We package freeradius with our application and the combined package is ultimately put under source control on the installed host. When building everything on the build host, the default build creates the certificate files. Basically: freeradius/etc/raddb/certs/* So upgrades of our package include new cert files every time which ends up as a revision on the install host. Is there a way to configure the make to skip the generation of certs? Basically defer this step to a post upgrade process (one outside the source control). Bill
On 08/10/2023 21:37, Bill Schoolfield wrote:
We package freeradius with our application and the combined package is ultimately put under source control on the installed host.
When building everything on the build host, the default build creates the certificate files. Basically:
freeradius/etc/raddb/certs/*
So upgrades of our package include new cert files every time which ends up as a revision on the install host.
Is there a way to configure the make to skip the generation of certs? Basically defer this step to a post upgrade process (one outside the source control).
You don't say DEB or RPM, but if DEB you can edit debian/rules to delete the certs before packaging, and if RPM then do the same with redhat/freeradius.spec. An alternative option that I tend to do is to install the packages as-is but put your own config in e.g. /srv/raddb, then edit /etc/default/freeradius (or equivalent) to use the config from there rather than the default location (e.g. add "-d /srv/raddb" to the args). That way you can easily manage the config separately, and know the package will never ask any questions on upgrade about do you want to replace each config file that you've changed. -- Matthew
Thanks Matthew for the quick response... Good info. It's DEB but we may still end up supporting RH. Bill On 10/8/2023 3:59 PM, Matthew Newton via Freeradius-Users wrote:
On 08/10/2023 21:37, Bill Schoolfield wrote:
We package freeradius with our application and the combined package is ultimately put under source control on the installed host.
When building everything on the build host, the default build creates the certificate files. Basically:
freeradius/etc/raddb/certs/*
So upgrades of our package include new cert files every time which ends up as a revision on the install host.
Is there a way to configure the make to skip the generation of certs? Basically defer this step to a post upgrade process (one outside the source control).
You don't say DEB or RPM, but if DEB you can edit debian/rules to delete the certs before packaging, and if RPM then do the same with redhat/freeradius.spec.
An alternative option that I tend to do is to install the packages as-is but put your own config in e.g. /srv/raddb, then edit /etc/default/freeradius (or equivalent) to use the config from there rather than the default location (e.g. add "-d /srv/raddb" to the args).
That way you can easily manage the config separately, and know the package will never ask any questions on upgrade about do you want to replace each config file that you've changed.
On Oct 8, 2023, at 4:37 PM, Bill Schoolfield <bill@billmax.com> wrote:
We package freeradius with our application and the combined package is ultimately put under source control on the installed host.
When building everything on the build host, the default build creates the certificate files. Basically:
It creates the certs when building from source. When building packages, the build system sets the PACKAGE=y variable, and the certs aren't created. The certs are therefore not included in the package. The file debian/freeradius-config.postinst has a "make" rule to build the certs. But even that build process only creates the certs if they don't already exist. If you want to skip that step, just delete the debian/freeradius-config.postinst file before you build the debian packages. That way those rules don't be run, and there won't be any certs generated. Alan DeKok.
participants (3)
-
Alan DeKok -
Bill Schoolfield -
Matthew Newton