git: 0720a1d8ab10 - main - net/freeipa-server: Respect PREFIX and fix service restarts
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Fri, 04 Sep 2026 14:31:58 UTC
The branch main has been updated by joneum:
URL: https://cgit.FreeBSD.org/ports/commit/?id=0720a1d8ab10827cde5952188b8fccad06835306
commit 0720a1d8ab10827cde5952188b8fccad06835306
Author: Jochen Neumeister <joneum@FreeBSD.org>
AuthorDate: 2026-09-04 14:29:16 +0000
Commit: Jochen Neumeister <joneum@FreeBSD.org>
CommitDate: 2026-09-04 14:31:48 +0000
net/freeipa-server: Respect PREFIX and fix service restarts
The patches hardcoded /usr/local. They now carry %%PREFIX%% for this port's
own files and %%LOCALBASE%% for what other ports install, substituted in
post-patch.
Two restart fixes: the rc script passes --ignore-service-failures on restart
as it already does on start, so one failing service no longer takes the
Directory Server down with it, and FreeBSDService re-checks a service after a
failed rc action instead of trusting a status check that raced the pidfile.
Sponsored by: Netzkommune GmbH
---
net/freeipa-server/Makefile | 16 +-
net/freeipa-server/files/freeipa-server.in | 2 +-
net/freeipa-server/files/patch-client_ipa-join.c | 2 +-
...patch-install_share_ipa-kdc-proxy.conf.template | 6 +-
.../patch-install_tools_ipa-httpd-kdcproxy.in | 4 +-
.../patch-install_updates_80-schema__compat.update | 2 +-
.../files/patch-ipaplatform_base_paths.py | 46 ++--
.../files/patch-ipaplatform_freebsd_paths.py | 248 ++++++++++-----------
.../files/patch-ipaplatform_freebsd_services.py | 52 +++--
.../files/patch-ipapython_ipautil.py | 2 +-
.../files/patch-ipaserver_install_cainstance.py | 8 +-
.../patch-ipaserver_install_server_upgrade.py | 12 +-
12 files changed, 211 insertions(+), 189 deletions(-)
diff --git a/net/freeipa-server/Makefile b/net/freeipa-server/Makefile
index 6567e1379110..e86badffca7e 100644
--- a/net/freeipa-server/Makefile
+++ b/net/freeipa-server/Makefile
@@ -1,6 +1,6 @@
PORTNAME= freeipa-server
DISTVERSION= 4.13.2
-PORTREVISION= 1
+PORTREVISION= 2
CATEGORIES= net
MASTER_SITES= https://codeberg.org/freeipa/freeipa/releases/download/release-${DISTVERSION:S/./-/g}/
DISTNAME= freeipa-${DISTVERSION}
@@ -108,6 +108,20 @@ PLIST_SUB= DISTVERSION=${DISTVERSION}
OPTIONS_DEFINE= DOCS
+post-patch:
+ @${REINPLACE_CMD} -e 's|%%PREFIX%%|${PREFIX}|g' \
+ -e 's|%%LOCALBASE%%|${LOCALBASE}|g' \
+ ${WRKSRC}/client/ipa-join.c \
+ ${WRKSRC}/install/share/ipa-kdc-proxy.conf.template \
+ ${WRKSRC}/install/tools/ipa-httpd-kdcproxy.in \
+ ${WRKSRC}/install/updates/80-schema_compat.update \
+ ${WRKSRC}/ipaplatform/base/paths.py \
+ ${WRKSRC}/ipaplatform/freebsd/paths.py \
+ ${WRKSRC}/ipaplatform/freebsd/services.py \
+ ${WRKSRC}/ipapython/ipautil.py \
+ ${WRKSRC}/ipaserver/install/cainstance.py \
+ ${WRKSRC}/ipaserver/install/server/upgrade.py
+
post-build:
${MAKE_CMD} -C ${WRKSRC}/client \
LIBINTL_LIBS="-lintl" ipa-getkeytab ipa-rmkeytab ipa-join
diff --git a/net/freeipa-server/files/freeipa-server.in b/net/freeipa-server/files/freeipa-server.in
index b06145da69f1..befcdbcab6be 100644
--- a/net/freeipa-server/files/freeipa-server.in
+++ b/net/freeipa-server/files/freeipa-server.in
@@ -89,7 +89,7 @@ freeipa_server_stop()
freeipa_server_restart()
{
- "${command}" restart
+ "${command}" restart --ignore-service-failures
}
freeipa_server_status()
diff --git a/net/freeipa-server/files/patch-client_ipa-join.c b/net/freeipa-server/files/patch-client_ipa-join.c
index 94f5f85cc117..fbb40dd36b1e 100644
--- a/net/freeipa-server/files/patch-client_ipa-join.c
+++ b/net/freeipa-server/files/patch-client_ipa-join.c
@@ -5,7 +5,7 @@
if (childpid == 0) {
char *argv[12];
- char *path = "/usr/sbin/ipa-getkeytab";
-+ char *path = "/usr/local/sbin/ipa-getkeytab";
++ char *path = "%%PREFIX%%/sbin/ipa-getkeytab";
int arg = 0;
int err;
diff --git a/net/freeipa-server/files/patch-install_share_ipa-kdc-proxy.conf.template b/net/freeipa-server/files/patch-install_share_ipa-kdc-proxy.conf.template
index 70604cd4b10c..5eb7942bbe09 100644
--- a/net/freeipa-server/files/patch-install_share_ipa-kdc-proxy.conf.template
+++ b/net/freeipa-server/files/patch-install_share_ipa-kdc-proxy.conf.template
@@ -10,9 +10,9 @@
-# The symlink from /etc/ipa/kdcproxy/ to /etc/httpd/conf.d/ is maintained
-# by the ExecStartPre script /usr/libexec/ipa/ipa-httpd-kdcproxy in
-# httpd.service. The service also sets the environment variable
-+# The symlink from /usr/local/etc/ipa/kdcproxy/ipa-kdc-proxy.conf to
-+# /usr/local/etc/apache24/Includes/ipa-kdc-proxy.conf is maintained by
-+# /usr/local/libexec/ipa/ipa-httpd-kdcproxy in the apache24 RC start and
++# The symlink from %%LOCALBASE%%/etc/ipa/kdcproxy/ipa-kdc-proxy.conf to
++# %%LOCALBASE%%/etc/apache24/Includes/ipa-kdc-proxy.conf is maintained by
++# %%PREFIX%%/libexec/ipa/ipa-httpd-kdcproxy in the apache24 RC start and
+# restart hooks. The service also sets the environment variable
# KDCPROXY_CONFIG to $KDCPROXY_CONFIG.
#
diff --git a/net/freeipa-server/files/patch-install_tools_ipa-httpd-kdcproxy.in b/net/freeipa-server/files/patch-install_tools_ipa-httpd-kdcproxy.in
index 1c4cd439da11..befc5c49cb03 100644
--- a/net/freeipa-server/files/patch-install_tools_ipa-httpd-kdcproxy.in
+++ b/net/freeipa-server/files/patch-install_tools_ipa-httpd-kdcproxy.in
@@ -10,8 +10,8 @@
-This script creates or removes the symlink from /etc/ipa/ipa-kdc-proxy.conf
-to /etc/httpd/conf.d/. It's called from ExecStartPre hook in httpd.service.
+This script creates or removes the symlink from
-+/usr/local/etc/ipa/kdcproxy/ipa-kdc-proxy.conf to
-+/usr/local/etc/apache24/Includes/ipa-kdc-proxy.conf. It is called from the
++%%LOCALBASE%%/etc/ipa/kdcproxy/ipa-kdc-proxy.conf to
++%%LOCALBASE%%/etc/apache24/Includes/ipa-kdc-proxy.conf. It is called from the
+apache24 RC start and restart hooks.
"""
import logging
diff --git a/net/freeipa-server/files/patch-install_updates_80-schema__compat.update b/net/freeipa-server/files/patch-install_updates_80-schema__compat.update
index 604c26068239..52dba24e37a0 100644
--- a/net/freeipa-server/files/patch-install_updates_80-schema__compat.update
+++ b/net/freeipa-server/files/patch-install_updates_80-schema__compat.update
@@ -5,7 +5,7 @@
default:objectclass: extensibleObject
default:cn: Schema Compatibility
-default:nsslapd-pluginpath: /usr/lib$LIBARCH/dirsrv/plugins/schemacompat-plugin.so
-+default:nsslapd-pluginpath: /usr/local/lib/dirsrv/plugins/schemacompat-plugin.so
++default:nsslapd-pluginpath: %%LOCALBASE%%/lib/dirsrv/plugins/schemacompat-plugin.so
default:nsslapd-plugininitfunc: schema_compat_plugin_init
default:nsslapd-plugintype: object
default:nsslapd-pluginenabled: on
diff --git a/net/freeipa-server/files/patch-ipaplatform_base_paths.py b/net/freeipa-server/files/patch-ipaplatform_base_paths.py
index 1159b57f7cb7..d25860254221 100644
--- a/net/freeipa-server/files/patch-ipaplatform_base_paths.py
+++ b/net/freeipa-server/files/patch-ipaplatform_base_paths.py
@@ -6,15 +6,15 @@
NAMED_CUSTOM_OPTIONS_CONF = "/etc/named/ipa-options-ext.conf"
- NAMED_CONF_SRC = '/usr/share/ipa/bind.named.conf.template'
- NAMED_CUSTOM_CONF_SRC = '/usr/share/ipa/bind.ipa-ext.conf.template'
-+ NAMED_CONF_SRC = '/usr/local/share/ipa/bind.named.conf.template'
-+ NAMED_CUSTOM_CONF_SRC = '/usr/local/share/ipa/bind.ipa-ext.conf.template'
++ NAMED_CONF_SRC = '%%PREFIX%%/share/ipa/bind.named.conf.template'
++ NAMED_CUSTOM_CONF_SRC = '%%PREFIX%%/share/ipa/bind.ipa-ext.conf.template'
NAMED_CUSTOM_OPTIONS_CONF_SRC = (
- '/usr/share/ipa/bind.ipa-options-ext.conf.template'
-+ '/usr/local/share/ipa/bind.ipa-options-ext.conf.template'
++ '%%PREFIX%%/share/ipa/bind.ipa-options-ext.conf.template'
)
NAMED_LOGGING_OPTIONS_CONF_SRC = (
- "/usr/share/ipa/bind.ipa-logging-ext.conf.template"
-+ "/usr/local/share/ipa/bind.ipa-logging-ext.conf.template"
++ "%%PREFIX%%/share/ipa/bind.ipa-logging-ext.conf.template"
)
NAMED_VAR_DIR = "/var/named"
NAMED_KEYTAB = "/etc/named.keytab"
@@ -23,7 +23,7 @@
NAMED_MANAGED_KEYS_DIR = "/var/named/dynamic"
NAMED_CRYPTO_POLICY_FILE = None
- UNBOUND_CONF_SRC = '/usr/share/ipa/client/unbound.conf.template'
-+ UNBOUND_CONF_SRC = '/usr/local/share/ipa/client/unbound.conf.template'
++ UNBOUND_CONF_SRC = '%%LOCALBASE%%/share/ipa/client/unbound.conf.template'
UNBOUND_CONFIG_DIR = "/etc/unbound/conf.d/"
UNBOUND_CONF = "/etc/unbound/conf.d/zzz-ipa.conf"
NSLCD_CONF = "/etc/nslcd.conf"
@@ -32,12 +32,12 @@
SSH_CONFIG_DIR = "/etc/ssh"
SSH_CONFIG = "/etc/ssh/ssh_config"
- SSH_IPA_CONFIG_TEMPLATE = "/usr/share/ipa/client/ssh_ipa.conf.template"
-+ SSH_IPA_CONFIG_TEMPLATE = "/usr/local/share/ipa/client/ssh_ipa.conf.template"
++ SSH_IPA_CONFIG_TEMPLATE = "%%LOCALBASE%%/share/ipa/client/ssh_ipa.conf.template"
SSH_IPA_CONFIG = "/etc/ssh/ssh_config.d/04-ipa.conf"
SSHD_CONFIG = "/etc/ssh/sshd_config"
SSHD_IPA_CONFIG = "/etc/ssh/sshd_config.d/04-ipa.conf"
- SSHD_IPA_CONFIG_TEMPLATE = "/usr/share/ipa/client/sshd_ipa.conf.template"
-+ SSHD_IPA_CONFIG_TEMPLATE = "/usr/local/share/ipa/client/sshd_ipa.conf.template"
++ SSHD_IPA_CONFIG_TEMPLATE = "%%LOCALBASE%%/share/ipa/client/sshd_ipa.conf.template"
SSSD_CONF = "/etc/sssd/sssd.conf"
SSSD_CONF_BKP = "/etc/sssd/sssd.conf.bkp"
SSSD_CONF_DELETED = "/etc/sssd/sssd.conf.deleted"
@@ -47,8 +47,8 @@
BIN_KVNO = "/usr/bin/kvno"
- LDAPMODIFY = "/usr/bin/ldapmodify"
- LDAPPASSWD = "/usr/bin/ldappasswd"
-+ LDAPMODIFY = "/usr/local/bin/ldapmodify"
-+ LDAPPASSWD = "/usr/local/bin/ldappasswd"
++ LDAPMODIFY = "%%LOCALBASE%%/bin/ldapmodify"
++ LDAPPASSWD = "%%LOCALBASE%%/bin/ldappasswd"
MODUTIL = "/usr/bin/modutil"
NET = "/usr/bin/net"
BIN_NISDOMAINNAME = "/usr/bin/nisdomainname"
@@ -74,16 +74,16 @@
- SUBID_GENERATORS_ULDIF = "/usr/share/ipa/subid-generators.uldif"
- IPA_JS_PLUGINS_DIR = "/usr/share/ipa/ui/js/plugins"
- UPDATES_DIR = "/usr/share/ipa/updates/"
-+ USR_SHARE_IPA_DIR = "/usr/local/share/ipa/"
-+ USR_SHARE_IPA_CLIENT_DIR = "/usr/local/share/ipa/client"
-+ CA_TOPOLOGY_ULDIF = "/usr/local/share/ipa/ca-topology.uldif"
-+ IPA_HTML_DIR = "/usr/local/share/ipa/html"
-+ CA_CRT = "/usr/local/share/ipa/html/ca.crt"
-+ SCHEMA_COMPAT_ULDIF = "/usr/local/share/ipa/updates/91-schema_compat.update"
-+ SCHEMA_COMPAT_POST_ULDIF = "/usr/local/share/ipa/schema_compat_post.uldif"
-+ SUBID_GENERATORS_ULDIF = "/usr/local/share/ipa/subid-generators.uldif"
-+ IPA_JS_PLUGINS_DIR = "/usr/local/share/ipa/ui/js/plugins"
-+ UPDATES_DIR = "/usr/local/share/ipa/updates/"
++ USR_SHARE_IPA_DIR = "%%LOCALBASE%%/share/ipa/"
++ USR_SHARE_IPA_CLIENT_DIR = "%%LOCALBASE%%/share/ipa/client"
++ CA_TOPOLOGY_ULDIF = "%%PREFIX%%/share/ipa/ca-topology.uldif"
++ IPA_HTML_DIR = "%%LOCALBASE%%/share/ipa/html"
++ CA_CRT = "%%LOCALBASE%%/share/ipa/html/ca.crt"
++ SCHEMA_COMPAT_ULDIF = "%%LOCALBASE%%/share/ipa/updates/91-schema_compat.update"
++ SCHEMA_COMPAT_POST_ULDIF = "%%LOCALBASE%%/share/ipa/schema_compat_post.uldif"
++ SUBID_GENERATORS_ULDIF = "%%PREFIX%%/share/ipa/subid-generators.uldif"
++ IPA_JS_PLUGINS_DIR = "%%LOCALBASE%%/share/ipa/ui/js/plugins"
++ UPDATES_DIR = "%%LOCALBASE%%/share/ipa/updates/"
DICT_WORDS = "/usr/share/dict/words"
VAR_KERBEROS_KRB5KDC_DIR = "/var/kerberos/krb5kdc/"
VAR_KRB5KDC_K5_REALM = "/var/kerberos/krb5kdc/.k5."
@@ -101,7 +101,7 @@
IPA_GETKEYTAB = '/usr/sbin/ipa-getkeytab'
IPA_MIGRATE_LOG = '/var/log/ipa-migrate.log'
- EXTERNAL_SCHEMA_DIR = '/usr/share/ipa/schema.d'
-+ EXTERNAL_SCHEMA_DIR = '/usr/local/share/ipa/schema.d'
++ EXTERNAL_SCHEMA_DIR = '%%LOCALBASE%%/share/ipa/schema.d'
GSSPROXY_CONF = '/etc/gssproxy/10-ipa.conf'
KRB5CC_HTTPD = '/tmp/krb5cc-httpd'
IF_INET6 = '/proc/net/if_inet6'
@@ -112,9 +112,9 @@
- ETC_DIRSRV = "/etc/dirsrv"
- DS_KEYTAB = "/etc/dirsrv/ds.keytab"
- ETC_DIRSRV_SLAPD_INSTANCE_TEMPLATE = "/etc/dirsrv/slapd-%s"
-+ ETC_DIRSRV = "/usr/local/etc/dirsrv"
-+ DS_KEYTAB = "/usr/local/etc/dirsrv/ds.keytab"
-+ ETC_DIRSRV_SLAPD_INSTANCE_TEMPLATE = "/usr/local/etc/dirsrv/slapd-%s"
++ ETC_DIRSRV = "%%LOCALBASE%%/etc/dirsrv"
++ DS_KEYTAB = "%%LOCALBASE%%/etc/dirsrv/ds.keytab"
++ ETC_DIRSRV_SLAPD_INSTANCE_TEMPLATE = "%%LOCALBASE%%/etc/dirsrv/slapd-%s"
USR_LIB_DIRSRV = "/usr/lib/dirsrv"
USR_LIB_DIRSRV_64 = "/usr/lib64/dirsrv"
VAR_LIB_DIRSRV_INSTANCE_SCRIPTS_TEMPLATE = "/var/lib/dirsrv/scripts-%s"
diff --git a/net/freeipa-server/files/patch-ipaplatform_freebsd_paths.py b/net/freeipa-server/files/patch-ipaplatform_freebsd_paths.py
index 8ffb4cf36f56..3db105deb092 100644
--- a/net/freeipa-server/files/patch-ipaplatform_freebsd_paths.py
+++ b/net/freeipa-server/files/patch-ipaplatform_freebsd_paths.py
@@ -9,14 +9,14 @@
+
+
+class FreeBSDPathNamespace(BasePathNamespace):
-+ PKIDESTROY = "/usr/local/sbin/pkidestroy"
-+ PKISPAWN = "/usr/local/sbin/pkispawn"
-+ PKI = "/usr/local/bin/pki"
-+ PKI_SERVER = "/usr/local/sbin/pki-server"
-+ BIN_TOMCAT = "/usr/local/apache-tomcat-9.0/bin/catalina.sh"
++ PKIDESTROY = "%%LOCALBASE%%/sbin/pkidestroy"
++ PKISPAWN = "%%LOCALBASE%%/sbin/pkispawn"
++ PKI = "%%LOCALBASE%%/bin/pki"
++ PKI_SERVER = "%%LOCALBASE%%/sbin/pki-server"
++ BIN_TOMCAT = "%%LOCALBASE%%/apache-tomcat-9.0/bin/catalina.sh"
+ BIN_PS = "/bin/ps"
+
-+ PKI_CONFIGURATION = "/usr/local/etc/pki"
++ PKI_CONFIGURATION = "%%LOCALBASE%%/etc/pki"
+ PKI_TOMCAT = "/var/db/pki/pki-tomcat/conf"
+ PKI_TOMCAT_ALIAS_DIR = "/var/db/pki/pki-tomcat/alias"
+ PKI_TOMCAT_ALIAS_PWDFILE_TXT = "/var/db/pki/pki-tomcat/alias/pwdfile.txt"
@@ -43,19 +43,19 @@
+ IPA_OTPD_SOCKET = "/var/run/krb5kdc/DEFAULT.socket"
+ IPA_CCACHES = "/var/run/ipa/ccaches"
+ IPA_RENEWAL_LOCK = "/var/run/ipa/renewal.lock"
-+ KLIST = "/usr/local/bin/klist"
-+ KADMIN_LOCAL = "/usr/local/sbin/kadmin.local"
-+ KDB5_UTIL = "/usr/local/sbin/kdb5_util"
++ KLIST = "%%LOCALBASE%%/bin/klist"
++ KADMIN_LOCAL = "%%LOCALBASE%%/sbin/kadmin.local"
++ KDB5_UTIL = "%%LOCALBASE%%/sbin/kdb5_util"
+
-+ ETC_IPA = "/usr/local/etc/ipa"
-+ IPA_DEFAULT_CONF = "/usr/local/etc/ipa/default.conf"
++ ETC_IPA = "%%LOCALBASE%%/etc/ipa"
++ IPA_DEFAULT_CONF = "%%LOCALBASE%%/etc/ipa/default.conf"
+
-+ IPA_CUSTODIA_CONF_DIR = "/usr/local/etc/ipa/custodia"
-+ IPA_CUSTODIA_CONF = "/usr/local/etc/ipa/custodia/custodia.conf"
-+ IPA_CUSTODIA_KEYS = "/usr/local/etc/ipa/custodia/server.keys"
++ IPA_CUSTODIA_CONF_DIR = "%%LOCALBASE%%/etc/ipa/custodia"
++ IPA_CUSTODIA_CONF = "%%LOCALBASE%%/etc/ipa/custodia/custodia.conf"
++ IPA_CUSTODIA_KEYS = "%%LOCALBASE%%/etc/ipa/custodia/server.keys"
+ IPA_CUSTODIA_SOCKET = "/var/run/httpd/ipa-custodia.sock"
+
-+ KDCPROXY_CONFIG = "/usr/local/etc/ipa/kdcproxy/kdcproxy.conf"
++ KDCPROXY_CONFIG = "%%PREFIX%%/etc/ipa/kdcproxy/kdcproxy.conf"
+
+ VAR_LIB_IPA = "/var/db/ipa"
+ CA_BUNDLE_PEM = "/var/db/ipa-client/pki/ca-bundle.pem"
@@ -64,7 +64,7 @@
+ HTTPD_KEY_FILE = "/var/db/ipa/private/httpd.key"
+ HTTPD_PASSWD_FILE_FMT = "/var/db/ipa/passwds/{host}-443-RSA"
+ HTTP_KEYTAB = "/var/db/ipa/gssproxy/http.keytab"
-+ GSSPROXY_CONF = "/usr/local/etc/gssproxy/10-ipa.conf"
++ GSSPROXY_CONF = "%%LOCALBASE%%/etc/gssproxy/10-ipa.conf"
+ IPA_CCACHE_SWEEPER_GSSPROXY_SOCK = (
+ "/var/db/gssproxy/ipa_ccache_sweeper.sock"
+ )
@@ -79,72 +79,72 @@
+ REPLICA_INFO_TEMPLATE = "/var/db/ipa/replica-info-%s"
+ REPLICA_INFO_GPG_TEMPLATE = "/var/db/ipa/replica-info-%s.gpg"
+ PKI_CA_PUBLISH_DIR = "/var/db/ipa/pki-ca/publish"
-+ CERTUTIL = "/usr/local/bin/certutil"
-+ PK12UTIL = "/usr/local/bin/pk12util"
-+ MODUTIL = "/usr/local/bin/modutil"
++ CERTUTIL = "%%LOCALBASE%%/bin/certutil"
++ PK12UTIL = "%%LOCALBASE%%/bin/pk12util"
++ MODUTIL = "%%LOCALBASE%%/bin/modutil"
+ SYSCONFIG_PKI_TOMCAT = "/var/db/pki/pki-tomcat/conf/tomcat.conf"
-+ SYSCONFIG_PKI_TOMCAT_PKI_TOMCAT_DIR = "/usr/local/etc/pki/tomcat/pki-tomcat"
++ SYSCONFIG_PKI_TOMCAT_PKI_TOMCAT_DIR = "%%LOCALBASE%%/etc/pki/tomcat/pki-tomcat"
+ IPA_CLIENT_SYSRESTORE = "/var/db/ipa-client/sysrestore"
+ SYSRESTORE_INDEX = "/var/db/ipa-client/sysrestore/sysrestore.index"
+ SYSRESTORE = "/var/db/ipa/sysrestore"
+ STATEFILE_DIR = "/var/db/ipa/sysupgrade"
+
-+ VAR_KERBEROS_KRB5KDC_DIR = "/usr/local/var/krb5kdc/"
-+ KRB5_CONF = "/usr/local/etc/krb5.conf"
-+ COMMON_KRB5_CONF_DIR = "/usr/local/etc/krb5.conf.d/"
-+ KRB5_FREEIPA_DEFAULTS = "/usr/local/etc/krb5.conf.d/freeipa"
-+ KRB5_FREEIPA = "/usr/local/etc/krb5.conf.d/freeipa-realm"
-+ KRB5_FREEIPA_SERVER = "/usr/local/etc/krb5.conf.d/freeipa-server"
-+ VAR_KRB5KDC_K5_REALM = "/usr/local/var/krb5kdc/.k5."
-+ CACERT_PEM = "/usr/local/var/krb5kdc/cacert.pem"
-+ KRB5KDC_KADM5_ACL = "/usr/local/var/krb5kdc/kadm5.acl"
-+ KRB5KDC_KADM5_KEYTAB = "/usr/local/var/krb5kdc/kadm5.keytab"
-+ KRB5KDC_KDC_CONF = "/usr/local/var/krb5kdc/kdc.conf"
-+ KDC_CERT = "/usr/local/var/krb5kdc/kdc.crt"
-+ KDC_KEY = "/usr/local/var/krb5kdc/kdc.key"
-+
-+ IPACTL = "/usr/local/sbin/ipactl"
-+ IPA_CLIENT_AUTOMOUNT = "/usr/local/sbin/ipa-client-automount"
-+ IPA_CLIENT_INSTALL = "/usr/local/sbin/ipa-client-install"
-+ IPA_GETKEYTAB = "/usr/local/sbin/ipa-getkeytab"
-+ IPA_RMKEYTAB = "/usr/local/sbin/ipa-rmkeytab"
-+ SBIN_IPA_JOIN = "/usr/local/sbin/ipa-join"
-+ CONNCHECK_CCACHE = "/usr/local/etc/ipa/.conncheck_ccache"
-+ IPA_DNS_CCACHE = "/usr/local/etc/ipa/.dns_ccache"
-+ OPENLDAP_LDAP_CONF = "/usr/local/etc/openldap/ldap.conf"
-+ IPA_DNS_UPDATE_TXT = "/usr/local/etc/ipa/.dns_update.txt"
-+ IPA_CA_CRT = "/usr/local/etc/ipa/ca.crt"
-+ IPA_DNSKEYSYNCD_KEYTAB = "/usr/local/etc/ipa/dnssec/ipa-dnskeysyncd.keytab"
-+ IPA_ODS_EXPORTER_KEYTAB = "/usr/local/etc/ipa/dnssec/ipa-ods-exporter.keytab"
-+ IPA_SERVER_CONF = "/usr/local/etc/ipa/server.conf"
-+ DNSSEC_OPENSSL_CONF = "/usr/local/etc/ipa/dnssec/openssl.cnf"
-+ DNSSEC_SOFTHSM2_CONF = "/usr/local/etc/ipa/dnssec/softhsm2.conf"
-+ DNSSEC_SOFTHSM_PIN_SO = "/usr/local/etc/ipa/dnssec/softhsm_pin_so"
-+ IPA_NSSDB_DIR = "/usr/local/etc/ipa/nssdb"
-+ IPA_NSSDB_PWDFILE_TXT = "/usr/local/etc/ipa/nssdb/pwdfile.txt"
-+ NSS_DB_DIR = "/usr/local/etc/pki/nssdb"
-+
-+ LIBEXEC_IPA_DIR = "/usr/local/libexec/ipa"
-+ IPA_OTPD = "/usr/local/libexec/ipa/ipa-otpd"
-+ IPA_OTPD_WRAPPER = "/usr/local/libexec/ipa/ipa-otpd-wrapper"
++ VAR_KERBEROS_KRB5KDC_DIR = "%%LOCALBASE%%/var/krb5kdc/"
++ KRB5_CONF = "%%LOCALBASE%%/etc/krb5.conf"
++ COMMON_KRB5_CONF_DIR = "%%LOCALBASE%%/etc/krb5.conf.d/"
++ KRB5_FREEIPA_DEFAULTS = "%%LOCALBASE%%/etc/krb5.conf.d/freeipa"
++ KRB5_FREEIPA = "%%LOCALBASE%%/etc/krb5.conf.d/freeipa-realm"
++ KRB5_FREEIPA_SERVER = "%%LOCALBASE%%/etc/krb5.conf.d/freeipa-server"
++ VAR_KRB5KDC_K5_REALM = "%%LOCALBASE%%/var/krb5kdc/.k5."
++ CACERT_PEM = "%%LOCALBASE%%/var/krb5kdc/cacert.pem"
++ KRB5KDC_KADM5_ACL = "%%LOCALBASE%%/var/krb5kdc/kadm5.acl"
++ KRB5KDC_KADM5_KEYTAB = "%%LOCALBASE%%/var/krb5kdc/kadm5.keytab"
++ KRB5KDC_KDC_CONF = "%%LOCALBASE%%/var/krb5kdc/kdc.conf"
++ KDC_CERT = "%%LOCALBASE%%/var/krb5kdc/kdc.crt"
++ KDC_KEY = "%%LOCALBASE%%/var/krb5kdc/kdc.key"
++
++ IPACTL = "%%PREFIX%%/sbin/ipactl"
++ IPA_CLIENT_AUTOMOUNT = "%%PREFIX%%/sbin/ipa-client-automount"
++ IPA_CLIENT_INSTALL = "%%PREFIX%%/sbin/ipa-client-install"
++ IPA_GETKEYTAB = "%%PREFIX%%/sbin/ipa-getkeytab"
++ IPA_RMKEYTAB = "%%PREFIX%%/sbin/ipa-rmkeytab"
++ SBIN_IPA_JOIN = "%%PREFIX%%/sbin/ipa-join"
++ CONNCHECK_CCACHE = "%%LOCALBASE%%/etc/ipa/.conncheck_ccache"
++ IPA_DNS_CCACHE = "%%LOCALBASE%%/etc/ipa/.dns_ccache"
++ OPENLDAP_LDAP_CONF = "%%LOCALBASE%%/etc/openldap/ldap.conf"
++ IPA_DNS_UPDATE_TXT = "%%LOCALBASE%%/etc/ipa/.dns_update.txt"
++ IPA_CA_CRT = "%%LOCALBASE%%/etc/ipa/ca.crt"
++ IPA_DNSKEYSYNCD_KEYTAB = "%%LOCALBASE%%/etc/ipa/dnssec/ipa-dnskeysyncd.keytab"
++ IPA_ODS_EXPORTER_KEYTAB = "%%LOCALBASE%%/etc/ipa/dnssec/ipa-ods-exporter.keytab"
++ IPA_SERVER_CONF = "%%LOCALBASE%%/etc/ipa/server.conf"
++ DNSSEC_OPENSSL_CONF = "%%LOCALBASE%%/etc/ipa/dnssec/openssl.cnf"
++ DNSSEC_SOFTHSM2_CONF = "%%LOCALBASE%%/etc/ipa/dnssec/softhsm2.conf"
++ DNSSEC_SOFTHSM_PIN_SO = "%%LOCALBASE%%/etc/ipa/dnssec/softhsm_pin_so"
++ IPA_NSSDB_DIR = "%%LOCALBASE%%/etc/ipa/nssdb"
++ IPA_NSSDB_PWDFILE_TXT = "%%LOCALBASE%%/etc/ipa/nssdb/pwdfile.txt"
++ NSS_DB_DIR = "%%LOCALBASE%%/etc/pki/nssdb"
++
++ LIBEXEC_IPA_DIR = "%%LOCALBASE%%/libexec/ipa"
++ IPA_OTPD = "%%PREFIX%%/libexec/ipa/ipa-otpd"
++ IPA_OTPD_WRAPPER = "%%PREFIX%%/libexec/ipa/ipa-otpd-wrapper"
+ IPA_OTPD_LOG = "/var/log/ipa-otpd.log"
-+ LIBEXEC_CERTMONGER_DIR = "/usr/local/libexec/certmonger"
-+ CERTMONGER_COMMAND_TEMPLATE = "/usr/local/libexec/ipa/certmonger/%s"
-+ CERTMONGER_DOGTAG_SUBMIT = "/usr/local/libexec/certmonger/dogtag-submit"
-+ DOGTAG_IPA_CA_RENEW_AGENT_SUBMIT = "/usr/local/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit"
-+ DOGTAG_IPA_RENEW_AGENT_SUBMIT = "/usr/local/libexec/certmonger/dogtag-ipa-renew-agent-submit"
-+ IPA_SERVER_GUARD = "/usr/local/libexec/certmonger/ipa-server-guard"
-+ IPA_DNSKEYSYNCD_REPLICA = "/usr/local/libexec/ipa/ipa-dnskeysync-replica"
-+ IPA_DNSKEYSYNCD = "/usr/local/libexec/ipa/ipa-dnskeysyncd"
-+ IPA_ODS_EXPORTER = "/usr/local/libexec/ipa/ipa-ods-exporter"
-+ IPA_PKI_RETRIEVE_KEY = "/usr/local/libexec/ipa/ipa-pki-retrieve-key"
-+ IPA_PKI_WAIT_RUNNING = "/usr/local/libexec/ipa/ipa-pki-wait-running"
-+ IPA_CUSTODIA_HANDLER = "/usr/local/libexec/ipa/custodia"
-+ IPA_CUSTODIA_CHECK = "/usr/local/libexec/ipa/ipa-custodia-check"
-+
-+ SSSD_CONF = "/usr/local/etc/sssd/sssd.conf"
-+ SSSD_CONF_BKP = "/usr/local/etc/sssd/sssd.conf.bkp"
-+ SSSD_CONF_DELETED = "/usr/local/etc/sssd/sssd.conf.deleted"
++ LIBEXEC_CERTMONGER_DIR = "%%LOCALBASE%%/libexec/certmonger"
++ CERTMONGER_COMMAND_TEMPLATE = "%%LOCALBASE%%/libexec/ipa/certmonger/%s"
++ CERTMONGER_DOGTAG_SUBMIT = "%%LOCALBASE%%/libexec/certmonger/dogtag-submit"
++ DOGTAG_IPA_CA_RENEW_AGENT_SUBMIT = "%%PREFIX%%/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit"
++ DOGTAG_IPA_RENEW_AGENT_SUBMIT = "%%LOCALBASE%%/libexec/certmonger/dogtag-ipa-renew-agent-submit"
++ IPA_SERVER_GUARD = "%%PREFIX%%/libexec/certmonger/ipa-server-guard"
++ IPA_DNSKEYSYNCD_REPLICA = "%%PREFIX%%/libexec/ipa/ipa-dnskeysync-replica"
++ IPA_DNSKEYSYNCD = "%%PREFIX%%/libexec/ipa/ipa-dnskeysyncd"
++ IPA_ODS_EXPORTER = "%%PREFIX%%/libexec/ipa/ipa-ods-exporter"
++ IPA_PKI_RETRIEVE_KEY = "%%PREFIX%%/libexec/ipa/ipa-pki-retrieve-key"
++ IPA_PKI_WAIT_RUNNING = "%%PREFIX%%/libexec/ipa/ipa-pki-wait-running"
++ IPA_CUSTODIA_HANDLER = "%%LOCALBASE%%/libexec/ipa/custodia"
++ IPA_CUSTODIA_CHECK = "%%PREFIX%%/libexec/ipa/ipa-custodia-check"
++
++ SSSD_CONF = "%%LOCALBASE%%/etc/sssd/sssd.conf"
++ SSSD_CONF_BKP = "%%LOCALBASE%%/etc/sssd/sssd.conf.bkp"
++ SSSD_CONF_DELETED = "%%LOCALBASE%%/etc/sssd/sssd.conf.deleted"
+ SSSD_DB = "/var/db/sss/db"
+ SSSD_LDB = "/var/db/sss/db/sssd.ldb"
+ SSSD_CONFIG_LDB = "/var/db/sss/db/config.ldb"
@@ -159,7 +159,7 @@
+ SSSD_KEYTABS_DIR = "/var/db/sss/keytabs"
+ SSSD_SECRETS = "/var/db/sss/secrets/secrets.ldb"
+
-+ DSCTL = "/usr/local/bin/dsctl"
++ DSCTL = "%%LOCALBASE%%/bin/dsctl"
+
+ VAR_LIB_DIRSRV = "/var/db/dirsrv"
+ VAR_LIB_DIRSRV_INSTANCE_SCRIPTS_TEMPLATE = "/var/db/dirsrv/scripts-%s"
@@ -170,55 +170,55 @@
+ VAR_RUN_DIRSRV_DIR = "/var/run/dirsrv"
+ DIRSRV_LOCK_DIR = "/var/run/dirsrv"
+
-+ HTTPD = "/usr/local/sbin/httpd"
-+ ETC_HTTPD_DIR = "/usr/local/etc/apache24"
-+ HTTPD_ALIAS_DIR = "/usr/local/etc/apache24/alias"
-+ GSSAPI_SESSION_KEY = "/usr/local/etc/apache24/alias/ipasession.key"
-+ HTTPD_CONF_D_DIR = "/usr/local/etc/apache24/Includes/"
-+ HTTPD_IPA_WSGI_MODULES_CONF = "/usr/local/etc/apache24/modules.d/290_freeipa.conf"
-+ HTTPD_IPA_ENVVARS_CONF = "/usr/local/etc/apache24/envvars.d/ipa.env"
-+ HTTPD_IPA_RC_CONF = "/usr/local/etc/rc.conf.d/apache24/ipa"
-+ HTTPD_IPA_CONF = "/usr/local/etc/apache24/Includes/ipa.conf"
-+ HTTPD_IPA_KDCPROXY_CONF = "/usr/local/etc/ipa/kdcproxy/ipa-kdc-proxy.conf"
-+ HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/usr/local/etc/apache24/Includes/ipa-kdc-proxy.conf"
-+ HTTPD_IPA_PKI_PROXY_CONF = "/usr/local/etc/apache24/Includes/ipa-pki-proxy.conf"
-+ HTTPD_IPA_REWRITE_CONF = "/usr/local/etc/apache24/Includes/ipa-rewrite.conf"
-+ HTTPD_NSS_CONF = "/usr/local/etc/apache24/Includes/nss.conf"
-+ HTTPD_PASSWORD_CONF = "/usr/local/etc/apache24/password.conf"
-+ HTTPD_SSL_CONF = "/usr/local/etc/apache24/extra/httpd-ssl.conf"
-+ HTTPD_SSL_SITE_CONF = "/usr/local/etc/apache24/extra/httpd-ssl.conf"
-+ HTTPD_IPA_SSL_CONF_SYMLINK = "/usr/local/etc/apache24/Includes/ipa-ssl.conf"
-+ OLD_IPA_KEYTAB = "/usr/local/etc/apache24/ipa.keytab"
-+ OLD_KRA_AGENT_PEM = "/usr/local/etc/apache24/alias/kra-agent.pem"
++ HTTPD = "%%LOCALBASE%%/sbin/httpd"
++ ETC_HTTPD_DIR = "%%LOCALBASE%%/etc/apache24"
++ HTTPD_ALIAS_DIR = "%%LOCALBASE%%/etc/apache24/alias"
++ GSSAPI_SESSION_KEY = "%%LOCALBASE%%/etc/apache24/alias/ipasession.key"
++ HTTPD_CONF_D_DIR = "%%LOCALBASE%%/etc/apache24/Includes/"
++ HTTPD_IPA_WSGI_MODULES_CONF = "%%LOCALBASE%%/etc/apache24/modules.d/290_freeipa.conf"
++ HTTPD_IPA_ENVVARS_CONF = "%%LOCALBASE%%/etc/apache24/envvars.d/ipa.env"
++ HTTPD_IPA_RC_CONF = "%%LOCALBASE%%/etc/rc.conf.d/apache24/ipa"
++ HTTPD_IPA_CONF = "%%LOCALBASE%%/etc/apache24/Includes/ipa.conf"
++ HTTPD_IPA_KDCPROXY_CONF = "%%LOCALBASE%%/etc/ipa/kdcproxy/ipa-kdc-proxy.conf"
++ HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "%%LOCALBASE%%/etc/apache24/Includes/ipa-kdc-proxy.conf"
++ HTTPD_IPA_PKI_PROXY_CONF = "%%LOCALBASE%%/etc/apache24/Includes/ipa-pki-proxy.conf"
++ HTTPD_IPA_REWRITE_CONF = "%%LOCALBASE%%/etc/apache24/Includes/ipa-rewrite.conf"
++ HTTPD_NSS_CONF = "%%LOCALBASE%%/etc/apache24/Includes/nss.conf"
++ HTTPD_PASSWORD_CONF = "%%LOCALBASE%%/etc/apache24/password.conf"
++ HTTPD_SSL_CONF = "%%LOCALBASE%%/etc/apache24/extra/httpd-ssl.conf"
++ HTTPD_SSL_SITE_CONF = "%%LOCALBASE%%/etc/apache24/extra/httpd-ssl.conf"
++ HTTPD_IPA_SSL_CONF_SYMLINK = "%%LOCALBASE%%/etc/apache24/Includes/ipa-ssl.conf"
++ OLD_IPA_KEYTAB = "%%LOCALBASE%%/etc/apache24/ipa.keytab"
++ OLD_KRA_AGENT_PEM = "%%LOCALBASE%%/etc/apache24/alias/kra-agent.pem"
+ WSGI_PREFIX_DIR = "/var/run/httpd/wsgi"
-+ IPA_HTTPD_KDCPROXY = "/usr/local/libexec/ipa/ipa-httpd-kdcproxy"
-+ IPA_HTTPD_PASSWD_READER = "/usr/local/libexec/ipa/ipa-httpd-pwdreader"
-+
-+ BIN_CURL = "/usr/local/bin/curl"
-+ CERTMONGER = "/usr/local/sbin/certmonger"
-+ GPG2 = "/usr/local/bin/gpg"
-+ GPG_AGENT = "/usr/local/bin/gpg-agent"
-+ IPA_DNS_INSTALL = "/usr/local/sbin/ipa-dns-install"
-+ IPA_REPLICA_CONNCHECK = "/usr/local/sbin/ipa-replica-conncheck"
-+ IPA_SERVER_UPGRADE = "/usr/local/sbin/ipa-server-upgrade"
-+ KDESTROY = "/usr/local/bin/kdestroy"
-+ KINIT = "/usr/local/bin/kinit"
-+ KTUTIL = "/usr/local/bin/ktutil"
-+ NET = "/usr/local/bin/net"
-+ NSUPDATE = "/usr/local/bin/nsupdate"
-+ SMBD = "/usr/local/sbin/smbd"
-+ SSSCTL = "/usr/local/sbin/sssctl"
-+ SSS_SSH_AUTHORIZEDKEYS = "/usr/local/bin/sss_ssh_authorizedkeys"
-+ SSS_SSH_KNOWNHOSTS = "/usr/local/bin/sss_ssh_knownhosts"
-+ SSS_SSH_KNOWNHOSTSPROXY = "/usr/local/bin/sss_ssh_knownhostsproxy"
-+ TDBTOOL = "/usr/local/bin/tdbtool"
-+
-+ IPA_CACERT_MANAGE = "/usr/local/sbin/ipa-cacert-manage"
-+ IPA_GETCERT = "/usr/local/bin/ipa-getcert"
-+
-+ CHRONYC = "/usr/local/bin/chronyc"
-+ CHRONYD = "/usr/local/sbin/chronyd"
-+ CHRONY_CONF = "/usr/local/etc/chrony.conf"
++ IPA_HTTPD_KDCPROXY = "%%PREFIX%%/libexec/ipa/ipa-httpd-kdcproxy"
++ IPA_HTTPD_PASSWD_READER = "%%PREFIX%%/libexec/ipa/ipa-httpd-pwdreader"
++
++ BIN_CURL = "%%LOCALBASE%%/bin/curl"
++ CERTMONGER = "%%LOCALBASE%%/sbin/certmonger"
++ GPG2 = "%%LOCALBASE%%/bin/gpg"
++ GPG_AGENT = "%%LOCALBASE%%/bin/gpg-agent"
++ IPA_DNS_INSTALL = "%%PREFIX%%/sbin/ipa-dns-install"
++ IPA_REPLICA_CONNCHECK = "%%PREFIX%%/sbin/ipa-replica-conncheck"
++ IPA_SERVER_UPGRADE = "%%PREFIX%%/sbin/ipa-server-upgrade"
++ KDESTROY = "%%LOCALBASE%%/bin/kdestroy"
++ KINIT = "%%LOCALBASE%%/bin/kinit"
++ KTUTIL = "%%LOCALBASE%%/bin/ktutil"
++ NET = "%%LOCALBASE%%/bin/net"
++ NSUPDATE = "%%LOCALBASE%%/bin/nsupdate"
++ SMBD = "%%LOCALBASE%%/sbin/smbd"
++ SSSCTL = "%%LOCALBASE%%/sbin/sssctl"
++ SSS_SSH_AUTHORIZEDKEYS = "%%LOCALBASE%%/bin/sss_ssh_authorizedkeys"
++ SSS_SSH_KNOWNHOSTS = "%%LOCALBASE%%/bin/sss_ssh_knownhosts"
++ SSS_SSH_KNOWNHOSTSPROXY = "%%LOCALBASE%%/bin/sss_ssh_knownhostsproxy"
++ TDBTOOL = "%%LOCALBASE%%/bin/tdbtool"
++
++ IPA_CACERT_MANAGE = "%%PREFIX%%/sbin/ipa-cacert-manage"
++ IPA_GETCERT = "%%LOCALBASE%%/bin/ipa-getcert"
++
++ CHRONYC = "%%LOCALBASE%%/bin/chronyc"
++ CHRONYD = "%%LOCALBASE%%/sbin/chronyd"
++ CHRONY_CONF = "%%LOCALBASE%%/etc/chrony.conf"
+
+ SYSTEMCTL = None
+ SYSTEMD_TMPFILES = None
diff --git a/net/freeipa-server/files/patch-ipaplatform_freebsd_services.py b/net/freeipa-server/files/patch-ipaplatform_freebsd_services.py
index a5df0aba1308..c21366ce1d7b 100644
--- a/net/freeipa-server/files/patch-ipaplatform_freebsd_services.py
+++ b/net/freeipa-server/files/patch-ipaplatform_freebsd_services.py
@@ -1,6 +1,6 @@
--- ipaplatform/freebsd/services.py.orig 2026-08-19 14:16:07 UTC
+++ ipaplatform/freebsd/services.py
-@@ -0,0 +1,576 @@
+@@ -0,0 +1,584 @@
+#
+# Copyright (C) 2026 FreeIPA Contributors see COPYING for license
+#
@@ -43,11 +43,11 @@
+
+freebsd_kerberos_rc_programs = {
+ "kdc": {
-+ "kdc_program": "/usr/local/sbin/krb5kdc",
++ "kdc_program": "%%LOCALBASE%%/sbin/krb5kdc",
+ },
+ "kadmind": {
-+ "kdc_program": "/usr/local/sbin/krb5kdc",
-+ "kadmind_program": "/usr/local/sbin/kadmind",
++ "kdc_program": "%%LOCALBASE%%/sbin/krb5kdc",
++ "kadmind_program": "%%LOCALBASE%%/sbin/kadmind",
+ },
+}
+
@@ -120,25 +120,33 @@
+ skip_output=daemonizing or not capture_output
+ )
+
++ def _run_service_tolerant(self, action, capture_output=True):
++ try:
++ self._run_service(action, capture_output=capture_output)
++ except ipautil.CalledProcessError:
++ if self.is_running():
++ logger.warning(
++ "'%s %s' reported a failure but the service is running, "
++ "continuing", self.rc_name, action)
++ return
++ # FreeBSD base rc scripts for the Kerberos daemons (kdc,
++ # kadmind) can fail to (re)start while the environment is
++ # being torn down -- e.g. SimpleServiceInstance.uninstall()
++ # restores a previously-running kadmind after krb5kdc/DS
++ # were already unconfigured. Aborting the whole uninstall
++ # over a best-effort restore is worse than continuing; a
++ # genuine install-time failure still surfaces at the first
++ # real use of the service.
++ if self.rc_name not in ("kdc", "kadmind"):
++ raise
++ logger.warning(
++ "Ignoring failed '%s %s' (service could not be started; "
++ "likely mid-teardown restore)", self.rc_name, action)
++
+ def start(self, instance_name="", capture_output=True, wait=True):
+ os.makedirs(os.path.dirname(paths.SVC_LIST_FILE), mode=0o711, exist_ok=True)
+ if not self.is_running(instance_name, wait=wait):
-+ try:
-+ self._run_service("onestart", capture_output=capture_output)
-+ except ipautil.CalledProcessError:
-+ # FreeBSD base rc scripts for the Kerberos daemons (kdc,
-+ # kadmind) can fail to (re)start while the environment is
-+ # being torn down -- e.g. SimpleServiceInstance.uninstall()
-+ # restores a previously-running kadmind after krb5kdc/DS
-+ # were already unconfigured. Aborting the whole uninstall
-+ # over a best-effort restore is worse than continuing; a
-+ # genuine install-time failure still surfaces at the first
-+ # real use of the service.
-+ if self.rc_name not in ("kdc", "kadmind"):
-+ raise
-+ logger.warning(
-+ "Ignoring failed '%s onestart' (service could not be "
-+ "started; likely mid-teardown restore)", self.rc_name)
++ self._run_service_tolerant("onestart", capture_output=capture_output)
+ super(FreeBSDService, self).start(
+ instance_name, capture_output=capture_output, wait=wait
+ )
@@ -151,7 +159,7 @@
+ )
+
+ def restart(self, instance_name="", capture_output=True, wait=True):
-+ self._run_service("onerestart", capture_output=capture_output)
++ self._run_service_tolerant("onerestart", capture_output=capture_output)
+
+ def try_restart(self, instance_name="", capture_output=True, wait=True):
+ if self.is_running(instance_name, wait=wait):
@@ -170,7 +178,7 @@
+ def is_installed(self):
+ return (
+ os.path.exists("/etc/rc.d/%s" % self.rc_name) or
-+ os.path.exists("/usr/local/etc/rc.d/%s" % self.rc_name)
++ os.path.exists("%%LOCALBASE%%/etc/rc.d/%s" % self.rc_name)
+ )
+
+ def enable(self, instance_name=""):
diff --git a/net/freeipa-server/files/patch-ipapython_ipautil.py b/net/freeipa-server/files/patch-ipapython_ipautil.py
index 9649c574700b..0e5bd5a84a5d 100644
--- a/net/freeipa-server/files/patch-ipapython_ipautil.py
+++ b/net/freeipa-server/files/patch-ipapython_ipautil.py
@@ -5,7 +5,7 @@
# copy default env
env = copy.deepcopy(os.environ)
- env["PATH"] = "/bin:/sbin:/usr/kerberos/bin:/usr/kerberos/sbin:/usr/bin:/usr/sbin"
-+ env["PATH"] = "/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin"
++ env["PATH"] = "/sbin:/bin:/usr/sbin:/usr/bin:%%LOCALBASE%%/sbin:%%LOCALBASE%%/bin"
if stdin:
p_in = subprocess.PIPE
if skip_output:
diff --git a/net/freeipa-server/files/patch-ipaserver_install_cainstance.py b/net/freeipa-server/files/patch-ipaserver_install_cainstance.py
index 3685347a545b..454935f7406d 100644
--- a/net/freeipa-server/files/patch-ipaserver_install_cainstance.py
+++ b/net/freeipa-server/files/patch-ipaserver_install_cainstance.py
@@ -15,7 +15,7 @@
logger.debug('Deploying ACME')
- self._ldap_mod('/usr/share/pki/acme/database/ds/schema.ldif')
-+ self._ldap_mod('/usr/local/share/pki/acme/database/ds/schema.ldif')
++ self._ldap_mod('%%LOCALBASE%%/share/pki/acme/database/ds/schema.ldif')
configure_acme_acls()
@@ -42,7 +42,7 @@
"""
if not data:
- with open('/usr/share/pki/VERSION', 'r') as fd:
-+ with open('/usr/local/share/pki/VERSION', 'r') as fd:
++ with open('%%LOCALBASE%%/share/pki/VERSION', 'r') as fd:
data = fd.read()
groups = re.match(r'.*\nSpecification-Version: ([\d+\.]*)\n.*', data)
@@ -51,10 +51,10 @@
# and an upgrade-specific version of the profile exists.
#
- profile_filename = '/usr/share/ipa/profiles/{}.cfg'.format(profile_id)
-+ profile_filename = '/usr/local/share/ipa/profiles/{}.cfg'.format(profile_id)
++ profile_filename = '%%LOCALBASE%%/share/ipa/profiles/{}.cfg'.format(profile_id)
profile_upg_filename = \
- '/usr/share/ipa/profiles/{}.UPGRADE.cfg'.format(profile_id)
-+ '/usr/local/share/ipa/profiles/{}.UPGRADE.cfg'.format(profile_id)
++ '%%LOCALBASE%%/share/ipa/profiles/{}.UPGRADE.cfg'.format(profile_id)
if api.env.context == 'updates' and os.path.isfile(profile_upg_filename):
profile_filename = profile_upg_filename
diff --git a/net/freeipa-server/files/patch-ipaserver_install_server_upgrade.py b/net/freeipa-server/files/patch-ipaserver_install_server_upgrade.py
index 19a9182c9d27..826397a9b0a8 100644
--- a/net/freeipa-server/files/patch-ipaserver_install_server_upgrade.py
+++ b/net/freeipa-server/files/patch-ipaserver_install_server_upgrade.py
@@ -5,7 +5,7 @@
logger.error("Missing Certification Authority file.")
logger.error("You should place a copy of the CA certificate in "
- "/usr/share/ipa/html/ca.crt")
-+ "/usr/local/share/ipa/html/ca.crt")
++ "%%LOCALBASE%%/share/ipa/html/ca.crt")
else:
logger.debug('Certificate file exists')
@@ -16,9 +16,9 @@
- '/usr/share/pki/acme/conf/database/ds/schema.ldif',
- '/usr/share/pki/acme/conf/database/ldap/schema.ldif',
- '/usr/share/pki/acme/database/ldap/schema.ldif',
-+ '/usr/local/share/pki/acme/conf/database/ds/schema.ldif',
-+ '/usr/local/share/pki/acme/conf/database/ldap/schema.ldif',
-+ '/usr/local/share/pki/acme/database/ldap/schema.ldif',
++ '%%LOCALBASE%%/share/pki/acme/conf/database/ds/schema.ldif',
++ '%%LOCALBASE%%/share/pki/acme/conf/database/ldap/schema.ldif',
++ '%%LOCALBASE%%/share/pki/acme/database/ldap/schema.ldif',
]:
if os.path.exists(path):
acme_schema_ldif = path
@@ -28,8 +28,8 @@
schema_files=[
- '/usr/share/pki/server/conf/schema-certProfile.ldif',
- '/usr/share/pki/server/conf/schema-authority.ldif',
-+ '/usr/local/share/pki/server/conf/schema-certProfile.ldif',
-+ '/usr/local/share/pki/server/conf/schema-authority.ldif',
++ '%%LOCALBASE%%/share/pki/server/conf/schema-certProfile.ldif',
++ '%%LOCALBASE%%/share/pki/server/conf/schema-authority.ldif',
acme_schema_ldif,
]
try: