kea: Add systemd units and fix keactrl config paths (#1667)

SPECS/kea/0001-keactrl-Use-absolute-sysconfdir-and-localstatedir.patch

@@ -0,0 +1,85 @@
+From: Daniel Casota <dcasota@gmail.com>
+Date: Mon, 31 Aug 2026 00:00:00 +0200
+Subject: [PATCH] keactrl: do not prepend ${prefix} to an absolute sysconfdir
+
+src/bin/keactrl/meson.build builds the paths substituted into keactrl and
+keactrl.conf by string-concatenating a literal '${prefix}/' in front of the
+sysconfdir and localstatedir options:
+
+    keactrl_conf_data.set('sysconfdir', '${prefix}/' + SYSCONFDIR)
+    keactrl_conf_data.set('localstatedir', '${prefix}/' + LOCALSTATEDIR)
+
+That assumes the options are prefix-relative, which is the autotools
+convention. Meson does not follow it. BUILTIN_DIR_NOPREFIX_OPTIONS in
+mesonbuild/options.py maps sysconfdir to an absolute '/etc' and
+localstatedir to an absolute '/var' whenever the prefix is '/usr', whether
+or not the values are passed on the command line:
+
+    BUILTIN_DIR_NOPREFIX_OPTIONS = {
+        OptionKey('sysconfdir'):     {'/usr': '/etc'},
+        OptionKey('localstatedir'):  {'/usr': '/var', '/usr/local': '/var/local'},
+
+The concatenation then yields '${prefix}//etc' and '${prefix}//var', which
+expand at run time to /usr/etc and /usr/var -- directories that do not
+exist. keactrl is unusable on any prefix=/usr build, which is essentially
+every distribution package:
+
+    $ keactrl status
+    ERROR/keactrl: keactrl configuration file doesn't exist in
+    /usr//etc/kea/keactrl.conf.
+
+Eight substitutions across the two generated files are affected, not only
+the configuration file location: KEA_LOGGER_DESTINATION, the PID directory
+and localstatedir in keactrl, and all four kea_*_config_file entries in the
+installed keactrl.conf. Passing -c does not work around it, because the
+installed keactrl.conf carries the same corrupted paths.
+
+Use the option directly when it is already absolute, and keep the
+'${prefix}/' indirection when it is prefix-relative. The indirection is what
+makes a self-contained install relocatable -- prefix is a live shell
+variable in the generated scripts -- so it must survive for the prefixes
+where meson leaves the options relative.
+
+sbindir is unaffected: meson relativizes it under the prefix, so
+'${prefix}/' + SBINDIR is already correct.
+
+Verified by generating keactrl and keactrl.conf with meson 1.12.0 from the
+unmodified templates. With prefix=/usr, with and without explicit
+--sysconfdir/--localstatedir, the config path becomes /etc/kea/keactrl.conf
+and the log and PID paths land under /var. With prefix=/usr/local and
+prefix=/opt/kea both generated files are byte-identical to the unpatched
+build.
+
+Signed-off-by: Daniel Casota <dcasota@gmail.com>
+---
+--- a/src/bin/keactrl/meson.build
++++ b/src/bin/keactrl/meson.build
+@@ -3,7 +3,11 @@
+ keactrl_conf_data.set('exec_prefix', '${prefix}')
+ keactrl_conf_data.set('prefix', PREFIX)
+ keactrl_conf_data.set('sbindir', '${prefix}/' + SBINDIR)
+-keactrl_conf_data.set('sysconfdir', '${prefix}/' + SYSCONFDIR)
++if SYSCONFDIR.startswith('/')
++    keactrl_conf_data.set('sysconfdir', SYSCONFDIR)
++else
++    keactrl_conf_data.set('sysconfdir', '${prefix}/' + SYSCONFDIR)
++endif
+ if NETCONF_DEP.found()
+     keactrl_conf_data.set('HAVE_NETCONF', 'yes')
+ else
+@@ -11,8 +15,13 @@
+ endif
+ keactrl_conf_data.set('EXTENDED_VERSION', EXTENDED_VERSION)
+ keactrl_conf_data.set('PACKAGE_VERSION', PROJECT_VERSION)
+-keactrl_conf_data.set('runstatedir', '${prefix}/' + LOCALSTATEDIR + '/run')
+-keactrl_conf_data.set('localstatedir', '${prefix}/' + LOCALSTATEDIR)
++if LOCALSTATEDIR.startswith('/')
++    keactrl_conf_data.set('runstatedir', LOCALSTATEDIR / 'run')
++    keactrl_conf_data.set('localstatedir', LOCALSTATEDIR)
++else
++    keactrl_conf_data.set('runstatedir', '${prefix}/' + LOCALSTATEDIR + '/run')
++    keactrl_conf_data.set('localstatedir', '${prefix}/' + LOCALSTATEDIR)
++endif
+
+ kea_conf_data = configuration_data()
+ kea_conf_data.set('libdir', LIBDIR_INSTALLED)

SPECS/kea/disable-kea-by-default.preset

@@ -0,0 +1,3 @@
+disable kea-dhcp4.service
+disable kea-dhcp6.service
+disable kea-dhcp-ddns.service

SPECS/kea/kea-dhcp-ddns.service

@@ -0,0 +1,27 @@
+[Unit]
+Description=Kea DHCP-DDNS Server
+Documentation=https://kea.readthedocs.io/
+Wants=network-online.target
+After=network-online.target
+After=time-sync.target
+
+[Service]
+# Type=simple, not Type=notify: Kea 3.1.9 has no sd_notify support upstream
+# (no libsystemd dependency, no NOTIFY_SOCKET handling). Distributions that
+# use Type=notify carry an out-of-tree sd-daemon patch; Photon does not.
+Type=simple
+User=kea
+Group=kea
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+RuntimeDirectory=kea
+RuntimeDirectoryMode=0750
+RuntimeDirectoryPreserve=yes
+StateDirectory=kea
+StateDirectoryMode=0750
+LogsDirectory=kea
+LogsDirectoryMode=0750
+ExecStart=/usr/sbin/kea-dhcp-ddns -c /etc/kea/kea-dhcp-ddns.conf
+ExecReload=/usr/bin/kill -HUP $MAINPID
+
+[Install]
+WantedBy=multi-user.target

SPECS/kea/kea-dhcp4.service

@@ -0,0 +1,30 @@
+[Unit]
+Description=Kea DHCPv4 Server
+Documentation=https://kea.readthedocs.io/
+Wants=network-online.target
+After=network-online.target
+After=time-sync.target
+
+[Service]
+# Type=simple, not Type=notify: Kea 3.1.9 has no sd_notify support upstream
+# (no libsystemd dependency, no NOTIFY_SOCKET handling). Distributions that
+# use Type=notify carry an out-of-tree sd-daemon patch; Photon does not.
+Type=simple
+User=kea
+Group=kea
+# CAP_NET_BIND_SERVICE: bind the privileged DHCPv4 server port 67.
+# CAP_NET_RAW: open the raw sockets DHCPv4 needs to answer clients that do
+# not yet hold an address.
+AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_RAW
+RuntimeDirectory=kea
+RuntimeDirectoryMode=0750
+RuntimeDirectoryPreserve=yes
+StateDirectory=kea
+StateDirectoryMode=0750
+LogsDirectory=kea
+LogsDirectoryMode=0750
+ExecStart=/usr/sbin/kea-dhcp4 -c /etc/kea/kea-dhcp4.conf
+ExecReload=/usr/bin/kill -HUP $MAINPID
+
+[Install]
+WantedBy=multi-user.target

SPECS/kea/kea-dhcp6.service

@@ -0,0 +1,29 @@
+[Unit]
+Description=Kea DHCPv6 Server
+Documentation=https://kea.readthedocs.io/
+Wants=network-online.target
+After=network-online.target
+After=time-sync.target
+
+[Service]
+# Type=simple, not Type=notify: Kea 3.1.9 has no sd_notify support upstream
+# (no libsystemd dependency, no NOTIFY_SOCKET handling). Distributions that
+# use Type=notify carry an out-of-tree sd-daemon patch; Photon does not.
+Type=simple
+User=kea
+Group=kea
+# CAP_NET_BIND_SERVICE: bind the privileged DHCPv6 server port 547.
+# DHCPv6 uses ordinary UDP sockets, so CAP_NET_RAW is not required.
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+RuntimeDirectory=kea
+RuntimeDirectoryMode=0750
+RuntimeDirectoryPreserve=yes
+StateDirectory=kea
+StateDirectoryMode=0750
+LogsDirectory=kea
+LogsDirectoryMode=0750
+ExecStart=/usr/sbin/kea-dhcp6 -c /etc/kea/kea-dhcp6.conf
+ExecReload=/usr/bin/kill -HUP $MAINPID
+
+[Install]
+WantedBy=multi-user.target

SPECS/kea/kea.spec

@@ -1,9 +1,10 @@
 %global build_if %{photon_subrelease} >= 91
+%global kea_services kea-dhcp4.service kea-dhcp6.service kea-dhcp-ddns.service
 
 Summary:      A modern, scalable, robust DHCPv4 and DHCPv6 server.
 Name:         kea
 Version:      3.1.9
-Release:      3%{?dist}
+Release:      4%{?dist}
 Url:          https://www.isc.org/kea/
 Group:        System Environment/Base
 Vendor:       VMware, Inc.
@@ -16,15 +17,25 @@ Source2: %{name}.sysusers
 Source3: license.txt
 %include %{SOURCE3}
 
+Source4: kea-dhcp4.service
+Source5: kea-dhcp6.service
+Source6: kea-dhcp-ddns.service
+Source7: disable-kea-by-default.preset
+
+Patch0: 0001-keactrl-Use-absolute-sysconfdir-and-localstatedir.patch
+
 BuildRequires: meson
 BuildRequires: log4cplus-devel
 BuildRequires: boost-devel
 BuildRequires: krb5-devel
 BuildRequires: shadow
 BuildRequires: systemd-devel
+BuildRequires: systemd-rpm-macros
 
 Requires:      kea-libs = %{version}-%{release}
+Requires:      systemd
 Requires(pre): shadow
+Requires(pre): systemd-rpm-macros
 Obsoletes:     dhcp-server
 
 %description
@@ -79,11 +90,24 @@ The %name-docs contains %name package doc files.
 install -p -D -m 0644 %{SOURCE1} %{buildroot}%{_tmpfilesdir}/%{name}.conf
 install -p -D -m 0644 %{SOURCE2} %{buildroot}%{_sysusersdir}/%{name}.conf
 
+install -vdm 755 %{buildroot}%{_unitdir}
+install -p -m 0644 %{SOURCE4} %{buildroot}%{_unitdir}/kea-dhcp4.service
+install -p -m 0644 %{SOURCE5} %{buildroot}%{_unitdir}/kea-dhcp6.service
+install -p -m 0644 %{SOURCE6} %{buildroot}%{_unitdir}/kea-dhcp-ddns.service
+install -p -D -m 0644 %{SOURCE7} %{buildroot}%{_presetdir}/50-%{name}.preset
+
 %pre
 %sysusers_create_compat %{SOURCE2}
 
 %post
 systemd-tmpfiles --create %{name}.conf
+%systemd_post %{kea_services}
+
+%preun
+%systemd_preun %{kea_services}
+
+%postun
+%systemd_postun_with_restart %{kea_services}
 
 %post libs
 /sbin/ldconfig
@@ -104,6 +128,10 @@ rm -rf %{buildroot}
 %{_sysconfdir}/kea
 %{_tmpfilesdir}/%{name}.conf
 %{_sysusersdir}/%{name}.conf
+%{_unitdir}/kea-dhcp4.service
+%{_unitdir}/kea-dhcp6.service
+%{_unitdir}/kea-dhcp-ddns.service
+%{_presetdir}/50-%{name}.preset
 %dir %attr(0750,kea,kea) %{_sharedstatedir}/kea
 %dir %attr(0750,kea,kea) %{_localstatedir}/log/kea
 
@@ -128,6 +156,10 @@ rm -rf %{buildroot}
 %{_docdir}/*
 
 %changelog
+* Mon Aug 31 2026 Daniel Casota <dcasota@gmail.com> 3.1.9-4
+- Ship systemd units for kea-dhcp4, kea-dhcp6 and kea-dhcp-ddns
+- Fix keactrl looking for its config under /usr/etc instead of /etc
+- Ship a disable-by-default preset so the DHCP servers are not enabled on install
 * Mon Jun 22 2026 Bo Gan <bo.gan@broadcom.com> 3.1.9-3
 - Disable mysql support
 * Mon Jun 15 2026 Bo Gan <bo.gan@broadcom.com> 3.1.9-2