installer: Use `puppet --write-catalog-summary` to determine classes.

Using checks of `,$PUPPET_CLASSES,` is repetitive and error-prone; it
does not properly deal with `zulip_ops::` classes, for instance, which
include the `zulip::` classes.

As alluded to in ca9d27175b, this can be fixed by inspecting the
classes that would be applied, using `puppet --write-catalog-summary`.
We work around the chicken-and-egg problem alluded to therein by
writing out as complete `zulip.conf` as would be necessary, before
running puppet and removing the sections we then know to not be
needed.

Unfortunately, there are two checks for `$PUPPET_CLASSES` which cannot
be switched to this technique, as they concern errors that we wish to
catch quite early, and thus before we have puppet installed.  Since we
expect failures of those to only concern warnings, and only be
mistakenly omitted for internal `zulip_ops::` classes, this seems a
reasonable risk to admit in exchange for catching common errors early.

scripts/lib/install

@@ -325,14 +325,45 @@ fi
 
 # Generate /etc/zulip/zulip.conf .
 mkdir -p /etc/zulip
-if [ -z "$NO_OVERWRITE_SETTINGS" ] || ! [ -e "/etc/zulip/zulip.conf" ]; then
+has_class() {
-    (
+    grep -qx "$1" /var/lib/puppet/classes.txt
-        cat <<EOF
+}
+
+# puppet apply --noop fails unless the user that it _would_ chown
+# files to exists; https://tickets.puppetlabs.com/browse/PUP-3907
+#
+# The home directory here should match what's declared in base.pp.
+useradd -m zulip --home-dir /home/zulip
+if [ -n "$NO_OVERWRITE_SETTINGS" ] && [ -e "/etc/zulip/zulip.conf" ]; then
+    "$ZULIP_PATH"/scripts/zulip-puppet-apply --force --noop \
+                 --write-catalog-summary \
+                 --classfile=/var/lib/puppet/classes.txt \
+                 >/dev/null
+else
+    # Write out more than we need, and remove sections that are not
+    # applicable to the classes that are actually necessary.
+    cat <<EOF > /etc/zulip/zulip.conf
 [machine]
 puppet_classes = $PUPPET_CLASSES
 deploy_type = $DEPLOYMENT_TYPE
+
+[postgresql]
+version = $POSTGRES_VERSION
 EOF
 
+    if [ -n "$USE_CERTBOT" ]; then
+        crudini --set /etc/zulip/zulip.conf certbot auto_renew yes
+    fi
+
+    "$ZULIP_PATH"/scripts/zulip-puppet-apply --force --noop \
+                 --write-catalog-summary \
+                 --classfile=/var/lib/puppet/classes.txt \
+                 >/dev/null
+
+    if ! has_class "zulip::postgres_common" || [ "$package_system" != apt ]; then
+        crudini --del /etc/zulip/zulip.conf postgresql
+    fi
+
     # Note: there are four dpkg-query outputs to consider:
     #
     # root@host# dpkg-query --showformat '${Status}\n' -W rabbitmq-server 2>/dev/null
@@ -349,33 +380,12 @@ EOF
     # (There are more possibilities in the case of dpkg errors.)  Here
     # we are checking for either empty or not-installed.
     if ! dpkg-query --showformat '${Status}\n' -W rabbitmq-server 2>/dev/null | grep -vq ' not-installed$'; then
-            cat <<EOF
+        cat <<EOF >>/etc/zulip/zulip.conf
 
 [rabbitmq]
 nodename = zulip@localhost
 EOF
     fi
-
-        if [ -n "$USE_CERTBOT" ]; then
-            cat <<EOF
-
-[certbot]
-auto_renew = yes
-EOF
-        fi
-
-        case ",$PUPPET_CLASSES," in
-            *,zulip::voyager,* | *,zulip::postgres_appdb_tuned,*)
-                if [ "$package_system" = apt ]; then
-                    cat <<EOF
-
-[postgresql]
-version = $POSTGRES_VERSION
-EOF
-                fi
-                ;;
-        esac
-    ) > /etc/zulip/zulip.conf
 fi
 
 case ",$PUPPET_CLASSES," in