Re: [gentoo-dev] [PATCH 2/4] acct-user/jenkins: Add jenkins user, UID 473

[Michael Orlitzky]

On 12/26/19 8:28 AM, Thomas Deutschmann wrote:
> On 2019-12-26 12:04, Michael Orlitzky wrote:
>> On 12/25/19 10:11 AM, Thomas Deutschmann wrote:
>>> +ACCT_USER_HOME=/var/lib/jenkins
>> Needed?
>
> I cannot answer that for sure. In *my* setups I need a valid home for
> standard SSH setup (~/.ssh/authorized_keys). But there are dozen ways
> how you can run and use Jenkins...
>
> For myself I am probably not going to use Gentoo's acct-* stuff. While
> *I* need valid HOME for jenkins' user to get working SSH setup without
> any additional configuration I also store services in
> /srv/<server-instance> instead of /var/lib. I am still scared to death
> that when I change HOME (usermod) which is part of my Salt state
> (configuration management) that acct-* stuff will revert at some point
> and break dozen of clusters ;]
>

Unless you override acct-{user,group}/jenkins, you won't really be safe.
Every time the package is installed -- particularly, the first time --
it's going to clobber the existing user's settings. This is true for
everyone using Jenkins in those dozens of different ways.

So before you push this, I would figure out what you want the Jenkins
user to look like on your machine, and add an -r1 of acct-user/jenkins
in a local overlay that configures it how you want. At that point, you
can drop the usermod calls from your configuration management tools.

For the benefit of those other users, it would be extra nice if you
could document how to do all that. I recently had to do the same thing
for OpenDKIM, because the old instructions that were gave were being
wiped out on upgrades and reinstalls:

  https://wiki.gentoo.org/wiki/OpenDKIM#The_new_way

Then if the home directory is only needed by people who are going to be
overriding the acct-user ebuild anyway, you might as well leave
ACCT_USER_HOME at the default and let people set it in their overlays.