confz_site_containers_init (35249B)
1 #!zsh 2 # vim: ft=zsh noet ts=4 sts=4 sw=4 3 4 typeset -gA site_containers_mountpoints=( 5 init /home/ccx/bzr/container-user-init 6 ccx-bzr /home/ccx/bzr 7 ccx-dotfiles /home/ccx/bzr/container-dotfiles 8 ccx-scripts /home/ccx/bzr/container-scripts 9 ccx-password-store /home/ccx/bzr/password-store 10 ccx-development /home/ccx/development 11 ccx-baregit /home/ccx/baregit 12 #ccx-opt /home/ccx/opt 13 rcm-devops /mnt/volumes/containers/user/ccx/git/home/ccx/git/rcm-devops 14 # ccx-git /home/ccx/git 15 # ccx-git-recombee /home/ccx/git/recombee 16 ccx-task /home/ccx/task 17 pthbs /usr/src/pthbs 18 mrrl /usr/src/mrrl 19 audio /mnt/volumes/audio 20 video /mnt/volumes/video 21 photos /mnt/volumes/photos 22 versions /versions 23 mail-te2000.cz-ccx /home/ccx/mail/te2000.cz/ccx 24 mail-disroot.org-ccx /home/ccx/mail/disroot.org/ccx 25 mail-recombee.com-jan.pobrislo /home/ccx/mail/recombee.com/jan.pobrislo 26 ) 27 28 confz_site_containers_usersvc_simple_check() { 29 checkvars containers_dir svscan_dir user uid gid image_name 30 defvar container_name "$vars[image_name]" 31 defvar mount_ro "init ccx-dotfiles ccx-scripts" 32 defvar container_type generic 33 34 local userdir bindroot flags mtp src dst src_el dst_el 35 local -a fstab mnt_dirs_extra pid1_el_lines 36 userdir=$vars[containers_dir]/user/$vars[user] 37 bindroot=$userdir/$vars[container_name]/root 38 39 if (($+vars[mount_ro])); then 40 flags=$'\tnone\tbind,ro,nosuid,nodev\t0 0' 41 for mtp in ${=vars[mount_ro]}; do 42 src=$site_containers_mountpoints[$mtp] 43 dst=$bindroot/mnt/$mtp 44 mnt_dirs_extra+=( $mtp ) 45 fstab+=( $src$'\t'$dst$flags ) 46 src_el=\"${${src//\\/\\\\}//\"/\\\"}\" 47 dst_el=\"${${dst//\\/\\\\}//\"/\\\"}\" 48 pid1_el_lines+=( 49 "if { mkdir -p $dst_el }" 50 "if { s6-mount -r -o bind,nodev,nosuid $src_el $dst_el }" 51 "if { s6-mount -o remount,bind,ro,nodev,nosuid . $dst_el }" 52 ) 53 done 54 fi 55 if (($+vars[mount_rw])); then 56 flags=$'\tnone\tbind,rw,nosuid,nodev\t0 0' 57 for mtp in ${=vars[mount_rw]}; do 58 src=$site_containers_mountpoints[$mtp] 59 dst=$bindroot/mnt/$mtp 60 mnt_dirs_extra+=( $mtp ) 61 fstab+=( $src$'\t'$dst$flags ) 62 src_el=\"${${src//\\/\\\\}//\"/\\\"}\" 63 dst_el=\"${${dst//\\/\\\\}//\"/\\\"}\" 64 pid1_el_lines+=( 65 "if { mkdir -p $dst_el }" 66 "if { s6-mount -r -o bind,nodev,nosuid $src_el $dst_el }" 67 "if { s6-mount -o remount,bind,rw,nodev,nosuid . $dst_el }" 68 ) 69 done 70 fi 71 72 (($+vars[pid1_el])) && pid1_el_lines+=( $vars[pid1_el] ) 73 74 if (($#mnt_dirs_extra)); then 75 unify mnt_dirs_extra "$mnt_dirs_extra" 76 unify fstab_extra ${(F)fstab} 77 fi 78 79 require container_service_$vars[container_type] \ 80 :image_name :container_name :containers_dir :svscan_dir :user \ 81 \?mnt_dirs_extra \?fstab_extra \?prepare_chroot \?linux_caps \ 82 \?seccomp_profile \?display_number \ 83 pid1_el=${(F)pid1_el_lines} 84 85 #local chome=$userdir/$vars[container_name]/home/$vars[user] 86 #if ! [[ -d $chome/run ]]; then 87 # require fs_l filename=$chome/run destination=/mnt/init 88 # require fs_o filename=$chome/run owner=$uid:$gid 89 #fi 90 } 91 92 confz_site_containers_xorg_check() { 93 checkvars containers_dir svscan_dir 94 defvar user xorg 95 local display container bind bindroot chome uid gid 96 local -a fstab 97 bind=$'\tnone\tbind,nosuid,nodev\t0 0' 98 uid="${${(s.:.)"$(getent passwd $vars[user])"}[3]}" \ 99 gid="${${(s.:.)"$(getent group $vars[user])"}[3]}" \ 100 101 for display in 5 6 7 8; do 102 container=X$display 103 require container_service_xorg \ 104 vtN=$display image_name=gentoo-xorg \ 105 :containers_dir :svscan_dir :user 106 done 107 } 108 109 confz_site_containers_user_single_check() { 110 checkvars containers_dir svscan_dir user container_name image_name 111 defvar mount_ro init 112 require container_uidgid_for_name name=$vars[user] %uid %gid 113 require site_containers_usersvc_simple \ 114 :containers_dir :svscan_dir :user :uid :gid \ 115 :container_name :image_name :mount_ro \?mount_rw \?linux_caps \ 116 \?seccomp_profile \ 117 \?prepare_chroot 118 } 119 120 # User Container 121 UC() { 122 local container image 123 container=$1 124 shift 125 image=${1:-$container} 126 (($#)) && shift 127 require site_containers_usersvc_simple \ 128 :containers_dir :svscan_dir :user :uid :gid \ 129 container_name=$container image_name=$image "$@" 130 } 131 132 SUC() { 133 local container image 134 container=$1 135 shift 136 image=${1:-$container} 137 (($#)) && shift 138 require site_containers_user_single :containers_dir :svscan_dir \ 139 user=$container container_name=$container image_name=$image "$@" 140 } 141 #typeset -f -t UC 142 143 UCa() { 144 local container=$1 145 shift 146 UC $container alpine-$container "$@" 147 } 148 149 SUCa() { 150 local container=$1 151 shift 152 SUC $container alpine-$container "$@" 153 } 154 155 UCv() { 156 local container=$1 157 shift 158 UC $container void-$container "$@" 159 } 160 161 confz_site_containers_user_check() { 162 checkvars containers_dir svscan_dir user 163 require container_uidgid_for_name name=$vars[user] %uid %gid 164 165 local ro="mount_ro=init ccx-dotfiles ccx-scripts" 166 167 local -a el_netns=( 168 'unshare -n # make new network namespace' 169 'if { ip addr add 127.0.0.1/8 dev lo }' 170 'if { ip addr add ::1/128 dev lo }' 171 'if { ip link set lo up }' 172 ) 173 local in_netns=pid1_el=${(F)el_netns} 174 175 local with_more_fds=pid1_el='zsh -c "ulimit -Hn 16384 && exec \"$@\"" --' 176 177 local -a el_mount_usb_devices=( 178 "#!$(which execlineb) -P" 179 'if { mount -o bind,ro /dev/bus/usb dev/bus/usb }' 180 'mount -t sysfs sysfs sys' 181 ) 182 local with_usb=prepare_chroot=${(F)el_mount_usb_devices} 183 184 local -a el_mount_audio_devices=( 185 "#!$(which execlineb) -P" 186 'if { mount -o bind,ro /dev/snd dev/snd }' 187 'mount -t sysfs sysfs sys' # maybe not necessary? 188 ) 189 local with_audio=prepare_chroot=${(F)el_mount_audio_devices} 190 191 local -a el_mount_ccx_opt=( 192 "#!$(which execlineb) -P" 193 'if { mount -o bind,ro /home/ccx/opt ./opt }' 194 ) 195 local with_opt=prepare_chroot=${(F)el_mount_ccx_opt} 196 197 local display 198 for display in 5 6 7 8; do 199 UC xsession.$display alpine-xsession \ 200 container_type=xsession \ 201 display_number=$display \ 202 :containers_dir :svscan_dir :user 203 done 204 205 UC alpine-browsers 206 UC pentoo 207 UCa weechat 208 UCa senpai 209 UCa profanity 210 UCa gomuks 211 UCa testssl 212 UCa tinyproxy 213 UCa tor 214 UCa syncthing 215 UCa mpv 216 UCa imgproc 217 UCa ghosttext $in_netns 218 UC rcm-jira alpine-ghosttext $in_netns seccomp_profile=ptrace 219 UC socks alpine-tinyproxy "$ro versions" 220 UC pypi-mirror alpine-httpd $in_netns 221 UCa ssh 222 UCa pass mount_rw="ccx-password-store" $in_netns 223 # seccomp profile for OpenSSH: KnownHostsCommand-ORDER: setresgid 1000: Operation not permitted 224 UC rcm-ssh alpine-ssh seccomp_profile=setuidgid "$ro rcm-devops versions" $with_more_fds 225 UCa socials $in_netns 226 UCa gpg $with_usb $in_netns 227 UCa notes $in_netns mount_rw=ccx-task 228 UCa gimp $in_netns 229 UCa ebook $in_netns 230 UCv telegram 231 UC mumble gentoo-mumble 232 UC gentoo-dev gentoo-dev 233 UCa pdf 234 UCa poezio 235 UCa libervia 236 UCa signal 237 UCa bugwarrior mount_rw=ccx-task 238 UC signal2 alpine-signal 239 UC scrapbook alpine-pywebscrapbook $in_netns 240 UC ff-artemislena-audio void-browsers 241 UC ff-te2000-audio void-browsers 242 UC ff-rcm-audio void-browsers 243 UC ff-hanka-audio void-browsers 244 UC ff-rcm-slack alpine-browsers 245 UC ff-blesmrt.net alpine-browsers 246 UC ff-syncthing alpine-browsers $in_netns 247 UC ff-rcm-google alpine-browsers $in_netns 248 UC ff-rcm-internal alpine-browsers $in_netns 249 UC ff-rcm-other alpine-browsers $in_netns 250 UC ff-recombee.1password.eu alpine-browsers $in_netns 251 UC ff-kosik.cz alpine-browsers $in_netns 252 UC ff-template alpine-browsers $in_netns 253 UC ff-te2000 alpine-browsers $in_netns 254 UC ff-te2000-google alpine-browsers $in_netns 255 UC ff-webcomics alpine-browsers $in_netns 256 UC ff-csas.cz alpine-browsers $in_netns 257 UC ff-flife alpine-browsers $in_netns 258 UC ff-github.com alpine-browsers $in_netns 259 UC ff-sopuli.xyz alpine-browsers $in_netns 260 UC ff-kumi.tube alpine-browsers $in_netns 261 UC ff-diode.zone alpine-browsers $in_netns 262 UC ff-kosik.cz alpine-browsers $in_netns 263 UC ff-disroot.org alpine-browsers $in_netns 264 UC ff-codeberg.org alpine-browsers $in_netns 265 UC ff-wise.com alpine-browsers $in_netns 266 UC ff-pixelfed.de alpine-browsers $in_netns 267 UC ff-time4vps.com alpine-browsers $in_netns 268 UC ff-itch.io alpine-browsers $in_netns 269 UC ff-mobilizon.envs.net alpine-browsers $in_netns 270 UC ff-lulu.com alpine-browsers $in_netns 271 UC ff-mojemana.cz alpine-browsers $in_netns 272 UC ff-norwegian.com alpine-browsers # $in_netns 273 UC ff-finnair.com alpine-browsers # $in_netns 274 UC gentoo-browsers gentoo-torbrowser $in_netns 275 UC gentoo-video gentoo-video $in_netns "$ro video" 276 UC syncplay gentoo-video "$ro video" 277 #UC twitch void-browsers 278 UCa aria2 mount_rw="video audio" 279 UC neonmodem alpine-go 280 UC iamb alpine-rust 281 UC simplex alpine-haskell 282 UC xpra gentoo-xorg container_type=ephemeral $in_netns seccomp_profile=xpra 283 UC bzr alpine-breezy mount_rw=ccx-bzr "$ro ccx-baregit" $in_netns 284 UC git alpine-git mount_rw=ccx-baregit $in_netns 285 UC sndiod alpine-sndio $with_audio $in_netns 286 UC mpd void-mpd "$ro init audio" 287 UC doom void-doom $in_netns seccomp_profile=ptrace 288 #UC {,}alpine-recombee 289 UC rcm-puppet alpine-puppet $in_netns 290 UC rcm-postgresql-dev alpine-postgresql-dev $in_netns seccomp_profile=ptrace 291 UC spark alpine-dev-spark mount_rw="ccx-bzr" seccomp_profile=ptrace 292 UC ssrn-master-dev alpine-postgresql-dev mount_rw="ccx-bzr" $in_netns seccomp_profile=ptrace 293 UC ssrn-monitor-dev alpine-postgresql-dev mount_rw="ccx-bzr" $in_netns seccomp_profile=ptrace 294 UC pthbs-dev alpine-pthbs-dev mount_rw="ccx-bzr" "$ro pthbs mrrl" $in_netns seccomp_profile=ptrace 295 UC ledum-dev alpine-pthbs-dev "$ro pthbs mrrl" $in_netns seccomp_profile=ptrace 296 UC pthbs-build mrrl-bindmount "$ro versions mrrl" $in_netns $with_more_fds seccomp_profile=build 297 UC gentoo-prefix-dev alpine-gentoo-dev $with_opt "$ro versions" seccomp_profile=ptrace 298 UC x11-dev gentoo-xorg mount_rw="ccx-bzr" $in_netns seccomp_profile=ptrace 299 UCa weechat-dev $in_netns seccomp_profile=ptrace 300 UCa ocaml-dev $in_netns seccomp_profile=ptrace 301 # -- mail 302 UCa mail-net mount_rw="mail-te2000.cz-ccx mail-disroot.org-ccx" 303 UC {rcm,alpine}-mail-net mount_rw="mail-recombee.com-jan.pobrislo" 304 UC mail alpine-mail-read mount_rw="mail-te2000.cz-ccx mail-disroot.org-ccx" $in_netns 305 UC rcm-mail alpine-mail-read mount_rw="mail-recombee.com-jan.pobrislo" $in_netns 306 307 } 308 309 confz_site_container_services_check() { 310 defvar containers_dir /mnt/volumes/containers 311 defvar svscan_dir /run/service 312 require site_containers_xorg user=xorg :containers_dir :svscan_dir 313 require site_containers_user user=ccx :containers_dir :svscan_dir 314 #require container_service_sysroot :containers_dir :svscan_dir \ 315 # image_name=alpine-dev 316 local -a el_rfkill_and_sys=( 317 "#!$(which execlineb) -P" 318 'importas -i GID GID' 319 'if { mknod -m 660 ./dev/rfkill c 10 242 }' 320 'if { chown 0:${GID} ./dev/rfkill }' 321 'mount -t sysfs sysfs sys' 322 ) 323 local -a el_net_tun=( 324 "#!$(which execlineb) -P" 325 'importas -i GID GID' 326 'if { mknod -m 660 ./dev/net/tun c 10 200 }' 327 'if { chown 0:${GID} ./dev/net/tun }' 328 ) 329 330 SUCa wpa_supplicant linux_caps='^CAP_NET_ADMIN,^CAP_NET_RAW' \ 331 prepare_chroot=${(F)el_rfkill_and_sys} 332 SUCa dhcpcd linux_caps='^CAP_NET_ADMIN,^CAP_NET_RAW,^CAP_NET_BIND_SERVICE' 333 SUCa unbound linux_caps='^CAP_NET_BIND_SERVICE' 334 SUCa tinc linux_caps='^CAP_NET_ADMIN' prepare_chroot=${(F)el_net_tun} 335 SUCa networking linux_caps='^CAP_NET_ADMIN,^CAP_NET_RAW' \ 336 prepare_chroot=${(F)el_rfkill_and_sys} 337 } 338 339 confz_site_container_alpine_check() { 340 checkvars containers_dir svscan_dir image_name packages 341 defvar arch x86_64 342 defvar repositories 'main community' # abduco lives in community 343 344 require container_alpine_image \ 345 :containers_dir :arch :image_name :repositories \?release 346 require container_alpine_packages_installed \ 347 :containers_dir :svscan_dir :image_name :packages 348 } 349 350 confz_site_container_void_musl_check() { 351 checkvars containers_dir svscan_dir image_name packages 352 defvar arch x86_64-musl 353 defvar repository current/musl 354 355 require container_void_image \ 356 :containers_dir :arch :repository :image_name 357 require container_void_packages_installed \ 358 :containers_dir :svscan_dir :image_name :packages 359 } 360 361 confz_site_container_void_glibc_check() { 362 checkvars containers_dir svscan_dir image_name packages 363 defvar arch x86_64 364 defvar repository current 365 366 require container_void_image \ 367 xbps_install_executable=xbps-install.static \ 368 :containers_dir :arch :repository :image_name 369 require container_void_packages_installed \ 370 :containers_dir :svscan_dir :image_name :packages 371 } 372 373 confz_site_container_void_glibc_nonfree_check() { 374 checkvars containers_dir svscan_dir image_name packages 375 defvar arch x86_64 376 defvar repository current 377 378 require container_void_image \ 379 xbps_install_executable=xbps-install.static \ 380 :containers_dir :arch :repository :image_name 381 require container_void_packages_installed \ 382 :containers_dir :svscan_dir :image_name packages=void-repo-nonfree 383 require container_void_packages_installed \ 384 :containers_dir :svscan_dir :image_name :packages 385 } 386 387 confz_site_container_gentoo_check() { 388 checkvars containers_dir svscan_dir image_name system 389 defvar system amd64-musl-hardened 390 391 require container_gentoo_from_snapshot \ 392 :containers_dir :system :image_name :svscan_dir 393 } 394 395 confz_site_container_nix_check() { 396 checkvars containers_dir svscan_dir image_name packages 397 defvar system x86_64-linux 398 defvar repository current/musl 399 400 require container_nix_image_from_release \ 401 :containers_dir :repository :image_name :svscan_dir :system 402 require container_nix_packages_installed \ 403 :containers_dir :svscan_dir :image_name :packages 404 require container_nix_bin_linked :containers_dir :image_name 405 } 406 407 confz_site_container_debian_puppetserver_check() { 408 checkvars containers_dir svscan_dir image_name 409 defvar arch amd64 410 defvar suite bullseye # Debian 11 411 defvar packages puppetserver 412 413 require container_debian_image \ 414 :containers_dir :image_name :svscan_dir :arch :suite \?root 415 require container_puppet_apt_repo \ 416 :containers_dir :image_name :svscan_dir :arch :suite 417 require container_debian_packages_installed_with_fakeroot \ 418 :containers_dir :svscan_dir :image_name :packages 419 } 420 421 confz_site_container_images_check() { 422 checkvars containers_dir svscan_dir 423 424 local -a gentoo_images_musl 425 gentoo_images_musl=( 426 xorg 427 video 428 torbrowser 429 mumble 430 dev 431 ) 432 433 local i 434 for i in $gentoo_images_musl; do 435 require site_container_gentoo :containers_dir :svscan_dir \ 436 system=amd64-musl-hardened image_name=gentoo-$i 437 done 438 439 require container_mrrl_image :containers_dir :svscan_dir \ 440 image_name=mrrl-bindmount 441 442 require site_container_gentoo :containers_dir :svscan_dir \ 443 system=amd64-nomultilib-openrc image_name=gentoo-dev-glibc 444 445 local -a alpine_core=( 446 s6 447 s6-{rc,linux-utils,portable-utils} 448 execline 449 ncurses-terminfo 450 zsh 451 tree 452 strace 453 musl-utils 454 ) 455 456 local -a alpine_community=( 457 $alpine_core 458 abduco 459 rxvt-unicode-terminfo 460 ) 461 462 local -a alpine_x11=( 463 $alpine_community 464 fontconfig 465 rxvt-unicode 466 nsxiv 467 font-terminus 468 font-unifont 469 #wmctrl 470 xauth 471 xbindkeys 472 xclip 473 xdotool 474 xdpyinfo 475 xev 476 xrandr 477 xrdb 478 ) 479 480 local -a alpine_terminal=( 481 $alpine_community 482 tmux 483 strace 484 vis 485 # mandoc 486 ) 487 488 local -a alpine_dev_core=( 489 $alpine_terminal 490 vim 491 ctags 492 ripgrep delta bat 493 git 494 git-lfs 495 tig 496 make 497 patch 498 rsync 499 strace 500 {skalibs,s6,execline}-{dev,static} 501 ) 502 503 local -a alpine_dev_py3=( 504 $alpine_dev_core 505 py3-setuptools 506 py3-pip 507 py3-pysocks # for proxy support in pip 508 py3-wheel 509 py3-pip-tools 510 breezy 511 py3-tzlocal # for breezy 512 py3-cffi # not strictly necessary but used by eg. taskwarrior/bugwarrior 513 s6-networking # for tunneling proxy through unix sockets 514 man-pages 515 man-pages-posix 516 mandoc 517 ctags-doc 518 ) 519 local -a alpine_dev_py3_gcc=( 520 $alpine_dev_py3 521 python3-dev 522 gcc 523 g++ 524 musl-dev 525 ncurses-dev 526 zlib-dev 527 openssl-dev 528 gmp-dev 529 libffi-dev 530 ) 531 local -a alpine_dev_py3_gdb=( 532 $alpine_dev_py3_gcc 533 curl{,-dev,-dbg} 534 musl-dbg 535 openssl-{dev,dbg} 536 readline-dev 537 sqlite{,-dev} 538 python3-dbg 539 gdb 540 perf 541 ) 542 543 local -a alpine_dev_ocaml=( 544 $alpine_dev_core 545 s6-networking # for tunneling proxy through unix sockets 546 man-pages 547 man-pages-posix 548 mandoc 549 ctags-doc 550 python3-dev 551 gcc 552 g++ 553 musl-dev 554 ncurses-dev 555 zlib-dev 556 openssl-dev 557 gmp-dev 558 libffi-dev 559 # ocaml{,-doc} # ocaml-4.x 560 # ocamlbuild{,-doc} 561 opam{,-doc} 562 dune{,-doc} 563 ocaml5{,-doc,-ocamldoc,-compiler-libs} 564 ) 565 566 require site_container_alpine :containers_dir :svscan_dir \ 567 image_name=alpine-ocaml-dev packages="$alpine_dev_ocaml" 568 569 require site_container_alpine :containers_dir :svscan_dir \ 570 image_name=alpine-sndio \ 571 packages="$alpine_community sndio alsa-utils strace tmux" 572 573 require site_container_alpine :containers_dir :svscan_dir \ 574 image_name=alpine-httpd \ 575 packages="$alpine_terminal s6-networking thttpd thttpd-doc tipidee tipidee-doc w3m" 576 577 require site_container_alpine :containers_dir :svscan_dir \ 578 image_name=alpine-tinyproxy \ 579 packages="$alpine_terminal s6-networking w3m tinyproxy" # tinyproxy-doc mandoc" 580 581 require site_container_alpine :containers_dir :svscan_dir \ 582 image_name=alpine-aria2 \ 583 packages="$alpine_terminal aria2 aria2-doc" 584 585 require site_container_alpine :containers_dir :svscan_dir \ 586 image_name=alpine-syncthing \ 587 packages="$alpine_community syncthing ncdu" 588 589 require site_container_alpine :containers_dir :svscan_dir \ 590 image_name=alpine-mpv \ 591 packages="$alpine_x11 mpv mpv-dbg strace gdb" 592 593 local -a alpine_pdf=( 594 $alpine_x11 595 qpdf 596 xpdf 597 pdf4qt 598 mupdf 599 zathura zathura-pdf-poppler 600 corepdf 601 ghostscript ghostscript-doc 602 poppler-utils poppler-doc 603 mandoc 604 tmux 605 vis 606 ) 607 require site_container_alpine :containers_dir :svscan_dir \ 608 image_name=alpine-pdf \ 609 packages="$alpine_pdf" 610 611 require site_container_alpine :containers_dir :svscan_dir \ 612 image_name=alpine-tor \ 613 packages="$alpine_community tor" 614 615 require site_container_alpine :containers_dir :svscan_dir \ 616 image_name=alpine-wpa_supplicant \ 617 packages="$alpine_community wpa_supplicant" 618 619 require site_container_alpine :containers_dir :svscan_dir \ 620 image_name=alpine-unbound \ 621 packages="$alpine_community unbound" 622 623 require site_container_alpine :containers_dir :svscan_dir \ 624 image_name=alpine-dhcpcd \ 625 packages="$alpine_community dhcpcd" 626 627 require site_container_alpine :containers_dir :svscan_dir \ 628 image_name=alpine-tinc \ 629 packages="$alpine_community tinc-pre" 630 631 local -a alpine_networking=( 632 $alpine_community 633 util-linux util-linux-misc # for rfkill 634 iproute2 635 dhcpcd 636 unbound ldns-tools drill 637 fping traceroute tcptraceroute 638 iptraf-ng 639 mtr 640 arping 641 bridge-utils 642 tshark 643 tcpdump 644 conntrack-tools 645 iptables 646 nftables 647 ethtool 648 macchanger 649 stunnel 650 socat 651 s6-networking 652 sslscan 653 ssldump 654 htop 655 gdb 656 iftop 657 ) 658 require site_container_alpine :containers_dir :svscan_dir \ 659 image_name=alpine-networking \ 660 packages="$alpine_networking" 661 662 require site_container_alpine :containers_dir :svscan_dir \ 663 image_name=alpine-go \ 664 packages="$alpine_dev_core go" 665 666 require site_container_alpine :containers_dir :svscan_dir \ 667 image_name=alpine-git \ 668 packages="$alpine_dev_core git-daemon s6-networking" 669 670 require site_container_alpine :containers_dir :svscan_dir \ 671 image_name=alpine-rust \ 672 packages="$alpine_dev_core rust cargo rustup" 673 674 require site_container_alpine :containers_dir :svscan_dir \ 675 image_name=alpine-gpg packages="$alpine_terminal gnupg gnupg-scdaemon pinentry-tty pinentry-curses-ss" 676 677 require site_container_alpine :containers_dir :svscan_dir \ 678 image_name=alpine-pass packages="$alpine_terminal gnupg pass pass-otp git" 679 680 require site_container_alpine :containers_dir :svscan_dir \ 681 image_name=alpine-ssh packages="$alpine_terminal openssh dropbear make rsync got" 682 683 local -a alpine_weechat=( 684 $alpine_terminal 685 weechat weechat-matrix weechat-python weechat-perl weechat-spell 686 aspell aspell-utils 687 git 688 perl-pod-parser # for multiline.pl 689 ) 690 require site_container_alpine :containers_dir :svscan_dir \ 691 image_name=alpine-weechat packages="$alpine_weechat" 692 693 local -a alpine_weechat_dev=( 694 $alpine_dev_py3_gdb 695 socat 696 weechat weechat-matrix weechat-python weechat-perl weechat-spell 697 weechat-dev 698 aspell aspell-utils 699 aspell-dev 700 cmake 701 ) 702 require site_container_alpine :containers_dir :svscan_dir \ 703 image_name=alpine-weechat-dev packages="$alpine_weechat_dev" 704 705 require site_container_alpine :containers_dir :svscan_dir \ 706 repositories="main community testing" \ 707 image_name=alpine-senpai \ 708 packages="$alpine_terminal senpai senpai-doc mandoc" 709 710 require site_container_alpine :containers_dir :svscan_dir \ 711 repositories="main community testing" \ 712 image_name=alpine-profanity packages="$alpine_terminal profanity" 713 714 require site_container_alpine :containers_dir :svscan_dir \ 715 repositories="main community testing" \ 716 image_name=alpine-gomuks packages="$alpine_terminal gomuks" 717 718 local -a alpine_haskell=( 719 # deps claimed by ghcup 720 binutils-gold curl gcc g++ gmp-dev libffi-dev make musl-dev ncurses-dev perl tar xz 721 # for verifying ghcup 722 gnupg gnupg-wks-client 723 # other 724 git zlib-dev openssl-dev 725 cabal 726 grep findutils ripgrep 727 ) 728 require site_container_alpine :containers_dir :svscan_dir \ 729 repositories="main community testing" \ 730 image_name=alpine-haskell \ 731 packages="$alpine_haskell" 732 733 local -a alpine_testssl=( 734 $alpine_terminal 735 bash 736 coreutils # (for dd) 737 procps-ng # (for ps) 738 git 739 make 740 patch 741 ldns-tools 742 drill 743 sfeed curl 744 openssl 745 gnutls-utils 746 ) 747 require site_container_alpine :containers_dir :svscan_dir \ 748 repositories="main community testing" \ 749 image_name=alpine-testssl packages="$alpine_testssl" 750 751 local -a alpine_mail_net=( 752 $alpine_terminal 753 make patch 754 mandoc 755 {mblaze,slrn,msmtp}{,-doc} 756 py3-{setuptools,pip,wheel} # Python 3 / venv 757 py3-{cryptography,urllib3,certifi,distro,python-gssapi} # offlineimap3 758 git git-doc # offlineimap3 source 759 ) 760 require site_container_alpine :containers_dir :svscan_dir \ 761 repositories="main community testing" \ 762 image_name=alpine-mail-net packages="$alpine_mail_net" 763 764 local -a alpine_mail_read=( 765 $alpine_terminal 766 make 767 mandoc 768 {neomutt,mblaze,notmuch,elinks,w3m,lynx,git,par}{,-doc} 769 py3-{setuptools,pip,wheel} # Python 3 / venv 770 py3-{notmuch,urwid{,trees},twisted,magic,gpgme} # alot 771 poppler-utils poppler-doc # pdftotext 772 catdoc{,-doc} # .doc/.xls 773 gnumeric{,-doc} font-noto # ssconvert 774 ) 775 require site_container_alpine :containers_dir :svscan_dir \ 776 repositories="main community testing" \ 777 image_name=alpine-mail-read packages="$alpine_mail_read" 778 779 local -a alpine_dev_spark=( 780 $alpine_dev_py3 781 postgresql14 782 py3-psycopg2 783 openssh 784 rsync 785 ) 786 require site_container_alpine :containers_dir :svscan_dir \ 787 repositories="main community" \ 788 image_name=alpine-dev-spark \ 789 packages="$alpine_dev_spark" 790 791 require site_container_alpine :containers_dir :svscan_dir \ 792 repositories="main community" \ 793 image_name=alpine-breezy \ 794 packages="$alpine_dev_py3" 795 796 require site_container_alpine :containers_dir :svscan_dir \ 797 repositories="main community" \ 798 image_name=alpine-bugwarrior \ 799 packages="$alpine_dev_py3 task" 800 801 require site_container_alpine :containers_dir :svscan_dir \ 802 repositories="main community testing" \ 803 image_name=alpine-notes \ 804 packages="$alpine_dev_py3 broot task neovim py3-pynvim py3-six w3m par gawk" 805 806 local -a alpine_dev_pthbs=( 807 $alpine_dev_py3_gcc 808 broot 809 vim 810 neovim 811 py3-jinja2 812 py3-yaml 813 wget 814 pkgconf 815 htop 816 skalibs-dev 817 s6-dev 818 execline-dev 819 linux-headers 820 libcap-static 821 libcap-dev 822 socat 823 curl 824 gdb 825 ncdu 826 swi-prolog 827 gpg 828 ) 829 require site_container_alpine :containers_dir :svscan_dir \ 830 repositories="main community testing" \ 831 image_name=alpine-pthbs-dev \ 832 packages="$alpine_dev_pthbs" 833 834 require site_container_alpine :containers_dir :svscan_dir \ 835 repositories="main community" \ 836 image_name=alpine-pywebscrapbook \ 837 packages="$alpine_dev_py3 py3-pynvim" 838 839 require site_container_alpine :containers_dir :svscan_dir \ 840 repositories="main community" \ 841 image_name=alpine-ebook \ 842 packages="$alpine_dev_py3 py3-pynvim ebook-tools epy" 843 844 local -a alpine_poezio=( 845 $alpine_dev_py3_gcc 846 py3-{cryptography,asn1,asn1-modules,aiodns,pycares,typing-extensions} 847 py3-sphinx 848 cmake 849 ) 850 require site_container_alpine :containers_dir :svscan_dir \ 851 repositories="main community" \ 852 image_name=alpine-poezio \ 853 packages="$alpine_poezio" 854 855 local -a alpine_libervia=( 856 $alpine_dev_py3_gcc 857 py3-{cryptography,asn1,asn1-modules,aiodns,pycares,typing-extensions} 858 py3-{alembic,twisted,gobject3,lxml,lxml-html-clean,dbus,babel,pillow} 859 py3-{openssl,sqlalchemy,cairo,cairo-dev,libxml2,netifaces} 860 # Mercurial 861 mercurial mercurial-zsh-completion 862 # libcairo 2 with development header 863 cairo{,-dev,-dbg} 864 # libjpeg with development headers 865 libjpeg 866 libjpeg-turbo{,-dev} 867 # libgirepository 1.0 with development headers 868 # libdbus-1 with development headers 869 dbus{,-dev} 870 # libdbus-glib-1 with development headers 871 dbus-glib{,-dev} 872 # libxml2 with development headers 873 libxml2{,-dev,-dbg} 874 # libxlt2 with development headers 875 # D-Bus x11 tools (this doesn’t needs X11, it is just needed for dbus-launch) 876 cmake 877 libsodium{,-dev} 878 ) 879 require site_container_alpine :containers_dir :svscan_dir \ 880 repositories="main community" \ 881 image_name=alpine-libervia \ 882 packages="$alpine_libervia" 883 884 local -a alpine_imgproc=( 885 $alpine_dev_py3_gcc 886 python3-dev 887 py3-{matplotlib,numpy{,-dev},pillow,pyarrow} 888 tesseract-ocr 889 tesseract-ocr-data-{ces,eng,fin,pol,rus,ukr,osd} 890 cmake 891 swig 892 blas 893 openblas{,-dev} 894 gflags{,-dev} 895 graphicsmagick 896 poppler-utils 897 ) 898 require site_container_alpine :containers_dir :svscan_dir \ 899 repositories="main community" \ 900 image_name=alpine-imgproc \ 901 packages="$alpine_imgproc" 902 903 require site_container_alpine :containers_dir :svscan_dir \ 904 repositories="main community" \ 905 image_name=alpine-gimp \ 906 packages="$alpine_x11 gimp" 907 908 require site_container_alpine :containers_dir :svscan_dir \ 909 repositories="main testing community" \ 910 image_name=alpine-signal \ 911 packages="$alpine_x11 signal-desktop" 912 913 local -a alpine_browsers=( 914 $alpine_x11 915 firefox 916 font-noto 917 #lxappearance 918 mupdf 919 mupdf-x11 920 7zip 921 qutebrowser 922 rsync 923 vimb 924 #visurf 925 w3m 926 privoxy # can use upstream SOCKS proxy 927 s6-networking 928 execline 929 coreutils # cat -s in ff-mkprofile 930 yad # Yet Another Dialog, fork of Zenity 931 # py3-pynvim neovim # neovim + bindings for https://github.com/fregante/GhostText 932 # git # for nvim plugins 933 # py3-pip py3-wheel # for vim-ghost autoinstall procedure 934 ) 935 require site_container_alpine :containers_dir :svscan_dir \ 936 image_name=alpine-browsers packages="$alpine_browsers" 937 938 require site_container_alpine :containers_dir :svscan_dir \ 939 image_name=alpine-ghosttext \ 940 packages="$alpine_dev_py3 py3-pynvim neovim neovim-doc pandoc-cli pandoc-cli-doc w3m lynx elinks" 941 942 local -a alpine_socials=( 943 $alpine_x11 944 firefox 945 font-noto 946 #lxappearance 947 7zip 948 rsync 949 coreutils # cat -s in ff-mkprofile 950 py3-pynvim neovim # neovim + bindings for https://github.com/fregante/GhostText 951 git # for nvim plugins 952 py3-pip py3-wheel # for vim-ghost autoinstall procedure 953 py3-{setuptools,pip,wheel} # Python 3 / venv 954 py3-{cryptography,urllib3,certifi,distro,python-gssapi} # offlineimap3 955 git-lfs 956 zsh-vcs 957 vim vis 958 tmux 959 htop 960 openssh 961 make 962 patch 963 ripgrep bat delta 964 colordiff 965 tree broot 966 gnupg pass 967 sfeed sfeed-doc lynx elinks w3m curl # alternative RSS/ATOM processor 968 musl-utils # for getent 969 notmuch mblaze notmuch-doc mblaze-doc notmuch-vim 970 socat 971 gawk 972 mksh 973 openssl 974 s6-networking 975 ) 976 require site_container_alpine :containers_dir :svscan_dir \ 977 repositories="main community testing" \ 978 image_name=alpine-socials packages="$alpine_socials" 979 980 local -a alpine_office=( 981 $alpine_x11 982 font-noto 983 #lxappearance 984 mupdf 985 mupdf-x11 986 7zip 987 catdoc 988 abiword 989 gnumeric 990 libreoffice 991 ) 992 # require site_container_alpine :containers_dir :svscan_dir \ 993 # repositories="main community testing" \ 994 # image_name=alpine-office packages="$alpine_office" 995 996 local -a alpine_dev_postgresql=( 997 $alpine_dev_py3_gdb 998 git 999 git-daemon 1000 git-doc 1001 zsh-vcs 1002 vim 1003 ctags 1004 htop 1005 colordiff 1006 tree broot 1007 strace gdb 1008 postgresql16{-jit,-contrib,-contrib-jit,-doc,-dev,-plpython3} 1009 postgresql17{-jit,-contrib,-contrib-jit,-doc,-dev,-plpython3} 1010 postgresql-{pgvector,timescaledb,plpgsql_check} 1011 musl-dev 1012 ncurses-dev 1013 readline-dev 1014 openssl-dev 1015 py3-psycopg2 1016 py3-pytest 1017 py3-hypothesis 1018 bison flex 1019 libpq-dev libecpg-dev icu-dev lz4-dev zstd-dev 1020 util-linux-dev zlib-dev 1021 linux-headers 1022 pg_top 1023 pg_activity 1024 ) 1025 alpine_dev_postgresql+=( # timescaledb build deps 1026 bash 1027 cmake 1028 # 'openssl-dev>3' 1029 openssl-dev 1030 perl-ipc-run 1031 perl-utils 1032 # postgresql 1033 # postgresql-dev 1034 samurai 1035 ) 1036 require site_container_alpine :containers_dir :svscan_dir \ 1037 image_name=alpine-postgresql-dev packages="$alpine_dev_postgresql" 1038 1039 local -a alpine_dev_gentoo=( 1040 $alpine_dev_py3 1041 bash 1042 wget 1043 git 1044 git-daemon 1045 git-doc 1046 zsh-vcs 1047 vim 1048 ctags 1049 htop 1050 colordiff 1051 tree broot 1052 strace gdb 1053 musl-dev 1054 ncurses-dev 1055 openssl-dev 1056 gcc 1057 g++ 1058 binutils 1059 alpine-release 1060 lsb-release-minimal 1061 linux-headers 1062 gettext{,-dev} 1063 automake 1064 autoconf 1065 tar 1066 findutils 1067 coreutils 1068 util-linux 1069 mksh 1070 bmake 1071 nawk 1072 ) 1073 #require site_container_alpine :containers_dir :svscan_dir \ 1074 # image_name=alpine-gentoo-dev packages="$alpine_dev_gentoo" 1075 1076 local -a alpine_puppet=( 1077 $alpine_terminal 1078 # from alpine_dev_core 1079 vim 1080 ctags 1081 ripgrep bat 1082 delta 1083 git 1084 git-lfs 1085 make 1086 patch 1087 rsync 1088 strace 1089 {skalibs,s6,execline}-{dev,static} 1090 s6-networking 1091 # added 1092 man-pages 1093 # man-pages-posix ## missing 1094 mandoc 1095 zsh-vcs 1096 htop 1097 ruby-full ruby-bundler # for puppet 1098 # ruby-json # missing 1099 colordiff 1100 # jq 1101 file 1102 gawk 1103 # openssl 1104 ruby-dev 1105 gcc 1106 g++ 1107 musl-dev 1108 ncurses-dev 1109 zlib-dev 1110 openssl-dev 1111 gmp-dev 1112 libffi-dev 1113 ) 1114 # I see /opt/puppetlabs/puppet/bin/ruby --version 1115 # => ruby 3.1.2p20 (2022-04-12 revision 4491bb740a) [x86_64-linux-gnu] 1116 # The newest alpine with ruby 3.1.x is v3.17 with 3.1.5-r0 1117 # (was v3.17 with 2.7.6p219 previously) 1118 require site_container_alpine :containers_dir :svscan_dir \ 1119 release=v3.17 image_name=alpine-puppet packages="$alpine_puppet" 1120 1121 local -a alpine_recombee=( 1122 $alpine_community 1123 # man-db 1124 man-pages # man-pages-posix 1125 git 1126 git-lfs 1127 git-daemon 1128 git-doc 1129 zsh-vcs 1130 vim vis 1131 tmux 1132 htop 1133 openssh 1134 python3 ipython py3-pip py3-wheel 1135 python3-dev libffi{,-dev} # for compiling cffi 1136 py3-cffi py3-cryptography py3-pynacl 1137 ruby ruby-bundler ruby-json # for puppet 1138 ruby-bigdecimal ruby-rdoc # for gitlab 1139 make 1140 patch 1141 ripgrep bat # delta 1142 colordiff 1143 jq 1144 weechat weechat-python py3-websocket-client # for wee-slack 1145 weechat-spell aspell aspell-utils 1146 py3-feedparser # for weemustfeed.py 1147 rsync 1148 tree # broot 1149 gnupg pass 1150 go # for DC/OS CLI 1151 file 1152 strace gdb 1153 task py3-cffi # for taskwarrior/bugwarrior 1154 sfeed sfeed-doc lynx elinks w3m curl # alternative RSS/ATOM processor 1155 drill ldns-tools # for drill 1156 musl-utils # for getent 1157 notmuch mblaze notmuch-doc mblaze-doc notmuch-vim 1158 py3-notmuch py3-gpgme # for alot 1159 ncurses-dev # for building sfeed from source 1160 socat 1161 gawk 1162 # postgresql-dev # for developing pg_cgroup 1163 mksh 1164 dpkg dpkg-dev 1165 fuse3-dev pcre2-dev # for tup 1166 openssl 1167 ctags 1168 jsonnet 1169 yq 1170 ) 1171 #require site_container_alpine :containers_dir :svscan_dir \ 1172 # release=v3.13 image_name=alpine-recombee packages="$alpine_recombee" 1173 1174 local -a void_core=( 1175 abduco 1176 s6 1177 s6-{rc,linux-utils,portable-utils} 1178 execline 1179 ncurses-base 1180 rxvt-unicode-terminfo 1181 zsh 1182 coreutils 1183 which 1184 grep 1185 gawk 1186 sed 1187 findutils 1188 strace 1189 htop 1190 procps-ng 1191 vis 1192 ) 1193 local -a void_x11=( 1194 $void_core 1195 xauth 1196 xdg-utils 1197 wmctrl 1198 xdotool 1199 xclip 1200 file # for xdg-open 1201 rxvt-unicode 1202 # xorg-fonts 1203 font-misc-misc 1204 dejavu-fonts-ttf 1205 terminus-font 1206 ) 1207 1208 require site_container_void_musl :containers_dir :svscan_dir \ 1209 image_name=void-mpd packages="$void_core sndio sox mpd mpc ncmpcpp" 1210 1211 require site_container_void_musl :containers_dir :svscan_dir \ 1212 image_name=void-telegram packages="$void_x11 sndio sox telegram-desktop nsxiv" 1213 # TODO: packages="p7zip" fails despite being installed 1214 1215 require site_container_void_musl :containers_dir :svscan_dir \ 1216 image_name=void-browsers packages="$void_x11 sndio sox firefox yad" 1217 1218 require site_container_void_musl :containers_dir :svscan_dir \ 1219 image_name=void-mumble packages="$void_x11 sndio sox mumble" 1220 1221 local -a void_doom=( 1222 $void_x11 1223 sndio sox 1224 git 1225 tmux 1226 wget 1227 curl 1228 w3m 1229 # p7zip 1230 nsxiv 1231 SLADE 1232 deutex 1233 crispy-doom 1234 gzdoom 1235 glxinfo 1236 ) 1237 require site_container_void_musl :containers_dir :svscan_dir \ 1238 image_name=void-doom packages="$void_doom" 1239 1240 require site_container_void_glibc :containers_dir :svscan_dir \ 1241 image_name=void-signal \ 1242 packages="$void_x11 htop xdg-utils mesa-demos Signal-Desktop" 1243 1244 # require site_container_void_glibc_nonfree :containers_dir :svscan_dir \ 1245 # image_name=void-games \ 1246 # packages="$void_core dwarffortress adom" 1247 1248 local -a nix_core=( 1249 s6 1250 s6-{rc,linux-utils,portable-utils} 1251 execline 1252 # ncurses # version stripping doesn't work for this ATM 1253 zsh 1254 abduco 1255 rxvt-unicode 1256 ) 1257 1258 # require site_container_nix :containers_dir :svscan_dir \ 1259 # image_name=nix-signal packages="$nix_core signal-desktop" 1260 1261 #require site_container_debian_puppetserver :containers_dir :svscan_dir \ 1262 # image_name=rcm-puppetserver 1263 1264 local -a alpine_xsession=( 1265 $alpine_x11 1266 # 9base 1267 dmenu 1268 fluxbox 1269 font-arabic-misc 1270 font-cursor-misc 1271 # font-daewoo-misc 1272 font-dec-misc 1273 font-isas-misc 1274 font-jis-misc 1275 font-micro-misc 1276 font-misc-cyrillic 1277 font-misc-ethiopic 1278 # font-misc-meltho 1279 font-misc-misc 1280 font-mutt-misc 1281 font-noto 1282 font-schumacher-misc 1283 font-sony-misc 1284 font-sun-misc 1285 font-terminus-nerd 1286 # fontforge 1287 # fontforge-python3 1288 gvncviewer 1289 s6-networking 1290 htop 1291 i3lock{,-doc} 1292 i3wm{,-doc} 1293 mandoc 1294 man-pages 1295 multitail 1296 ncurses 1297 plan9port 1298 py3-cairo 1299 redshift 1300 rxvt-unicode 1301 rxvt-unicode-doc 1302 scrot 1303 setxkbmap 1304 nsxiv 1305 font-terminus 1306 tmux{,-doc} 1307 font-unifont 1308 vis 1309 # wmctrl 1310 xautolock{,-doc} 1311 xwininfo{,-doc} 1312 xprop{,-doc} 1313 xinput{,-doc} 1314 xpra{,-doc} 1315 xset{,-doc} 1316 xfontsel{,-doc} 1317 rofi{,-doc,-blocks} 1318 ) 1319 require site_container_alpine :containers_dir :svscan_dir \ 1320 image_name=alpine-xsession \ 1321 packages="$alpine_xsession" 1322 } 1323 1324 confz_site_containers_check() { 1325 defvar containers_dir /mnt/volumes/containers 1326 defvar svscan_dir /run/service 1327 require site_container_images :containers_dir :svscan_dir 1328 require site_container_services :containers_dir :svscan_dir 1329 } 1330 1331 confz_container_sysroot_rundir_check() { 1332 checkvars container_root container_name tmp_dir 1333 require fs_contentnl filename=$vars[tmp_dir]/run/init \ 1334 content=$'#!/bin/sh\nexec sleep 3600' 1335 require fs_m filename=$vars[tmp_dir]/run/init mode=755 1336 }