all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe7d:68e4
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 938d3e6b-aee5-42b0-a154-40259b449da8
        host_id: dc6e70e9c8a632db314ad904d19835ae509ec2b306670431b28f35fc
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe7d:68e4
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.7.203
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.193.40
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe7d:68e4
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job flake8 explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#32>'
      - '<Job flake8 explicit: None implied: None source: osism/release/.zuul.yaml@main#2>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: 6e1427de47e24f1c943ad467f5fb87e7
      build_refs:
      - branch: main
        change: '2419'
        change_message: "chore(deps): update dependency debops.debops to v3.3.0\n\n>
          \u2139\uFE0F **Note**\n> \n> This PR body was truncated due to platform
          limits.\n\nThis PR contains the following updates:\n\n| Package | Update
          | Change |\n|---|---|---|\n| [debops.debops](https://redirect.github.com/debops/debops)
          | minor | `3.2.5` \u2192 `3.3.0` |\n\n---\n\n### Release Notes\n\n<details>\n<summary>debops/debops
          (debops.debops)</summary>\n\n### [`v3.3.0`](https://redirect.github.com/debops/debops/blob/HEAD/CHANGELOG.rst#debops-v330---2026-03-13)\n\n[Compare
          Source](https://redirect.github.com/debops/debops/compare/v3.2.6...v3.3.0)\n\n..
          \\_debops v3.3.0: <https://github.com/debops/debops/compare/v3.2.0...v3.3.0>\n\nAdded\n\n```\n\nNew
          DebOps roles\n''''''''''''''''\n\n- The :ref:`debops.nixos` role with its
          corresponding playbook can be used to\n  manage NixOS-based hosts. The role
          is not included in the main\n  :file:`site.yml` playbook, which is focused
          on Debian/Ubuntu hosts.\n\n- The :ref:`debops.influxdb2` role can be used
          to install and configure\n  `InfluxDB v2.x`__ time-series database.\n\n
          \ .. __: https://www.influxdata.com/products/influxdb/\n\n- The :ref:`debops.pgbadger`
          role can be used to generate PostgreSQL log\n  reports from local or remote
          hosts over SSH.\n\n:ref:`debops.core` role\n'''''''''''''''''''''''\n\n-
          A new local fact, ``ansible_local.core.is_64bits``, can be used to determine\n
          \ if the current system supports 32-bit or 64-bit architecture.\n\n:ref:`debops.dovecot`
          role\n''''''''''''''''''''''''''\n\n- The role now supports `iterate_filter`
          for its LDAP configuration, allowing\n  :command:`doveadm` commands to iterate
          over all users. Note that you might\n  have to adjust the defaults for the
          :envvar:`dovecot__ldap_user_list_filter`\n  variable if you use the :envvar:`dovecot__ldap_user_filter`
          variable.\n\n:ref:`debops.ipxe` role\n'''''''''''''''''''''''\n\n- Debian
          13 (Trixie) has been released, support for its installer has been added\n
          \ to the role. Debian Trixie is now the primary Stable release available
          in the\n  netboot installation menu.\n\n:ref:`debops.netbox` role\n'''''''''''''''''''''''''\n\n-
          Starting with NetBox ``v3.4.9``, anonymized reporting of census data is
          being\n  enabled by default. DebOps respects this upstream default. You
          can change it\n  using :envvar:`netbox__config_census_reporting`.\n\n- The
          role can be used with NetBox deployed in a clustered PostgreSQL setup\n
          \ with primary/standby nodes.\n\n:ref:`debops.nginx` role\n''''''''''''''''''''''''\n\n-
          Different file templates used in the role can now be overridden by the users\n
          \ with the DebOps template override system and the ``template_src`` lookup\n
          \ plugin.\n\n:ref:`debops.preseed` role\n''''''''''''''''''''''''''\n\n-
          The role will now generate preseed templates for Debian 13 (Trixie)\n  automated
          installation.\n\n:ref:`debops.resolved` role\n'''''''''''''''''''''''''''\n\n-
          The role will add a new entry in the :file:`/etc/services` database (using\n
          \ the :ref:`debops.etc_services` role) for the ``5355`` TCP and UDP ports,\n
          \ reserved for the `Link-Local Multicast Name Resolution`__. This should
          help\n  with identification of unknown TCP/UDP ports of the listening services.\n\n
          \ .. __: https://en.wikipedia.org/wiki/Link-Local_Multicast_Name_Resolution\n\nChanged\n```\n\nUpdates
          of upstream application versions\n''''''''''''''''''''''''''''''''''''''''\n\n-
          In the :ref:`debops.netbox` role, the NetBox version has been updated to\n
          \ `v4.4.1`.\n\n- In the :ref:`debops.ipxe` role, the Debian Bookworm installer
          has been\n  updated to v12.12.\n\nGeneral\n'''''''\n\n- The :ref:`debops.root_account`,
          :ref:`debops.system_users` and\n  :ref:`debops.users` roles are now able
          to handle the symlinked\n  :file:`~/.ssh/authorized_keys` files correctly
          using optional `follow`\n  parameter.\n\n- The DebOps CI pipeline in GitHub
          Actions is improved and will be executed on\n  pull requests and pushes
          to test changes before merging them.\n\n- The :command:`debops` script and
          custom Ansible lookup plugins should now be\n  compatible with Python 3.12+
          due to removal of the `distutils` Python\n  dependency, replaced by the
          `packaging` Python module.\n\n- References to the old `debops.roleXX` Ansible
          Collections have been removed\n  from all playbooks, since the project is
          now contained in a single Ansible\n  Collection.\n\n:ref:`debops.apt` role\n''''''''''''''''''''''\n\n-
          The Debian 10 (Buster) release has been archived and removed from Debian\n
          \ mirrors. The role will use <https://archive.debian.org/debian> as the\n
          \ repository URL on Debian Buster hosts.\n\n- The role now can manage repository
          GPG keys directly, stored in the\n  :file:`/etc/apt/keyrings/` directory,
          bypassing the deprecated\n  `ansible.builtin.apt_key` module. Support for
          the Ansible module is\n  present, but needs to be enabled explicitly.\n\n
          \ Existing role configuration might need to be updated to support new changes,\n
          \ check the role documentation for details.\n\n:ref:`debops.gitlab` role\n'''''''''''''''''''''''''\n\n-
          Users can now select specific GitLab version to install using the APT\n
          \ preferences, by specifying the package version in the\n  :envvar:`gitlab__preferred_version`
          variable. By default, the latest version\n  will be installed.\n\n- The
          :command:`nginx` service inside of the GitLab Omnibus installation will\n
          \ be restarted when X.509 certificates managed by the :ref:`debops.pki`
          role\n  are reissued, for example via ACME.\n\n:ref:`debops.gitlab_runner`
          role\n''''''''''''''''''''''''''''''''\n\n- The role is now compatible with
          GitLab 17.x and newer releases.\n\n- The runner registration method has
          changed, see the role documentation for\n  details.\n\n:ref:`debops.keyring`
          role\n''''''''''''''''''''''''''\n\n- The role now can manage repository
          GPG keys directly, stored in the\n  :file:`/etc/apt/keyrings/` directory,
          bypassing the deprecated\n  `ansible.builtin.apt_key` module. Support for
          the Ansible module is\n  present, but needs to be enabled explicitly.\n\n
          \ Existing role configuration might need to be updated to support new changes,\n
          \ check the role documentation for details.\n\n:ref:`debops.nginx` role\n''''''''''''''''''''''''\n\n-
          The custom :command:`systemd` override that ensures that the :command:`nginx`\n
          \ service is started after network is available will be installed only on
          older\n  Debian/Ubuntu releases; it's now the default since Debian Bookworm.\n\n:ref:`debops.pki`
          role\n''''''''''''''''''''''\n\n- The default key type in :command:`certbot`
          is set to RSA, since currently\n  there's no support for different key types
          in DebOps PKI infrastructure.\n\n- The permission of the :file:`config/environment`
          configuration file in PKI\n  realms will be se to `0644` so that other UNIX
          accounts can read it. This is\n  needed by the :command:`acme-tiny` command
          which is executed on a separate\n  UNIX account.\n\n:ref:`debops.postgresql_server`
          role\n''''''''''''''''''''''''''''''''''''\n\n- The role can now support
          `pgBadger`\\_\\_ log analyzer by enabling verbose log\n  output and modifying
          access to the log files themselves in the\n  :file:`/var/log/postgresql/`
          directory. This functionality is disabled by\n  default and can be enabled
          using a role variable.\n\n  .. \\_\\_: <https://pgbadger.darold.net/>\n\n-
          The default log ident string is changed to `postgresql-<version>-<name>`
          to\n  better distinguish different PostgreSQL instances in the system logs.\n\n:ref:`debops.reprepro`
          role\n'''''''''''''''''''''''''''\n\n- The role now configures local APT
          repositories for Debian 13 (Trixie) and\n  Debian 14 (Forky) by default.
          Configuration for Debian Buster repositories\n  has been removed. Symlinks
          for the :file:`stable/`, :file:`oldstable/` and\n  :file:`oldoldstable/`
          releases will be updated automatically to point to the\n  correct Debian
          releases.\n\n:ref:`debops.resources` role\n''''''''''''''''''''''''''''\n\n-
          The :command:`git` repositories will be processed by the role first, since\n
          \ :command:`git` can handle directory creation if needed.\n\n:ref:`debops.rspamd`
          role\n'''''''''''''''''''''''''\n\n- Due to the `removal`\\_\\_ of the `distutils`
          Python module from Python v3.12,\n  custom scripts included in the role
          which create and update DKIM keys have\n  been updated to use the `shutil`
          module instead.\n\n  .. \\_\\_: <https://docs.python.org/3.11/whatsnew/3.10.html#distutils-deprecated>\n\n:ref:`debops.snmpd`
          role\n''''''''''''''''''''''''\n\n- The :file:`snmpd.service` configuration
          file provided in the role will ensure\n  that the :command:`snmpd` daemon
          is restarted on failure. Older versions of\n  :command:`snmpd` can `fail
          due to rapid changes in network interfaces`\\_\\_.\n\n  .. \\_\\_: <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1023656>\n\n:ref:`debops.yadm`
          role\n'''''''''''''''''''''''\n\n- The paths to the repositories that are
          safe to clone by the :command:`git`\n  command, used for dotfiles by the
          :ref:`debops.system_users` and\n  :ref:`debops.users` roles, will be defined
          in the :file:`/etc/gitconfig`\n  system-wide configuration file instead
          of the per-user :file:`~/.gitconfig`\n  configuration files. This avoids
          the issue of modifying per-user environment\n  from the system-wide level
          on which DebOps operates and ensires that the\n  cloned dotfiles are not
          modified. The specific tasks that do this have been\n  moved from the :ref:`debops.system_users`
          and :ref:`debops.users` role into\n  the :ref:`debops.yadm` role.\n\nFixed\n\n```\n\nGeneral\n'''''''\n\n-
          The :ref:`debops.system_users` and the :ref:`debops.users` roles will add
          the\n  dotfiles repository cloned by the ``root`` UNIX account in the\n
          \ :ref:`debops.yadm` role to the list of trusted :command:`git` repositories
          in\n  the :file:`~/.gitconfig` configuration file of each user account managed
          by\n  the role. This is needed to allow :command:`git` to clone local repositories\n
          \ not owned by the UNIX account, required by the mitigation of the\n  `CVE-2022-24765`__
          security vulnerability.\n\n  .. __: https://github.blog/open-source/git/git-security-vulnerability-announced/#cve-2022-24765\n\n-
          The :command:`debops` script will not try to download the required Ansible\n
          \ Collections during new project creation if the :command:`ansible-galaxy`\n
          \ command is not available in the user's ``$PATH``.\n\n- The :file:`tools/dist-upgrade.yml`
          playbook will not fail anymore during\n  :file:`/etc/services` database
          assembly if no upgrade was performed.\n\n- New DebOps project directories
          will use fixed Ansible configuration for\n  callback plugins and will default
          to a YAML output format of the playbook\n  results.\n\n:ref:`debops.apache`
          role\n'''''''''''''''''''''''''\n\n- Fixed an issue with the vhost ``state:
          \"absent\"`` parameter not working\n  correctly when the ``enabled: False``
          parameter was not set as well.\n\n:ref:`debops.docker_gen` role\n'''''''''''''''''''''''''''''\n\n-
          Flattened the list of directories that are created by the ``file`` task.
          This\n  should fix the issue of Ansible stopping during execution due to
          nested lists\n  in the ``loop`` keyword.\n\n:ref:`debops.dropbear_initramfs`
          role\n'''''''''''''''''''''''''''''''''''''\n\n- The role now supports both
          the old and the new location if the initramfs\n  configuration files.\n\n:ref:`debops.ferm`
          role\n'''''''''''''''''''''''\n\n- The role will restart the :command:`fail2ban`
          service instead of reloading\n  it, which will ensure that the custom rules
          are re-added when the\n  :command:`ferm` service is restarted.\n\n- Fixed
          an issue with the role failing if the :envvar:`ferm__parsed_rules`\n  variable
          is not defined correctly. The role will skip rule generation in such\n  case
          instead of failing with the \"AnsibleUndefined\" error message.\n\n:ref:`debops.ifupdown`
          role\n'''''''''''''''''''''''''''\n\n- The :file:`iface@.service` :command:`systemd`
          unit provided by the role is\n  changed to use ``After==sys-subsystem-net-devices-%i.device``
          parameter. This\n  should ensure that the bridge interfaces are correctly
          started at boot time.\n\n:ref:`debops.netbox` role\n'''''''''''''''''''''''''\n\n-
          Fixed an issue with the Django superuser creation task that failed execution\n
          \ if the ``error`` string was not present in command output; this resulted
          in\n  an incomplete installation.\n\n:ref:`debops.nullmailer` role\n'''''''''''''''''''''''''''''\n\n-
          The role will avoid interacting with the LDAP server when LDAP support is\n
          \ disabled while DebOps is used in LDAP environment.\n\n:ref:`debops.owncloud`
          role\n'''''''''''''''''''''''''''\n\n- Fixed conditional logic in a task
          which determines if the \"autosetup\"\n  operation should be performed during
          Nextcloud/ownCloud installation.\n\n:ref:`debops.pki` role\n''''''''''''''''''''''\n\n-
          The Let's Encrypt service dropped support for the ``contacts`` option. This\n
          \ requires a new version of the :command:`acme-tiny` command to be installed
          on\n  client hosts to work properly. Since the ``acme-tiny`` APT package
          in Debian\n  Bookworm is too old, on this release the role will install\n
          \ :command:`acme-tiny` from source. On existing installations, the\n  ``acme-tiny``
          APT package might need to be removed manually.\n\n- The ``acme-tiny`` source
          repository switched from the ``master`` branch to\n  the ``main`` branch,
          existing source installations need to remove the local\n  clone of the repository
          in :file:`/usr/local/src/pki-acme/diafygi/acme-tiny/`\n  so that it can
          be cloned correctly by Ansible. You should also remove the\n  copy of the
          :file:`/usr/local/bin/acme-tiny` command to be installed\n  correctly.\n\n:ref:`debops.pdns`
          role\n'''''''''''''''''''''''\n\n- The PowerDNS service will be configured
          to listen on all external IPv4 and\n  IPv6 addresses of a host insteand
          of listening on \"all\" IP addresses to\n  ensure that the service is started
          while the :command:`systemd-resolved`\n  service listens on the loopback
          interface.\n\n:ref:`debops.postgresql_server` role\n''''''''''''''''''''''''''''''''''''\n\n-
          Fixed an issue with the ``vacuum_defer_cleanup_age`` option removal in\n
          \ PostgreSQL 16.x resulting in failed startup of the service. The option
          will\n  be added only on supported PostgreSQL versions.\n\n:ref:`debops.resolved`
          role\n'''''''''''''''''''''''''''\n\n- The role will disable synthesis of
          local hostname by the\n  :command:`systemd-resolved` service (enabled by
          default in systemd v256) to\n  allow resolution of the host's FQDN queries
          by upstream DNS server.\n\n:ref:`debops.sysctl` role\n'''''''''''''''''''''''''\n\n-
          The :file:`50-pid-max.conf` configuration file will be installed only on\n
          \ platforms which support 64-bit architecture.\n\nRemoved\n```\n\nGeneral\n'''''''\n\n-
          The `volkszaehler` (`debops-contrib`) role was removed because the role\n
          \ maintainer considers the application to be superseded by Grafana.\n  See
          `Future of the project; The elephant in the room \u2013 Grafana`\\_\\_.\n\n
          \ .. \\_\\_: [volkszaehler/volkszaehler.org#819](https://redirect.github.com/volkszaehler/volkszaehler.org/issues/819)\n\n-
          The `bitcoind` role was removed due to lack of interest by the role\n  maintainer.\n\n-
          The `profile_tasks.py` Ansible callback plugin has been removed due to\n
          \ \"Unexpected Exception\" error on Ansible v2.19. Users should use its
          upstream\n  alternative, `ansible.posix.profile_tasks` plugin.\n\n:ref:`debops.ipxe`
          role\n'''''''''''''''''''''''\n\n- Debian 10 (Buster) has been archived
          and it's no longer available on Debian\n  mirrors, support for its installer
          has been removed from the role.\n\n:ref:`debops.netbox` role\n'''''''''''''''''''''''''\n\n-
          The NAPALM integration feature found in NetBox 3.4 and before has been moved\n
          \ to a dedicated plugin. If you want to continue using it, you will have
          to\n  install the plugin. All role variables about NAPALM except\n  :envvar:`netbox__napalm_ssh_generate`
          and\n  :envvar:`netbox__napalm_ssh_generate_bits` have been removed.\n\n:ref:`debops.python`
          role\n'''''''''''''''''''''''''\n\n- The `python3-future` and `python-future`
          APT packages have been removed\n  from Debian Stable release, and will not
          be installed by default by the\n  :ref:`debops.python` role.\n\nSecurity\n\n```\n\n:ref:`debops.icinga`
          role\n'''''''''''''''''''''''''\n\n- The GPG key of the Icinga upstream
          APT repository `has been replaced`__ on\n  30th September 2024. The role
          includes the new key which should be installed\n  on the host on the next
          run. The old GPG key will not be removed\n  automatically.\n\n  .. __: https://icinga.com/blog/2024/08/26/icinga-package-repository-key-rotation-2024/\n\n`debops
          v3.2.0`_ - 2024-09-16\n-----------------------------\n\n.. _debops v3.2.0:
          https://github.com/debops/debops/compare/v3.1.0...v3.2.0\n\nAdded\n~~~~~\n\nNew
          DebOps roles\n''''''''''''''''\n\n- The :ref:`debops.debconf` Ansible role
          can be used to pre-configure APT\n  packages which use the `debconf`__ configuration
          database and install them\n  afterwards. The role is included near the end
          of the :file:`site.yml`\n  playbook to allow of configuration of other needed
          services before the actual\n  package installation.\n\n  .. __: https://en.wikipedia.org/wiki/Debian_configuration_system\n\nGeneral\n'''''''\n\n-
          The :command:`debops` script can now log its operation to standard error
          and\n  to the :command:`syslog` service. Use the ``--verbose`` or ``-v``
          flag to\n  enable log output on the console.\n\n- Users can define \"playbook
          sets\" on the view level of the \"modern\" project\n  directories. Playbook
          sets can be used as aliases to call multiple playbooks\n  using a custom
          name. See :ref:`playbook_sets` documentation for more details.\n\n- Users
          can now enable \"read-only Fridays\" functionality on a per project\n  basis,
          to ensure that on Fridays, Ansible playbooks are run only in check\n  mode,
          with ``--check`` and ``--diff`` arguments automatically added to the\n  :command:`ansible-playbook`
          command options.\n\n:ref:`debops.apt_install` role\n''''''''''''''''''''''''''''''\n\n-
          The role will import the :ref:`debops.secret` role during execution to get\n
          \ access to the :file:`secret/` directory. This permits use of stored passwords\n
          \ in Debconf answers configured via the :ref:`debops.apt_install` role.\n\n:ref:`debops.dnsmasq`
          role\n''''''''''''''''''''''''''\n\n- The role can optionally ignore IP
          addresses on a network interface and use\n  only specified ones for :command:`dnsmasq`
          configuration. This can help with\n  Routing Advertisements issues on internal
          networks. See role documentation\n  for more details.\n\n:ref:`debops.pki`
          role\n''''''''''''''''''''''\n\n- Add support for defining per-realm UNIX
          environment variables set during\n  :command:`pki-realm` script execution.
          These variables can be used to augment\n  runtime environment, for example
          to define HTTP proxy to use inside internal\n  networks with restricted
          access to the outside world.\n\n:ref:`debops.rabbitmq_server` role\n''''''''''''''''''''''''''''''''''\n\n-
          The role can manage much more RabbitMQ internal structures - exchanges,\n
          \ queues, bindings between them, as well as vhost and user limits.\n\nChanged\n~~~~~~~\n\nUpdates
          of upstream application versions\n''''''''''''''''''''''''''''''''''''''''\n\n-
          In the :ref:`debops.ipxe` role, support for the Debian Bullseye netboot\n
          \ installer has been updated to v11.12; the Debian Bookworm installer has
          been\n  updated to v12.7.\n\nGeneral\n'''''''\n\n- DebOps now uses `pipx`__
          as the preferred installation method. This allows\n  for easier maintenance
          of the DebOps virtual environment.\n\n  .. __: https://pipx.pypa.io/\n\n:ref:`debops.elasticsearch`
          role\n''''''''''''''''''''''''''''''''\n\n- The role now supports new Elasticsearch
          v8.x password management mechanism.\n\n- The role can now manage passwords
          in separate Elasticsearch clusters defined\n  in one Ansible inventory.\n\n
          \ .. warning:: Due to this change, Elasticsearch passwords stored in the\n
          \              :file:`ansible/secret/` subdirectory will be read from a
          different\n               location. If passwords are not moved to the new
          location, role\n               will reset the Elasticsearch built-in users
          passwords\n               automatically. This might result in data loss.\n\n:ref:`debops.kibana`
          role\n'''''''''''''''''''''''''\n\n- The path to the password file stored
          in :file:`ansible/secret/` subdirectory\n  is now configurable using a variable.\n\n-
          The role uses new per-cluster Elasticsearch passwords by default. This is\n
          \ done using a separate :envvar:`kibana__elasticsearch_cluster_name` variable,\n
          \ which needs to be synchronized with the Elasticsearch configuration via\n
          \ Ansible inventory (Kibana can be installed separately from Elasticsearch).\n\n:ref:`debops.lxc`
          role\n''''''''''''''''''''''\n\n- The role supports integration with the
          :command:`systemd-resolved` DNS\n  resolver. This permits use of the :command:`systemd-networkd`
          service to\n  manage networking on the LXC host.\n\n- LXC containers will
          be configured with AppArmor \"unconfined\" profile by\n  default. This change
          allows startup of various services inside of the\n  container without errors
          on Debian Bookwrom hosts.\n\n:ref:`debops.lxd` role\n''''''''''''''''''''''\n\n-
          The role supports integration with the :command:`systemd-resolved` DNS\n
          \ resolver. This permits use of the :command:`systemd-networkd` service
          to\n  manage networking on the LXD host.\n\n:ref:`debops.nginx` role\n''''''''''''''''''''''''\n\n-
          The ``/index.html`` and ``/index.htm`` entries in the default ``try_files``\n
          \ configuration option have been replaced with the ``$uri/index.html`` entry.\n
          \ This change should ensure that any location not present on the server
          will\n  return error 404 correctly, instead of falling back to the ``/index.html``\n
          \ file if it's present in the root of the website.\n\n:ref:`debops.postgresql_server`
          role\n''''''''''''''''''''''''''''''''''''\n\n- The :command:`autopostgresqlbackup`
          script was modified to have separate set\n  of options for the :command:`psql`
          command and the :command:`pg_dump`\n  command. This permits the use of the
          ``--format=custom`` option in\n  :command:`pg_dump` command, enabling more
          efficient database dumps.\n\n- The extension of the backup files created
          by the\n  :command:`autopostgresqlbackup` script can be configured via a
          default\n  variable. This change might cause existing installations to change
          the file\n  extension used during backups.\n\n:ref:`debops.proc_hidepid`
          role\n'''''''''''''''''''''''''''''''\n\n- The role will check if the host
          is in the ``debops_service_libvirtd`` Ansible\n  inventory group, or if
          the :ref:`debops.libvirtd` role was applied on the\n  host and will change
          the ``hidepid=`` value to ``0`` to avoid issues with\n  Polkit subsystem.\n\n:ref:`debops.rsyslog`
          role\n''''''''''''''''''''''''''\n\n- The log rotation configuration for
          logs managed by :command:`rsyslog` now has\n  an upper size limit of 1 GB
          to trigger the rotation. This should help in\n  cases when these logs are
          growing rapidly, but the rotation period is too\n  large to avoid filling
          up disk space.\n\n:ref:`debops.zabbix_agent` role\n'''''''''''''''''''''''''''''''\n\n-
          The fact script now supports both the old Zabbix Agent, and the new Zabbix\n
          \ Agent 2 configuration files.\n\nFixed\n~~~~~\n\n:ref:`debops.dpkg_cleanup`
          role\n'''''''''''''''''''''''''''''''\n\n- Various YAML lists used in the
          package removal script will be sorted at Jinja\n  level to avoid constant
          reordering of list elements during Ansible execution\n  which makes the
          role not idempotent.\n\n:ref:`debops.gitlab` role\n'''''''''''''''''''''''''\n\n-
          Fixed an issue with the :file:`/etc/gitlab/ssl/` directory changing its
          mode\n  from 0775 set by the role to 0755 set by the :command:`gitlab-ctl\n
          \ reconfigure` command, making the role not idempotent.\n\n:ref:`debops.grub`
          role\n'''''''''''''''''''''''\n\n- Fixed an issue with the :file:`01_users`
          configuration file generating errors\n  and resulting in an empty user section
          in the configuration generated by the\n  :command:`update-grub` command.\n\n:ref:`debops.ifupdown`
          role\n'''''''''''''''''''''''''''\n\n- Fixed an issue with the :file:`ifup-allow-boot.service`
          :command:`systemd`\n  unit not starting correctly on boot due to issues
          with the ``$`` character\n  escaping.\n\n:ref:`debops.lxc` role\n''''''''''''''''''''''\n\n-
          The role will by default disable NFtables integration within the\n  :command:`lxc-net`
          script, configurable via a default variable. This fixes\n  usage of LXC
          containers on Debian Bookworm with the :command:`ferm` service\n  used by
          DebOps.\n\n:ref:`debops.lxd` role\n''''''''''''''''''''''\n\n- Fixed an
          issue with the default LXD daemon preseed configuration by removing\n  the
          unsupported ``managed`` parameter. This should allow the LXD daemon to be\n
          \ initialized correctly.\n\n- Fixed an issue with the role trying to copy
          the source-built libraries when\n  an APT-based installation is used. The
          role will check if the libraries exist\n  before trying to copy them.\n\n-
          Fixed an issue on Debian Bookworm where the :command:`lxd-apparmor-load`\n
          \ binary is not present where the APT-based LXD daemon expects it. The role\n
          \ will create a symlink for this binary when needed.\n\n:ref:`debops.networkd`
          role\n'''''''''''''''''''''''''''\n\n- Do not restart the :command:`systemd-networkd`
          service if the role detects\n  that the network stack is not managed by
          it. This should avoid the issue\n  where the role playbook hanged on first
          run of the role on a host not managed\n  by :command:`systemd-networkd`
          service.\n\n:ref:`debops.ntp` role\n''''''''''''''''''''''\n\n- Fixed an
          issue with conditional check for Linux capabilities not being\n  checked
          reliably to decide if NTP support should be enabled. The role should\n  now
          correctly detect when Linux capabilities are enforced.\n\n:ref:`debops.rsyslog`
          role\n''''''''''''''''''''''''''\n\n- List of log files which should be
          managed by the :command:`logrotate` service\n  will be sorted to avoid constant
          reordering during role execution, which\n  fixes role idempotency.\n\n:ref:`debops.swapfile`
          role\n'''''''''''''''''''''''''''\n\n- Fixed an issue in the :command:`swapon`
          task conditional logic where the task\n  could not be executed correctly
          when the swap file was missing.\n\n- Ensure that the swap file is correctly
          disabled by the :command:`swapoff`\n  command before being removed with
          the ``absent`` state.\n\nRemoved\n~~~~~~~\n\n:ref:`debops.ipxe` role\n'''''''''''''''''''''''\n\n-
          Debian 9 (Stretch) has been removed from Debian mirrors, therefore the role\n
          \ will no longer offer support for installing Debian Stretch via PXE boot.\n\n`debops
          v3.1.0`_ - 2023-11-29\n-----------------------------\n\n.. _debops v3.1.0:
          https://github.com/debops/debops/compare/v3.0.0...v3.1.0\n\nAdded\n~~~~~\n\nNew
          DebOps roles\n''''''''''''''''\n\n- The :ref:`debops.metricbeat` role, part
          of the Elastic stack, can be used to\n  install `Metricbeat`__, a service
          that can gather metrics and other non-log\n  data from other services and
          send them to Elasticsearch for processing.\n\n  .. __: https://www.elastic.co/beats/metricbeat\n\n-
          The :ref:`debops.opensearch` role can be used to set up an unsecured,\n
          \ local-only installation of `OpenSearch`__. OpenSearch is a fork of\n  Elasticsearch
          that continues to be released under a free software license.\n\n  .. __:
          https://opensearch.org/\n\n- The :ref:`debops.reboot` role can be used to
          reboot, forcefully or only if\n  required, any DebOps host.\n\n- The :ref:`debops.miniflux`
          role can install and manage Miniflux, a web-based,\n  minimalistic feed
          reader written in Go.\n\n- The :ref:`debops.systemd` role is included in
          the common playbook by default.\n  It configures the :command:`systemd`
          system and service manager. Both\n  system-wide, as well as user services
          configured globally can be managed with\n  this role.\n\n- The :ref:`debops.networkd`
          role can be used to configure the\n  :command:`systemd-networkd` service,
          part of the :command:`systemd` project\n  responsible for network interface
          configuration.\n\n- The :ref:`debops.timesyncd` role is used to configure
          the\n  :command:`systemd-timesyncd` service, a minimal SNTP/NTP client.
          The role is\n  included in the :file:`layer/common.yml` playbook instead
          of the\n  :ref:`debops.ntp` role to provide NTP support by default.\n\n-
          The :ref:`debops.resolved` role is included in the :file:`layer/common.yml`\n
          \ playbook by default, replacing the :ref:`debops.resolvconf` role. It manages\n
          \ the :command:`systemd-resolved` service, a local DNS resolver.\n\n- The
          :ref:`debops.bind` role is responsible for installing and managing the\n
          \ ISC BIND nameserver. It supports DNSSEC, key rollovers, multiple DNS zones,\n
          \ views and many more features.\n\n- The :ref:`debops.apparmor` role can
          be used to manage AppArmor configuration\n  and profiles. It will be included
          in the :file:`layer/common.yml` playbook in\n  the future.\n\n- The :ref:`debops.apt_mirror`
          role can be used to create a mirror of one or\n  multiple APT repositories
          and publish them for other hosts to use as package\n  source.\n\nGeneral\n'''''''\n\n-
          DebOps now includes a custom version of the\n  ``community.general.apache2_module``
          Ansible module, available as\n  ``debops.debops.apache2_module``. The custom
          module includes a fixed\n  idempotency check for enabled Apache 2 modules
          that works on Debian or Ubuntu\n  hosts. The :ref:`debops.apache` Ansible
          role will use this module instead of\n  the original one.\n\n- The :command:`debops
          exec` command can be used to execute Ansible modules\n  against hosts in
          the project directory; this is a wrapper for the\n  :command:`ansible` command.\n\n-
          The :command:`debops run`, :command:`debops check` and :command:`debops
          exec`\n  commands can emit ASCII \"bell\" at the end of Ansible execution
          to notify user\n  after long runs. Use the ``-E`` or ``--bell`` option to
          enable this.\n\n- The :command:`debops env` command can be used to inspect
          the runtime\n  environment variables present when other DebOps commands
          are used, as well as\n  execute external commands inside of that runtime
          environment. This is handy\n  for using various :command:`ansible-*` commands
          within DebOps project\n  directories.\n\n- DebOps monorepo now includes
          configuration for the `pre-commit`__ hook to\n  verify changes before they
          are committed to the repository. Multiple checks\n  are performed, notably
          `codespell`__ is used to find spelling mistakes. More\n  checks will be
          enabled in the future.\n\n  .. __: https://pre-commit.com/\n  .. __: https://github.com/codespell-project/codespell\n\n-
          New project directory layout called \"modern\" has been implemented in DebOps\n
          \ scripts. It can be created using the command:\n\n  .. code-block:: console\n\n
          \    debops project init -t modern <project>\n\n  The modern project layout
          supports multiple Ansible inventories encapsulated\n  into :ref:`infrastructure
          views <project_infrastructure_views>`.\n\n- DebOps scripts now support management
          of the project directories using\n  :command:`git` as VCS repositories.
          New project directories will use\n  :command:`git` by default. This also
          enables support for secrets encrypted\n  using :command:`git-crypt`.\n\n:ref:`debops.apt`
          role\n''''''''''''''''''''''\n\n- The role now supports management of the
          \"Deb822\" format of the APT repository\n  sources.\n\n:ref:`debops.avahi`
          role\n''''''''''''''''''''''''\n\n- The role will ensure that the :command:`systemd-resolved`
          service Multicast\n  DNS support is disabled to avoid conflict with the
          :command:`avahi-daemon`\n  service.\n\n:ref:`debops.ferm` role\n'''''''''''''''''''''''\n\n-
          Multicast DNS traffic is accepted by default in the firewall to allow for
          the\n  ``.local`` mDNS domain resolution by the :command:`systemd-resolved`
          service.\n  The role provides a set of variables to limit the traffic by
          subnet, or\n  disable it completely.\n\n:ref:`debops.icinga_web` role\n'''''''''''''''''''''''''''''\n\n-
          The role can now create host and service templates using Icinga Director
          API.\n  This should improve the initial deployment experience, since users
          don't need\n  to create basic host templates by hand before registering
          hosts in Icinga.\n\n:ref:`debops.ipxe` role\n'''''''''''''''''''''''\n\n-
          The Debian Installer Menu can now install Debian GNU/Linux 12 (Bookworm).\n\n:ref:`debops.java`
          role\n'''''''''''''''''''''''\n\n- The role will now configure the default
          security policy for Java\n  applications. The additions will permit Java
          applications to access the\n  system-wide CA certificate store in :file:`/etc/ssl/certs/`
          directory as well\n  as the PKI infrastructure managed by the :ref:`debops.pki`
          role, so that Java\n  applications can use the existing X.509 certificates
          and private keys for TLS\n  encryption support.\n\n:ref:`debops.keyring`
          role\n''''''''''''''''''''''''''\n\n- The role can now download APT repository
          GPG keys to separate keyring files,\n  which can be used to scope a given
          GPG key to specific APT repositories.\n\n:ref:`debops.kibana` role\n'''''''''''''''''''''''''\n\n-
          The role can now manage passwords and other confidential data stored in
          the\n  Kibana keystore.\n\n:ref:`debops.mount` role\n''''''''''''''''''''''''\n\n-
          The role can now create custom files which can be used to store credentials\n
          \ required to mount remote devices.\n\n:ref:`debops.netbox` role\n'''''''''''''''''''''''''\n\n-
          The role will enable LDAP support in NetBox if LDAP environment managed
          by\n  the :ref:`debops.ldap` role is detected on the host. Currently only
          user\n  authentication and Django ACL system is supported via LDAP groups.\n\n:ref:`debops.nginx`
          role\n''''''''''''''''''''''''\n\n- The server configuration files can now
          contain :command:`nginx` configuration\n  outside of the ``server`` and
          ``upstream`` blocks using the new\n  ``item.toplevel_options`` parameter.\n\n:ref:`debops.owncloud`
          role\n'''''''''''''''''''''''''''\n\n- Support to host the application on
          a subpath for security reasons.\n\n:ref:`debops.python` role\n'''''''''''''''''''''''''\n\n-
          The :file:`service/python_raw` playbook used during early bootstrap process\n
          \ can now inject host entries into the :file:`/etc/hosts` configuration
          file to\n  permit DNS name resolution early during bootstrapping.\n\n:ref:`debops.resources`
          role\n''''''''''''''''''''''''''''\n\n- The :ref:`debops.resources` role
          can now be used to install pip library\n  dependencies or virtual environments
          via the ``ansible.builtin.pip``\n  module.\n\n- The :ref:`debops.resources`
          role can now be used to replace a line via the\n  ``ansible.builtin.replace``
          module.\n\n:ref:`debops.slapd` role\n''''''''''''''''''''''''\n\n- The playbook
          can now be configured to skip the saslauthd role execution.\n\n:ref:`debops.zabbix_agent`
          role\n'''''''''''''''''''''''''''''''\n\n- The role now supports management
          of Zabbix Agent (written in C) as well as\n  Zabbix Agent 2 (written in
          Go), available in Debian repositories. Only one\n  flavor can be managed
          at a time, but role provides an easy way to switch\n  between the two flavors.\n\nChanged\n~~~~~~~\n\nUpdates
          of upstream application versions\n''''''''''''''''''''''''''''''''''''''''\n\n-
          In the :ref:`debops.roundcube` role, the Roundcube version installed by\n
          \ default has been updated to ``1.6.0``.\n\n- In the :ref:`debops.ipxe`
          role, the Debian Buster netboot installer version\n  has been updated to
          the next point release, 10.13. Debian Bullseye has been\n  updated to the
          next point release as well, 11.8. The Debian Bookworm release\n  has been
          updated to 12.2.\n\n- In the :ref:`debops.netbox` role, the NetBox version
          has been updated to\n  ``v3.4.2``.\n\n- In the :ref:`debops.owncloud` role,
          the ownCloud support has been updated to\n  ``v10.10``.\n\n- In the :ref:`debops.owncloud`
          role, the Nextcloud support has been updated to\n  ``v24.0`` and ``v25.0``.\n\nGeneral\n~~~~~~~\n\n-
          Tasks which use modules and plugins from the ``ansible.builtin`` Ansible\n
          \ Collection have been updated to refer to them via their Fully Qualified\n
          \ Collection Names (for example ``ansible.builtin.file`` instead of ``file``).\n
          \ This is due to changing requirements of the :command:`ansible-lint` tool.\n\n
          \ New submissions to the DebOps project will be required to use the FQCNs
          as\n  well.\n\n- Various roles that lookup SSH public keys on the Ansible
          Controller\n  (:ref:`debops.preseed`, :ref:`debops.reprepro`, :ref:`debops.system_users`)\n
          \ will try to use the :file:`~/.ssh/authorized_keys` file to find the keys
          if\n  all other methods fail.\n\n- In the :file:`site.yml` playbook, the
          :file:`sys.yml` and :file:`net.yml`\n  playbooks will be executed before
          the :file:`common.yml` playbook. This\n  should ensure that configuration
          of certain resources like mount points or\n  LVM pools is present before
          the system is prepared for general operation.\n\n- The :file:`ansible/playbooks/tools/reboot.yml`
          Ansible playbook has been\n  moved to :file:`ansible/playbooks/reboot.yml`
          file and uses the new\n  :ref:`debops.reboot` Ansible role to perform operations.
          To use it, you can\n  run the ``reboot`` playbook instead of ``tools/reboot``.\n\n-
          The :file:`ansible/playbooks/tools/upgrade-reboot.yml` Ansible playbook
          has\n  been moved to :file:`ansible/playbooks/upgrade.yml` file and will
          no longer\n  reboot the host automatically. Users can chain the ``upgrade``
          and ``reboot``\n  playbooks to achieve the previous behaviour, for example:\n\n
          \ .. code-block:: console\n\n     debops run upgrade reboot -l <host>\n\n-
          The debops-contrib :file:`dropbear_initramfs` playbook has been moved to\n
          \ the :ref:`debops.dropbear_initramfs` playbook. The role variable\n  ``dropbear_initramfs__host_authorized_keys``
          now uses the same keys as\n  the ``ansible.posix.authorized_key`` module.\n\n-
          Various tasks that interact with the MariaDB/MySQL databases will now use
          the\n  :file:`/run/mysqld/mysqld.sock` UNIX socket to do so, due to changes
          in\n  MariaDB restricting local connections for the ``root`` UNIX account.\n\n-
          The HTML documentation build process has been improved. The\n  :command:`yaml2rst`
          script will be invoked only when a defaults file is\n  modified, significantly
          speeding up documentation rebuilds. Users can also\n  modify the :command:`sphinx`
          options specified in the Makefile via an\n  environment variable if they
          wish.\n\n- The :file:`ansible/playbooks/tools/dist-upgrade.yml` Ansible
          playbook now has\n  MTA configuration exposed via variables in case the
          mail should be sent via\n  a remote server instead of a local one.\n\n-
          DebOps playbooks have been reorganized to not use a large set of symlinks\n
          \ inside of the repository. Instead different sections of the :file:`site.yml`\n
          \ playbook have been organized into \"layers\", new playbooks are located
          under\n  the :file:`ansible/playbooks/layers/` subdirectory. See the new\n
          \ :ref:`playbooks` documentation for more details.\n\n- The new :ref:`debops.timesyncd`
          role has replaced the :ref:`debops.ntp` role\n  as the default NTP service
          provider in the :file:`layer/common.yml` playbook.\n  Existing hosts shouldn't
          be affected - the new role can automatically\n  recognize that a different
          time daemon package is installed on the host and\n  will not try to configure
          :command:`systemd-timesyncd` service in such case.\n  You might need to
          add your hosts to the ``[debops_service_ntp]`` Ansible\n  inventory group
          to keep using the old role.\n\n- The new :ref:`debops.resolved` role has
          replaced the :ref:`debops.resolvconf`\n  role as the default DNS resolver
          in the :file:`layer/common.yml` and the\n  bootstrap playbooks. Existing
          hosts shouldn't be affected, the role detects\n  presence of the ``resolvconf``
          APT package and does not modify the host\n  configuration in such case.\n\n-
          Multiple DebOps Collections on Ansible Galaxy have been merged into a single\n
          \ ``debops.debops`` Collection to prepare the project to switch role references\n
          \ to FQCNs. This is also a test to see if Ansible Galaxy allows >2 MB\n
          \ collection tarballs.\n\n- The :command:`debops config` command has been
          refactored and split into\n  multiple subcommands to allow easier configuration
          introspection. See\n  :ref:`it's documentation page <cmd_debops-config>`
          for more details.\n\n- The Debian 12 (Bookworm) has been released! Multiple
          DebOps roles have been\n  updated and switched the \"stable\" release to
          Bookworm, with Bullseye becoming\n  the \"oldstable\" release. The new Debian
          Testing release, \"Trixie\" has also\n  been added in relevant places.\n\n-
          DebOps now supports using :command:`git` in project directories - new\n
          \ projects will be initialized as :command:`git` repositories by default.
          The\n  :command:`git-crypt` command is also supported, and can encrypt project\n
          \ secrets.\n\n:ref:`debops.apt` role\n''''''''''''''''''''''\n\n- The role
          will configure APT to use Debian Security repositories via the\n  http://deb.debian.org/debian-security/
          CDN.\n\n- The role has been refreshed and management of the\n  :file:`/etc/apt/sources.list`
          file was redesigned to allow for better\n  flexibility in configuration.
          See role documentation for more details.\n\n:ref:`debops.apt_preferences`
          role\n''''''''''''''''''''''''''''''''''\n\n- The pin priorities for the
          Debian ``-updates`` and ``-security`` APT\n  repositories have been raised
          to 550 to match the raised priority of the\n  primary repository. This should
          ensure that when the custom pin priorities\n  are active, updates to Debian
          packages are correctly installed as well. See\n  :envvar:`apt_preferences__debian_stable_default_preset_list`
          variable for\n  details.\n\n:ref:`debops.docker_server` role\n''''''''''''''''''''''''''''''''\n\n-
          The role can now directly handle the daemon ``log-driver`` parameter.\n\n-
          The role has been redesigned from scratch; Python :command:`virtualenv`\n
          \ support has been removed since the :command:`docker-compose` is included
          in\n  Debian repositories directly, or is implemented as a Go plugin in
          upstream\n  repositories. The Docker configuration is now implemented via
          the\n  :ref:`universal_configuration` system, users will have to modify
          their\n  Ansible inventories. See the role documentation for details.\n\n:ref:`debops.elasticsearch`
          role\n''''''''''''''''''''''''''''''''\n\n- The role will check the status
          of the built-in user accounts via the HTTP API\n  instead of relying on
          the Ansible local facts and create them if they don't\n  exist. This should
          help with an upgrade of existing Elasticsearch clusters\n  without TLS encrypted
          traffic and authentication.\n\n:ref:`debops.gitlab` role\n'''''''''''''''''''''''''\n\n-
          The role has been rewritten from scratch and now can be used to deploy and\n
          \ manage a `GitLab Omnibus`__ instance (managed internally by Chef) on Debian\n
          \ or Ubuntu hosts. The role integrates with various DebOps services (firewall,\n
          \ PKI infrastructure, LDAP environment) with GitLab Omnibus. Both Community\n
          \ Edition (default) and Enterprise Edition are supported.\n\n  .. __: https://docs.gitlab.com/omnibus/\n\n:ref:`debops.global_handlers`
          role\n''''''''''''''''''''''''''''''''''\n\n- The :command:`systemd` handlers
          have been moved to a separate\n  :file:`handlers/systemd.yml` configuration
          file.\n\n:ref:`debops.icinga` role\n'''''''''''''''''''''''''\n\n- New hosts
          will be added to Icinga Director using the ``icinga-agent-host``\n  template,
          created by default by the :ref:`debops.icinga_web` role. On\n  existing
          installations, you should either create this template by hand, or\n  run
          the :ref:`debops.icinga_web` role so that it gets added automatically.\n\n:ref:`debops.icinga_db`
          role\n''''''''''''''''''''''''''''\n\n- The role will manage Icinga databases
          directly instead of relying on\n  :command:`dbconfig` Debian subsystem.
          This improves support for remote Icinga\n  database deployments accessible
          over TLS.\n\n:ref:`debops.icinga_web` role\n'''''''''''''''''''''''''''''\n\n-
          The LDAP configuration used by the role to configure LDAP access will be\n
          \ based on the :ref:`debops.ldap` Ansible local facts instead of static
          values,\n  to better support modified environments.\n\n:ref:`debops.influxdata`
          role\n'''''''''''''''''''''''''''''\n\n- InfluxData has published a new
          APT repository GPG key, the role should\n  refresh it automatically.\n\n:ref:`debops.minio`
          role\n''''''''''''''''''''''''\n\n- The role has been updated to support
          newer MinIO features, like the embedded\n  MinIO Console. Some of the instance
          parameters have been changed, for example\n  access key and secret key have
          been replaced with root account and password.\n  Check the role documentation
          for more details.\n\n:ref:`debops.nginx` role\n''''''''''''''''''''''''\n\n-
          Configure the :file:`nginx.service` systemd unit to start the\n  :command:`nginx`
          service after the network is configured. This way\n  :command:`nginx` should
          be able to resolve upstream services specified via\n  DNS names at startup.\n\n:ref:`debops.ntp`
          role\n''''''''''''''''''''''\n\n- The default NTP daemon used on hosts with
          the :command:`systemd` service\n  manager will be :command:`systemd-timesyncd`.
          Existing systems with\n  a different NTP server should not be affected by
          this change.\n\n- The role should better detect Linux Container environment
          and not try to\n  install an NTP daemon inside of a container.\n\n:ref:`debops.pki`
          role\n''''''''''''''''''''''\n\n- The :command:`pki-realm` script will call
          the :command:`certbot` command with\n  the :command:`certbot --authenticator
          <plugin>` option explicitly to allow\n  use with third-party authenticator
          plugins that might not support the\n  :command:`certbot --<plugin>` syntax.\n\n:ref:`debops.preseed`
          role\n''''''''''''''''''''''''''\n\n- The default guided partition recipe
          used by the Debian Installer is changed\n  from ``atomic`` to ``multi``.
          This should allow for easier changes in the\n  partition layout via LVM
          due to separate partitions for :file:`/home` and\n  :file:`/var` mount points.\n\n:ref:`debops.proc_hidepid`
          role\n'''''''''''''''''''''''''''''''\n\n- The role will check if PolicyKit
          is installed on the host, in which case the\n  default security level for
          access to the :file:`/proc` filesystem will be\n  more permissive.\n\n:ref:`debops.python`
          role\n'''''''''''''''''''''''''\n\n- The role will enable Python 2.7 support
          via the fact script only when an\n  existing Python 2.7 installation is
          detected. This change should help avoid\n  installing Python 2.7 packages
          on newer OS releases when they might be\n  unavailable.\n\n- The :file:`/etc/pip.conf`
          configuration file template can be overridden via\n  the DebOps template
          override mechanism.\n\n:ref:`debops.resolvconf` role\n'''''''''''''''''''''''''''''\n\n-
          In the :ref:`debops.resolvconf` role, you can now write a fully static\n
          \ :file:`/etc/resolv.conf` file without the ``resolvconf`` package.\n\n:ref:`debops.slapd`
          role\n''''''''''''''''''''''''\n\n- The default log level used by OpenLDAP
          has been changed from ``stats`` to\n  ``none`` to minimize log output in
          large environments. This can be modified\n  using Ansible inventory in case
          that the authentication, accounting or search\n  metrics are needed.\n\n:ref:`debops.sshd`
          role\n'''''''''''''''''''''''\n\n- The management of the :file:`/etc/ssh/sshd_config`
          configuration file has\n  been redesigned and now uses :ref:`universal_configuration`.
          Multiple default\n  variables have been removed as a result. Any changes
          in configuration applied\n  through Ansible inventory might need to be converted
          to the new format. Check\n  the changes on existing hosts before applying
          new configuration.\n\n:ref:`debops.system_users` role\n'''''''''''''''''''''''''''''''\n\n-
          The role will check remote user databases for local admin information using\n
          \ the :command:`getent passwd` command if the user has not been found in
          the\n  :file:`/etc/passwd` local database.\n\nFixed\n~~~~~\n\nGeneral\n'''''''\n\n-
          Extrepo facts file did not detect a disabled repository as being disabled\n
          \ due to a change in the extrepo file format.\n\n- Ensure that the custom
          Ansible plugins included in DebOps are present in the\n  Ansible Collection
          build from the DebOps repository.\n\n- Provide a help message in case the
          :file:`ansible.cfg` configuration file in\n  the DebOps project directory
          does not include the ``inventory`` option.\n\n- Fixed an issue with custom
          Ansible plugins not working in \"standalone\" mode\n  without the DebOps
          scripts installed on Ansible Controller.\n\n- The ``warn`` parameter in
          the ``shell`` and ``command`` Ansible modules has\n  been removed in Ansible
          2.14. It has been removed in various DebOps roles to\n  allow playbook execution
          to work correctly.\n\n- Fixed all password lookups which used ``chars=ascii``
          instead of\n  ``chars=ascii_letters``. This resulted in passwords which
          only contained the\n  letters a,c,i,s instead of all lowercase and uppercase
          ASCII letters. Because\n  all occurrences of this bug at least also included
          all digits in the character\n  set and the password length was at least
          20 characters, this did not result\n  in weak passwords.\n\n- The ``ipaddr``
          Ansible filter and its aliases used in various roles were\n  renamed to
          ``ansible.utils.ipaddr`` and its corresponding alias names because\n  Ansible
          requires use of FQCNs in filters. The ``ansible.utils`` Ansible\n  Collection
          is now a dependency of the DebOps Collection.\n\n- The :command:`debops
          run` and :command:`debops check` commands should now\n  correctly recognize
          options of the :command:`ansible-playbook` command which\n  don't expect
          arguments and expand playbook names specified after them.\n\n:ref:`debops.apt`
          role\n''''''''''''''''''''''\n\n- In the fact script, parse the ``deb-src``
          configuration entries before\n  ``deb`` entries to ensure that there are
          no duplicates.\n\n- The role no longer defaults to the ``ansible_local.core.distribution``
          and\n  ``ansible_local.core.distribution_release`` local facts for determining
          the\n  Linux distribution and the distribution release, respectively. These
          facts\n  were set later in the common playbook, meaning that the role would
          restore\n  the previous distribution release in ``/etc/apt/sources.list``
          after a\n  distribution upgrade.\n\ndebops.boxbackup role\n'''''''''''''''''''''\n\n-
          The role is not included in the DebOps Collection on Ansible Galaxy,\n  therefore
          its playbook is no longer included in the main :file:`site.yml`\n  playbook.
          This fixes an issue with Ansible stopping the site playbook\n  execution
          when it cannot find the ``boxbackup`` role in the Collection.\n\n:ref:`debops.core`
          role\n'''''''''''''''''''''''\n\n- Ensure that the ``ansible_controllers``
          fact can be reset using the\n  :envvar:`core__remove_facts` variable to
          avoid infinitely growing list of\n  Ansible Controllers.\n\n:ref:`debops.cron`
          role\n'''''''''''''''''''''''\n\n- Fixed the order of job parameters applied
          by the role - now parameters from\n  a specific job will override parameters
          specified for all jobs in a given\n  configuration entry.\n\n:ref:`debops.dnsmasq`
          role\n''''''''''''''''''''''''''\n\n- Fixed service configuration mistake
          when DHCPv6 mode is set to an empty\n  string. The configuration template
          should take this into account and add\n  a correct separator (or omit it)
          in the generated configuration file.\n\n:ref:`debops.dovecot` role\n''''''''''''''''''''''''''\n\n-
          The role's PKI hook script still referenced an old configuration file that\n
          \ was no longer being managed by :ref:`debops.dovecot` since the role redesign,\n
          \ resulting in the hook script failing to reload dovecot after a certificate
          or\n  DH param change.\n\n:ref:`debops.elasticsearch` role\n''''''''''''''''''''''''''''''''\n\n-
          The internal Java security policy used by Elasticsearch will be configured\n
          \ only on Elasticsearch v7.x+ versions. Before them, Elasticsearch used
          the\n  global Java security policy.\n\n:ref:`debops.environment` role\n''''''''''''''''''''''''''''''\n\n-
          Fixed issues with preserving environment variables across multiple role\n
          \ executions.\n\n:ref:`debops.etc_aliases` role\n''''''''''''''''''''''''''''''\n\n-
          Don't save dependent recipients on Ansible Controller if they are not\n
          \ defined. This should avoid creating unnecessary files in AWX job containers.\n\n:ref:`debops.ferm`
          role\n'''''''''''''''''''''''\n\n- Don't include additional '{' or '}' characters
          in certain rules when the\n  ``domain_args`` parameter is specified.\n\n-
          Fixed an issue in the rule template that caused a templating type error
          where\n  Jinja expected a string but found an int value instead.\n\n:ref:`debops.gitlab_runner`
          role\n''''''''''''''''''''''''''''''''\n\n- Fixed an error that could occur
          in the \"Patch 'vagrant-libvirt' source code\"\n  task on systems other
          than Debian 9 or 10. The patch is not required since\n  the ``vagrant-libvirt``
          v0.1.0 package.\n\n:ref:`debops.grub` role\n'''''''''''''''''''''''\n\n-
          The :command:`grub` user passwords will be passed for encryption using\n
          \ a temporary file stored in the :file:`secret/` directory on the Ansible\n
          \ Controller instead of directly on the command line, to avoid leaks through\n
          \ the process list.\n\n:ref:`debops.ifupdown` role\n'''''''''''''''''''''''''''\n\n-
          The interface names used in scripts will be escaped using the\n  :command:`systemd-escape`
          tool. This should fix problems with control over\n  network interfaces which
          contain the hyphen character(s).\n\n:ref:`debops.kibana` role\n'''''''''''''''''''''''''\n\n-
          The role will use the correct path of the Kibana keystore depending on the\n
          \ installed version (versions <7.0.0 keep the keystore in the\n  :file:`/var/lib/kibana/`
          directory; newer versions use the\n  :file:`/etc/kibana/` directory).\n\n-
          The role will use different user account depending on Kibana version (either\n
          \ ``kibana``, or ``kibana_system`` used in newer installations of\n  Elasticsearch).
          Depending on your installed version, you should check the\n  :envvar:`kibana__elasticsearch_username`
          to verify that the correct account\n  is used for access to Elasticsearch.\n\n-
          The role will include the ``server.publicBaseUrl`` parameter depending on\n
          \ Kibana version, to avoid failures on older Kibana installations.\n\n:ref:`debops.ldap`
          role\n'''''''''''''''''''''''\n\n- Fixed an issue with the role passing
          IP and MAC addresses to the LDAP\n  directory as a nested YAML list which
          resulted in a wrong attribute values.\n\n- Fixed an issue with role parsing
          the already parsed Ansible facts to extract\n  IP/CIDR information which
          resulted in wrong output in certain cases. The role\n  will now implicitly
          trust the Ansible facts to be correct when adding IP and\n  prefix details
          to the LDAP database.\n\n:ref:`debops.libvirtd` role\n'''''''''''''''''''''''''''\n\n-
          Fixed ``qemu-kvm`` package installation logic; the KVM packages should now
          be\n  handled correctly on Debian Bullseye and newer releases.\n\n:ref:`debops.logrotate`
          role\n''''''''''''''''''''''''''''\n\n- Fixed formatting in the :file:`/etc/logrotate.conf`
          configuration file to\n  avoid adding :command:`vim` fold markers from the
          DebOps role defaults.\n\n:ref:`debops.lxc` role\n''''''''''''''''''''''\n\n-
          Fixed name of the ``vfs_root`` parameter in the call to the\n  ``community.general.lxc_container``
          Ansible module, which was renamed to\n  ``zfs_root``.\n\n:ref:`debops.netbase`
          role\n''''''''''''''''''''''''''\n\n- In the fact script, don't use ``in``
          for matching IP addresses and DNS names\n  where substring matching is undesirable.\n\n:ref:`debops.netbox`
          role\n'''''''''''''''''''''''''\n\n- Using boolean variables in :envvar:`netbox__config_plugins_config`
          for\n  example resulted in an error because the role used the ``to_nice_json``\n
          \ Jinja2 filter internally to render Python configuration.\n  This is fixed
          for all uses of ``to_nice_json``\n\n:ref:`debops.ntp` role\n''''''''''''''''''''''\n\n-
          Fix an issue where the role tried to manage the :command:`systemd-timesyncd`\n
          \ service without it actually being present on the host. This should now
          be\n  avoided by carefully checking the service status.\n\n- The role will
          not try to purge installed NTP daemon packages when it is\n  disabled through
          Ansible inventory.\n\n:ref:`debops.owncloud` role\n'''''''''''''''''''''''''''\n\n-
          Access to static assets was not logged regardless of the\n  ``owncloud__nginx_access_log_assets``
          setting.\n\n- Access to the ``/remote`` URI path was not configured in Nginx
          as proposed in\n  the upstream Nginx example in the Nextcloud docs.\n\n:ref:`debops.pdns`
          role\n'''''''''''''''''''''''\n\n- On pdns installations with version >=
          4.5.0 (e.g. on Bookworm systems), the\n  role would cause a syntax error
          on the local-address configuration option.\n\n:ref:`debops.pki` role\n''''''''''''''''''''''\n\n-
          After the :command:`certbot` script performs a certificate renewal operation,\n
          \ a deploy hook will update the PEM chains in a given PKI realm\n  :file:`private/`
          directory to include the new private key created by the\n  :command:`certbot`
          script.\n\n- Fixed an issue where when a PKI realm was initialized for ACME/Let's
          Encrypt\n  support, second level domains were not included in the generated
          X.509\n  certificate request.\n\n- Use :command:`openssl x509 -inform PEM`
          command to explicitly check for\n  a PEM-formatted X.509 certificate file
          because the old :command:`openssl x509\n  -in` option was changed to work
          with both DER and PEM files. This should fix\n  an issue with Let's Encrypt
          certificate chains containing a DER-formatted\n  certificate inside of them.\n\n
          \ Users will need to remove existing PKI realms which use ACME/Let's Encrypt
          CA\n  for the :command:`pki-realm` script to rebuild the certificate chain\n
          \ correctly. After that re-run the :ref:`debops.pki` role on the host to\n
          \ re-create che realms.\n\n:ref:`debops.postconf` role\n'''''''''''''''''''''''''''\n\n-
          The EHLO IP address check was removed. This check would reject a message
          if\n  the EHLO hostname of the connecting mailserver resolved to a non-publicly\n
          \ routable IP address. However, rejecting messages for this reason is\n
          \ prohibited by :rfc:`5321` section 4.1.4, and sometimes caused deliverability\n
          \ issues for Office 365 users.\n\n:ref:`debops.preseed` role\n''''''''''''''''''''''''''\n\n-
          Fixed an issue with the ``d-i`` keyboard preseed that resulted in the\n
          \ ``keyboard-configuration`` APT package not being installed and configured\n
          \ correctly. The default keymap is changed to ``us`` and the option is no\n
          \ longer based on the system language which might be incorrect in this case.\n\n:ref:`debops.proc_hidepid`
          role\n'''''''''''''''''''''''''''''''\n\n- The fact script has been optimized
          \n\n</details>\n\n---\n\n### Configuration\n\n\U0001F4C5 **Schedule**: Branch
          creation - At any time (no schedule defined), Automerge - At any time (no
          schedule defined).\n\n\U0001F6A6 **Automerge**: Disabled by config. Please
          merge this manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever
          PR becomes conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515
          **Ignore**: Close this PR and you won't be reminded about this update again.\n\n---\n\n
          - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
          box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
          View the [repository job log](https://developer.mend.io/github/osism/release).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My42Ni40IiwidXBkYXRlZEluVmVyIjoiNDMuNjYuNCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUiXX0=-->\n"
        change_url: https://github.com/osism/release/pull/2419
        commit_id: 652bba730ae468d75662534f6fc2512ae266fac2
        patchset: 652bba730ae468d75662534f6fc2512ae266fac2
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          name: osism/release
          short_name: release
        src_dir: src/github.com/osism/release
        topic: null
      buildset: 529383973f3140968177ca4be48368f3
      buildset_refs:
      - branch: main
        change: '2419'
        change_message: "chore(deps): update dependency debops.debops to v3.3.0\n\n>
          \u2139\uFE0F **Note**\n> \n> This PR body was truncated due to platform
          limits.\n\nThis PR contains the following updates:\n\n| Package | Update
          | Change |\n|---|---|---|\n| [debops.debops](https://redirect.github.com/debops/debops)
          | minor | `3.2.5` \u2192 `3.3.0` |\n\n---\n\n### Release Notes\n\n<details>\n<summary>debops/debops
          (debops.debops)</summary>\n\n### [`v3.3.0`](https://redirect.github.com/debops/debops/blob/HEAD/CHANGELOG.rst#debops-v330---2026-03-13)\n\n[Compare
          Source](https://redirect.github.com/debops/debops/compare/v3.2.6...v3.3.0)\n\n..
          \\_debops v3.3.0: <https://github.com/debops/debops/compare/v3.2.0...v3.3.0>\n\nAdded\n\n```\n\nNew
          DebOps roles\n''''''''''''''''\n\n- The :ref:`debops.nixos` role with its
          corresponding playbook can be used to\n  manage NixOS-based hosts. The role
          is not included in the main\n  :file:`site.yml` playbook, which is focused
          on Debian/Ubuntu hosts.\n\n- The :ref:`debops.influxdb2` role can be used
          to install and configure\n  `InfluxDB v2.x`__ time-series database.\n\n
          \ .. __: https://www.influxdata.com/products/influxdb/\n\n- The :ref:`debops.pgbadger`
          role can be used to generate PostgreSQL log\n  reports from local or remote
          hosts over SSH.\n\n:ref:`debops.core` role\n'''''''''''''''''''''''\n\n-
          A new local fact, ``ansible_local.core.is_64bits``, can be used to determine\n
          \ if the current system supports 32-bit or 64-bit architecture.\n\n:ref:`debops.dovecot`
          role\n''''''''''''''''''''''''''\n\n- The role now supports `iterate_filter`
          for its LDAP configuration, allowing\n  :command:`doveadm` commands to iterate
          over all users. Note that you might\n  have to adjust the defaults for the
          :envvar:`dovecot__ldap_user_list_filter`\n  variable if you use the :envvar:`dovecot__ldap_user_filter`
          variable.\n\n:ref:`debops.ipxe` role\n'''''''''''''''''''''''\n\n- Debian
          13 (Trixie) has been released, support for its installer has been added\n
          \ to the role. Debian Trixie is now the primary Stable release available
          in the\n  netboot installation menu.\n\n:ref:`debops.netbox` role\n'''''''''''''''''''''''''\n\n-
          Starting with NetBox ``v3.4.9``, anonymized reporting of census data is
          being\n  enabled by default. DebOps respects this upstream default. You
          can change it\n  using :envvar:`netbox__config_census_reporting`.\n\n- The
          role can be used with NetBox deployed in a clustered PostgreSQL setup\n
          \ with primary/standby nodes.\n\n:ref:`debops.nginx` role\n''''''''''''''''''''''''\n\n-
          Different file templates used in the role can now be overridden by the users\n
          \ with the DebOps template override system and the ``template_src`` lookup\n
          \ plugin.\n\n:ref:`debops.preseed` role\n''''''''''''''''''''''''''\n\n-
          The role will now generate preseed templates for Debian 13 (Trixie)\n  automated
          installation.\n\n:ref:`debops.resolved` role\n'''''''''''''''''''''''''''\n\n-
          The role will add a new entry in the :file:`/etc/services` database (using\n
          \ the :ref:`debops.etc_services` role) for the ``5355`` TCP and UDP ports,\n
          \ reserved for the `Link-Local Multicast Name Resolution`__. This should
          help\n  with identification of unknown TCP/UDP ports of the listening services.\n\n
          \ .. __: https://en.wikipedia.org/wiki/Link-Local_Multicast_Name_Resolution\n\nChanged\n```\n\nUpdates
          of upstream application versions\n''''''''''''''''''''''''''''''''''''''''\n\n-
          In the :ref:`debops.netbox` role, the NetBox version has been updated to\n
          \ `v4.4.1`.\n\n- In the :ref:`debops.ipxe` role, the Debian Bookworm installer
          has been\n  updated to v12.12.\n\nGeneral\n'''''''\n\n- The :ref:`debops.root_account`,
          :ref:`debops.system_users` and\n  :ref:`debops.users` roles are now able
          to handle the symlinked\n  :file:`~/.ssh/authorized_keys` files correctly
          using optional `follow`\n  parameter.\n\n- The DebOps CI pipeline in GitHub
          Actions is improved and will be executed on\n  pull requests and pushes
          to test changes before merging them.\n\n- The :command:`debops` script and
          custom Ansible lookup plugins should now be\n  compatible with Python 3.12+
          due to removal of the `distutils` Python\n  dependency, replaced by the
          `packaging` Python module.\n\n- References to the old `debops.roleXX` Ansible
          Collections have been removed\n  from all playbooks, since the project is
          now contained in a single Ansible\n  Collection.\n\n:ref:`debops.apt` role\n''''''''''''''''''''''\n\n-
          The Debian 10 (Buster) release has been archived and removed from Debian\n
          \ mirrors. The role will use <https://archive.debian.org/debian> as the\n
          \ repository URL on Debian Buster hosts.\n\n- The role now can manage repository
          GPG keys directly, stored in the\n  :file:`/etc/apt/keyrings/` directory,
          bypassing the deprecated\n  `ansible.builtin.apt_key` module. Support for
          the Ansible module is\n  present, but needs to be enabled explicitly.\n\n
          \ Existing role configuration might need to be updated to support new changes,\n
          \ check the role documentation for details.\n\n:ref:`debops.gitlab` role\n'''''''''''''''''''''''''\n\n-
          Users can now select specific GitLab version to install using the APT\n
          \ preferences, by specifying the package version in the\n  :envvar:`gitlab__preferred_version`
          variable. By default, the latest version\n  will be installed.\n\n- The
          :command:`nginx` service inside of the GitLab Omnibus installation will\n
          \ be restarted when X.509 certificates managed by the :ref:`debops.pki`
          role\n  are reissued, for example via ACME.\n\n:ref:`debops.gitlab_runner`
          role\n''''''''''''''''''''''''''''''''\n\n- The role is now compatible with
          GitLab 17.x and newer releases.\n\n- The runner registration method has
          changed, see the role documentation for\n  details.\n\n:ref:`debops.keyring`
          role\n''''''''''''''''''''''''''\n\n- The role now can manage repository
          GPG keys directly, stored in the\n  :file:`/etc/apt/keyrings/` directory,
          bypassing the deprecated\n  `ansible.builtin.apt_key` module. Support for
          the Ansible module is\n  present, but needs to be enabled explicitly.\n\n
          \ Existing role configuration might need to be updated to support new changes,\n
          \ check the role documentation for details.\n\n:ref:`debops.nginx` role\n''''''''''''''''''''''''\n\n-
          The custom :command:`systemd` override that ensures that the :command:`nginx`\n
          \ service is started after network is available will be installed only on
          older\n  Debian/Ubuntu releases; it's now the default since Debian Bookworm.\n\n:ref:`debops.pki`
          role\n''''''''''''''''''''''\n\n- The default key type in :command:`certbot`
          is set to RSA, since currently\n  there's no support for different key types
          in DebOps PKI infrastructure.\n\n- The permission of the :file:`config/environment`
          configuration file in PKI\n  realms will be se to `0644` so that other UNIX
          accounts can read it. This is\n  needed by the :command:`acme-tiny` command
          which is executed on a separate\n  UNIX account.\n\n:ref:`debops.postgresql_server`
          role\n''''''''''''''''''''''''''''''''''''\n\n- The role can now support
          `pgBadger`\\_\\_ log analyzer by enabling verbose log\n  output and modifying
          access to the log files themselves in the\n  :file:`/var/log/postgresql/`
          directory. This functionality is disabled by\n  default and can be enabled
          using a role variable.\n\n  .. \\_\\_: <https://pgbadger.darold.net/>\n\n-
          The default log ident string is changed to `postgresql-<version>-<name>`
          to\n  better distinguish different PostgreSQL instances in the system logs.\n\n:ref:`debops.reprepro`
          role\n'''''''''''''''''''''''''''\n\n- The role now configures local APT
          repositories for Debian 13 (Trixie) and\n  Debian 14 (Forky) by default.
          Configuration for Debian Buster repositories\n  has been removed. Symlinks
          for the :file:`stable/`, :file:`oldstable/` and\n  :file:`oldoldstable/`
          releases will be updated automatically to point to the\n  correct Debian
          releases.\n\n:ref:`debops.resources` role\n''''''''''''''''''''''''''''\n\n-
          The :command:`git` repositories will be processed by the role first, since\n
          \ :command:`git` can handle directory creation if needed.\n\n:ref:`debops.rspamd`
          role\n'''''''''''''''''''''''''\n\n- Due to the `removal`\\_\\_ of the `distutils`
          Python module from Python v3.12,\n  custom scripts included in the role
          which create and update DKIM keys have\n  been updated to use the `shutil`
          module instead.\n\n  .. \\_\\_: <https://docs.python.org/3.11/whatsnew/3.10.html#distutils-deprecated>\n\n:ref:`debops.snmpd`
          role\n''''''''''''''''''''''''\n\n- The :file:`snmpd.service` configuration
          file provided in the role will ensure\n  that the :command:`snmpd` daemon
          is restarted on failure. Older versions of\n  :command:`snmpd` can `fail
          due to rapid changes in network interfaces`\\_\\_.\n\n  .. \\_\\_: <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1023656>\n\n:ref:`debops.yadm`
          role\n'''''''''''''''''''''''\n\n- The paths to the repositories that are
          safe to clone by the :command:`git`\n  command, used for dotfiles by the
          :ref:`debops.system_users` and\n  :ref:`debops.users` roles, will be defined
          in the :file:`/etc/gitconfig`\n  system-wide configuration file instead
          of the per-user :file:`~/.gitconfig`\n  configuration files. This avoids
          the issue of modifying per-user environment\n  from the system-wide level
          on which DebOps operates and ensires that the\n  cloned dotfiles are not
          modified. The specific tasks that do this have been\n  moved from the :ref:`debops.system_users`
          and :ref:`debops.users` role into\n  the :ref:`debops.yadm` role.\n\nFixed\n\n```\n\nGeneral\n'''''''\n\n-
          The :ref:`debops.system_users` and the :ref:`debops.users` roles will add
          the\n  dotfiles repository cloned by the ``root`` UNIX account in the\n
          \ :ref:`debops.yadm` role to the list of trusted :command:`git` repositories
          in\n  the :file:`~/.gitconfig` configuration file of each user account managed
          by\n  the role. This is needed to allow :command:`git` to clone local repositories\n
          \ not owned by the UNIX account, required by the mitigation of the\n  `CVE-2022-24765`__
          security vulnerability.\n\n  .. __: https://github.blog/open-source/git/git-security-vulnerability-announced/#cve-2022-24765\n\n-
          The :command:`debops` script will not try to download the required Ansible\n
          \ Collections during new project creation if the :command:`ansible-galaxy`\n
          \ command is not available in the user's ``$PATH``.\n\n- The :file:`tools/dist-upgrade.yml`
          playbook will not fail anymore during\n  :file:`/etc/services` database
          assembly if no upgrade was performed.\n\n- New DebOps project directories
          will use fixed Ansible configuration for\n  callback plugins and will default
          to a YAML output format of the playbook\n  results.\n\n:ref:`debops.apache`
          role\n'''''''''''''''''''''''''\n\n- Fixed an issue with the vhost ``state:
          \"absent\"`` parameter not working\n  correctly when the ``enabled: False``
          parameter was not set as well.\n\n:ref:`debops.docker_gen` role\n'''''''''''''''''''''''''''''\n\n-
          Flattened the list of directories that are created by the ``file`` task.
          This\n  should fix the issue of Ansible stopping during execution due to
          nested lists\n  in the ``loop`` keyword.\n\n:ref:`debops.dropbear_initramfs`
          role\n'''''''''''''''''''''''''''''''''''''\n\n- The role now supports both
          the old and the new location if the initramfs\n  configuration files.\n\n:ref:`debops.ferm`
          role\n'''''''''''''''''''''''\n\n- The role will restart the :command:`fail2ban`
          service instead of reloading\n  it, which will ensure that the custom rules
          are re-added when the\n  :command:`ferm` service is restarted.\n\n- Fixed
          an issue with the role failing if the :envvar:`ferm__parsed_rules`\n  variable
          is not defined correctly. The role will skip rule generation in such\n  case
          instead of failing with the \"AnsibleUndefined\" error message.\n\n:ref:`debops.ifupdown`
          role\n'''''''''''''''''''''''''''\n\n- The :file:`iface@.service` :command:`systemd`
          unit provided by the role is\n  changed to use ``After==sys-subsystem-net-devices-%i.device``
          parameter. This\n  should ensure that the bridge interfaces are correctly
          started at boot time.\n\n:ref:`debops.netbox` role\n'''''''''''''''''''''''''\n\n-
          Fixed an issue with the Django superuser creation task that failed execution\n
          \ if the ``error`` string was not present in command output; this resulted
          in\n  an incomplete installation.\n\n:ref:`debops.nullmailer` role\n'''''''''''''''''''''''''''''\n\n-
          The role will avoid interacting with the LDAP server when LDAP support is\n
          \ disabled while DebOps is used in LDAP environment.\n\n:ref:`debops.owncloud`
          role\n'''''''''''''''''''''''''''\n\n- Fixed conditional logic in a task
          which determines if the \"autosetup\"\n  operation should be performed during
          Nextcloud/ownCloud installation.\n\n:ref:`debops.pki` role\n''''''''''''''''''''''\n\n-
          The Let's Encrypt service dropped support for the ``contacts`` option. This\n
          \ requires a new version of the :command:`acme-tiny` command to be installed
          on\n  client hosts to work properly. Since the ``acme-tiny`` APT package
          in Debian\n  Bookworm is too old, on this release the role will install\n
          \ :command:`acme-tiny` from source. On existing installations, the\n  ``acme-tiny``
          APT package might need to be removed manually.\n\n- The ``acme-tiny`` source
          repository switched from the ``master`` branch to\n  the ``main`` branch,
          existing source installations need to remove the local\n  clone of the repository
          in :file:`/usr/local/src/pki-acme/diafygi/acme-tiny/`\n  so that it can
          be cloned correctly by Ansible. You should also remove the\n  copy of the
          :file:`/usr/local/bin/acme-tiny` command to be installed\n  correctly.\n\n:ref:`debops.pdns`
          role\n'''''''''''''''''''''''\n\n- The PowerDNS service will be configured
          to listen on all external IPv4 and\n  IPv6 addresses of a host insteand
          of listening on \"all\" IP addresses to\n  ensure that the service is started
          while the :command:`systemd-resolved`\n  service listens on the loopback
          interface.\n\n:ref:`debops.postgresql_server` role\n''''''''''''''''''''''''''''''''''''\n\n-
          Fixed an issue with the ``vacuum_defer_cleanup_age`` option removal in\n
          \ PostgreSQL 16.x resulting in failed startup of the service. The option
          will\n  be added only on supported PostgreSQL versions.\n\n:ref:`debops.resolved`
          role\n'''''''''''''''''''''''''''\n\n- The role will disable synthesis of
          local hostname by the\n  :command:`systemd-resolved` service (enabled by
          default in systemd v256) to\n  allow resolution of the host's FQDN queries
          by upstream DNS server.\n\n:ref:`debops.sysctl` role\n'''''''''''''''''''''''''\n\n-
          The :file:`50-pid-max.conf` configuration file will be installed only on\n
          \ platforms which support 64-bit architecture.\n\nRemoved\n```\n\nGeneral\n'''''''\n\n-
          The `volkszaehler` (`debops-contrib`) role was removed because the role\n
          \ maintainer considers the application to be superseded by Grafana.\n  See
          `Future of the project; The elephant in the room \u2013 Grafana`\\_\\_.\n\n
          \ .. \\_\\_: [volkszaehler/volkszaehler.org#819](https://redirect.github.com/volkszaehler/volkszaehler.org/issues/819)\n\n-
          The `bitcoind` role was removed due to lack of interest by the role\n  maintainer.\n\n-
          The `profile_tasks.py` Ansible callback plugin has been removed due to\n
          \ \"Unexpected Exception\" error on Ansible v2.19. Users should use its
          upstream\n  alternative, `ansible.posix.profile_tasks` plugin.\n\n:ref:`debops.ipxe`
          role\n'''''''''''''''''''''''\n\n- Debian 10 (Buster) has been archived
          and it's no longer available on Debian\n  mirrors, support for its installer
          has been removed from the role.\n\n:ref:`debops.netbox` role\n'''''''''''''''''''''''''\n\n-
          The NAPALM integration feature found in NetBox 3.4 and before has been moved\n
          \ to a dedicated plugin. If you want to continue using it, you will have
          to\n  install the plugin. All role variables about NAPALM except\n  :envvar:`netbox__napalm_ssh_generate`
          and\n  :envvar:`netbox__napalm_ssh_generate_bits` have been removed.\n\n:ref:`debops.python`
          role\n'''''''''''''''''''''''''\n\n- The `python3-future` and `python-future`
          APT packages have been removed\n  from Debian Stable release, and will not
          be installed by default by the\n  :ref:`debops.python` role.\n\nSecurity\n\n```\n\n:ref:`debops.icinga`
          role\n'''''''''''''''''''''''''\n\n- The GPG key of the Icinga upstream
          APT repository `has been replaced`__ on\n  30th September 2024. The role
          includes the new key which should be installed\n  on the host on the next
          run. The old GPG key will not be removed\n  automatically.\n\n  .. __: https://icinga.com/blog/2024/08/26/icinga-package-repository-key-rotation-2024/\n\n`debops
          v3.2.0`_ - 2024-09-16\n-----------------------------\n\n.. _debops v3.2.0:
          https://github.com/debops/debops/compare/v3.1.0...v3.2.0\n\nAdded\n~~~~~\n\nNew
          DebOps roles\n''''''''''''''''\n\n- The :ref:`debops.debconf` Ansible role
          can be used to pre-configure APT\n  packages which use the `debconf`__ configuration
          database and install them\n  afterwards. The role is included near the end
          of the :file:`site.yml`\n  playbook to allow of configuration of other needed
          services before the actual\n  package installation.\n\n  .. __: https://en.wikipedia.org/wiki/Debian_configuration_system\n\nGeneral\n'''''''\n\n-
          The :command:`debops` script can now log its operation to standard error
          and\n  to the :command:`syslog` service. Use the ``--verbose`` or ``-v``
          flag to\n  enable log output on the console.\n\n- Users can define \"playbook
          sets\" on the view level of the \"modern\" project\n  directories. Playbook
          sets can be used as aliases to call multiple playbooks\n  using a custom
          name. See :ref:`playbook_sets` documentation for more details.\n\n- Users
          can now enable \"read-only Fridays\" functionality on a per project\n  basis,
          to ensure that on Fridays, Ansible playbooks are run only in check\n  mode,
          with ``--check`` and ``--diff`` arguments automatically added to the\n  :command:`ansible-playbook`
          command options.\n\n:ref:`debops.apt_install` role\n''''''''''''''''''''''''''''''\n\n-
          The role will import the :ref:`debops.secret` role during execution to get\n
          \ access to the :file:`secret/` directory. This permits use of stored passwords\n
          \ in Debconf answers configured via the :ref:`debops.apt_install` role.\n\n:ref:`debops.dnsmasq`
          role\n''''''''''''''''''''''''''\n\n- The role can optionally ignore IP
          addresses on a network interface and use\n  only specified ones for :command:`dnsmasq`
          configuration. This can help with\n  Routing Advertisements issues on internal
          networks. See role documentation\n  for more details.\n\n:ref:`debops.pki`
          role\n''''''''''''''''''''''\n\n- Add support for defining per-realm UNIX
          environment variables set during\n  :command:`pki-realm` script execution.
          These variables can be used to augment\n  runtime environment, for example
          to define HTTP proxy to use inside internal\n  networks with restricted
          access to the outside world.\n\n:ref:`debops.rabbitmq_server` role\n''''''''''''''''''''''''''''''''''\n\n-
          The role can manage much more RabbitMQ internal structures - exchanges,\n
          \ queues, bindings between them, as well as vhost and user limits.\n\nChanged\n~~~~~~~\n\nUpdates
          of upstream application versions\n''''''''''''''''''''''''''''''''''''''''\n\n-
          In the :ref:`debops.ipxe` role, support for the Debian Bullseye netboot\n
          \ installer has been updated to v11.12; the Debian Bookworm installer has
          been\n  updated to v12.7.\n\nGeneral\n'''''''\n\n- DebOps now uses `pipx`__
          as the preferred installation method. This allows\n  for easier maintenance
          of the DebOps virtual environment.\n\n  .. __: https://pipx.pypa.io/\n\n:ref:`debops.elasticsearch`
          role\n''''''''''''''''''''''''''''''''\n\n- The role now supports new Elasticsearch
          v8.x password management mechanism.\n\n- The role can now manage passwords
          in separate Elasticsearch clusters defined\n  in one Ansible inventory.\n\n
          \ .. warning:: Due to this change, Elasticsearch passwords stored in the\n
          \              :file:`ansible/secret/` subdirectory will be read from a
          different\n               location. If passwords are not moved to the new
          location, role\n               will reset the Elasticsearch built-in users
          passwords\n               automatically. This might result in data loss.\n\n:ref:`debops.kibana`
          role\n'''''''''''''''''''''''''\n\n- The path to the password file stored
          in :file:`ansible/secret/` subdirectory\n  is now configurable using a variable.\n\n-
          The role uses new per-cluster Elasticsearch passwords by default. This is\n
          \ done using a separate :envvar:`kibana__elasticsearch_cluster_name` variable,\n
          \ which needs to be synchronized with the Elasticsearch configuration via\n
          \ Ansible inventory (Kibana can be installed separately from Elasticsearch).\n\n:ref:`debops.lxc`
          role\n''''''''''''''''''''''\n\n- The role supports integration with the
          :command:`systemd-resolved` DNS\n  resolver. This permits use of the :command:`systemd-networkd`
          service to\n  manage networking on the LXC host.\n\n- LXC containers will
          be configured with AppArmor \"unconfined\" profile by\n  default. This change
          allows startup of various services inside of the\n  container without errors
          on Debian Bookwrom hosts.\n\n:ref:`debops.lxd` role\n''''''''''''''''''''''\n\n-
          The role supports integration with the :command:`systemd-resolved` DNS\n
          \ resolver. This permits use of the :command:`systemd-networkd` service
          to\n  manage networking on the LXD host.\n\n:ref:`debops.nginx` role\n''''''''''''''''''''''''\n\n-
          The ``/index.html`` and ``/index.htm`` entries in the default ``try_files``\n
          \ configuration option have been replaced with the ``$uri/index.html`` entry.\n
          \ This change should ensure that any location not present on the server
          will\n  return error 404 correctly, instead of falling back to the ``/index.html``\n
          \ file if it's present in the root of the website.\n\n:ref:`debops.postgresql_server`
          role\n''''''''''''''''''''''''''''''''''''\n\n- The :command:`autopostgresqlbackup`
          script was modified to have separate set\n  of options for the :command:`psql`
          command and the :command:`pg_dump`\n  command. This permits the use of the
          ``--format=custom`` option in\n  :command:`pg_dump` command, enabling more
          efficient database dumps.\n\n- The extension of the backup files created
          by the\n  :command:`autopostgresqlbackup` script can be configured via a
          default\n  variable. This change might cause existing installations to change
          the file\n  extension used during backups.\n\n:ref:`debops.proc_hidepid`
          role\n'''''''''''''''''''''''''''''''\n\n- The role will check if the host
          is in the ``debops_service_libvirtd`` Ansible\n  inventory group, or if
          the :ref:`debops.libvirtd` role was applied on the\n  host and will change
          the ``hidepid=`` value to ``0`` to avoid issues with\n  Polkit subsystem.\n\n:ref:`debops.rsyslog`
          role\n''''''''''''''''''''''''''\n\n- The log rotation configuration for
          logs managed by :command:`rsyslog` now has\n  an upper size limit of 1 GB
          to trigger the rotation. This should help in\n  cases when these logs are
          growing rapidly, but the rotation period is too\n  large to avoid filling
          up disk space.\n\n:ref:`debops.zabbix_agent` role\n'''''''''''''''''''''''''''''''\n\n-
          The fact script now supports both the old Zabbix Agent, and the new Zabbix\n
          \ Agent 2 configuration files.\n\nFixed\n~~~~~\n\n:ref:`debops.dpkg_cleanup`
          role\n'''''''''''''''''''''''''''''''\n\n- Various YAML lists used in the
          package removal script will be sorted at Jinja\n  level to avoid constant
          reordering of list elements during Ansible execution\n  which makes the
          role not idempotent.\n\n:ref:`debops.gitlab` role\n'''''''''''''''''''''''''\n\n-
          Fixed an issue with the :file:`/etc/gitlab/ssl/` directory changing its
          mode\n  from 0775 set by the role to 0755 set by the :command:`gitlab-ctl\n
          \ reconfigure` command, making the role not idempotent.\n\n:ref:`debops.grub`
          role\n'''''''''''''''''''''''\n\n- Fixed an issue with the :file:`01_users`
          configuration file generating errors\n  and resulting in an empty user section
          in the configuration generated by the\n  :command:`update-grub` command.\n\n:ref:`debops.ifupdown`
          role\n'''''''''''''''''''''''''''\n\n- Fixed an issue with the :file:`ifup-allow-boot.service`
          :command:`systemd`\n  unit not starting correctly on boot due to issues
          with the ``$`` character\n  escaping.\n\n:ref:`debops.lxc` role\n''''''''''''''''''''''\n\n-
          The role will by default disable NFtables integration within the\n  :command:`lxc-net`
          script, configurable via a default variable. This fixes\n  usage of LXC
          containers on Debian Bookworm with the :command:`ferm` service\n  used by
          DebOps.\n\n:ref:`debops.lxd` role\n''''''''''''''''''''''\n\n- Fixed an
          issue with the default LXD daemon preseed configuration by removing\n  the
          unsupported ``managed`` parameter. This should allow the LXD daemon to be\n
          \ initialized correctly.\n\n- Fixed an issue with the role trying to copy
          the source-built libraries when\n  an APT-based installation is used. The
          role will check if the libraries exist\n  before trying to copy them.\n\n-
          Fixed an issue on Debian Bookworm where the :command:`lxd-apparmor-load`\n
          \ binary is not present where the APT-based LXD daemon expects it. The role\n
          \ will create a symlink for this binary when needed.\n\n:ref:`debops.networkd`
          role\n'''''''''''''''''''''''''''\n\n- Do not restart the :command:`systemd-networkd`
          service if the role detects\n  that the network stack is not managed by
          it. This should avoid the issue\n  where the role playbook hanged on first
          run of the role on a host not managed\n  by :command:`systemd-networkd`
          service.\n\n:ref:`debops.ntp` role\n''''''''''''''''''''''\n\n- Fixed an
          issue with conditional check for Linux capabilities not being\n  checked
          reliably to decide if NTP support should be enabled. The role should\n  now
          correctly detect when Linux capabilities are enforced.\n\n:ref:`debops.rsyslog`
          role\n''''''''''''''''''''''''''\n\n- List of log files which should be
          managed by the :command:`logrotate` service\n  will be sorted to avoid constant
          reordering during role execution, which\n  fixes role idempotency.\n\n:ref:`debops.swapfile`
          role\n'''''''''''''''''''''''''''\n\n- Fixed an issue in the :command:`swapon`
          task conditional logic where the task\n  could not be executed correctly
          when the swap file was missing.\n\n- Ensure that the swap file is correctly
          disabled by the :command:`swapoff`\n  command before being removed with
          the ``absent`` state.\n\nRemoved\n~~~~~~~\n\n:ref:`debops.ipxe` role\n'''''''''''''''''''''''\n\n-
          Debian 9 (Stretch) has been removed from Debian mirrors, therefore the role\n
          \ will no longer offer support for installing Debian Stretch via PXE boot.\n\n`debops
          v3.1.0`_ - 2023-11-29\n-----------------------------\n\n.. _debops v3.1.0:
          https://github.com/debops/debops/compare/v3.0.0...v3.1.0\n\nAdded\n~~~~~\n\nNew
          DebOps roles\n''''''''''''''''\n\n- The :ref:`debops.metricbeat` role, part
          of the Elastic stack, can be used to\n  install `Metricbeat`__, a service
          that can gather metrics and other non-log\n  data from other services and
          send them to Elasticsearch for processing.\n\n  .. __: https://www.elastic.co/beats/metricbeat\n\n-
          The :ref:`debops.opensearch` role can be used to set up an unsecured,\n
          \ local-only installation of `OpenSearch`__. OpenSearch is a fork of\n  Elasticsearch
          that continues to be released under a free software license.\n\n  .. __:
          https://opensearch.org/\n\n- The :ref:`debops.reboot` role can be used to
          reboot, forcefully or only if\n  required, any DebOps host.\n\n- The :ref:`debops.miniflux`
          role can install and manage Miniflux, a web-based,\n  minimalistic feed
          reader written in Go.\n\n- The :ref:`debops.systemd` role is included in
          the common playbook by default.\n  It configures the :command:`systemd`
          system and service manager. Both\n  system-wide, as well as user services
          configured globally can be managed with\n  this role.\n\n- The :ref:`debops.networkd`
          role can be used to configure the\n  :command:`systemd-networkd` service,
          part of the :command:`systemd` project\n  responsible for network interface
          configuration.\n\n- The :ref:`debops.timesyncd` role is used to configure
          the\n  :command:`systemd-timesyncd` service, a minimal SNTP/NTP client.
          The role is\n  included in the :file:`layer/common.yml` playbook instead
          of the\n  :ref:`debops.ntp` role to provide NTP support by default.\n\n-
          The :ref:`debops.resolved` role is included in the :file:`layer/common.yml`\n
          \ playbook by default, replacing the :ref:`debops.resolvconf` role. It manages\n
          \ the :command:`systemd-resolved` service, a local DNS resolver.\n\n- The
          :ref:`debops.bind` role is responsible for installing and managing the\n
          \ ISC BIND nameserver. It supports DNSSEC, key rollovers, multiple DNS zones,\n
          \ views and many more features.\n\n- The :ref:`debops.apparmor` role can
          be used to manage AppArmor configuration\n  and profiles. It will be included
          in the :file:`layer/common.yml` playbook in\n  the future.\n\n- The :ref:`debops.apt_mirror`
          role can be used to create a mirror of one or\n  multiple APT repositories
          and publish them for other hosts to use as package\n  source.\n\nGeneral\n'''''''\n\n-
          DebOps now includes a custom version of the\n  ``community.general.apache2_module``
          Ansible module, available as\n  ``debops.debops.apache2_module``. The custom
          module includes a fixed\n  idempotency check for enabled Apache 2 modules
          that works on Debian or Ubuntu\n  hosts. The :ref:`debops.apache` Ansible
          role will use this module instead of\n  the original one.\n\n- The :command:`debops
          exec` command can be used to execute Ansible modules\n  against hosts in
          the project directory; this is a wrapper for the\n  :command:`ansible` command.\n\n-
          The :command:`debops run`, :command:`debops check` and :command:`debops
          exec`\n  commands can emit ASCII \"bell\" at the end of Ansible execution
          to notify user\n  after long runs. Use the ``-E`` or ``--bell`` option to
          enable this.\n\n- The :command:`debops env` command can be used to inspect
          the runtime\n  environment variables present when other DebOps commands
          are used, as well as\n  execute external commands inside of that runtime
          environment. This is handy\n  for using various :command:`ansible-*` commands
          within DebOps project\n  directories.\n\n- DebOps monorepo now includes
          configuration for the `pre-commit`__ hook to\n  verify changes before they
          are committed to the repository. Multiple checks\n  are performed, notably
          `codespell`__ is used to find spelling mistakes. More\n  checks will be
          enabled in the future.\n\n  .. __: https://pre-commit.com/\n  .. __: https://github.com/codespell-project/codespell\n\n-
          New project directory layout called \"modern\" has been implemented in DebOps\n
          \ scripts. It can be created using the command:\n\n  .. code-block:: console\n\n
          \    debops project init -t modern <project>\n\n  The modern project layout
          supports multiple Ansible inventories encapsulated\n  into :ref:`infrastructure
          views <project_infrastructure_views>`.\n\n- DebOps scripts now support management
          of the project directories using\n  :command:`git` as VCS repositories.
          New project directories will use\n  :command:`git` by default. This also
          enables support for secrets encrypted\n  using :command:`git-crypt`.\n\n:ref:`debops.apt`
          role\n''''''''''''''''''''''\n\n- The role now supports management of the
          \"Deb822\" format of the APT repository\n  sources.\n\n:ref:`debops.avahi`
          role\n''''''''''''''''''''''''\n\n- The role will ensure that the :command:`systemd-resolved`
          service Multicast\n  DNS support is disabled to avoid conflict with the
          :command:`avahi-daemon`\n  service.\n\n:ref:`debops.ferm` role\n'''''''''''''''''''''''\n\n-
          Multicast DNS traffic is accepted by default in the firewall to allow for
          the\n  ``.local`` mDNS domain resolution by the :command:`systemd-resolved`
          service.\n  The role provides a set of variables to limit the traffic by
          subnet, or\n  disable it completely.\n\n:ref:`debops.icinga_web` role\n'''''''''''''''''''''''''''''\n\n-
          The role can now create host and service templates using Icinga Director
          API.\n  This should improve the initial deployment experience, since users
          don't need\n  to create basic host templates by hand before registering
          hosts in Icinga.\n\n:ref:`debops.ipxe` role\n'''''''''''''''''''''''\n\n-
          The Debian Installer Menu can now install Debian GNU/Linux 12 (Bookworm).\n\n:ref:`debops.java`
          role\n'''''''''''''''''''''''\n\n- The role will now configure the default
          security policy for Java\n  applications. The additions will permit Java
          applications to access the\n  system-wide CA certificate store in :file:`/etc/ssl/certs/`
          directory as well\n  as the PKI infrastructure managed by the :ref:`debops.pki`
          role, so that Java\n  applications can use the existing X.509 certificates
          and private keys for TLS\n  encryption support.\n\n:ref:`debops.keyring`
          role\n''''''''''''''''''''''''''\n\n- The role can now download APT repository
          GPG keys to separate keyring files,\n  which can be used to scope a given
          GPG key to specific APT repositories.\n\n:ref:`debops.kibana` role\n'''''''''''''''''''''''''\n\n-
          The role can now manage passwords and other confidential data stored in
          the\n  Kibana keystore.\n\n:ref:`debops.mount` role\n''''''''''''''''''''''''\n\n-
          The role can now create custom files which can be used to store credentials\n
          \ required to mount remote devices.\n\n:ref:`debops.netbox` role\n'''''''''''''''''''''''''\n\n-
          The role will enable LDAP support in NetBox if LDAP environment managed
          by\n  the :ref:`debops.ldap` role is detected on the host. Currently only
          user\n  authentication and Django ACL system is supported via LDAP groups.\n\n:ref:`debops.nginx`
          role\n''''''''''''''''''''''''\n\n- The server configuration files can now
          contain :command:`nginx` configuration\n  outside of the ``server`` and
          ``upstream`` blocks using the new\n  ``item.toplevel_options`` parameter.\n\n:ref:`debops.owncloud`
          role\n'''''''''''''''''''''''''''\n\n- Support to host the application on
          a subpath for security reasons.\n\n:ref:`debops.python` role\n'''''''''''''''''''''''''\n\n-
          The :file:`service/python_raw` playbook used during early bootstrap process\n
          \ can now inject host entries into the :file:`/etc/hosts` configuration
          file to\n  permit DNS name resolution early during bootstrapping.\n\n:ref:`debops.resources`
          role\n''''''''''''''''''''''''''''\n\n- The :ref:`debops.resources` role
          can now be used to install pip library\n  dependencies or virtual environments
          via the ``ansible.builtin.pip``\n  module.\n\n- The :ref:`debops.resources`
          role can now be used to replace a line via the\n  ``ansible.builtin.replace``
          module.\n\n:ref:`debops.slapd` role\n''''''''''''''''''''''''\n\n- The playbook
          can now be configured to skip the saslauthd role execution.\n\n:ref:`debops.zabbix_agent`
          role\n'''''''''''''''''''''''''''''''\n\n- The role now supports management
          of Zabbix Agent (written in C) as well as\n  Zabbix Agent 2 (written in
          Go), available in Debian repositories. Only one\n  flavor can be managed
          at a time, but role provides an easy way to switch\n  between the two flavors.\n\nChanged\n~~~~~~~\n\nUpdates
          of upstream application versions\n''''''''''''''''''''''''''''''''''''''''\n\n-
          In the :ref:`debops.roundcube` role, the Roundcube version installed by\n
          \ default has been updated to ``1.6.0``.\n\n- In the :ref:`debops.ipxe`
          role, the Debian Buster netboot installer version\n  has been updated to
          the next point release, 10.13. Debian Bullseye has been\n  updated to the
          next point release as well, 11.8. The Debian Bookworm release\n  has been
          updated to 12.2.\n\n- In the :ref:`debops.netbox` role, the NetBox version
          has been updated to\n  ``v3.4.2``.\n\n- In the :ref:`debops.owncloud` role,
          the ownCloud support has been updated to\n  ``v10.10``.\n\n- In the :ref:`debops.owncloud`
          role, the Nextcloud support has been updated to\n  ``v24.0`` and ``v25.0``.\n\nGeneral\n~~~~~~~\n\n-
          Tasks which use modules and plugins from the ``ansible.builtin`` Ansible\n
          \ Collection have been updated to refer to them via their Fully Qualified\n
          \ Collection Names (for example ``ansible.builtin.file`` instead of ``file``).\n
          \ This is due to changing requirements of the :command:`ansible-lint` tool.\n\n
          \ New submissions to the DebOps project will be required to use the FQCNs
          as\n  well.\n\n- Various roles that lookup SSH public keys on the Ansible
          Controller\n  (:ref:`debops.preseed`, :ref:`debops.reprepro`, :ref:`debops.system_users`)\n
          \ will try to use the :file:`~/.ssh/authorized_keys` file to find the keys
          if\n  all other methods fail.\n\n- In the :file:`site.yml` playbook, the
          :file:`sys.yml` and :file:`net.yml`\n  playbooks will be executed before
          the :file:`common.yml` playbook. This\n  should ensure that configuration
          of certain resources like mount points or\n  LVM pools is present before
          the system is prepared for general operation.\n\n- The :file:`ansible/playbooks/tools/reboot.yml`
          Ansible playbook has been\n  moved to :file:`ansible/playbooks/reboot.yml`
          file and uses the new\n  :ref:`debops.reboot` Ansible role to perform operations.
          To use it, you can\n  run the ``reboot`` playbook instead of ``tools/reboot``.\n\n-
          The :file:`ansible/playbooks/tools/upgrade-reboot.yml` Ansible playbook
          has\n  been moved to :file:`ansible/playbooks/upgrade.yml` file and will
          no longer\n  reboot the host automatically. Users can chain the ``upgrade``
          and ``reboot``\n  playbooks to achieve the previous behaviour, for example:\n\n
          \ .. code-block:: console\n\n     debops run upgrade reboot -l <host>\n\n-
          The debops-contrib :file:`dropbear_initramfs` playbook has been moved to\n
          \ the :ref:`debops.dropbear_initramfs` playbook. The role variable\n  ``dropbear_initramfs__host_authorized_keys``
          now uses the same keys as\n  the ``ansible.posix.authorized_key`` module.\n\n-
          Various tasks that interact with the MariaDB/MySQL databases will now use
          the\n  :file:`/run/mysqld/mysqld.sock` UNIX socket to do so, due to changes
          in\n  MariaDB restricting local connections for the ``root`` UNIX account.\n\n-
          The HTML documentation build process has been improved. The\n  :command:`yaml2rst`
          script will be invoked only when a defaults file is\n  modified, significantly
          speeding up documentation rebuilds. Users can also\n  modify the :command:`sphinx`
          options specified in the Makefile via an\n  environment variable if they
          wish.\n\n- The :file:`ansible/playbooks/tools/dist-upgrade.yml` Ansible
          playbook now has\n  MTA configuration exposed via variables in case the
          mail should be sent via\n  a remote server instead of a local one.\n\n-
          DebOps playbooks have been reorganized to not use a large set of symlinks\n
          \ inside of the repository. Instead different sections of the :file:`site.yml`\n
          \ playbook have been organized into \"layers\", new playbooks are located
          under\n  the :file:`ansible/playbooks/layers/` subdirectory. See the new\n
          \ :ref:`playbooks` documentation for more details.\n\n- The new :ref:`debops.timesyncd`
          role has replaced the :ref:`debops.ntp` role\n  as the default NTP service
          provider in the :file:`layer/common.yml` playbook.\n  Existing hosts shouldn't
          be affected - the new role can automatically\n  recognize that a different
          time daemon package is installed on the host and\n  will not try to configure
          :command:`systemd-timesyncd` service in such case.\n  You might need to
          add your hosts to the ``[debops_service_ntp]`` Ansible\n  inventory group
          to keep using the old role.\n\n- The new :ref:`debops.resolved` role has
          replaced the :ref:`debops.resolvconf`\n  role as the default DNS resolver
          in the :file:`layer/common.yml` and the\n  bootstrap playbooks. Existing
          hosts shouldn't be affected, the role detects\n  presence of the ``resolvconf``
          APT package and does not modify the host\n  configuration in such case.\n\n-
          Multiple DebOps Collections on Ansible Galaxy have been merged into a single\n
          \ ``debops.debops`` Collection to prepare the project to switch role references\n
          \ to FQCNs. This is also a test to see if Ansible Galaxy allows >2 MB\n
          \ collection tarballs.\n\n- The :command:`debops config` command has been
          refactored and split into\n  multiple subcommands to allow easier configuration
          introspection. See\n  :ref:`it's documentation page <cmd_debops-config>`
          for more details.\n\n- The Debian 12 (Bookworm) has been released! Multiple
          DebOps roles have been\n  updated and switched the \"stable\" release to
          Bookworm, with Bullseye becoming\n  the \"oldstable\" release. The new Debian
          Testing release, \"Trixie\" has also\n  been added in relevant places.\n\n-
          DebOps now supports using :command:`git` in project directories - new\n
          \ projects will be initialized as :command:`git` repositories by default.
          The\n  :command:`git-crypt` command is also supported, and can encrypt project\n
          \ secrets.\n\n:ref:`debops.apt` role\n''''''''''''''''''''''\n\n- The role
          will configure APT to use Debian Security repositories via the\n  http://deb.debian.org/debian-security/
          CDN.\n\n- The role has been refreshed and management of the\n  :file:`/etc/apt/sources.list`
          file was redesigned to allow for better\n  flexibility in configuration.
          See role documentation for more details.\n\n:ref:`debops.apt_preferences`
          role\n''''''''''''''''''''''''''''''''''\n\n- The pin priorities for the
          Debian ``-updates`` and ``-security`` APT\n  repositories have been raised
          to 550 to match the raised priority of the\n  primary repository. This should
          ensure that when the custom pin priorities\n  are active, updates to Debian
          packages are correctly installed as well. See\n  :envvar:`apt_preferences__debian_stable_default_preset_list`
          variable for\n  details.\n\n:ref:`debops.docker_server` role\n''''''''''''''''''''''''''''''''\n\n-
          The role can now directly handle the daemon ``log-driver`` parameter.\n\n-
          The role has been redesigned from scratch; Python :command:`virtualenv`\n
          \ support has been removed since the :command:`docker-compose` is included
          in\n  Debian repositories directly, or is implemented as a Go plugin in
          upstream\n  repositories. The Docker configuration is now implemented via
          the\n  :ref:`universal_configuration` system, users will have to modify
          their\n  Ansible inventories. See the role documentation for details.\n\n:ref:`debops.elasticsearch`
          role\n''''''''''''''''''''''''''''''''\n\n- The role will check the status
          of the built-in user accounts via the HTTP API\n  instead of relying on
          the Ansible local facts and create them if they don't\n  exist. This should
          help with an upgrade of existing Elasticsearch clusters\n  without TLS encrypted
          traffic and authentication.\n\n:ref:`debops.gitlab` role\n'''''''''''''''''''''''''\n\n-
          The role has been rewritten from scratch and now can be used to deploy and\n
          \ manage a `GitLab Omnibus`__ instance (managed internally by Chef) on Debian\n
          \ or Ubuntu hosts. The role integrates with various DebOps services (firewall,\n
          \ PKI infrastructure, LDAP environment) with GitLab Omnibus. Both Community\n
          \ Edition (default) and Enterprise Edition are supported.\n\n  .. __: https://docs.gitlab.com/omnibus/\n\n:ref:`debops.global_handlers`
          role\n''''''''''''''''''''''''''''''''''\n\n- The :command:`systemd` handlers
          have been moved to a separate\n  :file:`handlers/systemd.yml` configuration
          file.\n\n:ref:`debops.icinga` role\n'''''''''''''''''''''''''\n\n- New hosts
          will be added to Icinga Director using the ``icinga-agent-host``\n  template,
          created by default by the :ref:`debops.icinga_web` role. On\n  existing
          installations, you should either create this template by hand, or\n  run
          the :ref:`debops.icinga_web` role so that it gets added automatically.\n\n:ref:`debops.icinga_db`
          role\n''''''''''''''''''''''''''''\n\n- The role will manage Icinga databases
          directly instead of relying on\n  :command:`dbconfig` Debian subsystem.
          This improves support for remote Icinga\n  database deployments accessible
          over TLS.\n\n:ref:`debops.icinga_web` role\n'''''''''''''''''''''''''''''\n\n-
          The LDAP configuration used by the role to configure LDAP access will be\n
          \ based on the :ref:`debops.ldap` Ansible local facts instead of static
          values,\n  to better support modified environments.\n\n:ref:`debops.influxdata`
          role\n'''''''''''''''''''''''''''''\n\n- InfluxData has published a new
          APT repository GPG key, the role should\n  refresh it automatically.\n\n:ref:`debops.minio`
          role\n''''''''''''''''''''''''\n\n- The role has been updated to support
          newer MinIO features, like the embedded\n  MinIO Console. Some of the instance
          parameters have been changed, for example\n  access key and secret key have
          been replaced with root account and password.\n  Check the role documentation
          for more details.\n\n:ref:`debops.nginx` role\n''''''''''''''''''''''''\n\n-
          Configure the :file:`nginx.service` systemd unit to start the\n  :command:`nginx`
          service after the network is configured. This way\n  :command:`nginx` should
          be able to resolve upstream services specified via\n  DNS names at startup.\n\n:ref:`debops.ntp`
          role\n''''''''''''''''''''''\n\n- The default NTP daemon used on hosts with
          the :command:`systemd` service\n  manager will be :command:`systemd-timesyncd`.
          Existing systems with\n  a different NTP server should not be affected by
          this change.\n\n- The role should better detect Linux Container environment
          and not try to\n  install an NTP daemon inside of a container.\n\n:ref:`debops.pki`
          role\n''''''''''''''''''''''\n\n- The :command:`pki-realm` script will call
          the :command:`certbot` command with\n  the :command:`certbot --authenticator
          <plugin>` option explicitly to allow\n  use with third-party authenticator
          plugins that might not support the\n  :command:`certbot --<plugin>` syntax.\n\n:ref:`debops.preseed`
          role\n''''''''''''''''''''''''''\n\n- The default guided partition recipe
          used by the Debian Installer is changed\n  from ``atomic`` to ``multi``.
          This should allow for easier changes in the\n  partition layout via LVM
          due to separate partitions for :file:`/home` and\n  :file:`/var` mount points.\n\n:ref:`debops.proc_hidepid`
          role\n'''''''''''''''''''''''''''''''\n\n- The role will check if PolicyKit
          is installed on the host, in which case the\n  default security level for
          access to the :file:`/proc` filesystem will be\n  more permissive.\n\n:ref:`debops.python`
          role\n'''''''''''''''''''''''''\n\n- The role will enable Python 2.7 support
          via the fact script only when an\n  existing Python 2.7 installation is
          detected. This change should help avoid\n  installing Python 2.7 packages
          on newer OS releases when they might be\n  unavailable.\n\n- The :file:`/etc/pip.conf`
          configuration file template can be overridden via\n  the DebOps template
          override mechanism.\n\n:ref:`debops.resolvconf` role\n'''''''''''''''''''''''''''''\n\n-
          In the :ref:`debops.resolvconf` role, you can now write a fully static\n
          \ :file:`/etc/resolv.conf` file without the ``resolvconf`` package.\n\n:ref:`debops.slapd`
          role\n''''''''''''''''''''''''\n\n- The default log level used by OpenLDAP
          has been changed from ``stats`` to\n  ``none`` to minimize log output in
          large environments. This can be modified\n  using Ansible inventory in case
          that the authentication, accounting or search\n  metrics are needed.\n\n:ref:`debops.sshd`
          role\n'''''''''''''''''''''''\n\n- The management of the :file:`/etc/ssh/sshd_config`
          configuration file has\n  been redesigned and now uses :ref:`universal_configuration`.
          Multiple default\n  variables have been removed as a result. Any changes
          in configuration applied\n  through Ansible inventory might need to be converted
          to the new format. Check\n  the changes on existing hosts before applying
          new configuration.\n\n:ref:`debops.system_users` role\n'''''''''''''''''''''''''''''''\n\n-
          The role will check remote user databases for local admin information using\n
          \ the :command:`getent passwd` command if the user has not been found in
          the\n  :file:`/etc/passwd` local database.\n\nFixed\n~~~~~\n\nGeneral\n'''''''\n\n-
          Extrepo facts file did not detect a disabled repository as being disabled\n
          \ due to a change in the extrepo file format.\n\n- Ensure that the custom
          Ansible plugins included in DebOps are present in the\n  Ansible Collection
          build from the DebOps repository.\n\n- Provide a help message in case the
          :file:`ansible.cfg` configuration file in\n  the DebOps project directory
          does not include the ``inventory`` option.\n\n- Fixed an issue with custom
          Ansible plugins not working in \"standalone\" mode\n  without the DebOps
          scripts installed on Ansible Controller.\n\n- The ``warn`` parameter in
          the ``shell`` and ``command`` Ansible modules has\n  been removed in Ansible
          2.14. It has been removed in various DebOps roles to\n  allow playbook execution
          to work correctly.\n\n- Fixed all password lookups which used ``chars=ascii``
          instead of\n  ``chars=ascii_letters``. This resulted in passwords which
          only contained the\n  letters a,c,i,s instead of all lowercase and uppercase
          ASCII letters. Because\n  all occurrences of this bug at least also included
          all digits in the character\n  set and the password length was at least
          20 characters, this did not result\n  in weak passwords.\n\n- The ``ipaddr``
          Ansible filter and its aliases used in various roles were\n  renamed to
          ``ansible.utils.ipaddr`` and its corresponding alias names because\n  Ansible
          requires use of FQCNs in filters. The ``ansible.utils`` Ansible\n  Collection
          is now a dependency of the DebOps Collection.\n\n- The :command:`debops
          run` and :command:`debops check` commands should now\n  correctly recognize
          options of the :command:`ansible-playbook` command which\n  don't expect
          arguments and expand playbook names specified after them.\n\n:ref:`debops.apt`
          role\n''''''''''''''''''''''\n\n- In the fact script, parse the ``deb-src``
          configuration entries before\n  ``deb`` entries to ensure that there are
          no duplicates.\n\n- The role no longer defaults to the ``ansible_local.core.distribution``
          and\n  ``ansible_local.core.distribution_release`` local facts for determining
          the\n  Linux distribution and the distribution release, respectively. These
          facts\n  were set later in the common playbook, meaning that the role would
          restore\n  the previous distribution release in ``/etc/apt/sources.list``
          after a\n  distribution upgrade.\n\ndebops.boxbackup role\n'''''''''''''''''''''\n\n-
          The role is not included in the DebOps Collection on Ansible Galaxy,\n  therefore
          its playbook is no longer included in the main :file:`site.yml`\n  playbook.
          This fixes an issue with Ansible stopping the site playbook\n  execution
          when it cannot find the ``boxbackup`` role in the Collection.\n\n:ref:`debops.core`
          role\n'''''''''''''''''''''''\n\n- Ensure that the ``ansible_controllers``
          fact can be reset using the\n  :envvar:`core__remove_facts` variable to
          avoid infinitely growing list of\n  Ansible Controllers.\n\n:ref:`debops.cron`
          role\n'''''''''''''''''''''''\n\n- Fixed the order of job parameters applied
          by the role - now parameters from\n  a specific job will override parameters
          specified for all jobs in a given\n  configuration entry.\n\n:ref:`debops.dnsmasq`
          role\n''''''''''''''''''''''''''\n\n- Fixed service configuration mistake
          when DHCPv6 mode is set to an empty\n  string. The configuration template
          should take this into account and add\n  a correct separator (or omit it)
          in the generated configuration file.\n\n:ref:`debops.dovecot` role\n''''''''''''''''''''''''''\n\n-
          The role's PKI hook script still referenced an old configuration file that\n
          \ was no longer being managed by :ref:`debops.dovecot` since the role redesign,\n
          \ resulting in the hook script failing to reload dovecot after a certificate
          or\n  DH param change.\n\n:ref:`debops.elasticsearch` role\n''''''''''''''''''''''''''''''''\n\n-
          The internal Java security policy used by Elasticsearch will be configured\n
          \ only on Elasticsearch v7.x+ versions. Before them, Elasticsearch used
          the\n  global Java security policy.\n\n:ref:`debops.environment` role\n''''''''''''''''''''''''''''''\n\n-
          Fixed issues with preserving environment variables across multiple role\n
          \ executions.\n\n:ref:`debops.etc_aliases` role\n''''''''''''''''''''''''''''''\n\n-
          Don't save dependent recipients on Ansible Controller if they are not\n
          \ defined. This should avoid creating unnecessary files in AWX job containers.\n\n:ref:`debops.ferm`
          role\n'''''''''''''''''''''''\n\n- Don't include additional '{' or '}' characters
          in certain rules when the\n  ``domain_args`` parameter is specified.\n\n-
          Fixed an issue in the rule template that caused a templating type error
          where\n  Jinja expected a string but found an int value instead.\n\n:ref:`debops.gitlab_runner`
          role\n''''''''''''''''''''''''''''''''\n\n- Fixed an error that could occur
          in the \"Patch 'vagrant-libvirt' source code\"\n  task on systems other
          than Debian 9 or 10. The patch is not required since\n  the ``vagrant-libvirt``
          v0.1.0 package.\n\n:ref:`debops.grub` role\n'''''''''''''''''''''''\n\n-
          The :command:`grub` user passwords will be passed for encryption using\n
          \ a temporary file stored in the :file:`secret/` directory on the Ansible\n
          \ Controller instead of directly on the command line, to avoid leaks through\n
          \ the process list.\n\n:ref:`debops.ifupdown` role\n'''''''''''''''''''''''''''\n\n-
          The interface names used in scripts will be escaped using the\n  :command:`systemd-escape`
          tool. This should fix problems with control over\n  network interfaces which
          contain the hyphen character(s).\n\n:ref:`debops.kibana` role\n'''''''''''''''''''''''''\n\n-
          The role will use the correct path of the Kibana keystore depending on the\n
          \ installed version (versions <7.0.0 keep the keystore in the\n  :file:`/var/lib/kibana/`
          directory; newer versions use the\n  :file:`/etc/kibana/` directory).\n\n-
          The role will use different user account depending on Kibana version (either\n
          \ ``kibana``, or ``kibana_system`` used in newer installations of\n  Elasticsearch).
          Depending on your installed version, you should check the\n  :envvar:`kibana__elasticsearch_username`
          to verify that the correct account\n  is used for access to Elasticsearch.\n\n-
          The role will include the ``server.publicBaseUrl`` parameter depending on\n
          \ Kibana version, to avoid failures on older Kibana installations.\n\n:ref:`debops.ldap`
          role\n'''''''''''''''''''''''\n\n- Fixed an issue with the role passing
          IP and MAC addresses to the LDAP\n  directory as a nested YAML list which
          resulted in a wrong attribute values.\n\n- Fixed an issue with role parsing
          the already parsed Ansible facts to extract\n  IP/CIDR information which
          resulted in wrong output in certain cases. The role\n  will now implicitly
          trust the Ansible facts to be correct when adding IP and\n  prefix details
          to the LDAP database.\n\n:ref:`debops.libvirtd` role\n'''''''''''''''''''''''''''\n\n-
          Fixed ``qemu-kvm`` package installation logic; the KVM packages should now
          be\n  handled correctly on Debian Bullseye and newer releases.\n\n:ref:`debops.logrotate`
          role\n''''''''''''''''''''''''''''\n\n- Fixed formatting in the :file:`/etc/logrotate.conf`
          configuration file to\n  avoid adding :command:`vim` fold markers from the
          DebOps role defaults.\n\n:ref:`debops.lxc` role\n''''''''''''''''''''''\n\n-
          Fixed name of the ``vfs_root`` parameter in the call to the\n  ``community.general.lxc_container``
          Ansible module, which was renamed to\n  ``zfs_root``.\n\n:ref:`debops.netbase`
          role\n''''''''''''''''''''''''''\n\n- In the fact script, don't use ``in``
          for matching IP addresses and DNS names\n  where substring matching is undesirable.\n\n:ref:`debops.netbox`
          role\n'''''''''''''''''''''''''\n\n- Using boolean variables in :envvar:`netbox__config_plugins_config`
          for\n  example resulted in an error because the role used the ``to_nice_json``\n
          \ Jinja2 filter internally to render Python configuration.\n  This is fixed
          for all uses of ``to_nice_json``\n\n:ref:`debops.ntp` role\n''''''''''''''''''''''\n\n-
          Fix an issue where the role tried to manage the :command:`systemd-timesyncd`\n
          \ service without it actually being present on the host. This should now
          be\n  avoided by carefully checking the service status.\n\n- The role will
          not try to purge installed NTP daemon packages when it is\n  disabled through
          Ansible inventory.\n\n:ref:`debops.owncloud` role\n'''''''''''''''''''''''''''\n\n-
          Access to static assets was not logged regardless of the\n  ``owncloud__nginx_access_log_assets``
          setting.\n\n- Access to the ``/remote`` URI path was not configured in Nginx
          as proposed in\n  the upstream Nginx example in the Nextcloud docs.\n\n:ref:`debops.pdns`
          role\n'''''''''''''''''''''''\n\n- On pdns installations with version >=
          4.5.0 (e.g. on Bookworm systems), the\n  role would cause a syntax error
          on the local-address configuration option.\n\n:ref:`debops.pki` role\n''''''''''''''''''''''\n\n-
          After the :command:`certbot` script performs a certificate renewal operation,\n
          \ a deploy hook will update the PEM chains in a given PKI realm\n  :file:`private/`
          directory to include the new private key created by the\n  :command:`certbot`
          script.\n\n- Fixed an issue where when a PKI realm was initialized for ACME/Let's
          Encrypt\n  support, second level domains were not included in the generated
          X.509\n  certificate request.\n\n- Use :command:`openssl x509 -inform PEM`
          command to explicitly check for\n  a PEM-formatted X.509 certificate file
          because the old :command:`openssl x509\n  -in` option was changed to work
          with both DER and PEM files. This should fix\n  an issue with Let's Encrypt
          certificate chains containing a DER-formatted\n  certificate inside of them.\n\n
          \ Users will need to remove existing PKI realms which use ACME/Let's Encrypt
          CA\n  for the :command:`pki-realm` script to rebuild the certificate chain\n
          \ correctly. After that re-run the :ref:`debops.pki` role on the host to\n
          \ re-create che realms.\n\n:ref:`debops.postconf` role\n'''''''''''''''''''''''''''\n\n-
          The EHLO IP address check was removed. This check would reject a message
          if\n  the EHLO hostname of the connecting mailserver resolved to a non-publicly\n
          \ routable IP address. However, rejecting messages for this reason is\n
          \ prohibited by :rfc:`5321` section 4.1.4, and sometimes caused deliverability\n
          \ issues for Office 365 users.\n\n:ref:`debops.preseed` role\n''''''''''''''''''''''''''\n\n-
          Fixed an issue with the ``d-i`` keyboard preseed that resulted in the\n
          \ ``keyboard-configuration`` APT package not being installed and configured\n
          \ correctly. The default keymap is changed to ``us`` and the option is no\n
          \ longer based on the system language which might be incorrect in this case.\n\n:ref:`debops.proc_hidepid`
          role\n'''''''''''''''''''''''''''''''\n\n- The fact script has been optimized
          \n\n</details>\n\n---\n\n### Configuration\n\n\U0001F4C5 **Schedule**: Branch
          creation - At any time (no schedule defined), Automerge - At any time (no
          schedule defined).\n\n\U0001F6A6 **Automerge**: Disabled by config. Please
          merge this manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever
          PR becomes conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515
          **Ignore**: Close this PR and you won't be reminded about this update again.\n\n---\n\n
          - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
          box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
          View the [repository job log](https://developer.mend.io/github/osism/release).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My42Ni40IiwidXBkYXRlZEluVmVyIjoiNDMuNjYuNCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUiXX0=-->\n"
        change_url: https://github.com/osism/release/pull/2419
        commit_id: 652bba730ae468d75662534f6fc2512ae266fac2
        patchset: 652bba730ae468d75662534f6fc2512ae266fac2
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          name: osism/release
          short_name: release
        src_dir: src/github.com/osism/release
        topic: null
      change: '2419'
      change_message: "chore(deps): update dependency debops.debops to v3.3.0\n\n>
        \u2139\uFE0F **Note**\n> \n> This PR body was truncated due to platform limits.\n\nThis
        PR contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n|
        [debops.debops](https://redirect.github.com/debops/debops) | minor | `3.2.5`
        \u2192 `3.3.0` |\n\n---\n\n### Release Notes\n\n<details>\n<summary>debops/debops
        (debops.debops)</summary>\n\n### [`v3.3.0`](https://redirect.github.com/debops/debops/blob/HEAD/CHANGELOG.rst#debops-v330---2026-03-13)\n\n[Compare
        Source](https://redirect.github.com/debops/debops/compare/v3.2.6...v3.3.0)\n\n..
        \\_debops v3.3.0: <https://github.com/debops/debops/compare/v3.2.0...v3.3.0>\n\nAdded\n\n```\n\nNew
        DebOps roles\n''''''''''''''''\n\n- The :ref:`debops.nixos` role with its
        corresponding playbook can be used to\n  manage NixOS-based hosts. The role
        is not included in the main\n  :file:`site.yml` playbook, which is focused
        on Debian/Ubuntu hosts.\n\n- The :ref:`debops.influxdb2` role can be used
        to install and configure\n  `InfluxDB v2.x`__ time-series database.\n\n  ..
        __: https://www.influxdata.com/products/influxdb/\n\n- The :ref:`debops.pgbadger`
        role can be used to generate PostgreSQL log\n  reports from local or remote
        hosts over SSH.\n\n:ref:`debops.core` role\n'''''''''''''''''''''''\n\n- A
        new local fact, ``ansible_local.core.is_64bits``, can be used to determine\n
        \ if the current system supports 32-bit or 64-bit architecture.\n\n:ref:`debops.dovecot`
        role\n''''''''''''''''''''''''''\n\n- The role now supports `iterate_filter`
        for its LDAP configuration, allowing\n  :command:`doveadm` commands to iterate
        over all users. Note that you might\n  have to adjust the defaults for the
        :envvar:`dovecot__ldap_user_list_filter`\n  variable if you use the :envvar:`dovecot__ldap_user_filter`
        variable.\n\n:ref:`debops.ipxe` role\n'''''''''''''''''''''''\n\n- Debian
        13 (Trixie) has been released, support for its installer has been added\n
        \ to the role. Debian Trixie is now the primary Stable release available in
        the\n  netboot installation menu.\n\n:ref:`debops.netbox` role\n'''''''''''''''''''''''''\n\n-
        Starting with NetBox ``v3.4.9``, anonymized reporting of census data is being\n
        \ enabled by default. DebOps respects this upstream default. You can change
        it\n  using :envvar:`netbox__config_census_reporting`.\n\n- The role can be
        used with NetBox deployed in a clustered PostgreSQL setup\n  with primary/standby
        nodes.\n\n:ref:`debops.nginx` role\n''''''''''''''''''''''''\n\n- Different
        file templates used in the role can now be overridden by the users\n  with
        the DebOps template override system and the ``template_src`` lookup\n  plugin.\n\n:ref:`debops.preseed`
        role\n''''''''''''''''''''''''''\n\n- The role will now generate preseed templates
        for Debian 13 (Trixie)\n  automated installation.\n\n:ref:`debops.resolved`
        role\n'''''''''''''''''''''''''''\n\n- The role will add a new entry in the
        :file:`/etc/services` database (using\n  the :ref:`debops.etc_services` role)
        for the ``5355`` TCP and UDP ports,\n  reserved for the `Link-Local Multicast
        Name Resolution`__. This should help\n  with identification of unknown TCP/UDP
        ports of the listening services.\n\n  .. __: https://en.wikipedia.org/wiki/Link-Local_Multicast_Name_Resolution\n\nChanged\n```\n\nUpdates
        of upstream application versions\n''''''''''''''''''''''''''''''''''''''''\n\n-
        In the :ref:`debops.netbox` role, the NetBox version has been updated to\n
        \ `v4.4.1`.\n\n- In the :ref:`debops.ipxe` role, the Debian Bookworm installer
        has been\n  updated to v12.12.\n\nGeneral\n'''''''\n\n- The :ref:`debops.root_account`,
        :ref:`debops.system_users` and\n  :ref:`debops.users` roles are now able to
        handle the symlinked\n  :file:`~/.ssh/authorized_keys` files correctly using
        optional `follow`\n  parameter.\n\n- The DebOps CI pipeline in GitHub Actions
        is improved and will be executed on\n  pull requests and pushes to test changes
        before merging them.\n\n- The :command:`debops` script and custom Ansible
        lookup plugins should now be\n  compatible with Python 3.12+ due to removal
        of the `distutils` Python\n  dependency, replaced by the `packaging` Python
        module.\n\n- References to the old `debops.roleXX` Ansible Collections have
        been removed\n  from all playbooks, since the project is now contained in
        a single Ansible\n  Collection.\n\n:ref:`debops.apt` role\n''''''''''''''''''''''\n\n-
        The Debian 10 (Buster) release has been archived and removed from Debian\n
        \ mirrors. The role will use <https://archive.debian.org/debian> as the\n
        \ repository URL on Debian Buster hosts.\n\n- The role now can manage repository
        GPG keys directly, stored in the\n  :file:`/etc/apt/keyrings/` directory,
        bypassing the deprecated\n  `ansible.builtin.apt_key` module. Support for
        the Ansible module is\n  present, but needs to be enabled explicitly.\n\n
        \ Existing role configuration might need to be updated to support new changes,\n
        \ check the role documentation for details.\n\n:ref:`debops.gitlab` role\n'''''''''''''''''''''''''\n\n-
        Users can now select specific GitLab version to install using the APT\n  preferences,
        by specifying the package version in the\n  :envvar:`gitlab__preferred_version`
        variable. By default, the latest version\n  will be installed.\n\n- The :command:`nginx`
        service inside of the GitLab Omnibus installation will\n  be restarted when
        X.509 certificates managed by the :ref:`debops.pki` role\n  are reissued,
        for example via ACME.\n\n:ref:`debops.gitlab_runner` role\n''''''''''''''''''''''''''''''''\n\n-
        The role is now compatible with GitLab 17.x and newer releases.\n\n- The runner
        registration method has changed, see the role documentation for\n  details.\n\n:ref:`debops.keyring`
        role\n''''''''''''''''''''''''''\n\n- The role now can manage repository GPG
        keys directly, stored in the\n  :file:`/etc/apt/keyrings/` directory, bypassing
        the deprecated\n  `ansible.builtin.apt_key` module. Support for the Ansible
        module is\n  present, but needs to be enabled explicitly.\n\n  Existing role
        configuration might need to be updated to support new changes,\n  check the
        role documentation for details.\n\n:ref:`debops.nginx` role\n''''''''''''''''''''''''\n\n-
        The custom :command:`systemd` override that ensures that the :command:`nginx`\n
        \ service is started after network is available will be installed only on
        older\n  Debian/Ubuntu releases; it's now the default since Debian Bookworm.\n\n:ref:`debops.pki`
        role\n''''''''''''''''''''''\n\n- The default key type in :command:`certbot`
        is set to RSA, since currently\n  there's no support for different key types
        in DebOps PKI infrastructure.\n\n- The permission of the :file:`config/environment`
        configuration file in PKI\n  realms will be se to `0644` so that other UNIX
        accounts can read it. This is\n  needed by the :command:`acme-tiny` command
        which is executed on a separate\n  UNIX account.\n\n:ref:`debops.postgresql_server`
        role\n''''''''''''''''''''''''''''''''''''\n\n- The role can now support `pgBadger`\\_\\_
        log analyzer by enabling verbose log\n  output and modifying access to the
        log files themselves in the\n  :file:`/var/log/postgresql/` directory. This
        functionality is disabled by\n  default and can be enabled using a role variable.\n\n
        \ .. \\_\\_: <https://pgbadger.darold.net/>\n\n- The default log ident string
        is changed to `postgresql-<version>-<name>` to\n  better distinguish different
        PostgreSQL instances in the system logs.\n\n:ref:`debops.reprepro` role\n'''''''''''''''''''''''''''\n\n-
        The role now configures local APT repositories for Debian 13 (Trixie) and\n
        \ Debian 14 (Forky) by default. Configuration for Debian Buster repositories\n
        \ has been removed. Symlinks for the :file:`stable/`, :file:`oldstable/` and\n
        \ :file:`oldoldstable/` releases will be updated automatically to point to
        the\n  correct Debian releases.\n\n:ref:`debops.resources` role\n''''''''''''''''''''''''''''\n\n-
        The :command:`git` repositories will be processed by the role first, since\n
        \ :command:`git` can handle directory creation if needed.\n\n:ref:`debops.rspamd`
        role\n'''''''''''''''''''''''''\n\n- Due to the `removal`\\_\\_ of the `distutils`
        Python module from Python v3.12,\n  custom scripts included in the role which
        create and update DKIM keys have\n  been updated to use the `shutil` module
        instead.\n\n  .. \\_\\_: <https://docs.python.org/3.11/whatsnew/3.10.html#distutils-deprecated>\n\n:ref:`debops.snmpd`
        role\n''''''''''''''''''''''''\n\n- The :file:`snmpd.service` configuration
        file provided in the role will ensure\n  that the :command:`snmpd` daemon
        is restarted on failure. Older versions of\n  :command:`snmpd` can `fail due
        to rapid changes in network interfaces`\\_\\_.\n\n  .. \\_\\_: <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1023656>\n\n:ref:`debops.yadm`
        role\n'''''''''''''''''''''''\n\n- The paths to the repositories that are
        safe to clone by the :command:`git`\n  command, used for dotfiles by the :ref:`debops.system_users`
        and\n  :ref:`debops.users` roles, will be defined in the :file:`/etc/gitconfig`\n
        \ system-wide configuration file instead of the per-user :file:`~/.gitconfig`\n
        \ configuration files. This avoids the issue of modifying per-user environment\n
        \ from the system-wide level on which DebOps operates and ensires that the\n
        \ cloned dotfiles are not modified. The specific tasks that do this have been\n
        \ moved from the :ref:`debops.system_users` and :ref:`debops.users` role into\n
        \ the :ref:`debops.yadm` role.\n\nFixed\n\n```\n\nGeneral\n'''''''\n\n- The
        :ref:`debops.system_users` and the :ref:`debops.users` roles will add the\n
        \ dotfiles repository cloned by the ``root`` UNIX account in the\n  :ref:`debops.yadm`
        role to the list of trusted :command:`git` repositories in\n  the :file:`~/.gitconfig`
        configuration file of each user account managed by\n  the role. This is needed
        to allow :command:`git` to clone local repositories\n  not owned by the UNIX
        account, required by the mitigation of the\n  `CVE-2022-24765`__ security
        vulnerability.\n\n  .. __: https://github.blog/open-source/git/git-security-vulnerability-announced/#cve-2022-24765\n\n-
        The :command:`debops` script will not try to download the required Ansible\n
        \ Collections during new project creation if the :command:`ansible-galaxy`\n
        \ command is not available in the user's ``$PATH``.\n\n- The :file:`tools/dist-upgrade.yml`
        playbook will not fail anymore during\n  :file:`/etc/services` database assembly
        if no upgrade was performed.\n\n- New DebOps project directories will use
        fixed Ansible configuration for\n  callback plugins and will default to a
        YAML output format of the playbook\n  results.\n\n:ref:`debops.apache` role\n'''''''''''''''''''''''''\n\n-
        Fixed an issue with the vhost ``state: \"absent\"`` parameter not working\n
        \ correctly when the ``enabled: False`` parameter was not set as well.\n\n:ref:`debops.docker_gen`
        role\n'''''''''''''''''''''''''''''\n\n- Flattened the list of directories
        that are created by the ``file`` task. This\n  should fix the issue of Ansible
        stopping during execution due to nested lists\n  in the ``loop`` keyword.\n\n:ref:`debops.dropbear_initramfs`
        role\n'''''''''''''''''''''''''''''''''''''\n\n- The role now supports both
        the old and the new location if the initramfs\n  configuration files.\n\n:ref:`debops.ferm`
        role\n'''''''''''''''''''''''\n\n- The role will restart the :command:`fail2ban`
        service instead of reloading\n  it, which will ensure that the custom rules
        are re-added when the\n  :command:`ferm` service is restarted.\n\n- Fixed
        an issue with the role failing if the :envvar:`ferm__parsed_rules`\n  variable
        is not defined correctly. The role will skip rule generation in such\n  case
        instead of failing with the \"AnsibleUndefined\" error message.\n\n:ref:`debops.ifupdown`
        role\n'''''''''''''''''''''''''''\n\n- The :file:`iface@.service` :command:`systemd`
        unit provided by the role is\n  changed to use ``After==sys-subsystem-net-devices-%i.device``
        parameter. This\n  should ensure that the bridge interfaces are correctly
        started at boot time.\n\n:ref:`debops.netbox` role\n'''''''''''''''''''''''''\n\n-
        Fixed an issue with the Django superuser creation task that failed execution\n
        \ if the ``error`` string was not present in command output; this resulted
        in\n  an incomplete installation.\n\n:ref:`debops.nullmailer` role\n'''''''''''''''''''''''''''''\n\n-
        The role will avoid interacting with the LDAP server when LDAP support is\n
        \ disabled while DebOps is used in LDAP environment.\n\n:ref:`debops.owncloud`
        role\n'''''''''''''''''''''''''''\n\n- Fixed conditional logic in a task which
        determines if the \"autosetup\"\n  operation should be performed during Nextcloud/ownCloud
        installation.\n\n:ref:`debops.pki` role\n''''''''''''''''''''''\n\n- The Let's
        Encrypt service dropped support for the ``contacts`` option. This\n  requires
        a new version of the :command:`acme-tiny` command to be installed on\n  client
        hosts to work properly. Since the ``acme-tiny`` APT package in Debian\n  Bookworm
        is too old, on this release the role will install\n  :command:`acme-tiny`
        from source. On existing installations, the\n  ``acme-tiny`` APT package might
        need to be removed manually.\n\n- The ``acme-tiny`` source repository switched
        from the ``master`` branch to\n  the ``main`` branch, existing source installations
        need to remove the local\n  clone of the repository in :file:`/usr/local/src/pki-acme/diafygi/acme-tiny/`\n
        \ so that it can be cloned correctly by Ansible. You should also remove the\n
        \ copy of the :file:`/usr/local/bin/acme-tiny` command to be installed\n  correctly.\n\n:ref:`debops.pdns`
        role\n'''''''''''''''''''''''\n\n- The PowerDNS service will be configured
        to listen on all external IPv4 and\n  IPv6 addresses of a host insteand of
        listening on \"all\" IP addresses to\n  ensure that the service is started
        while the :command:`systemd-resolved`\n  service listens on the loopback interface.\n\n:ref:`debops.postgresql_server`
        role\n''''''''''''''''''''''''''''''''''''\n\n- Fixed an issue with the ``vacuum_defer_cleanup_age``
        option removal in\n  PostgreSQL 16.x resulting in failed startup of the service.
        The option will\n  be added only on supported PostgreSQL versions.\n\n:ref:`debops.resolved`
        role\n'''''''''''''''''''''''''''\n\n- The role will disable synthesis of
        local hostname by the\n  :command:`systemd-resolved` service (enabled by default
        in systemd v256) to\n  allow resolution of the host's FQDN queries by upstream
        DNS server.\n\n:ref:`debops.sysctl` role\n'''''''''''''''''''''''''\n\n- The
        :file:`50-pid-max.conf` configuration file will be installed only on\n  platforms
        which support 64-bit architecture.\n\nRemoved\n```\n\nGeneral\n'''''''\n\n-
        The `volkszaehler` (`debops-contrib`) role was removed because the role\n
        \ maintainer considers the application to be superseded by Grafana.\n  See
        `Future of the project; The elephant in the room \u2013 Grafana`\\_\\_.\n\n
        \ .. \\_\\_: [volkszaehler/volkszaehler.org#819](https://redirect.github.com/volkszaehler/volkszaehler.org/issues/819)\n\n-
        The `bitcoind` role was removed due to lack of interest by the role\n  maintainer.\n\n-
        The `profile_tasks.py` Ansible callback plugin has been removed due to\n  \"Unexpected
        Exception\" error on Ansible v2.19. Users should use its upstream\n  alternative,
        `ansible.posix.profile_tasks` plugin.\n\n:ref:`debops.ipxe` role\n'''''''''''''''''''''''\n\n-
        Debian 10 (Buster) has been archived and it's no longer available on Debian\n
        \ mirrors, support for its installer has been removed from the role.\n\n:ref:`debops.netbox`
        role\n'''''''''''''''''''''''''\n\n- The NAPALM integration feature found
        in NetBox 3.4 and before has been moved\n  to a dedicated plugin. If you want
        to continue using it, you will have to\n  install the plugin. All role variables
        about NAPALM except\n  :envvar:`netbox__napalm_ssh_generate` and\n  :envvar:`netbox__napalm_ssh_generate_bits`
        have been removed.\n\n:ref:`debops.python` role\n'''''''''''''''''''''''''\n\n-
        The `python3-future` and `python-future` APT packages have been removed\n
        \ from Debian Stable release, and will not be installed by default by the\n
        \ :ref:`debops.python` role.\n\nSecurity\n\n```\n\n:ref:`debops.icinga` role\n'''''''''''''''''''''''''\n\n-
        The GPG key of the Icinga upstream APT repository `has been replaced`__ on\n
        \ 30th September 2024. The role includes the new key which should be installed\n
        \ on the host on the next run. The old GPG key will not be removed\n  automatically.\n\n
        \ .. __: https://icinga.com/blog/2024/08/26/icinga-package-repository-key-rotation-2024/\n\n`debops
        v3.2.0`_ - 2024-09-16\n-----------------------------\n\n.. _debops v3.2.0:
        https://github.com/debops/debops/compare/v3.1.0...v3.2.0\n\nAdded\n~~~~~\n\nNew
        DebOps roles\n''''''''''''''''\n\n- The :ref:`debops.debconf` Ansible role
        can be used to pre-configure APT\n  packages which use the `debconf`__ configuration
        database and install them\n  afterwards. The role is included near the end
        of the :file:`site.yml`\n  playbook to allow of configuration of other needed
        services before the actual\n  package installation.\n\n  .. __: https://en.wikipedia.org/wiki/Debian_configuration_system\n\nGeneral\n'''''''\n\n-
        The :command:`debops` script can now log its operation to standard error and\n
        \ to the :command:`syslog` service. Use the ``--verbose`` or ``-v`` flag to\n
        \ enable log output on the console.\n\n- Users can define \"playbook sets\"
        on the view level of the \"modern\" project\n  directories. Playbook sets
        can be used as aliases to call multiple playbooks\n  using a custom name.
        See :ref:`playbook_sets` documentation for more details.\n\n- Users can now
        enable \"read-only Fridays\" functionality on a per project\n  basis, to ensure
        that on Fridays, Ansible playbooks are run only in check\n  mode, with ``--check``
        and ``--diff`` arguments automatically added to the\n  :command:`ansible-playbook`
        command options.\n\n:ref:`debops.apt_install` role\n''''''''''''''''''''''''''''''\n\n-
        The role will import the :ref:`debops.secret` role during execution to get\n
        \ access to the :file:`secret/` directory. This permits use of stored passwords\n
        \ in Debconf answers configured via the :ref:`debops.apt_install` role.\n\n:ref:`debops.dnsmasq`
        role\n''''''''''''''''''''''''''\n\n- The role can optionally ignore IP addresses
        on a network interface and use\n  only specified ones for :command:`dnsmasq`
        configuration. This can help with\n  Routing Advertisements issues on internal
        networks. See role documentation\n  for more details.\n\n:ref:`debops.pki`
        role\n''''''''''''''''''''''\n\n- Add support for defining per-realm UNIX
        environment variables set during\n  :command:`pki-realm` script execution.
        These variables can be used to augment\n  runtime environment, for example
        to define HTTP proxy to use inside internal\n  networks with restricted access
        to the outside world.\n\n:ref:`debops.rabbitmq_server` role\n''''''''''''''''''''''''''''''''''\n\n-
        The role can manage much more RabbitMQ internal structures - exchanges,\n
        \ queues, bindings between them, as well as vhost and user limits.\n\nChanged\n~~~~~~~\n\nUpdates
        of upstream application versions\n''''''''''''''''''''''''''''''''''''''''\n\n-
        In the :ref:`debops.ipxe` role, support for the Debian Bullseye netboot\n
        \ installer has been updated to v11.12; the Debian Bookworm installer has
        been\n  updated to v12.7.\n\nGeneral\n'''''''\n\n- DebOps now uses `pipx`__
        as the preferred installation method. This allows\n  for easier maintenance
        of the DebOps virtual environment.\n\n  .. __: https://pipx.pypa.io/\n\n:ref:`debops.elasticsearch`
        role\n''''''''''''''''''''''''''''''''\n\n- The role now supports new Elasticsearch
        v8.x password management mechanism.\n\n- The role can now manage passwords
        in separate Elasticsearch clusters defined\n  in one Ansible inventory.\n\n
        \ .. warning:: Due to this change, Elasticsearch passwords stored in the\n
        \              :file:`ansible/secret/` subdirectory will be read from a different\n
        \              location. If passwords are not moved to the new location, role\n
        \              will reset the Elasticsearch built-in users passwords\n               automatically.
        This might result in data loss.\n\n:ref:`debops.kibana` role\n'''''''''''''''''''''''''\n\n-
        The path to the password file stored in :file:`ansible/secret/` subdirectory\n
        \ is now configurable using a variable.\n\n- The role uses new per-cluster
        Elasticsearch passwords by default. This is\n  done using a separate :envvar:`kibana__elasticsearch_cluster_name`
        variable,\n  which needs to be synchronized with the Elasticsearch configuration
        via\n  Ansible inventory (Kibana can be installed separately from Elasticsearch).\n\n:ref:`debops.lxc`
        role\n''''''''''''''''''''''\n\n- The role supports integration with the :command:`systemd-resolved`
        DNS\n  resolver. This permits use of the :command:`systemd-networkd` service
        to\n  manage networking on the LXC host.\n\n- LXC containers will be configured
        with AppArmor \"unconfined\" profile by\n  default. This change allows startup
        of various services inside of the\n  container without errors on Debian Bookwrom
        hosts.\n\n:ref:`debops.lxd` role\n''''''''''''''''''''''\n\n- The role supports
        integration with the :command:`systemd-resolved` DNS\n  resolver. This permits
        use of the :command:`systemd-networkd` service to\n  manage networking on
        the LXD host.\n\n:ref:`debops.nginx` role\n''''''''''''''''''''''''\n\n- The
        ``/index.html`` and ``/index.htm`` entries in the default ``try_files``\n
        \ configuration option have been replaced with the ``$uri/index.html`` entry.\n
        \ This change should ensure that any location not present on the server will\n
        \ return error 404 correctly, instead of falling back to the ``/index.html``\n
        \ file if it's present in the root of the website.\n\n:ref:`debops.postgresql_server`
        role\n''''''''''''''''''''''''''''''''''''\n\n- The :command:`autopostgresqlbackup`
        script was modified to have separate set\n  of options for the :command:`psql`
        command and the :command:`pg_dump`\n  command. This permits the use of the
        ``--format=custom`` option in\n  :command:`pg_dump` command, enabling more
        efficient database dumps.\n\n- The extension of the backup files created by
        the\n  :command:`autopostgresqlbackup` script can be configured via a default\n
        \ variable. This change might cause existing installations to change the file\n
        \ extension used during backups.\n\n:ref:`debops.proc_hidepid` role\n'''''''''''''''''''''''''''''''\n\n-
        The role will check if the host is in the ``debops_service_libvirtd`` Ansible\n
        \ inventory group, or if the :ref:`debops.libvirtd` role was applied on the\n
        \ host and will change the ``hidepid=`` value to ``0`` to avoid issues with\n
        \ Polkit subsystem.\n\n:ref:`debops.rsyslog` role\n''''''''''''''''''''''''''\n\n-
        The log rotation configuration for logs managed by :command:`rsyslog` now
        has\n  an upper size limit of 1 GB to trigger the rotation. This should help
        in\n  cases when these logs are growing rapidly, but the rotation period is
        too\n  large to avoid filling up disk space.\n\n:ref:`debops.zabbix_agent`
        role\n'''''''''''''''''''''''''''''''\n\n- The fact script now supports both
        the old Zabbix Agent, and the new Zabbix\n  Agent 2 configuration files.\n\nFixed\n~~~~~\n\n:ref:`debops.dpkg_cleanup`
        role\n'''''''''''''''''''''''''''''''\n\n- Various YAML lists used in the
        package removal script will be sorted at Jinja\n  level to avoid constant
        reordering of list elements during Ansible execution\n  which makes the role
        not idempotent.\n\n:ref:`debops.gitlab` role\n'''''''''''''''''''''''''\n\n-
        Fixed an issue with the :file:`/etc/gitlab/ssl/` directory changing its mode\n
        \ from 0775 set by the role to 0755 set by the :command:`gitlab-ctl\n  reconfigure`
        command, making the role not idempotent.\n\n:ref:`debops.grub` role\n'''''''''''''''''''''''\n\n-
        Fixed an issue with the :file:`01_users` configuration file generating errors\n
        \ and resulting in an empty user section in the configuration generated by
        the\n  :command:`update-grub` command.\n\n:ref:`debops.ifupdown` role\n'''''''''''''''''''''''''''\n\n-
        Fixed an issue with the :file:`ifup-allow-boot.service` :command:`systemd`\n
        \ unit not starting correctly on boot due to issues with the ``$`` character\n
        \ escaping.\n\n:ref:`debops.lxc` role\n''''''''''''''''''''''\n\n- The role
        will by default disable NFtables integration within the\n  :command:`lxc-net`
        script, configurable via a default variable. This fixes\n  usage of LXC containers
        on Debian Bookworm with the :command:`ferm` service\n  used by DebOps.\n\n:ref:`debops.lxd`
        role\n''''''''''''''''''''''\n\n- Fixed an issue with the default LXD daemon
        preseed configuration by removing\n  the unsupported ``managed`` parameter.
        This should allow the LXD daemon to be\n  initialized correctly.\n\n- Fixed
        an issue with the role trying to copy the source-built libraries when\n  an
        APT-based installation is used. The role will check if the libraries exist\n
        \ before trying to copy them.\n\n- Fixed an issue on Debian Bookworm where
        the :command:`lxd-apparmor-load`\n  binary is not present where the APT-based
        LXD daemon expects it. The role\n  will create a symlink for this binary when
        needed.\n\n:ref:`debops.networkd` role\n'''''''''''''''''''''''''''\n\n- Do
        not restart the :command:`systemd-networkd` service if the role detects\n
        \ that the network stack is not managed by it. This should avoid the issue\n
        \ where the role playbook hanged on first run of the role on a host not managed\n
        \ by :command:`systemd-networkd` service.\n\n:ref:`debops.ntp` role\n''''''''''''''''''''''\n\n-
        Fixed an issue with conditional check for Linux capabilities not being\n  checked
        reliably to decide if NTP support should be enabled. The role should\n  now
        correctly detect when Linux capabilities are enforced.\n\n:ref:`debops.rsyslog`
        role\n''''''''''''''''''''''''''\n\n- List of log files which should be managed
        by the :command:`logrotate` service\n  will be sorted to avoid constant reordering
        during role execution, which\n  fixes role idempotency.\n\n:ref:`debops.swapfile`
        role\n'''''''''''''''''''''''''''\n\n- Fixed an issue in the :command:`swapon`
        task conditional logic where the task\n  could not be executed correctly when
        the swap file was missing.\n\n- Ensure that the swap file is correctly disabled
        by the :command:`swapoff`\n  command before being removed with the ``absent``
        state.\n\nRemoved\n~~~~~~~\n\n:ref:`debops.ipxe` role\n'''''''''''''''''''''''\n\n-
        Debian 9 (Stretch) has been removed from Debian mirrors, therefore the role\n
        \ will no longer offer support for installing Debian Stretch via PXE boot.\n\n`debops
        v3.1.0`_ - 2023-11-29\n-----------------------------\n\n.. _debops v3.1.0:
        https://github.com/debops/debops/compare/v3.0.0...v3.1.0\n\nAdded\n~~~~~\n\nNew
        DebOps roles\n''''''''''''''''\n\n- The :ref:`debops.metricbeat` role, part
        of the Elastic stack, can be used to\n  install `Metricbeat`__, a service
        that can gather metrics and other non-log\n  data from other services and
        send them to Elasticsearch for processing.\n\n  .. __: https://www.elastic.co/beats/metricbeat\n\n-
        The :ref:`debops.opensearch` role can be used to set up an unsecured,\n  local-only
        installation of `OpenSearch`__. OpenSearch is a fork of\n  Elasticsearch that
        continues to be released under a free software license.\n\n  .. __: https://opensearch.org/\n\n-
        The :ref:`debops.reboot` role can be used to reboot, forcefully or only if\n
        \ required, any DebOps host.\n\n- The :ref:`debops.miniflux` role can install
        and manage Miniflux, a web-based,\n  minimalistic feed reader written in Go.\n\n-
        The :ref:`debops.systemd` role is included in the common playbook by default.\n
        \ It configures the :command:`systemd` system and service manager. Both\n
        \ system-wide, as well as user services configured globally can be managed
        with\n  this role.\n\n- The :ref:`debops.networkd` role can be used to configure
        the\n  :command:`systemd-networkd` service, part of the :command:`systemd`
        project\n  responsible for network interface configuration.\n\n- The :ref:`debops.timesyncd`
        role is used to configure the\n  :command:`systemd-timesyncd` service, a minimal
        SNTP/NTP client. The role is\n  included in the :file:`layer/common.yml` playbook
        instead of the\n  :ref:`debops.ntp` role to provide NTP support by default.\n\n-
        The :ref:`debops.resolved` role is included in the :file:`layer/common.yml`\n
        \ playbook by default, replacing the :ref:`debops.resolvconf` role. It manages\n
        \ the :command:`systemd-resolved` service, a local DNS resolver.\n\n- The
        :ref:`debops.bind` role is responsible for installing and managing the\n  ISC
        BIND nameserver. It supports DNSSEC, key rollovers, multiple DNS zones,\n
        \ views and many more features.\n\n- The :ref:`debops.apparmor` role can be
        used to manage AppArmor configuration\n  and profiles. It will be included
        in the :file:`layer/common.yml` playbook in\n  the future.\n\n- The :ref:`debops.apt_mirror`
        role can be used to create a mirror of one or\n  multiple APT repositories
        and publish them for other hosts to use as package\n  source.\n\nGeneral\n'''''''\n\n-
        DebOps now includes a custom version of the\n  ``community.general.apache2_module``
        Ansible module, available as\n  ``debops.debops.apache2_module``. The custom
        module includes a fixed\n  idempotency check for enabled Apache 2 modules
        that works on Debian or Ubuntu\n  hosts. The :ref:`debops.apache` Ansible
        role will use this module instead of\n  the original one.\n\n- The :command:`debops
        exec` command can be used to execute Ansible modules\n  against hosts in the
        project directory; this is a wrapper for the\n  :command:`ansible` command.\n\n-
        The :command:`debops run`, :command:`debops check` and :command:`debops exec`\n
        \ commands can emit ASCII \"bell\" at the end of Ansible execution to notify
        user\n  after long runs. Use the ``-E`` or ``--bell`` option to enable this.\n\n-
        The :command:`debops env` command can be used to inspect the runtime\n  environment
        variables present when other DebOps commands are used, as well as\n  execute
        external commands inside of that runtime environment. This is handy\n  for
        using various :command:`ansible-*` commands within DebOps project\n  directories.\n\n-
        DebOps monorepo now includes configuration for the `pre-commit`__ hook to\n
        \ verify changes before they are committed to the repository. Multiple checks\n
        \ are performed, notably `codespell`__ is used to find spelling mistakes.
        More\n  checks will be enabled in the future.\n\n  .. __: https://pre-commit.com/\n
        \ .. __: https://github.com/codespell-project/codespell\n\n- New project directory
        layout called \"modern\" has been implemented in DebOps\n  scripts. It can
        be created using the command:\n\n  .. code-block:: console\n\n     debops
        project init -t modern <project>\n\n  The modern project layout supports multiple
        Ansible inventories encapsulated\n  into :ref:`infrastructure views <project_infrastructure_views>`.\n\n-
        DebOps scripts now support management of the project directories using\n  :command:`git`
        as VCS repositories. New project directories will use\n  :command:`git` by
        default. This also enables support for secrets encrypted\n  using :command:`git-crypt`.\n\n:ref:`debops.apt`
        role\n''''''''''''''''''''''\n\n- The role now supports management of the
        \"Deb822\" format of the APT repository\n  sources.\n\n:ref:`debops.avahi`
        role\n''''''''''''''''''''''''\n\n- The role will ensure that the :command:`systemd-resolved`
        service Multicast\n  DNS support is disabled to avoid conflict with the :command:`avahi-daemon`\n
        \ service.\n\n:ref:`debops.ferm` role\n'''''''''''''''''''''''\n\n- Multicast
        DNS traffic is accepted by default in the firewall to allow for the\n  ``.local``
        mDNS domain resolution by the :command:`systemd-resolved` service.\n  The
        role provides a set of variables to limit the traffic by subnet, or\n  disable
        it completely.\n\n:ref:`debops.icinga_web` role\n'''''''''''''''''''''''''''''\n\n-
        The role can now create host and service templates using Icinga Director API.\n
        \ This should improve the initial deployment experience, since users don't
        need\n  to create basic host templates by hand before registering hosts in
        Icinga.\n\n:ref:`debops.ipxe` role\n'''''''''''''''''''''''\n\n- The Debian
        Installer Menu can now install Debian GNU/Linux 12 (Bookworm).\n\n:ref:`debops.java`
        role\n'''''''''''''''''''''''\n\n- The role will now configure the default
        security policy for Java\n  applications. The additions will permit Java applications
        to access the\n  system-wide CA certificate store in :file:`/etc/ssl/certs/`
        directory as well\n  as the PKI infrastructure managed by the :ref:`debops.pki`
        role, so that Java\n  applications can use the existing X.509 certificates
        and private keys for TLS\n  encryption support.\n\n:ref:`debops.keyring` role\n''''''''''''''''''''''''''\n\n-
        The role can now download APT repository GPG keys to separate keyring files,\n
        \ which can be used to scope a given GPG key to specific APT repositories.\n\n:ref:`debops.kibana`
        role\n'''''''''''''''''''''''''\n\n- The role can now manage passwords and
        other confidential data stored in the\n  Kibana keystore.\n\n:ref:`debops.mount`
        role\n''''''''''''''''''''''''\n\n- The role can now create custom files which
        can be used to store credentials\n  required to mount remote devices.\n\n:ref:`debops.netbox`
        role\n'''''''''''''''''''''''''\n\n- The role will enable LDAP support in
        NetBox if LDAP environment managed by\n  the :ref:`debops.ldap` role is detected
        on the host. Currently only user\n  authentication and Django ACL system is
        supported via LDAP groups.\n\n:ref:`debops.nginx` role\n''''''''''''''''''''''''\n\n-
        The server configuration files can now contain :command:`nginx` configuration\n
        \ outside of the ``server`` and ``upstream`` blocks using the new\n  ``item.toplevel_options``
        parameter.\n\n:ref:`debops.owncloud` role\n'''''''''''''''''''''''''''\n\n-
        Support to host the application on a subpath for security reasons.\n\n:ref:`debops.python`
        role\n'''''''''''''''''''''''''\n\n- The :file:`service/python_raw` playbook
        used during early bootstrap process\n  can now inject host entries into the
        :file:`/etc/hosts` configuration file to\n  permit DNS name resolution early
        during bootstrapping.\n\n:ref:`debops.resources` role\n''''''''''''''''''''''''''''\n\n-
        The :ref:`debops.resources` role can now be used to install pip library\n
        \ dependencies or virtual environments via the ``ansible.builtin.pip``\n  module.\n\n-
        The :ref:`debops.resources` role can now be used to replace a line via the\n
        \ ``ansible.builtin.replace`` module.\n\n:ref:`debops.slapd` role\n''''''''''''''''''''''''\n\n-
        The playbook can now be configured to skip the saslauthd role execution.\n\n:ref:`debops.zabbix_agent`
        role\n'''''''''''''''''''''''''''''''\n\n- The role now supports management
        of Zabbix Agent (written in C) as well as\n  Zabbix Agent 2 (written in Go),
        available in Debian repositories. Only one\n  flavor can be managed at a time,
        but role provides an easy way to switch\n  between the two flavors.\n\nChanged\n~~~~~~~\n\nUpdates
        of upstream application versions\n''''''''''''''''''''''''''''''''''''''''\n\n-
        In the :ref:`debops.roundcube` role, the Roundcube version installed by\n
        \ default has been updated to ``1.6.0``.\n\n- In the :ref:`debops.ipxe` role,
        the Debian Buster netboot installer version\n  has been updated to the next
        point release, 10.13. Debian Bullseye has been\n  updated to the next point
        release as well, 11.8. The Debian Bookworm release\n  has been updated to
        12.2.\n\n- In the :ref:`debops.netbox` role, the NetBox version has been updated
        to\n  ``v3.4.2``.\n\n- In the :ref:`debops.owncloud` role, the ownCloud support
        has been updated to\n  ``v10.10``.\n\n- In the :ref:`debops.owncloud` role,
        the Nextcloud support has been updated to\n  ``v24.0`` and ``v25.0``.\n\nGeneral\n~~~~~~~\n\n-
        Tasks which use modules and plugins from the ``ansible.builtin`` Ansible\n
        \ Collection have been updated to refer to them via their Fully Qualified\n
        \ Collection Names (for example ``ansible.builtin.file`` instead of ``file``).\n
        \ This is due to changing requirements of the :command:`ansible-lint` tool.\n\n
        \ New submissions to the DebOps project will be required to use the FQCNs
        as\n  well.\n\n- Various roles that lookup SSH public keys on the Ansible
        Controller\n  (:ref:`debops.preseed`, :ref:`debops.reprepro`, :ref:`debops.system_users`)\n
        \ will try to use the :file:`~/.ssh/authorized_keys` file to find the keys
        if\n  all other methods fail.\n\n- In the :file:`site.yml` playbook, the :file:`sys.yml`
        and :file:`net.yml`\n  playbooks will be executed before the :file:`common.yml`
        playbook. This\n  should ensure that configuration of certain resources like
        mount points or\n  LVM pools is present before the system is prepared for
        general operation.\n\n- The :file:`ansible/playbooks/tools/reboot.yml` Ansible
        playbook has been\n  moved to :file:`ansible/playbooks/reboot.yml` file and
        uses the new\n  :ref:`debops.reboot` Ansible role to perform operations. To
        use it, you can\n  run the ``reboot`` playbook instead of ``tools/reboot``.\n\n-
        The :file:`ansible/playbooks/tools/upgrade-reboot.yml` Ansible playbook has\n
        \ been moved to :file:`ansible/playbooks/upgrade.yml` file and will no longer\n
        \ reboot the host automatically. Users can chain the ``upgrade`` and ``reboot``\n
        \ playbooks to achieve the previous behaviour, for example:\n\n  .. code-block::
        console\n\n     debops run upgrade reboot -l <host>\n\n- The debops-contrib
        :file:`dropbear_initramfs` playbook has been moved to\n  the :ref:`debops.dropbear_initramfs`
        playbook. The role variable\n  ``dropbear_initramfs__host_authorized_keys``
        now uses the same keys as\n  the ``ansible.posix.authorized_key`` module.\n\n-
        Various tasks that interact with the MariaDB/MySQL databases will now use
        the\n  :file:`/run/mysqld/mysqld.sock` UNIX socket to do so, due to changes
        in\n  MariaDB restricting local connections for the ``root`` UNIX account.\n\n-
        The HTML documentation build process has been improved. The\n  :command:`yaml2rst`
        script will be invoked only when a defaults file is\n  modified, significantly
        speeding up documentation rebuilds. Users can also\n  modify the :command:`sphinx`
        options specified in the Makefile via an\n  environment variable if they wish.\n\n-
        The :file:`ansible/playbooks/tools/dist-upgrade.yml` Ansible playbook now
        has\n  MTA configuration exposed via variables in case the mail should be
        sent via\n  a remote server instead of a local one.\n\n- DebOps playbooks
        have been reorganized to not use a large set of symlinks\n  inside of the
        repository. Instead different sections of the :file:`site.yml`\n  playbook
        have been organized into \"layers\", new playbooks are located under\n  the
        :file:`ansible/playbooks/layers/` subdirectory. See the new\n  :ref:`playbooks`
        documentation for more details.\n\n- The new :ref:`debops.timesyncd` role
        has replaced the :ref:`debops.ntp` role\n  as the default NTP service provider
        in the :file:`layer/common.yml` playbook.\n  Existing hosts shouldn't be affected
        - the new role can automatically\n  recognize that a different time daemon
        package is installed on the host and\n  will not try to configure :command:`systemd-timesyncd`
        service in such case.\n  You might need to add your hosts to the ``[debops_service_ntp]``
        Ansible\n  inventory group to keep using the old role.\n\n- The new :ref:`debops.resolved`
        role has replaced the :ref:`debops.resolvconf`\n  role as the default DNS
        resolver in the :file:`layer/common.yml` and the\n  bootstrap playbooks. Existing
        hosts shouldn't be affected, the role detects\n  presence of the ``resolvconf``
        APT package and does not modify the host\n  configuration in such case.\n\n-
        Multiple DebOps Collections on Ansible Galaxy have been merged into a single\n
        \ ``debops.debops`` Collection to prepare the project to switch role references\n
        \ to FQCNs. This is also a test to see if Ansible Galaxy allows >2 MB\n  collection
        tarballs.\n\n- The :command:`debops config` command has been refactored and
        split into\n  multiple subcommands to allow easier configuration introspection.
        See\n  :ref:`it's documentation page <cmd_debops-config>` for more details.\n\n-
        The Debian 12 (Bookworm) has been released! Multiple DebOps roles have been\n
        \ updated and switched the \"stable\" release to Bookworm, with Bullseye becoming\n
        \ the \"oldstable\" release. The new Debian Testing release, \"Trixie\" has
        also\n  been added in relevant places.\n\n- DebOps now supports using :command:`git`
        in project directories - new\n  projects will be initialized as :command:`git`
        repositories by default. The\n  :command:`git-crypt` command is also supported,
        and can encrypt project\n  secrets.\n\n:ref:`debops.apt` role\n''''''''''''''''''''''\n\n-
        The role will configure APT to use Debian Security repositories via the\n
        \ http://deb.debian.org/debian-security/ CDN.\n\n- The role has been refreshed
        and management of the\n  :file:`/etc/apt/sources.list` file was redesigned
        to allow for better\n  flexibility in configuration. See role documentation
        for more details.\n\n:ref:`debops.apt_preferences` role\n''''''''''''''''''''''''''''''''''\n\n-
        The pin priorities for the Debian ``-updates`` and ``-security`` APT\n  repositories
        have been raised to 550 to match the raised priority of the\n  primary repository.
        This should ensure that when the custom pin priorities\n  are active, updates
        to Debian packages are correctly installed as well. See\n  :envvar:`apt_preferences__debian_stable_default_preset_list`
        variable for\n  details.\n\n:ref:`debops.docker_server` role\n''''''''''''''''''''''''''''''''\n\n-
        The role can now directly handle the daemon ``log-driver`` parameter.\n\n-
        The role has been redesigned from scratch; Python :command:`virtualenv`\n
        \ support has been removed since the :command:`docker-compose` is included
        in\n  Debian repositories directly, or is implemented as a Go plugin in upstream\n
        \ repositories. The Docker configuration is now implemented via the\n  :ref:`universal_configuration`
        system, users will have to modify their\n  Ansible inventories. See the role
        documentation for details.\n\n:ref:`debops.elasticsearch` role\n''''''''''''''''''''''''''''''''\n\n-
        The role will check the status of the built-in user accounts via the HTTP
        API\n  instead of relying on the Ansible local facts and create them if they
        don't\n  exist. This should help with an upgrade of existing Elasticsearch
        clusters\n  without TLS encrypted traffic and authentication.\n\n:ref:`debops.gitlab`
        role\n'''''''''''''''''''''''''\n\n- The role has been rewritten from scratch
        and now can be used to deploy and\n  manage a `GitLab Omnibus`__ instance
        (managed internally by Chef) on Debian\n  or Ubuntu hosts. The role integrates
        with various DebOps services (firewall,\n  PKI infrastructure, LDAP environment)
        with GitLab Omnibus. Both Community\n  Edition (default) and Enterprise Edition
        are supported.\n\n  .. __: https://docs.gitlab.com/omnibus/\n\n:ref:`debops.global_handlers`
        role\n''''''''''''''''''''''''''''''''''\n\n- The :command:`systemd` handlers
        have been moved to a separate\n  :file:`handlers/systemd.yml` configuration
        file.\n\n:ref:`debops.icinga` role\n'''''''''''''''''''''''''\n\n- New hosts
        will be added to Icinga Director using the ``icinga-agent-host``\n  template,
        created by default by the :ref:`debops.icinga_web` role. On\n  existing installations,
        you should either create this template by hand, or\n  run the :ref:`debops.icinga_web`
        role so that it gets added automatically.\n\n:ref:`debops.icinga_db` role\n''''''''''''''''''''''''''''\n\n-
        The role will manage Icinga databases directly instead of relying on\n  :command:`dbconfig`
        Debian subsystem. This improves support for remote Icinga\n  database deployments
        accessible over TLS.\n\n:ref:`debops.icinga_web` role\n'''''''''''''''''''''''''''''\n\n-
        The LDAP configuration used by the role to configure LDAP access will be\n
        \ based on the :ref:`debops.ldap` Ansible local facts instead of static values,\n
        \ to better support modified environments.\n\n:ref:`debops.influxdata` role\n'''''''''''''''''''''''''''''\n\n-
        InfluxData has published a new APT repository GPG key, the role should\n  refresh
        it automatically.\n\n:ref:`debops.minio` role\n''''''''''''''''''''''''\n\n-
        The role has been updated to support newer MinIO features, like the embedded\n
        \ MinIO Console. Some of the instance parameters have been changed, for example\n
        \ access key and secret key have been replaced with root account and password.\n
        \ Check the role documentation for more details.\n\n:ref:`debops.nginx` role\n''''''''''''''''''''''''\n\n-
        Configure the :file:`nginx.service` systemd unit to start the\n  :command:`nginx`
        service after the network is configured. This way\n  :command:`nginx` should
        be able to resolve upstream services specified via\n  DNS names at startup.\n\n:ref:`debops.ntp`
        role\n''''''''''''''''''''''\n\n- The default NTP daemon used on hosts with
        the :command:`systemd` service\n  manager will be :command:`systemd-timesyncd`.
        Existing systems with\n  a different NTP server should not be affected by
        this change.\n\n- The role should better detect Linux Container environment
        and not try to\n  install an NTP daemon inside of a container.\n\n:ref:`debops.pki`
        role\n''''''''''''''''''''''\n\n- The :command:`pki-realm` script will call
        the :command:`certbot` command with\n  the :command:`certbot --authenticator
        <plugin>` option explicitly to allow\n  use with third-party authenticator
        plugins that might not support the\n  :command:`certbot --<plugin>` syntax.\n\n:ref:`debops.preseed`
        role\n''''''''''''''''''''''''''\n\n- The default guided partition recipe
        used by the Debian Installer is changed\n  from ``atomic`` to ``multi``. This
        should allow for easier changes in the\n  partition layout via LVM due to
        separate partitions for :file:`/home` and\n  :file:`/var` mount points.\n\n:ref:`debops.proc_hidepid`
        role\n'''''''''''''''''''''''''''''''\n\n- The role will check if PolicyKit
        is installed on the host, in which case the\n  default security level for
        access to the :file:`/proc` filesystem will be\n  more permissive.\n\n:ref:`debops.python`
        role\n'''''''''''''''''''''''''\n\n- The role will enable Python 2.7 support
        via the fact script only when an\n  existing Python 2.7 installation is detected.
        This change should help avoid\n  installing Python 2.7 packages on newer OS
        releases when they might be\n  unavailable.\n\n- The :file:`/etc/pip.conf`
        configuration file template can be overridden via\n  the DebOps template override
        mechanism.\n\n:ref:`debops.resolvconf` role\n'''''''''''''''''''''''''''''\n\n-
        In the :ref:`debops.resolvconf` role, you can now write a fully static\n  :file:`/etc/resolv.conf`
        file without the ``resolvconf`` package.\n\n:ref:`debops.slapd` role\n''''''''''''''''''''''''\n\n-
        The default log level used by OpenLDAP has been changed from ``stats`` to\n
        \ ``none`` to minimize log output in large environments. This can be modified\n
        \ using Ansible inventory in case that the authentication, accounting or search\n
        \ metrics are needed.\n\n:ref:`debops.sshd` role\n'''''''''''''''''''''''\n\n-
        The management of the :file:`/etc/ssh/sshd_config` configuration file has\n
        \ been redesigned and now uses :ref:`universal_configuration`. Multiple default\n
        \ variables have been removed as a result. Any changes in configuration applied\n
        \ through Ansible inventory might need to be converted to the new format.
        Check\n  the changes on existing hosts before applying new configuration.\n\n:ref:`debops.system_users`
        role\n'''''''''''''''''''''''''''''''\n\n- The role will check remote user
        databases for local admin information using\n  the :command:`getent passwd`
        command if the user has not been found in the\n  :file:`/etc/passwd` local
        database.\n\nFixed\n~~~~~\n\nGeneral\n'''''''\n\n- Extrepo facts file did
        not detect a disabled repository as being disabled\n  due to a change in the
        extrepo file format.\n\n- Ensure that the custom Ansible plugins included
        in DebOps are present in the\n  Ansible Collection build from the DebOps repository.\n\n-
        Provide a help message in case the :file:`ansible.cfg` configuration file
        in\n  the DebOps project directory does not include the ``inventory`` option.\n\n-
        Fixed an issue with custom Ansible plugins not working in \"standalone\" mode\n
        \ without the DebOps scripts installed on Ansible Controller.\n\n- The ``warn``
        parameter in the ``shell`` and ``command`` Ansible modules has\n  been removed
        in Ansible 2.14. It has been removed in various DebOps roles to\n  allow playbook
        execution to work correctly.\n\n- Fixed all password lookups which used ``chars=ascii``
        instead of\n  ``chars=ascii_letters``. This resulted in passwords which only
        contained the\n  letters a,c,i,s instead of all lowercase and uppercase ASCII
        letters. Because\n  all occurrences of this bug at least also included all
        digits in the character\n  set and the password length was at least 20 characters,
        this did not result\n  in weak passwords.\n\n- The ``ipaddr`` Ansible filter
        and its aliases used in various roles were\n  renamed to ``ansible.utils.ipaddr``
        and its corresponding alias names because\n  Ansible requires use of FQCNs
        in filters. The ``ansible.utils`` Ansible\n  Collection is now a dependency
        of the DebOps Collection.\n\n- The :command:`debops run` and :command:`debops
        check` commands should now\n  correctly recognize options of the :command:`ansible-playbook`
        command which\n  don't expect arguments and expand playbook names specified
        after them.\n\n:ref:`debops.apt` role\n''''''''''''''''''''''\n\n- In the
        fact script, parse the ``deb-src`` configuration entries before\n  ``deb``
        entries to ensure that there are no duplicates.\n\n- The role no longer defaults
        to the ``ansible_local.core.distribution`` and\n  ``ansible_local.core.distribution_release``
        local facts for determining the\n  Linux distribution and the distribution
        release, respectively. These facts\n  were set later in the common playbook,
        meaning that the role would restore\n  the previous distribution release in
        ``/etc/apt/sources.list`` after a\n  distribution upgrade.\n\ndebops.boxbackup
        role\n'''''''''''''''''''''\n\n- The role is not included in the DebOps Collection
        on Ansible Galaxy,\n  therefore its playbook is no longer included in the
        main :file:`site.yml`\n  playbook. This fixes an issue with Ansible stopping
        the site playbook\n  execution when it cannot find the ``boxbackup`` role
        in the Collection.\n\n:ref:`debops.core` role\n'''''''''''''''''''''''\n\n-
        Ensure that the ``ansible_controllers`` fact can be reset using the\n  :envvar:`core__remove_facts`
        variable to avoid infinitely growing list of\n  Ansible Controllers.\n\n:ref:`debops.cron`
        role\n'''''''''''''''''''''''\n\n- Fixed the order of job parameters applied
        by the role - now parameters from\n  a specific job will override parameters
        specified for all jobs in a given\n  configuration entry.\n\n:ref:`debops.dnsmasq`
        role\n''''''''''''''''''''''''''\n\n- Fixed service configuration mistake
        when DHCPv6 mode is set to an empty\n  string. The configuration template
        should take this into account and add\n  a correct separator (or omit it)
        in the generated configuration file.\n\n:ref:`debops.dovecot` role\n''''''''''''''''''''''''''\n\n-
        The role's PKI hook script still referenced an old configuration file that\n
        \ was no longer being managed by :ref:`debops.dovecot` since the role redesign,\n
        \ resulting in the hook script failing to reload dovecot after a certificate
        or\n  DH param change.\n\n:ref:`debops.elasticsearch` role\n''''''''''''''''''''''''''''''''\n\n-
        The internal Java security policy used by Elasticsearch will be configured\n
        \ only on Elasticsearch v7.x+ versions. Before them, Elasticsearch used the\n
        \ global Java security policy.\n\n:ref:`debops.environment` role\n''''''''''''''''''''''''''''''\n\n-
        Fixed issues with preserving environment variables across multiple role\n
        \ executions.\n\n:ref:`debops.etc_aliases` role\n''''''''''''''''''''''''''''''\n\n-
        Don't save dependent recipients on Ansible Controller if they are not\n  defined.
        This should avoid creating unnecessary files in AWX job containers.\n\n:ref:`debops.ferm`
        role\n'''''''''''''''''''''''\n\n- Don't include additional '{' or '}' characters
        in certain rules when the\n  ``domain_args`` parameter is specified.\n\n-
        Fixed an issue in the rule template that caused a templating type error where\n
        \ Jinja expected a string but found an int value instead.\n\n:ref:`debops.gitlab_runner`
        role\n''''''''''''''''''''''''''''''''\n\n- Fixed an error that could occur
        in the \"Patch 'vagrant-libvirt' source code\"\n  task on systems other than
        Debian 9 or 10. The patch is not required since\n  the ``vagrant-libvirt``
        v0.1.0 package.\n\n:ref:`debops.grub` role\n'''''''''''''''''''''''\n\n- The
        :command:`grub` user passwords will be passed for encryption using\n  a temporary
        file stored in the :file:`secret/` directory on the Ansible\n  Controller
        instead of directly on the command line, to avoid leaks through\n  the process
        list.\n\n:ref:`debops.ifupdown` role\n'''''''''''''''''''''''''''\n\n- The
        interface names used in scripts will be escaped using the\n  :command:`systemd-escape`
        tool. This should fix problems with control over\n  network interfaces which
        contain the hyphen character(s).\n\n:ref:`debops.kibana` role\n'''''''''''''''''''''''''\n\n-
        The role will use the correct path of the Kibana keystore depending on the\n
        \ installed version (versions <7.0.0 keep the keystore in the\n  :file:`/var/lib/kibana/`
        directory; newer versions use the\n  :file:`/etc/kibana/` directory).\n\n-
        The role will use different user account depending on Kibana version (either\n
        \ ``kibana``, or ``kibana_system`` used in newer installations of\n  Elasticsearch).
        Depending on your installed version, you should check the\n  :envvar:`kibana__elasticsearch_username`
        to verify that the correct account\n  is used for access to Elasticsearch.\n\n-
        The role will include the ``server.publicBaseUrl`` parameter depending on\n
        \ Kibana version, to avoid failures on older Kibana installations.\n\n:ref:`debops.ldap`
        role\n'''''''''''''''''''''''\n\n- Fixed an issue with the role passing IP
        and MAC addresses to the LDAP\n  directory as a nested YAML list which resulted
        in a wrong attribute values.\n\n- Fixed an issue with role parsing the already
        parsed Ansible facts to extract\n  IP/CIDR information which resulted in wrong
        output in certain cases. The role\n  will now implicitly trust the Ansible
        facts to be correct when adding IP and\n  prefix details to the LDAP database.\n\n:ref:`debops.libvirtd`
        role\n'''''''''''''''''''''''''''\n\n- Fixed ``qemu-kvm`` package installation
        logic; the KVM packages should now be\n  handled correctly on Debian Bullseye
        and newer releases.\n\n:ref:`debops.logrotate` role\n''''''''''''''''''''''''''''\n\n-
        Fixed formatting in the :file:`/etc/logrotate.conf` configuration file to\n
        \ avoid adding :command:`vim` fold markers from the DebOps role defaults.\n\n:ref:`debops.lxc`
        role\n''''''''''''''''''''''\n\n- Fixed name of the ``vfs_root`` parameter
        in the call to the\n  ``community.general.lxc_container`` Ansible module,
        which was renamed to\n  ``zfs_root``.\n\n:ref:`debops.netbase` role\n''''''''''''''''''''''''''\n\n-
        In the fact script, don't use ``in`` for matching IP addresses and DNS names\n
        \ where substring matching is undesirable.\n\n:ref:`debops.netbox` role\n'''''''''''''''''''''''''\n\n-
        Using boolean variables in :envvar:`netbox__config_plugins_config` for\n  example
        resulted in an error because the role used the ``to_nice_json``\n  Jinja2
        filter internally to render Python configuration.\n  This is fixed for all
        uses of ``to_nice_json``\n\n:ref:`debops.ntp` role\n''''''''''''''''''''''\n\n-
        Fix an issue where the role tried to manage the :command:`systemd-timesyncd`\n
        \ service without it actually being present on the host. This should now be\n
        \ avoided by carefully checking the service status.\n\n- The role will not
        try to purge installed NTP daemon packages when it is\n  disabled through
        Ansible inventory.\n\n:ref:`debops.owncloud` role\n'''''''''''''''''''''''''''\n\n-
        Access to static assets was not logged regardless of the\n  ``owncloud__nginx_access_log_assets``
        setting.\n\n- Access to the ``/remote`` URI path was not configured in Nginx
        as proposed in\n  the upstream Nginx example in the Nextcloud docs.\n\n:ref:`debops.pdns`
        role\n'''''''''''''''''''''''\n\n- On pdns installations with version >= 4.5.0
        (e.g. on Bookworm systems), the\n  role would cause a syntax error on the
        local-address configuration option.\n\n:ref:`debops.pki` role\n''''''''''''''''''''''\n\n-
        After the :command:`certbot` script performs a certificate renewal operation,\n
        \ a deploy hook will update the PEM chains in a given PKI realm\n  :file:`private/`
        directory to include the new private key created by the\n  :command:`certbot`
        script.\n\n- Fixed an issue where when a PKI realm was initialized for ACME/Let's
        Encrypt\n  support, second level domains were not included in the generated
        X.509\n  certificate request.\n\n- Use :command:`openssl x509 -inform PEM`
        command to explicitly check for\n  a PEM-formatted X.509 certificate file
        because the old :command:`openssl x509\n  -in` option was changed to work
        with both DER and PEM files. This should fix\n  an issue with Let's Encrypt
        certificate chains containing a DER-formatted\n  certificate inside of them.\n\n
        \ Users will need to remove existing PKI realms which use ACME/Let's Encrypt
        CA\n  for the :command:`pki-realm` script to rebuild the certificate chain\n
        \ correctly. After that re-run the :ref:`debops.pki` role on the host to\n
        \ re-create che realms.\n\n:ref:`debops.postconf` role\n'''''''''''''''''''''''''''\n\n-
        The EHLO IP address check was removed. This check would reject a message if\n
        \ the EHLO hostname of the connecting mailserver resolved to a non-publicly\n
        \ routable IP address. However, rejecting messages for this reason is\n  prohibited
        by :rfc:`5321` section 4.1.4, and sometimes caused deliverability\n  issues
        for Office 365 users.\n\n:ref:`debops.preseed` role\n''''''''''''''''''''''''''\n\n-
        Fixed an issue with the ``d-i`` keyboard preseed that resulted in the\n  ``keyboard-configuration``
        APT package not being installed and configured\n  correctly. The default keymap
        is changed to ``us`` and the option is no\n  longer based on the system language
        which might be incorrect in this case.\n\n:ref:`debops.proc_hidepid` role\n'''''''''''''''''''''''''''''''\n\n-
        The fact script has been optimized \n\n</details>\n\n---\n\n### Configuration\n\n\U0001F4C5
        **Schedule**: Branch creation - At any time (no schedule defined), Automerge
        - At any time (no schedule defined).\n\n\U0001F6A6 **Automerge**: Disabled
        by config. Please merge this manually once you are satisfied.\n\n\u267B **Rebasing**:
        Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515
        **Ignore**: Close this PR and you won't be reminded about this update again.\n\n---\n\n
        - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
        box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
        View the [repository job log](https://developer.mend.io/github/osism/release).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My42Ni40IiwidXBkYXRlZEluVmVyIjoiNDMuNjYuNCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUiXX0=-->\n"
      change_url: https://github.com/osism/release/pull/2419
      child_jobs: []
      commit_id: 652bba730ae468d75662534f6fc2512ae266fac2
      event_id: 54baf8f0-2053-11f1-96e3-6ff1deac5c0c
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/6e1427de47e24f1c943ad467f5fb87e7/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/6e1427de47e24f1c943ad467f5fb87e7/work/logs
        result_data_file: /var/lib/zuul/builds/6e1427de47e24f1c943ad467f5fb87e7/work/results.json
        src_root: /var/lib/zuul/builds/6e1427de47e24f1c943ad467f5fb87e7/work/src
        work_root: /var/lib/zuul/builds/6e1427de47e24f1c943ad467f5fb87e7/work
      include_vars: []
      items:
      - branch: main
        change: '2419'
        change_message: "chore(deps): update dependency debops.debops to v3.3.0\n\n>
          \u2139\uFE0F **Note**\n> \n> This PR body was truncated due to platform
          limits.\n\nThis PR contains the following updates:\n\n| Package | Update
          | Change |\n|---|---|---|\n| [debops.debops](https://redirect.github.com/debops/debops)
          | minor | `3.2.5` \u2192 `3.3.0` |\n\n---\n\n### Release Notes\n\n<details>\n<summary>debops/debops
          (debops.debops)</summary>\n\n### [`v3.3.0`](https://redirect.github.com/debops/debops/blob/HEAD/CHANGELOG.rst#debops-v330---2026-03-13)\n\n[Compare
          Source](https://redirect.github.com/debops/debops/compare/v3.2.6...v3.3.0)\n\n..
          \\_debops v3.3.0: <https://github.com/debops/debops/compare/v3.2.0...v3.3.0>\n\nAdded\n\n```\n\nNew
          DebOps roles\n''''''''''''''''\n\n- The :ref:`debops.nixos` role with its
          corresponding playbook can be used to\n  manage NixOS-based hosts. The role
          is not included in the main\n  :file:`site.yml` playbook, which is focused
          on Debian/Ubuntu hosts.\n\n- The :ref:`debops.influxdb2` role can be used
          to install and configure\n  `InfluxDB v2.x`__ time-series database.\n\n
          \ .. __: https://www.influxdata.com/products/influxdb/\n\n- The :ref:`debops.pgbadger`
          role can be used to generate PostgreSQL log\n  reports from local or remote
          hosts over SSH.\n\n:ref:`debops.core` role\n'''''''''''''''''''''''\n\n-
          A new local fact, ``ansible_local.core.is_64bits``, can be used to determine\n
          \ if the current system supports 32-bit or 64-bit architecture.\n\n:ref:`debops.dovecot`
          role\n''''''''''''''''''''''''''\n\n- The role now supports `iterate_filter`
          for its LDAP configuration, allowing\n  :command:`doveadm` commands to iterate
          over all users. Note that you might\n  have to adjust the defaults for the
          :envvar:`dovecot__ldap_user_list_filter`\n  variable if you use the :envvar:`dovecot__ldap_user_filter`
          variable.\n\n:ref:`debops.ipxe` role\n'''''''''''''''''''''''\n\n- Debian
          13 (Trixie) has been released, support for its installer has been added\n
          \ to the role. Debian Trixie is now the primary Stable release available
          in the\n  netboot installation menu.\n\n:ref:`debops.netbox` role\n'''''''''''''''''''''''''\n\n-
          Starting with NetBox ``v3.4.9``, anonymized reporting of census data is
          being\n  enabled by default. DebOps respects this upstream default. You
          can change it\n  using :envvar:`netbox__config_census_reporting`.\n\n- The
          role can be used with NetBox deployed in a clustered PostgreSQL setup\n
          \ with primary/standby nodes.\n\n:ref:`debops.nginx` role\n''''''''''''''''''''''''\n\n-
          Different file templates used in the role can now be overridden by the users\n
          \ with the DebOps template override system and the ``template_src`` lookup\n
          \ plugin.\n\n:ref:`debops.preseed` role\n''''''''''''''''''''''''''\n\n-
          The role will now generate preseed templates for Debian 13 (Trixie)\n  automated
          installation.\n\n:ref:`debops.resolved` role\n'''''''''''''''''''''''''''\n\n-
          The role will add a new entry in the :file:`/etc/services` database (using\n
          \ the :ref:`debops.etc_services` role) for the ``5355`` TCP and UDP ports,\n
          \ reserved for the `Link-Local Multicast Name Resolution`__. This should
          help\n  with identification of unknown TCP/UDP ports of the listening services.\n\n
          \ .. __: https://en.wikipedia.org/wiki/Link-Local_Multicast_Name_Resolution\n\nChanged\n```\n\nUpdates
          of upstream application versions\n''''''''''''''''''''''''''''''''''''''''\n\n-
          In the :ref:`debops.netbox` role, the NetBox version has been updated to\n
          \ `v4.4.1`.\n\n- In the :ref:`debops.ipxe` role, the Debian Bookworm installer
          has been\n  updated to v12.12.\n\nGeneral\n'''''''\n\n- The :ref:`debops.root_account`,
          :ref:`debops.system_users` and\n  :ref:`debops.users` roles are now able
          to handle the symlinked\n  :file:`~/.ssh/authorized_keys` files correctly
          using optional `follow`\n  parameter.\n\n- The DebOps CI pipeline in GitHub
          Actions is improved and will be executed on\n  pull requests and pushes
          to test changes before merging them.\n\n- The :command:`debops` script and
          custom Ansible lookup plugins should now be\n  compatible with Python 3.12+
          due to removal of the `distutils` Python\n  dependency, replaced by the
          `packaging` Python module.\n\n- References to the old `debops.roleXX` Ansible
          Collections have been removed\n  from all playbooks, since the project is
          now contained in a single Ansible\n  Collection.\n\n:ref:`debops.apt` role\n''''''''''''''''''''''\n\n-
          The Debian 10 (Buster) release has been archived and removed from Debian\n
          \ mirrors. The role will use <https://archive.debian.org/debian> as the\n
          \ repository URL on Debian Buster hosts.\n\n- The role now can manage repository
          GPG keys directly, stored in the\n  :file:`/etc/apt/keyrings/` directory,
          bypassing the deprecated\n  `ansible.builtin.apt_key` module. Support for
          the Ansible module is\n  present, but needs to be enabled explicitly.\n\n
          \ Existing role configuration might need to be updated to support new changes,\n
          \ check the role documentation for details.\n\n:ref:`debops.gitlab` role\n'''''''''''''''''''''''''\n\n-
          Users can now select specific GitLab version to install using the APT\n
          \ preferences, by specifying the package version in the\n  :envvar:`gitlab__preferred_version`
          variable. By default, the latest version\n  will be installed.\n\n- The
          :command:`nginx` service inside of the GitLab Omnibus installation will\n
          \ be restarted when X.509 certificates managed by the :ref:`debops.pki`
          role\n  are reissued, for example via ACME.\n\n:ref:`debops.gitlab_runner`
          role\n''''''''''''''''''''''''''''''''\n\n- The role is now compatible with
          GitLab 17.x and newer releases.\n\n- The runner registration method has
          changed, see the role documentation for\n  details.\n\n:ref:`debops.keyring`
          role\n''''''''''''''''''''''''''\n\n- The role now can manage repository
          GPG keys directly, stored in the\n  :file:`/etc/apt/keyrings/` directory,
          bypassing the deprecated\n  `ansible.builtin.apt_key` module. Support for
          the Ansible module is\n  present, but needs to be enabled explicitly.\n\n
          \ Existing role configuration might need to be updated to support new changes,\n
          \ check the role documentation for details.\n\n:ref:`debops.nginx` role\n''''''''''''''''''''''''\n\n-
          The custom :command:`systemd` override that ensures that the :command:`nginx`\n
          \ service is started after network is available will be installed only on
          older\n  Debian/Ubuntu releases; it's now the default since Debian Bookworm.\n\n:ref:`debops.pki`
          role\n''''''''''''''''''''''\n\n- The default key type in :command:`certbot`
          is set to RSA, since currently\n  there's no support for different key types
          in DebOps PKI infrastructure.\n\n- The permission of the :file:`config/environment`
          configuration file in PKI\n  realms will be se to `0644` so that other UNIX
          accounts can read it. This is\n  needed by the :command:`acme-tiny` command
          which is executed on a separate\n  UNIX account.\n\n:ref:`debops.postgresql_server`
          role\n''''''''''''''''''''''''''''''''''''\n\n- The role can now support
          `pgBadger`\\_\\_ log analyzer by enabling verbose log\n  output and modifying
          access to the log files themselves in the\n  :file:`/var/log/postgresql/`
          directory. This functionality is disabled by\n  default and can be enabled
          using a role variable.\n\n  .. \\_\\_: <https://pgbadger.darold.net/>\n\n-
          The default log ident string is changed to `postgresql-<version>-<name>`
          to\n  better distinguish different PostgreSQL instances in the system logs.\n\n:ref:`debops.reprepro`
          role\n'''''''''''''''''''''''''''\n\n- The role now configures local APT
          repositories for Debian 13 (Trixie) and\n  Debian 14 (Forky) by default.
          Configuration for Debian Buster repositories\n  has been removed. Symlinks
          for the :file:`stable/`, :file:`oldstable/` and\n  :file:`oldoldstable/`
          releases will be updated automatically to point to the\n  correct Debian
          releases.\n\n:ref:`debops.resources` role\n''''''''''''''''''''''''''''\n\n-
          The :command:`git` repositories will be processed by the role first, since\n
          \ :command:`git` can handle directory creation if needed.\n\n:ref:`debops.rspamd`
          role\n'''''''''''''''''''''''''\n\n- Due to the `removal`\\_\\_ of the `distutils`
          Python module from Python v3.12,\n  custom scripts included in the role
          which create and update DKIM keys have\n  been updated to use the `shutil`
          module instead.\n\n  .. \\_\\_: <https://docs.python.org/3.11/whatsnew/3.10.html#distutils-deprecated>\n\n:ref:`debops.snmpd`
          role\n''''''''''''''''''''''''\n\n- The :file:`snmpd.service` configuration
          file provided in the role will ensure\n  that the :command:`snmpd` daemon
          is restarted on failure. Older versions of\n  :command:`snmpd` can `fail
          due to rapid changes in network interfaces`\\_\\_.\n\n  .. \\_\\_: <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1023656>\n\n:ref:`debops.yadm`
          role\n'''''''''''''''''''''''\n\n- The paths to the repositories that are
          safe to clone by the :command:`git`\n  command, used for dotfiles by the
          :ref:`debops.system_users` and\n  :ref:`debops.users` roles, will be defined
          in the :file:`/etc/gitconfig`\n  system-wide configuration file instead
          of the per-user :file:`~/.gitconfig`\n  configuration files. This avoids
          the issue of modifying per-user environment\n  from the system-wide level
          on which DebOps operates and ensires that the\n  cloned dotfiles are not
          modified. The specific tasks that do this have been\n  moved from the :ref:`debops.system_users`
          and :ref:`debops.users` role into\n  the :ref:`debops.yadm` role.\n\nFixed\n\n```\n\nGeneral\n'''''''\n\n-
          The :ref:`debops.system_users` and the :ref:`debops.users` roles will add
          the\n  dotfiles repository cloned by the ``root`` UNIX account in the\n
          \ :ref:`debops.yadm` role to the list of trusted :command:`git` repositories
          in\n  the :file:`~/.gitconfig` configuration file of each user account managed
          by\n  the role. This is needed to allow :command:`git` to clone local repositories\n
          \ not owned by the UNIX account, required by the mitigation of the\n  `CVE-2022-24765`__
          security vulnerability.\n\n  .. __: https://github.blog/open-source/git/git-security-vulnerability-announced/#cve-2022-24765\n\n-
          The :command:`debops` script will not try to download the required Ansible\n
          \ Collections during new project creation if the :command:`ansible-galaxy`\n
          \ command is not available in the user's ``$PATH``.\n\n- The :file:`tools/dist-upgrade.yml`
          playbook will not fail anymore during\n  :file:`/etc/services` database
          assembly if no upgrade was performed.\n\n- New DebOps project directories
          will use fixed Ansible configuration for\n  callback plugins and will default
          to a YAML output format of the playbook\n  results.\n\n:ref:`debops.apache`
          role\n'''''''''''''''''''''''''\n\n- Fixed an issue with the vhost ``state:
          \"absent\"`` parameter not working\n  correctly when the ``enabled: False``
          parameter was not set as well.\n\n:ref:`debops.docker_gen` role\n'''''''''''''''''''''''''''''\n\n-
          Flattened the list of directories that are created by the ``file`` task.
          This\n  should fix the issue of Ansible stopping during execution due to
          nested lists\n  in the ``loop`` keyword.\n\n:ref:`debops.dropbear_initramfs`
          role\n'''''''''''''''''''''''''''''''''''''\n\n- The role now supports both
          the old and the new location if the initramfs\n  configuration files.\n\n:ref:`debops.ferm`
          role\n'''''''''''''''''''''''\n\n- The role will restart the :command:`fail2ban`
          service instead of reloading\n  it, which will ensure that the custom rules
          are re-added when the\n  :command:`ferm` service is restarted.\n\n- Fixed
          an issue with the role failing if the :envvar:`ferm__parsed_rules`\n  variable
          is not defined correctly. The role will skip rule generation in such\n  case
          instead of failing with the \"AnsibleUndefined\" error message.\n\n:ref:`debops.ifupdown`
          role\n'''''''''''''''''''''''''''\n\n- The :file:`iface@.service` :command:`systemd`
          unit provided by the role is\n  changed to use ``After==sys-subsystem-net-devices-%i.device``
          parameter. This\n  should ensure that the bridge interfaces are correctly
          started at boot time.\n\n:ref:`debops.netbox` role\n'''''''''''''''''''''''''\n\n-
          Fixed an issue with the Django superuser creation task that failed execution\n
          \ if the ``error`` string was not present in command output; this resulted
          in\n  an incomplete installation.\n\n:ref:`debops.nullmailer` role\n'''''''''''''''''''''''''''''\n\n-
          The role will avoid interacting with the LDAP server when LDAP support is\n
          \ disabled while DebOps is used in LDAP environment.\n\n:ref:`debops.owncloud`
          role\n'''''''''''''''''''''''''''\n\n- Fixed conditional logic in a task
          which determines if the \"autosetup\"\n  operation should be performed during
          Nextcloud/ownCloud installation.\n\n:ref:`debops.pki` role\n''''''''''''''''''''''\n\n-
          The Let's Encrypt service dropped support for the ``contacts`` option. This\n
          \ requires a new version of the :command:`acme-tiny` command to be installed
          on\n  client hosts to work properly. Since the ``acme-tiny`` APT package
          in Debian\n  Bookworm is too old, on this release the role will install\n
          \ :command:`acme-tiny` from source. On existing installations, the\n  ``acme-tiny``
          APT package might need to be removed manually.\n\n- The ``acme-tiny`` source
          repository switched from the ``master`` branch to\n  the ``main`` branch,
          existing source installations need to remove the local\n  clone of the repository
          in :file:`/usr/local/src/pki-acme/diafygi/acme-tiny/`\n  so that it can
          be cloned correctly by Ansible. You should also remove the\n  copy of the
          :file:`/usr/local/bin/acme-tiny` command to be installed\n  correctly.\n\n:ref:`debops.pdns`
          role\n'''''''''''''''''''''''\n\n- The PowerDNS service will be configured
          to listen on all external IPv4 and\n  IPv6 addresses of a host insteand
          of listening on \"all\" IP addresses to\n  ensure that the service is started
          while the :command:`systemd-resolved`\n  service listens on the loopback
          interface.\n\n:ref:`debops.postgresql_server` role\n''''''''''''''''''''''''''''''''''''\n\n-
          Fixed an issue with the ``vacuum_defer_cleanup_age`` option removal in\n
          \ PostgreSQL 16.x resulting in failed startup of the service. The option
          will\n  be added only on supported PostgreSQL versions.\n\n:ref:`debops.resolved`
          role\n'''''''''''''''''''''''''''\n\n- The role will disable synthesis of
          local hostname by the\n  :command:`systemd-resolved` service (enabled by
          default in systemd v256) to\n  allow resolution of the host's FQDN queries
          by upstream DNS server.\n\n:ref:`debops.sysctl` role\n'''''''''''''''''''''''''\n\n-
          The :file:`50-pid-max.conf` configuration file will be installed only on\n
          \ platforms which support 64-bit architecture.\n\nRemoved\n```\n\nGeneral\n'''''''\n\n-
          The `volkszaehler` (`debops-contrib`) role was removed because the role\n
          \ maintainer considers the application to be superseded by Grafana.\n  See
          `Future of the project; The elephant in the room \u2013 Grafana`\\_\\_.\n\n
          \ .. \\_\\_: [volkszaehler/volkszaehler.org#819](https://redirect.github.com/volkszaehler/volkszaehler.org/issues/819)\n\n-
          The `bitcoind` role was removed due to lack of interest by the role\n  maintainer.\n\n-
          The `profile_tasks.py` Ansible callback plugin has been removed due to\n
          \ \"Unexpected Exception\" error on Ansible v2.19. Users should use its
          upstream\n  alternative, `ansible.posix.profile_tasks` plugin.\n\n:ref:`debops.ipxe`
          role\n'''''''''''''''''''''''\n\n- Debian 10 (Buster) has been archived
          and it's no longer available on Debian\n  mirrors, support for its installer
          has been removed from the role.\n\n:ref:`debops.netbox` role\n'''''''''''''''''''''''''\n\n-
          The NAPALM integration feature found in NetBox 3.4 and before has been moved\n
          \ to a dedicated plugin. If you want to continue using it, you will have
          to\n  install the plugin. All role variables about NAPALM except\n  :envvar:`netbox__napalm_ssh_generate`
          and\n  :envvar:`netbox__napalm_ssh_generate_bits` have been removed.\n\n:ref:`debops.python`
          role\n'''''''''''''''''''''''''\n\n- The `python3-future` and `python-future`
          APT packages have been removed\n  from Debian Stable release, and will not
          be installed by default by the\n  :ref:`debops.python` role.\n\nSecurity\n\n```\n\n:ref:`debops.icinga`
          role\n'''''''''''''''''''''''''\n\n- The GPG key of the Icinga upstream
          APT repository `has been replaced`__ on\n  30th September 2024. The role
          includes the new key which should be installed\n  on the host on the next
          run. The old GPG key will not be removed\n  automatically.\n\n  .. __: https://icinga.com/blog/2024/08/26/icinga-package-repository-key-rotation-2024/\n\n`debops
          v3.2.0`_ - 2024-09-16\n-----------------------------\n\n.. _debops v3.2.0:
          https://github.com/debops/debops/compare/v3.1.0...v3.2.0\n\nAdded\n~~~~~\n\nNew
          DebOps roles\n''''''''''''''''\n\n- The :ref:`debops.debconf` Ansible role
          can be used to pre-configure APT\n  packages which use the `debconf`__ configuration
          database and install them\n  afterwards. The role is included near the end
          of the :file:`site.yml`\n  playbook to allow of configuration of other needed
          services before the actual\n  package installation.\n\n  .. __: https://en.wikipedia.org/wiki/Debian_configuration_system\n\nGeneral\n'''''''\n\n-
          The :command:`debops` script can now log its operation to standard error
          and\n  to the :command:`syslog` service. Use the ``--verbose`` or ``-v``
          flag to\n  enable log output on the console.\n\n- Users can define \"playbook
          sets\" on the view level of the \"modern\" project\n  directories. Playbook
          sets can be used as aliases to call multiple playbooks\n  using a custom
          name. See :ref:`playbook_sets` documentation for more details.\n\n- Users
          can now enable \"read-only Fridays\" functionality on a per project\n  basis,
          to ensure that on Fridays, Ansible playbooks are run only in check\n  mode,
          with ``--check`` and ``--diff`` arguments automatically added to the\n  :command:`ansible-playbook`
          command options.\n\n:ref:`debops.apt_install` role\n''''''''''''''''''''''''''''''\n\n-
          The role will import the :ref:`debops.secret` role during execution to get\n
          \ access to the :file:`secret/` directory. This permits use of stored passwords\n
          \ in Debconf answers configured via the :ref:`debops.apt_install` role.\n\n:ref:`debops.dnsmasq`
          role\n''''''''''''''''''''''''''\n\n- The role can optionally ignore IP
          addresses on a network interface and use\n  only specified ones for :command:`dnsmasq`
          configuration. This can help with\n  Routing Advertisements issues on internal
          networks. See role documentation\n  for more details.\n\n:ref:`debops.pki`
          role\n''''''''''''''''''''''\n\n- Add support for defining per-realm UNIX
          environment variables set during\n  :command:`pki-realm` script execution.
          These variables can be used to augment\n  runtime environment, for example
          to define HTTP proxy to use inside internal\n  networks with restricted
          access to the outside world.\n\n:ref:`debops.rabbitmq_server` role\n''''''''''''''''''''''''''''''''''\n\n-
          The role can manage much more RabbitMQ internal structures - exchanges,\n
          \ queues, bindings between them, as well as vhost and user limits.\n\nChanged\n~~~~~~~\n\nUpdates
          of upstream application versions\n''''''''''''''''''''''''''''''''''''''''\n\n-
          In the :ref:`debops.ipxe` role, support for the Debian Bullseye netboot\n
          \ installer has been updated to v11.12; the Debian Bookworm installer has
          been\n  updated to v12.7.\n\nGeneral\n'''''''\n\n- DebOps now uses `pipx`__
          as the preferred installation method. This allows\n  for easier maintenance
          of the DebOps virtual environment.\n\n  .. __: https://pipx.pypa.io/\n\n:ref:`debops.elasticsearch`
          role\n''''''''''''''''''''''''''''''''\n\n- The role now supports new Elasticsearch
          v8.x password management mechanism.\n\n- The role can now manage passwords
          in separate Elasticsearch clusters defined\n  in one Ansible inventory.\n\n
          \ .. warning:: Due to this change, Elasticsearch passwords stored in the\n
          \              :file:`ansible/secret/` subdirectory will be read from a
          different\n               location. If passwords are not moved to the new
          location, role\n               will reset the Elasticsearch built-in users
          passwords\n               automatically. This might result in data loss.\n\n:ref:`debops.kibana`
          role\n'''''''''''''''''''''''''\n\n- The path to the password file stored
          in :file:`ansible/secret/` subdirectory\n  is now configurable using a variable.\n\n-
          The role uses new per-cluster Elasticsearch passwords by default. This is\n
          \ done using a separate :envvar:`kibana__elasticsearch_cluster_name` variable,\n
          \ which needs to be synchronized with the Elasticsearch configuration via\n
          \ Ansible inventory (Kibana can be installed separately from Elasticsearch).\n\n:ref:`debops.lxc`
          role\n''''''''''''''''''''''\n\n- The role supports integration with the
          :command:`systemd-resolved` DNS\n  resolver. This permits use of the :command:`systemd-networkd`
          service to\n  manage networking on the LXC host.\n\n- LXC containers will
          be configured with AppArmor \"unconfined\" profile by\n  default. This change
          allows startup of various services inside of the\n  container without errors
          on Debian Bookwrom hosts.\n\n:ref:`debops.lxd` role\n''''''''''''''''''''''\n\n-
          The role supports integration with the :command:`systemd-resolved` DNS\n
          \ resolver. This permits use of the :command:`systemd-networkd` service
          to\n  manage networking on the LXD host.\n\n:ref:`debops.nginx` role\n''''''''''''''''''''''''\n\n-
          The ``/index.html`` and ``/index.htm`` entries in the default ``try_files``\n
          \ configuration option have been replaced with the ``$uri/index.html`` entry.\n
          \ This change should ensure that any location not present on the server
          will\n  return error 404 correctly, instead of falling back to the ``/index.html``\n
          \ file if it's present in the root of the website.\n\n:ref:`debops.postgresql_server`
          role\n''''''''''''''''''''''''''''''''''''\n\n- The :command:`autopostgresqlbackup`
          script was modified to have separate set\n  of options for the :command:`psql`
          command and the :command:`pg_dump`\n  command. This permits the use of the
          ``--format=custom`` option in\n  :command:`pg_dump` command, enabling more
          efficient database dumps.\n\n- The extension of the backup files created
          by the\n  :command:`autopostgresqlbackup` script can be configured via a
          default\n  variable. This change might cause existing installations to change
          the file\n  extension used during backups.\n\n:ref:`debops.proc_hidepid`
          role\n'''''''''''''''''''''''''''''''\n\n- The role will check if the host
          is in the ``debops_service_libvirtd`` Ansible\n  inventory group, or if
          the :ref:`debops.libvirtd` role was applied on the\n  host and will change
          the ``hidepid=`` value to ``0`` to avoid issues with\n  Polkit subsystem.\n\n:ref:`debops.rsyslog`
          role\n''''''''''''''''''''''''''\n\n- The log rotation configuration for
          logs managed by :command:`rsyslog` now has\n  an upper size limit of 1 GB
          to trigger the rotation. This should help in\n  cases when these logs are
          growing rapidly, but the rotation period is too\n  large to avoid filling
          up disk space.\n\n:ref:`debops.zabbix_agent` role\n'''''''''''''''''''''''''''''''\n\n-
          The fact script now supports both the old Zabbix Agent, and the new Zabbix\n
          \ Agent 2 configuration files.\n\nFixed\n~~~~~\n\n:ref:`debops.dpkg_cleanup`
          role\n'''''''''''''''''''''''''''''''\n\n- Various YAML lists used in the
          package removal script will be sorted at Jinja\n  level to avoid constant
          reordering of list elements during Ansible execution\n  which makes the
          role not idempotent.\n\n:ref:`debops.gitlab` role\n'''''''''''''''''''''''''\n\n-
          Fixed an issue with the :file:`/etc/gitlab/ssl/` directory changing its
          mode\n  from 0775 set by the role to 0755 set by the :command:`gitlab-ctl\n
          \ reconfigure` command, making the role not idempotent.\n\n:ref:`debops.grub`
          role\n'''''''''''''''''''''''\n\n- Fixed an issue with the :file:`01_users`
          configuration file generating errors\n  and resulting in an empty user section
          in the configuration generated by the\n  :command:`update-grub` command.\n\n:ref:`debops.ifupdown`
          role\n'''''''''''''''''''''''''''\n\n- Fixed an issue with the :file:`ifup-allow-boot.service`
          :command:`systemd`\n  unit not starting correctly on boot due to issues
          with the ``$`` character\n  escaping.\n\n:ref:`debops.lxc` role\n''''''''''''''''''''''\n\n-
          The role will by default disable NFtables integration within the\n  :command:`lxc-net`
          script, configurable via a default variable. This fixes\n  usage of LXC
          containers on Debian Bookworm with the :command:`ferm` service\n  used by
          DebOps.\n\n:ref:`debops.lxd` role\n''''''''''''''''''''''\n\n- Fixed an
          issue with the default LXD daemon preseed configuration by removing\n  the
          unsupported ``managed`` parameter. This should allow the LXD daemon to be\n
          \ initialized correctly.\n\n- Fixed an issue with the role trying to copy
          the source-built libraries when\n  an APT-based installation is used. The
          role will check if the libraries exist\n  before trying to copy them.\n\n-
          Fixed an issue on Debian Bookworm where the :command:`lxd-apparmor-load`\n
          \ binary is not present where the APT-based LXD daemon expects it. The role\n
          \ will create a symlink for this binary when needed.\n\n:ref:`debops.networkd`
          role\n'''''''''''''''''''''''''''\n\n- Do not restart the :command:`systemd-networkd`
          service if the role detects\n  that the network stack is not managed by
          it. This should avoid the issue\n  where the role playbook hanged on first
          run of the role on a host not managed\n  by :command:`systemd-networkd`
          service.\n\n:ref:`debops.ntp` role\n''''''''''''''''''''''\n\n- Fixed an
          issue with conditional check for Linux capabilities not being\n  checked
          reliably to decide if NTP support should be enabled. The role should\n  now
          correctly detect when Linux capabilities are enforced.\n\n:ref:`debops.rsyslog`
          role\n''''''''''''''''''''''''''\n\n- List of log files which should be
          managed by the :command:`logrotate` service\n  will be sorted to avoid constant
          reordering during role execution, which\n  fixes role idempotency.\n\n:ref:`debops.swapfile`
          role\n'''''''''''''''''''''''''''\n\n- Fixed an issue in the :command:`swapon`
          task conditional logic where the task\n  could not be executed correctly
          when the swap file was missing.\n\n- Ensure that the swap file is correctly
          disabled by the :command:`swapoff`\n  command before being removed with
          the ``absent`` state.\n\nRemoved\n~~~~~~~\n\n:ref:`debops.ipxe` role\n'''''''''''''''''''''''\n\n-
          Debian 9 (Stretch) has been removed from Debian mirrors, therefore the role\n
          \ will no longer offer support for installing Debian Stretch via PXE boot.\n\n`debops
          v3.1.0`_ - 2023-11-29\n-----------------------------\n\n.. _debops v3.1.0:
          https://github.com/debops/debops/compare/v3.0.0...v3.1.0\n\nAdded\n~~~~~\n\nNew
          DebOps roles\n''''''''''''''''\n\n- The :ref:`debops.metricbeat` role, part
          of the Elastic stack, can be used to\n  install `Metricbeat`__, a service
          that can gather metrics and other non-log\n  data from other services and
          send them to Elasticsearch for processing.\n\n  .. __: https://www.elastic.co/beats/metricbeat\n\n-
          The :ref:`debops.opensearch` role can be used to set up an unsecured,\n
          \ local-only installation of `OpenSearch`__. OpenSearch is a fork of\n  Elasticsearch
          that continues to be released under a free software license.\n\n  .. __:
          https://opensearch.org/\n\n- The :ref:`debops.reboot` role can be used to
          reboot, forcefully or only if\n  required, any DebOps host.\n\n- The :ref:`debops.miniflux`
          role can install and manage Miniflux, a web-based,\n  minimalistic feed
          reader written in Go.\n\n- The :ref:`debops.systemd` role is included in
          the common playbook by default.\n  It configures the :command:`systemd`
          system and service manager. Both\n  system-wide, as well as user services
          configured globally can be managed with\n  this role.\n\n- The :ref:`debops.networkd`
          role can be used to configure the\n  :command:`systemd-networkd` service,
          part of the :command:`systemd` project\n  responsible for network interface
          configuration.\n\n- The :ref:`debops.timesyncd` role is used to configure
          the\n  :command:`systemd-timesyncd` service, a minimal SNTP/NTP client.
          The role is\n  included in the :file:`layer/common.yml` playbook instead
          of the\n  :ref:`debops.ntp` role to provide NTP support by default.\n\n-
          The :ref:`debops.resolved` role is included in the :file:`layer/common.yml`\n
          \ playbook by default, replacing the :ref:`debops.resolvconf` role. It manages\n
          \ the :command:`systemd-resolved` service, a local DNS resolver.\n\n- The
          :ref:`debops.bind` role is responsible for installing and managing the\n
          \ ISC BIND nameserver. It supports DNSSEC, key rollovers, multiple DNS zones,\n
          \ views and many more features.\n\n- The :ref:`debops.apparmor` role can
          be used to manage AppArmor configuration\n  and profiles. It will be included
          in the :file:`layer/common.yml` playbook in\n  the future.\n\n- The :ref:`debops.apt_mirror`
          role can be used to create a mirror of one or\n  multiple APT repositories
          and publish them for other hosts to use as package\n  source.\n\nGeneral\n'''''''\n\n-
          DebOps now includes a custom version of the\n  ``community.general.apache2_module``
          Ansible module, available as\n  ``debops.debops.apache2_module``. The custom
          module includes a fixed\n  idempotency check for enabled Apache 2 modules
          that works on Debian or Ubuntu\n  hosts. The :ref:`debops.apache` Ansible
          role will use this module instead of\n  the original one.\n\n- The :command:`debops
          exec` command can be used to execute Ansible modules\n  against hosts in
          the project directory; this is a wrapper for the\n  :command:`ansible` command.\n\n-
          The :command:`debops run`, :command:`debops check` and :command:`debops
          exec`\n  commands can emit ASCII \"bell\" at the end of Ansible execution
          to notify user\n  after long runs. Use the ``-E`` or ``--bell`` option to
          enable this.\n\n- The :command:`debops env` command can be used to inspect
          the runtime\n  environment variables present when other DebOps commands
          are used, as well as\n  execute external commands inside of that runtime
          environment. This is handy\n  for using various :command:`ansible-*` commands
          within DebOps project\n  directories.\n\n- DebOps monorepo now includes
          configuration for the `pre-commit`__ hook to\n  verify changes before they
          are committed to the repository. Multiple checks\n  are performed, notably
          `codespell`__ is used to find spelling mistakes. More\n  checks will be
          enabled in the future.\n\n  .. __: https://pre-commit.com/\n  .. __: https://github.com/codespell-project/codespell\n\n-
          New project directory layout called \"modern\" has been implemented in DebOps\n
          \ scripts. It can be created using the command:\n\n  .. code-block:: console\n\n
          \    debops project init -t modern <project>\n\n  The modern project layout
          supports multiple Ansible inventories encapsulated\n  into :ref:`infrastructure
          views <project_infrastructure_views>`.\n\n- DebOps scripts now support management
          of the project directories using\n  :command:`git` as VCS repositories.
          New project directories will use\n  :command:`git` by default. This also
          enables support for secrets encrypted\n  using :command:`git-crypt`.\n\n:ref:`debops.apt`
          role\n''''''''''''''''''''''\n\n- The role now supports management of the
          \"Deb822\" format of the APT repository\n  sources.\n\n:ref:`debops.avahi`
          role\n''''''''''''''''''''''''\n\n- The role will ensure that the :command:`systemd-resolved`
          service Multicast\n  DNS support is disabled to avoid conflict with the
          :command:`avahi-daemon`\n  service.\n\n:ref:`debops.ferm` role\n'''''''''''''''''''''''\n\n-
          Multicast DNS traffic is accepted by default in the firewall to allow for
          the\n  ``.local`` mDNS domain resolution by the :command:`systemd-resolved`
          service.\n  The role provides a set of variables to limit the traffic by
          subnet, or\n  disable it completely.\n\n:ref:`debops.icinga_web` role\n'''''''''''''''''''''''''''''\n\n-
          The role can now create host and service templates using Icinga Director
          API.\n  This should improve the initial deployment experience, since users
          don't need\n  to create basic host templates by hand before registering
          hosts in Icinga.\n\n:ref:`debops.ipxe` role\n'''''''''''''''''''''''\n\n-
          The Debian Installer Menu can now install Debian GNU/Linux 12 (Bookworm).\n\n:ref:`debops.java`
          role\n'''''''''''''''''''''''\n\n- The role will now configure the default
          security policy for Java\n  applications. The additions will permit Java
          applications to access the\n  system-wide CA certificate store in :file:`/etc/ssl/certs/`
          directory as well\n  as the PKI infrastructure managed by the :ref:`debops.pki`
          role, so that Java\n  applications can use the existing X.509 certificates
          and private keys for TLS\n  encryption support.\n\n:ref:`debops.keyring`
          role\n''''''''''''''''''''''''''\n\n- The role can now download APT repository
          GPG keys to separate keyring files,\n  which can be used to scope a given
          GPG key to specific APT repositories.\n\n:ref:`debops.kibana` role\n'''''''''''''''''''''''''\n\n-
          The role can now manage passwords and other confidential data stored in
          the\n  Kibana keystore.\n\n:ref:`debops.mount` role\n''''''''''''''''''''''''\n\n-
          The role can now create custom files which can be used to store credentials\n
          \ required to mount remote devices.\n\n:ref:`debops.netbox` role\n'''''''''''''''''''''''''\n\n-
          The role will enable LDAP support in NetBox if LDAP environment managed
          by\n  the :ref:`debops.ldap` role is detected on the host. Currently only
          user\n  authentication and Django ACL system is supported via LDAP groups.\n\n:ref:`debops.nginx`
          role\n''''''''''''''''''''''''\n\n- The server configuration files can now
          contain :command:`nginx` configuration\n  outside of the ``server`` and
          ``upstream`` blocks using the new\n  ``item.toplevel_options`` parameter.\n\n:ref:`debops.owncloud`
          role\n'''''''''''''''''''''''''''\n\n- Support to host the application on
          a subpath for security reasons.\n\n:ref:`debops.python` role\n'''''''''''''''''''''''''\n\n-
          The :file:`service/python_raw` playbook used during early bootstrap process\n
          \ can now inject host entries into the :file:`/etc/hosts` configuration
          file to\n  permit DNS name resolution early during bootstrapping.\n\n:ref:`debops.resources`
          role\n''''''''''''''''''''''''''''\n\n- The :ref:`debops.resources` role
          can now be used to install pip library\n  dependencies or virtual environments
          via the ``ansible.builtin.pip``\n  module.\n\n- The :ref:`debops.resources`
          role can now be used to replace a line via the\n  ``ansible.builtin.replace``
          module.\n\n:ref:`debops.slapd` role\n''''''''''''''''''''''''\n\n- The playbook
          can now be configured to skip the saslauthd role execution.\n\n:ref:`debops.zabbix_agent`
          role\n'''''''''''''''''''''''''''''''\n\n- The role now supports management
          of Zabbix Agent (written in C) as well as\n  Zabbix Agent 2 (written in
          Go), available in Debian repositories. Only one\n  flavor can be managed
          at a time, but role provides an easy way to switch\n  between the two flavors.\n\nChanged\n~~~~~~~\n\nUpdates
          of upstream application versions\n''''''''''''''''''''''''''''''''''''''''\n\n-
          In the :ref:`debops.roundcube` role, the Roundcube version installed by\n
          \ default has been updated to ``1.6.0``.\n\n- In the :ref:`debops.ipxe`
          role, the Debian Buster netboot installer version\n  has been updated to
          the next point release, 10.13. Debian Bullseye has been\n  updated to the
          next point release as well, 11.8. The Debian Bookworm release\n  has been
          updated to 12.2.\n\n- In the :ref:`debops.netbox` role, the NetBox version
          has been updated to\n  ``v3.4.2``.\n\n- In the :ref:`debops.owncloud` role,
          the ownCloud support has been updated to\n  ``v10.10``.\n\n- In the :ref:`debops.owncloud`
          role, the Nextcloud support has been updated to\n  ``v24.0`` and ``v25.0``.\n\nGeneral\n~~~~~~~\n\n-
          Tasks which use modules and plugins from the ``ansible.builtin`` Ansible\n
          \ Collection have been updated to refer to them via their Fully Qualified\n
          \ Collection Names (for example ``ansible.builtin.file`` instead of ``file``).\n
          \ This is due to changing requirements of the :command:`ansible-lint` tool.\n\n
          \ New submissions to the DebOps project will be required to use the FQCNs
          as\n  well.\n\n- Various roles that lookup SSH public keys on the Ansible
          Controller\n  (:ref:`debops.preseed`, :ref:`debops.reprepro`, :ref:`debops.system_users`)\n
          \ will try to use the :file:`~/.ssh/authorized_keys` file to find the keys
          if\n  all other methods fail.\n\n- In the :file:`site.yml` playbook, the
          :file:`sys.yml` and :file:`net.yml`\n  playbooks will be executed before
          the :file:`common.yml` playbook. This\n  should ensure that configuration
          of certain resources like mount points or\n  LVM pools is present before
          the system is prepared for general operation.\n\n- The :file:`ansible/playbooks/tools/reboot.yml`
          Ansible playbook has been\n  moved to :file:`ansible/playbooks/reboot.yml`
          file and uses the new\n  :ref:`debops.reboot` Ansible role to perform operations.
          To use it, you can\n  run the ``reboot`` playbook instead of ``tools/reboot``.\n\n-
          The :file:`ansible/playbooks/tools/upgrade-reboot.yml` Ansible playbook
          has\n  been moved to :file:`ansible/playbooks/upgrade.yml` file and will
          no longer\n  reboot the host automatically. Users can chain the ``upgrade``
          and ``reboot``\n  playbooks to achieve the previous behaviour, for example:\n\n
          \ .. code-block:: console\n\n     debops run upgrade reboot -l <host>\n\n-
          The debops-contrib :file:`dropbear_initramfs` playbook has been moved to\n
          \ the :ref:`debops.dropbear_initramfs` playbook. The role variable\n  ``dropbear_initramfs__host_authorized_keys``
          now uses the same keys as\n  the ``ansible.posix.authorized_key`` module.\n\n-
          Various tasks that interact with the MariaDB/MySQL databases will now use
          the\n  :file:`/run/mysqld/mysqld.sock` UNIX socket to do so, due to changes
          in\n  MariaDB restricting local connections for the ``root`` UNIX account.\n\n-
          The HTML documentation build process has been improved. The\n  :command:`yaml2rst`
          script will be invoked only when a defaults file is\n  modified, significantly
          speeding up documentation rebuilds. Users can also\n  modify the :command:`sphinx`
          options specified in the Makefile via an\n  environment variable if they
          wish.\n\n- The :file:`ansible/playbooks/tools/dist-upgrade.yml` Ansible
          playbook now has\n  MTA configuration exposed via variables in case the
          mail should be sent via\n  a remote server instead of a local one.\n\n-
          DebOps playbooks have been reorganized to not use a large set of symlinks\n
          \ inside of the repository. Instead different sections of the :file:`site.yml`\n
          \ playbook have been organized into \"layers\", new playbooks are located
          under\n  the :file:`ansible/playbooks/layers/` subdirectory. See the new\n
          \ :ref:`playbooks` documentation for more details.\n\n- The new :ref:`debops.timesyncd`
          role has replaced the :ref:`debops.ntp` role\n  as the default NTP service
          provider in the :file:`layer/common.yml` playbook.\n  Existing hosts shouldn't
          be affected - the new role can automatically\n  recognize that a different
          time daemon package is installed on the host and\n  will not try to configure
          :command:`systemd-timesyncd` service in such case.\n  You might need to
          add your hosts to the ``[debops_service_ntp]`` Ansible\n  inventory group
          to keep using the old role.\n\n- The new :ref:`debops.resolved` role has
          replaced the :ref:`debops.resolvconf`\n  role as the default DNS resolver
          in the :file:`layer/common.yml` and the\n  bootstrap playbooks. Existing
          hosts shouldn't be affected, the role detects\n  presence of the ``resolvconf``
          APT package and does not modify the host\n  configuration in such case.\n\n-
          Multiple DebOps Collections on Ansible Galaxy have been merged into a single\n
          \ ``debops.debops`` Collection to prepare the project to switch role references\n
          \ to FQCNs. This is also a test to see if Ansible Galaxy allows >2 MB\n
          \ collection tarballs.\n\n- The :command:`debops config` command has been
          refactored and split into\n  multiple subcommands to allow easier configuration
          introspection. See\n  :ref:`it's documentation page <cmd_debops-config>`
          for more details.\n\n- The Debian 12 (Bookworm) has been released! Multiple
          DebOps roles have been\n  updated and switched the \"stable\" release to
          Bookworm, with Bullseye becoming\n  the \"oldstable\" release. The new Debian
          Testing release, \"Trixie\" has also\n  been added in relevant places.\n\n-
          DebOps now supports using :command:`git` in project directories - new\n
          \ projects will be initialized as :command:`git` repositories by default.
          The\n  :command:`git-crypt` command is also supported, and can encrypt project\n
          \ secrets.\n\n:ref:`debops.apt` role\n''''''''''''''''''''''\n\n- The role
          will configure APT to use Debian Security repositories via the\n  http://deb.debian.org/debian-security/
          CDN.\n\n- The role has been refreshed and management of the\n  :file:`/etc/apt/sources.list`
          file was redesigned to allow for better\n  flexibility in configuration.
          See role documentation for more details.\n\n:ref:`debops.apt_preferences`
          role\n''''''''''''''''''''''''''''''''''\n\n- The pin priorities for the
          Debian ``-updates`` and ``-security`` APT\n  repositories have been raised
          to 550 to match the raised priority of the\n  primary repository. This should
          ensure that when the custom pin priorities\n  are active, updates to Debian
          packages are correctly installed as well. See\n  :envvar:`apt_preferences__debian_stable_default_preset_list`
          variable for\n  details.\n\n:ref:`debops.docker_server` role\n''''''''''''''''''''''''''''''''\n\n-
          The role can now directly handle the daemon ``log-driver`` parameter.\n\n-
          The role has been redesigned from scratch; Python :command:`virtualenv`\n
          \ support has been removed since the :command:`docker-compose` is included
          in\n  Debian repositories directly, or is implemented as a Go plugin in
          upstream\n  repositories. The Docker configuration is now implemented via
          the\n  :ref:`universal_configuration` system, users will have to modify
          their\n  Ansible inventories. See the role documentation for details.\n\n:ref:`debops.elasticsearch`
          role\n''''''''''''''''''''''''''''''''\n\n- The role will check the status
          of the built-in user accounts via the HTTP API\n  instead of relying on
          the Ansible local facts and create them if they don't\n  exist. This should
          help with an upgrade of existing Elasticsearch clusters\n  without TLS encrypted
          traffic and authentication.\n\n:ref:`debops.gitlab` role\n'''''''''''''''''''''''''\n\n-
          The role has been rewritten from scratch and now can be used to deploy and\n
          \ manage a `GitLab Omnibus`__ instance (managed internally by Chef) on Debian\n
          \ or Ubuntu hosts. The role integrates with various DebOps services (firewall,\n
          \ PKI infrastructure, LDAP environment) with GitLab Omnibus. Both Community\n
          \ Edition (default) and Enterprise Edition are supported.\n\n  .. __: https://docs.gitlab.com/omnibus/\n\n:ref:`debops.global_handlers`
          role\n''''''''''''''''''''''''''''''''''\n\n- The :command:`systemd` handlers
          have been moved to a separate\n  :file:`handlers/systemd.yml` configuration
          file.\n\n:ref:`debops.icinga` role\n'''''''''''''''''''''''''\n\n- New hosts
          will be added to Icinga Director using the ``icinga-agent-host``\n  template,
          created by default by the :ref:`debops.icinga_web` role. On\n  existing
          installations, you should either create this template by hand, or\n  run
          the :ref:`debops.icinga_web` role so that it gets added automatically.\n\n:ref:`debops.icinga_db`
          role\n''''''''''''''''''''''''''''\n\n- The role will manage Icinga databases
          directly instead of relying on\n  :command:`dbconfig` Debian subsystem.
          This improves support for remote Icinga\n  database deployments accessible
          over TLS.\n\n:ref:`debops.icinga_web` role\n'''''''''''''''''''''''''''''\n\n-
          The LDAP configuration used by the role to configure LDAP access will be\n
          \ based on the :ref:`debops.ldap` Ansible local facts instead of static
          values,\n  to better support modified environments.\n\n:ref:`debops.influxdata`
          role\n'''''''''''''''''''''''''''''\n\n- InfluxData has published a new
          APT repository GPG key, the role should\n  refresh it automatically.\n\n:ref:`debops.minio`
          role\n''''''''''''''''''''''''\n\n- The role has been updated to support
          newer MinIO features, like the embedded\n  MinIO Console. Some of the instance
          parameters have been changed, for example\n  access key and secret key have
          been replaced with root account and password.\n  Check the role documentation
          for more details.\n\n:ref:`debops.nginx` role\n''''''''''''''''''''''''\n\n-
          Configure the :file:`nginx.service` systemd unit to start the\n  :command:`nginx`
          service after the network is configured. This way\n  :command:`nginx` should
          be able to resolve upstream services specified via\n  DNS names at startup.\n\n:ref:`debops.ntp`
          role\n''''''''''''''''''''''\n\n- The default NTP daemon used on hosts with
          the :command:`systemd` service\n  manager will be :command:`systemd-timesyncd`.
          Existing systems with\n  a different NTP server should not be affected by
          this change.\n\n- The role should better detect Linux Container environment
          and not try to\n  install an NTP daemon inside of a container.\n\n:ref:`debops.pki`
          role\n''''''''''''''''''''''\n\n- The :command:`pki-realm` script will call
          the :command:`certbot` command with\n  the :command:`certbot --authenticator
          <plugin>` option explicitly to allow\n  use with third-party authenticator
          plugins that might not support the\n  :command:`certbot --<plugin>` syntax.\n\n:ref:`debops.preseed`
          role\n''''''''''''''''''''''''''\n\n- The default guided partition recipe
          used by the Debian Installer is changed\n  from ``atomic`` to ``multi``.
          This should allow for easier changes in the\n  partition layout via LVM
          due to separate partitions for :file:`/home` and\n  :file:`/var` mount points.\n\n:ref:`debops.proc_hidepid`
          role\n'''''''''''''''''''''''''''''''\n\n- The role will check if PolicyKit
          is installed on the host, in which case the\n  default security level for
          access to the :file:`/proc` filesystem will be\n  more permissive.\n\n:ref:`debops.python`
          role\n'''''''''''''''''''''''''\n\n- The role will enable Python 2.7 support
          via the fact script only when an\n  existing Python 2.7 installation is
          detected. This change should help avoid\n  installing Python 2.7 packages
          on newer OS releases when they might be\n  unavailable.\n\n- The :file:`/etc/pip.conf`
          configuration file template can be overridden via\n  the DebOps template
          override mechanism.\n\n:ref:`debops.resolvconf` role\n'''''''''''''''''''''''''''''\n\n-
          In the :ref:`debops.resolvconf` role, you can now write a fully static\n
          \ :file:`/etc/resolv.conf` file without the ``resolvconf`` package.\n\n:ref:`debops.slapd`
          role\n''''''''''''''''''''''''\n\n- The default log level used by OpenLDAP
          has been changed from ``stats`` to\n  ``none`` to minimize log output in
          large environments. This can be modified\n  using Ansible inventory in case
          that the authentication, accounting or search\n  metrics are needed.\n\n:ref:`debops.sshd`
          role\n'''''''''''''''''''''''\n\n- The management of the :file:`/etc/ssh/sshd_config`
          configuration file has\n  been redesigned and now uses :ref:`universal_configuration`.
          Multiple default\n  variables have been removed as a result. Any changes
          in configuration applied\n  through Ansible inventory might need to be converted
          to the new format. Check\n  the changes on existing hosts before applying
          new configuration.\n\n:ref:`debops.system_users` role\n'''''''''''''''''''''''''''''''\n\n-
          The role will check remote user databases for local admin information using\n
          \ the :command:`getent passwd` command if the user has not been found in
          the\n  :file:`/etc/passwd` local database.\n\nFixed\n~~~~~\n\nGeneral\n'''''''\n\n-
          Extrepo facts file did not detect a disabled repository as being disabled\n
          \ due to a change in the extrepo file format.\n\n- Ensure that the custom
          Ansible plugins included in DebOps are present in the\n  Ansible Collection
          build from the DebOps repository.\n\n- Provide a help message in case the
          :file:`ansible.cfg` configuration file in\n  the DebOps project directory
          does not include the ``inventory`` option.\n\n- Fixed an issue with custom
          Ansible plugins not working in \"standalone\" mode\n  without the DebOps
          scripts installed on Ansible Controller.\n\n- The ``warn`` parameter in
          the ``shell`` and ``command`` Ansible modules has\n  been removed in Ansible
          2.14. It has been removed in various DebOps roles to\n  allow playbook execution
          to work correctly.\n\n- Fixed all password lookups which used ``chars=ascii``
          instead of\n  ``chars=ascii_letters``. This resulted in passwords which
          only contained the\n  letters a,c,i,s instead of all lowercase and uppercase
          ASCII letters. Because\n  all occurrences of this bug at least also included
          all digits in the character\n  set and the password length was at least
          20 characters, this did not result\n  in weak passwords.\n\n- The ``ipaddr``
          Ansible filter and its aliases used in various roles were\n  renamed to
          ``ansible.utils.ipaddr`` and its corresponding alias names because\n  Ansible
          requires use of FQCNs in filters. The ``ansible.utils`` Ansible\n  Collection
          is now a dependency of the DebOps Collection.\n\n- The :command:`debops
          run` and :command:`debops check` commands should now\n  correctly recognize
          options of the :command:`ansible-playbook` command which\n  don't expect
          arguments and expand playbook names specified after them.\n\n:ref:`debops.apt`
          role\n''''''''''''''''''''''\n\n- In the fact script, parse the ``deb-src``
          configuration entries before\n  ``deb`` entries to ensure that there are
          no duplicates.\n\n- The role no longer defaults to the ``ansible_local.core.distribution``
          and\n  ``ansible_local.core.distribution_release`` local facts for determining
          the\n  Linux distribution and the distribution release, respectively. These
          facts\n  were set later in the common playbook, meaning that the role would
          restore\n  the previous distribution release in ``/etc/apt/sources.list``
          after a\n  distribution upgrade.\n\ndebops.boxbackup role\n'''''''''''''''''''''\n\n-
          The role is not included in the DebOps Collection on Ansible Galaxy,\n  therefore
          its playbook is no longer included in the main :file:`site.yml`\n  playbook.
          This fixes an issue with Ansible stopping the site playbook\n  execution
          when it cannot find the ``boxbackup`` role in the Collection.\n\n:ref:`debops.core`
          role\n'''''''''''''''''''''''\n\n- Ensure that the ``ansible_controllers``
          fact can be reset using the\n  :envvar:`core__remove_facts` variable to
          avoid infinitely growing list of\n  Ansible Controllers.\n\n:ref:`debops.cron`
          role\n'''''''''''''''''''''''\n\n- Fixed the order of job parameters applied
          by the role - now parameters from\n  a specific job will override parameters
          specified for all jobs in a given\n  configuration entry.\n\n:ref:`debops.dnsmasq`
          role\n''''''''''''''''''''''''''\n\n- Fixed service configuration mistake
          when DHCPv6 mode is set to an empty\n  string. The configuration template
          should take this into account and add\n  a correct separator (or omit it)
          in the generated configuration file.\n\n:ref:`debops.dovecot` role\n''''''''''''''''''''''''''\n\n-
          The role's PKI hook script still referenced an old configuration file that\n
          \ was no longer being managed by :ref:`debops.dovecot` since the role redesign,\n
          \ resulting in the hook script failing to reload dovecot after a certificate
          or\n  DH param change.\n\n:ref:`debops.elasticsearch` role\n''''''''''''''''''''''''''''''''\n\n-
          The internal Java security policy used by Elasticsearch will be configured\n
          \ only on Elasticsearch v7.x+ versions. Before them, Elasticsearch used
          the\n  global Java security policy.\n\n:ref:`debops.environment` role\n''''''''''''''''''''''''''''''\n\n-
          Fixed issues with preserving environment variables across multiple role\n
          \ executions.\n\n:ref:`debops.etc_aliases` role\n''''''''''''''''''''''''''''''\n\n-
          Don't save dependent recipients on Ansible Controller if they are not\n
          \ defined. This should avoid creating unnecessary files in AWX job containers.\n\n:ref:`debops.ferm`
          role\n'''''''''''''''''''''''\n\n- Don't include additional '{' or '}' characters
          in certain rules when the\n  ``domain_args`` parameter is specified.\n\n-
          Fixed an issue in the rule template that caused a templating type error
          where\n  Jinja expected a string but found an int value instead.\n\n:ref:`debops.gitlab_runner`
          role\n''''''''''''''''''''''''''''''''\n\n- Fixed an error that could occur
          in the \"Patch 'vagrant-libvirt' source code\"\n  task on systems other
          than Debian 9 or 10. The patch is not required since\n  the ``vagrant-libvirt``
          v0.1.0 package.\n\n:ref:`debops.grub` role\n'''''''''''''''''''''''\n\n-
          The :command:`grub` user passwords will be passed for encryption using\n
          \ a temporary file stored in the :file:`secret/` directory on the Ansible\n
          \ Controller instead of directly on the command line, to avoid leaks through\n
          \ the process list.\n\n:ref:`debops.ifupdown` role\n'''''''''''''''''''''''''''\n\n-
          The interface names used in scripts will be escaped using the\n  :command:`systemd-escape`
          tool. This should fix problems with control over\n  network interfaces which
          contain the hyphen character(s).\n\n:ref:`debops.kibana` role\n'''''''''''''''''''''''''\n\n-
          The role will use the correct path of the Kibana keystore depending on the\n
          \ installed version (versions <7.0.0 keep the keystore in the\n  :file:`/var/lib/kibana/`
          directory; newer versions use the\n  :file:`/etc/kibana/` directory).\n\n-
          The role will use different user account depending on Kibana version (either\n
          \ ``kibana``, or ``kibana_system`` used in newer installations of\n  Elasticsearch).
          Depending on your installed version, you should check the\n  :envvar:`kibana__elasticsearch_username`
          to verify that the correct account\n  is used for access to Elasticsearch.\n\n-
          The role will include the ``server.publicBaseUrl`` parameter depending on\n
          \ Kibana version, to avoid failures on older Kibana installations.\n\n:ref:`debops.ldap`
          role\n'''''''''''''''''''''''\n\n- Fixed an issue with the role passing
          IP and MAC addresses to the LDAP\n  directory as a nested YAML list which
          resulted in a wrong attribute values.\n\n- Fixed an issue with role parsing
          the already parsed Ansible facts to extract\n  IP/CIDR information which
          resulted in wrong output in certain cases. The role\n  will now implicitly
          trust the Ansible facts to be correct when adding IP and\n  prefix details
          to the LDAP database.\n\n:ref:`debops.libvirtd` role\n'''''''''''''''''''''''''''\n\n-
          Fixed ``qemu-kvm`` package installation logic; the KVM packages should now
          be\n  handled correctly on Debian Bullseye and newer releases.\n\n:ref:`debops.logrotate`
          role\n''''''''''''''''''''''''''''\n\n- Fixed formatting in the :file:`/etc/logrotate.conf`
          configuration file to\n  avoid adding :command:`vim` fold markers from the
          DebOps role defaults.\n\n:ref:`debops.lxc` role\n''''''''''''''''''''''\n\n-
          Fixed name of the ``vfs_root`` parameter in the call to the\n  ``community.general.lxc_container``
          Ansible module, which was renamed to\n  ``zfs_root``.\n\n:ref:`debops.netbase`
          role\n''''''''''''''''''''''''''\n\n- In the fact script, don't use ``in``
          for matching IP addresses and DNS names\n  where substring matching is undesirable.\n\n:ref:`debops.netbox`
          role\n'''''''''''''''''''''''''\n\n- Using boolean variables in :envvar:`netbox__config_plugins_config`
          for\n  example resulted in an error because the role used the ``to_nice_json``\n
          \ Jinja2 filter internally to render Python configuration.\n  This is fixed
          for all uses of ``to_nice_json``\n\n:ref:`debops.ntp` role\n''''''''''''''''''''''\n\n-
          Fix an issue where the role tried to manage the :command:`systemd-timesyncd`\n
          \ service without it actually being present on the host. This should now
          be\n  avoided by carefully checking the service status.\n\n- The role will
          not try to purge installed NTP daemon packages when it is\n  disabled through
          Ansible inventory.\n\n:ref:`debops.owncloud` role\n'''''''''''''''''''''''''''\n\n-
          Access to static assets was not logged regardless of the\n  ``owncloud__nginx_access_log_assets``
          setting.\n\n- Access to the ``/remote`` URI path was not configured in Nginx
          as proposed in\n  the upstream Nginx example in the Nextcloud docs.\n\n:ref:`debops.pdns`
          role\n'''''''''''''''''''''''\n\n- On pdns installations with version >=
          4.5.0 (e.g. on Bookworm systems), the\n  role would cause a syntax error
          on the local-address configuration option.\n\n:ref:`debops.pki` role\n''''''''''''''''''''''\n\n-
          After the :command:`certbot` script performs a certificate renewal operation,\n
          \ a deploy hook will update the PEM chains in a given PKI realm\n  :file:`private/`
          directory to include the new private key created by the\n  :command:`certbot`
          script.\n\n- Fixed an issue where when a PKI realm was initialized for ACME/Let's
          Encrypt\n  support, second level domains were not included in the generated
          X.509\n  certificate request.\n\n- Use :command:`openssl x509 -inform PEM`
          command to explicitly check for\n  a PEM-formatted X.509 certificate file
          because the old :command:`openssl x509\n  -in` option was changed to work
          with both DER and PEM files. This should fix\n  an issue with Let's Encrypt
          certificate chains containing a DER-formatted\n  certificate inside of them.\n\n
          \ Users will need to remove existing PKI realms which use ACME/Let's Encrypt
          CA\n  for the :command:`pki-realm` script to rebuild the certificate chain\n
          \ correctly. After that re-run the :ref:`debops.pki` role on the host to\n
          \ re-create che realms.\n\n:ref:`debops.postconf` role\n'''''''''''''''''''''''''''\n\n-
          The EHLO IP address check was removed. This check would reject a message
          if\n  the EHLO hostname of the connecting mailserver resolved to a non-publicly\n
          \ routable IP address. However, rejecting messages for this reason is\n
          \ prohibited by :rfc:`5321` section 4.1.4, and sometimes caused deliverability\n
          \ issues for Office 365 users.\n\n:ref:`debops.preseed` role\n''''''''''''''''''''''''''\n\n-
          Fixed an issue with the ``d-i`` keyboard preseed that resulted in the\n
          \ ``keyboard-configuration`` APT package not being installed and configured\n
          \ correctly. The default keymap is changed to ``us`` and the option is no\n
          \ longer based on the system language which might be incorrect in this case.\n\n:ref:`debops.proc_hidepid`
          role\n'''''''''''''''''''''''''''''''\n\n- The fact script has been optimized
          \n\n</details>\n\n---\n\n### Configuration\n\n\U0001F4C5 **Schedule**: Branch
          creation - At any time (no schedule defined), Automerge - At any time (no
          schedule defined).\n\n\U0001F6A6 **Automerge**: Disabled by config. Please
          merge this manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever
          PR becomes conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515
          **Ignore**: Close this PR and you won't be reminded about this update again.\n\n---\n\n
          - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
          box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
          View the [repository job log](https://developer.mend.io/github/osism/release).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My42Ni40IiwidXBkYXRlZEluVmVyIjoiNDMuNjYuNCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUiXX0=-->\n"
        change_url: https://github.com/osism/release/pull/2419
        commit_id: 652bba730ae468d75662534f6fc2512ae266fac2
        patchset: 652bba730ae468d75662534f6fc2512ae266fac2
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          name: osism/release
          short_name: release
          src_dir: src/github.com/osism/release
        topic: null
      job: flake8
      jobtags: []
      max_attempts: 3
      message: Y2hvcmUoZGVwcyk6IHVwZGF0ZSBkZXBlbmRlbmN5IGRlYm9wcy5kZWJvcHMgdG8gdjMuMy4wCgo+IOKEue+4jyAqKk5vdGUqKgo+IAo+IFRoaXMgUFIgYm9keSB3YXMgdHJ1bmNhdGVkIGR1ZSB0byBwbGF0Zm9ybSBsaW1pdHMuCgpUaGlzIFBSIGNvbnRhaW5zIHRoZSBmb2xsb3dpbmcgdXBkYXRlczoKCnwgUGFja2FnZSB8IFVwZGF0ZSB8IENoYW5nZSB8CnwtLS18LS0tfC0tLXwKfCBbZGVib3BzLmRlYm9wc10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RlYm9wcy9kZWJvcHMpIHwgbWlub3IgfCBgMy4yLjVgIOKGkiBgMy4zLjBgIHwKCi0tLQoKIyMjIFJlbGVhc2UgTm90ZXMKCjxkZXRhaWxzPgo8c3VtbWFyeT5kZWJvcHMvZGVib3BzIChkZWJvcHMuZGVib3BzKTwvc3VtbWFyeT4KCiMjIyBbYHYzLjMuMGBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kZWJvcHMvZGVib3BzL2Jsb2IvSEVBRC9DSEFOR0VMT0cucnN0I2RlYm9wcy12MzMwLS0tMjAyNi0wMy0xMykKCltDb21wYXJlIFNvdXJjZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RlYm9wcy9kZWJvcHMvY29tcGFyZS92My4yLjYuLi52My4zLjApCgouLiBcX2RlYm9wcyB2My4zLjA6IDxodHRwczovL2dpdGh1Yi5jb20vZGVib3BzL2RlYm9wcy9jb21wYXJlL3YzLjIuMC4uLnYzLjMuMD4KCkFkZGVkCgpgYGAKCk5ldyBEZWJPcHMgcm9sZXMKJycnJycnJycnJycnJycnJwoKLSBUaGUgOnJlZjpgZGVib3BzLm5peG9zYCByb2xlIHdpdGggaXRzIGNvcnJlc3BvbmRpbmcgcGxheWJvb2sgY2FuIGJlIHVzZWQgdG8KICBtYW5hZ2UgTml4T1MtYmFzZWQgaG9zdHMuIFRoZSByb2xlIGlzIG5vdCBpbmNsdWRlZCBpbiB0aGUgbWFpbgogIDpmaWxlOmBzaXRlLnltbGAgcGxheWJvb2ssIHdoaWNoIGlzIGZvY3VzZWQgb24gRGViaWFuL1VidW50dSBob3N0cy4KCi0gVGhlIDpyZWY6YGRlYm9wcy5pbmZsdXhkYjJgIHJvbGUgY2FuIGJlIHVzZWQgdG8gaW5zdGFsbCBhbmQgY29uZmlndXJlCiAgYEluZmx1eERCIHYyLnhgX18gdGltZS1zZXJpZXMgZGF0YWJhc2UuCgogIC4uIF9fOiBodHRwczovL3d3dy5pbmZsdXhkYXRhLmNvbS9wcm9kdWN0cy9pbmZsdXhkYi8KCi0gVGhlIDpyZWY6YGRlYm9wcy5wZ2JhZGdlcmAgcm9sZSBjYW4gYmUgdXNlZCB0byBnZW5lcmF0ZSBQb3N0Z3JlU1FMIGxvZwogIHJlcG9ydHMgZnJvbSBsb2NhbCBvciByZW1vdGUgaG9zdHMgb3ZlciBTU0guCgo6cmVmOmBkZWJvcHMuY29yZWAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnJwoKLSBBIG5ldyBsb2NhbCBmYWN0LCBgYGFuc2libGVfbG9jYWwuY29yZS5pc182NGJpdHNgYCwgY2FuIGJlIHVzZWQgdG8gZGV0ZXJtaW5lCiAgaWYgdGhlIGN1cnJlbnQgc3lzdGVtIHN1cHBvcnRzIDMyLWJpdCBvciA2NC1iaXQgYXJjaGl0ZWN0dXJlLgoKOnJlZjpgZGVib3BzLmRvdmVjb3RgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnJycKCi0gVGhlIHJvbGUgbm93IHN1cHBvcnRzIGBpdGVyYXRlX2ZpbHRlcmAgZm9yIGl0cyBMREFQIGNvbmZpZ3VyYXRpb24sIGFsbG93aW5nCiAgOmNvbW1hbmQ6YGRvdmVhZG1gIGNvbW1hbmRzIHRvIGl0ZXJhdGUgb3ZlciBhbGwgdXNlcnMuIE5vdGUgdGhhdCB5b3UgbWlnaHQKICBoYXZlIHRvIGFkanVzdCB0aGUgZGVmYXVsdHMgZm9yIHRoZSA6ZW52dmFyOmBkb3ZlY290X19sZGFwX3VzZXJfbGlzdF9maWx0ZXJgCiAgdmFyaWFibGUgaWYgeW91IHVzZSB0aGUgOmVudnZhcjpgZG92ZWNvdF9fbGRhcF91c2VyX2ZpbHRlcmAgdmFyaWFibGUuCgo6cmVmOmBkZWJvcHMuaXB4ZWAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnJwoKLSBEZWJpYW4gMTMgKFRyaXhpZSkgaGFzIGJlZW4gcmVsZWFzZWQsIHN1cHBvcnQgZm9yIGl0cyBpbnN0YWxsZXIgaGFzIGJlZW4gYWRkZWQKICB0byB0aGUgcm9sZS4gRGViaWFuIFRyaXhpZSBpcyBub3cgdGhlIHByaW1hcnkgU3RhYmxlIHJlbGVhc2UgYXZhaWxhYmxlIGluIHRoZQogIG5ldGJvb3QgaW5zdGFsbGF0aW9uIG1lbnUuCgo6cmVmOmBkZWJvcHMubmV0Ym94YCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycKCi0gU3RhcnRpbmcgd2l0aCBOZXRCb3ggYGB2My40LjlgYCwgYW5vbnltaXplZCByZXBvcnRpbmcgb2YgY2Vuc3VzIGRhdGEgaXMgYmVpbmcKICBlbmFibGVkIGJ5IGRlZmF1bHQuIERlYk9wcyByZXNwZWN0cyB0aGlzIHVwc3RyZWFtIGRlZmF1bHQuIFlvdSBjYW4gY2hhbmdlIGl0CiAgdXNpbmcgOmVudnZhcjpgbmV0Ym94X19jb25maWdfY2Vuc3VzX3JlcG9ydGluZ2AuCgotIFRoZSByb2xlIGNhbiBiZSB1c2VkIHdpdGggTmV0Qm94IGRlcGxveWVkIGluIGEgY2x1c3RlcmVkIFBvc3RncmVTUUwgc2V0dXAKICB3aXRoIHByaW1hcnkvc3RhbmRieSBub2Rlcy4KCjpyZWY6YGRlYm9wcy5uZ2lueGAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnJycKCi0gRGlmZmVyZW50IGZpbGUgdGVtcGxhdGVzIHVzZWQgaW4gdGhlIHJvbGUgY2FuIG5vdyBiZSBvdmVycmlkZGVuIGJ5IHRoZSB1c2VycwogIHdpdGggdGhlIERlYk9wcyB0ZW1wbGF0ZSBvdmVycmlkZSBzeXN0ZW0gYW5kIHRoZSBgYHRlbXBsYXRlX3NyY2BgIGxvb2t1cAogIHBsdWdpbi4KCjpyZWY6YGRlYm9wcy5wcmVzZWVkYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycnCgotIFRoZSByb2xlIHdpbGwgbm93IGdlbmVyYXRlIHByZXNlZWQgdGVtcGxhdGVzIGZvciBEZWJpYW4gMTMgKFRyaXhpZSkKICBhdXRvbWF0ZWQgaW5zdGFsbGF0aW9uLgoKOnJlZjpgZGVib3BzLnJlc29sdmVkYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycnJwoKLSBUaGUgcm9sZSB3aWxsIGFkZCBhIG5ldyBlbnRyeSBpbiB0aGUgOmZpbGU6YC9ldGMvc2VydmljZXNgIGRhdGFiYXNlICh1c2luZwogIHRoZSA6cmVmOmBkZWJvcHMuZXRjX3NlcnZpY2VzYCByb2xlKSBmb3IgdGhlIGBgNTM1NWBgIFRDUCBhbmQgVURQIHBvcnRzLAogIHJlc2VydmVkIGZvciB0aGUgYExpbmstTG9jYWwgTXVsdGljYXN0IE5hbWUgUmVzb2x1dGlvbmBfXy4gVGhpcyBzaG91bGQgaGVscAogIHdpdGggaWRlbnRpZmljYXRpb24gb2YgdW5rbm93biBUQ1AvVURQIHBvcnRzIG9mIHRoZSBsaXN0ZW5pbmcgc2VydmljZXMuCgogIC4uIF9fOiBodHRwczovL2VuLndpa2lwZWRpYS5vcmcvd2lraS9MaW5rLUxvY2FsX011bHRpY2FzdF9OYW1lX1Jlc29sdXRpb24KCkNoYW5nZWQKYGBgCgpVcGRhdGVzIG9mIHVwc3RyZWFtIGFwcGxpY2F0aW9uIHZlcnNpb25zCicnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycKCi0gSW4gdGhlIDpyZWY6YGRlYm9wcy5uZXRib3hgIHJvbGUsIHRoZSBOZXRCb3ggdmVyc2lvbiBoYXMgYmVlbiB1cGRhdGVkIHRvCiAgYHY0LjQuMWAuCgotIEluIHRoZSA6cmVmOmBkZWJvcHMuaXB4ZWAgcm9sZSwgdGhlIERlYmlhbiBCb29rd29ybSBpbnN0YWxsZXIgaGFzIGJlZW4KICB1cGRhdGVkIHRvIHYxMi4xMi4KCkdlbmVyYWwKJycnJycnJwoKLSBUaGUgOnJlZjpgZGVib3BzLnJvb3RfYWNjb3VudGAsIDpyZWY6YGRlYm9wcy5zeXN0ZW1fdXNlcnNgIGFuZAogIDpyZWY6YGRlYm9wcy51c2Vyc2Agcm9sZXMgYXJlIG5vdyBhYmxlIHRvIGhhbmRsZSB0aGUgc3ltbGlua2VkCiAgOmZpbGU6YH4vLnNzaC9hdXRob3JpemVkX2tleXNgIGZpbGVzIGNvcnJlY3RseSB1c2luZyBvcHRpb25hbCBgZm9sbG93YAogIHBhcmFtZXRlci4KCi0gVGhlIERlYk9wcyBDSSBwaXBlbGluZSBpbiBHaXRIdWIgQWN0aW9ucyBpcyBpbXByb3ZlZCBhbmQgd2lsbCBiZSBleGVjdXRlZCBvbgogIHB1bGwgcmVxdWVzdHMgYW5kIHB1c2hlcyB0byB0ZXN0IGNoYW5nZXMgYmVmb3JlIG1lcmdpbmcgdGhlbS4KCi0gVGhlIDpjb21tYW5kOmBkZWJvcHNgIHNjcmlwdCBhbmQgY3VzdG9tIEFuc2libGUgbG9va3VwIHBsdWdpbnMgc2hvdWxkIG5vdyBiZQogIGNvbXBhdGlibGUgd2l0aCBQeXRob24gMy4xMisgZHVlIHRvIHJlbW92YWwgb2YgdGhlIGBkaXN0dXRpbHNgIFB5dGhvbgogIGRlcGVuZGVuY3ksIHJlcGxhY2VkIGJ5IHRoZSBgcGFja2FnaW5nYCBQeXRob24gbW9kdWxlLgoKLSBSZWZlcmVuY2VzIHRvIHRoZSBvbGQgYGRlYm9wcy5yb2xlWFhgIEFuc2libGUgQ29sbGVjdGlvbnMgaGF2ZSBiZWVuIHJlbW92ZWQKICBmcm9tIGFsbCBwbGF5Ym9va3MsIHNpbmNlIHRoZSBwcm9qZWN0IGlzIG5vdyBjb250YWluZWQgaW4gYSBzaW5nbGUgQW5zaWJsZQogIENvbGxlY3Rpb24uCgo6cmVmOmBkZWJvcHMuYXB0YCByb2xlCicnJycnJycnJycnJycnJycnJycnJycKCi0gVGhlIERlYmlhbiAxMCAoQnVzdGVyKSByZWxlYXNlIGhhcyBiZWVuIGFyY2hpdmVkIGFuZCByZW1vdmVkIGZyb20gRGViaWFuCiAgbWlycm9ycy4gVGhlIHJvbGUgd2lsbCB1c2UgPGh0dHBzOi8vYXJjaGl2ZS5kZWJpYW4ub3JnL2RlYmlhbj4gYXMgdGhlCiAgcmVwb3NpdG9yeSBVUkwgb24gRGViaWFuIEJ1c3RlciBob3N0cy4KCi0gVGhlIHJvbGUgbm93IGNhbiBtYW5hZ2UgcmVwb3NpdG9yeSBHUEcga2V5cyBkaXJlY3RseSwgc3RvcmVkIGluIHRoZQogIDpmaWxlOmAvZXRjL2FwdC9rZXlyaW5ncy9gIGRpcmVjdG9yeSwgYnlwYXNzaW5nIHRoZSBkZXByZWNhdGVkCiAgYGFuc2libGUuYnVpbHRpbi5hcHRfa2V5YCBtb2R1bGUuIFN1cHBvcnQgZm9yIHRoZSBBbnNpYmxlIG1vZHVsZSBpcwogIHByZXNlbnQsIGJ1dCBuZWVkcyB0byBiZSBlbmFibGVkIGV4cGxpY2l0bHkuCgogIEV4aXN0aW5nIHJvbGUgY29uZmlndXJhdGlvbiBtaWdodCBuZWVkIHRvIGJlIHVwZGF0ZWQgdG8gc3VwcG9ydCBuZXcgY2hhbmdlcywKICBjaGVjayB0aGUgcm9sZSBkb2N1bWVudGF0aW9uIGZvciBkZXRhaWxzLgoKOnJlZjpgZGVib3BzLmdpdGxhYmAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnJycnCgotIFVzZXJzIGNhbiBub3cgc2VsZWN0IHNwZWNpZmljIEdpdExhYiB2ZXJzaW9uIHRvIGluc3RhbGwgdXNpbmcgdGhlIEFQVAogIHByZWZlcmVuY2VzLCBieSBzcGVjaWZ5aW5nIHRoZSBwYWNrYWdlIHZlcnNpb24gaW4gdGhlCiAgOmVudnZhcjpgZ2l0bGFiX19wcmVmZXJyZWRfdmVyc2lvbmAgdmFyaWFibGUuIEJ5IGRlZmF1bHQsIHRoZSBsYXRlc3QgdmVyc2lvbgogIHdpbGwgYmUgaW5zdGFsbGVkLgoKLSBUaGUgOmNvbW1hbmQ6YG5naW54YCBzZXJ2aWNlIGluc2lkZSBvZiB0aGUgR2l0TGFiIE9tbmlidXMgaW5zdGFsbGF0aW9uIHdpbGwKICBiZSByZXN0YXJ0ZWQgd2hlbiBYLjUwOSBjZXJ0aWZpY2F0ZXMgbWFuYWdlZCBieSB0aGUgOnJlZjpgZGVib3BzLnBraWAgcm9sZQogIGFyZSByZWlzc3VlZCwgZm9yIGV4YW1wbGUgdmlhIEFDTUUuCgo6cmVmOmBkZWJvcHMuZ2l0bGFiX3J1bm5lcmAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJwoKLSBUaGUgcm9sZSBpcyBub3cgY29tcGF0aWJsZSB3aXRoIEdpdExhYiAxNy54IGFuZCBuZXdlciByZWxlYXNlcy4KCi0gVGhlIHJ1bm5lciByZWdpc3RyYXRpb24gbWV0aG9kIGhhcyBjaGFuZ2VkLCBzZWUgdGhlIHJvbGUgZG9jdW1lbnRhdGlvbiBmb3IKICBkZXRhaWxzLgoKOnJlZjpgZGVib3BzLmtleXJpbmdgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnJycKCi0gVGhlIHJvbGUgbm93IGNhbiBtYW5hZ2UgcmVwb3NpdG9yeSBHUEcga2V5cyBkaXJlY3RseSwgc3RvcmVkIGluIHRoZQogIDpmaWxlOmAvZXRjL2FwdC9rZXlyaW5ncy9gIGRpcmVjdG9yeSwgYnlwYXNzaW5nIHRoZSBkZXByZWNhdGVkCiAgYGFuc2libGUuYnVpbHRpbi5hcHRfa2V5YCBtb2R1bGUuIFN1cHBvcnQgZm9yIHRoZSBBbnNpYmxlIG1vZHVsZSBpcwogIHByZXNlbnQsIGJ1dCBuZWVkcyB0byBiZSBlbmFibGVkIGV4cGxpY2l0bHkuCgogIEV4aXN0aW5nIHJvbGUgY29uZmlndXJhdGlvbiBtaWdodCBuZWVkIHRvIGJlIHVwZGF0ZWQgdG8gc3VwcG9ydCBuZXcgY2hhbmdlcywKICBjaGVjayB0aGUgcm9sZSBkb2N1bWVudGF0aW9uIGZvciBkZXRhaWxzLgoKOnJlZjpgZGVib3BzLm5naW54YCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJwoKLSBUaGUgY3VzdG9tIDpjb21tYW5kOmBzeXN0ZW1kYCBvdmVycmlkZSB0aGF0IGVuc3VyZXMgdGhhdCB0aGUgOmNvbW1hbmQ6YG5naW54YAogIHNlcnZpY2UgaXMgc3RhcnRlZCBhZnRlciBuZXR3b3JrIGlzIGF2YWlsYWJsZSB3aWxsIGJlIGluc3RhbGxlZCBvbmx5IG9uIG9sZGVyCiAgRGViaWFuL1VidW50dSByZWxlYXNlczsgaXQncyBub3cgdGhlIGRlZmF1bHQgc2luY2UgRGViaWFuIEJvb2t3b3JtLgoKOnJlZjpgZGVib3BzLnBraWAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnCgotIFRoZSBkZWZhdWx0IGtleSB0eXBlIGluIDpjb21tYW5kOmBjZXJ0Ym90YCBpcyBzZXQgdG8gUlNBLCBzaW5jZSBjdXJyZW50bHkKICB0aGVyZSdzIG5vIHN1cHBvcnQgZm9yIGRpZmZlcmVudCBrZXkgdHlwZXMgaW4gRGViT3BzIFBLSSBpbmZyYXN0cnVjdHVyZS4KCi0gVGhlIHBlcm1pc3Npb24gb2YgdGhlIDpmaWxlOmBjb25maWcvZW52aXJvbm1lbnRgIGNvbmZpZ3VyYXRpb24gZmlsZSBpbiBQS0kKICByZWFsbXMgd2lsbCBiZSBzZSB0byBgMDY0NGAgc28gdGhhdCBvdGhlciBVTklYIGFjY291bnRzIGNhbiByZWFkIGl0LiBUaGlzIGlzCiAgbmVlZGVkIGJ5IHRoZSA6Y29tbWFuZDpgYWNtZS10aW55YCBjb21tYW5kIHdoaWNoIGlzIGV4ZWN1dGVkIG9uIGEgc2VwYXJhdGUKICBVTklYIGFjY291bnQuCgo6cmVmOmBkZWJvcHMucG9zdGdyZXNxbF9zZXJ2ZXJgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnCgotIFRoZSByb2xlIGNhbiBub3cgc3VwcG9ydCBgcGdCYWRnZXJgXF9cXyBsb2cgYW5hbHl6ZXIgYnkgZW5hYmxpbmcgdmVyYm9zZSBsb2cKICBvdXRwdXQgYW5kIG1vZGlmeWluZyBhY2Nlc3MgdG8gdGhlIGxvZyBmaWxlcyB0aGVtc2VsdmVzIGluIHRoZQogIDpmaWxlOmAvdmFyL2xvZy9wb3N0Z3Jlc3FsL2AgZGlyZWN0b3J5LiBUaGlzIGZ1bmN0aW9uYWxpdHkgaXMgZGlzYWJsZWQgYnkKICBkZWZhdWx0IGFuZCBjYW4gYmUgZW5hYmxlZCB1c2luZyBhIHJvbGUgdmFyaWFibGUuCgogIC4uIFxfXF86IDxodHRwczovL3BnYmFkZ2VyLmRhcm9sZC5uZXQvPgoKLSBUaGUgZGVmYXVsdCBsb2cgaWRlbnQgc3RyaW5nIGlzIGNoYW5nZWQgdG8gYHBvc3RncmVzcWwtPHZlcnNpb24+LTxuYW1lPmAgdG8KICBiZXR0ZXIgZGlzdGluZ3Vpc2ggZGlmZmVyZW50IFBvc3RncmVTUUwgaW5zdGFuY2VzIGluIHRoZSBzeXN0ZW0gbG9ncy4KCjpyZWY6YGRlYm9wcy5yZXByZXByb2Agcm9sZQonJycnJycnJycnJycnJycnJycnJycnJycnJycKCi0gVGhlIHJvbGUgbm93IGNvbmZpZ3VyZXMgbG9jYWwgQVBUIHJlcG9zaXRvcmllcyBmb3IgRGViaWFuIDEzIChUcml4aWUpIGFuZAogIERlYmlhbiAxNCAoRm9ya3kpIGJ5IGRlZmF1bHQuIENvbmZpZ3VyYXRpb24gZm9yIERlYmlhbiBCdXN0ZXIgcmVwb3NpdG9yaWVzCiAgaGFzIGJlZW4gcmVtb3ZlZC4gU3ltbGlua3MgZm9yIHRoZSA6ZmlsZTpgc3RhYmxlL2AsIDpmaWxlOmBvbGRzdGFibGUvYCBhbmQKICA6ZmlsZTpgb2xkb2xkc3RhYmxlL2AgcmVsZWFzZXMgd2lsbCBiZSB1cGRhdGVkIGF1dG9tYXRpY2FsbHkgdG8gcG9pbnQgdG8gdGhlCiAgY29ycmVjdCBEZWJpYW4gcmVsZWFzZXMuCgo6cmVmOmBkZWJvcHMucmVzb3VyY2VzYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycnJycKCi0gVGhlIDpjb21tYW5kOmBnaXRgIHJlcG9zaXRvcmllcyB3aWxsIGJlIHByb2Nlc3NlZCBieSB0aGUgcm9sZSBmaXJzdCwgc2luY2UKICA6Y29tbWFuZDpgZ2l0YCBjYW4gaGFuZGxlIGRpcmVjdG9yeSBjcmVhdGlvbiBpZiBuZWVkZWQuCgo6cmVmOmBkZWJvcHMucnNwYW1kYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycKCi0gRHVlIHRvIHRoZSBgcmVtb3ZhbGBcX1xfIG9mIHRoZSBgZGlzdHV0aWxzYCBQeXRob24gbW9kdWxlIGZyb20gUHl0aG9uIHYzLjEyLAogIGN1c3RvbSBzY3JpcHRzIGluY2x1ZGVkIGluIHRoZSByb2xlIHdoaWNoIGNyZWF0ZSBhbmQgdXBkYXRlIERLSU0ga2V5cyBoYXZlCiAgYmVlbiB1cGRhdGVkIHRvIHVzZSB0aGUgYHNodXRpbGAgbW9kdWxlIGluc3RlYWQuCgogIC4uIFxfXF86IDxodHRwczovL2RvY3MucHl0aG9uLm9yZy8zLjExL3doYXRzbmV3LzMuMTAuaHRtbCNkaXN0dXRpbHMtZGVwcmVjYXRlZD4KCjpyZWY6YGRlYm9wcy5zbm1wZGAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnJycKCi0gVGhlIDpmaWxlOmBzbm1wZC5zZXJ2aWNlYCBjb25maWd1cmF0aW9uIGZpbGUgcHJvdmlkZWQgaW4gdGhlIHJvbGUgd2lsbCBlbnN1cmUKICB0aGF0IHRoZSA6Y29tbWFuZDpgc25tcGRgIGRhZW1vbiBpcyByZXN0YXJ0ZWQgb24gZmFpbHVyZS4gT2xkZXIgdmVyc2lvbnMgb2YKICA6Y29tbWFuZDpgc25tcGRgIGNhbiBgZmFpbCBkdWUgdG8gcmFwaWQgY2hhbmdlcyBpbiBuZXR3b3JrIGludGVyZmFjZXNgXF9cXy4KCiAgLi4gXF9cXzogPGh0dHBzOi8vYnVncy5kZWJpYW4ub3JnL2NnaS1iaW4vYnVncmVwb3J0LmNnaT9idWc9MTAyMzY1Nj4KCjpyZWY6YGRlYm9wcy55YWRtYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnCgotIFRoZSBwYXRocyB0byB0aGUgcmVwb3NpdG9yaWVzIHRoYXQgYXJlIHNhZmUgdG8gY2xvbmUgYnkgdGhlIDpjb21tYW5kOmBnaXRgCiAgY29tbWFuZCwgdXNlZCBmb3IgZG90ZmlsZXMgYnkgdGhlIDpyZWY6YGRlYm9wcy5zeXN0ZW1fdXNlcnNgIGFuZAogIDpyZWY6YGRlYm9wcy51c2Vyc2Agcm9sZXMsIHdpbGwgYmUgZGVmaW5lZCBpbiB0aGUgOmZpbGU6YC9ldGMvZ2l0Y29uZmlnYAogIHN5c3RlbS13aWRlIGNvbmZpZ3VyYXRpb24gZmlsZSBpbnN0ZWFkIG9mIHRoZSBwZXItdXNlciA6ZmlsZTpgfi8uZ2l0Y29uZmlnYAogIGNvbmZpZ3VyYXRpb24gZmlsZXMuIFRoaXMgYXZvaWRzIHRoZSBpc3N1ZSBvZiBtb2RpZnlpbmcgcGVyLXVzZXIgZW52aXJvbm1lbnQKICBmcm9tIHRoZSBzeXN0ZW0td2lkZSBsZXZlbCBvbiB3aGljaCBEZWJPcHMgb3BlcmF0ZXMgYW5kIGVuc2lyZXMgdGhhdCB0aGUKICBjbG9uZWQgZG90ZmlsZXMgYXJlIG5vdCBtb2RpZmllZC4gVGhlIHNwZWNpZmljIHRhc2tzIHRoYXQgZG8gdGhpcyBoYXZlIGJlZW4KICBtb3ZlZCBmcm9tIHRoZSA6cmVmOmBkZWJvcHMuc3lzdGVtX3VzZXJzYCBhbmQgOnJlZjpgZGVib3BzLnVzZXJzYCByb2xlIGludG8KICB0aGUgOnJlZjpgZGVib3BzLnlhZG1gIHJvbGUuCgpGaXhlZAoKYGBgCgpHZW5lcmFsCicnJycnJycKCi0gVGhlIDpyZWY6YGRlYm9wcy5zeXN0ZW1fdXNlcnNgIGFuZCB0aGUgOnJlZjpgZGVib3BzLnVzZXJzYCByb2xlcyB3aWxsIGFkZCB0aGUKICBkb3RmaWxlcyByZXBvc2l0b3J5IGNsb25lZCBieSB0aGUgYGByb290YGAgVU5JWCBhY2NvdW50IGluIHRoZQogIDpyZWY6YGRlYm9wcy55YWRtYCByb2xlIHRvIHRoZSBsaXN0IG9mIHRydXN0ZWQgOmNvbW1hbmQ6YGdpdGAgcmVwb3NpdG9yaWVzIGluCiAgdGhlIDpmaWxlOmB+Ly5naXRjb25maWdgIGNvbmZpZ3VyYXRpb24gZmlsZSBvZiBlYWNoIHVzZXIgYWNjb3VudCBtYW5hZ2VkIGJ5CiAgdGhlIHJvbGUuIFRoaXMgaXMgbmVlZGVkIHRvIGFsbG93IDpjb21tYW5kOmBnaXRgIHRvIGNsb25lIGxvY2FsIHJlcG9zaXRvcmllcwogIG5vdCBvd25lZCBieSB0aGUgVU5JWCBhY2NvdW50LCByZXF1aXJlZCBieSB0aGUgbWl0aWdhdGlvbiBvZiB0aGUKICBgQ1ZFLTIwMjItMjQ3NjVgX18gc2VjdXJpdHkgdnVsbmVyYWJpbGl0eS4KCiAgLi4gX186IGh0dHBzOi8vZ2l0aHViLmJsb2cvb3Blbi1zb3VyY2UvZ2l0L2dpdC1zZWN1cml0eS12dWxuZXJhYmlsaXR5LWFubm91bmNlZC8jY3ZlLTIwMjItMjQ3NjUKCi0gVGhlIDpjb21tYW5kOmBkZWJvcHNgIHNjcmlwdCB3aWxsIG5vdCB0cnkgdG8gZG93bmxvYWQgdGhlIHJlcXVpcmVkIEFuc2libGUKICBDb2xsZWN0aW9ucyBkdXJpbmcgbmV3IHByb2plY3QgY3JlYXRpb24gaWYgdGhlIDpjb21tYW5kOmBhbnNpYmxlLWdhbGF4eWAKICBjb21tYW5kIGlzIG5vdCBhdmFpbGFibGUgaW4gdGhlIHVzZXIncyBgYCRQQVRIYGAuCgotIFRoZSA6ZmlsZTpgdG9vbHMvZGlzdC11cGdyYWRlLnltbGAgcGxheWJvb2sgd2lsbCBub3QgZmFpbCBhbnltb3JlIGR1cmluZwogIDpmaWxlOmAvZXRjL3NlcnZpY2VzYCBkYXRhYmFzZSBhc3NlbWJseSBpZiBubyB1cGdyYWRlIHdhcyBwZXJmb3JtZWQuCgotIE5ldyBEZWJPcHMgcHJvamVjdCBkaXJlY3RvcmllcyB3aWxsIHVzZSBmaXhlZCBBbnNpYmxlIGNvbmZpZ3VyYXRpb24gZm9yCiAgY2FsbGJhY2sgcGx1Z2lucyBhbmQgd2lsbCBkZWZhdWx0IHRvIGEgWUFNTCBvdXRwdXQgZm9ybWF0IG9mIHRoZSBwbGF5Ym9vawogIHJlc3VsdHMuCgo6cmVmOmBkZWJvcHMuYXBhY2hlYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycKCi0gRml4ZWQgYW4gaXNzdWUgd2l0aCB0aGUgdmhvc3QgYGBzdGF0ZTogImFic2VudCJgYCBwYXJhbWV0ZXIgbm90IHdvcmtpbmcKICBjb3JyZWN0bHkgd2hlbiB0aGUgYGBlbmFibGVkOiBGYWxzZWBgIHBhcmFtZXRlciB3YXMgbm90IHNldCBhcyB3ZWxsLgoKOnJlZjpgZGVib3BzLmRvY2tlcl9nZW5gIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnJycnJycKCi0gRmxhdHRlbmVkIHRoZSBsaXN0IG9mIGRpcmVjdG9yaWVzIHRoYXQgYXJlIGNyZWF0ZWQgYnkgdGhlIGBgZmlsZWBgIHRhc2suIFRoaXMKICBzaG91bGQgZml4IHRoZSBpc3N1ZSBvZiBBbnNpYmxlIHN0b3BwaW5nIGR1cmluZyBleGVjdXRpb24gZHVlIHRvIG5lc3RlZCBsaXN0cwogIGluIHRoZSBgYGxvb3BgYCBrZXl3b3JkLgoKOnJlZjpgZGVib3BzLmRyb3BiZWFyX2luaXRyYW1mc2Agcm9sZQonJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnCgotIFRoZSByb2xlIG5vdyBzdXBwb3J0cyBib3RoIHRoZSBvbGQgYW5kIHRoZSBuZXcgbG9jYXRpb24gaWYgdGhlIGluaXRyYW1mcwogIGNvbmZpZ3VyYXRpb24gZmlsZXMuCgo6cmVmOmBkZWJvcHMuZmVybWAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnJwoKLSBUaGUgcm9sZSB3aWxsIHJlc3RhcnQgdGhlIDpjb21tYW5kOmBmYWlsMmJhbmAgc2VydmljZSBpbnN0ZWFkIG9mIHJlbG9hZGluZwogIGl0LCB3aGljaCB3aWxsIGVuc3VyZSB0aGF0IHRoZSBjdXN0b20gcnVsZXMgYXJlIHJlLWFkZGVkIHdoZW4gdGhlCiAgOmNvbW1hbmQ6YGZlcm1gIHNlcnZpY2UgaXMgcmVzdGFydGVkLgoKLSBGaXhlZCBhbiBpc3N1ZSB3aXRoIHRoZSByb2xlIGZhaWxpbmcgaWYgdGhlIDplbnZ2YXI6YGZlcm1fX3BhcnNlZF9ydWxlc2AKICB2YXJpYWJsZSBpcyBub3QgZGVmaW5lZCBjb3JyZWN0bHkuIFRoZSByb2xlIHdpbGwgc2tpcCBydWxlIGdlbmVyYXRpb24gaW4gc3VjaAogIGNhc2UgaW5zdGVhZCBvZiBmYWlsaW5nIHdpdGggdGhlICJBbnNpYmxlVW5kZWZpbmVkIiBlcnJvciBtZXNzYWdlLgoKOnJlZjpgZGVib3BzLmlmdXBkb3duYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycnJwoKLSBUaGUgOmZpbGU6YGlmYWNlQC5zZXJ2aWNlYCA6Y29tbWFuZDpgc3lzdGVtZGAgdW5pdCBwcm92aWRlZCBieSB0aGUgcm9sZSBpcwogIGNoYW5nZWQgdG8gdXNlIGBgQWZ0ZXI9PXN5cy1zdWJzeXN0ZW0tbmV0LWRldmljZXMtJWkuZGV2aWNlYGAgcGFyYW1ldGVyLiBUaGlzCiAgc2hvdWxkIGVuc3VyZSB0aGF0IHRoZSBicmlkZ2UgaW50ZXJmYWNlcyBhcmUgY29ycmVjdGx5IHN0YXJ0ZWQgYXQgYm9vdCB0aW1lLgoKOnJlZjpgZGVib3BzLm5ldGJveGAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnJycnCgotIEZpeGVkIGFuIGlzc3VlIHdpdGggdGhlIERqYW5nbyBzdXBlcnVzZXIgY3JlYXRpb24gdGFzayB0aGF0IGZhaWxlZCBleGVjdXRpb24KICBpZiB0aGUgYGBlcnJvcmBgIHN0cmluZyB3YXMgbm90IHByZXNlbnQgaW4gY29tbWFuZCBvdXRwdXQ7IHRoaXMgcmVzdWx0ZWQgaW4KICBhbiBpbmNvbXBsZXRlIGluc3RhbGxhdGlvbi4KCjpyZWY6YGRlYm9wcy5udWxsbWFpbGVyYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycnJycnCgotIFRoZSByb2xlIHdpbGwgYXZvaWQgaW50ZXJhY3Rpbmcgd2l0aCB0aGUgTERBUCBzZXJ2ZXIgd2hlbiBMREFQIHN1cHBvcnQgaXMKICBkaXNhYmxlZCB3aGlsZSBEZWJPcHMgaXMgdXNlZCBpbiBMREFQIGVudmlyb25tZW50LgoKOnJlZjpgZGVib3BzLm93bmNsb3VkYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycnJwoKLSBGaXhlZCBjb25kaXRpb25hbCBsb2dpYyBpbiBhIHRhc2sgd2hpY2ggZGV0ZXJtaW5lcyBpZiB0aGUgImF1dG9zZXR1cCIKICBvcGVyYXRpb24gc2hvdWxkIGJlIHBlcmZvcm1lZCBkdXJpbmcgTmV4dGNsb3VkL293bkNsb3VkIGluc3RhbGxhdGlvbi4KCjpyZWY6YGRlYm9wcy5wa2lgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJwoKLSBUaGUgTGV0J3MgRW5jcnlwdCBzZXJ2aWNlIGRyb3BwZWQgc3VwcG9ydCBmb3IgdGhlIGBgY29udGFjdHNgYCBvcHRpb24uIFRoaXMKICByZXF1aXJlcyBhIG5ldyB2ZXJzaW9uIG9mIHRoZSA6Y29tbWFuZDpgYWNtZS10aW55YCBjb21tYW5kIHRvIGJlIGluc3RhbGxlZCBvbgogIGNsaWVudCBob3N0cyB0byB3b3JrIHByb3Blcmx5LiBTaW5jZSB0aGUgYGBhY21lLXRpbnlgYCBBUFQgcGFja2FnZSBpbiBEZWJpYW4KICBCb29rd29ybSBpcyB0b28gb2xkLCBvbiB0aGlzIHJlbGVhc2UgdGhlIHJvbGUgd2lsbCBpbnN0YWxsCiAgOmNvbW1hbmQ6YGFjbWUtdGlueWAgZnJvbSBzb3VyY2UuIE9uIGV4aXN0aW5nIGluc3RhbGxhdGlvbnMsIHRoZQogIGBgYWNtZS10aW55YGAgQVBUIHBhY2thZ2UgbWlnaHQgbmVlZCB0byBiZSByZW1vdmVkIG1hbnVhbGx5LgoKLSBUaGUgYGBhY21lLXRpbnlgYCBzb3VyY2UgcmVwb3NpdG9yeSBzd2l0Y2hlZCBmcm9tIHRoZSBgYG1hc3RlcmBgIGJyYW5jaCB0bwogIHRoZSBgYG1haW5gYCBicmFuY2gsIGV4aXN0aW5nIHNvdXJjZSBpbnN0YWxsYXRpb25zIG5lZWQgdG8gcmVtb3ZlIHRoZSBsb2NhbAogIGNsb25lIG9mIHRoZSByZXBvc2l0b3J5IGluIDpmaWxlOmAvdXNyL2xvY2FsL3NyYy9wa2ktYWNtZS9kaWFmeWdpL2FjbWUtdGlueS9gCiAgc28gdGhhdCBpdCBjYW4gYmUgY2xvbmVkIGNvcnJlY3RseSBieSBBbnNpYmxlLiBZb3Ugc2hvdWxkIGFsc28gcmVtb3ZlIHRoZQogIGNvcHkgb2YgdGhlIDpmaWxlOmAvdXNyL2xvY2FsL2Jpbi9hY21lLXRpbnlgIGNvbW1hbmQgdG8gYmUgaW5zdGFsbGVkCiAgY29ycmVjdGx5LgoKOnJlZjpgZGVib3BzLnBkbnNgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycKCi0gVGhlIFBvd2VyRE5TIHNlcnZpY2Ugd2lsbCBiZSBjb25maWd1cmVkIHRvIGxpc3RlbiBvbiBhbGwgZXh0ZXJuYWwgSVB2NCBhbmQKICBJUHY2IGFkZHJlc3NlcyBvZiBhIGhvc3QgaW5zdGVhbmQgb2YgbGlzdGVuaW5nIG9uICJhbGwiIElQIGFkZHJlc3NlcyB0bwogIGVuc3VyZSB0aGF0IHRoZSBzZXJ2aWNlIGlzIHN0YXJ0ZWQgd2hpbGUgdGhlIDpjb21tYW5kOmBzeXN0ZW1kLXJlc29sdmVkYAogIHNlcnZpY2UgbGlzdGVucyBvbiB0aGUgbG9vcGJhY2sgaW50ZXJmYWNlLgoKOnJlZjpgZGVib3BzLnBvc3RncmVzcWxfc2VydmVyYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJwoKLSBGaXhlZCBhbiBpc3N1ZSB3aXRoIHRoZSBgYHZhY3V1bV9kZWZlcl9jbGVhbnVwX2FnZWBgIG9wdGlvbiByZW1vdmFsIGluCiAgUG9zdGdyZVNRTCAxNi54IHJlc3VsdGluZyBpbiBmYWlsZWQgc3RhcnR1cCBvZiB0aGUgc2VydmljZS4gVGhlIG9wdGlvbiB3aWxsCiAgYmUgYWRkZWQgb25seSBvbiBzdXBwb3J0ZWQgUG9zdGdyZVNRTCB2ZXJzaW9ucy4KCjpyZWY6YGRlYm9wcy5yZXNvbHZlZGAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnJycnJycKCi0gVGhlIHJvbGUgd2lsbCBkaXNhYmxlIHN5bnRoZXNpcyBvZiBsb2NhbCBob3N0bmFtZSBieSB0aGUKICA6Y29tbWFuZDpgc3lzdGVtZC1yZXNvbHZlZGAgc2VydmljZSAoZW5hYmxlZCBieSBkZWZhdWx0IGluIHN5c3RlbWQgdjI1NikgdG8KICBhbGxvdyByZXNvbHV0aW9uIG9mIHRoZSBob3N0J3MgRlFETiBxdWVyaWVzIGJ5IHVwc3RyZWFtIEROUyBzZXJ2ZXIuCgo6cmVmOmBkZWJvcHMuc3lzY3RsYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycKCi0gVGhlIDpmaWxlOmA1MC1waWQtbWF4LmNvbmZgIGNvbmZpZ3VyYXRpb24gZmlsZSB3aWxsIGJlIGluc3RhbGxlZCBvbmx5IG9uCiAgcGxhdGZvcm1zIHdoaWNoIHN1cHBvcnQgNjQtYml0IGFyY2hpdGVjdHVyZS4KClJlbW92ZWQKYGBgCgpHZW5lcmFsCicnJycnJycKCi0gVGhlIGB2b2xrc3phZWhsZXJgIChgZGVib3BzLWNvbnRyaWJgKSByb2xlIHdhcyByZW1vdmVkIGJlY2F1c2UgdGhlIHJvbGUKICBtYWludGFpbmVyIGNvbnNpZGVycyB0aGUgYXBwbGljYXRpb24gdG8gYmUgc3VwZXJzZWRlZCBieSBHcmFmYW5hLgogIFNlZSBgRnV0dXJlIG9mIHRoZSBwcm9qZWN0OyBUaGUgZWxlcGhhbnQgaW4gdGhlIHJvb20g4oCTIEdyYWZhbmFgXF9cXy4KCiAgLi4gXF9cXzogW3ZvbGtzemFlaGxlci92b2xrc3phZWhsZXIub3JnIzgxOV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3ZvbGtzemFlaGxlci92b2xrc3phZWhsZXIub3JnL2lzc3Vlcy84MTkpCgotIFRoZSBgYml0Y29pbmRgIHJvbGUgd2FzIHJlbW92ZWQgZHVlIHRvIGxhY2sgb2YgaW50ZXJlc3QgYnkgdGhlIHJvbGUKICBtYWludGFpbmVyLgoKLSBUaGUgYHByb2ZpbGVfdGFza3MucHlgIEFuc2libGUgY2FsbGJhY2sgcGx1Z2luIGhhcyBiZWVuIHJlbW92ZWQgZHVlIHRvCiAgIlVuZXhwZWN0ZWQgRXhjZXB0aW9uIiBlcnJvciBvbiBBbnNpYmxlIHYyLjE5LiBVc2VycyBzaG91bGQgdXNlIGl0cyB1cHN0cmVhbQogIGFsdGVybmF0aXZlLCBgYW5zaWJsZS5wb3NpeC5wcm9maWxlX3Rhc2tzYCBwbHVnaW4uCgo6cmVmOmBkZWJvcHMuaXB4ZWAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnJwoKLSBEZWJpYW4gMTAgKEJ1c3RlcikgaGFzIGJlZW4gYXJjaGl2ZWQgYW5kIGl0J3Mgbm8gbG9uZ2VyIGF2YWlsYWJsZSBvbiBEZWJpYW4KICBtaXJyb3JzLCBzdXBwb3J0IGZvciBpdHMgaW5zdGFsbGVyIGhhcyBiZWVuIHJlbW92ZWQgZnJvbSB0aGUgcm9sZS4KCjpyZWY6YGRlYm9wcy5uZXRib3hgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnJwoKLSBUaGUgTkFQQUxNIGludGVncmF0aW9uIGZlYXR1cmUgZm91bmQgaW4gTmV0Qm94IDMuNCBhbmQgYmVmb3JlIGhhcyBiZWVuIG1vdmVkCiAgdG8gYSBkZWRpY2F0ZWQgcGx1Z2luLiBJZiB5b3Ugd2FudCB0byBjb250aW51ZSB1c2luZyBpdCwgeW91IHdpbGwgaGF2ZSB0bwogIGluc3RhbGwgdGhlIHBsdWdpbi4gQWxsIHJvbGUgdmFyaWFibGVzIGFib3V0IE5BUEFMTSBleGNlcHQKICA6ZW52dmFyOmBuZXRib3hfX25hcGFsbV9zc2hfZ2VuZXJhdGVgIGFuZAogIDplbnZ2YXI6YG5ldGJveF9fbmFwYWxtX3NzaF9nZW5lcmF0ZV9iaXRzYCBoYXZlIGJlZW4gcmVtb3ZlZC4KCjpyZWY6YGRlYm9wcy5weXRob25gIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnJwoKLSBUaGUgYHB5dGhvbjMtZnV0dXJlYCBhbmQgYHB5dGhvbi1mdXR1cmVgIEFQVCBwYWNrYWdlcyBoYXZlIGJlZW4gcmVtb3ZlZAogIGZyb20gRGViaWFuIFN0YWJsZSByZWxlYXNlLCBhbmQgd2lsbCBub3QgYmUgaW5zdGFsbGVkIGJ5IGRlZmF1bHQgYnkgdGhlCiAgOnJlZjpgZGVib3BzLnB5dGhvbmAgcm9sZS4KClNlY3VyaXR5CgpgYGAKCjpyZWY6YGRlYm9wcy5pY2luZ2FgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnJwoKLSBUaGUgR1BHIGtleSBvZiB0aGUgSWNpbmdhIHVwc3RyZWFtIEFQVCByZXBvc2l0b3J5IGBoYXMgYmVlbiByZXBsYWNlZGBfXyBvbgogIDMwdGggU2VwdGVtYmVyIDIwMjQuIFRoZSByb2xlIGluY2x1ZGVzIHRoZSBuZXcga2V5IHdoaWNoIHNob3VsZCBiZSBpbnN0YWxsZWQKICBvbiB0aGUgaG9zdCBvbiB0aGUgbmV4dCBydW4uIFRoZSBvbGQgR1BHIGtleSB3aWxsIG5vdCBiZSByZW1vdmVkCiAgYXV0b21hdGljYWxseS4KCiAgLi4gX186IGh0dHBzOi8vaWNpbmdhLmNvbS9ibG9nLzIwMjQvMDgvMjYvaWNpbmdhLXBhY2thZ2UtcmVwb3NpdG9yeS1rZXktcm90YXRpb24tMjAyNC8KCmBkZWJvcHMgdjMuMi4wYF8gLSAyMDI0LTA5LTE2Ci0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCgouLiBfZGVib3BzIHYzLjIuMDogaHR0cHM6Ly9naXRodWIuY29tL2RlYm9wcy9kZWJvcHMvY29tcGFyZS92My4xLjAuLi52My4yLjAKCkFkZGVkCn5+fn5+CgpOZXcgRGViT3BzIHJvbGVzCicnJycnJycnJycnJycnJycKCi0gVGhlIDpyZWY6YGRlYm9wcy5kZWJjb25mYCBBbnNpYmxlIHJvbGUgY2FuIGJlIHVzZWQgdG8gcHJlLWNvbmZpZ3VyZSBBUFQKICBwYWNrYWdlcyB3aGljaCB1c2UgdGhlIGBkZWJjb25mYF9fIGNvbmZpZ3VyYXRpb24gZGF0YWJhc2UgYW5kIGluc3RhbGwgdGhlbQogIGFmdGVyd2FyZHMuIFRoZSByb2xlIGlzIGluY2x1ZGVkIG5lYXIgdGhlIGVuZCBvZiB0aGUgOmZpbGU6YHNpdGUueW1sYAogIHBsYXlib29rIHRvIGFsbG93IG9mIGNvbmZpZ3VyYXRpb24gb2Ygb3RoZXIgbmVlZGVkIHNlcnZpY2VzIGJlZm9yZSB0aGUgYWN0dWFsCiAgcGFja2FnZSBpbnN0YWxsYXRpb24uCgogIC4uIF9fOiBodHRwczovL2VuLndpa2lwZWRpYS5vcmcvd2lraS9EZWJpYW5fY29uZmlndXJhdGlvbl9zeXN0ZW0KCkdlbmVyYWwKJycnJycnJwoKLSBUaGUgOmNvbW1hbmQ6YGRlYm9wc2Agc2NyaXB0IGNhbiBub3cgbG9nIGl0cyBvcGVyYXRpb24gdG8gc3RhbmRhcmQgZXJyb3IgYW5kCiAgdG8gdGhlIDpjb21tYW5kOmBzeXNsb2dgIHNlcnZpY2UuIFVzZSB0aGUgYGAtLXZlcmJvc2VgYCBvciBgYC12YGAgZmxhZyB0bwogIGVuYWJsZSBsb2cgb3V0cHV0IG9uIHRoZSBjb25zb2xlLgoKLSBVc2VycyBjYW4gZGVmaW5lICJwbGF5Ym9vayBzZXRzIiBvbiB0aGUgdmlldyBsZXZlbCBvZiB0aGUgIm1vZGVybiIgcHJvamVjdAogIGRpcmVjdG9yaWVzLiBQbGF5Ym9vayBzZXRzIGNhbiBiZSB1c2VkIGFzIGFsaWFzZXMgdG8gY2FsbCBtdWx0aXBsZSBwbGF5Ym9va3MKICB1c2luZyBhIGN1c3RvbSBuYW1lLiBTZWUgOnJlZjpgcGxheWJvb2tfc2V0c2AgZG9jdW1lbnRhdGlvbiBmb3IgbW9yZSBkZXRhaWxzLgoKLSBVc2VycyBjYW4gbm93IGVuYWJsZSAicmVhZC1vbmx5IEZyaWRheXMiIGZ1bmN0aW9uYWxpdHkgb24gYSBwZXIgcHJvamVjdAogIGJhc2lzLCB0byBlbnN1cmUgdGhhdCBvbiBGcmlkYXlzLCBBbnNpYmxlIHBsYXlib29rcyBhcmUgcnVuIG9ubHkgaW4gY2hlY2sKICBtb2RlLCB3aXRoIGBgLS1jaGVja2BgIGFuZCBgYC0tZGlmZmBgIGFyZ3VtZW50cyBhdXRvbWF0aWNhbGx5IGFkZGVkIHRvIHRoZQogIDpjb21tYW5kOmBhbnNpYmxlLXBsYXlib29rYCBjb21tYW5kIG9wdGlvbnMuCgo6cmVmOmBkZWJvcHMuYXB0X2luc3RhbGxgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnCgotIFRoZSByb2xlIHdpbGwgaW1wb3J0IHRoZSA6cmVmOmBkZWJvcHMuc2VjcmV0YCByb2xlIGR1cmluZyBleGVjdXRpb24gdG8gZ2V0CiAgYWNjZXNzIHRvIHRoZSA6ZmlsZTpgc2VjcmV0L2AgZGlyZWN0b3J5LiBUaGlzIHBlcm1pdHMgdXNlIG9mIHN0b3JlZCBwYXNzd29yZHMKICBpbiBEZWJjb25mIGFuc3dlcnMgY29uZmlndXJlZCB2aWEgdGhlIDpyZWY6YGRlYm9wcy5hcHRfaW5zdGFsbGAgcm9sZS4KCjpyZWY6YGRlYm9wcy5kbnNtYXNxYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycnCgotIFRoZSByb2xlIGNhbiBvcHRpb25hbGx5IGlnbm9yZSBJUCBhZGRyZXNzZXMgb24gYSBuZXR3b3JrIGludGVyZmFjZSBhbmQgdXNlCiAgb25seSBzcGVjaWZpZWQgb25lcyBmb3IgOmNvbW1hbmQ6YGRuc21hc3FgIGNvbmZpZ3VyYXRpb24uIFRoaXMgY2FuIGhlbHAgd2l0aAogIFJvdXRpbmcgQWR2ZXJ0aXNlbWVudHMgaXNzdWVzIG9uIGludGVybmFsIG5ldHdvcmtzLiBTZWUgcm9sZSBkb2N1bWVudGF0aW9uCiAgZm9yIG1vcmUgZGV0YWlscy4KCjpyZWY6YGRlYm9wcy5wa2lgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJwoKLSBBZGQgc3VwcG9ydCBmb3IgZGVmaW5pbmcgcGVyLXJlYWxtIFVOSVggZW52aXJvbm1lbnQgdmFyaWFibGVzIHNldCBkdXJpbmcKICA6Y29tbWFuZDpgcGtpLXJlYWxtYCBzY3JpcHQgZXhlY3V0aW9uLiBUaGVzZSB2YXJpYWJsZXMgY2FuIGJlIHVzZWQgdG8gYXVnbWVudAogIHJ1bnRpbWUgZW52aXJvbm1lbnQsIGZvciBleGFtcGxlIHRvIGRlZmluZSBIVFRQIHByb3h5IHRvIHVzZSBpbnNpZGUgaW50ZXJuYWwKICBuZXR3b3JrcyB3aXRoIHJlc3RyaWN0ZWQgYWNjZXNzIHRvIHRoZSBvdXRzaWRlIHdvcmxkLgoKOnJlZjpgZGVib3BzLnJhYmJpdG1xX3NlcnZlcmAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnCgotIFRoZSByb2xlIGNhbiBtYW5hZ2UgbXVjaCBtb3JlIFJhYmJpdE1RIGludGVybmFsIHN0cnVjdHVyZXMgLSBleGNoYW5nZXMsCiAgcXVldWVzLCBiaW5kaW5ncyBiZXR3ZWVuIHRoZW0sIGFzIHdlbGwgYXMgdmhvc3QgYW5kIHVzZXIgbGltaXRzLgoKQ2hhbmdlZAp+fn5+fn5+CgpVcGRhdGVzIG9mIHVwc3RyZWFtIGFwcGxpY2F0aW9uIHZlcnNpb25zCicnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycKCi0gSW4gdGhlIDpyZWY6YGRlYm9wcy5pcHhlYCByb2xlLCBzdXBwb3J0IGZvciB0aGUgRGViaWFuIEJ1bGxzZXllIG5ldGJvb3QKICBpbnN0YWxsZXIgaGFzIGJlZW4gdXBkYXRlZCB0byB2MTEuMTI7IHRoZSBEZWJpYW4gQm9va3dvcm0gaW5zdGFsbGVyIGhhcyBiZWVuCiAgdXBkYXRlZCB0byB2MTIuNy4KCkdlbmVyYWwKJycnJycnJwoKLSBEZWJPcHMgbm93IHVzZXMgYHBpcHhgX18gYXMgdGhlIHByZWZlcnJlZCBpbnN0YWxsYXRpb24gbWV0aG9kLiBUaGlzIGFsbG93cwogIGZvciBlYXNpZXIgbWFpbnRlbmFuY2Ugb2YgdGhlIERlYk9wcyB2aXJ0dWFsIGVudmlyb25tZW50LgoKICAuLiBfXzogaHR0cHM6Ly9waXB4LnB5cGEuaW8vCgo6cmVmOmBkZWJvcHMuZWxhc3RpY3NlYXJjaGAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJwoKLSBUaGUgcm9sZSBub3cgc3VwcG9ydHMgbmV3IEVsYXN0aWNzZWFyY2ggdjgueCBwYXNzd29yZCBtYW5hZ2VtZW50IG1lY2hhbmlzbS4KCi0gVGhlIHJvbGUgY2FuIG5vdyBtYW5hZ2UgcGFzc3dvcmRzIGluIHNlcGFyYXRlIEVsYXN0aWNzZWFyY2ggY2x1c3RlcnMgZGVmaW5lZAogIGluIG9uZSBBbnNpYmxlIGludmVudG9yeS4KCiAgLi4gd2FybmluZzo6IER1ZSB0byB0aGlzIGNoYW5nZSwgRWxhc3RpY3NlYXJjaCBwYXNzd29yZHMgc3RvcmVkIGluIHRoZQogICAgICAgICAgICAgICA6ZmlsZTpgYW5zaWJsZS9zZWNyZXQvYCBzdWJkaXJlY3Rvcnkgd2lsbCBiZSByZWFkIGZyb20gYSBkaWZmZXJlbnQKICAgICAgICAgICAgICAgbG9jYXRpb24uIElmIHBhc3N3b3JkcyBhcmUgbm90IG1vdmVkIHRvIHRoZSBuZXcgbG9jYXRpb24sIHJvbGUKICAgICAgICAgICAgICAgd2lsbCByZXNldCB0aGUgRWxhc3RpY3NlYXJjaCBidWlsdC1pbiB1c2VycyBwYXNzd29yZHMKICAgICAgICAgICAgICAgYXV0b21hdGljYWxseS4gVGhpcyBtaWdodCByZXN1bHQgaW4gZGF0YSBsb3NzLgoKOnJlZjpgZGVib3BzLmtpYmFuYWAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnJycnCgotIFRoZSBwYXRoIHRvIHRoZSBwYXNzd29yZCBmaWxlIHN0b3JlZCBpbiA6ZmlsZTpgYW5zaWJsZS9zZWNyZXQvYCBzdWJkaXJlY3RvcnkKICBpcyBub3cgY29uZmlndXJhYmxlIHVzaW5nIGEgdmFyaWFibGUuCgotIFRoZSByb2xlIHVzZXMgbmV3IHBlci1jbHVzdGVyIEVsYXN0aWNzZWFyY2ggcGFzc3dvcmRzIGJ5IGRlZmF1bHQuIFRoaXMgaXMKICBkb25lIHVzaW5nIGEgc2VwYXJhdGUgOmVudnZhcjpga2liYW5hX19lbGFzdGljc2VhcmNoX2NsdXN0ZXJfbmFtZWAgdmFyaWFibGUsCiAgd2hpY2ggbmVlZHMgdG8gYmUgc3luY2hyb25pemVkIHdpdGggdGhlIEVsYXN0aWNzZWFyY2ggY29uZmlndXJhdGlvbiB2aWEKICBBbnNpYmxlIGludmVudG9yeSAoS2liYW5hIGNhbiBiZSBpbnN0YWxsZWQgc2VwYXJhdGVseSBmcm9tIEVsYXN0aWNzZWFyY2gpLgoKOnJlZjpgZGVib3BzLmx4Y2Agcm9sZQonJycnJycnJycnJycnJycnJycnJycnCgotIFRoZSByb2xlIHN1cHBvcnRzIGludGVncmF0aW9uIHdpdGggdGhlIDpjb21tYW5kOmBzeXN0ZW1kLXJlc29sdmVkYCBETlMKICByZXNvbHZlci4gVGhpcyBwZXJtaXRzIHVzZSBvZiB0aGUgOmNvbW1hbmQ6YHN5c3RlbWQtbmV0d29ya2RgIHNlcnZpY2UgdG8KICBtYW5hZ2UgbmV0d29ya2luZyBvbiB0aGUgTFhDIGhvc3QuCgotIExYQyBjb250YWluZXJzIHdpbGwgYmUgY29uZmlndXJlZCB3aXRoIEFwcEFybW9yICJ1bmNvbmZpbmVkIiBwcm9maWxlIGJ5CiAgZGVmYXVsdC4gVGhpcyBjaGFuZ2UgYWxsb3dzIHN0YXJ0dXAgb2YgdmFyaW91cyBzZXJ2aWNlcyBpbnNpZGUgb2YgdGhlCiAgY29udGFpbmVyIHdpdGhvdXQgZXJyb3JzIG9uIERlYmlhbiBCb29rd3JvbSBob3N0cy4KCjpyZWY6YGRlYm9wcy5seGRgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJwoKLSBUaGUgcm9sZSBzdXBwb3J0cyBpbnRlZ3JhdGlvbiB3aXRoIHRoZSA6Y29tbWFuZDpgc3lzdGVtZC1yZXNvbHZlZGAgRE5TCiAgcmVzb2x2ZXIuIFRoaXMgcGVybWl0cyB1c2Ugb2YgdGhlIDpjb21tYW5kOmBzeXN0ZW1kLW5ldHdvcmtkYCBzZXJ2aWNlIHRvCiAgbWFuYWdlIG5ldHdvcmtpbmcgb24gdGhlIExYRCBob3N0LgoKOnJlZjpgZGVib3BzLm5naW54YCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJwoKLSBUaGUgYGAvaW5kZXguaHRtbGBgIGFuZCBgYC9pbmRleC5odG1gYCBlbnRyaWVzIGluIHRoZSBkZWZhdWx0IGBgdHJ5X2ZpbGVzYGAKICBjb25maWd1cmF0aW9uIG9wdGlvbiBoYXZlIGJlZW4gcmVwbGFjZWQgd2l0aCB0aGUgYGAkdXJpL2luZGV4Lmh0bWxgYCBlbnRyeS4KICBUaGlzIGNoYW5nZSBzaG91bGQgZW5zdXJlIHRoYXQgYW55IGxvY2F0aW9uIG5vdCBwcmVzZW50IG9uIHRoZSBzZXJ2ZXIgd2lsbAogIHJldHVybiBlcnJvciA0MDQgY29ycmVjdGx5LCBpbnN0ZWFkIG9mIGZhbGxpbmcgYmFjayB0byB0aGUgYGAvaW5kZXguaHRtbGBgCiAgZmlsZSBpZiBpdCdzIHByZXNlbnQgaW4gdGhlIHJvb3Qgb2YgdGhlIHdlYnNpdGUuCgo6cmVmOmBkZWJvcHMucG9zdGdyZXNxbF9zZXJ2ZXJgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnCgotIFRoZSA6Y29tbWFuZDpgYXV0b3Bvc3RncmVzcWxiYWNrdXBgIHNjcmlwdCB3YXMgbW9kaWZpZWQgdG8gaGF2ZSBzZXBhcmF0ZSBzZXQKICBvZiBvcHRpb25zIGZvciB0aGUgOmNvbW1hbmQ6YHBzcWxgIGNvbW1hbmQgYW5kIHRoZSA6Y29tbWFuZDpgcGdfZHVtcGAKICBjb21tYW5kLiBUaGlzIHBlcm1pdHMgdGhlIHVzZSBvZiB0aGUgYGAtLWZvcm1hdD1jdXN0b21gYCBvcHRpb24gaW4KICA6Y29tbWFuZDpgcGdfZHVtcGAgY29tbWFuZCwgZW5hYmxpbmcgbW9yZSBlZmZpY2llbnQgZGF0YWJhc2UgZHVtcHMuCgotIFRoZSBleHRlbnNpb24gb2YgdGhlIGJhY2t1cCBmaWxlcyBjcmVhdGVkIGJ5IHRoZQogIDpjb21tYW5kOmBhdXRvcG9zdGdyZXNxbGJhY2t1cGAgc2NyaXB0IGNhbiBiZSBjb25maWd1cmVkIHZpYSBhIGRlZmF1bHQKICB2YXJpYWJsZS4gVGhpcyBjaGFuZ2UgbWlnaHQgY2F1c2UgZXhpc3RpbmcgaW5zdGFsbGF0aW9ucyB0byBjaGFuZ2UgdGhlIGZpbGUKICBleHRlbnNpb24gdXNlZCBkdXJpbmcgYmFja3Vwcy4KCjpyZWY6YGRlYm9wcy5wcm9jX2hpZGVwaWRgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJwoKLSBUaGUgcm9sZSB3aWxsIGNoZWNrIGlmIHRoZSBob3N0IGlzIGluIHRoZSBgYGRlYm9wc19zZXJ2aWNlX2xpYnZpcnRkYGAgQW5zaWJsZQogIGludmVudG9yeSBncm91cCwgb3IgaWYgdGhlIDpyZWY6YGRlYm9wcy5saWJ2aXJ0ZGAgcm9sZSB3YXMgYXBwbGllZCBvbiB0aGUKICBob3N0IGFuZCB3aWxsIGNoYW5nZSB0aGUgYGBoaWRlcGlkPWBgIHZhbHVlIHRvIGBgMGBgIHRvIGF2b2lkIGlzc3VlcyB3aXRoCiAgUG9sa2l0IHN1YnN5c3RlbS4KCjpyZWY6YGRlYm9wcy5yc3lzbG9nYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycnCgotIFRoZSBsb2cgcm90YXRpb24gY29uZmlndXJhdGlvbiBmb3IgbG9ncyBtYW5hZ2VkIGJ5IDpjb21tYW5kOmByc3lzbG9nYCBub3cgaGFzCiAgYW4gdXBwZXIgc2l6ZSBsaW1pdCBvZiAxIEdCIHRvIHRyaWdnZXIgdGhlIHJvdGF0aW9uLiBUaGlzIHNob3VsZCBoZWxwIGluCiAgY2FzZXMgd2hlbiB0aGVzZSBsb2dzIGFyZSBncm93aW5nIHJhcGlkbHksIGJ1dCB0aGUgcm90YXRpb24gcGVyaW9kIGlzIHRvbwogIGxhcmdlIHRvIGF2b2lkIGZpbGxpbmcgdXAgZGlzayBzcGFjZS4KCjpyZWY6YGRlYm9wcy56YWJiaXhfYWdlbnRgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJwoKLSBUaGUgZmFjdCBzY3JpcHQgbm93IHN1cHBvcnRzIGJvdGggdGhlIG9sZCBaYWJiaXggQWdlbnQsIGFuZCB0aGUgbmV3IFphYmJpeAogIEFnZW50IDIgY29uZmlndXJhdGlvbiBmaWxlcy4KCkZpeGVkCn5+fn5+Cgo6cmVmOmBkZWJvcHMuZHBrZ19jbGVhbnVwYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycKCi0gVmFyaW91cyBZQU1MIGxpc3RzIHVzZWQgaW4gdGhlIHBhY2thZ2UgcmVtb3ZhbCBzY3JpcHQgd2lsbCBiZSBzb3J0ZWQgYXQgSmluamEKICBsZXZlbCB0byBhdm9pZCBjb25zdGFudCByZW9yZGVyaW5nIG9mIGxpc3QgZWxlbWVudHMgZHVyaW5nIEFuc2libGUgZXhlY3V0aW9uCiAgd2hpY2ggbWFrZXMgdGhlIHJvbGUgbm90IGlkZW1wb3RlbnQuCgo6cmVmOmBkZWJvcHMuZ2l0bGFiYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycKCi0gRml4ZWQgYW4gaXNzdWUgd2l0aCB0aGUgOmZpbGU6YC9ldGMvZ2l0bGFiL3NzbC9gIGRpcmVjdG9yeSBjaGFuZ2luZyBpdHMgbW9kZQogIGZyb20gMDc3NSBzZXQgYnkgdGhlIHJvbGUgdG8gMDc1NSBzZXQgYnkgdGhlIDpjb21tYW5kOmBnaXRsYWItY3RsCiAgcmVjb25maWd1cmVgIGNvbW1hbmQsIG1ha2luZyB0aGUgcm9sZSBub3QgaWRlbXBvdGVudC4KCjpyZWY6YGRlYm9wcy5ncnViYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnCgotIEZpeGVkIGFuIGlzc3VlIHdpdGggdGhlIDpmaWxlOmAwMV91c2Vyc2AgY29uZmlndXJhdGlvbiBmaWxlIGdlbmVyYXRpbmcgZXJyb3JzCiAgYW5kIHJlc3VsdGluZyBpbiBhbiBlbXB0eSB1c2VyIHNlY3Rpb24gaW4gdGhlIGNvbmZpZ3VyYXRpb24gZ2VuZXJhdGVkIGJ5IHRoZQogIDpjb21tYW5kOmB1cGRhdGUtZ3J1YmAgY29tbWFuZC4KCjpyZWY6YGRlYm9wcy5pZnVwZG93bmAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnJycnJycKCi0gRml4ZWQgYW4gaXNzdWUgd2l0aCB0aGUgOmZpbGU6YGlmdXAtYWxsb3ctYm9vdC5zZXJ2aWNlYCA6Y29tbWFuZDpgc3lzdGVtZGAKICB1bml0IG5vdCBzdGFydGluZyBjb3JyZWN0bHkgb24gYm9vdCBkdWUgdG8gaXNzdWVzIHdpdGggdGhlIGBgJGBgIGNoYXJhY3RlcgogIGVzY2FwaW5nLgoKOnJlZjpgZGVib3BzLmx4Y2Agcm9sZQonJycnJycnJycnJycnJycnJycnJycnCgotIFRoZSByb2xlIHdpbGwgYnkgZGVmYXVsdCBkaXNhYmxlIE5GdGFibGVzIGludGVncmF0aW9uIHdpdGhpbiB0aGUKICA6Y29tbWFuZDpgbHhjLW5ldGAgc2NyaXB0LCBjb25maWd1cmFibGUgdmlhIGEgZGVmYXVsdCB2YXJpYWJsZS4gVGhpcyBmaXhlcwogIHVzYWdlIG9mIExYQyBjb250YWluZXJzIG9uIERlYmlhbiBCb29rd29ybSB3aXRoIHRoZSA6Y29tbWFuZDpgZmVybWAgc2VydmljZQogIHVzZWQgYnkgRGViT3BzLgoKOnJlZjpgZGVib3BzLmx4ZGAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnCgotIEZpeGVkIGFuIGlzc3VlIHdpdGggdGhlIGRlZmF1bHQgTFhEIGRhZW1vbiBwcmVzZWVkIGNvbmZpZ3VyYXRpb24gYnkgcmVtb3ZpbmcKICB0aGUgdW5zdXBwb3J0ZWQgYGBtYW5hZ2VkYGAgcGFyYW1ldGVyLiBUaGlzIHNob3VsZCBhbGxvdyB0aGUgTFhEIGRhZW1vbiB0byBiZQogIGluaXRpYWxpemVkIGNvcnJlY3RseS4KCi0gRml4ZWQgYW4gaXNzdWUgd2l0aCB0aGUgcm9sZSB0cnlpbmcgdG8gY29weSB0aGUgc291cmNlLWJ1aWx0IGxpYnJhcmllcyB3aGVuCiAgYW4gQVBULWJhc2VkIGluc3RhbGxhdGlvbiBpcyB1c2VkLiBUaGUgcm9sZSB3aWxsIGNoZWNrIGlmIHRoZSBsaWJyYXJpZXMgZXhpc3QKICBiZWZvcmUgdHJ5aW5nIHRvIGNvcHkgdGhlbS4KCi0gRml4ZWQgYW4gaXNzdWUgb24gRGViaWFuIEJvb2t3b3JtIHdoZXJlIHRoZSA6Y29tbWFuZDpgbHhkLWFwcGFybW9yLWxvYWRgCiAgYmluYXJ5IGlzIG5vdCBwcmVzZW50IHdoZXJlIHRoZSBBUFQtYmFzZWQgTFhEIGRhZW1vbiBleHBlY3RzIGl0LiBUaGUgcm9sZQogIHdpbGwgY3JlYXRlIGEgc3ltbGluayBmb3IgdGhpcyBiaW5hcnkgd2hlbiBuZWVkZWQuCgo6cmVmOmBkZWJvcHMubmV0d29ya2RgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnJycnCgotIERvIG5vdCByZXN0YXJ0IHRoZSA6Y29tbWFuZDpgc3lzdGVtZC1uZXR3b3JrZGAgc2VydmljZSBpZiB0aGUgcm9sZSBkZXRlY3RzCiAgdGhhdCB0aGUgbmV0d29yayBzdGFjayBpcyBub3QgbWFuYWdlZCBieSBpdC4gVGhpcyBzaG91bGQgYXZvaWQgdGhlIGlzc3VlCiAgd2hlcmUgdGhlIHJvbGUgcGxheWJvb2sgaGFuZ2VkIG9uIGZpcnN0IHJ1biBvZiB0aGUgcm9sZSBvbiBhIGhvc3Qgbm90IG1hbmFnZWQKICBieSA6Y29tbWFuZDpgc3lzdGVtZC1uZXR3b3JrZGAgc2VydmljZS4KCjpyZWY6YGRlYm9wcy5udHBgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJwoKLSBGaXhlZCBhbiBpc3N1ZSB3aXRoIGNvbmRpdGlvbmFsIGNoZWNrIGZvciBMaW51eCBjYXBhYmlsaXRpZXMgbm90IGJlaW5nCiAgY2hlY2tlZCByZWxpYWJseSB0byBkZWNpZGUgaWYgTlRQIHN1cHBvcnQgc2hvdWxkIGJlIGVuYWJsZWQuIFRoZSByb2xlIHNob3VsZAogIG5vdyBjb3JyZWN0bHkgZGV0ZWN0IHdoZW4gTGludXggY2FwYWJpbGl0aWVzIGFyZSBlbmZvcmNlZC4KCjpyZWY6YGRlYm9wcy5yc3lzbG9nYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycnCgotIExpc3Qgb2YgbG9nIGZpbGVzIHdoaWNoIHNob3VsZCBiZSBtYW5hZ2VkIGJ5IHRoZSA6Y29tbWFuZDpgbG9ncm90YXRlYCBzZXJ2aWNlCiAgd2lsbCBiZSBzb3J0ZWQgdG8gYXZvaWQgY29uc3RhbnQgcmVvcmRlcmluZyBkdXJpbmcgcm9sZSBleGVjdXRpb24sIHdoaWNoCiAgZml4ZXMgcm9sZSBpZGVtcG90ZW5jeS4KCjpyZWY6YGRlYm9wcy5zd2FwZmlsZWAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnJycnJycKCi0gRml4ZWQgYW4gaXNzdWUgaW4gdGhlIDpjb21tYW5kOmBzd2Fwb25gIHRhc2sgY29uZGl0aW9uYWwgbG9naWMgd2hlcmUgdGhlIHRhc2sKICBjb3VsZCBub3QgYmUgZXhlY3V0ZWQgY29ycmVjdGx5IHdoZW4gdGhlIHN3YXAgZmlsZSB3YXMgbWlzc2luZy4KCi0gRW5zdXJlIHRoYXQgdGhlIHN3YXAgZmlsZSBpcyBjb3JyZWN0bHkgZGlzYWJsZWQgYnkgdGhlIDpjb21tYW5kOmBzd2Fwb2ZmYAogIGNvbW1hbmQgYmVmb3JlIGJlaW5nIHJlbW92ZWQgd2l0aCB0aGUgYGBhYnNlbnRgYCBzdGF0ZS4KClJlbW92ZWQKfn5+fn5+fgoKOnJlZjpgZGVib3BzLmlweGVgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycKCi0gRGViaWFuIDkgKFN0cmV0Y2gpIGhhcyBiZWVuIHJlbW92ZWQgZnJvbSBEZWJpYW4gbWlycm9ycywgdGhlcmVmb3JlIHRoZSByb2xlCiAgd2lsbCBubyBsb25nZXIgb2ZmZXIgc3VwcG9ydCBmb3IgaW5zdGFsbGluZyBEZWJpYW4gU3RyZXRjaCB2aWEgUFhFIGJvb3QuCgpgZGVib3BzIHYzLjEuMGBfIC0gMjAyMy0xMS0yOQotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQoKLi4gX2RlYm9wcyB2My4xLjA6IGh0dHBzOi8vZ2l0aHViLmNvbS9kZWJvcHMvZGVib3BzL2NvbXBhcmUvdjMuMC4wLi4udjMuMS4wCgpBZGRlZAp+fn5+fgoKTmV3IERlYk9wcyByb2xlcwonJycnJycnJycnJycnJycnCgotIFRoZSA6cmVmOmBkZWJvcHMubWV0cmljYmVhdGAgcm9sZSwgcGFydCBvZiB0aGUgRWxhc3RpYyBzdGFjaywgY2FuIGJlIHVzZWQgdG8KICBpbnN0YWxsIGBNZXRyaWNiZWF0YF9fLCBhIHNlcnZpY2UgdGhhdCBjYW4gZ2F0aGVyIG1ldHJpY3MgYW5kIG90aGVyIG5vbi1sb2cKICBkYXRhIGZyb20gb3RoZXIgc2VydmljZXMgYW5kIHNlbmQgdGhlbSB0byBFbGFzdGljc2VhcmNoIGZvciBwcm9jZXNzaW5nLgoKICAuLiBfXzogaHR0cHM6Ly93d3cuZWxhc3RpYy5jby9iZWF0cy9tZXRyaWNiZWF0CgotIFRoZSA6cmVmOmBkZWJvcHMub3BlbnNlYXJjaGAgcm9sZSBjYW4gYmUgdXNlZCB0byBzZXQgdXAgYW4gdW5zZWN1cmVkLAogIGxvY2FsLW9ubHkgaW5zdGFsbGF0aW9uIG9mIGBPcGVuU2VhcmNoYF9fLiBPcGVuU2VhcmNoIGlzIGEgZm9yayBvZgogIEVsYXN0aWNzZWFyY2ggdGhhdCBjb250aW51ZXMgdG8gYmUgcmVsZWFzZWQgdW5kZXIgYSBmcmVlIHNvZnR3YXJlIGxpY2Vuc2UuCgogIC4uIF9fOiBodHRwczovL29wZW5zZWFyY2gub3JnLwoKLSBUaGUgOnJlZjpgZGVib3BzLnJlYm9vdGAgcm9sZSBjYW4gYmUgdXNlZCB0byByZWJvb3QsIGZvcmNlZnVsbHkgb3Igb25seSBpZgogIHJlcXVpcmVkLCBhbnkgRGViT3BzIGhvc3QuCgotIFRoZSA6cmVmOmBkZWJvcHMubWluaWZsdXhgIHJvbGUgY2FuIGluc3RhbGwgYW5kIG1hbmFnZSBNaW5pZmx1eCwgYSB3ZWItYmFzZWQsCiAgbWluaW1hbGlzdGljIGZlZWQgcmVhZGVyIHdyaXR0ZW4gaW4gR28uCgotIFRoZSA6cmVmOmBkZWJvcHMuc3lzdGVtZGAgcm9sZSBpcyBpbmNsdWRlZCBpbiB0aGUgY29tbW9uIHBsYXlib29rIGJ5IGRlZmF1bHQuCiAgSXQgY29uZmlndXJlcyB0aGUgOmNvbW1hbmQ6YHN5c3RlbWRgIHN5c3RlbSBhbmQgc2VydmljZSBtYW5hZ2VyLiBCb3RoCiAgc3lzdGVtLXdpZGUsIGFzIHdlbGwgYXMgdXNlciBzZXJ2aWNlcyBjb25maWd1cmVkIGdsb2JhbGx5IGNhbiBiZSBtYW5hZ2VkIHdpdGgKICB0aGlzIHJvbGUuCgotIFRoZSA6cmVmOmBkZWJvcHMubmV0d29ya2RgIHJvbGUgY2FuIGJlIHVzZWQgdG8gY29uZmlndXJlIHRoZQogIDpjb21tYW5kOmBzeXN0ZW1kLW5ldHdvcmtkYCBzZXJ2aWNlLCBwYXJ0IG9mIHRoZSA6Y29tbWFuZDpgc3lzdGVtZGAgcHJvamVjdAogIHJlc3BvbnNpYmxlIGZvciBuZXR3b3JrIGludGVyZmFjZSBjb25maWd1cmF0aW9uLgoKLSBUaGUgOnJlZjpgZGVib3BzLnRpbWVzeW5jZGAgcm9sZSBpcyB1c2VkIHRvIGNvbmZpZ3VyZSB0aGUKICA6Y29tbWFuZDpgc3lzdGVtZC10aW1lc3luY2RgIHNlcnZpY2UsIGEgbWluaW1hbCBTTlRQL05UUCBjbGllbnQuIFRoZSByb2xlIGlzCiAgaW5jbHVkZWQgaW4gdGhlIDpmaWxlOmBsYXllci9jb21tb24ueW1sYCBwbGF5Ym9vayBpbnN0ZWFkIG9mIHRoZQogIDpyZWY6YGRlYm9wcy5udHBgIHJvbGUgdG8gcHJvdmlkZSBOVFAgc3VwcG9ydCBieSBkZWZhdWx0LgoKLSBUaGUgOnJlZjpgZGVib3BzLnJlc29sdmVkYCByb2xlIGlzIGluY2x1ZGVkIGluIHRoZSA6ZmlsZTpgbGF5ZXIvY29tbW9uLnltbGAKICBwbGF5Ym9vayBieSBkZWZhdWx0LCByZXBsYWNpbmcgdGhlIDpyZWY6YGRlYm9wcy5yZXNvbHZjb25mYCByb2xlLiBJdCBtYW5hZ2VzCiAgdGhlIDpjb21tYW5kOmBzeXN0ZW1kLXJlc29sdmVkYCBzZXJ2aWNlLCBhIGxvY2FsIEROUyByZXNvbHZlci4KCi0gVGhlIDpyZWY6YGRlYm9wcy5iaW5kYCByb2xlIGlzIHJlc3BvbnNpYmxlIGZvciBpbnN0YWxsaW5nIGFuZCBtYW5hZ2luZyB0aGUKICBJU0MgQklORCBuYW1lc2VydmVyLiBJdCBzdXBwb3J0cyBETlNTRUMsIGtleSByb2xsb3ZlcnMsIG11bHRpcGxlIEROUyB6b25lcywKICB2aWV3cyBhbmQgbWFueSBtb3JlIGZlYXR1cmVzLgoKLSBUaGUgOnJlZjpgZGVib3BzLmFwcGFybW9yYCByb2xlIGNhbiBiZSB1c2VkIHRvIG1hbmFnZSBBcHBBcm1vciBjb25maWd1cmF0aW9uCiAgYW5kIHByb2ZpbGVzLiBJdCB3aWxsIGJlIGluY2x1ZGVkIGluIHRoZSA6ZmlsZTpgbGF5ZXIvY29tbW9uLnltbGAgcGxheWJvb2sgaW4KICB0aGUgZnV0dXJlLgoKLSBUaGUgOnJlZjpgZGVib3BzLmFwdF9taXJyb3JgIHJvbGUgY2FuIGJlIHVzZWQgdG8gY3JlYXRlIGEgbWlycm9yIG9mIG9uZSBvcgogIG11bHRpcGxlIEFQVCByZXBvc2l0b3JpZXMgYW5kIHB1Ymxpc2ggdGhlbSBmb3Igb3RoZXIgaG9zdHMgdG8gdXNlIGFzIHBhY2thZ2UKICBzb3VyY2UuCgpHZW5lcmFsCicnJycnJycKCi0gRGViT3BzIG5vdyBpbmNsdWRlcyBhIGN1c3RvbSB2ZXJzaW9uIG9mIHRoZQogIGBgY29tbXVuaXR5LmdlbmVyYWwuYXBhY2hlMl9tb2R1bGVgYCBBbnNpYmxlIG1vZHVsZSwgYXZhaWxhYmxlIGFzCiAgYGBkZWJvcHMuZGVib3BzLmFwYWNoZTJfbW9kdWxlYGAuIFRoZSBjdXN0b20gbW9kdWxlIGluY2x1ZGVzIGEgZml4ZWQKICBpZGVtcG90ZW5jeSBjaGVjayBmb3IgZW5hYmxlZCBBcGFjaGUgMiBtb2R1bGVzIHRoYXQgd29ya3Mgb24gRGViaWFuIG9yIFVidW50dQogIGhvc3RzLiBUaGUgOnJlZjpgZGVib3BzLmFwYWNoZWAgQW5zaWJsZSByb2xlIHdpbGwgdXNlIHRoaXMgbW9kdWxlIGluc3RlYWQgb2YKICB0aGUgb3JpZ2luYWwgb25lLgoKLSBUaGUgOmNvbW1hbmQ6YGRlYm9wcyBleGVjYCBjb21tYW5kIGNhbiBiZSB1c2VkIHRvIGV4ZWN1dGUgQW5zaWJsZSBtb2R1bGVzCiAgYWdhaW5zdCBob3N0cyBpbiB0aGUgcHJvamVjdCBkaXJlY3Rvcnk7IHRoaXMgaXMgYSB3cmFwcGVyIGZvciB0aGUKICA6Y29tbWFuZDpgYW5zaWJsZWAgY29tbWFuZC4KCi0gVGhlIDpjb21tYW5kOmBkZWJvcHMgcnVuYCwgOmNvbW1hbmQ6YGRlYm9wcyBjaGVja2AgYW5kIDpjb21tYW5kOmBkZWJvcHMgZXhlY2AKICBjb21tYW5kcyBjYW4gZW1pdCBBU0NJSSAiYmVsbCIgYXQgdGhlIGVuZCBvZiBBbnNpYmxlIGV4ZWN1dGlvbiB0byBub3RpZnkgdXNlcgogIGFmdGVyIGxvbmcgcnVucy4gVXNlIHRoZSBgYC1FYGAgb3IgYGAtLWJlbGxgYCBvcHRpb24gdG8gZW5hYmxlIHRoaXMuCgotIFRoZSA6Y29tbWFuZDpgZGVib3BzIGVudmAgY29tbWFuZCBjYW4gYmUgdXNlZCB0byBpbnNwZWN0IHRoZSBydW50aW1lCiAgZW52aXJvbm1lbnQgdmFyaWFibGVzIHByZXNlbnQgd2hlbiBvdGhlciBEZWJPcHMgY29tbWFuZHMgYXJlIHVzZWQsIGFzIHdlbGwgYXMKICBleGVjdXRlIGV4dGVybmFsIGNvbW1hbmRzIGluc2lkZSBvZiB0aGF0IHJ1bnRpbWUgZW52aXJvbm1lbnQuIFRoaXMgaXMgaGFuZHkKICBmb3IgdXNpbmcgdmFyaW91cyA6Y29tbWFuZDpgYW5zaWJsZS0qYCBjb21tYW5kcyB3aXRoaW4gRGViT3BzIHByb2plY3QKICBkaXJlY3Rvcmllcy4KCi0gRGViT3BzIG1vbm9yZXBvIG5vdyBpbmNsdWRlcyBjb25maWd1cmF0aW9uIGZvciB0aGUgYHByZS1jb21taXRgX18gaG9vayB0bwogIHZlcmlmeSBjaGFuZ2VzIGJlZm9yZSB0aGV5IGFyZSBjb21taXR0ZWQgdG8gdGhlIHJlcG9zaXRvcnkuIE11bHRpcGxlIGNoZWNrcwogIGFyZSBwZXJmb3JtZWQsIG5vdGFibHkgYGNvZGVzcGVsbGBfXyBpcyB1c2VkIHRvIGZpbmQgc3BlbGxpbmcgbWlzdGFrZXMuIE1vcmUKICBjaGVja3Mgd2lsbCBiZSBlbmFibGVkIGluIHRoZSBmdXR1cmUuCgogIC4uIF9fOiBodHRwczovL3ByZS1jb21taXQuY29tLwogIC4uIF9fOiBodHRwczovL2dpdGh1Yi5jb20vY29kZXNwZWxsLXByb2plY3QvY29kZXNwZWxsCgotIE5ldyBwcm9qZWN0IGRpcmVjdG9yeSBsYXlvdXQgY2FsbGVkICJtb2Rlcm4iIGhhcyBiZWVuIGltcGxlbWVudGVkIGluIERlYk9wcwogIHNjcmlwdHMuIEl0IGNhbiBiZSBjcmVhdGVkIHVzaW5nIHRoZSBjb21tYW5kOgoKICAuLiBjb2RlLWJsb2NrOjogY29uc29sZQoKICAgICBkZWJvcHMgcHJvamVjdCBpbml0IC10IG1vZGVybiA8cHJvamVjdD4KCiAgVGhlIG1vZGVybiBwcm9qZWN0IGxheW91dCBzdXBwb3J0cyBtdWx0aXBsZSBBbnNpYmxlIGludmVudG9yaWVzIGVuY2Fwc3VsYXRlZAogIGludG8gOnJlZjpgaW5mcmFzdHJ1Y3R1cmUgdmlld3MgPHByb2plY3RfaW5mcmFzdHJ1Y3R1cmVfdmlld3M+YC4KCi0gRGViT3BzIHNjcmlwdHMgbm93IHN1cHBvcnQgbWFuYWdlbWVudCBvZiB0aGUgcHJvamVjdCBkaXJlY3RvcmllcyB1c2luZwogIDpjb21tYW5kOmBnaXRgIGFzIFZDUyByZXBvc2l0b3JpZXMuIE5ldyBwcm9qZWN0IGRpcmVjdG9yaWVzIHdpbGwgdXNlCiAgOmNvbW1hbmQ6YGdpdGAgYnkgZGVmYXVsdC4gVGhpcyBhbHNvIGVuYWJsZXMgc3VwcG9ydCBmb3Igc2VjcmV0cyBlbmNyeXB0ZWQKICB1c2luZyA6Y29tbWFuZDpgZ2l0LWNyeXB0YC4KCjpyZWY6YGRlYm9wcy5hcHRgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJwoKLSBUaGUgcm9sZSBub3cgc3VwcG9ydHMgbWFuYWdlbWVudCBvZiB0aGUgIkRlYjgyMiIgZm9ybWF0IG9mIHRoZSBBUFQgcmVwb3NpdG9yeQogIHNvdXJjZXMuCgo6cmVmOmBkZWJvcHMuYXZhaGlgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnCgotIFRoZSByb2xlIHdpbGwgZW5zdXJlIHRoYXQgdGhlIDpjb21tYW5kOmBzeXN0ZW1kLXJlc29sdmVkYCBzZXJ2aWNlIE11bHRpY2FzdAogIEROUyBzdXBwb3J0IGlzIGRpc2FibGVkIHRvIGF2b2lkIGNvbmZsaWN0IHdpdGggdGhlIDpjb21tYW5kOmBhdmFoaS1kYWVtb25gCiAgc2VydmljZS4KCjpyZWY6YGRlYm9wcy5mZXJtYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnCgotIE11bHRpY2FzdCBETlMgdHJhZmZpYyBpcyBhY2NlcHRlZCBieSBkZWZhdWx0IGluIHRoZSBmaXJld2FsbCB0byBhbGxvdyBmb3IgdGhlCiAgYGAubG9jYWxgYCBtRE5TIGRvbWFpbiByZXNvbHV0aW9uIGJ5IHRoZSA6Y29tbWFuZDpgc3lzdGVtZC1yZXNvbHZlZGAgc2VydmljZS4KICBUaGUgcm9sZSBwcm92aWRlcyBhIHNldCBvZiB2YXJpYWJsZXMgdG8gbGltaXQgdGhlIHRyYWZmaWMgYnkgc3VibmV0LCBvcgogIGRpc2FibGUgaXQgY29tcGxldGVseS4KCjpyZWY6YGRlYm9wcy5pY2luZ2Ffd2ViYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycnJycnCgotIFRoZSByb2xlIGNhbiBub3cgY3JlYXRlIGhvc3QgYW5kIHNlcnZpY2UgdGVtcGxhdGVzIHVzaW5nIEljaW5nYSBEaXJlY3RvciBBUEkuCiAgVGhpcyBzaG91bGQgaW1wcm92ZSB0aGUgaW5pdGlhbCBkZXBsb3ltZW50IGV4cGVyaWVuY2UsIHNpbmNlIHVzZXJzIGRvbid0IG5lZWQKICB0byBjcmVhdGUgYmFzaWMgaG9zdCB0ZW1wbGF0ZXMgYnkgaGFuZCBiZWZvcmUgcmVnaXN0ZXJpbmcgaG9zdHMgaW4gSWNpbmdhLgoKOnJlZjpgZGVib3BzLmlweGVgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycKCi0gVGhlIERlYmlhbiBJbnN0YWxsZXIgTWVudSBjYW4gbm93IGluc3RhbGwgRGViaWFuIEdOVS9MaW51eCAxMiAoQm9va3dvcm0pLgoKOnJlZjpgZGVib3BzLmphdmFgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycKCi0gVGhlIHJvbGUgd2lsbCBub3cgY29uZmlndXJlIHRoZSBkZWZhdWx0IHNlY3VyaXR5IHBvbGljeSBmb3IgSmF2YQogIGFwcGxpY2F0aW9ucy4gVGhlIGFkZGl0aW9ucyB3aWxsIHBlcm1pdCBKYXZhIGFwcGxpY2F0aW9ucyB0byBhY2Nlc3MgdGhlCiAgc3lzdGVtLXdpZGUgQ0EgY2VydGlmaWNhdGUgc3RvcmUgaW4gOmZpbGU6YC9ldGMvc3NsL2NlcnRzL2AgZGlyZWN0b3J5IGFzIHdlbGwKICBhcyB0aGUgUEtJIGluZnJhc3RydWN0dXJlIG1hbmFnZWQgYnkgdGhlIDpyZWY6YGRlYm9wcy5wa2lgIHJvbGUsIHNvIHRoYXQgSmF2YQogIGFwcGxpY2F0aW9ucyBjYW4gdXNlIHRoZSBleGlzdGluZyBYLjUwOSBjZXJ0aWZpY2F0ZXMgYW5kIHByaXZhdGUga2V5cyBmb3IgVExTCiAgZW5jcnlwdGlvbiBzdXBwb3J0LgoKOnJlZjpgZGVib3BzLmtleXJpbmdgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnJycKCi0gVGhlIHJvbGUgY2FuIG5vdyBkb3dubG9hZCBBUFQgcmVwb3NpdG9yeSBHUEcga2V5cyB0byBzZXBhcmF0ZSBrZXlyaW5nIGZpbGVzLAogIHdoaWNoIGNhbiBiZSB1c2VkIHRvIHNjb3BlIGEgZ2l2ZW4gR1BHIGtleSB0byBzcGVjaWZpYyBBUFQgcmVwb3NpdG9yaWVzLgoKOnJlZjpgZGVib3BzLmtpYmFuYWAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnJycnCgotIFRoZSByb2xlIGNhbiBub3cgbWFuYWdlIHBhc3N3b3JkcyBhbmQgb3RoZXIgY29uZmlkZW50aWFsIGRhdGEgc3RvcmVkIGluIHRoZQogIEtpYmFuYSBrZXlzdG9yZS4KCjpyZWY6YGRlYm9wcy5tb3VudGAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnJycKCi0gVGhlIHJvbGUgY2FuIG5vdyBjcmVhdGUgY3VzdG9tIGZpbGVzIHdoaWNoIGNhbiBiZSB1c2VkIHRvIHN0b3JlIGNyZWRlbnRpYWxzCiAgcmVxdWlyZWQgdG8gbW91bnQgcmVtb3RlIGRldmljZXMuCgo6cmVmOmBkZWJvcHMubmV0Ym94YCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycKCi0gVGhlIHJvbGUgd2lsbCBlbmFibGUgTERBUCBzdXBwb3J0IGluIE5ldEJveCBpZiBMREFQIGVudmlyb25tZW50IG1hbmFnZWQgYnkKICB0aGUgOnJlZjpgZGVib3BzLmxkYXBgIHJvbGUgaXMgZGV0ZWN0ZWQgb24gdGhlIGhvc3QuIEN1cnJlbnRseSBvbmx5IHVzZXIKICBhdXRoZW50aWNhdGlvbiBhbmQgRGphbmdvIEFDTCBzeXN0ZW0gaXMgc3VwcG9ydGVkIHZpYSBMREFQIGdyb3Vwcy4KCjpyZWY6YGRlYm9wcy5uZ2lueGAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnJycKCi0gVGhlIHNlcnZlciBjb25maWd1cmF0aW9uIGZpbGVzIGNhbiBub3cgY29udGFpbiA6Y29tbWFuZDpgbmdpbnhgIGNvbmZpZ3VyYXRpb24KICBvdXRzaWRlIG9mIHRoZSBgYHNlcnZlcmBgIGFuZCBgYHVwc3RyZWFtYGAgYmxvY2tzIHVzaW5nIHRoZSBuZXcKICBgYGl0ZW0udG9wbGV2ZWxfb3B0aW9uc2BgIHBhcmFtZXRlci4KCjpyZWY6YGRlYm9wcy5vd25jbG91ZGAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnJycnJycKCi0gU3VwcG9ydCB0byBob3N0IHRoZSBhcHBsaWNhdGlvbiBvbiBhIHN1YnBhdGggZm9yIHNlY3VyaXR5IHJlYXNvbnMuCgo6cmVmOmBkZWJvcHMucHl0aG9uYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycKCi0gVGhlIDpmaWxlOmBzZXJ2aWNlL3B5dGhvbl9yYXdgIHBsYXlib29rIHVzZWQgZHVyaW5nIGVhcmx5IGJvb3RzdHJhcCBwcm9jZXNzCiAgY2FuIG5vdyBpbmplY3QgaG9zdCBlbnRyaWVzIGludG8gdGhlIDpmaWxlOmAvZXRjL2hvc3RzYCBjb25maWd1cmF0aW9uIGZpbGUgdG8KICBwZXJtaXQgRE5TIG5hbWUgcmVzb2x1dGlvbiBlYXJseSBkdXJpbmcgYm9vdHN0cmFwcGluZy4KCjpyZWY6YGRlYm9wcy5yZXNvdXJjZXNgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnJycnJwoKLSBUaGUgOnJlZjpgZGVib3BzLnJlc291cmNlc2Agcm9sZSBjYW4gbm93IGJlIHVzZWQgdG8gaW5zdGFsbCBwaXAgbGlicmFyeQogIGRlcGVuZGVuY2llcyBvciB2aXJ0dWFsIGVudmlyb25tZW50cyB2aWEgdGhlIGBgYW5zaWJsZS5idWlsdGluLnBpcGBgCiAgbW9kdWxlLgoKLSBUaGUgOnJlZjpgZGVib3BzLnJlc291cmNlc2Agcm9sZSBjYW4gbm93IGJlIHVzZWQgdG8gcmVwbGFjZSBhIGxpbmUgdmlhIHRoZQogIGBgYW5zaWJsZS5idWlsdGluLnJlcGxhY2VgYCBtb2R1bGUuCgo6cmVmOmBkZWJvcHMuc2xhcGRgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnCgotIFRoZSBwbGF5Ym9vayBjYW4gbm93IGJlIGNvbmZpZ3VyZWQgdG8gc2tpcCB0aGUgc2FzbGF1dGhkIHJvbGUgZXhlY3V0aW9uLgoKOnJlZjpgZGVib3BzLnphYmJpeF9hZ2VudGAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnCgotIFRoZSByb2xlIG5vdyBzdXBwb3J0cyBtYW5hZ2VtZW50IG9mIFphYmJpeCBBZ2VudCAod3JpdHRlbiBpbiBDKSBhcyB3ZWxsIGFzCiAgWmFiYml4IEFnZW50IDIgKHdyaXR0ZW4gaW4gR28pLCBhdmFpbGFibGUgaW4gRGViaWFuIHJlcG9zaXRvcmllcy4gT25seSBvbmUKICBmbGF2b3IgY2FuIGJlIG1hbmFnZWQgYXQgYSB0aW1lLCBidXQgcm9sZSBwcm92aWRlcyBhbiBlYXN5IHdheSB0byBzd2l0Y2gKICBiZXR3ZWVuIHRoZSB0d28gZmxhdm9ycy4KCkNoYW5nZWQKfn5+fn5+fgoKVXBkYXRlcyBvZiB1cHN0cmVhbSBhcHBsaWNhdGlvbiB2ZXJzaW9ucwonJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnCgotIEluIHRoZSA6cmVmOmBkZWJvcHMucm91bmRjdWJlYCByb2xlLCB0aGUgUm91bmRjdWJlIHZlcnNpb24gaW5zdGFsbGVkIGJ5CiAgZGVmYXVsdCBoYXMgYmVlbiB1cGRhdGVkIHRvIGBgMS42LjBgYC4KCi0gSW4gdGhlIDpyZWY6YGRlYm9wcy5pcHhlYCByb2xlLCB0aGUgRGViaWFuIEJ1c3RlciBuZXRib290IGluc3RhbGxlciB2ZXJzaW9uCiAgaGFzIGJlZW4gdXBkYXRlZCB0byB0aGUgbmV4dCBwb2ludCByZWxlYXNlLCAxMC4xMy4gRGViaWFuIEJ1bGxzZXllIGhhcyBiZWVuCiAgdXBkYXRlZCB0byB0aGUgbmV4dCBwb2ludCByZWxlYXNlIGFzIHdlbGwsIDExLjguIFRoZSBEZWJpYW4gQm9va3dvcm0gcmVsZWFzZQogIGhhcyBiZWVuIHVwZGF0ZWQgdG8gMTIuMi4KCi0gSW4gdGhlIDpyZWY6YGRlYm9wcy5uZXRib3hgIHJvbGUsIHRoZSBOZXRCb3ggdmVyc2lvbiBoYXMgYmVlbiB1cGRhdGVkIHRvCiAgYGB2My40LjJgYC4KCi0gSW4gdGhlIDpyZWY6YGRlYm9wcy5vd25jbG91ZGAgcm9sZSwgdGhlIG93bkNsb3VkIHN1cHBvcnQgaGFzIGJlZW4gdXBkYXRlZCB0bwogIGBgdjEwLjEwYGAuCgotIEluIHRoZSA6cmVmOmBkZWJvcHMub3duY2xvdWRgIHJvbGUsIHRoZSBOZXh0Y2xvdWQgc3VwcG9ydCBoYXMgYmVlbiB1cGRhdGVkIHRvCiAgYGB2MjQuMGBgIGFuZCBgYHYyNS4wYGAuCgpHZW5lcmFsCn5+fn5+fn4KCi0gVGFza3Mgd2hpY2ggdXNlIG1vZHVsZXMgYW5kIHBsdWdpbnMgZnJvbSB0aGUgYGBhbnNpYmxlLmJ1aWx0aW5gYCBBbnNpYmxlCiAgQ29sbGVjdGlvbiBoYXZlIGJlZW4gdXBkYXRlZCB0byByZWZlciB0byB0aGVtIHZpYSB0aGVpciBGdWxseSBRdWFsaWZpZWQKICBDb2xsZWN0aW9uIE5hbWVzIChmb3IgZXhhbXBsZSBgYGFuc2libGUuYnVpbHRpbi5maWxlYGAgaW5zdGVhZCBvZiBgYGZpbGVgYCkuCiAgVGhpcyBpcyBkdWUgdG8gY2hhbmdpbmcgcmVxdWlyZW1lbnRzIG9mIHRoZSA6Y29tbWFuZDpgYW5zaWJsZS1saW50YCB0b29sLgoKICBOZXcgc3VibWlzc2lvbnMgdG8gdGhlIERlYk9wcyBwcm9qZWN0IHdpbGwgYmUgcmVxdWlyZWQgdG8gdXNlIHRoZSBGUUNOcyBhcwogIHdlbGwuCgotIFZhcmlvdXMgcm9sZXMgdGhhdCBsb29rdXAgU1NIIHB1YmxpYyBrZXlzIG9uIHRoZSBBbnNpYmxlIENvbnRyb2xsZXIKICAoOnJlZjpgZGVib3BzLnByZXNlZWRgLCA6cmVmOmBkZWJvcHMucmVwcmVwcm9gLCA6cmVmOmBkZWJvcHMuc3lzdGVtX3VzZXJzYCkKICB3aWxsIHRyeSB0byB1c2UgdGhlIDpmaWxlOmB+Ly5zc2gvYXV0aG9yaXplZF9rZXlzYCBmaWxlIHRvIGZpbmQgdGhlIGtleXMgaWYKICBhbGwgb3RoZXIgbWV0aG9kcyBmYWlsLgoKLSBJbiB0aGUgOmZpbGU6YHNpdGUueW1sYCBwbGF5Ym9vaywgdGhlIDpmaWxlOmBzeXMueW1sYCBhbmQgOmZpbGU6YG5ldC55bWxgCiAgcGxheWJvb2tzIHdpbGwgYmUgZXhlY3V0ZWQgYmVmb3JlIHRoZSA6ZmlsZTpgY29tbW9uLnltbGAgcGxheWJvb2suIFRoaXMKICBzaG91bGQgZW5zdXJlIHRoYXQgY29uZmlndXJhdGlvbiBvZiBjZXJ0YWluIHJlc291cmNlcyBsaWtlIG1vdW50IHBvaW50cyBvcgogIExWTSBwb29scyBpcyBwcmVzZW50IGJlZm9yZSB0aGUgc3lzdGVtIGlzIHByZXBhcmVkIGZvciBnZW5lcmFsIG9wZXJhdGlvbi4KCi0gVGhlIDpmaWxlOmBhbnNpYmxlL3BsYXlib29rcy90b29scy9yZWJvb3QueW1sYCBBbnNpYmxlIHBsYXlib29rIGhhcyBiZWVuCiAgbW92ZWQgdG8gOmZpbGU6YGFuc2libGUvcGxheWJvb2tzL3JlYm9vdC55bWxgIGZpbGUgYW5kIHVzZXMgdGhlIG5ldwogIDpyZWY6YGRlYm9wcy5yZWJvb3RgIEFuc2libGUgcm9sZSB0byBwZXJmb3JtIG9wZXJhdGlvbnMuIFRvIHVzZSBpdCwgeW91IGNhbgogIHJ1biB0aGUgYGByZWJvb3RgYCBwbGF5Ym9vayBpbnN0ZWFkIG9mIGBgdG9vbHMvcmVib290YGAuCgotIFRoZSA6ZmlsZTpgYW5zaWJsZS9wbGF5Ym9va3MvdG9vbHMvdXBncmFkZS1yZWJvb3QueW1sYCBBbnNpYmxlIHBsYXlib29rIGhhcwogIGJlZW4gbW92ZWQgdG8gOmZpbGU6YGFuc2libGUvcGxheWJvb2tzL3VwZ3JhZGUueW1sYCBmaWxlIGFuZCB3aWxsIG5vIGxvbmdlcgogIHJlYm9vdCB0aGUgaG9zdCBhdXRvbWF0aWNhbGx5LiBVc2VycyBjYW4gY2hhaW4gdGhlIGBgdXBncmFkZWBgIGFuZCBgYHJlYm9vdGBgCiAgcGxheWJvb2tzIHRvIGFjaGlldmUgdGhlIHByZXZpb3VzIGJlaGF2aW91ciwgZm9yIGV4YW1wbGU6CgogIC4uIGNvZGUtYmxvY2s6OiBjb25zb2xlCgogICAgIGRlYm9wcyBydW4gdXBncmFkZSByZWJvb3QgLWwgPGhvc3Q+CgotIFRoZSBkZWJvcHMtY29udHJpYiA6ZmlsZTpgZHJvcGJlYXJfaW5pdHJhbWZzYCBwbGF5Ym9vayBoYXMgYmVlbiBtb3ZlZCB0bwogIHRoZSA6cmVmOmBkZWJvcHMuZHJvcGJlYXJfaW5pdHJhbWZzYCBwbGF5Ym9vay4gVGhlIHJvbGUgdmFyaWFibGUKICBgYGRyb3BiZWFyX2luaXRyYW1mc19faG9zdF9hdXRob3JpemVkX2tleXNgYCBub3cgdXNlcyB0aGUgc2FtZSBrZXlzIGFzCiAgdGhlIGBgYW5zaWJsZS5wb3NpeC5hdXRob3JpemVkX2tleWBgIG1vZHVsZS4KCi0gVmFyaW91cyB0YXNrcyB0aGF0IGludGVyYWN0IHdpdGggdGhlIE1hcmlhREIvTXlTUUwgZGF0YWJhc2VzIHdpbGwgbm93IHVzZSB0aGUKICA6ZmlsZTpgL3J1bi9teXNxbGQvbXlzcWxkLnNvY2tgIFVOSVggc29ja2V0IHRvIGRvIHNvLCBkdWUgdG8gY2hhbmdlcyBpbgogIE1hcmlhREIgcmVzdHJpY3RpbmcgbG9jYWwgY29ubmVjdGlvbnMgZm9yIHRoZSBgYHJvb3RgYCBVTklYIGFjY291bnQuCgotIFRoZSBIVE1MIGRvY3VtZW50YXRpb24gYnVpbGQgcHJvY2VzcyBoYXMgYmVlbiBpbXByb3ZlZC4gVGhlCiAgOmNvbW1hbmQ6YHlhbWwycnN0YCBzY3JpcHQgd2lsbCBiZSBpbnZva2VkIG9ubHkgd2hlbiBhIGRlZmF1bHRzIGZpbGUgaXMKICBtb2RpZmllZCwgc2lnbmlmaWNhbnRseSBzcGVlZGluZyB1cCBkb2N1bWVudGF0aW9uIHJlYnVpbGRzLiBVc2VycyBjYW4gYWxzbwogIG1vZGlmeSB0aGUgOmNvbW1hbmQ6YHNwaGlueGAgb3B0aW9ucyBzcGVjaWZpZWQgaW4gdGhlIE1ha2VmaWxlIHZpYSBhbgogIGVudmlyb25tZW50IHZhcmlhYmxlIGlmIHRoZXkgd2lzaC4KCi0gVGhlIDpmaWxlOmBhbnNpYmxlL3BsYXlib29rcy90b29scy9kaXN0LXVwZ3JhZGUueW1sYCBBbnNpYmxlIHBsYXlib29rIG5vdyBoYXMKICBNVEEgY29uZmlndXJhdGlvbiBleHBvc2VkIHZpYSB2YXJpYWJsZXMgaW4gY2FzZSB0aGUgbWFpbCBzaG91bGQgYmUgc2VudCB2aWEKICBhIHJlbW90ZSBzZXJ2ZXIgaW5zdGVhZCBvZiBhIGxvY2FsIG9uZS4KCi0gRGViT3BzIHBsYXlib29rcyBoYXZlIGJlZW4gcmVvcmdhbml6ZWQgdG8gbm90IHVzZSBhIGxhcmdlIHNldCBvZiBzeW1saW5rcwogIGluc2lkZSBvZiB0aGUgcmVwb3NpdG9yeS4gSW5zdGVhZCBkaWZmZXJlbnQgc2VjdGlvbnMgb2YgdGhlIDpmaWxlOmBzaXRlLnltbGAKICBwbGF5Ym9vayBoYXZlIGJlZW4gb3JnYW5pemVkIGludG8gImxheWVycyIsIG5ldyBwbGF5Ym9va3MgYXJlIGxvY2F0ZWQgdW5kZXIKICB0aGUgOmZpbGU6YGFuc2libGUvcGxheWJvb2tzL2xheWVycy9gIHN1YmRpcmVjdG9yeS4gU2VlIHRoZSBuZXcKICA6cmVmOmBwbGF5Ym9va3NgIGRvY3VtZW50YXRpb24gZm9yIG1vcmUgZGV0YWlscy4KCi0gVGhlIG5ldyA6cmVmOmBkZWJvcHMudGltZXN5bmNkYCByb2xlIGhhcyByZXBsYWNlZCB0aGUgOnJlZjpgZGVib3BzLm50cGAgcm9sZQogIGFzIHRoZSBkZWZhdWx0IE5UUCBzZXJ2aWNlIHByb3ZpZGVyIGluIHRoZSA6ZmlsZTpgbGF5ZXIvY29tbW9uLnltbGAgcGxheWJvb2suCiAgRXhpc3RpbmcgaG9zdHMgc2hvdWxkbid0IGJlIGFmZmVjdGVkIC0gdGhlIG5ldyByb2xlIGNhbiBhdXRvbWF0aWNhbGx5CiAgcmVjb2duaXplIHRoYXQgYSBkaWZmZXJlbnQgdGltZSBkYWVtb24gcGFja2FnZSBpcyBpbnN0YWxsZWQgb24gdGhlIGhvc3QgYW5kCiAgd2lsbCBub3QgdHJ5IHRvIGNvbmZpZ3VyZSA6Y29tbWFuZDpgc3lzdGVtZC10aW1lc3luY2RgIHNlcnZpY2UgaW4gc3VjaCBjYXNlLgogIFlvdSBtaWdodCBuZWVkIHRvIGFkZCB5b3VyIGhvc3RzIHRvIHRoZSBgYFtkZWJvcHNfc2VydmljZV9udHBdYGAgQW5zaWJsZQogIGludmVudG9yeSBncm91cCB0byBrZWVwIHVzaW5nIHRoZSBvbGQgcm9sZS4KCi0gVGhlIG5ldyA6cmVmOmBkZWJvcHMucmVzb2x2ZWRgIHJvbGUgaGFzIHJlcGxhY2VkIHRoZSA6cmVmOmBkZWJvcHMucmVzb2x2Y29uZmAKICByb2xlIGFzIHRoZSBkZWZhdWx0IEROUyByZXNvbHZlciBpbiB0aGUgOmZpbGU6YGxheWVyL2NvbW1vbi55bWxgIGFuZCB0aGUKICBib290c3RyYXAgcGxheWJvb2tzLiBFeGlzdGluZyBob3N0cyBzaG91bGRuJ3QgYmUgYWZmZWN0ZWQsIHRoZSByb2xlIGRldGVjdHMKICBwcmVzZW5jZSBvZiB0aGUgYGByZXNvbHZjb25mYGAgQVBUIHBhY2thZ2UgYW5kIGRvZXMgbm90IG1vZGlmeSB0aGUgaG9zdAogIGNvbmZpZ3VyYXRpb24gaW4gc3VjaCBjYXNlLgoKLSBNdWx0aXBsZSBEZWJPcHMgQ29sbGVjdGlvbnMgb24gQW5zaWJsZSBHYWxheHkgaGF2ZSBiZWVuIG1lcmdlZCBpbnRvIGEgc2luZ2xlCiAgYGBkZWJvcHMuZGVib3BzYGAgQ29sbGVjdGlvbiB0byBwcmVwYXJlIHRoZSBwcm9qZWN0IHRvIHN3aXRjaCByb2xlIHJlZmVyZW5jZXMKICB0byBGUUNOcy4gVGhpcyBpcyBhbHNvIGEgdGVzdCB0byBzZWUgaWYgQW5zaWJsZSBHYWxheHkgYWxsb3dzID4yIE1CCiAgY29sbGVjdGlvbiB0YXJiYWxscy4KCi0gVGhlIDpjb21tYW5kOmBkZWJvcHMgY29uZmlnYCBjb21tYW5kIGhhcyBiZWVuIHJlZmFjdG9yZWQgYW5kIHNwbGl0IGludG8KICBtdWx0aXBsZSBzdWJjb21tYW5kcyB0byBhbGxvdyBlYXNpZXIgY29uZmlndXJhdGlvbiBpbnRyb3NwZWN0aW9uLiBTZWUKICA6cmVmOmBpdCdzIGRvY3VtZW50YXRpb24gcGFnZSA8Y21kX2RlYm9wcy1jb25maWc+YCBmb3IgbW9yZSBkZXRhaWxzLgoKLSBUaGUgRGViaWFuIDEyIChCb29rd29ybSkgaGFzIGJlZW4gcmVsZWFzZWQhIE11bHRpcGxlIERlYk9wcyByb2xlcyBoYXZlIGJlZW4KICB1cGRhdGVkIGFuZCBzd2l0Y2hlZCB0aGUgInN0YWJsZSIgcmVsZWFzZSB0byBCb29rd29ybSwgd2l0aCBCdWxsc2V5ZSBiZWNvbWluZwogIHRoZSAib2xkc3RhYmxlIiByZWxlYXNlLiBUaGUgbmV3IERlYmlhbiBUZXN0aW5nIHJlbGVhc2UsICJUcml4aWUiIGhhcyBhbHNvCiAgYmVlbiBhZGRlZCBpbiByZWxldmFudCBwbGFjZXMuCgotIERlYk9wcyBub3cgc3VwcG9ydHMgdXNpbmcgOmNvbW1hbmQ6YGdpdGAgaW4gcHJvamVjdCBkaXJlY3RvcmllcyAtIG5ldwogIHByb2plY3RzIHdpbGwgYmUgaW5pdGlhbGl6ZWQgYXMgOmNvbW1hbmQ6YGdpdGAgcmVwb3NpdG9yaWVzIGJ5IGRlZmF1bHQuIFRoZQogIDpjb21tYW5kOmBnaXQtY3J5cHRgIGNvbW1hbmQgaXMgYWxzbyBzdXBwb3J0ZWQsIGFuZCBjYW4gZW5jcnlwdCBwcm9qZWN0CiAgc2VjcmV0cy4KCjpyZWY6YGRlYm9wcy5hcHRgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJwoKLSBUaGUgcm9sZSB3aWxsIGNvbmZpZ3VyZSBBUFQgdG8gdXNlIERlYmlhbiBTZWN1cml0eSByZXBvc2l0b3JpZXMgdmlhIHRoZQogIGh0dHA6Ly9kZWIuZGViaWFuLm9yZy9kZWJpYW4tc2VjdXJpdHkvIENETi4KCi0gVGhlIHJvbGUgaGFzIGJlZW4gcmVmcmVzaGVkIGFuZCBtYW5hZ2VtZW50IG9mIHRoZQogIDpmaWxlOmAvZXRjL2FwdC9zb3VyY2VzLmxpc3RgIGZpbGUgd2FzIHJlZGVzaWduZWQgdG8gYWxsb3cgZm9yIGJldHRlcgogIGZsZXhpYmlsaXR5IGluIGNvbmZpZ3VyYXRpb24uIFNlZSByb2xlIGRvY3VtZW50YXRpb24gZm9yIG1vcmUgZGV0YWlscy4KCjpyZWY6YGRlYm9wcy5hcHRfcHJlZmVyZW5jZXNgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJwoKLSBUaGUgcGluIHByaW9yaXRpZXMgZm9yIHRoZSBEZWJpYW4gYGAtdXBkYXRlc2BgIGFuZCBgYC1zZWN1cml0eWBgIEFQVAogIHJlcG9zaXRvcmllcyBoYXZlIGJlZW4gcmFpc2VkIHRvIDU1MCB0byBtYXRjaCB0aGUgcmFpc2VkIHByaW9yaXR5IG9mIHRoZQogIHByaW1hcnkgcmVwb3NpdG9yeS4gVGhpcyBzaG91bGQgZW5zdXJlIHRoYXQgd2hlbiB0aGUgY3VzdG9tIHBpbiBwcmlvcml0aWVzCiAgYXJlIGFjdGl2ZSwgdXBkYXRlcyB0byBEZWJpYW4gcGFja2FnZXMgYXJlIGNvcnJlY3RseSBpbnN0YWxsZWQgYXMgd2VsbC4gU2VlCiAgOmVudnZhcjpgYXB0X3ByZWZlcmVuY2VzX19kZWJpYW5fc3RhYmxlX2RlZmF1bHRfcHJlc2V0X2xpc3RgIHZhcmlhYmxlIGZvcgogIGRldGFpbHMuCgo6cmVmOmBkZWJvcHMuZG9ja2VyX3NlcnZlcmAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJwoKLSBUaGUgcm9sZSBjYW4gbm93IGRpcmVjdGx5IGhhbmRsZSB0aGUgZGFlbW9uIGBgbG9nLWRyaXZlcmBgIHBhcmFtZXRlci4KCi0gVGhlIHJvbGUgaGFzIGJlZW4gcmVkZXNpZ25lZCBmcm9tIHNjcmF0Y2g7IFB5dGhvbiA6Y29tbWFuZDpgdmlydHVhbGVudmAKICBzdXBwb3J0IGhhcyBiZWVuIHJlbW92ZWQgc2luY2UgdGhlIDpjb21tYW5kOmBkb2NrZXItY29tcG9zZWAgaXMgaW5jbHVkZWQgaW4KICBEZWJpYW4gcmVwb3NpdG9yaWVzIGRpcmVjdGx5LCBvciBpcyBpbXBsZW1lbnRlZCBhcyBhIEdvIHBsdWdpbiBpbiB1cHN0cmVhbQogIHJlcG9zaXRvcmllcy4gVGhlIERvY2tlciBjb25maWd1cmF0aW9uIGlzIG5vdyBpbXBsZW1lbnRlZCB2aWEgdGhlCiAgOnJlZjpgdW5pdmVyc2FsX2NvbmZpZ3VyYXRpb25gIHN5c3RlbSwgdXNlcnMgd2lsbCBoYXZlIHRvIG1vZGlmeSB0aGVpcgogIEFuc2libGUgaW52ZW50b3JpZXMuIFNlZSB0aGUgcm9sZSBkb2N1bWVudGF0aW9uIGZvciBkZXRhaWxzLgoKOnJlZjpgZGVib3BzLmVsYXN0aWNzZWFyY2hgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycKCi0gVGhlIHJvbGUgd2lsbCBjaGVjayB0aGUgc3RhdHVzIG9mIHRoZSBidWlsdC1pbiB1c2VyIGFjY291bnRzIHZpYSB0aGUgSFRUUCBBUEkKICBpbnN0ZWFkIG9mIHJlbHlpbmcgb24gdGhlIEFuc2libGUgbG9jYWwgZmFjdHMgYW5kIGNyZWF0ZSB0aGVtIGlmIHRoZXkgZG9uJ3QKICBleGlzdC4gVGhpcyBzaG91bGQgaGVscCB3aXRoIGFuIHVwZ3JhZGUgb2YgZXhpc3RpbmcgRWxhc3RpY3NlYXJjaCBjbHVzdGVycwogIHdpdGhvdXQgVExTIGVuY3J5cHRlZCB0cmFmZmljIGFuZCBhdXRoZW50aWNhdGlvbi4KCjpyZWY6YGRlYm9wcy5naXRsYWJgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnJwoKLSBUaGUgcm9sZSBoYXMgYmVlbiByZXdyaXR0ZW4gZnJvbSBzY3JhdGNoIGFuZCBub3cgY2FuIGJlIHVzZWQgdG8gZGVwbG95IGFuZAogIG1hbmFnZSBhIGBHaXRMYWIgT21uaWJ1c2BfXyBpbnN0YW5jZSAobWFuYWdlZCBpbnRlcm5hbGx5IGJ5IENoZWYpIG9uIERlYmlhbgogIG9yIFVidW50dSBob3N0cy4gVGhlIHJvbGUgaW50ZWdyYXRlcyB3aXRoIHZhcmlvdXMgRGViT3BzIHNlcnZpY2VzIChmaXJld2FsbCwKICBQS0kgaW5mcmFzdHJ1Y3R1cmUsIExEQVAgZW52aXJvbm1lbnQpIHdpdGggR2l0TGFiIE9tbmlidXMuIEJvdGggQ29tbXVuaXR5CiAgRWRpdGlvbiAoZGVmYXVsdCkgYW5kIEVudGVycHJpc2UgRWRpdGlvbiBhcmUgc3VwcG9ydGVkLgoKICAuLiBfXzogaHR0cHM6Ly9kb2NzLmdpdGxhYi5jb20vb21uaWJ1cy8KCjpyZWY6YGRlYm9wcy5nbG9iYWxfaGFuZGxlcnNgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJwoKLSBUaGUgOmNvbW1hbmQ6YHN5c3RlbWRgIGhhbmRsZXJzIGhhdmUgYmVlbiBtb3ZlZCB0byBhIHNlcGFyYXRlCiAgOmZpbGU6YGhhbmRsZXJzL3N5c3RlbWQueW1sYCBjb25maWd1cmF0aW9uIGZpbGUuCgo6cmVmOmBkZWJvcHMuaWNpbmdhYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycKCi0gTmV3IGhvc3RzIHdpbGwgYmUgYWRkZWQgdG8gSWNpbmdhIERpcmVjdG9yIHVzaW5nIHRoZSBgYGljaW5nYS1hZ2VudC1ob3N0YGAKICB0ZW1wbGF0ZSwgY3JlYXRlZCBieSBkZWZhdWx0IGJ5IHRoZSA6cmVmOmBkZWJvcHMuaWNpbmdhX3dlYmAgcm9sZS4gT24KICBleGlzdGluZyBpbnN0YWxsYXRpb25zLCB5b3Ugc2hvdWxkIGVpdGhlciBjcmVhdGUgdGhpcyB0ZW1wbGF0ZSBieSBoYW5kLCBvcgogIHJ1biB0aGUgOnJlZjpgZGVib3BzLmljaW5nYV93ZWJgIHJvbGUgc28gdGhhdCBpdCBnZXRzIGFkZGVkIGF1dG9tYXRpY2FsbHkuCgo6cmVmOmBkZWJvcHMuaWNpbmdhX2RiYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycnJycKCi0gVGhlIHJvbGUgd2lsbCBtYW5hZ2UgSWNpbmdhIGRhdGFiYXNlcyBkaXJlY3RseSBpbnN0ZWFkIG9mIHJlbHlpbmcgb24KICA6Y29tbWFuZDpgZGJjb25maWdgIERlYmlhbiBzdWJzeXN0ZW0uIFRoaXMgaW1wcm92ZXMgc3VwcG9ydCBmb3IgcmVtb3RlIEljaW5nYQogIGRhdGFiYXNlIGRlcGxveW1lbnRzIGFjY2Vzc2libGUgb3ZlciBUTFMuCgo6cmVmOmBkZWJvcHMuaWNpbmdhX3dlYmAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnJycnJycnJwoKLSBUaGUgTERBUCBjb25maWd1cmF0aW9uIHVzZWQgYnkgdGhlIHJvbGUgdG8gY29uZmlndXJlIExEQVAgYWNjZXNzIHdpbGwgYmUKICBiYXNlZCBvbiB0aGUgOnJlZjpgZGVib3BzLmxkYXBgIEFuc2libGUgbG9jYWwgZmFjdHMgaW5zdGVhZCBvZiBzdGF0aWMgdmFsdWVzLAogIHRvIGJldHRlciBzdXBwb3J0IG1vZGlmaWVkIGVudmlyb25tZW50cy4KCjpyZWY6YGRlYm9wcy5pbmZsdXhkYXRhYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycnJycnCgotIEluZmx1eERhdGEgaGFzIHB1Ymxpc2hlZCBhIG5ldyBBUFQgcmVwb3NpdG9yeSBHUEcga2V5LCB0aGUgcm9sZSBzaG91bGQKICByZWZyZXNoIGl0IGF1dG9tYXRpY2FsbHkuCgo6cmVmOmBkZWJvcHMubWluaW9gIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnCgotIFRoZSByb2xlIGhhcyBiZWVuIHVwZGF0ZWQgdG8gc3VwcG9ydCBuZXdlciBNaW5JTyBmZWF0dXJlcywgbGlrZSB0aGUgZW1iZWRkZWQKICBNaW5JTyBDb25zb2xlLiBTb21lIG9mIHRoZSBpbnN0YW5jZSBwYXJhbWV0ZXJzIGhhdmUgYmVlbiBjaGFuZ2VkLCBmb3IgZXhhbXBsZQogIGFjY2VzcyBrZXkgYW5kIHNlY3JldCBrZXkgaGF2ZSBiZWVuIHJlcGxhY2VkIHdpdGggcm9vdCBhY2NvdW50IGFuZCBwYXNzd29yZC4KICBDaGVjayB0aGUgcm9sZSBkb2N1bWVudGF0aW9uIGZvciBtb3JlIGRldGFpbHMuCgo6cmVmOmBkZWJvcHMubmdpbnhgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnCgotIENvbmZpZ3VyZSB0aGUgOmZpbGU6YG5naW54LnNlcnZpY2VgIHN5c3RlbWQgdW5pdCB0byBzdGFydCB0aGUKICA6Y29tbWFuZDpgbmdpbnhgIHNlcnZpY2UgYWZ0ZXIgdGhlIG5ldHdvcmsgaXMgY29uZmlndXJlZC4gVGhpcyB3YXkKICA6Y29tbWFuZDpgbmdpbnhgIHNob3VsZCBiZSBhYmxlIHRvIHJlc29sdmUgdXBzdHJlYW0gc2VydmljZXMgc3BlY2lmaWVkIHZpYQogIEROUyBuYW1lcyBhdCBzdGFydHVwLgoKOnJlZjpgZGVib3BzLm50cGAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnCgotIFRoZSBkZWZhdWx0IE5UUCBkYWVtb24gdXNlZCBvbiBob3N0cyB3aXRoIHRoZSA6Y29tbWFuZDpgc3lzdGVtZGAgc2VydmljZQogIG1hbmFnZXIgd2lsbCBiZSA6Y29tbWFuZDpgc3lzdGVtZC10aW1lc3luY2RgLiBFeGlzdGluZyBzeXN0ZW1zIHdpdGgKICBhIGRpZmZlcmVudCBOVFAgc2VydmVyIHNob3VsZCBub3QgYmUgYWZmZWN0ZWQgYnkgdGhpcyBjaGFuZ2UuCgotIFRoZSByb2xlIHNob3VsZCBiZXR0ZXIgZGV0ZWN0IExpbnV4IENvbnRhaW5lciBlbnZpcm9ubWVudCBhbmQgbm90IHRyeSB0bwogIGluc3RhbGwgYW4gTlRQIGRhZW1vbiBpbnNpZGUgb2YgYSBjb250YWluZXIuCgo6cmVmOmBkZWJvcHMucGtpYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycKCi0gVGhlIDpjb21tYW5kOmBwa2ktcmVhbG1gIHNjcmlwdCB3aWxsIGNhbGwgdGhlIDpjb21tYW5kOmBjZXJ0Ym90YCBjb21tYW5kIHdpdGgKICB0aGUgOmNvbW1hbmQ6YGNlcnRib3QgLS1hdXRoZW50aWNhdG9yIDxwbHVnaW4+YCBvcHRpb24gZXhwbGljaXRseSB0byBhbGxvdwogIHVzZSB3aXRoIHRoaXJkLXBhcnR5IGF1dGhlbnRpY2F0b3IgcGx1Z2lucyB0aGF0IG1pZ2h0IG5vdCBzdXBwb3J0IHRoZQogIDpjb21tYW5kOmBjZXJ0Ym90IC0tPHBsdWdpbj5gIHN5bnRheC4KCjpyZWY6YGRlYm9wcy5wcmVzZWVkYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycnCgotIFRoZSBkZWZhdWx0IGd1aWRlZCBwYXJ0aXRpb24gcmVjaXBlIHVzZWQgYnkgdGhlIERlYmlhbiBJbnN0YWxsZXIgaXMgY2hhbmdlZAogIGZyb20gYGBhdG9taWNgYCB0byBgYG11bHRpYGAuIFRoaXMgc2hvdWxkIGFsbG93IGZvciBlYXNpZXIgY2hhbmdlcyBpbiB0aGUKICBwYXJ0aXRpb24gbGF5b3V0IHZpYSBMVk0gZHVlIHRvIHNlcGFyYXRlIHBhcnRpdGlvbnMgZm9yIDpmaWxlOmAvaG9tZWAgYW5kCiAgOmZpbGU6YC92YXJgIG1vdW50IHBvaW50cy4KCjpyZWY6YGRlYm9wcy5wcm9jX2hpZGVwaWRgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJwoKLSBUaGUgcm9sZSB3aWxsIGNoZWNrIGlmIFBvbGljeUtpdCBpcyBpbnN0YWxsZWQgb24gdGhlIGhvc3QsIGluIHdoaWNoIGNhc2UgdGhlCiAgZGVmYXVsdCBzZWN1cml0eSBsZXZlbCBmb3IgYWNjZXNzIHRvIHRoZSA6ZmlsZTpgL3Byb2NgIGZpbGVzeXN0ZW0gd2lsbCBiZQogIG1vcmUgcGVybWlzc2l2ZS4KCjpyZWY6YGRlYm9wcy5weXRob25gIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnJwoKLSBUaGUgcm9sZSB3aWxsIGVuYWJsZSBQeXRob24gMi43IHN1cHBvcnQgdmlhIHRoZSBmYWN0IHNjcmlwdCBvbmx5IHdoZW4gYW4KICBleGlzdGluZyBQeXRob24gMi43IGluc3RhbGxhdGlvbiBpcyBkZXRlY3RlZC4gVGhpcyBjaGFuZ2Ugc2hvdWxkIGhlbHAgYXZvaWQKICBpbnN0YWxsaW5nIFB5dGhvbiAyLjcgcGFja2FnZXMgb24gbmV3ZXIgT1MgcmVsZWFzZXMgd2hlbiB0aGV5IG1pZ2h0IGJlCiAgdW5hdmFpbGFibGUuCgotIFRoZSA6ZmlsZTpgL2V0Yy9waXAuY29uZmAgY29uZmlndXJhdGlvbiBmaWxlIHRlbXBsYXRlIGNhbiBiZSBvdmVycmlkZGVuIHZpYQogIHRoZSBEZWJPcHMgdGVtcGxhdGUgb3ZlcnJpZGUgbWVjaGFuaXNtLgoKOnJlZjpgZGVib3BzLnJlc29sdmNvbmZgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnJycnJycKCi0gSW4gdGhlIDpyZWY6YGRlYm9wcy5yZXNvbHZjb25mYCByb2xlLCB5b3UgY2FuIG5vdyB3cml0ZSBhIGZ1bGx5IHN0YXRpYwogIDpmaWxlOmAvZXRjL3Jlc29sdi5jb25mYCBmaWxlIHdpdGhvdXQgdGhlIGBgcmVzb2x2Y29uZmBgIHBhY2thZ2UuCgo6cmVmOmBkZWJvcHMuc2xhcGRgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnCgotIFRoZSBkZWZhdWx0IGxvZyBsZXZlbCB1c2VkIGJ5IE9wZW5MREFQIGhhcyBiZWVuIGNoYW5nZWQgZnJvbSBgYHN0YXRzYGAgdG8KICBgYG5vbmVgYCB0byBtaW5pbWl6ZSBsb2cgb3V0cHV0IGluIGxhcmdlIGVudmlyb25tZW50cy4gVGhpcyBjYW4gYmUgbW9kaWZpZWQKICB1c2luZyBBbnNpYmxlIGludmVudG9yeSBpbiBjYXNlIHRoYXQgdGhlIGF1dGhlbnRpY2F0aW9uLCBhY2NvdW50aW5nIG9yIHNlYXJjaAogIG1ldHJpY3MgYXJlIG5lZWRlZC4KCjpyZWY6YGRlYm9wcy5zc2hkYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnCgotIFRoZSBtYW5hZ2VtZW50IG9mIHRoZSA6ZmlsZTpgL2V0Yy9zc2gvc3NoZF9jb25maWdgIGNvbmZpZ3VyYXRpb24gZmlsZSBoYXMKICBiZWVuIHJlZGVzaWduZWQgYW5kIG5vdyB1c2VzIDpyZWY6YHVuaXZlcnNhbF9jb25maWd1cmF0aW9uYC4gTXVsdGlwbGUgZGVmYXVsdAogIHZhcmlhYmxlcyBoYXZlIGJlZW4gcmVtb3ZlZCBhcyBhIHJlc3VsdC4gQW55IGNoYW5nZXMgaW4gY29uZmlndXJhdGlvbiBhcHBsaWVkCiAgdGhyb3VnaCBBbnNpYmxlIGludmVudG9yeSBtaWdodCBuZWVkIHRvIGJlIGNvbnZlcnRlZCB0byB0aGUgbmV3IGZvcm1hdC4gQ2hlY2sKICB0aGUgY2hhbmdlcyBvbiBleGlzdGluZyBob3N0cyBiZWZvcmUgYXBwbHlpbmcgbmV3IGNvbmZpZ3VyYXRpb24uCgo6cmVmOmBkZWJvcHMuc3lzdGVtX3VzZXJzYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycKCi0gVGhlIHJvbGUgd2lsbCBjaGVjayByZW1vdGUgdXNlciBkYXRhYmFzZXMgZm9yIGxvY2FsIGFkbWluIGluZm9ybWF0aW9uIHVzaW5nCiAgdGhlIDpjb21tYW5kOmBnZXRlbnQgcGFzc3dkYCBjb21tYW5kIGlmIHRoZSB1c2VyIGhhcyBub3QgYmVlbiBmb3VuZCBpbiB0aGUKICA6ZmlsZTpgL2V0Yy9wYXNzd2RgIGxvY2FsIGRhdGFiYXNlLgoKRml4ZWQKfn5+fn4KCkdlbmVyYWwKJycnJycnJwoKLSBFeHRyZXBvIGZhY3RzIGZpbGUgZGlkIG5vdCBkZXRlY3QgYSBkaXNhYmxlZCByZXBvc2l0b3J5IGFzIGJlaW5nIGRpc2FibGVkCiAgZHVlIHRvIGEgY2hhbmdlIGluIHRoZSBleHRyZXBvIGZpbGUgZm9ybWF0LgoKLSBFbnN1cmUgdGhhdCB0aGUgY3VzdG9tIEFuc2libGUgcGx1Z2lucyBpbmNsdWRlZCBpbiBEZWJPcHMgYXJlIHByZXNlbnQgaW4gdGhlCiAgQW5zaWJsZSBDb2xsZWN0aW9uIGJ1aWxkIGZyb20gdGhlIERlYk9wcyByZXBvc2l0b3J5LgoKLSBQcm92aWRlIGEgaGVscCBtZXNzYWdlIGluIGNhc2UgdGhlIDpmaWxlOmBhbnNpYmxlLmNmZ2AgY29uZmlndXJhdGlvbiBmaWxlIGluCiAgdGhlIERlYk9wcyBwcm9qZWN0IGRpcmVjdG9yeSBkb2VzIG5vdCBpbmNsdWRlIHRoZSBgYGludmVudG9yeWBgIG9wdGlvbi4KCi0gRml4ZWQgYW4gaXNzdWUgd2l0aCBjdXN0b20gQW5zaWJsZSBwbHVnaW5zIG5vdCB3b3JraW5nIGluICJzdGFuZGFsb25lIiBtb2RlCiAgd2l0aG91dCB0aGUgRGViT3BzIHNjcmlwdHMgaW5zdGFsbGVkIG9uIEFuc2libGUgQ29udHJvbGxlci4KCi0gVGhlIGBgd2FybmBgIHBhcmFtZXRlciBpbiB0aGUgYGBzaGVsbGBgIGFuZCBgYGNvbW1hbmRgYCBBbnNpYmxlIG1vZHVsZXMgaGFzCiAgYmVlbiByZW1vdmVkIGluIEFuc2libGUgMi4xNC4gSXQgaGFzIGJlZW4gcmVtb3ZlZCBpbiB2YXJpb3VzIERlYk9wcyByb2xlcyB0bwogIGFsbG93IHBsYXlib29rIGV4ZWN1dGlvbiB0byB3b3JrIGNvcnJlY3RseS4KCi0gRml4ZWQgYWxsIHBhc3N3b3JkIGxvb2t1cHMgd2hpY2ggdXNlZCBgYGNoYXJzPWFzY2lpYGAgaW5zdGVhZCBvZgogIGBgY2hhcnM9YXNjaWlfbGV0dGVyc2BgLiBUaGlzIHJlc3VsdGVkIGluIHBhc3N3b3JkcyB3aGljaCBvbmx5IGNvbnRhaW5lZCB0aGUKICBsZXR0ZXJzIGEsYyxpLHMgaW5zdGVhZCBvZiBhbGwgbG93ZXJjYXNlIGFuZCB1cHBlcmNhc2UgQVNDSUkgbGV0dGVycy4gQmVjYXVzZQogIGFsbCBvY2N1cnJlbmNlcyBvZiB0aGlzIGJ1ZyBhdCBsZWFzdCBhbHNvIGluY2x1ZGVkIGFsbCBkaWdpdHMgaW4gdGhlIGNoYXJhY3RlcgogIHNldCBhbmQgdGhlIHBhc3N3b3JkIGxlbmd0aCB3YXMgYXQgbGVhc3QgMjAgY2hhcmFjdGVycywgdGhpcyBkaWQgbm90IHJlc3VsdAogIGluIHdlYWsgcGFzc3dvcmRzLgoKLSBUaGUgYGBpcGFkZHJgYCBBbnNpYmxlIGZpbHRlciBhbmQgaXRzIGFsaWFzZXMgdXNlZCBpbiB2YXJpb3VzIHJvbGVzIHdlcmUKICByZW5hbWVkIHRvIGBgYW5zaWJsZS51dGlscy5pcGFkZHJgYCBhbmQgaXRzIGNvcnJlc3BvbmRpbmcgYWxpYXMgbmFtZXMgYmVjYXVzZQogIEFuc2libGUgcmVxdWlyZXMgdXNlIG9mIEZRQ05zIGluIGZpbHRlcnMuIFRoZSBgYGFuc2libGUudXRpbHNgYCBBbnNpYmxlCiAgQ29sbGVjdGlvbiBpcyBub3cgYSBkZXBlbmRlbmN5IG9mIHRoZSBEZWJPcHMgQ29sbGVjdGlvbi4KCi0gVGhlIDpjb21tYW5kOmBkZWJvcHMgcnVuYCBhbmQgOmNvbW1hbmQ6YGRlYm9wcyBjaGVja2AgY29tbWFuZHMgc2hvdWxkIG5vdwogIGNvcnJlY3RseSByZWNvZ25pemUgb3B0aW9ucyBvZiB0aGUgOmNvbW1hbmQ6YGFuc2libGUtcGxheWJvb2tgIGNvbW1hbmQgd2hpY2gKICBkb24ndCBleHBlY3QgYXJndW1lbnRzIGFuZCBleHBhbmQgcGxheWJvb2sgbmFtZXMgc3BlY2lmaWVkIGFmdGVyIHRoZW0uCgo6cmVmOmBkZWJvcHMuYXB0YCByb2xlCicnJycnJycnJycnJycnJycnJycnJycKCi0gSW4gdGhlIGZhY3Qgc2NyaXB0LCBwYXJzZSB0aGUgYGBkZWItc3JjYGAgY29uZmlndXJhdGlvbiBlbnRyaWVzIGJlZm9yZQogIGBgZGViYGAgZW50cmllcyB0byBlbnN1cmUgdGhhdCB0aGVyZSBhcmUgbm8gZHVwbGljYXRlcy4KCi0gVGhlIHJvbGUgbm8gbG9uZ2VyIGRlZmF1bHRzIHRvIHRoZSBgYGFuc2libGVfbG9jYWwuY29yZS5kaXN0cmlidXRpb25gYCBhbmQKICBgYGFuc2libGVfbG9jYWwuY29yZS5kaXN0cmlidXRpb25fcmVsZWFzZWBgIGxvY2FsIGZhY3RzIGZvciBkZXRlcm1pbmluZyB0aGUKICBMaW51eCBkaXN0cmlidXRpb24gYW5kIHRoZSBkaXN0cmlidXRpb24gcmVsZWFzZSwgcmVzcGVjdGl2ZWx5LiBUaGVzZSBmYWN0cwogIHdlcmUgc2V0IGxhdGVyIGluIHRoZSBjb21tb24gcGxheWJvb2ssIG1lYW5pbmcgdGhhdCB0aGUgcm9sZSB3b3VsZCByZXN0b3JlCiAgdGhlIHByZXZpb3VzIGRpc3RyaWJ1dGlvbiByZWxlYXNlIGluIGBgL2V0Yy9hcHQvc291cmNlcy5saXN0YGAgYWZ0ZXIgYQogIGRpc3RyaWJ1dGlvbiB1cGdyYWRlLgoKZGVib3BzLmJveGJhY2t1cCByb2xlCicnJycnJycnJycnJycnJycnJycnJwoKLSBUaGUgcm9sZSBpcyBub3QgaW5jbHVkZWQgaW4gdGhlIERlYk9wcyBDb2xsZWN0aW9uIG9uIEFuc2libGUgR2FsYXh5LAogIHRoZXJlZm9yZSBpdHMgcGxheWJvb2sgaXMgbm8gbG9uZ2VyIGluY2x1ZGVkIGluIHRoZSBtYWluIDpmaWxlOmBzaXRlLnltbGAKICBwbGF5Ym9vay4gVGhpcyBmaXhlcyBhbiBpc3N1ZSB3aXRoIEFuc2libGUgc3RvcHBpbmcgdGhlIHNpdGUgcGxheWJvb2sKICBleGVjdXRpb24gd2hlbiBpdCBjYW5ub3QgZmluZCB0aGUgYGBib3hiYWNrdXBgYCByb2xlIGluIHRoZSBDb2xsZWN0aW9uLgoKOnJlZjpgZGVib3BzLmNvcmVgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycKCi0gRW5zdXJlIHRoYXQgdGhlIGBgYW5zaWJsZV9jb250cm9sbGVyc2BgIGZhY3QgY2FuIGJlIHJlc2V0IHVzaW5nIHRoZQogIDplbnZ2YXI6YGNvcmVfX3JlbW92ZV9mYWN0c2AgdmFyaWFibGUgdG8gYXZvaWQgaW5maW5pdGVseSBncm93aW5nIGxpc3Qgb2YKICBBbnNpYmxlIENvbnRyb2xsZXJzLgoKOnJlZjpgZGVib3BzLmNyb25gIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycKCi0gRml4ZWQgdGhlIG9yZGVyIG9mIGpvYiBwYXJhbWV0ZXJzIGFwcGxpZWQgYnkgdGhlIHJvbGUgLSBub3cgcGFyYW1ldGVycyBmcm9tCiAgYSBzcGVjaWZpYyBqb2Igd2lsbCBvdmVycmlkZSBwYXJhbWV0ZXJzIHNwZWNpZmllZCBmb3IgYWxsIGpvYnMgaW4gYSBnaXZlbgogIGNvbmZpZ3VyYXRpb24gZW50cnkuCgo6cmVmOmBkZWJvcHMuZG5zbWFzcWAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnJycnJwoKLSBGaXhlZCBzZXJ2aWNlIGNvbmZpZ3VyYXRpb24gbWlzdGFrZSB3aGVuIERIQ1B2NiBtb2RlIGlzIHNldCB0byBhbiBlbXB0eQogIHN0cmluZy4gVGhlIGNvbmZpZ3VyYXRpb24gdGVtcGxhdGUgc2hvdWxkIHRha2UgdGhpcyBpbnRvIGFjY291bnQgYW5kIGFkZAogIGEgY29ycmVjdCBzZXBhcmF0b3IgKG9yIG9taXQgaXQpIGluIHRoZSBnZW5lcmF0ZWQgY29uZmlndXJhdGlvbiBmaWxlLgoKOnJlZjpgZGVib3BzLmRvdmVjb3RgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnJycKCi0gVGhlIHJvbGUncyBQS0kgaG9vayBzY3JpcHQgc3RpbGwgcmVmZXJlbmNlZCBhbiBvbGQgY29uZmlndXJhdGlvbiBmaWxlIHRoYXQKICB3YXMgbm8gbG9uZ2VyIGJlaW5nIG1hbmFnZWQgYnkgOnJlZjpgZGVib3BzLmRvdmVjb3RgIHNpbmNlIHRoZSByb2xlIHJlZGVzaWduLAogIHJlc3VsdGluZyBpbiB0aGUgaG9vayBzY3JpcHQgZmFpbGluZyB0byByZWxvYWQgZG92ZWNvdCBhZnRlciBhIGNlcnRpZmljYXRlIG9yCiAgREggcGFyYW0gY2hhbmdlLgoKOnJlZjpgZGVib3BzLmVsYXN0aWNzZWFyY2hgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycKCi0gVGhlIGludGVybmFsIEphdmEgc2VjdXJpdHkgcG9saWN5IHVzZWQgYnkgRWxhc3RpY3NlYXJjaCB3aWxsIGJlIGNvbmZpZ3VyZWQKICBvbmx5IG9uIEVsYXN0aWNzZWFyY2ggdjcueCsgdmVyc2lvbnMuIEJlZm9yZSB0aGVtLCBFbGFzdGljc2VhcmNoIHVzZWQgdGhlCiAgZ2xvYmFsIEphdmEgc2VjdXJpdHkgcG9saWN5LgoKOnJlZjpgZGVib3BzLmVudmlyb25tZW50YCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycnJycnJwoKLSBGaXhlZCBpc3N1ZXMgd2l0aCBwcmVzZXJ2aW5nIGVudmlyb25tZW50IHZhcmlhYmxlcyBhY3Jvc3MgbXVsdGlwbGUgcm9sZQogIGV4ZWN1dGlvbnMuCgo6cmVmOmBkZWJvcHMuZXRjX2FsaWFzZXNgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnCgotIERvbid0IHNhdmUgZGVwZW5kZW50IHJlY2lwaWVudHMgb24gQW5zaWJsZSBDb250cm9sbGVyIGlmIHRoZXkgYXJlIG5vdAogIGRlZmluZWQuIFRoaXMgc2hvdWxkIGF2b2lkIGNyZWF0aW5nIHVubmVjZXNzYXJ5IGZpbGVzIGluIEFXWCBqb2IgY29udGFpbmVycy4KCjpyZWY6YGRlYm9wcy5mZXJtYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnCgotIERvbid0IGluY2x1ZGUgYWRkaXRpb25hbCAneycgb3IgJ30nIGNoYXJhY3RlcnMgaW4gY2VydGFpbiBydWxlcyB3aGVuIHRoZQogIGBgZG9tYWluX2FyZ3NgYCBwYXJhbWV0ZXIgaXMgc3BlY2lmaWVkLgoKLSBGaXhlZCBhbiBpc3N1ZSBpbiB0aGUgcnVsZSB0ZW1wbGF0ZSB0aGF0IGNhdXNlZCBhIHRlbXBsYXRpbmcgdHlwZSBlcnJvciB3aGVyZQogIEppbmphIGV4cGVjdGVkIGEgc3RyaW5nIGJ1dCBmb3VuZCBhbiBpbnQgdmFsdWUgaW5zdGVhZC4KCjpyZWY6YGRlYm9wcy5naXRsYWJfcnVubmVyYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnCgotIEZpeGVkIGFuIGVycm9yIHRoYXQgY291bGQgb2NjdXIgaW4gdGhlICJQYXRjaCAndmFncmFudC1saWJ2aXJ0JyBzb3VyY2UgY29kZSIKICB0YXNrIG9uIHN5c3RlbXMgb3RoZXIgdGhhbiBEZWJpYW4gOSBvciAxMC4gVGhlIHBhdGNoIGlzIG5vdCByZXF1aXJlZCBzaW5jZQogIHRoZSBgYHZhZ3JhbnQtbGlidmlydGBgIHYwLjEuMCBwYWNrYWdlLgoKOnJlZjpgZGVib3BzLmdydWJgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycKCi0gVGhlIDpjb21tYW5kOmBncnViYCB1c2VyIHBhc3N3b3JkcyB3aWxsIGJlIHBhc3NlZCBmb3IgZW5jcnlwdGlvbiB1c2luZwogIGEgdGVtcG9yYXJ5IGZpbGUgc3RvcmVkIGluIHRoZSA6ZmlsZTpgc2VjcmV0L2AgZGlyZWN0b3J5IG9uIHRoZSBBbnNpYmxlCiAgQ29udHJvbGxlciBpbnN0ZWFkIG9mIGRpcmVjdGx5IG9uIHRoZSBjb21tYW5kIGxpbmUsIHRvIGF2b2lkIGxlYWtzIHRocm91Z2gKICB0aGUgcHJvY2VzcyBsaXN0LgoKOnJlZjpgZGVib3BzLmlmdXBkb3duYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycnJwoKLSBUaGUgaW50ZXJmYWNlIG5hbWVzIHVzZWQgaW4gc2NyaXB0cyB3aWxsIGJlIGVzY2FwZWQgdXNpbmcgdGhlCiAgOmNvbW1hbmQ6YHN5c3RlbWQtZXNjYXBlYCB0b29sLiBUaGlzIHNob3VsZCBmaXggcHJvYmxlbXMgd2l0aCBjb250cm9sIG92ZXIKICBuZXR3b3JrIGludGVyZmFjZXMgd2hpY2ggY29udGFpbiB0aGUgaHlwaGVuIGNoYXJhY3RlcihzKS4KCjpyZWY6YGRlYm9wcy5raWJhbmFgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnJwoKLSBUaGUgcm9sZSB3aWxsIHVzZSB0aGUgY29ycmVjdCBwYXRoIG9mIHRoZSBLaWJhbmEga2V5c3RvcmUgZGVwZW5kaW5nIG9uIHRoZQogIGluc3RhbGxlZCB2ZXJzaW9uICh2ZXJzaW9ucyA8Ny4wLjAga2VlcCB0aGUga2V5c3RvcmUgaW4gdGhlCiAgOmZpbGU6YC92YXIvbGliL2tpYmFuYS9gIGRpcmVjdG9yeTsgbmV3ZXIgdmVyc2lvbnMgdXNlIHRoZQogIDpmaWxlOmAvZXRjL2tpYmFuYS9gIGRpcmVjdG9yeSkuCgotIFRoZSByb2xlIHdpbGwgdXNlIGRpZmZlcmVudCB1c2VyIGFjY291bnQgZGVwZW5kaW5nIG9uIEtpYmFuYSB2ZXJzaW9uIChlaXRoZXIKICBgYGtpYmFuYWBgLCBvciBgYGtpYmFuYV9zeXN0ZW1gYCB1c2VkIGluIG5ld2VyIGluc3RhbGxhdGlvbnMgb2YKICBFbGFzdGljc2VhcmNoKS4gRGVwZW5kaW5nIG9uIHlvdXIgaW5zdGFsbGVkIHZlcnNpb24sIHlvdSBzaG91bGQgY2hlY2sgdGhlCiAgOmVudnZhcjpga2liYW5hX19lbGFzdGljc2VhcmNoX3VzZXJuYW1lYCB0byB2ZXJpZnkgdGhhdCB0aGUgY29ycmVjdCBhY2NvdW50CiAgaXMgdXNlZCBmb3IgYWNjZXNzIHRvIEVsYXN0aWNzZWFyY2guCgotIFRoZSByb2xlIHdpbGwgaW5jbHVkZSB0aGUgYGBzZXJ2ZXIucHVibGljQmFzZVVybGBgIHBhcmFtZXRlciBkZXBlbmRpbmcgb24KICBLaWJhbmEgdmVyc2lvbiwgdG8gYXZvaWQgZmFpbHVyZXMgb24gb2xkZXIgS2liYW5hIGluc3RhbGxhdGlvbnMuCgo6cmVmOmBkZWJvcHMubGRhcGAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnJwoKLSBGaXhlZCBhbiBpc3N1ZSB3aXRoIHRoZSByb2xlIHBhc3NpbmcgSVAgYW5kIE1BQyBhZGRyZXNzZXMgdG8gdGhlIExEQVAKICBkaXJlY3RvcnkgYXMgYSBuZXN0ZWQgWUFNTCBsaXN0IHdoaWNoIHJlc3VsdGVkIGluIGEgd3JvbmcgYXR0cmlidXRlIHZhbHVlcy4KCi0gRml4ZWQgYW4gaXNzdWUgd2l0aCByb2xlIHBhcnNpbmcgdGhlIGFscmVhZHkgcGFyc2VkIEFuc2libGUgZmFjdHMgdG8gZXh0cmFjdAogIElQL0NJRFIgaW5mb3JtYXRpb24gd2hpY2ggcmVzdWx0ZWQgaW4gd3Jvbmcgb3V0cHV0IGluIGNlcnRhaW4gY2FzZXMuIFRoZSByb2xlCiAgd2lsbCBub3cgaW1wbGljaXRseSB0cnVzdCB0aGUgQW5zaWJsZSBmYWN0cyB0byBiZSBjb3JyZWN0IHdoZW4gYWRkaW5nIElQIGFuZAogIHByZWZpeCBkZXRhaWxzIHRvIHRoZSBMREFQIGRhdGFiYXNlLgoKOnJlZjpgZGVib3BzLmxpYnZpcnRkYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycnJwoKLSBGaXhlZCBgYHFlbXUta3ZtYGAgcGFja2FnZSBpbnN0YWxsYXRpb24gbG9naWM7IHRoZSBLVk0gcGFja2FnZXMgc2hvdWxkIG5vdyBiZQogIGhhbmRsZWQgY29ycmVjdGx5IG9uIERlYmlhbiBCdWxsc2V5ZSBhbmQgbmV3ZXIgcmVsZWFzZXMuCgo6cmVmOmBkZWJvcHMubG9ncm90YXRlYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnJycnJycKCi0gRml4ZWQgZm9ybWF0dGluZyBpbiB0aGUgOmZpbGU6YC9ldGMvbG9ncm90YXRlLmNvbmZgIGNvbmZpZ3VyYXRpb24gZmlsZSB0bwogIGF2b2lkIGFkZGluZyA6Y29tbWFuZDpgdmltYCBmb2xkIG1hcmtlcnMgZnJvbSB0aGUgRGViT3BzIHJvbGUgZGVmYXVsdHMuCgo6cmVmOmBkZWJvcHMubHhjYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycKCi0gRml4ZWQgbmFtZSBvZiB0aGUgYGB2ZnNfcm9vdGBgIHBhcmFtZXRlciBpbiB0aGUgY2FsbCB0byB0aGUKICBgYGNvbW11bml0eS5nZW5lcmFsLmx4Y19jb250YWluZXJgYCBBbnNpYmxlIG1vZHVsZSwgd2hpY2ggd2FzIHJlbmFtZWQgdG8KICBgYHpmc19yb290YGAuCgo6cmVmOmBkZWJvcHMubmV0YmFzZWAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnJycnJwoKLSBJbiB0aGUgZmFjdCBzY3JpcHQsIGRvbid0IHVzZSBgYGluYGAgZm9yIG1hdGNoaW5nIElQIGFkZHJlc3NlcyBhbmQgRE5TIG5hbWVzCiAgd2hlcmUgc3Vic3RyaW5nIG1hdGNoaW5nIGlzIHVuZGVzaXJhYmxlLgoKOnJlZjpgZGVib3BzLm5ldGJveGAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnJycnCgotIFVzaW5nIGJvb2xlYW4gdmFyaWFibGVzIGluIDplbnZ2YXI6YG5ldGJveF9fY29uZmlnX3BsdWdpbnNfY29uZmlnYCBmb3IKICBleGFtcGxlIHJlc3VsdGVkIGluIGFuIGVycm9yIGJlY2F1c2UgdGhlIHJvbGUgdXNlZCB0aGUgYGB0b19uaWNlX2pzb25gYAogIEppbmphMiBmaWx0ZXIgaW50ZXJuYWxseSB0byByZW5kZXIgUHl0aG9uIGNvbmZpZ3VyYXRpb24uCiAgVGhpcyBpcyBmaXhlZCBmb3IgYWxsIHVzZXMgb2YgYGB0b19uaWNlX2pzb25gYAoKOnJlZjpgZGVib3BzLm50cGAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnCgotIEZpeCBhbiBpc3N1ZSB3aGVyZSB0aGUgcm9sZSB0cmllZCB0byBtYW5hZ2UgdGhlIDpjb21tYW5kOmBzeXN0ZW1kLXRpbWVzeW5jZGAKICBzZXJ2aWNlIHdpdGhvdXQgaXQgYWN0dWFsbHkgYmVpbmcgcHJlc2VudCBvbiB0aGUgaG9zdC4gVGhpcyBzaG91bGQgbm93IGJlCiAgYXZvaWRlZCBieSBjYXJlZnVsbHkgY2hlY2tpbmcgdGhlIHNlcnZpY2Ugc3RhdHVzLgoKLSBUaGUgcm9sZSB3aWxsIG5vdCB0cnkgdG8gcHVyZ2UgaW5zdGFsbGVkIE5UUCBkYWVtb24gcGFja2FnZXMgd2hlbiBpdCBpcwogIGRpc2FibGVkIHRocm91Z2ggQW5zaWJsZSBpbnZlbnRvcnkuCgo6cmVmOmBkZWJvcHMub3duY2xvdWRgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnJycnCgotIEFjY2VzcyB0byBzdGF0aWMgYXNzZXRzIHdhcyBub3QgbG9nZ2VkIHJlZ2FyZGxlc3Mgb2YgdGhlCiAgYGBvd25jbG91ZF9fbmdpbnhfYWNjZXNzX2xvZ19hc3NldHNgYCBzZXR0aW5nLgoKLSBBY2Nlc3MgdG8gdGhlIGBgL3JlbW90ZWBgIFVSSSBwYXRoIHdhcyBub3QgY29uZmlndXJlZCBpbiBOZ2lueCBhcyBwcm9wb3NlZCBpbgogIHRoZSB1cHN0cmVhbSBOZ2lueCBleGFtcGxlIGluIHRoZSBOZXh0Y2xvdWQgZG9jcy4KCjpyZWY6YGRlYm9wcy5wZG5zYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycnCgotIE9uIHBkbnMgaW5zdGFsbGF0aW9ucyB3aXRoIHZlcnNpb24gPj0gNC41LjAgKGUuZy4gb24gQm9va3dvcm0gc3lzdGVtcyksIHRoZQogIHJvbGUgd291bGQgY2F1c2UgYSBzeW50YXggZXJyb3Igb24gdGhlIGxvY2FsLWFkZHJlc3MgY29uZmlndXJhdGlvbiBvcHRpb24uCgo6cmVmOmBkZWJvcHMucGtpYCByb2xlCicnJycnJycnJycnJycnJycnJycnJycKCi0gQWZ0ZXIgdGhlIDpjb21tYW5kOmBjZXJ0Ym90YCBzY3JpcHQgcGVyZm9ybXMgYSBjZXJ0aWZpY2F0ZSByZW5ld2FsIG9wZXJhdGlvbiwKICBhIGRlcGxveSBob29rIHdpbGwgdXBkYXRlIHRoZSBQRU0gY2hhaW5zIGluIGEgZ2l2ZW4gUEtJIHJlYWxtCiAgOmZpbGU6YHByaXZhdGUvYCBkaXJlY3RvcnkgdG8gaW5jbHVkZSB0aGUgbmV3IHByaXZhdGUga2V5IGNyZWF0ZWQgYnkgdGhlCiAgOmNvbW1hbmQ6YGNlcnRib3RgIHNjcmlwdC4KCi0gRml4ZWQgYW4gaXNzdWUgd2hlcmUgd2hlbiBhIFBLSSByZWFsbSB3YXMgaW5pdGlhbGl6ZWQgZm9yIEFDTUUvTGV0J3MgRW5jcnlwdAogIHN1cHBvcnQsIHNlY29uZCBsZXZlbCBkb21haW5zIHdlcmUgbm90IGluY2x1ZGVkIGluIHRoZSBnZW5lcmF0ZWQgWC41MDkKICBjZXJ0aWZpY2F0ZSByZXF1ZXN0LgoKLSBVc2UgOmNvbW1hbmQ6YG9wZW5zc2wgeDUwOSAtaW5mb3JtIFBFTWAgY29tbWFuZCB0byBleHBsaWNpdGx5IGNoZWNrIGZvcgogIGEgUEVNLWZvcm1hdHRlZCBYLjUwOSBjZXJ0aWZpY2F0ZSBmaWxlIGJlY2F1c2UgdGhlIG9sZCA6Y29tbWFuZDpgb3BlbnNzbCB4NTA5CiAgLWluYCBvcHRpb24gd2FzIGNoYW5nZWQgdG8gd29yayB3aXRoIGJvdGggREVSIGFuZCBQRU0gZmlsZXMuIFRoaXMgc2hvdWxkIGZpeAogIGFuIGlzc3VlIHdpdGggTGV0J3MgRW5jcnlwdCBjZXJ0aWZpY2F0ZSBjaGFpbnMgY29udGFpbmluZyBhIERFUi1mb3JtYXR0ZWQKICBjZXJ0aWZpY2F0ZSBpbnNpZGUgb2YgdGhlbS4KCiAgVXNlcnMgd2lsbCBuZWVkIHRvIHJlbW92ZSBleGlzdGluZyBQS0kgcmVhbG1zIHdoaWNoIHVzZSBBQ01FL0xldCdzIEVuY3J5cHQgQ0EKICBmb3IgdGhlIDpjb21tYW5kOmBwa2ktcmVhbG1gIHNjcmlwdCB0byByZWJ1aWxkIHRoZSBjZXJ0aWZpY2F0ZSBjaGFpbgogIGNvcnJlY3RseS4gQWZ0ZXIgdGhhdCByZS1ydW4gdGhlIDpyZWY6YGRlYm9wcy5wa2lgIHJvbGUgb24gdGhlIGhvc3QgdG8KICByZS1jcmVhdGUgY2hlIHJlYWxtcy4KCjpyZWY6YGRlYm9wcy5wb3N0Y29uZmAgcm9sZQonJycnJycnJycnJycnJycnJycnJycnJycnJycKCi0gVGhlIEVITE8gSVAgYWRkcmVzcyBjaGVjayB3YXMgcmVtb3ZlZC4gVGhpcyBjaGVjayB3b3VsZCByZWplY3QgYSBtZXNzYWdlIGlmCiAgdGhlIEVITE8gaG9zdG5hbWUgb2YgdGhlIGNvbm5lY3RpbmcgbWFpbHNlcnZlciByZXNvbHZlZCB0byBhIG5vbi1wdWJsaWNseQogIHJvdXRhYmxlIElQIGFkZHJlc3MuIEhvd2V2ZXIsIHJlamVjdGluZyBtZXNzYWdlcyBmb3IgdGhpcyByZWFzb24gaXMKICBwcm9oaWJpdGVkIGJ5IDpyZmM6YDUzMjFgIHNlY3Rpb24gNC4xLjQsIGFuZCBzb21ldGltZXMgY2F1c2VkIGRlbGl2ZXJhYmlsaXR5CiAgaXNzdWVzIGZvciBPZmZpY2UgMzY1IHVzZXJzLgoKOnJlZjpgZGVib3BzLnByZXNlZWRgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnJycKCi0gRml4ZWQgYW4gaXNzdWUgd2l0aCB0aGUgYGBkLWlgYCBrZXlib2FyZCBwcmVzZWVkIHRoYXQgcmVzdWx0ZWQgaW4gdGhlCiAgYGBrZXlib2FyZC1jb25maWd1cmF0aW9uYGAgQVBUIHBhY2thZ2Ugbm90IGJlaW5nIGluc3RhbGxlZCBhbmQgY29uZmlndXJlZAogIGNvcnJlY3RseS4gVGhlIGRlZmF1bHQga2V5bWFwIGlzIGNoYW5nZWQgdG8gYGB1c2BgIGFuZCB0aGUgb3B0aW9uIGlzIG5vCiAgbG9uZ2VyIGJhc2VkIG9uIHRoZSBzeXN0ZW0gbGFuZ3VhZ2Ugd2hpY2ggbWlnaHQgYmUgaW5jb3JyZWN0IGluIHRoaXMgY2FzZS4KCjpyZWY6YGRlYm9wcy5wcm9jX2hpZGVwaWRgIHJvbGUKJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJwoKLSBUaGUgZmFjdCBzY3JpcHQgaGFzIGJlZW4gb3B0aW1pemVkIAoKPC9kZXRhaWxzPgoKLS0tCgojIyMgQ29uZmlndXJhdGlvbgoK8J+ThSAqKlNjaGVkdWxlKio6IEJyYW5jaCBjcmVhdGlvbiAtIEF0IGFueSB0aW1lIChubyBzY2hlZHVsZSBkZWZpbmVkKSwgQXV0b21lcmdlIC0gQXQgYW55IHRpbWUgKG5vIHNjaGVkdWxlIGRlZmluZWQpLgoK8J+apiAqKkF1dG9tZXJnZSoqOiBEaXNhYmxlZCBieSBjb25maWcuIFBsZWFzZSBtZXJnZSB0aGlzIG1hbnVhbGx5IG9uY2UgeW91IGFyZSBzYXRpc2ZpZWQuCgrimbsgKipSZWJhc2luZyoqOiBXaGVuZXZlciBQUiBiZWNvbWVzIGNvbmZsaWN0ZWQsIG9yIHlvdSB0aWNrIHRoZSByZWJhc2UvcmV0cnkgY2hlY2tib3guCgrwn5SVICoqSWdub3JlKio6IENsb3NlIHRoaXMgUFIgYW5kIHlvdSB3b24ndCBiZSByZW1pbmRlZCBhYm91dCB0aGlzIHVwZGF0ZSBhZ2Fpbi4KCi0tLQoKIC0gWyBdIDwhLS0gcmViYXNlLWNoZWNrIC0tPklmIHlvdSB3YW50IHRvIHJlYmFzZS9yZXRyeSB0aGlzIFBSLCBjaGVjayB0aGlzIGJveAoKLS0tCgpUaGlzIFBSIHdhcyBnZW5lcmF0ZWQgYnkgW01lbmQgUmVub3ZhdGVdKGh0dHBzOi8vbWVuZC5pby9yZW5vdmF0ZS8pLiBWaWV3IHRoZSBbcmVwb3NpdG9yeSBqb2IgbG9nXShodHRwczovL2RldmVsb3Blci5tZW5kLmlvL2dpdGh1Yi9vc2lzbS9yZWxlYXNlKS4KPCEtLXJlbm92YXRlLWRlYnVnOmV5SmpjbVZoZEdWa1NXNVdaWElpT2lJME15NDJOaTQwSWl3aWRYQmtZWFJsWkVsdVZtVnlJam9pTkRNdU5qWXVOQ0lzSW5SaGNtZGxkRUp5WVc1amFDSTZJbTFoYVc0aUxDSnNZV0psYkhNaU9sc2ljbVZ1YjNaaGRHVWlYWDA9LS0+Cg==
      patchset: 652bba730ae468d75662534f6fc2512ae266fac2
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 4f450aa36c28b035ce97359a888edbd7599eaf31
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 397240f42127868e42e86e6aeb120c2cb092d117
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: a01eed06dffe368c1d01819193bfadccb137414d
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 4f450aa36c28b035ce97359a888edbd7599eaf31
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 397240f42127868e42e86e6aeb120c2cb092d117
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/flake8/run.yaml
          roles:
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_0/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_0/zuul-jobs/roles
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_1/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_1/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_2/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_2/openinfra-zuul-jobs/roles
      post_review: false
      post_timeout: null
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/release
        name: osism/release
        short_name: release
        src_dir: src/github.com/osism/release
      projects:
        github.com/osism/release:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          checkout: main
          checkout_description: zuul branch
          commit: 0408ff860ad2ae6cdd9c4aaec203d7d1ba07e906
          name: osism/release
          required: false
          short_name: release
          src_dir: src/github.com/osism/release
      ref: refs/pull/2419/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
