confz_site_containers_init (33678B)
1 #!zsh 2 # vim: ft=zsh noet ts=4 sts=4 sw=4 3 4 typeset -gA site_containers_mountpoints=( 5 init /home/ccx/bzr/container-user-init 6 ccx-bzr /home/ccx/bzr 7 ccx-dotfiles /home/ccx/bzr/container-dotfiles 8 ccx-scripts /home/ccx/bzr/container-scripts 9 ccx-password-store /home/ccx/bzr/password-store 10 ccx-development /home/ccx/development 11 ccx-baregit /home/ccx/baregit 12 #ccx-opt /home/ccx/opt 13 rcm-devops /mnt/volumes/containers/user/ccx/git/home/ccx/git/rcm-devops 14 # ccx-git /home/ccx/git 15 # ccx-git-recombee /home/ccx/git/recombee 16 ccx-task /home/ccx/task 17 pthbs /usr/src/pthbs 18 mrrl /usr/src/mrrl 19 audio /mnt/volumes/audio 20 video /mnt/volumes/video 21 photos /mnt/volumes/photos 22 versions /versions 23 mail-te2000.cz-ccx /home/ccx/mail/te2000.cz/ccx 24 mail-disroot.org-ccx /home/ccx/mail/disroot.org/ccx 25 mail-recombee.com-jan.pobrislo /home/ccx/mail/recombee.com/jan.pobrislo 26 ) 27 28 confz_site_containers_usersvc_simple_check() { 29 checkvars containers_dir svscan_dir user uid gid image_name 30 defvar container_name "$vars[image_name]" 31 defvar mount_ro "init ccx-dotfiles ccx-scripts" 32 defvar container_type generic 33 34 local userdir bindroot flags mtp src dst src_el dst_el 35 local -a fstab mnt_dirs_extra pid1_el_lines 36 userdir=$vars[containers_dir]/user/$vars[user] 37 bindroot=$userdir/$vars[container_name]/root 38 39 if (($+vars[mount_ro])); then 40 flags=$'\tnone\tbind,ro,nosuid,nodev\t0 0' 41 for mtp in ${=vars[mount_ro]}; do 42 src=$site_containers_mountpoints[$mtp] 43 dst=$bindroot/mnt/$mtp 44 mnt_dirs_extra+=( $mtp ) 45 fstab+=( $src$'\t'$dst$flags ) 46 src_el=\"${${src//\\/\\\\}//\"/\\\"}\" 47 dst_el=\"${${dst//\\/\\\\}//\"/\\\"}\" 48 pid1_el_lines+=( 49 "if { mkdir -p $dst_el }" 50 "if { s6-mount -r -o bind,nodev,nosuid $src_el $dst_el }" 51 "if { s6-mount -o remount,bind,ro,nodev,nosuid . $dst_el }" 52 ) 53 done 54 fi 55 if (($+vars[mount_rw])); then 56 flags=$'\tnone\tbind,rw,nosuid,nodev\t0 0' 57 for mtp in ${=vars[mount_rw]}; do 58 src=$site_containers_mountpoints[$mtp] 59 dst=$bindroot/mnt/$mtp 60 mnt_dirs_extra+=( $mtp ) 61 fstab+=( $src$'\t'$dst$flags ) 62 src_el=\"${${src//\\/\\\\}//\"/\\\"}\" 63 dst_el=\"${${dst//\\/\\\\}//\"/\\\"}\" 64 pid1_el_lines+=( 65 "if { mkdir -p $dst_el }" 66 "if { s6-mount -r -o bind,nodev,nosuid $src_el $dst_el }" 67 "if { s6-mount -o remount,bind,rw,nodev,nosuid . $dst_el }" 68 ) 69 done 70 fi 71 72 (($+vars[pid1_el])) && pid1_el_lines+=( $vars[pid1_el] ) 73 74 if (($#mnt_dirs_extra)); then 75 unify mnt_dirs_extra "$mnt_dirs_extra" 76 unify fstab_extra ${(F)fstab} 77 fi 78 79 require container_service_$vars[container_type] \ 80 :image_name :container_name :containers_dir :svscan_dir :user \ 81 \?mnt_dirs_extra \?fstab_extra \?prepare_chroot \?linux_caps \ 82 \?seccomp_profile \ 83 pid1_el=${(F)pid1_el_lines} 84 85 #local chome=$userdir/$vars[container_name]/home/$vars[user] 86 #if ! [[ -d $chome/run ]]; then 87 # require fs_l filename=$chome/run destination=/mnt/init 88 # require fs_o filename=$chome/run owner=$uid:$gid 89 #fi 90 } 91 92 confz_site_containers_xorg_check() { 93 checkvars containers_dir svscan_dir 94 defvar user xorg 95 local display container bind bindroot chome uid gid 96 local -a fstab 97 bind=$'\tnone\tbind,nosuid,nodev\t0 0' 98 uid="${${(s.:.)"$(getent passwd $vars[user])"}[3]}" \ 99 gid="${${(s.:.)"$(getent group $vars[user])"}[3]}" \ 100 101 for display in 5 6 7 8; do 102 container=X$display 103 require container_service_xorg \ 104 vtN=$display image_name=gentoo-xorg \ 105 :containers_dir :svscan_dir :user 106 done 107 } 108 109 confz_site_containers_user_single_check() { 110 checkvars containers_dir svscan_dir user container_name image_name 111 defvar mount_ro init 112 require container_uidgid_for_name name=$vars[user] %uid %gid 113 require site_containers_usersvc_simple \ 114 :containers_dir :svscan_dir :user :uid :gid \ 115 :container_name :image_name :mount_ro \?mount_rw \?linux_caps \ 116 \?seccomp_profile \ 117 \?prepare_chroot 118 } 119 120 # User Container 121 UC() { 122 local container image 123 container=$1 124 shift 125 image=${1:-$container} 126 (($#)) && shift 127 require site_containers_usersvc_simple \ 128 :containers_dir :svscan_dir :user :uid :gid \ 129 container_name=$container image_name=$image "$@" 130 } 131 132 SUC() { 133 local container image 134 container=$1 135 shift 136 image=${1:-$container} 137 (($#)) && shift 138 require site_containers_user_single :containers_dir :svscan_dir \ 139 user=$container container_name=$container image_name=$image "$@" 140 } 141 #typeset -f -t UC 142 143 UCa() { 144 local container=$1 145 shift 146 UC $container alpine-$container "$@" 147 } 148 149 SUCa() { 150 local container=$1 151 shift 152 SUC $container alpine-$container "$@" 153 } 154 155 UCv() { 156 local container=$1 157 shift 158 UC $container void-$container "$@" 159 } 160 161 confz_site_containers_user_check() { 162 checkvars containers_dir svscan_dir user 163 require container_uidgid_for_name name=$vars[user] %uid %gid 164 165 local ro="mount_ro=init ccx-dotfiles ccx-scripts" 166 167 local display 168 for display in 5 6 7 8; do 169 require container_service_xsession \ 170 display_number=$display image_name=alpine-xsession \ 171 :containers_dir :svscan_dir :user 172 done 173 174 local -a el_netns=( 175 'unshare -n # make new network namespace' 176 'if { ip addr add 127.0.0.1/8 dev lo }' 177 'if { ip addr add ::1/128 dev lo }' 178 'if { ip link set lo up }' 179 ) 180 local in_netns=pid1_el=${(F)el_netns} 181 182 local with_more_fds=pid1_el='zsh -c "ulimit -Hn 16384 && exec \"$@\"" --' 183 184 local -a el_mount_usb_devices=( 185 "#!$(which execlineb) -P" 186 'if { mount -o bind,ro /dev/bus/usb dev/bus/usb }' 187 'mount -t sysfs sysfs sys' 188 ) 189 local with_usb=prepare_chroot=${(F)el_mount_usb_devices} 190 191 local -a el_mount_audio_devices=( 192 "#!$(which execlineb) -P" 193 'if { mount -o bind,ro /dev/snd dev/snd }' 194 'mount -t sysfs sysfs sys' # maybe not necessary? 195 ) 196 local with_audio=prepare_chroot=${(F)el_mount_audio_devices} 197 198 local -a el_mount_ccx_opt=( 199 "#!$(which execlineb) -P" 200 'if { mount -o bind,ro /home/ccx/opt ./opt }' 201 ) 202 local with_opt=prepare_chroot=${(F)el_mount_ccx_opt} 203 204 UC alpine-browsers 205 UC pentoo 206 UCa weechat 207 UCa senpai 208 UCa profanity 209 UCa gomuks 210 UCa testssl 211 UCa tinyproxy 212 UCa tor 213 UCa syncthing 214 UCa mpv 215 UCa imgproc 216 UCa ghosttext $in_netns 217 UC rcm-jira alpine-ghosttext $in_netns seccomp_profile=ptrace 218 UC socks alpine-tinyproxy "$ro versions" 219 UC pypi-mirror alpine-httpd $in_netns 220 UCa ssh 221 UCa pass mount_rw="ccx-password-store" $in_netns 222 # seccomp profile for OpenSSH: KnownHostsCommand-ORDER: setresgid 1000: Operation not permitted 223 UC rcm-ssh alpine-ssh seccomp_profile=setuidgid "$ro rcm-devops versions" $with_more_fds 224 UCa socials $in_netns 225 UCa gpg $with_usb $in_netns 226 UCa notes $in_netns mount_rw=ccx-task 227 UCa gimp $in_netns 228 UCa ebook $in_netns 229 UCv telegram 230 UC mumble gentoo-mumble 231 UC gentoo-dev gentoo-dev 232 UCa qpdf 233 UCa poezio 234 UCa libervia 235 UCa signal 236 UCa bugwarrior mount_rw=ccx-task 237 UC signal2 alpine-signal 238 UC scrapbook alpine-pywebscrapbook $in_netns 239 UC ff-te2000-audio void-browsers 240 UC ff-rcm-audio void-browsers 241 UC ff-rcm-slack alpine-browsers 242 UC ff-blesmrt.net alpine-browsers 243 UC ff-syncthing alpine-browsers $in_netns 244 UC ff-rcm-google alpine-browsers $in_netns 245 UC ff-rcm-internal alpine-browsers $in_netns 246 UC ff-rcm-other alpine-browsers $in_netns 247 UC ff-recombee.1password.eu alpine-browsers $in_netns 248 UC ff-kosik.cz alpine-browsers $in_netns 249 UC ff-template alpine-browsers $in_netns 250 UC ff-te2000 alpine-browsers $in_netns 251 UC ff-webcomics alpine-browsers $in_netns 252 UC ff-csas.cz alpine-browsers $in_netns 253 UC ff-flife alpine-browsers $in_netns 254 UC ff-github.com alpine-browsers $in_netns 255 UC ff-sopuli.xyz alpine-browsers $in_netns 256 UC ff-kumi.tube alpine-browsers $in_netns 257 UC ff-diode.zone alpine-browsers $in_netns 258 UC ff-kosik.cz alpine-browsers $in_netns 259 UC ff-disroot.org alpine-browsers $in_netns 260 UC ff-codeberg.org alpine-browsers $in_netns 261 UC ff-wise.com alpine-browsers $in_netns 262 UC ff-pixelfed.de alpine-browsers $in_netns 263 UC ff-time4vps.com alpine-browsers $in_netns 264 UC ff-itch.io alpine-browsers $in_netns 265 UC ff-mobilizon.envs.net alpine-browsers $in_netns 266 UC ff-lulu.com alpine-browsers $in_netns 267 UC ff-norwegian.com alpine-browsers # $in_netns 268 UC ff-finnair.com alpine-browsers # $in_netns 269 UC gentoo-browsers gentoo-torbrowser $in_netns 270 UC gentoo-video gentoo-video $in_netns "$ro video" 271 UC syncplay gentoo-video "$ro video" 272 #UC twitch void-browsers 273 UCa aria2 mount_rw="video audio" 274 UC neonmodem alpine-go 275 UC iamb alpine-rust 276 UC simplex alpine-haskell 277 UC xpra gentoo-xorg container_type=ephemeral $in_netns seccomp_profile=xpra 278 UC bzr alpine-breezy mount_rw=ccx-bzr "$ro ccx-baregit" $in_netns 279 UC git alpine-git mount_rw=ccx-baregit $in_netns 280 UC sndiod alpine-sndio $with_audio $in_netns 281 UC mpd void-mpd "$ro init audio" 282 #UC {,}alpine-recombee 283 UC rcm-puppet alpine-puppet $in_netns 284 UC rcm-postgresql-dev alpine-postgresql-dev $in_netns seccomp_profile=ptrace 285 UC spark alpine-dev-spark mount_rw="ccx-bzr" seccomp_profile=ptrace 286 UC ssrn-master-dev alpine-postgresql-dev mount_rw="ccx-bzr" $in_netns seccomp_profile=ptrace 287 UC ssrn-monitor-dev alpine-postgresql-dev mount_rw="ccx-bzr" $in_netns seccomp_profile=ptrace 288 UC pthbs-dev alpine-pthbs-dev mount_rw="ccx-bzr" "$ro pthbs mrrl" $in_netns seccomp_profile=ptrace 289 UC ledum-dev alpine-pthbs-dev "$ro pthbs mrrl" $in_netns seccomp_profile=ptrace 290 UC pthbs-build mrrl-bindmount "$ro versions mrrl" $in_netns $with_more_fds seccomp_profile=build 291 UC gentoo-prefix-dev alpine-gentoo-dev $with_opt "$ro versions" seccomp_profile=ptrace 292 UC x11-dev gentoo-xorg mount_rw="ccx-bzr" $in_netns seccomp_profile=ptrace 293 UCa weechat-dev $in_netns seccomp_profile=ptrace 294 # -- mail 295 UCa mail-net mount_rw="mail-te2000.cz-ccx mail-disroot.org-ccx" 296 UC {rcm,alpine}-mail-net mount_rw="mail-recombee.com-jan.pobrislo" 297 UC mail alpine-mail-read mount_rw="mail-te2000.cz-ccx mail-disroot.org-ccx" $in_netns 298 UC rcm-mail alpine-mail-read mount_rw="mail-recombee.com-jan.pobrislo" $in_netns 299 300 } 301 302 confz_site_container_services_check() { 303 defvar containers_dir /mnt/volumes/containers 304 defvar svscan_dir /run/service 305 require site_containers_xorg user=xorg :containers_dir :svscan_dir 306 require site_containers_user user=ccx :containers_dir :svscan_dir 307 #require container_service_sysroot :containers_dir :svscan_dir \ 308 # image_name=alpine-dev 309 local -a el_rfkill_and_sys=( 310 "#!$(which execlineb) -P" 311 'importas -i GID GID' 312 'if { mknod -m 660 ./dev/rfkill c 10 242 }' 313 'if { chown 0:${GID} ./dev/rfkill }' 314 'mount -t sysfs sysfs sys' 315 ) 316 local -a el_net_tun=( 317 "#!$(which execlineb) -P" 318 'importas -i GID GID' 319 'if { mknod -m 660 ./dev/net/tun c 10 200 }' 320 'if { chown 0:${GID} ./dev/net/tun }' 321 ) 322 323 SUCa wpa_supplicant linux_caps='^CAP_NET_ADMIN,^CAP_NET_RAW' \ 324 prepare_chroot=${(F)el_rfkill_and_sys} 325 SUCa dhcpcd linux_caps='^CAP_NET_ADMIN,^CAP_NET_RAW,^CAP_NET_BIND_SERVICE' 326 SUCa unbound linux_caps='^CAP_NET_BIND_SERVICE' 327 SUCa tinc linux_caps='^CAP_NET_ADMIN' prepare_chroot=${(F)el_net_tun} 328 SUCa networking linux_caps='^CAP_NET_ADMIN,^CAP_NET_RAW' \ 329 prepare_chroot=${(F)el_rfkill_and_sys} 330 } 331 332 confz_site_container_alpine_check() { 333 checkvars containers_dir svscan_dir image_name packages 334 defvar arch x86_64 335 defvar repositories 'main community' # abduco lives in community 336 337 require container_alpine_image \ 338 :containers_dir :arch :image_name :repositories \?release 339 require container_alpine_packages_installed \ 340 :containers_dir :svscan_dir :image_name :packages 341 } 342 343 confz_site_container_void_musl_check() { 344 checkvars containers_dir svscan_dir image_name packages 345 defvar arch x86_64-musl 346 defvar repository current/musl 347 348 require container_void_image \ 349 :containers_dir :arch :repository :image_name 350 require container_void_packages_installed \ 351 :containers_dir :svscan_dir :image_name :packages 352 } 353 354 confz_site_container_void_glibc_check() { 355 checkvars containers_dir svscan_dir image_name packages 356 defvar arch x86_64 357 defvar repository current 358 359 require container_void_image \ 360 xbps_install_executable=xbps-install.static \ 361 :containers_dir :arch :repository :image_name 362 require container_void_packages_installed \ 363 :containers_dir :svscan_dir :image_name :packages 364 } 365 366 confz_site_container_void_glibc_nonfree_check() { 367 checkvars containers_dir svscan_dir image_name packages 368 defvar arch x86_64 369 defvar repository current 370 371 require container_void_image \ 372 xbps_install_executable=xbps-install.static \ 373 :containers_dir :arch :repository :image_name 374 require container_void_packages_installed \ 375 :containers_dir :svscan_dir :image_name packages=void-repo-nonfree 376 require container_void_packages_installed \ 377 :containers_dir :svscan_dir :image_name :packages 378 } 379 380 confz_site_container_gentoo_check() { 381 checkvars containers_dir svscan_dir image_name system 382 defvar system amd64-musl-hardened 383 384 require container_gentoo_from_snapshot \ 385 :containers_dir :system :image_name :svscan_dir 386 } 387 388 confz_site_container_nix_check() { 389 checkvars containers_dir svscan_dir image_name packages 390 defvar system x86_64-linux 391 defvar repository current/musl 392 393 require container_nix_image_from_release \ 394 :containers_dir :repository :image_name :svscan_dir :system 395 require container_nix_packages_installed \ 396 :containers_dir :svscan_dir :image_name :packages 397 require container_nix_bin_linked :containers_dir :image_name 398 } 399 400 confz_site_container_debian_puppetserver_check() { 401 checkvars containers_dir svscan_dir image_name 402 defvar arch amd64 403 defvar suite bullseye # Debian 11 404 defvar packages puppetserver 405 406 require container_debian_image \ 407 :containers_dir :image_name :svscan_dir :arch :suite \?root 408 require container_puppet_apt_repo \ 409 :containers_dir :image_name :svscan_dir :arch :suite 410 require container_debian_packages_installed_with_fakeroot \ 411 :containers_dir :svscan_dir :image_name :packages 412 } 413 414 confz_site_container_images_check() { 415 checkvars containers_dir svscan_dir 416 417 local -a gentoo_images_musl 418 gentoo_images_musl=( 419 xorg 420 video 421 torbrowser 422 mumble 423 dev 424 ) 425 426 local i 427 for i in $gentoo_images_musl; do 428 require site_container_gentoo :containers_dir :svscan_dir \ 429 system=amd64-musl-hardened image_name=gentoo-$i 430 done 431 432 require container_mrrl_image :containers_dir :svscan_dir \ 433 image_name=mrrl-bindmount 434 435 require site_container_gentoo :containers_dir :svscan_dir \ 436 system=amd64-nomultilib-openrc image_name=gentoo-dev-glibc 437 438 local -a alpine_core=( 439 s6 440 s6-{rc,linux-utils,portable-utils} 441 execline 442 ncurses-terminfo 443 zsh 444 tree 445 strace 446 musl-utils 447 ) 448 449 local -a alpine_community=( 450 $alpine_core 451 abduco 452 rxvt-unicode-terminfo 453 ) 454 455 local -a alpine_x11=( 456 $alpine_community 457 fontconfig 458 rxvt-unicode 459 nsxiv 460 font-terminus 461 font-unifont 462 #wmctrl 463 xauth 464 xbindkeys 465 xclip 466 xdotool 467 xdpyinfo 468 xev 469 xrandr 470 xrdb 471 ) 472 473 local -a alpine_terminal=( 474 $alpine_community 475 tmux 476 strace 477 vis 478 # mandoc 479 ) 480 481 local -a alpine_dev_core=( 482 $alpine_terminal 483 vim 484 ctags 485 ripgrep delta bat 486 git 487 git-lfs 488 tig 489 make 490 patch 491 rsync 492 strace 493 {skalibs,s6,execline}-{dev,static} 494 ) 495 496 local -a alpine_dev_py3=( 497 $alpine_dev_core 498 py3-setuptools 499 py3-pip 500 py3-pysocks # for proxy support in pip 501 py3-wheel 502 py3-pip-tools 503 breezy 504 py3-tzlocal # for breezy 505 py3-cffi # not strictly necessary but used by eg. taskwarrior/bugwarrior 506 s6-networking # for tunneling proxy through unix sockets 507 man-pages 508 man-pages-posix 509 mandoc 510 ctags-doc 511 ) 512 local -a alpine_dev_py3_gcc=( 513 $alpine_dev_py3 514 python3-dev 515 gcc 516 g++ 517 musl-dev 518 ncurses-dev 519 zlib-dev 520 openssl-dev 521 gmp-dev 522 libffi-dev 523 ) 524 local -a alpine_dev_py3_gdb=( 525 $alpine_dev_py3_gcc 526 curl{,-dev,-dbg} 527 musl-dbg 528 openssl-{dev,dbg} 529 readline-dev 530 sqlite{,-dev} 531 python3-dbg 532 gdb 533 perf 534 ) 535 536 537 require site_container_alpine :containers_dir :svscan_dir \ 538 image_name=alpine-sndio \ 539 packages="$alpine_community sndio alsa-utils strace tmux" 540 541 require site_container_alpine :containers_dir :svscan_dir \ 542 image_name=alpine-httpd \ 543 packages="$alpine_terminal s6-networking thttpd thttpd-doc tipidee tipidee-doc w3m" 544 545 require site_container_alpine :containers_dir :svscan_dir \ 546 image_name=alpine-tinyproxy \ 547 packages="$alpine_terminal s6-networking w3m tinyproxy" # tinyproxy-doc mandoc" 548 549 require site_container_alpine :containers_dir :svscan_dir \ 550 image_name=alpine-aria2 \ 551 packages="$alpine_terminal aria2 aria2-doc" 552 553 require site_container_alpine :containers_dir :svscan_dir \ 554 image_name=alpine-syncthing \ 555 packages="$alpine_community syncthing" 556 557 require site_container_alpine :containers_dir :svscan_dir \ 558 image_name=alpine-mpv \ 559 packages="$alpine_x11 mpv mpv-dbg strace gdb" 560 561 require site_container_alpine :containers_dir :svscan_dir \ 562 image_name=alpine-qpdf \ 563 packages="$alpine_x11 qpdf xpdf pdf4qt mupdf zathura zathura-pdf-poppler corepdf" 564 565 require site_container_alpine :containers_dir :svscan_dir \ 566 image_name=alpine-tor \ 567 packages="$alpine_community tor" 568 569 require site_container_alpine :containers_dir :svscan_dir \ 570 image_name=alpine-wpa_supplicant \ 571 packages="$alpine_community wpa_supplicant" 572 573 require site_container_alpine :containers_dir :svscan_dir \ 574 image_name=alpine-unbound \ 575 packages="$alpine_community unbound" 576 577 require site_container_alpine :containers_dir :svscan_dir \ 578 image_name=alpine-dhcpcd \ 579 packages="$alpine_community dhcpcd" 580 581 require site_container_alpine :containers_dir :svscan_dir \ 582 image_name=alpine-tinc \ 583 packages="$alpine_community tinc-pre" 584 585 local -a alpine_networking=( 586 $alpine_community 587 util-linux util-linux-misc # for rfkill 588 iproute2 589 dhcpcd 590 unbound ldns-tools drill 591 fping traceroute tcptraceroute 592 iptraf-ng 593 mtr 594 arping 595 bridge-utils 596 tshark 597 tcpdump 598 conntrack-tools 599 iptables 600 nftables 601 ethtool 602 macchanger 603 stunnel 604 socat 605 s6-networking 606 sslscan 607 ssldump 608 htop 609 gdb 610 iftop 611 ) 612 require site_container_alpine :containers_dir :svscan_dir \ 613 image_name=alpine-networking \ 614 packages="$alpine_networking" 615 616 require site_container_alpine :containers_dir :svscan_dir \ 617 image_name=alpine-go \ 618 packages="$alpine_dev_core go" 619 620 require site_container_alpine :containers_dir :svscan_dir \ 621 image_name=alpine-git \ 622 packages="$alpine_dev_core git-daemon s6-networking" 623 624 require site_container_alpine :containers_dir :svscan_dir \ 625 image_name=alpine-rust \ 626 packages="$alpine_dev_core rust cargo rustup" 627 628 require site_container_alpine :containers_dir :svscan_dir \ 629 image_name=alpine-gpg packages="$alpine_terminal gnupg gnupg-scdaemon pinentry-tty pinentry-curses-ss" 630 631 require site_container_alpine :containers_dir :svscan_dir \ 632 image_name=alpine-pass packages="$alpine_terminal gnupg pass pass-otp git" 633 634 require site_container_alpine :containers_dir :svscan_dir \ 635 image_name=alpine-ssh packages="$alpine_terminal openssh dropbear make rsync got" 636 637 local -a alpine_weechat=( 638 $alpine_terminal 639 weechat weechat-matrix weechat-python weechat-perl weechat-spell 640 aspell aspell-utils 641 git 642 perl-pod-parser # for multiline.pl 643 ) 644 require site_container_alpine :containers_dir :svscan_dir \ 645 image_name=alpine-weechat packages="$alpine_weechat" 646 647 local -a alpine_weechat_dev=( 648 $alpine_dev_py3_gdb 649 socat 650 weechat weechat-matrix weechat-python weechat-perl weechat-spell 651 weechat-dev 652 aspell aspell-utils 653 aspell-dev 654 cmake 655 ) 656 require site_container_alpine :containers_dir :svscan_dir \ 657 image_name=alpine-weechat-dev packages="$alpine_weechat_dev" 658 659 require site_container_alpine :containers_dir :svscan_dir \ 660 repositories="main community testing" \ 661 image_name=alpine-senpai \ 662 packages="$alpine_terminal senpai senpai-doc mandoc" 663 664 require site_container_alpine :containers_dir :svscan_dir \ 665 repositories="main community testing" \ 666 image_name=alpine-profanity packages="$alpine_terminal profanity" 667 668 require site_container_alpine :containers_dir :svscan_dir \ 669 repositories="main community testing" \ 670 image_name=alpine-gomuks packages="$alpine_terminal gomuks" 671 672 local -a alpine_haskell=( 673 # deps claimed by ghcup 674 binutils-gold curl gcc g++ gmp-dev libffi-dev make musl-dev ncurses-dev perl tar xz 675 # for verifying ghcup 676 gnupg gnupg-wks-client 677 # other 678 git zlib-dev openssl-dev 679 cabal 680 grep findutils ripgrep 681 ) 682 require site_container_alpine :containers_dir :svscan_dir \ 683 repositories="main community testing" \ 684 image_name=alpine-haskell \ 685 packages="$alpine_haskell" 686 687 local -a alpine_testssl=( 688 $alpine_terminal 689 bash 690 coreutils # (for dd) 691 procps-ng # (for ps) 692 git 693 make 694 patch 695 ldns-tools 696 drill 697 sfeed curl 698 openssl 699 gnutls-utils 700 ) 701 require site_container_alpine :containers_dir :svscan_dir \ 702 repositories="main community testing" \ 703 image_name=alpine-testssl packages="$alpine_testssl" 704 705 local -a alpine_mail_net=( 706 $alpine_terminal 707 make patch 708 mandoc 709 {mblaze,slrn,msmtp}{,-doc} 710 py3-{setuptools,pip,wheel} # Python 3 / venv 711 py3-{cryptography,urllib3,certifi,distro,python-gssapi} # offlineimap3 712 git git-doc # offlineimap3 source 713 ) 714 require site_container_alpine :containers_dir :svscan_dir \ 715 repositories="main community testing" \ 716 image_name=alpine-mail-net packages="$alpine_mail_net" 717 718 local -a alpine_mail_read=( 719 $alpine_terminal 720 make 721 mandoc 722 {neomutt,mblaze,notmuch,elinks,w3m,lynx,git,par}{,-doc} 723 py3-{setuptools,pip,wheel} # Python 3 / venv 724 py3-{notmuch,urwid{,trees},twisted,magic,gpgme} # alot 725 poppler-utils # pdftotext 726 ) 727 require site_container_alpine :containers_dir :svscan_dir \ 728 repositories="main community testing" \ 729 image_name=alpine-mail-read packages="$alpine_mail_read" 730 731 local -a alpine_dev_spark=( 732 $alpine_dev_py3 733 postgresql14 734 py3-psycopg2 735 openssh 736 rsync 737 ) 738 require site_container_alpine :containers_dir :svscan_dir \ 739 repositories="main community" \ 740 image_name=alpine-dev-spark \ 741 packages="$alpine_dev_spark" 742 743 require site_container_alpine :containers_dir :svscan_dir \ 744 repositories="main community" \ 745 image_name=alpine-breezy \ 746 packages="$alpine_dev_py3" 747 748 require site_container_alpine :containers_dir :svscan_dir \ 749 repositories="main community" \ 750 image_name=alpine-bugwarrior \ 751 packages="$alpine_dev_py3 task" 752 753 require site_container_alpine :containers_dir :svscan_dir \ 754 repositories="main community" \ 755 image_name=alpine-notes \ 756 packages="$alpine_dev_py3 broot task neovim py3-pynvim py3-six w3m" 757 758 local -a alpine_dev_pthbs=( 759 $alpine_dev_py3 760 broot 761 vim 762 neovim 763 py3-jinja2 764 py3-yaml 765 wget 766 gcc 767 g++ pkgconf 768 htop 769 skalibs-dev 770 s6-dev 771 execline-dev 772 linux-headers 773 libcap-static 774 libcap-dev 775 socat 776 curl 777 gdb 778 ncdu 779 swi-prolog 780 gpg 781 ) 782 require site_container_alpine :containers_dir :svscan_dir \ 783 repositories="main community testing" \ 784 image_name=alpine-pthbs-dev \ 785 packages="$alpine_dev_pthbs" 786 787 require site_container_alpine :containers_dir :svscan_dir \ 788 repositories="main community" \ 789 image_name=alpine-pywebscrapbook \ 790 packages="$alpine_dev_py3 py3-pynvim" 791 792 require site_container_alpine :containers_dir :svscan_dir \ 793 repositories="main community" \ 794 image_name=alpine-ebook \ 795 packages="$alpine_dev_py3 py3-pynvim ebook-tools epy" 796 797 local -a alpine_poezio=( 798 $alpine_dev_py3_gcc 799 py3-{cryptography,asn1,asn1-modules,aiodns,pycares,typing-extensions} 800 py3-sphinx 801 cmake 802 ) 803 require site_container_alpine :containers_dir :svscan_dir \ 804 repositories="main community" \ 805 image_name=alpine-poezio \ 806 packages="$alpine_poezio" 807 808 local -a alpine_libervia=( 809 $alpine_dev_py3_gcc 810 py3-{cryptography,asn1,asn1-modules,aiodns,pycares,typing-extensions} 811 py3-{alembic,twisted,gobject3,lxml,lxml-html-clean,dbus,babel,pillow} 812 py3-{openssl,sqlalchemy,cairo,cairo-dev,libxml2,netifaces} 813 # Mercurial 814 mercurial mercurial-zsh-completion 815 # libcairo 2 with development header 816 cairo{,-dev,-dbg} 817 # libjpeg with development headers 818 libjpeg 819 libjpeg-turbo{,-dev} 820 # libgirepository 1.0 with development headers 821 # libdbus-1 with development headers 822 dbus{,-dev} 823 # libdbus-glib-1 with development headers 824 dbus-glib{,-dev} 825 # libxml2 with development headers 826 libxml2{,-dev,-dbg} 827 # libxlt2 with development headers 828 # D-Bus x11 tools (this doesn’t needs X11, it is just needed for dbus-launch) 829 cmake 830 libsodium{,-dev} 831 ) 832 require site_container_alpine :containers_dir :svscan_dir \ 833 repositories="main community" \ 834 image_name=alpine-libervia \ 835 packages="$alpine_libervia" 836 837 local -a alpine_imgproc=( 838 $alpine_dev_py3_gcc 839 python3-dev 840 py3-{matplotlib,numpy{,-dev},pillow,pyarrow} 841 tesseract-ocr 842 tesseract-ocr-data-{ces,eng,fin,pol,rus,ukr,osd} 843 cmake 844 swig 845 blas 846 openblas{,-dev} 847 gflags{,-dev} 848 ) 849 require site_container_alpine :containers_dir :svscan_dir \ 850 repositories="main community" \ 851 image_name=alpine-imgproc \ 852 packages="$alpine_imgproc" 853 854 require site_container_alpine :containers_dir :svscan_dir \ 855 repositories="main community" \ 856 image_name=alpine-gimp \ 857 packages="$alpine_x11 gimp" 858 859 require site_container_alpine :containers_dir :svscan_dir \ 860 repositories="main testing community" \ 861 image_name=alpine-signal \ 862 packages="$alpine_x11 signal-desktop" 863 864 local -a alpine_browsers=( 865 $alpine_x11 866 firefox 867 font-noto 868 #lxappearance 869 mupdf 870 mupdf-x11 871 7zip 872 qutebrowser 873 rsync 874 vimb 875 #visurf 876 w3m 877 privoxy # can use upstream SOCKS proxy 878 s6-networking 879 execline 880 coreutils # cat -s in ff-mkprofile 881 # py3-pynvim neovim # neovim + bindings for https://github.com/fregante/GhostText 882 # git # for nvim plugins 883 # py3-pip py3-wheel # for vim-ghost autoinstall procedure 884 ) 885 require site_container_alpine :containers_dir :svscan_dir \ 886 image_name=alpine-browsers packages="$alpine_browsers" 887 888 require site_container_alpine :containers_dir :svscan_dir \ 889 image_name=alpine-ghosttext \ 890 packages="$alpine_dev_py3 py3-pynvim neovim neovim-doc pandoc-cli pandoc-cli-doc w3m lynx elinks" 891 892 local -a alpine_socials=( 893 $alpine_x11 894 firefox 895 font-noto 896 #lxappearance 897 7zip 898 rsync 899 coreutils # cat -s in ff-mkprofile 900 py3-pynvim neovim # neovim + bindings for https://github.com/fregante/GhostText 901 git # for nvim plugins 902 py3-pip py3-wheel # for vim-ghost autoinstall procedure 903 py3-{setuptools,pip,wheel} # Python 3 / venv 904 py3-{cryptography,urllib3,certifi,distro,python-gssapi} # offlineimap3 905 git-lfs 906 zsh-vcs 907 vim vis 908 tmux 909 htop 910 openssh 911 make 912 patch 913 ripgrep bat delta 914 colordiff 915 tree broot 916 gnupg pass 917 sfeed sfeed-doc lynx elinks w3m curl # alternative RSS/ATOM processor 918 musl-utils # for getent 919 notmuch mblaze notmuch-doc mblaze-doc notmuch-vim 920 socat 921 gawk 922 mksh 923 openssl 924 s6-networking 925 ) 926 require site_container_alpine :containers_dir :svscan_dir \ 927 repositories="main community testing" \ 928 image_name=alpine-socials packages="$alpine_socials" 929 930 local -a alpine_office=( 931 $alpine_x11 932 font-noto 933 #lxappearance 934 mupdf 935 mupdf-x11 936 7zip 937 catdoc 938 abiword 939 gnumeric 940 libreoffice 941 ) 942 # require site_container_alpine :containers_dir :svscan_dir \ 943 # repositories="main community testing" \ 944 # image_name=alpine-office packages="$alpine_office" 945 946 local -a alpine_dev_postgresql=( 947 $alpine_dev_py3_gdb 948 git 949 git-daemon 950 git-doc 951 zsh-vcs 952 vim 953 ctags 954 htop 955 colordiff 956 tree broot 957 strace gdb 958 postgresql16{-jit,-contrib,-contrib-jit,-doc,-dev,-plpython3} 959 postgresql17{-jit,-contrib,-contrib-jit,-doc,-dev,-plpython3} 960 postgresql-{pgvector,timescaledb,plpgsql_check} 961 musl-dev 962 ncurses-dev 963 readline-dev 964 openssl-dev 965 py3-psycopg2 966 py3-pytest 967 py3-hypothesis 968 bison flex 969 libpq-dev libecpg-dev icu-dev lz4-dev zstd-dev 970 util-linux-dev zlib-dev 971 linux-headers 972 pg_top 973 pg_activity 974 ) 975 require site_container_alpine :containers_dir :svscan_dir \ 976 image_name=alpine-postgresql-dev packages="$alpine_dev_postgresql" 977 978 local -a alpine_dev_gentoo=( 979 $alpine_dev_py3 980 bash 981 wget 982 git 983 git-daemon 984 git-doc 985 zsh-vcs 986 vim 987 ctags 988 htop 989 colordiff 990 tree broot 991 strace gdb 992 musl-dev 993 ncurses-dev 994 openssl-dev 995 gcc 996 g++ 997 binutils 998 alpine-release 999 lsb-release-minimal 1000 linux-headers 1001 gettext{,-dev} 1002 automake 1003 autoconf 1004 tar 1005 findutils 1006 coreutils 1007 util-linux 1008 mksh 1009 bmake 1010 nawk 1011 ) 1012 #require site_container_alpine :containers_dir :svscan_dir \ 1013 # image_name=alpine-gentoo-dev packages="$alpine_dev_gentoo" 1014 1015 local -a alpine_puppet=( 1016 $alpine_terminal 1017 # from alpine_dev_core 1018 vim 1019 ctags 1020 ripgrep bat 1021 delta 1022 git 1023 git-lfs 1024 make 1025 patch 1026 rsync 1027 strace 1028 {skalibs,s6,execline}-{dev,static} 1029 s6-networking 1030 # added 1031 man-pages 1032 # man-pages-posix ## missing 1033 mandoc 1034 zsh-vcs 1035 htop 1036 ruby-full ruby-bundler # for puppet 1037 # ruby-json # missing 1038 colordiff 1039 # jq 1040 file 1041 gawk 1042 # openssl 1043 ruby-dev 1044 gcc 1045 g++ 1046 musl-dev 1047 ncurses-dev 1048 zlib-dev 1049 openssl-dev 1050 gmp-dev 1051 libffi-dev 1052 ) 1053 # I see /opt/puppetlabs/puppet/bin/ruby --version 1054 # => ruby 3.1.2p20 (2022-04-12 revision 4491bb740a) [x86_64-linux-gnu] 1055 # The newest alpine with ruby 3.1.x is v3.17 with 3.1.5-r0 1056 # (was v3.17 with 2.7.6p219 previously) 1057 require site_container_alpine :containers_dir :svscan_dir \ 1058 release=v3.17 image_name=alpine-puppet packages="$alpine_puppet" 1059 1060 local -a alpine_recombee=( 1061 $alpine_community 1062 # man-db 1063 man-pages # man-pages-posix 1064 git 1065 git-lfs 1066 git-daemon 1067 git-doc 1068 zsh-vcs 1069 vim vis 1070 tmux 1071 htop 1072 openssh 1073 python3 ipython py3-pip py3-wheel 1074 python3-dev libffi{,-dev} # for compiling cffi 1075 py3-cffi py3-cryptography py3-pynacl 1076 ruby ruby-bundler ruby-json # for puppet 1077 ruby-bigdecimal ruby-rdoc # for gitlab 1078 make 1079 patch 1080 ripgrep bat # delta 1081 colordiff 1082 jq 1083 weechat weechat-python py3-websocket-client # for wee-slack 1084 weechat-spell aspell aspell-utils 1085 py3-feedparser # for weemustfeed.py 1086 rsync 1087 tree # broot 1088 gnupg pass 1089 go # for DC/OS CLI 1090 file 1091 strace gdb 1092 task py3-cffi # for taskwarrior/bugwarrior 1093 sfeed sfeed-doc lynx elinks w3m curl # alternative RSS/ATOM processor 1094 drill ldns-tools # for drill 1095 musl-utils # for getent 1096 notmuch mblaze notmuch-doc mblaze-doc notmuch-vim 1097 py3-notmuch py3-gpgme # for alot 1098 ncurses-dev # for building sfeed from source 1099 socat 1100 gawk 1101 # postgresql-dev # for developing pg_cgroup 1102 mksh 1103 dpkg dpkg-dev 1104 fuse3-dev pcre2-dev # for tup 1105 openssl 1106 ctags 1107 jsonnet 1108 yq 1109 ) 1110 #require site_container_alpine :containers_dir :svscan_dir \ 1111 # release=v3.13 image_name=alpine-recombee packages="$alpine_recombee" 1112 1113 local -a void_core=( 1114 abduco 1115 s6 1116 s6-{rc,linux-utils,portable-utils} 1117 execline 1118 ncurses-base 1119 rxvt-unicode-terminfo 1120 zsh 1121 coreutils 1122 which 1123 grep 1124 gawk 1125 sed 1126 findutils 1127 strace 1128 htop 1129 procps-ng 1130 vis 1131 ) 1132 local -a void_x11=( 1133 $void_core 1134 xauth 1135 xdg-utils 1136 wmctrl 1137 xdotool 1138 xclip 1139 file # for xdg-open 1140 rxvt-unicode 1141 # xorg-fonts 1142 font-misc-misc 1143 dejavu-fonts-ttf 1144 terminus-font 1145 ) 1146 1147 require site_container_void_musl :containers_dir :svscan_dir \ 1148 image_name=void-mpd packages="$void_core sndio sox mpd mpc ncmpcpp" 1149 1150 require site_container_void_musl :containers_dir :svscan_dir \ 1151 image_name=void-telegram packages="$void_x11 sndio sox telegram-desktop nsxiv" 1152 # TODO: packages="p7zip" fails despite being installed 1153 1154 require site_container_void_musl :containers_dir :svscan_dir \ 1155 image_name=void-browsers packages="$void_x11 sndio sox firefox" 1156 1157 require site_container_void_musl :containers_dir :svscan_dir \ 1158 image_name=void-mumble packages="$void_x11 sndio sox mumble" 1159 1160 require site_container_void_glibc :containers_dir :svscan_dir \ 1161 image_name=void-signal \ 1162 packages="$void_x11 htop xdg-utils mesa-demos Signal-Desktop" 1163 1164 # require site_container_void_glibc_nonfree :containers_dir :svscan_dir \ 1165 # image_name=void-games \ 1166 # packages="$void_core dwarffortress adom" 1167 1168 local -a nix_core=( 1169 s6 1170 s6-{rc,linux-utils,portable-utils} 1171 execline 1172 # ncurses # version stripping doesn't work for this ATM 1173 zsh 1174 abduco 1175 rxvt-unicode 1176 ) 1177 1178 # require site_container_nix :containers_dir :svscan_dir \ 1179 # image_name=nix-signal packages="$nix_core signal-desktop" 1180 1181 #require site_container_debian_puppetserver :containers_dir :svscan_dir \ 1182 # image_name=rcm-puppetserver 1183 1184 local -a alpine_xsession=( 1185 $alpine_x11 1186 # 9base 1187 dmenu 1188 fluxbox 1189 font-arabic-misc 1190 font-cursor-misc 1191 # font-daewoo-misc 1192 font-dec-misc 1193 font-isas-misc 1194 font-jis-misc 1195 font-micro-misc 1196 font-misc-cyrillic 1197 font-misc-ethiopic 1198 # font-misc-meltho 1199 font-misc-misc 1200 font-mutt-misc 1201 font-noto 1202 font-schumacher-misc 1203 font-sony-misc 1204 font-sun-misc 1205 font-terminus-nerd 1206 # fontforge 1207 # fontforge-python3 1208 gvncviewer 1209 s6-networking 1210 htop 1211 i3lock{,-doc} 1212 i3wm{,-doc} 1213 mandoc 1214 man-pages 1215 multitail 1216 ncurses 1217 plan9port 1218 py3-cairo 1219 redshift 1220 rxvt-unicode 1221 rxvt-unicode-doc 1222 scrot 1223 setxkbmap 1224 nsxiv 1225 font-terminus 1226 tmux{,-doc} 1227 font-unifont 1228 vis 1229 # wmctrl 1230 xautolock{,-doc} 1231 xwininfo{,-doc} 1232 xprop{,-doc} 1233 xinput{,-doc} 1234 xpra{,-doc} 1235 xset{,-doc} 1236 xfontsel{,-doc} 1237 rofi{,-doc} 1238 ) 1239 require site_container_alpine :containers_dir :svscan_dir \ 1240 image_name=alpine-xsession \ 1241 packages="$alpine_xsession" 1242 } 1243 1244 confz_site_containers_check() { 1245 defvar containers_dir /mnt/volumes/containers 1246 defvar svscan_dir /run/service 1247 require site_container_images :containers_dir :svscan_dir 1248 require site_container_services :containers_dir :svscan_dir 1249 } 1250 1251 confz_container_sysroot_rundir_check() { 1252 checkvars container_root container_name tmp_dir 1253 require fs_contentnl filename=$vars[tmp_dir]/run/init \ 1254 content=$'#!/bin/sh\nexec sleep 3600' 1255 require fs_m filename=$vars[tmp_dir]/run/init mode=755 1256 }