confz_site_containers_init (35658B)
1 #!zsh 2 # vim: ft=zsh noet ts=4 sts=4 sw=4 3 4 typeset -gA site_containers_mountpoints=( 5 init /home/ccx/bzr/container-user-init 6 ccx-bzr /home/ccx/bzr 7 ccx-dotfiles /home/ccx/bzr/container-dotfiles 8 ccx-scripts /home/ccx/bzr/container-scripts 9 ccx-password-store /home/ccx/bzr/password-store 10 ccx-development /home/ccx/development 11 ccx-baregit /home/ccx/baregit 12 ccx-vm-images /home/ccx/vm-images 13 #ccx-opt /home/ccx/opt 14 rcm-devops /mnt/volumes/containers/user/ccx/git/home/ccx/git/rcm-devops 15 # ccx-git /home/ccx/git 16 # ccx-git-recombee /home/ccx/git/recombee 17 ccx-task /home/ccx/task 18 pthbs /usr/src/pthbs 19 mrrl /usr/src/mrrl 20 audio /mnt/volumes/audio 21 video /mnt/volumes/video 22 photos /mnt/volumes/photos 23 versions /versions 24 mail-te2000.cz-ccx /home/ccx/mail/te2000.cz/ccx 25 mail-disroot.org-ccx /home/ccx/mail/disroot.org/ccx 26 mail-recombee.com-jan.pobrislo /home/ccx/mail/recombee.com/jan.pobrislo 27 ) 28 29 confz_site_containers_usersvc_simple_check() { 30 checkvars containers_dir svscan_dir user uid gid image_name 31 defvar container_name "$vars[image_name]" 32 defvar mount_ro "init ccx-dotfiles ccx-scripts" 33 defvar container_type generic 34 35 local userdir bindroot flags mtp src dst src_el dst_el 36 local -a fstab mnt_dirs_extra pid1_el_lines 37 userdir=$vars[containers_dir]/user/$vars[user] 38 bindroot=$userdir/$vars[container_name]/root 39 40 if (($+vars[mount_ro])); then 41 flags=$'\tnone\tbind,ro,nosuid,nodev\t0 0' 42 for mtp in ${=vars[mount_ro]}; do 43 src=$site_containers_mountpoints[$mtp] 44 dst=$bindroot/mnt/$mtp 45 mnt_dirs_extra+=( $mtp ) 46 fstab+=( $src$'\t'$dst$flags ) 47 src_el=\"${${src//\\/\\\\}//\"/\\\"}\" 48 dst_el=\"${${dst//\\/\\\\}//\"/\\\"}\" 49 pid1_el_lines+=( 50 "if { mkdir -p $dst_el }" 51 "if { s6-mount -r -o bind,nodev,nosuid $src_el $dst_el }" 52 "if { s6-mount -o remount,bind,ro,nodev,nosuid . $dst_el }" 53 ) 54 done 55 fi 56 if (($+vars[mount_rw])); then 57 flags=$'\tnone\tbind,rw,nosuid,nodev\t0 0' 58 for mtp in ${=vars[mount_rw]}; do 59 src=$site_containers_mountpoints[$mtp] 60 dst=$bindroot/mnt/$mtp 61 mnt_dirs_extra+=( $mtp ) 62 fstab+=( $src$'\t'$dst$flags ) 63 src_el=\"${${src//\\/\\\\}//\"/\\\"}\" 64 dst_el=\"${${dst//\\/\\\\}//\"/\\\"}\" 65 pid1_el_lines+=( 66 "if { mkdir -p $dst_el }" 67 "if { s6-mount -r -o bind,nodev,nosuid $src_el $dst_el }" 68 "if { s6-mount -o remount,bind,rw,nodev,nosuid . $dst_el }" 69 ) 70 done 71 fi 72 73 (($+vars[pid1_el])) && pid1_el_lines+=( $vars[pid1_el] ) 74 75 if (($#mnt_dirs_extra)); then 76 unify mnt_dirs_extra "$mnt_dirs_extra" 77 unify fstab_extra ${(F)fstab} 78 fi 79 80 require container_service_$vars[container_type] \ 81 :image_name :container_name :containers_dir :svscan_dir :user \ 82 \?mnt_dirs_extra \?fstab_extra \?prepare_chroot \?linux_caps \ 83 \?seccomp_profile \?display_number \ 84 pid1_el=${(F)pid1_el_lines} 85 86 #local chome=$userdir/$vars[container_name]/home/$vars[user] 87 #if ! [[ -d $chome/run ]]; then 88 # require fs_l filename=$chome/run destination=/mnt/init 89 # require fs_o filename=$chome/run owner=$uid:$gid 90 #fi 91 } 92 93 confz_site_containers_xorg_check() { 94 checkvars containers_dir svscan_dir 95 defvar user xorg 96 local display container bind bindroot chome uid gid 97 local -a fstab 98 bind=$'\tnone\tbind,nosuid,nodev\t0 0' 99 uid="${${(s.:.)"$(getent passwd $vars[user])"}[3]}" \ 100 gid="${${(s.:.)"$(getent group $vars[user])"}[3]}" \ 101 102 for display in 5 6 7 8; do 103 container=X$display 104 require container_service_xorg \ 105 vtN=$display image_name=gentoo-xorg \ 106 :containers_dir :svscan_dir :user 107 done 108 } 109 110 confz_site_containers_user_single_check() { 111 checkvars containers_dir svscan_dir user container_name image_name 112 defvar mount_ro init 113 require container_uidgid_for_name name=$vars[user] %uid %gid 114 require site_containers_usersvc_simple \ 115 :containers_dir :svscan_dir :user :uid :gid \ 116 :container_name :image_name :mount_ro \?mount_rw \?linux_caps \ 117 \?seccomp_profile \ 118 \?prepare_chroot 119 } 120 121 # User Container 122 UC() { 123 local container image 124 container=$1 125 shift 126 image=${1:-$container} 127 (($#)) && shift 128 require site_containers_usersvc_simple \ 129 :containers_dir :svscan_dir :user :uid :gid \ 130 container_name=$container image_name=$image "$@" 131 } 132 133 SUC() { 134 local container image 135 container=$1 136 shift 137 image=${1:-$container} 138 (($#)) && shift 139 require site_containers_user_single :containers_dir :svscan_dir \ 140 user=$container container_name=$container image_name=$image "$@" 141 } 142 #typeset -f -t UC 143 144 UCa() { 145 local container=$1 146 shift 147 UC $container alpine-$container "$@" 148 } 149 150 SUCa() { 151 local container=$1 152 shift 153 SUC $container alpine-$container "$@" 154 } 155 156 UCv() { 157 local container=$1 158 shift 159 UC $container void-$container "$@" 160 } 161 162 confz_site_containers_user_check() { 163 checkvars containers_dir svscan_dir user 164 require container_uidgid_for_name name=$vars[user] %uid %gid 165 166 local ro="mount_ro=init ccx-dotfiles ccx-scripts" 167 168 local -a el_netns=( 169 'unshare -n # make new network namespace' 170 'if { ip addr add 127.0.0.1/8 dev lo }' 171 'if { ip addr add ::1/128 dev lo }' 172 'if { ip link set lo up }' 173 ) 174 local in_netns=pid1_el=${(F)el_netns} 175 176 local with_more_fds=pid1_el='zsh -c "ulimit -Hn 16384 && exec \"$@\"" --' 177 178 local -a el_mount_usb_devices=( 179 "#!$(which execlineb) -P" 180 'if { mount -o bind,ro /dev/bus/usb dev/bus/usb }' 181 'mount -t sysfs sysfs sys' 182 ) 183 local with_usb=prepare_chroot=${(F)el_mount_usb_devices} 184 185 local -a el_mount_audio_devices=( 186 "#!$(which execlineb) -P" 187 'if { mount -o bind,ro /dev/snd dev/snd }' 188 'mount -t sysfs sysfs sys' # maybe not necessary? 189 ) 190 local with_audio=prepare_chroot=${(F)el_mount_audio_devices} 191 192 local -a el_mount_ccx_opt=( 193 "#!$(which execlineb) -P" 194 'if { mount -o bind,ro /home/ccx/opt ./opt }' 195 ) 196 local with_opt=prepare_chroot=${(F)el_mount_ccx_opt} 197 198 local display 199 for display in 5 6 7 8; do 200 UC xsession.$display alpine-xsession \ 201 container_type=xsession \ 202 display_number=$display \ 203 :containers_dir :svscan_dir :user 204 done 205 206 UC alpine-browsers 207 UC pentoo 208 UCa weechat 209 UCa senpai 210 UCa profanity 211 UCa gomuks 212 UCa testssl 213 UCa tinyproxy 214 UCa tor 215 UCa syncthing 216 UCa mpv 217 UCa imgproc 218 UCa ghosttext $in_netns 219 UC rcm-jira alpine-ghosttext $in_netns seccomp_profile=ptrace 220 UC socks alpine-tinyproxy "$ro versions" 221 UC pypi-mirror alpine-httpd $in_netns 222 UCa ssh 223 UCa pass mount_rw="ccx-password-store" $in_netns 224 # seccomp profile for OpenSSH: KnownHostsCommand-ORDER: setresgid 1000: Operation not permitted 225 UC rcm-ssh alpine-ssh seccomp_profile=setuidgid "$ro rcm-devops versions" $with_more_fds 226 UCa socials $in_netns 227 UCa gpg $with_usb $in_netns 228 UCa notes $in_netns mount_rw=ccx-task 229 UCa gimp $in_netns 230 UCa ebook $in_netns 231 UCv telegram 232 UC mumble gentoo-mumble 233 UC gentoo-dev gentoo-dev 234 UCa pdf 235 UCa poezio 236 UCa libervia 237 UCa signal 238 UCa bugwarrior mount_rw=ccx-task 239 UC signal2 alpine-signal 240 UC scrapbook alpine-pywebscrapbook $in_netns 241 UC ff-artemislena-audio void-browsers 242 UC ff-te2000-audio void-browsers 243 UC ff-rcm-audio void-browsers 244 UC ff-hanka-audio void-browsers 245 UC ff-rcm-slack alpine-browsers 246 UC ff-blesmrt.net alpine-browsers 247 UC ff-syncthing alpine-browsers $in_netns 248 UC ff-rcm-google alpine-browsers $in_netns 249 UC ff-rcm-internal alpine-browsers $in_netns 250 UC ff-rcm-other alpine-browsers $in_netns 251 UC ff-recombee.1password.eu alpine-browsers $in_netns 252 UC ff-kosik.cz alpine-browsers $in_netns 253 UC ff-template alpine-browsers $in_netns 254 UC ff-te2000 alpine-browsers $in_netns 255 UC ff-te2000-google alpine-browsers $in_netns 256 UC ff-webcomics alpine-browsers $in_netns 257 UC ff-csas.cz alpine-browsers $in_netns 258 UC ff-flife alpine-browsers $in_netns 259 UC ff-github.com alpine-browsers $in_netns 260 UC ff-sopuli.xyz alpine-browsers $in_netns 261 UC ff-kumi.tube alpine-browsers $in_netns 262 UC ff-diode.zone alpine-browsers $in_netns 263 UC ff-kosik.cz alpine-browsers $in_netns 264 UC ff-disroot.org alpine-browsers $in_netns 265 UC ff-codeberg.org alpine-browsers $in_netns 266 UC ff-wise.com alpine-browsers $in_netns 267 UC ff-pixelfed.de alpine-browsers $in_netns 268 UC ff-time4vps.com alpine-browsers $in_netns 269 UC ff-itch.io alpine-browsers $in_netns 270 UC ff-mobilizon.envs.net alpine-browsers $in_netns 271 UC ff-lulu.com alpine-browsers $in_netns 272 UC ff-mojemana.cz alpine-browsers $in_netns 273 UC ff-sopuli.xyz alpine-browsers $in_netns 274 UC ff-blahaj.zone alpine-browsers $in_netns 275 UC ff-norwegian.com alpine-browsers # $in_netns 276 UC ff-finnair.com alpine-browsers # $in_netns 277 UC gentoo-browsers gentoo-torbrowser $in_netns 278 UC gentoo-video gentoo-video $in_netns "$ro video" 279 UC syncplay gentoo-video "$ro video" 280 #UC twitch void-browsers 281 UCa aria2 mount_rw="video audio" 282 UC neonmodem alpine-go 283 UC iamb alpine-rust 284 UC simplex alpine-haskell 285 UC xpra gentoo-xorg container_type=ephemeral $in_netns seccomp_profile=xpra 286 UC bzr alpine-breezy mount_rw=ccx-bzr "$ro ccx-baregit" $in_netns 287 UC git alpine-git mount_rw=ccx-baregit $in_netns 288 UC sndiod alpine-sndio $with_audio $in_netns 289 UC mpd void-mpd "$ro init audio" 290 UC doom void-doom $in_netns seccomp_profile=ptrace 291 #UC {,}alpine-recombee 292 UC rcm-puppet alpine-puppet $in_netns 293 UC rcm-postgresql-dev alpine-postgresql-dev $in_netns seccomp_profile=ptrace 294 UC spark alpine-dev-spark mount_rw="ccx-bzr" seccomp_profile=ptrace 295 UC ssrn-master-dev alpine-postgresql-dev mount_rw="ccx-bzr" $in_netns seccomp_profile=ptrace 296 UC ssrn-monitor-dev alpine-postgresql-dev mount_rw="ccx-bzr" $in_netns seccomp_profile=ptrace 297 UC pthbs-dev alpine-pthbs-dev mount_rw="ccx-bzr" "$ro pthbs mrrl" $in_netns seccomp_profile=ptrace 298 UC ledum-dev alpine-pthbs-dev "$ro pthbs mrrl" $in_netns seccomp_profile=ptrace 299 UC pthbs-build mrrl-bindmount mount_rw=ccx-vm-images "$ro versions mrrl" $in_netns $with_more_fds seccomp_profile=build 300 UC pthbs-test alpine-qemu mount_rw=ccx-vm-images seccomp_profile=ptrace 301 UC gentoo-prefix-dev alpine-gentoo-dev $with_opt "$ro versions" seccomp_profile=ptrace 302 UC x11-dev gentoo-xorg mount_rw="ccx-bzr" $in_netns seccomp_profile=ptrace 303 UCa weechat-dev $in_netns seccomp_profile=ptrace 304 UCa ocaml-dev $in_netns seccomp_profile=ptrace 305 # -- mail 306 UCa mail-net mount_rw="mail-te2000.cz-ccx mail-disroot.org-ccx" 307 UC {rcm,alpine}-mail-net mount_rw="mail-recombee.com-jan.pobrislo" 308 UC mail alpine-mail-read mount_rw="mail-te2000.cz-ccx mail-disroot.org-ccx" $in_netns 309 UC rcm-mail alpine-mail-read mount_rw="mail-recombee.com-jan.pobrislo" $in_netns 310 311 } 312 313 confz_site_container_services_check() { 314 defvar containers_dir /mnt/volumes/containers 315 defvar svscan_dir /run/service 316 require site_containers_xorg user=xorg :containers_dir :svscan_dir 317 require site_containers_user user=ccx :containers_dir :svscan_dir 318 #require container_service_sysroot :containers_dir :svscan_dir \ 319 # image_name=alpine-dev 320 local -a el_rfkill_and_sys=( 321 "#!$(which execlineb) -P" 322 'importas -i GID GID' 323 'if { mknod -m 660 ./dev/rfkill c 10 242 }' 324 'if { chown 0:${GID} ./dev/rfkill }' 325 'mount -t sysfs sysfs sys' 326 ) 327 local -a el_net_tun=( 328 "#!$(which execlineb) -P" 329 'importas -i GID GID' 330 'if { mknod -m 660 ./dev/net/tun c 10 200 }' 331 'if { chown 0:${GID} ./dev/net/tun }' 332 ) 333 334 SUCa wpa_supplicant linux_caps='^CAP_NET_ADMIN,^CAP_NET_RAW' \ 335 prepare_chroot=${(F)el_rfkill_and_sys} 336 SUCa dhcpcd linux_caps='^CAP_NET_ADMIN,^CAP_NET_RAW,^CAP_NET_BIND_SERVICE' 337 SUCa unbound linux_caps='^CAP_NET_BIND_SERVICE' 338 SUCa tinc linux_caps='^CAP_NET_ADMIN' prepare_chroot=${(F)el_net_tun} 339 SUCa networking linux_caps='^CAP_NET_ADMIN,^CAP_NET_RAW' \ 340 prepare_chroot=${(F)el_rfkill_and_sys} 341 } 342 343 confz_site_container_alpine_check() { 344 checkvars containers_dir svscan_dir image_name packages 345 defvar arch x86_64 346 defvar repositories 'main community' # abduco lives in community 347 348 require container_alpine_image \ 349 :containers_dir :arch :image_name :repositories \?release 350 require container_alpine_packages_installed \ 351 :containers_dir :svscan_dir :image_name :packages 352 } 353 354 confz_site_container_void_musl_check() { 355 checkvars containers_dir svscan_dir image_name packages 356 defvar arch x86_64-musl 357 defvar repository current/musl 358 359 require container_void_image \ 360 :containers_dir :arch :repository :image_name 361 require container_void_packages_installed \ 362 :containers_dir :svscan_dir :image_name :packages 363 } 364 365 confz_site_container_void_glibc_check() { 366 checkvars containers_dir svscan_dir image_name packages 367 defvar arch x86_64 368 defvar repository current 369 370 require container_void_image \ 371 xbps_install_executable=xbps-install.static \ 372 :containers_dir :arch :repository :image_name 373 require container_void_packages_installed \ 374 :containers_dir :svscan_dir :image_name :packages 375 } 376 377 confz_site_container_void_glibc_nonfree_check() { 378 checkvars containers_dir svscan_dir image_name packages 379 defvar arch x86_64 380 defvar repository current 381 382 require container_void_image \ 383 xbps_install_executable=xbps-install.static \ 384 :containers_dir :arch :repository :image_name 385 require container_void_packages_installed \ 386 :containers_dir :svscan_dir :image_name packages=void-repo-nonfree 387 require container_void_packages_installed \ 388 :containers_dir :svscan_dir :image_name :packages 389 } 390 391 confz_site_container_gentoo_check() { 392 checkvars containers_dir svscan_dir image_name system 393 defvar system amd64-musl-hardened 394 395 require container_gentoo_from_snapshot \ 396 :containers_dir :system :image_name :svscan_dir 397 } 398 399 confz_site_container_nix_check() { 400 checkvars containers_dir svscan_dir image_name packages 401 defvar system x86_64-linux 402 defvar repository current/musl 403 404 require container_nix_image_from_release \ 405 :containers_dir :repository :image_name :svscan_dir :system 406 require container_nix_packages_installed \ 407 :containers_dir :svscan_dir :image_name :packages 408 require container_nix_bin_linked :containers_dir :image_name 409 } 410 411 confz_site_container_debian_puppetserver_check() { 412 checkvars containers_dir svscan_dir image_name 413 defvar arch amd64 414 defvar suite bullseye # Debian 11 415 defvar packages puppetserver 416 417 require container_debian_image \ 418 :containers_dir :image_name :svscan_dir :arch :suite \?root 419 require container_puppet_apt_repo \ 420 :containers_dir :image_name :svscan_dir :arch :suite 421 require container_debian_packages_installed_with_fakeroot \ 422 :containers_dir :svscan_dir :image_name :packages 423 } 424 425 confz_site_container_images_check() { 426 checkvars containers_dir svscan_dir 427 428 local -a gentoo_images_musl 429 gentoo_images_musl=( 430 xorg 431 video 432 torbrowser 433 mumble 434 dev 435 ) 436 437 local i 438 for i in $gentoo_images_musl; do 439 require site_container_gentoo :containers_dir :svscan_dir \ 440 system=amd64-musl-hardened image_name=gentoo-$i 441 done 442 443 require container_mrrl_image :containers_dir :svscan_dir \ 444 image_name=mrrl-bindmount 445 446 require site_container_gentoo :containers_dir :svscan_dir \ 447 system=amd64-nomultilib-openrc image_name=gentoo-dev-glibc 448 449 local -a alpine_core=( 450 s6 451 s6-{rc,linux-utils,portable-utils} 452 execline 453 ncurses-terminfo 454 zsh 455 tree 456 strace 457 musl-utils 458 ) 459 460 local -a alpine_community=( 461 $alpine_core 462 abduco 463 rxvt-unicode-terminfo 464 ) 465 466 local -a alpine_x11=( 467 $alpine_community 468 fontconfig 469 rxvt-unicode 470 nsxiv 471 font-terminus 472 font-unifont 473 #wmctrl 474 xauth 475 xbindkeys 476 xclip 477 xdotool 478 xdpyinfo 479 xev 480 xrandr 481 xrdb 482 ) 483 484 local -a alpine_terminal=( 485 $alpine_community 486 tmux 487 strace 488 vis 489 # mandoc 490 ) 491 492 local -a alpine_dev_core=( 493 $alpine_terminal 494 vim 495 ctags 496 ripgrep delta bat 497 git 498 git-lfs 499 tig 500 make 501 patch 502 rsync 503 strace 504 {skalibs,s6,execline}-{dev,static} 505 ) 506 507 local -a alpine_dev_py3=( 508 $alpine_dev_core 509 py3-setuptools 510 py3-pip 511 py3-pysocks # for proxy support in pip 512 py3-wheel 513 py3-pip-tools 514 breezy 515 py3-tzlocal # for breezy 516 py3-cffi # not strictly necessary but used by eg. taskwarrior/bugwarrior 517 s6-networking # for tunneling proxy through unix sockets 518 man-pages 519 man-pages-posix 520 mandoc 521 ctags-doc 522 ) 523 local -a alpine_dev_py3_gcc=( 524 $alpine_dev_py3 525 python3-dev 526 gcc 527 g++ 528 musl-dev 529 ncurses-dev 530 zlib-dev 531 openssl-dev 532 gmp-dev 533 libffi-dev 534 ) 535 local -a alpine_dev_py3_gdb=( 536 $alpine_dev_py3_gcc 537 curl{,-dev,-dbg} 538 musl-dbg 539 openssl-{dev,dbg} 540 readline-dev 541 sqlite{,-dev} 542 python3-dbg 543 gdb 544 perf 545 ) 546 547 local -a alpine_dev_ocaml=( 548 $alpine_dev_core 549 s6-networking # for tunneling proxy through unix sockets 550 man-pages 551 man-pages-posix 552 mandoc 553 ctags-doc 554 python3-dev 555 gcc 556 g++ 557 musl-dev 558 ncurses-dev 559 zlib-dev 560 openssl-dev 561 gmp-dev 562 libffi-dev 563 # ocaml{,-doc} # ocaml-4.x 564 # ocamlbuild{,-doc} 565 opam{,-doc} 566 dune{,-doc} 567 ocaml5{,-doc,-ocamldoc,-compiler-libs} 568 ) 569 570 require site_container_alpine :containers_dir :svscan_dir \ 571 image_name=alpine-qemu packages="$alpine_terminal qemu-tools qemu-system-x86_64" 572 573 require site_container_alpine :containers_dir :svscan_dir \ 574 image_name=alpine-ocaml-dev packages="$alpine_dev_ocaml" 575 576 require site_container_alpine :containers_dir :svscan_dir \ 577 image_name=alpine-sndio \ 578 packages="$alpine_community sndio alsa-utils strace tmux" 579 580 require site_container_alpine :containers_dir :svscan_dir \ 581 image_name=alpine-httpd \ 582 packages="$alpine_terminal s6-networking thttpd thttpd-doc tipidee tipidee-doc w3m" 583 584 require site_container_alpine :containers_dir :svscan_dir \ 585 image_name=alpine-tinyproxy \ 586 packages="$alpine_terminal s6-networking w3m tinyproxy" # tinyproxy-doc mandoc" 587 588 require site_container_alpine :containers_dir :svscan_dir \ 589 image_name=alpine-aria2 \ 590 packages="$alpine_terminal aria2 aria2-doc" 591 592 require site_container_alpine :containers_dir :svscan_dir \ 593 image_name=alpine-syncthing \ 594 packages="$alpine_community syncthing ncdu" 595 596 require site_container_alpine :containers_dir :svscan_dir \ 597 image_name=alpine-mpv \ 598 packages="$alpine_x11 mpv mpv-dbg strace gdb" 599 600 local -a alpine_pdf=( 601 $alpine_x11 602 qpdf 603 xpdf 604 pdf4qt 605 mupdf 606 zathura zathura-pdf-poppler 607 corepdf 608 ghostscript ghostscript-doc 609 poppler-utils poppler-doc 610 mandoc 611 tmux 612 vis 613 ) 614 require site_container_alpine :containers_dir :svscan_dir \ 615 image_name=alpine-pdf \ 616 packages="$alpine_pdf" 617 618 require site_container_alpine :containers_dir :svscan_dir \ 619 image_name=alpine-tor \ 620 packages="$alpine_community tor" 621 622 require site_container_alpine :containers_dir :svscan_dir \ 623 image_name=alpine-wpa_supplicant \ 624 packages="$alpine_community wpa_supplicant" 625 626 require site_container_alpine :containers_dir :svscan_dir \ 627 image_name=alpine-unbound \ 628 packages="$alpine_community unbound" 629 630 require site_container_alpine :containers_dir :svscan_dir \ 631 image_name=alpine-dhcpcd \ 632 packages="$alpine_community dhcpcd" 633 634 require site_container_alpine :containers_dir :svscan_dir \ 635 image_name=alpine-tinc \ 636 packages="$alpine_community tinc-pre" 637 638 local -a alpine_networking=( 639 $alpine_community 640 util-linux util-linux-misc # for rfkill 641 iproute2 642 dhcpcd 643 unbound ldns-tools drill 644 fping traceroute tcptraceroute 645 iptraf-ng 646 mtr 647 arping 648 bridge-utils 649 tshark 650 tcpdump 651 conntrack-tools 652 iptables 653 nftables 654 ethtool 655 macchanger 656 stunnel 657 socat 658 s6-networking 659 sslscan 660 ssldump 661 htop 662 gdb 663 iftop 664 ) 665 require site_container_alpine :containers_dir :svscan_dir \ 666 image_name=alpine-networking \ 667 packages="$alpine_networking" 668 669 require site_container_alpine :containers_dir :svscan_dir \ 670 image_name=alpine-go \ 671 packages="$alpine_dev_core go" 672 673 require site_container_alpine :containers_dir :svscan_dir \ 674 image_name=alpine-git \ 675 packages="$alpine_dev_core git-daemon s6-networking" 676 677 require site_container_alpine :containers_dir :svscan_dir \ 678 image_name=alpine-rust \ 679 packages="$alpine_dev_core rust cargo rustup" 680 681 require site_container_alpine :containers_dir :svscan_dir \ 682 image_name=alpine-gpg packages="$alpine_terminal gnupg gnupg-scdaemon pinentry-tty pinentry-curses-ss" 683 684 require site_container_alpine :containers_dir :svscan_dir \ 685 image_name=alpine-pass packages="$alpine_terminal gnupg pass pass-otp git" 686 687 require site_container_alpine :containers_dir :svscan_dir \ 688 image_name=alpine-ssh packages="$alpine_terminal openssh dropbear make rsync got" 689 690 local -a alpine_weechat=( 691 $alpine_terminal 692 weechat weechat-matrix weechat-python weechat-perl weechat-spell 693 aspell aspell-utils 694 git 695 perl-pod-parser # for multiline.pl 696 ) 697 require site_container_alpine :containers_dir :svscan_dir \ 698 image_name=alpine-weechat packages="$alpine_weechat" 699 700 local -a alpine_weechat_dev=( 701 $alpine_dev_py3_gdb 702 socat 703 weechat weechat-matrix weechat-python weechat-perl weechat-spell 704 weechat-dev 705 aspell aspell-utils 706 aspell-dev 707 cmake 708 ) 709 require site_container_alpine :containers_dir :svscan_dir \ 710 image_name=alpine-weechat-dev packages="$alpine_weechat_dev" 711 712 require site_container_alpine :containers_dir :svscan_dir \ 713 repositories="main community testing" \ 714 image_name=alpine-senpai \ 715 packages="$alpine_terminal senpai senpai-doc mandoc" 716 717 require site_container_alpine :containers_dir :svscan_dir \ 718 repositories="main community testing" \ 719 image_name=alpine-profanity packages="$alpine_terminal profanity" 720 721 require site_container_alpine :containers_dir :svscan_dir \ 722 repositories="main community testing" \ 723 image_name=alpine-gomuks packages="$alpine_terminal gomuks" 724 725 local -a alpine_haskell=( 726 # deps claimed by ghcup 727 binutils-gold curl gcc g++ gmp-dev libffi-dev make musl-dev ncurses-dev perl tar xz 728 # for verifying ghcup 729 gnupg gnupg-wks-client 730 # other 731 git zlib-dev openssl-dev 732 cabal 733 grep findutils ripgrep 734 ) 735 require site_container_alpine :containers_dir :svscan_dir \ 736 repositories="main community testing" \ 737 image_name=alpine-haskell \ 738 packages="$alpine_haskell" 739 740 local -a alpine_testssl=( 741 $alpine_terminal 742 bash 743 coreutils # (for dd) 744 procps-ng # (for ps) 745 git 746 make 747 patch 748 ldns-tools 749 drill 750 sfeed curl 751 openssl 752 gnutls-utils 753 ) 754 require site_container_alpine :containers_dir :svscan_dir \ 755 repositories="main community testing" \ 756 image_name=alpine-testssl packages="$alpine_testssl" 757 758 local -a alpine_mail_net=( 759 $alpine_terminal 760 make patch 761 mandoc 762 {mblaze,slrn,msmtp}{,-doc} 763 py3-{setuptools,pip,wheel} # Python 3 / venv 764 py3-{cryptography,urllib3,certifi,distro,python-gssapi} # offlineimap3 765 git git-doc # offlineimap3 source 766 ) 767 require site_container_alpine :containers_dir :svscan_dir \ 768 repositories="main community testing" \ 769 image_name=alpine-mail-net packages="$alpine_mail_net" 770 771 local -a alpine_mail_read=( 772 $alpine_terminal 773 make 774 mandoc 775 {neomutt,mblaze,notmuch,elinks,w3m,lynx,git,par}{,-doc} 776 py3-{setuptools,pip,wheel} # Python 3 / venv 777 py3-{notmuch,urwid{,trees},twisted,magic,gpgme} # alot 778 poppler-utils poppler-doc # pdftotext 779 catdoc{,-doc} # .doc/.xls 780 gnumeric{,-doc} font-noto # ssconvert 781 ) 782 require site_container_alpine :containers_dir :svscan_dir \ 783 repositories="main community testing" \ 784 image_name=alpine-mail-read packages="$alpine_mail_read" 785 786 local -a alpine_dev_spark=( 787 $alpine_dev_py3 788 postgresql14 789 py3-psycopg2 790 openssh 791 rsync 792 ) 793 require site_container_alpine :containers_dir :svscan_dir \ 794 repositories="main community" \ 795 image_name=alpine-dev-spark \ 796 packages="$alpine_dev_spark" 797 798 require site_container_alpine :containers_dir :svscan_dir \ 799 repositories="main community" \ 800 image_name=alpine-breezy \ 801 packages="$alpine_dev_py3" 802 803 require site_container_alpine :containers_dir :svscan_dir \ 804 repositories="main community" \ 805 image_name=alpine-bugwarrior \ 806 packages="$alpine_dev_py3 task" 807 808 require site_container_alpine :containers_dir :svscan_dir \ 809 repositories="main community testing" \ 810 image_name=alpine-notes \ 811 packages="$alpine_dev_py3 broot task neovim py3-pynvim py3-six w3m par gawk" 812 813 local -a alpine_dev_pthbs=( 814 $alpine_dev_py3_gcc 815 broot 816 vim 817 neovim 818 py3-jinja2 819 py3-yaml 820 wget 821 pkgconf 822 htop 823 skalibs-dev 824 s6-dev 825 execline-dev 826 linux-headers 827 libcap-static 828 libcap-dev 829 socat 830 curl 831 gdb 832 ncdu 833 swi-prolog 834 gpg 835 astyle 836 uncrustify 837 ) 838 require site_container_alpine :containers_dir :svscan_dir \ 839 repositories="main community testing" \ 840 image_name=alpine-pthbs-dev \ 841 packages="$alpine_dev_pthbs" 842 843 require site_container_alpine :containers_dir :svscan_dir \ 844 repositories="main community" \ 845 image_name=alpine-pywebscrapbook \ 846 packages="$alpine_dev_py3 py3-pynvim" 847 848 require site_container_alpine :containers_dir :svscan_dir \ 849 repositories="main community" \ 850 image_name=alpine-ebook \ 851 packages="$alpine_dev_py3 py3-pynvim ebook-tools epy" 852 853 local -a alpine_poezio=( 854 $alpine_dev_py3_gcc 855 py3-{cryptography,asn1,asn1-modules,aiodns,pycares,typing-extensions} 856 py3-sphinx 857 cmake 858 ) 859 require site_container_alpine :containers_dir :svscan_dir \ 860 repositories="main community" \ 861 image_name=alpine-poezio \ 862 packages="$alpine_poezio" 863 864 local -a alpine_libervia=( 865 $alpine_dev_py3_gcc 866 py3-{cryptography,asn1,asn1-modules,aiodns,pycares,typing-extensions} 867 py3-{alembic,twisted,gobject3,lxml,lxml-html-clean,dbus,babel,pillow} 868 py3-{openssl,sqlalchemy,cairo,cairo-dev,libxml2,netifaces} 869 # Mercurial 870 mercurial mercurial-zsh-completion 871 # libcairo 2 with development header 872 cairo{,-dev,-dbg} 873 # libjpeg with development headers 874 libjpeg 875 libjpeg-turbo{,-dev} 876 # libgirepository 1.0 with development headers 877 # libdbus-1 with development headers 878 dbus{,-dev} 879 # libdbus-glib-1 with development headers 880 dbus-glib{,-dev} 881 # libxml2 with development headers 882 libxml2{,-dev,-dbg} 883 # libxlt2 with development headers 884 # D-Bus x11 tools (this doesn’t needs X11, it is just needed for dbus-launch) 885 cmake 886 libsodium{,-dev} 887 ) 888 require site_container_alpine :containers_dir :svscan_dir \ 889 repositories="main community" \ 890 image_name=alpine-libervia \ 891 packages="$alpine_libervia" 892 893 local -a alpine_imgproc=( 894 $alpine_dev_py3_gcc 895 python3-dev 896 py3-{matplotlib,numpy{,-dev},pillow,pyarrow} 897 tesseract-ocr 898 tesseract-ocr-data-{ces,eng,fin,pol,rus,ukr,osd} 899 cmake 900 swig 901 blas 902 openblas{,-dev} 903 gflags{,-dev} 904 graphicsmagick 905 poppler-utils 906 ) 907 require site_container_alpine :containers_dir :svscan_dir \ 908 repositories="main community" \ 909 image_name=alpine-imgproc \ 910 packages="$alpine_imgproc" 911 912 require site_container_alpine :containers_dir :svscan_dir \ 913 repositories="main community" \ 914 image_name=alpine-gimp \ 915 packages="$alpine_x11 gimp" 916 917 require site_container_alpine :containers_dir :svscan_dir \ 918 repositories="main testing community" \ 919 image_name=alpine-signal \ 920 packages="$alpine_x11 signal-desktop" 921 922 local -a alpine_browsers=( 923 $alpine_x11 924 firefox 925 font-noto 926 #lxappearance 927 mupdf 928 mupdf-x11 929 7zip 930 qutebrowser 931 rsync 932 vimb 933 #visurf 934 w3m 935 privoxy # can use upstream SOCKS proxy 936 s6-networking 937 execline 938 coreutils # cat -s in ff-mkprofile 939 yad # Yet Another Dialog, fork of Zenity 940 # py3-pynvim neovim # neovim + bindings for https://github.com/fregante/GhostText 941 # git # for nvim plugins 942 # py3-pip py3-wheel # for vim-ghost autoinstall procedure 943 ) 944 require site_container_alpine :containers_dir :svscan_dir \ 945 image_name=alpine-browsers packages="$alpine_browsers" 946 947 require site_container_alpine :containers_dir :svscan_dir \ 948 image_name=alpine-ghosttext \ 949 packages="$alpine_dev_py3 py3-pynvim neovim neovim-doc pandoc-cli pandoc-cli-doc w3m lynx elinks" 950 951 local -a alpine_socials=( 952 $alpine_x11 953 firefox 954 font-noto 955 #lxappearance 956 7zip 957 rsync 958 coreutils # cat -s in ff-mkprofile 959 py3-pynvim neovim # neovim + bindings for https://github.com/fregante/GhostText 960 git # for nvim plugins 961 py3-pip py3-wheel # for vim-ghost autoinstall procedure 962 py3-{setuptools,pip,wheel} # Python 3 / venv 963 py3-{cryptography,urllib3,certifi,distro,python-gssapi} # offlineimap3 964 git-lfs 965 zsh-vcs 966 vim vis 967 tmux 968 htop 969 openssh 970 make 971 patch 972 ripgrep bat delta 973 colordiff 974 tree broot 975 gnupg pass 976 sfeed sfeed-doc lynx elinks w3m curl # alternative RSS/ATOM processor 977 musl-utils # for getent 978 notmuch mblaze notmuch-doc mblaze-doc notmuch-vim 979 socat 980 gawk 981 mksh 982 openssl 983 s6-networking 984 ) 985 require site_container_alpine :containers_dir :svscan_dir \ 986 repositories="main community testing" \ 987 image_name=alpine-socials packages="$alpine_socials" 988 989 local -a alpine_office=( 990 $alpine_x11 991 font-noto 992 #lxappearance 993 mupdf 994 mupdf-x11 995 7zip 996 catdoc 997 abiword 998 gnumeric 999 libreoffice 1000 ) 1001 # require site_container_alpine :containers_dir :svscan_dir \ 1002 # repositories="main community testing" \ 1003 # image_name=alpine-office packages="$alpine_office" 1004 1005 local -a alpine_dev_postgresql=( 1006 $alpine_dev_py3_gdb 1007 git 1008 git-daemon 1009 git-doc 1010 zsh-vcs 1011 vim 1012 ctags 1013 htop 1014 colordiff 1015 tree broot 1016 strace gdb 1017 postgresql16{-jit,-contrib,-contrib-jit,-doc,-dev,-plpython3} 1018 postgresql17{-jit,-contrib,-contrib-jit,-doc,-dev,-plpython3} 1019 postgresql-{pgvector,timescaledb,plpgsql_check} 1020 musl-dev 1021 ncurses-dev 1022 readline-dev 1023 openssl-dev 1024 py3-psycopg2 1025 py3-pytest 1026 py3-hypothesis 1027 bison flex 1028 libpq-dev libecpg-dev icu-dev lz4-dev zstd-dev 1029 util-linux-dev zlib-dev 1030 linux-headers 1031 pg_top 1032 pg_activity 1033 ) 1034 alpine_dev_postgresql+=( # timescaledb build deps 1035 bash 1036 cmake 1037 # 'openssl-dev>3' 1038 openssl-dev 1039 perl-ipc-run 1040 perl-utils 1041 # postgresql 1042 # postgresql-dev 1043 samurai 1044 ) 1045 require site_container_alpine :containers_dir :svscan_dir \ 1046 image_name=alpine-postgresql-dev packages="$alpine_dev_postgresql" 1047 1048 local -a alpine_dev_gentoo=( 1049 $alpine_dev_py3 1050 bash 1051 wget 1052 git 1053 git-daemon 1054 git-doc 1055 zsh-vcs 1056 vim 1057 ctags 1058 htop 1059 colordiff 1060 tree broot 1061 strace gdb 1062 musl-dev 1063 ncurses-dev 1064 openssl-dev 1065 gcc 1066 g++ 1067 binutils 1068 alpine-release 1069 lsb-release-minimal 1070 linux-headers 1071 gettext{,-dev} 1072 automake 1073 autoconf 1074 tar 1075 findutils 1076 coreutils 1077 util-linux 1078 mksh 1079 bmake 1080 nawk 1081 ) 1082 #require site_container_alpine :containers_dir :svscan_dir \ 1083 # image_name=alpine-gentoo-dev packages="$alpine_dev_gentoo" 1084 1085 local -a alpine_puppet=( 1086 $alpine_terminal 1087 # from alpine_dev_core 1088 vim 1089 ctags 1090 ripgrep bat 1091 delta 1092 git 1093 git-lfs 1094 make 1095 patch 1096 rsync 1097 strace 1098 {skalibs,s6,execline}-{dev,static} 1099 s6-networking 1100 # added 1101 man-pages 1102 # man-pages-posix ## missing 1103 mandoc 1104 zsh-vcs 1105 htop 1106 ruby-full ruby-bundler # for puppet 1107 # ruby-json # missing 1108 colordiff 1109 # jq 1110 file 1111 gawk 1112 # openssl 1113 ruby-dev 1114 gcc 1115 g++ 1116 musl-dev 1117 ncurses-dev 1118 zlib-dev 1119 openssl-dev 1120 gmp-dev 1121 libffi-dev 1122 ) 1123 # I see /opt/puppetlabs/puppet/bin/ruby --version 1124 # => ruby 3.1.2p20 (2022-04-12 revision 4491bb740a) [x86_64-linux-gnu] 1125 # The newest alpine with ruby 3.1.x is v3.17 with 3.1.5-r0 1126 # (was v3.17 with 2.7.6p219 previously) 1127 require site_container_alpine :containers_dir :svscan_dir \ 1128 release=v3.17 image_name=alpine-puppet packages="$alpine_puppet" 1129 1130 local -a alpine_recombee=( 1131 $alpine_community 1132 # man-db 1133 man-pages # man-pages-posix 1134 git 1135 git-lfs 1136 git-daemon 1137 git-doc 1138 zsh-vcs 1139 vim vis 1140 tmux 1141 htop 1142 openssh 1143 python3 ipython py3-pip py3-wheel 1144 python3-dev libffi{,-dev} # for compiling cffi 1145 py3-cffi py3-cryptography py3-pynacl 1146 ruby ruby-bundler ruby-json # for puppet 1147 ruby-bigdecimal ruby-rdoc # for gitlab 1148 make 1149 patch 1150 ripgrep bat # delta 1151 colordiff 1152 jq 1153 weechat weechat-python py3-websocket-client # for wee-slack 1154 weechat-spell aspell aspell-utils 1155 py3-feedparser # for weemustfeed.py 1156 rsync 1157 tree # broot 1158 gnupg pass 1159 go # for DC/OS CLI 1160 file 1161 strace gdb 1162 task py3-cffi # for taskwarrior/bugwarrior 1163 sfeed sfeed-doc lynx elinks w3m curl # alternative RSS/ATOM processor 1164 drill ldns-tools # for drill 1165 musl-utils # for getent 1166 notmuch mblaze notmuch-doc mblaze-doc notmuch-vim 1167 py3-notmuch py3-gpgme # for alot 1168 ncurses-dev # for building sfeed from source 1169 socat 1170 gawk 1171 # postgresql-dev # for developing pg_cgroup 1172 mksh 1173 dpkg dpkg-dev 1174 fuse3-dev pcre2-dev # for tup 1175 openssl 1176 ctags 1177 jsonnet 1178 yq 1179 ) 1180 #require site_container_alpine :containers_dir :svscan_dir \ 1181 # release=v3.13 image_name=alpine-recombee packages="$alpine_recombee" 1182 1183 local -a void_core=( 1184 abduco 1185 s6 1186 s6-{rc,linux-utils,portable-utils} 1187 execline 1188 ncurses-base 1189 rxvt-unicode-terminfo 1190 zsh 1191 coreutils 1192 which 1193 grep 1194 gawk 1195 sed 1196 findutils 1197 strace 1198 htop 1199 procps-ng 1200 vis 1201 ) 1202 local -a void_x11=( 1203 $void_core 1204 xauth 1205 xdg-utils 1206 wmctrl 1207 xdotool 1208 xclip 1209 file # for xdg-open 1210 rxvt-unicode 1211 # xorg-fonts 1212 font-misc-misc 1213 dejavu-fonts-ttf 1214 terminus-font 1215 ) 1216 1217 require site_container_void_musl :containers_dir :svscan_dir \ 1218 image_name=void-mpd packages="$void_core sndio sox mpd mpc ncmpcpp" 1219 1220 require site_container_void_musl :containers_dir :svscan_dir \ 1221 image_name=void-telegram packages="$void_x11 sndio sox telegram-desktop nsxiv" 1222 # TODO: packages="p7zip" fails despite being installed 1223 1224 require site_container_void_musl :containers_dir :svscan_dir \ 1225 image_name=void-browsers packages="$void_x11 sndio sox firefox yad" 1226 1227 require site_container_void_musl :containers_dir :svscan_dir \ 1228 image_name=void-mumble packages="$void_x11 sndio sox mumble" 1229 1230 local -a void_doom=( 1231 $void_x11 1232 sndio sox 1233 git 1234 tmux 1235 wget 1236 curl 1237 w3m 1238 # p7zip 1239 nsxiv 1240 SLADE 1241 deutex 1242 crispy-doom 1243 gzdoom 1244 glxinfo 1245 ) 1246 require site_container_void_musl :containers_dir :svscan_dir \ 1247 image_name=void-doom packages="$void_doom" 1248 1249 require site_container_void_glibc :containers_dir :svscan_dir \ 1250 image_name=void-signal \ 1251 packages="$void_x11 htop xdg-utils mesa-demos Signal-Desktop" 1252 1253 # require site_container_void_glibc_nonfree :containers_dir :svscan_dir \ 1254 # image_name=void-games \ 1255 # packages="$void_core dwarffortress adom" 1256 1257 local -a nix_core=( 1258 s6 1259 s6-{rc,linux-utils,portable-utils} 1260 execline 1261 # ncurses # version stripping doesn't work for this ATM 1262 zsh 1263 abduco 1264 rxvt-unicode 1265 ) 1266 1267 # require site_container_nix :containers_dir :svscan_dir \ 1268 # image_name=nix-signal packages="$nix_core signal-desktop" 1269 1270 #require site_container_debian_puppetserver :containers_dir :svscan_dir \ 1271 # image_name=rcm-puppetserver 1272 1273 local -a alpine_xsession=( 1274 $alpine_x11 1275 # 9base 1276 dmenu 1277 fluxbox 1278 font-arabic-misc 1279 font-cursor-misc 1280 # font-daewoo-misc 1281 font-dec-misc 1282 font-isas-misc 1283 font-jis-misc 1284 font-micro-misc 1285 font-misc-cyrillic 1286 font-misc-ethiopic 1287 # font-misc-meltho 1288 font-misc-misc 1289 font-mutt-misc 1290 font-noto 1291 font-schumacher-misc 1292 font-sony-misc 1293 font-sun-misc 1294 font-terminus-nerd 1295 # fontforge 1296 # fontforge-python3 1297 gvncviewer 1298 s6-networking 1299 htop 1300 i3lock{,-doc} 1301 i3wm{,-doc} 1302 mandoc 1303 man-pages 1304 multitail 1305 ncurses 1306 plan9port 1307 py3-cairo 1308 redshift 1309 rxvt-unicode 1310 rxvt-unicode-doc 1311 scrot 1312 setxkbmap 1313 nsxiv 1314 font-terminus 1315 tmux{,-doc} 1316 font-unifont 1317 vis 1318 # wmctrl 1319 xautolock{,-doc} 1320 xwininfo{,-doc} 1321 xprop{,-doc} 1322 xinput{,-doc} 1323 xpra{,-doc} 1324 xset{,-doc} 1325 xfontsel{,-doc} 1326 rofi{,-doc,-blocks} 1327 ) 1328 require site_container_alpine :containers_dir :svscan_dir \ 1329 image_name=alpine-xsession \ 1330 packages="$alpine_xsession" 1331 } 1332 1333 confz_site_containers_check() { 1334 defvar containers_dir /mnt/volumes/containers 1335 defvar svscan_dir /run/service 1336 require site_container_images :containers_dir :svscan_dir 1337 require site_container_services :containers_dir :svscan_dir 1338 } 1339 1340 confz_container_sysroot_rundir_check() { 1341 checkvars container_root container_name tmp_dir 1342 require fs_contentnl filename=$vars[tmp_dir]/run/init \ 1343 content=$'#!/bin/sh\nexec sleep 3600' 1344 require fs_m filename=$vars[tmp_dir]/run/init mode=755 1345 }