feat(sysadmin-tools): generate only en and it locales #41

Merged

claudiomaradonna merged 1 commit from feat/sysadmin-locale into main

2026-10-17 16:05:48 +02:00

motoko commented

2026-10-17 16:04:31 +02:00

Collaborator

Why

Hosts keep whatever locales their installer or image left in
/etc/locale.gen, so locale-gen is slow on some and the archive
holds locales nobody uses, while the default language differs from host
to host. The fleet needs English, with Italian as the fallback.

What changed

On every Debian-family host in the Linux play of fortify.yml,
sysadmin-tools writes /etc/locale.gen whole with en_US.UTF-8,
en_GB.UTF-8 and it_IT.UTF-8, installing locales if needed, and
runs locale-gen at once when the file changed, which drops every
other generated locale.
/etc/default/locale sets LANG=en_US.UTF-8 and
LANGUAGE=en_US:en:it_IT:it.
A tenant overrides all three per host or group with
sysadmin_locales, sysadmin_locale_lang and
sysadmin_locale_language; see the role README.
sysadmin-tools gains its first molecule scenario, in
MOLECULE_ROLES.

Out of scope: removing locales-all, and dpkg path-exclude rules for
translations and man pages.

How to verify

./tests/molecule/run.sh roles/sysadmin-tools: the scenario
generates de_DE.UTF-8 first, then asserts locale -a lists only
C, C.utf8, POSIX and the three locales, checks
/etc/default/locale, and passes idempotence.
Already run on this commit's tree: make verify (check and every
scenario, with podman) exit 0, no ^ERROR in any molecule log; the
same scenario on main's code fails at "Assert only English and
Italian are generated", with de_DE.utf8 left.
Before a live run: ansible-playbook fortify.yml -i inventory/<tenant>/ --tags sysadmin-tools --check --diff.

Considerations

Blast radius: every Linux host loses its other generated locales. A
user, service or SSH client forwarding one gets "cannot change locale"
warnings and falls back to C; services switch to English when they
start after systemd re-reads /etc/default/locale, at the latest
after the next boot. SSH, the firewall and the network are untouched,
so nothing can be locked out.
On Ubuntu, locale-gen also generates what language packs list in
/var/lib/locales/supported.d; a host with locales-all keeps every
prebuilt locale. Both are documented, not handled.
Low review findings set aside: "only" in the sysadmin_locales entry
and the ARCHITECTURE row reads loosely given those two exceptions, and
a few README wording and wrap nits.

## Why Hosts keep whatever locales their installer or image left in `/etc/locale.gen`, so `locale-gen` is slow on some and the archive holds locales nobody uses, while the default language differs from host to host. The fleet needs English, with Italian as the fallback. ## What changed - On every Debian-family host in the Linux play of `fortify.yml`, `sysadmin-tools` writes `/etc/locale.gen` whole with `en_US.UTF-8`, `en_GB.UTF-8` and `it_IT.UTF-8`, installing `locales` if needed, and runs `locale-gen` at once when the file changed, which drops every other generated locale. - `/etc/default/locale` sets `LANG=en_US.UTF-8` and `LANGUAGE=en_US:en:it_IT:it`. - A tenant overrides all three per host or group with `sysadmin_locales`, `sysadmin_locale_lang` and `sysadmin_locale_language`; see the role README. - `sysadmin-tools` gains its first molecule scenario, in `MOLECULE_ROLES`. Out of scope: removing `locales-all`, and dpkg `path-exclude` rules for translations and man pages. ## How to verify - `./tests/molecule/run.sh roles/sysadmin-tools`: the scenario generates `de_DE.UTF-8` first, then asserts `locale -a` lists only `C`, `C.utf8`, `POSIX` and the three locales, checks `/etc/default/locale`, and passes idempotence. - Already run on this commit's tree: `make verify` (check and every scenario, with podman) exit 0, no `^ERROR` in any molecule log; the same scenario on main's code fails at "Assert only English and Italian are generated", with `de_DE.utf8` left. - Before a live run: `ansible-playbook fortify.yml -i inventory/<tenant>/ --tags sysadmin-tools --check --diff`. ## Considerations - Blast radius: every Linux host loses its other generated locales. A user, service or SSH client forwarding one gets "cannot change locale" warnings and falls back to `C`; services switch to English when they start after systemd re-reads `/etc/default/locale`, at the latest after the next boot. SSH, the firewall and the network are untouched, so nothing can be locked out. - On Ubuntu, `locale-gen` also generates what language packs list in `/var/lib/locales/supported.d`; a host with `locales-all` keeps every prebuilt locale. Both are documented, not handled. - Low review findings set aside: "only" in the `sysadmin_locales` entry and the ARCHITECTURE row reads loosely given those two exceptions, and a few README wording and wrap nits.

motoko added 1 commit

2026-10-17 16:04:33 +02:00

feat(sysadmin-tools): generate only en and it locales f0a258eba8

On Debian-family hosts, sysadmin-tools now writes /etc/locale.gen
whole with en_US.UTF-8, en_GB.UTF-8 and it_IT.UTF-8 and runs
locale-gen at once when it changes, dropping every locale it does not
list, except those locales-all or Ubuntu's language packs provide.
/etc/default/locale defaults to English with Italian as the fallback.
sysadmin_locales and the two defaults override per host or group.

The role gets its first molecule scenario, which joins MOLECULE_ROLES;
locales joins the packages the test image downloads.

claudiomaradonna merged commit f0a258eba8 into main

2026-10-17 16:05:48 +02:00

claudiomaradonna deleted branch feat/sysadmin-locale

2026-10-17 16:05:53 +02:00

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

claudiomaradonna/castrum!41

No description provided.

Rows
Columns