29 changed files with 462 additions and 14 deletions
@ -1,3 +1,3 @@ |
|||
TOP_LEVEL_DIR := .. |
|||
include $(TOP_LEVEL_DIR)/Makefile.common |
|||
SYSTEMD_MAIN_UNIT_NAMES := var-lib-virtiofs-data.mount rpm-ostree-install-qemu-guest-agent.service |
|||
SYSTEMD_MAIN_UNIT_NAMES := var-lib-virtiofs-data.mount rpm-ostree-install-qemu-guest-agent.service install-fastfetch.service |
|||
|
|||
@ -0,0 +1,110 @@ |
|||
{ |
|||
"$schema": "https://github.com/fastfetch-cli/fastfetch/raw/dev/doc/json_schema.json", |
|||
"logo": { |
|||
"padding": { |
|||
"top": 2 |
|||
} |
|||
}, |
|||
"display": { |
|||
"showErrors": false, |
|||
"size": { |
|||
"ndigits": 0, |
|||
"maxPrefix": "GB" |
|||
}, |
|||
"separator": "", |
|||
"color": { |
|||
"keys": "blue", |
|||
"title": "blue" |
|||
}, |
|||
"key": { |
|||
"width": 36, |
|||
"type": "string" |
|||
}, |
|||
"bar": { |
|||
"width": 16, |
|||
"charElapsed": "■", |
|||
"charTotal": "-" |
|||
}, |
|||
"percent": { |
|||
"type": 3, |
|||
"color": { |
|||
"green": "green", |
|||
"yellow": "light_yellow", |
|||
"red": "light_red" |
|||
} |
|||
} |
|||
}, |
|||
"modules": [ |
|||
{ |
|||
"type": "custom", |
|||
"key": " ------- Software ------- ", |
|||
"format": " " |
|||
}, |
|||
"os", |
|||
"kernel", |
|||
"break", |
|||
{ |
|||
"type": "custom", |
|||
"key": " ------- Hardware ------- ", |
|||
"format": " " |
|||
}, |
|||
"host", |
|||
"cpu", |
|||
{ |
|||
"type": "physicaldisk", |
|||
"key": "Disk {dev-path}", |
|||
"format": "{size>10} {serial}" |
|||
}, |
|||
"break", |
|||
{ |
|||
"type": "custom", |
|||
"key": " ---- Resource Usage ---- ", |
|||
"format": " " |
|||
}, |
|||
{ |
|||
"type": "memory", |
|||
"key": "Memory", |
|||
"format": "{percentage-bar} {percentage>4}" |
|||
}, |
|||
{ |
|||
"type": "disk", |
|||
"format": "{size-percentage-bar} {size-percentage>4}", |
|||
"key": "Vol. /", |
|||
"folders": "/sysroot", |
|||
"percent": { |
|||
"green": 75, |
|||
"yellow": 90 |
|||
} |
|||
}, |
|||
{ |
|||
"type": "disk", |
|||
"format": "{size-percentage-bar} {size-percentage>4}", |
|||
"key": "Vol. {mountpoint}", |
|||
"folders": "/var:/var/lib/virtiofs/data", |
|||
"percent": { |
|||
"green": 75, |
|||
"yellow": 90 |
|||
} |
|||
}, |
|||
"break", |
|||
{ |
|||
"type": "custom", |
|||
"key": " ------ Environment ------ ", |
|||
"format": " " |
|||
}, |
|||
{ |
|||
"type": "title", |
|||
"key": "User", |
|||
"format": "{user-name-colored}" |
|||
}, |
|||
"uptime", |
|||
{ |
|||
"type": "title", |
|||
"key": "Hostname", |
|||
"format": "{host-name}", |
|||
"fqdn": true |
|||
}, |
|||
"localip", |
|||
"publicip" |
|||
] |
|||
} |
|||
@ -0,0 +1,11 @@ |
|||
#!/bin/bash |
|||
set -Eeuo pipefail |
|||
FASTFETCH_VERSION="$(curl -sSfL https://api.github.com/repos/fastfetch-cli/fastfetch/releases | jq -r '.[] | select(.prerelease == false and .draft == false) | .tag_name' | sort -V | tail -1)" |
|||
FASTFETCH_BIN="/usr/local/bin/fastfetch" |
|||
declare -A ARCH_MAP=( ["aarch64"]="aarch64" ["x86_64"]="amd64" ) |
|||
if [ ! -f "$FASTFETCH_BIN" ]; then |
|||
arch="$(arch)" |
|||
arch=${ARCH_MAP[$arch]} |
|||
echo "Installing fastfetch $FASTFETCH_VERSION for $arch..." |
|||
curl -sSfL https://github.com/fastfetch-cli/fastfetch/releases/download/$FASTFETCH_VERSION/fastfetch-linux-$arch.tar.gz | tar -zx --strip-components=2 -C /usr/local |
|||
fi |
|||
@ -0,0 +1,13 @@ |
|||
[Unit] |
|||
Description=Install fastfetch |
|||
Wants=network-online.target |
|||
After=network-online.target |
|||
ConditionPathExists=!/usr/local/bin/fastfetch |
|||
|
|||
[Service] |
|||
Type=oneshot |
|||
RemainAfterExit=yes |
|||
ExecStart=/etc/quadlets/base/install-fastfetch.sh |
|||
|
|||
[Install] |
|||
WantedBy=multi-user.target |
|||
@ -0,0 +1,9 @@ |
|||
#!/bin/sh |
|||
declare -a FASTFETCH_OPTIONS=( -c /etc/quadlets/base/fastfetch.jsonc ) |
|||
if [ "$USER" == "root" ]; then |
|||
FASTFETCH_OPTIONS+=( --custom-key-color dim_red --color-keys red --title-color-user red ) |
|||
else |
|||
FASTFETCH_OPTIONS+=( --custom-key-color dim_blue --color-keys blue --title-color-user green ) |
|||
fi |
|||
fastfetch "${FASTFETCH_OPTIONS[@]}" |
|||
unset FASTFETCH_OPTIONS |
|||
@ -0,0 +1,13 @@ |
|||
##
|
|||
## Makefile for Lego quadlet
|
|||
##
|
|||
|
|||
# Lego quadlet is mapped to the 10023 user (lego) and 10000 group (itix-svc)
|
|||
PROJECT_UID = 10023 |
|||
PROJECT_GID = 10000 |
|||
|
|||
# Include common Makefile
|
|||
TOP_LEVEL_DIR := .. |
|||
include $(TOP_LEVEL_DIR)/Makefile.common |
|||
|
|||
|
|||
@ -0,0 +1,3 @@ |
|||
LEGO_GLOBAL_ARGS=-a -m nicolas.masse@itix.fr -d changeme.example.tld --http |
|||
LEGO_RUN_ARGS= |
|||
LEGO_RENEW_ARGS=--days 30 --renew-hook=/etc/lego/hooks/flag-as-renewed.sh |
|||
@ -0,0 +1,3 @@ |
|||
#!/bin/sh |
|||
set -Eeuo pipefail |
|||
touch ${LEGO_CERT_PATH%.*}.renewed |
|||
@ -0,0 +1,52 @@ |
|||
[Unit] |
|||
Description=Lego Let's Encrypt client - Renew a certificate |
|||
Documentation=https://go-acme.github.io/lego/ |
|||
|
|||
# Only start if there are certificates to renew |
|||
ConditionPathExistsGlob=/var/lib/quadlets/lego/certificates/*.crt |
|||
# and if Lego has been configured ! |
|||
ConditionPathExists=/etc/quadlets/lego/config.env |
|||
|
|||
[Container] |
|||
ContainerName=lego-renew |
|||
|
|||
# No need for root privileges |
|||
User=10023 |
|||
Group=10000 |
|||
|
|||
# Image |
|||
Image=docker.io/goacme/lego:latest |
|||
AutoUpdate=registry |
|||
|
|||
# Network configuration |
|||
Network=host |
|||
|
|||
# Environment variables from config |
|||
EnvironmentFile=/etc/quadlets/lego/config.env |
|||
|
|||
# Volume mounts |
|||
Volume=/var/lib/quadlets/lego:/.lego:z |
|||
Volume=/etc/quadlets/lego/hooks:/etc/lego/hooks:ro |
|||
|
|||
# Be safe, set the umask to 0077 so that private keys are not world-readable |
|||
PodmanArgs=--umask=0077 |
|||
|
|||
# Command to run |
|||
Exec=$LEGO_GLOBAL_ARGS renew $LEGO_RENEW_ARGS |
|||
|
|||
[Service] |
|||
# If the command fails, don't try to restart it. |
|||
# Otherwise, we would hammer the Let's Encrypt servers and possibly get banned. |
|||
Restart=no |
|||
|
|||
# Getting a certificate may take some time |
|||
TimeoutStartSec=600 |
|||
|
|||
# This container is a job - run once to completion |
|||
Type=oneshot |
|||
|
|||
# These environment variables are sourced to be used by systemd in the Exec* commands |
|||
EnvironmentFile=/etc/quadlets/lego/config.env |
|||
|
|||
[Install] |
|||
WantedBy=lego.target |
|||
@ -0,0 +1,12 @@ |
|||
[Unit] |
|||
Description=Lego Let's Encrypt client - Renew a certificate |
|||
Documentation=https://go-acme.github.io/lego/ |
|||
PartOf=lego.target |
|||
|
|||
[Timer] |
|||
OnCalendar=daily |
|||
RandomizedDelaySec=1h |
|||
Persistent=true |
|||
|
|||
[Install] |
|||
WantedBy=lego.target |
|||
@ -0,0 +1,52 @@ |
|||
[Unit] |
|||
Description=Lego Let's Encrypt client - Fetch a certificate |
|||
Documentation=https://go-acme.github.io/lego/ |
|||
PartOf=lego.target |
|||
|
|||
# Only start if no certificates exist yet |
|||
ConditionPathExistsGlob=!/var/lib/quadlets/lego/certificates/*.crt |
|||
# and if Lego has been configured ! |
|||
ConditionPathExists=/etc/quadlets/lego/config.env |
|||
|
|||
[Container] |
|||
ContainerName=lego-run |
|||
|
|||
# No need for root privileges |
|||
User=10023 |
|||
Group=10000 |
|||
|
|||
# Image |
|||
Image=docker.io/goacme/lego:latest |
|||
AutoUpdate=registry |
|||
|
|||
# Network configuration |
|||
Network=host |
|||
|
|||
# Environment variables from config |
|||
EnvironmentFile=/etc/quadlets/lego/config.env |
|||
|
|||
# Volume mounts |
|||
Volume=/var/lib/quadlets/lego:/.lego:z |
|||
|
|||
# Be safe, set the umask to 0077 so that private keys are not world-readable |
|||
PodmanArgs=--umask=0077 |
|||
|
|||
# Command to run |
|||
Exec=$LEGO_GLOBAL_ARGS run $LEGO_RUN_ARGS |
|||
|
|||
[Service] |
|||
# If the command fails, don't try to restart it. |
|||
# Otherwise, we would hammer the Let's Encrypt servers and possibly get banned. |
|||
Restart=no |
|||
|
|||
# Getting a certificate may take some time |
|||
TimeoutStartSec=600 |
|||
|
|||
# This container is a job - run once to completion |
|||
Type=oneshot |
|||
|
|||
# These environment variables are sourced to be used by systemd in the Exec* commands |
|||
EnvironmentFile=/etc/quadlets/lego/config.env |
|||
|
|||
[Install] |
|||
WantedBy=lego.target |
|||
@ -0,0 +1,12 @@ |
|||
[Unit] |
|||
Description=Lego Let's Encrypt client |
|||
Documentation=https://go-acme.github.io/lego/ |
|||
Requires=lego-run.service lego-renew.timer |
|||
After=lego-run.service lego-renew.timer |
|||
|
|||
# Allow isolation - can stop/start this target independently |
|||
AllowIsolate=yes |
|||
|
|||
[Install] |
|||
# Start by default on boot |
|||
WantedBy=multi-user.target default.target |
|||
@ -0,0 +1,9 @@ |
|||
variant: fcos |
|||
version: 1.4.0 |
|||
passwd: |
|||
users: |
|||
- name: lego |
|||
uid: 10023 |
|||
gecos: Lego Let's Encrypt client |
|||
home_dir: /var/lib/quadlets/lego |
|||
primary_group: itix-svc |
|||
@ -0,0 +1,5 @@ |
|||
TOP_LEVEL_DIR := .. |
|||
include $(TOP_LEVEL_DIR)/Makefile.common |
|||
|
|||
$(TARGET_CHROOT)/etc/quadlets/samba/smb.conf.d: |
|||
install -d -m 0700 -o $(PROJECT_UID) -g $(PROJECT_GID) -D $< $@ |
|||
@ -0,0 +1,15 @@ |
|||
FROM quay.io/centos/centos:stream10 |
|||
|
|||
# Install Samba |
|||
RUN dnf install -y samba samba-client cifs-utils shadow-utils procps-ng \ |
|||
&& dnf clean all |
|||
|
|||
# /data holds the samba shares, /run/samba is for temporary files (non-persistent) |
|||
VOLUME /data /run |
|||
|
|||
# We only run smb (no nmb) |
|||
EXPOSE 445 |
|||
|
|||
ADD container-entrypoint / |
|||
ENTRYPOINT [ "/container-entrypoint" ] |
|||
CMD [ ] |
|||
@ -0,0 +1,10 @@ |
|||
#!/bin/bash |
|||
set -Eeuo pipefail |
|||
echo -n > /etc/samba/smb.conf |
|||
for file in /etc/samba/smb.conf.d/*.conf; do |
|||
echo "Using config file from $file..." |
|||
cat $file >> /etc/samba/smb.conf |
|||
echo >> /etc/samba/smb.conf |
|||
done |
|||
mkdir -p /var/lib/samba/lock /var/lib/samba/private /run/samba |
|||
exec /usr/sbin/smbd --foreground --no-process-group --debug-stdout "$@" |
|||
@ -0,0 +1,19 @@ |
|||
server string = Storage |
|||
|
|||
[foo] |
|||
path = /data/foo |
|||
comment = Foo |
|||
valid users = @itix |
|||
write list = @itix |
|||
group = itix |
|||
directory mask = 0770 |
|||
create mask = 0660 |
|||
|
|||
[bar] |
|||
path = /data/bar |
|||
comment = Bar |
|||
valid users = @itix |
|||
write list = @itix |
|||
group = itix |
|||
directory mask = 0775 |
|||
create mask = 0664 |
|||
@ -0,0 +1,8 @@ |
|||
[global] |
|||
workgroup = ITIX |
|||
passdb backend = tdbsam:/var/lib/samba/private/sam.tdb |
|||
map to guest = Bad User |
|||
load printers = no |
|||
private dir = /var/lib/samba/private |
|||
disable netbios = yes |
|||
debug syslog format = always |
|||
@ -0,0 +1,10 @@ |
|||
[Unit] |
|||
Description=Rebuild the samba container image |
|||
PartOf=samba.target |
|||
|
|||
[Timer] |
|||
OnCalendar=daily |
|||
Persistent=true |
|||
|
|||
[Install] |
|||
WantedBy=samba.target |
|||
@ -0,0 +1,9 @@ |
|||
[Unit] |
|||
Description=Build of the Samba daemon |
|||
Wants=network-online.target |
|||
After=network-online.target |
|||
|
|||
[Build] |
|||
File=/etc/quadlets/samba/container/Containerfile |
|||
ImageTag=localhost/samba:latest |
|||
SetWorkingDirectory=/etc/quadlets/samba/container |
|||
@ -0,0 +1,39 @@ |
|||
[Unit] |
|||
Description=Samba |
|||
After=samba-build.service |
|||
Wants=samba-build.service |
|||
Requires=var-lib-virtiofs-data.mount |
|||
|
|||
# Start/stop this unit when the target is started/stopped |
|||
PartOf=samba.target |
|||
|
|||
# Start Samba only if at least one share configuration file exists |
|||
ConditionPathExistsGlob=/etc/quadlets/samba/smb.conf.d/*shares.conf |
|||
|
|||
[Container] |
|||
ContainerName=samba |
|||
|
|||
# Image |
|||
Image=localhost/samba:latest |
|||
AutoUpdate=local |
|||
|
|||
# Security |
|||
User=0 |
|||
|
|||
# Storage |
|||
Volume=/var/lib/quadlets/samba/data:/var/lib/samba:Z |
|||
Volume=/var/lib/quadlets/samba/log:/var/log/samba:Z |
|||
Volume=/var/lib/virtiofs/data:/data |
|||
Volume=/etc/quadlets/samba/smb.conf.d:/etc/samba/smb.conf.d:Z |
|||
Volume=/run/quadlets/samba/passwd:/etc/passwd:Z |
|||
Volume=/run/quadlets/samba/group:/etc/group:Z |
|||
Volume=/run/quadlets/samba/shadow:/etc/shadow:Z |
|||
|
|||
# Network |
|||
Network=host |
|||
|
|||
# Samba debug level |
|||
Exec=--debuglevel=1 |
|||
|
|||
[Install] |
|||
WantedBy=samba.target |
|||
@ -0,0 +1,14 @@ |
|||
[Unit] |
|||
Description=Samba Service Target |
|||
Documentation=man:systemd.target(5) |
|||
Requires=samba.service |
|||
After=samba.service |
|||
|
|||
# Allow isolation - can stop/start this target independently |
|||
AllowIsolate=yes |
|||
|
|||
# Start Samba only if at least one share configuration file exists |
|||
ConditionPathExistsGlob=/etc/quadlets/samba/smb.conf.d/*shares.conf |
|||
|
|||
[Install] |
|||
WantedBy=multi-user.target |
|||
@ -0,0 +1,9 @@ |
|||
d$ /var/lib/quadlets/samba/data 0755 0 0 - |
|||
d$ /var/lib/quadlets/samba/log 0755 0 0 - |
|||
d$ /var/lib/quadlets/samba/cache 0755 0 0 - |
|||
d$ /var/lib/virtiofs/data/foo 0755 0 0 - |
|||
d$ /var/lib/virtiofs/data/bar 0755 0 0 - |
|||
d$ /run/quadlets/samba 0700 0 0 - |
|||
C$ /run/quadlets/samba/passwd - - - - /etc/passwd |
|||
C$ /run/quadlets/samba/group - - - - /etc/group |
|||
C$ /run/quadlets/samba/shadow - - - - /etc/shadow |
|||
Loading…
Reference in new issue