feat: full rootless setup (#165)

* use local devtools configs instead of global ones

* make docker image rootless

* add migration notes

* fix setup command

* fix regress jo

docs/architecture.rst

@@ -116,7 +116,7 @@ Filesystem tree
 
 The application supports two types of trees, one is for the legacy configuration (when there were no explicit repository name configuration available) and another one is the new-style tree. This document describes only new-style tree in order to avoid deprecated structures.
 
-Having default root as ``/var/lib/ahriman`` (differs from container though), the directory structure is the following:
+Having default root as ``/var/lib/ahriman``, the directory structure is the following:
 
 .. code-block::
 

docs/faq/docker.rst

@@ -22,6 +22,12 @@ In order to make data available outside of container, you would need to mount lo
 
    docker run --privileged -v /path/to/local/repo:/var/lib/ahriman -v /path/to/overrides/overrides.ini:/etc/ahriman.ini.d/10-overrides.ini arcan1s/ahriman:latest
 
+The volume must have correct rights, e.g.:
+
+.. code-block:: shell
+
+   chown 643:643 /path/to/local/repo
+
 The action can be specified during run, e.g.:
 
 .. code-block:: shell
@@ -59,19 +65,17 @@ The following environment variables are supported:
 
 * ``AHRIMAN_ARCHITECTURE`` - architecture of the repository, default is ``x86_64``.
 * ``AHRIMAN_DEBUG`` - if set all commands will be logged to console.
-* ``AHRIMAN_FORCE_ROOT`` - force run ahriman as root instead of guessing by subcommand.
 * ``AHRIMAN_HOST`` - host for the web interface, default is ``0.0.0.0``.
 * ``AHRIMAN_MULTILIB`` - if set (default) multilib repository will be used, disabled otherwise.
 * ``AHRIMAN_OUTPUT`` - controls logging handler, e.g. ``syslog``, ``console``. The name must be found in logging configuration. Note that if ``syslog`` handler is used you will need to mount ``/dev/log`` inside container because it is not available there.
 * ``AHRIMAN_PACKAGER`` - packager name from which packages will be built, default is ``ahriman bot <ahriman@example.com>``.
 * ``AHRIMAN_PACMAN_MIRROR`` - override pacman mirror server if set.
 * ``AHRIMAN_PORT`` - HTTP server port if any, default is empty.
-* ``AHRIMAN_POSTSETUP_COMMAND`` - if set, the command which will be called (as root) after the setup command, but before any other actions.
-* ``AHRIMAN_PRESETUP_COMMAND`` - if set, the command which will be called (as root) right before the setup command.
+* ``AHRIMAN_POSTSETUP_COMMAND`` - if set, the command which will be called after the setup command, but before any other actions.
+* ``AHRIMAN_PRESETUP_COMMAND`` - if set, the command which will be called right before the setup command.
 * ``AHRIMAN_REPOSITORY`` - repository name, default is ``aur``.
 * ``AHRIMAN_REPOSITORY_SERVER`` - optional override for the repository URL. Useful if you would like to download packages from remote instead of local filesystem.
-* ``AHRIMAN_REPOSITORY_ROOT`` - repository root. Because of filesystem rights it is required to override default repository root. By default, it uses ``ahriman`` directory inside ahriman's home, which can be passed as mount volume.
-* ``AHRIMAN_UNIX_SOCKET`` - full path to unix socket which is used by web server, default is empty. Note that more likely you would like to put it inside ``AHRIMAN_REPOSITORY_ROOT`` directory (e.g. ``/var/lib/ahriman/ahriman/ahriman-web.sock``) or to ``/run/ahriman``.
+* ``AHRIMAN_UNIX_SOCKET`` - full path to unix socket which is used by web server, default is empty. Note that more likely you would like to put it inside repository root directory (e.g. ``/var/lib/ahriman/ahriman-web.sock``) or to ``/run/ahriman``.
 * ``AHRIMAN_USER`` - ahriman user, usually must not be overwritten, default is ``ahriman``.
 * ``AHRIMAN_VALIDATE_CONFIGURATION`` - if set (default) validate service configuration.
 
@@ -99,7 +103,7 @@ For that you would need to have web container instance running forever; it can b
 
 .. code-block:: shell
 
-   docker run --privileged -p 8080:8080 -e AHRIMAN_PORT=8080 -e AHRIMAN_UNIX_SOCKET=/var/lib/ahriman/ahriman/ahriman-web.sock -v /path/to/local/repo:/var/lib/ahriman arcan1s/ahriman:latest
+   docker run --privileged -p 8080:8080 -e AHRIMAN_PORT=8080 -e AHRIMAN_UNIX_SOCKET=/var/lib/ahriman/ahriman-web.sock -v /path/to/local/repo:/var/lib/ahriman arcan1s/ahriman:latest
 
 Note about ``AHRIMAN_PORT`` environment variable which is required in order to enable web service. An additional port bind by ``-p 8080:8080`` is required to pass docker port outside of container.
 
@@ -109,7 +113,7 @@ If you are using ``AHRIMAN_UNIX_SOCKET`` variable, for every next container run
 
 .. code-block:: shell
 
-   docker run --privileged -e AHRIMAN_UNIX_SOCKET=/var/lib/ahriman/ahriman/ahriman-web.sock -v /path/to/local/repo:/var/lib/ahriman arcan1s/ahriman:latest
+   docker run --privileged -e AHRIMAN_UNIX_SOCKET=/var/lib/ahriman/ahriman-web.sock -v /path/to/local/repo:/var/lib/ahriman arcan1s/ahriman:latest
 
 Otherwise, you would need to pass ``AHRIMAN_PORT`` and mount container network to the host system (``--net=host``), e.g.:
 
@@ -128,7 +132,7 @@ In order to create configuration for additional repositories, the ``AHRIMAN_POST
 
 .. code-block:: shell
 
-   docker run --privileged -p 8080:8080 -e AHRIMAN_PORT=8080 -e AHRIMAN_UNIX_SOCKET=/var/lib/ahriman/ahriman/ahriman-web.sock -e AHRIMAN_POSTSETUP_COMMAND="ahriman --architecture x86_64 --repository aur-v2 service-setup --build-as-user ahriman --packager 'ahriman bot <ahriman@example.com>'" -v /path/to/local/repo:/var/lib/ahriman arcan1s/ahriman:latest
+   docker run --privileged -p 8080:8080 -e AHRIMAN_PORT=8080 -e AHRIMAN_UNIX_SOCKET=/var/lib/ahriman/ahriman-web.sock -e AHRIMAN_POSTSETUP_COMMAND="ahriman --architecture x86_64 --repository aur-v2 service-setup --build-as-user ahriman --packager 'ahriman bot <ahriman@example.com>'" -v /path/to/local/repo:/var/lib/ahriman arcan1s/ahriman:latest
 
 The command above will also create configuration for the repository named ``aur-v2``.
 

docs/faq/non-x86_64-setup.rst

@@ -55,6 +55,13 @@ There are two possible ways to achieve same setup, by using docker container. Th
 
       FROM arcan1s/ahriman:latest
 
+#.
+   Switch to ``root`` user:
+
+   .. code-block:: dockerfile
+
+      USER root
+
 #.
    Init pacman keys. This command is required in order to populate distribution keys:
 
@@ -78,12 +85,16 @@ There are two possible ways to achieve same setup, by using docker container. Th
 
       FROM arcan1s/ahriman:latest
 
+      USER root
+
       RUN pacman-key --init
 
       RUN pacman --noconfirm -Sy wget
       RUN wget https://pool.mirror.archlinux32.org/i686/extra/devtools-20221208-1.2-any.pkg.tar.zst && pacman --noconfirm -U devtools-20221208-1.2-any.pkg.tar.zst
       RUN wget https://pool.mirror.archlinux32.org/i686/core/archlinux32-keyring-20230705-1.0-any.pkg.tar.zst && pacman --noconfirm -U archlinux32-keyring-20230705-1.0-any.pkg.tar.zst
 
+      USER ahriman
+
 #.
    After that you can build you own container, e.g.:
 

docs/migrations/2.22.0.rst

@@ -0,0 +1,54 @@
+To 2.22.0
+---------
+
+This release stores newly generated configuration files in the repository root and changes the docker image to run as the ``ahriman`` user. Existing system-wide configuration files remain supported, so regular installations do not require manual intervention. Docker installations require data migration.
+
+Regular installation
+^^^^^^^^^^^^^^^^^^^^
+
+Newly generated ahriman and devtools configuration files are stored below ``/var/lib/ahriman/.config/ahriman`` instead of system-wide configuration directories. Existing configurations continue to work without any changes.
+
+However, it is recommended to migrate to the new configuration schema by doing the following steps:
+
+#.
+   Stop all ahriman services.
+
+#.
+   Remove the old generated configuration files. For example, for repository ``aur`` and architecture ``x86_64``:
+
+   .. code-block:: shell
+
+      sudo rm /etc/ahriman.ini.d/00-setup-overrides-x86_64-aur.ini
+      sudo rm /usr/share/devtools/pacman.conf.d/aur-x86_64.conf
+
+   Repeat this step for every configured repository. Do not remove manually maintained configuration overrides.
+
+#.
+   Run setup command (i.e. ``ahriman service-setup``) again with the same arguments as used before as the ``ahriman`` user.
+
+#.
+   Start the services again.
+
+Docker installation
+^^^^^^^^^^^^^^^^^^^
+
+The repository root inside the Docker image has changed from ``/var/lib/ahriman/ahriman`` to ``/var/lib/ahriman``. Existing repository contents must therefore be moved one directory level up, and the volume must be owned by the ``ahriman`` user.
+
+#.
+   Stop all containers using the repository volume and create a backup.
+
+#.
+   Run a one-off container which mounts the existing volume. Replace ``VOLUME`` with the named volume or bind mount used by the installation:
+
+   .. code-block:: shell
+
+      docker run --rm --user root --entrypoint bash \
+          --volume VOLUME:/var/lib/ahriman \
+          arcan1s/ahriman:latest \
+          -c 'find /var/lib/ahriman/ahriman -mindepth 1 -maxdepth 1 -exec mv -t /var/lib/ahriman -- {} + && rmdir /var/lib/ahriman/ahriman && chown ahriman:ahriman /var/lib/ahriman'
+
+#.
+   Update custom configuration and container arguments which refer to ``/var/lib/ahriman/ahriman``. The new path is ``/var/lib/ahriman``.
+
+#.
+   Start the containers again.

docs/migrations/index.rst

@@ -12,3 +12,4 @@ Upgrades to breakpoints
    2.9.0
    2.12.0
    2.16.0
+   2.22.0