1. 07 Aug, 2016 2 commits
  2. 02 Aug, 2016 1 commit
  3. 19 Jul, 2016 1 commit
    • Jérome Perrin's avatar
      gitlab: enable parameters-extra options when creating wrapper · 6082d6e9
      Jérome Perrin authored
      @jerome says at 5f5d5102 (comment 17119):
      before f4e51f77, we had:
      `~/srv/runner/instance/slappart0/bin/gitlab-rake` containing:
          if __name__ == '__main__':
              sys.exit(slapos.recipe.librecipe.execute.generic_exec((['/srv/slapgrid/slappart16/srv/runner/software/fffb3c99781923d3adb8bc53eb6c027a/bin/bundle', 'exec', 'sh', '-c', 'cd /srv/slapgrid/slappart16/srv/runner/instance/slappart0/gitlab-work && rake "$@"', 'rake'], None, {'BUNDLE_GEMFILE': '/srv/slapgrid/slappart16/srv/runner/software/fffb3c99781923d3adb8bc53eb6c027a/parts/gitlab/Gemfile', 'HOME': '/srv/slapgrid/slappart16/srv/runner/instance/slappart0', 'SIDEKIQ_MEMORY_KILLER_MAX_RSS': '1000000', 'RAILS_ENV': 'production'})))
      after, `~/srv/runner/instance/slappart0/bin/gitlab-rake` contains:
          # If the wrapped command uses a shebang, execute the referenced
          # executable passing the script path as first argument.
          # This is to workaround the limitation of 127 characters in #!
          if [[ -f $COMMAND && x$(head -c2 "$COMMAND") = x"#!" ]]; then
            SHEBANG=$(head -1 "$COMMAND")
            INTERPRETER=( ${SHEBANG#\#!} )
          exec $COMMAND
      which is a wrapper around `gitlab-rake.py` containing:
          if __name__ == '__main__':
              sys.exit(slapos.recipe.librecipe.execute.generic_exec((['/srv/slapgrid/slappart16/srv/runner/software/fffb3c99781923d3adb8bc53eb6c027a/bin/bundle', 'exec', 'sh', '-c', 'cd /srv/slapgrid/slappart16/srv/runner/instance/slappart0/gitlab-work && rake "$@"', 'rake'], None, {'BUNDLE_GEMFILE': '/srv/slapgrid/slappart16/srv/runner/software/fffb3c99781923d3adb8bc53eb6c027a/parts/gitlab/Gemfile', 'HOME': '/srv/slapgrid/slappart16/srv/runner/instance/slappart0', 'SIDEKIQ_MEMORY_KILLER_MAX_RSS': '1000000', 'RAILS_ENV': 'production'})))
      `gitlab-rake.py` after is same as `gitlab-rake` before.
      This [slapos.cookbook:wrapper](https://lab.nexedi.com/nexedi/slapos/blob/cd9faac0/slapos/recipe/wrapper.py#L39) has an argument *parameters-extra* which if set to true, propagate command line arguments to the wrapped script. The default value for this parameter is false.
      Before f4e51f77, the generated wrapper was also propagating arguments even when *parameters-extra* was not set, but since this commit, this *parameters-extra* option is now handled as expected.
      This is the reason for this regression. In our case, when we see `/srv/slapgrid/slappart16/srv/runner/instance/slappart0/bin/gitlab-rake assets:clean`, it just calls `rake` without arguments.
      So a simple patch that fix the problem would be jerome/slapos@d3d05f02 . This way, the generated wrapper becomes:
      exec $COMMAND $@
      and arguments are correctly propagated.
      Feel free to cherry-pick that patch for now, but it may be nice to rethink this *parameters-extra* option, after this debugging session, I believe it should be true by default.
      /cc @seb for introducing the parameter in 80bb4305 and @vpelletier for touching this code in e7083872
      /reviewed-by @kirr
  4. 22 Apr, 2016 2 commits
  5. 28 Feb, 2016 1 commit
  6. 17 Feb, 2016 1 commit
  7. 11 Feb, 2016 5 commits
  8. 17 Jan, 2016 26 commits
    • Kirill Smelkov's avatar
      gitlab: Switch to "GitLab Nexedi Edition" · 74d4ea62
      Kirill Smelkov authored
      GitLab Nexedi Edition is currently upstream 8.2.X + the following
          - HTTP(S) is made to be default clone protocol
            and SSH info is completely removed from UI
            so essentially the only way to access a repository is via HTTP(S).
          - Rake check tasks are adjusted to exit with non-zero code if there
            is a failure
            We need this for promises to work correctly with failures being
            detected, not silently skipped. The patch was sent upstream:
          - GitLab supports setting up site's ICP License in gitlab.yml and
            shows it in appropriate places together with info about GitLab
          + other cosmetic/minor changes.
      More patches will probably come (e.g. apply a single patch from a
      merge-request with `git am` without creating merge commit for just 1
      patch, etc) but for now that's all.
      NOTE ICP is non-ascii text with hieroglyphs. slapos.core was taught to
          be able to pass parameters with non-ascii values to instance:
          That patch is included in slapos.core 1.3.15, but as we currently
          have a lot of older slapos.core deployed (e.g. 1.3.5 on my
          development webrunner) a workaround is (hopefully temporarily) used
          to pass non-ascii values as URL-encoded strings.
      /cc @kazuhiko, @jerome, @rafael
    • Kirill Smelkov's avatar
      gitlab: Publish connection URL · 3c445ad3
      Kirill Smelkov authored
      In the previous patch we setup nginx service which listens to the world
      and as such gitlab service becomes to be ready to used - so publish
      backend URL.
      NOTE we'll need to optimise and tweak gitlab a bit further in upcoming
          patches, so it can be really used under load and with our use-cases,
          but even now it listens to http ok and generally works.
      /cc @kazuhiko, @jerome
    • Kirill Smelkov's avatar
      gitlab: Setup sidekiq service · 4c127fdd
      Kirill Smelkov authored
      Sidekiq[1] is used in GitLab as background jobs manager - i.e. if a
      request handler needs to spawn some non-light job - it adds it to
      sidekiq queue (in Redis) and relies on sidekiq service to later pick
      this job up and execute it.
      The service is setup with just to run bin/gitlab-sidekiq with
      appropriate queues (extracted from omnibus-gitlab) and appropriate
      settings to controlling GitLab's sidekiq Out-Of-Memory killer[2].
      NOTE Unlike unicorn OOM killer, Sidekiq memory killer just makes sidekiq
          processes to be SIGKILL terminated and relies on managing service to
          restart it. In slapos we don't have mechanism to set autorestart=true,
          nor bang/watchdog currently work with slapproxy, so we setup to do
          such monitoring ourselves manually with here-introduced
          watcher-sigkill program.
      NOTE2 sidekiq promise, because it is rake/gitlab based, is slow to
          load/run and thus is put into etc/promise.slow/
      [1] http://sidekiq.org/
      [2] https://gitlab.com/gitlab-org/gitlab-ce/blob/1322bd78/doc/operations/sidekiq_memory_killer.md
      /cc @kazuhiko, @jerome
    • Kirill Smelkov's avatar
      gitlab/nginx: Slapos'ify config and turn nginx into a service · 85f7d7e3
      Kirill Smelkov authored
      Go through nginx configuration templates and convert them to jinja2 with
      slapos parameters (reminder: names and default values are imported from
      omnibus-gitlab 8.2.3+ce.0-0-g8eda093), except commenting out features we
      do not want to support (yet ?).
      As nginx is a reverse-proxy, i.e. it integrates all internal services
      and works as frontend to them, our gitlab service is now ready to listen
      and talk to the world over (standard to slapos services backend) IPv6.
      Nginx also acts as SSL termination point - for it to work by default we
      setup self-signed certificate for the backend, which can be manually
      changed to proper certificate if needed. Backend certificate is used
      if gitlab is configured to work in HTTPS mode (and frontend certificate
      is another story).
      NOTE ssl certificate is generated with just `openssl req ...` - yes, there
          is slapos.cookbook:certificate_authority.request but it requires
          to start whole service and has up to 60 seconds latency to generate
          certificate. And we only need to run 1 command to do that...
      The features disabled are:
          - http -> https redirection
            not needed for us at nginx level - the frontend can do the
            redirection and also gitlab speaks HSTS on https port so when we access
            https port via http protocol, it gets redirected to https.
          - kerberos
          - ssl_dhparam
          - providing custom nginx configuration via instance parameter
      /cc @kazuhiko, @jerome
    • Kirill Smelkov's avatar
      gitlab: Hook nginx configuration files into SR system · 45127f6d
      Kirill Smelkov authored
      Like with Rails configuration files, hook nginx configuration files into
      SR / instance build process; rename *.erb -> *.in and add our header.
      The templates are still not valid - a lot of erb code is left there -
      we'll slapos'ify it incrementally in the following patches.
      /cc @kazuhiko, @jerome
    • Kirill Smelkov's avatar
      gitlab: Slapos'ify / tweak gitconfig and hook it into the system · 264d785a
      Kirill Smelkov authored
      Convert gitconfig template to jinja2 (reusing already-there
      `email_display_name` and `email_from` parameters for commits generated by
      System-level git config from gitlab-omnibus is also imported to this
      file (on slapos we cannot tweak system-level git config -
      software/.../parts/git/... is read-only for programs in instance
      partitions - so we move all gitlab's system-wide git settings to this
      "user-level" gitconfig.
      System gitconfig in omnibus is defined here:
      so it is
          pack.threads = 1    and
          receive.fsckObjects = true
      which makes sense to not waste a lot of memory when packing and not to
      allow corrupt objects to enter to system by evil users intentionally.
      To make the file foundable by git - we put it into partition root
      directory and set $HOME to point to partition root when running
      appropriate programs / services.
      NOTE we'll need to upgrade gitlab-shell and gitlab-workhorse to
          propagate $HOME for this setting to actually have effect.
          See the next patch.
      /cc @kazuhiko, @jerome
    • Kirill Smelkov's avatar
      gitlab: Setup gitlab-workhorse service · 6ddc1c30
      Kirill Smelkov authored
      Gitlab-workhorse[1] is a service which offloads Ruby-on-Rails based
      GitLab from long-running and slow requests. It is written in Go.
      Now as we have unicorn service set up, we can setup gitlab-workhorse
      service (which uses unicorn as authentication backend).
      Gitlab-workhorse setup is easy - it is just one program and several
      command line options to point to unicorn socket and to configure on
      which unix socket gitlab-workhorse will listen itself.
      NOTE we have to care that git and ruby to be on PATH when running
          gitlab-workhorse - because on e.g. git push'ing workhorse will run `git
          receive-pack` and a hook will be called which calls gitlab-shell,
          which is written in ruby.
      NOTE2 promise to check whether gitlab-workhorse is alive is to ping it
          via URL to non-existent endpoint and check for proper 403 HTTP code
      [1] https://gitlab.com/gitlab-org/gitlab-workhorse
      /cc @kazuhiko, @jerome
    • Kirill Smelkov's avatar
      gitlab: Compile assets on instantiation and make sure DB is properly... · 5a744de7
      Kirill Smelkov authored
      gitlab: Compile assets on instantiation and make sure DB is properly setup/migrated before unicorn runs
      There are several actions that needs to be done on gitlab instance
          - we have to (re-)compile assets
          - we have to migrate DB
      and also before the first run
          - we have to initialize DB
      We can compile assets as part of instantiation process, but regarding
      DB migration / setup - it is not currently possible to do that as part
      of instantiation - for that operations we need PG & Redis to be already
      running, but the first time slapos instantiates an SR it first prepares
      all services, and only after instantiation is done, starts them all. There is
      currently no way to hook into starting process, and run some scripts
      after one service is started but before another service startup...
      So the solution is: to perform such actions in delayed mode as part of
      application - unicorn service - startup: it makes sure PG is running and
      initializes it and does other actions which needs to be done to migrate
      the DB. Only if/after they succeed the main application is started.
      NOTE the comment about unicorn/gitlab startup slowness from the previous
          patch still holds true - so in order to get "all ok" after
          instantiation, it is required to perform the instantiation several
          times, because unicorn promise initially fails.
      /cc @kazuhiko, @jerome
    • Kirill Smelkov's avatar
      gitlab: Set up unicorn service · 481e4758
      Kirill Smelkov authored
      Now that all gitlab Rails application configuration files are ready, we
      can setup unicorn service to start it.
      NOTE there is a promise to check unicorn by url which works, but there
          are also rake tasks to check gitlab itself, e.g. like
          Unfortunately this tasks are slow to run (and gitlab:repo:check is
          very slow to run). That's why we do not put them into etc/promise/ -
          if we do - slapos reports promises time outs.
          What we do is we put them into etc/promise.slow/ so we have those
          scripts ready, but currently no one automatically checks them.
          Again, the promise to check unicorn just by accessing it by URL is
          there and is checked automatically out of the box.
      NOTE2 GitLab is very slow to load. That's why it can take some time
          after unicorn starts that it's promise start to report ok. This can
          show itself as temporary instantiation errors which say promise such and
          such failed.
      NOTE3 Unicorn start, but so far we did not cared to setup GitLab DB
          schema on instantiation. That's why unicorn remains not very usable
          and a lot of requests fail. We'll teach instance to setup DB and
          perform all other needed settings in the next patch.
      /cc @kazuhiko, @jerome
    • Kirill Smelkov's avatar
      gitlab: Add helper to set up promise to check something via url · 2772191c
      Kirill Smelkov authored
      Like with [promise-wrapper] a recipe could do
          <= promise-byurl
          url     = ...
      and a script to check such ur will be generated and automatically put
      into etc/promise/<service>.
      /cc @kazuhiko, @jerome
    • Kirill Smelkov's avatar
      gitlab/unicorn: Automatically load all available CPUs by default · 5dc6321c
      Kirill Smelkov authored
      Automatically configure unicorn to spawn as much worker processes as
      there are CPUs on the system by default.
      GitLab omnibus pre-hardcodes this value default to 2 (which we copied)
      and then also tweaks it this way in active code
      which we also do here.
      /cc @kazuhiko, @jerome
    • Kirill Smelkov's avatar
      gitlab/gitlab-shell-config.yml: Explicitly point it to secret file · b55d823d
      Kirill Smelkov authored
      Explicitly point gitlab-shell to location where we keep secrets.
      We already pointeg gitlab to that place and now we do that for
      gitlab-shell so those 2 peieces can connect to each other ok.
      Regarding the setting itself - there is no such block in omnibus-gitlab,
      but it is present in gitlab-shell configuration example:
      /cc @kazuhiko, @jerome
    • Kirill Smelkov's avatar
      gitlab/gitlab-shell-config.yml: Slapos'ify it · 0cd14ef6
      Kirill Smelkov authored
      Convert gitlab-shell configuration file to slapos:
          - convert to jinja2,
          - connect gitlab-shell to unicorn & redis unix sockets
          - http_settings are left to be default (empty) ones - as that works ok.
          - `auth_file` is still configured to point to wont-be-used sshkeys
            file, as without it gitlab-shell check will fail.
          - support for audit_usernames and git_annex is disabled and
            remains not configurable.
      /cc @kazuhiko, @jerome
    • Kirill Smelkov's avatar
      gitlab/unicorn.rb: First round of slaposification · 0aae33d9
      Kirill Smelkov authored
      Convert unicorn parameters to slapos and configure it to listen on unix
      socket only.
      ( Omnibus configures unicorn to listen on unix socket and
        loopback TCP, mainly because gitlab-shell could not connect to unicorn
        via unix socket until recently:
        But as it can now, there is no point to keep on TCP port open )
      To be able to do such configuration we add stub to unicorn service
      section (to create needed directories where to keep the socket).
      There will be follow-up patch which configures unicorn pre/post-forking
      actions, which is not trivial and thus better be done on its own.
      /cc @kazuhiko, @jerome
    • Kirill Smelkov's avatar
      gitlab/gitlab.yml: Slapos'ify rest of it · c3f1f0a9
      Kirill Smelkov authored
      Convert the rest of this configuration file to slapos.
      It is straightforward conversion of parameters except:
          - access-via-ssh is disabled (gitlab slapos version does not support
            ssh access and supports HTTP(S) only by design on purpose)
          - we do not support restricting possible projects visibility via
            instance parameter (very low chance this will be needed in
          - default issue-closing pattern is just ok for now and not
          - support for builds, build artifacts & CI is disabled (we do not
            support CI (yet ?))
          - some internal defaults are just ok (e.g. where to organize
            directory for keeping repositories archives for downloads)
          - reply-by-email is not supported (yet ?)
          - we do not support LFS (yet ?) - just plain git hosting is ok for now.
          - Gravatar defaults are ok for now and not configurable.
          - Support for LDAP is disabled
          - Support for Kerberos is disabled
          - Support for OmniAuth is disabled
          - Satellites path is just /dev/null as we start from version where
            satellites are already non-existent.
          - Uploading backups to somewhere via GitLab's builtin mechanism is
            not supported - we'll use SlapOS native backup and resiliency for
          - Support for Google analytics is disabled.
          - Support for Piwik is disabled.
          - we are ok (for now) with default rack-attack git settings
      /cc @kazuhiko, @jerome
    • Kirill Smelkov's avatar
      gitlab: Determine current slapuserX in instance · 34419064
      Kirill Smelkov authored
      This user will need to be specified several times in configuration
      files, as by default gitlab uses 'git' user and does "sudo" to it if it
      is not current.
      We will use {{ backend_info.user }} in the upcoming patches.
      /cc @kazuhiko, @jerome
    • Kirill Smelkov's avatar
      gitlab/gitlab.yml: Handle "external URL" · 93362a08
      Kirill Smelkov authored
      GitLab has a notion of "external URL" - the canonical "frontend" URL the
      server is reachable through: this URL is used as prefix to show
      e.g. git-clone URL for repositories, etc, even if a server can be
      reachable via several frontends.
      Add external_url handling to slapos instance.
      NOTE whether to use https or not is also defined by external_url, in
      particular by external_url scheme.
      /cc @kazuhiko, @jerome
    • Kirill Smelkov's avatar
      gitlab/smtp_settings.rb: Convert/integrate to slapos · c64f7ece
      Kirill Smelkov authored
      Convert to slapos SMTP settings for gitlab:
          - convert to jinja2
          - remove support for gitlab CI (we do not support it (yet ?))
          - add handling of `smtp_enable` parameter directly to that file
            ( omnibus handles this parameter externally and just removes
              smtp_settings.rb if it is true )
      NOTE smtp_settings.rb contains SMTP password, so it is mode is set to 0600.
      /cc @kazuhiko, @jerome
    • Kirill Smelkov's avatar
      gitlab/resque.yml: Tweak to integrate gitlab with internal redis · b20c258b
      Kirill Smelkov authored
      A simple change just to point resque to redis unix socket.
      /cc @kazuhiko, @jerome
    • Kirill Smelkov's avatar
      gitlab/database.yml: Tweak to integrate gitlab with internal postgresql · a73d20f4
      Kirill Smelkov authored
      We tweak database.yml to point to our postgresql unix socket; set
      adapter to hardcoded postgresql, encoding to unicode and omit collation
      (which according to omnibus-gitlab is used for mysql only).
      The only instance parameter imported from omnibus is `db_pool` - how
      many connection to a DB to keep open in a RoR thread/process.
      XXX we use db's superuser as a user to connect. Is it ok to do even if
          the whole DB is used only for gitlab? (I think it is ok for the
          first iteration, but we'll probably need to refine this later)
      /cc @kazuhiko, @jerome
    • Kirill Smelkov's avatar
      gitlab: Introduce macro library · 2e81276b
      Kirill Smelkov authored
      Introduce a library of Jinja2 macros that will be handy to use in
      templates. For now we add only 2 macros:
          cfg(name)   - to get instance configuration parameter `name`,   and
          cfg_bool    - to get truth value of ----//----
      The reason we introduce cfg() is that we will need to use a lot of
      parameters in many places and it is much more handy to write, e.g.
      compared to
      /cc @kazuhiko, @jerome
    • Kirill Smelkov's avatar
      gitlab: Organize place to keep parameters & their default imported from gitlab-omnibus · de860ba5
      Kirill Smelkov authored
      We will be using a several dozens of parameters to control gitlab
      instance. It makes sense not to deviate in such parameters namings and
      defaults from omnibus version.
      Thus for such parameters - for clarity - we organize a separate file
      where we will be keeping them - gitlab-parameters.cfg.
      In this patch series all used parameters will be "imported" from
      omnibus-gitlab 8.2.3+ce.0-0-g8eda093.
      NOTE it is maybe better to try to autogenerate that file from upstream
          omnibus parameters definitions. If time will tell it becomes hard to
          maintain our copy - we'll consider going that way.
      /cc @kazuhiko, @jerome
    • Kirill Smelkov's avatar
      gitlab: Organize per-instance gitlab work tree · 2ddc5b0c
      Kirill Smelkov authored
      Organize per-instance place for gitlab configuration and work directory.
      Unfortunately as GitLab is Ruby-on-Rails application, it is not possible
      to keep its code in one place and have multiple separate configuration
      sets in different places and start that code for a configuration set -
      GitLab and Rails insist to get configuration from relative to source
      code tree.
      GitLab omnibus "solves" this by having only one configuration set and
      having symlinks from code to that only configiration set. In slapos we
      can potentially have several instances for one software and thus we
      cannot do that.
      With such limitations a proper solution would be to bind-mount software
      code into instance filesystem namespace close to configuration - that
      way the code will be only one and will find proper per-instance config.
      Currently we do not have namespaces available on slapos unfortunately,
      thus something else is needed.
      The workaround I decided to do is this: to clone cloned gitlab
      repository from software/ space to instance/ space and adjust it in
      instance space. This has the following drawbacks:
          - code is duplicated
          - code becomes read-write, instead of being read-only
      but imho it is the most practical thing to do. Another solution could be
      to patch GitLab / Rails to remove "config lives in code" assumption, but
      the number of places where this needs to be done is really many.
      NOTE gems which gitlab uses and which were installed during software
          compilation are not duplicated - they are reused via bundler - via
          pointing BUNDLE_GEMFILE to original location in software.
      NOTE2 For instance tasks and also for maintanace convenience we establish
          <instance>/bin/gitlab-* programs, e.g. gitlab-rake, which e.g. for
          gitlab-rake will run rake with correctly loaded gitlab environment -
          like in gitlab-omnibus.
      /cc @kazuhiko, @jerome, @jp
    • Kirill Smelkov's avatar
      gitlab: Hook gitlab- and gitlab-shell- configuration files into the system · 13169cab
      Kirill Smelkov authored
      - Download them on SR build and pass info to instance
      - Instance prepares to process them as jinja2 templates
      - Instance hooks the files into configuration location as appropriate
      Every file so far is renamed *.erb -> *.in and a header added showing
      that this file is autogenerated with links about what was the base
      gitlab and/or omnibus version and omnibus reference revision this
      template was last updated for.
      So far all result configuration files are invalid - because ERB syntax
      is there. We will convert the configuration files to proper jinja2
      syntax and to using slapos parameters incrementally in the upcoming
      NOTE (again): md5 sums are not yet fixed - we will fix them in the end
          of gitlab patches series after applying all tweaking changes.
      /cc @kazuhiko, @jerome
    • Kirill Smelkov's avatar
      gitlab: Redis service · 0d286c5d
      Kirill Smelkov authored
      Organize internal Redis service, like with PostgreSQL in the previous
      patch, with the help of slapos.cookbook:redis.server recipe.
      Like with postgresql, and as we planned, redis listens only on
      internal-to-partition unix socket.
      The recipe establishes both service and promise to check it is alive;
      we only need to setup log rotation manually.
      /cc @kazuhiko, @jerome
    • Kirill Smelkov's avatar
      gitlab: PostgreSQL service · 470719fe
      Kirill Smelkov authored
      Organize internal PostgreSQL database which will be used as DB for
      Roby-on-Rails GitLab and listens only on unix socket (for security and
      performance reasons - see earlier intro patch).
      To do it we use slapos.cookbook:postgres recipe, with disabling
      "listen-to-network" via passing empty sets to ipv4 and ipv6 recipe
      The promise to check whether DB is alive is just `psql -c '\q'` which
      will error if failing to connect to DB, but exit silently if connected ok.
      Explicit log rotation is not needed - as postgresql logs to
      stdout/stderr - not to a file - logs are handled by slapos - put into
      .slappartX_postgresql.log and automatically rotated there.
      XXX omnibus-gitlab tunes postgresql with shared_buffers and other
      parameters, most likely for performance reasons - see e.g.
      I decided not to fine-tune postgresql for now, and get on-field feedback
      first, and then, if needed, we can tune.
      /cc @kazuhiko, @jerome
  9. 07 Jan, 2016 1 commit
    • Kirill Smelkov's avatar
      gitlab: Add helper for setting up promises · 5e4a181a
      Kirill Smelkov authored
      A recipe could do
          <= promise-wrapper
          command-line = ...
      and the wrapper will be put automatiaclly into etc/promise/<service>.
      ( for this to happen !py! magic is used again, like we did for logrotate
        and cron entries before )
      /cc @kazuhiko, @jerome