Add ensure_service helper and use across all deployers

Author: hpk42

cmdeploy/src/cmdeploy/basedeploy.py

@@ -163,6 +163,23 @@ def configure(self):
     def activate(self):
         pass
 
+    def ensure_service(self, service, running=True, enabled=True):
+        """Activate (or deactivate) a systemd service."""
+        if running:
+            verb = "Start and enable"
+        else:
+            verb = "Stop"
+        systemd.service(
+            name=f"{verb} {service}",
+            service=service,
+            running=running,
+            enabled=enabled,
+            restarted=self.need_restart if running else False,
+            daemon_reload=self.daemon_reload,
+        )
+        self.need_restart = False
+        self.daemon_reload = False
+
     def ensure_systemd_unit(self, src, **kwargs):
         """Install (or remove) a systemd unit file under ``/etc/systemd/system/``."""
         dest_name = src.split("/")[-1].replace(".j2", "")

cmdeploy/src/cmdeploy/deployers.py

@@ -27,7 +27,6 @@
     activate_remote_units,
     blocked_service_startup,
     configure_remote_units,
-    get_resource,
     has_systemd,
     is_in_container,
 )
@@ -208,13 +207,7 @@ def activate(self):
             ],
         )
 
-        systemd.service(
-            name="Start and enable unbound",
-            service="unbound.service",
-            running=True,
-            enabled=True,
-            restarted=self.need_restart,
-        )
+        self.ensure_service("unbound.service")
 
 
 class MtastsDeployer(Deployer):
@@ -225,11 +218,8 @@ def configure(self):
         self.remove_file("/etc/systemd/system/mta-sts-daemon.service")
 
     def activate(self):
-        systemd.service(
-            name="Stop MTA-STS daemon",
-            service="mta-sts-daemon.service",
-            # daemon_reload is tracked via self.remove_file() in configure()
-            daemon_reload=self.daemon_reload,
+        self.ensure_service(
+            "mta-sts-daemon.service",
             running=False,
             enabled=False,
         )
@@ -381,29 +371,18 @@ def configure(self):
         self.put_file("iroh-relay.toml", "/etc/iroh-relay.toml")
 
     def activate(self):
-        systemd.service(
-            name="Start and enable iroh-relay",
-            service="iroh-relay.service",
-            running=True,
+        self.ensure_service(
+            "iroh-relay.service",
             enabled=self.enable_iroh_relay,
-            restarted=self.need_restart,
         )
-        self.need_restart = False
 
 
 class JournaldDeployer(Deployer):
     def configure(self):
         self.put_file("journald.conf", "/etc/systemd/journald.conf")
 
     def activate(self):
-        systemd.service(
-            name="Start and enable journald",
-            service="systemd-journald.service",
-            running=True,
-            enabled=True,
-            restarted=self.need_restart,
-        )
-        self.need_restart = False
+        self.ensure_service("systemd-journald.service")
 
 
 class ChatmailVenvDeployer(Deployer):
@@ -492,12 +471,7 @@ def install(self):
         )
 
     def activate(self):
-        systemd.service(
-            name="Start and enable fcgiwrap",
-            service="fcgiwrap.service",
-            running=True,
-            enabled=True,
-        )
+        self.ensure_service("fcgiwrap.service")
 
 
 class GithashDeployer(Deployer):

cmdeploy/src/cmdeploy/dovecot/deployer.py

@@ -5,7 +5,7 @@
 from pyinfra import host
 from pyinfra.facts.deb import DebPackages
 from pyinfra.facts.server import Arch, Command, Sysctl
-from pyinfra.operations import apt, files, server, systemd
+from pyinfra.operations import apt, files, server
 
 from cmdeploy.basedeploy import (
     Deployer,
@@ -60,19 +60,17 @@ def install(self):
                 self.need_restart = True
         files.put(
             name="Pin dovecot packages to block Debian dist-upgrades",
-            src=io.StringIO(
-                "Package: dovecot-*\n"
-                "Pin: version *\n"
-                "Pin-Priority: -1\n"
-            ),
+            src=io.StringIO("Package: dovecot-*\nPin: version *\nPin-Priority: -1\n"),
             dest="/etc/apt/preferences.d/pin-dovecot",
             user="root",
             group="root",
             mode="644",
         )
 
     def configure(self):
-        self.daemon_reload |= configure_remote_units(self.config.mail_domain, self.units)
+        self.daemon_reload |= configure_remote_units(
+            self.config.mail_domain, self.units
+        )
         _configure_dovecot(self, self.config)
 
     def activate(self):
@@ -89,19 +87,12 @@ def activate(self):
             if stale == "STALE":
                 self.need_restart = True
 
-        restart = False if self.disable_mail else self.need_restart
-
-        systemd.service(
-            name="Disable dovecot for now"
-            if self.disable_mail
-            else "Start and enable Dovecot",
-            service="dovecot.service",
-            running=False if self.disable_mail else True,
-            enabled=False if self.disable_mail else True,
-            restarted=restart,
-            daemon_reload=self.daemon_reload,
+        active = not self.disable_mail
+        self.ensure_service(
+            "dovecot.service",
+            running=active,
+            enabled=active,
         )
-        self.need_restart = False
 
 
 def _pick_url(primary, fallback):

cmdeploy/src/cmdeploy/external/deployer.py

@@ -39,21 +39,18 @@ def configure(self):
         )
 
     def activate(self):
-        systemd.service(
-            name="Setup tls-cert-reload path watcher",
-            service="tls-cert-reload.path",
+        # No explicit reload needed here: dovecot/nginx read the cert
+        # on startup, and the .path watcher handles live changes.
+        self.ensure_service(
+            "tls-cert-reload.path",
             running=self.enabled,
             enabled=self.enabled,
-            restarted=self.need_restart,
-            daemon_reload=self.daemon_reload,
         )
         if not self.enabled:
-            systemd.service(
-                name="Stop tls-cert-reload.service",
-                service="tls-cert-reload.service",
+            self.ensure_service(
+                "tls-cert-reload.service",
                 running=False,
                 enabled=False,
-                daemon_reload=self.daemon_reload,
             )
 
 

cmdeploy/src/cmdeploy/filtermail/deployer.py

@@ -1,5 +1,5 @@
 from pyinfra import facts, host
-from pyinfra.operations import files, systemd
+from pyinfra.operations import files
 
 from cmdeploy.basedeploy import Deployer
 
@@ -34,12 +34,4 @@ def configure(self):
 
     def activate(self):
         for service in self.services:
-            systemd.service(
-                name=f"Start and enable {service}",
-                service=f"{service}.service",
-                running=True,
-                enabled=True,
-                restarted=self.need_restart,
-                daemon_reload=self.daemon_reload,
-            )
-        self.need_restart = False
+            self.ensure_service(f"{service}.service")

cmdeploy/src/cmdeploy/mtail/deployer.py

@@ -1,5 +1,5 @@
 from pyinfra import facts, host
-from pyinfra.operations import apt, server, systemd
+from pyinfra.operations import apt, server
 
 from cmdeploy.basedeploy import Deployer
 
@@ -42,11 +42,5 @@ def configure(self):
         self.put_file("mtail/delivered_mail.mtail", "/etc/mtail/delivered_mail.mtail")
 
     def activate(self):
-        systemd.service(
-            name="Start and enable mtail",
-            service="mtail.service",
-            running=bool(self.mtail_address),
-            enabled=bool(self.mtail_address),
-            restarted=self.need_restart,
-        )
-        self.need_restart = False
+        active = bool(self.mtail_address)
+        self.ensure_service("mtail.service", running=active, enabled=active)

cmdeploy/src/cmdeploy/nginx/deployer.py

@@ -1,5 +1,5 @@
 from chatmaild.config import Config
-from pyinfra.operations import apt, files, systemd
+from pyinfra.operations import apt
 
 from cmdeploy.basedeploy import (
     Deployer,
@@ -44,14 +44,7 @@ def configure(self):
         _configure_nginx(self, self.config)
 
     def activate(self):
-        systemd.service(
-            name="Start and enable nginx",
-            service="nginx.service",
-            running=True,
-            enabled=True,
-            restarted=self.need_restart,
-        )
-        self.need_restart = False
+        self.ensure_service("nginx.service")
 
 
 def _configure_nginx(deployer, config: Config, debug: bool = False):

cmdeploy/src/cmdeploy/opendkim/deployer.py

@@ -4,7 +4,7 @@
 
 from pyinfra import host
 from pyinfra.facts.files import File
-from pyinfra.operations import apt, files, server, systemd
+from pyinfra.operations import apt, files, server
 
 from cmdeploy.basedeploy import Deployer
 
@@ -85,12 +85,4 @@ def configure(self):
         )
 
     def activate(self):
-        systemd.service(
-            name="Start and enable OpenDKIM",
-            service="opendkim.service",
-            running=True,
-            enabled=True,
-            daemon_reload=self.daemon_reload,
-            restarted=self.need_restart,
-        )
-        self.need_restart = False
+        self.ensure_service("opendkim.service")

cmdeploy/src/cmdeploy/postfix/deployer.py

@@ -1,4 +1,4 @@
-from pyinfra.operations import apt, server, systemd
+from pyinfra.operations import apt, server
 
 from cmdeploy.basedeploy import Deployer
 
@@ -67,16 +67,9 @@ def configure(self):
             )
 
     def activate(self):
-        restart = False if self.disable_mail else self.need_restart
-
-        systemd.service(
-            name="disable postfix for now"
-            if self.disable_mail
-            else "Start and enable Postfix",
-            service="postfix.service",
-            running=False if self.disable_mail else True,
-            enabled=False if self.disable_mail else True,
-            restarted=restart,
-            daemon_reload=self.daemon_reload,
+        active = not self.disable_mail
+        self.ensure_service(
+            "postfix.service",
+            running=active,
+            enabled=active,
         )
-        self.need_restart = False