Ubuntu 20.04 (focal) support

[tbaumann]

Mainly python3 pains.

Using Ubuntu rspamd because there is no upstream repo.

This partly fixes #789

Untested modules, those will likely still fail
- news
- git
- readlater
- blog
- ircbouncer
- xmpp
- owncloud
- vpn

[tbaumann]

I'm not sure I will continue to invest into this project. Ansible isn't my strength and I find this all quite rough around the edges. I think I go back to setting it up manually the way I like it.

[adborden]

Related: letsencrypt/cerbot is deprecating certbot-auto, so the manual installtion of depedencies here will be necessary on other distributions as well.

[adborden]

@tbaumann thank you for your efforts! I understand what you mean about the rough edges. As we've added support for newer distributions and features, I feel like there's been regressions in other places. Hopefully we can improve that soon.

I'm testing this out and I've hit a few snags. It could just be differences in our base images. I'm using Ubuntu 20.04 on Google Cloud. What were you testing on?

[tbaumann]

I used the cloud image from my vps provider.
I don't think it's significantly modified. And I ran Dist-Upgrade before

[tbaumann]

I think the issues I had to deal with are basically one of two categories.

Either different package sources or python3 snafu.

[tbaumann]

It's been a while. Rough around the edges was mostly that I wasn't confident that I pulled out all the hard coded credentials.
And the way users were added was beyond confusing to me.
Somehow they exist as passwd users but also in this SQL database. I never managed to log into the web portal.
And the way the SQL uses are inserted didn't inspire me with confidence that it's safe to run this task multiple times to add users.

Basically I decided that there is too much hidden complexity and that I'm better off doing it the traditional way.
But admittedly that task has been on my smelly pile of things to do ever since. So maybe I should have pushed through.

[adborden]

Ah, I see what you mean about the rough edges. Sovereign is pretty opinionated about how it does things, so you're giving up some flexibility in exchange for automated configuraiton.

In general, the playbook is idempotent*, so running it multiple times is fine, even encouraged because the idea is that running the playbook will get your instance into a known good state (at least in theory).

Re: users, sovereign creates one main OS user with SSH access. For mail, IRC, prosody, etc, sovereign creates virtual users. Out of the box, Postfix uses local users on the system, but sovereign configures it to use virtual users and mail domains from PostgreSQL.

* It's been a while but the wallbag/readlater role may not be idempotent, but running it multiple times will fail harmlessly.

[adborden]

I got stuck on the webserver role. PHP PEAR is not installed. Even after installing it, the pear task fails. This is a module in early preview state, so it's not really considered stable. I think we'll want to fall back to the command module, instead.

Is PEAR the only way to get php-mcrypt on focal?

[tbaumann]

Pear just seemed the easiest way. I guess the alternative would be to build the module locally.
Don't know though.