hologram-base.pkg.toml

[package]
name    = "hologram-base"
version = "20241106.2"
description = "hologram: base installation"

requires = [
    "base",
    "hologram-openssh",
    "linux",
    "linux-firmware",
    # configuration management
    "replicator",
    # assorted CLI tools
    "age",
    "dnsutils",
    "git",
    "gron",
    "gofu",
    "go-yq",
    "gptfdisk",
    "htop",
    "jq",
    "lsof",
    "moreutils",      # chronic, sponge, ts, etc.
    "ncdu",
    "net-tools",      # netstat
    "nmap",           # ncat
    "pciutils",
    "pinfo",
    "pwgen",
    "pv",
    "python-tabulate",
    "qrencode",
    "ripgrep",
    "rsync",
    "screen",
    "socat",
    "strace",
    "sudo",
    "tcpdump",
    "tk",             # gitk
    "traceroute",
    "tree",
    "units",
    "up",
    "usbutils",
    "vim",
    "wget",
    "zsh",
]

# entities
[[group]]
name    = "sudo"
system  = true

[[user]]
name    = "stefan"
comment = "Stefan Majewsky"
uid     = 1001
group   = "users"
groups  = ["sudo"]
shell   = "/bin/zsh"

# locale
[[file]]
path    = "/etc/locale.conf"
content = """
    LANG=de_DE.UTF-8
    LC_MESSAGES=C
"""

[[file]]
path    = "/usr/share/holo/files/00-base/etc/locale.gen"
content = """
    de_DE.UTF-8 UTF-8
    en_US.UTF-8 UTF-8
"""

[[action]]
on     = "setup"
script = "locale-gen"

[[symlink]]
path   = "/etc/localtime"
target = "/usr/share/zoneinfo/Europe/Berlin"

[[file]]
path    = "/etc/vconsole.conf"
content = """
    KEYMAP=us
"""

# filesystem
[[file]]
path    = "/usr/share/holo/files/00-base/etc/fstab"
mode    = "0644"
content = """
    {{- range .Vars.fstab }}
    {{.source}}	{{.target}}	{{.fstype}}	{{.options}}	0 {{if eq .target "/"}}1{{else if contains "_netdev" .options}}0{{else}}2{{end}}
    {{- end }}
"""
[[symlink]]
path   = "/usr/share/holo/files/00-base/etc/fstab.holoscript"
target = "/usr/bin/replicator"

[[file]]
path    = "/usr/share/holo/files/00-base/etc/crypttab"
mode    = "0600"
content = """
    {{- range .Vars.crypttab }}
    {{.name}}	UUID={{.uuid}}	{{.keyfile}}	{{.options}}
    {{- end }}
"""
[[symlink]]
path   = "/usr/share/holo/files/00-base/etc/crypttab.holoscript"
target = "/usr/bin/replicator"

# pacman
[[file]]
path    = "/usr/share/holo/files/00-base/etc/pacman.conf.holoscript"
mode    = "0755"
content = '''
    #!/bin/sh

    # skip installation of translations
    echo '[options]'
    echo 'NoExtract = usr/share/locale/*/LC_MESSAGES'
    echo 'NoExtract = usr/share/locale/*/LC_MESSAGES/*'
    # skip installation of ripgrep zsh-completion (https://github.com/BurntSushi/ripgrep/issues/375)
    # completion function is provided by devenv instead
    echo 'NoExtract = usr/share/zsh/site-functions/_rg'

    sed '
        # enable additional options
        s/^#\(Color\|VerbosePkgLists\)$/\1/

        # enable multilib repo (TODO: move this into a later hologram?)
        /^#\[multilib]/,/^$/s/^#//
    '

    # add official holo repo
    echo
    echo '[holo]'
    echo 'Server = https://repo.holocm.org/archlinux/$arch'

    # add holograms repo
    echo
    echo '[holograms]'
    echo 'Server = https://repo.holocm.org/archlinux/personal'
'''

[[file]]
path    = "/usr/share/holo/files/00-base/etc/pacman.d/mirrorlist.holoscript"
mode    = "0755"
content = """
    #!/bin/sh
    # prefer my own mirror
    echo 'Server=https://mirror.bethselamin.de/$repo/os/$arch'
    # other German mirrors (no shuffling or ranking since this is only a fallback anyway)
    sed '1,/^## Germany/d;s/^#Server/Server/;/^$/,$d'
"""

# makepkg
[[file]]
path    = "/usr/share/holo/files/00-base/etc/makepkg.conf.holoscript"
mode    = "0755"
content = """
    #!/bin/sh
    sed '
        # enable package signing
        /^BUILDENV=/s/!sign/sign/
        # use my package signing key
        s/^#GPGKEY=.*/GPGKEY="0xF7A9C9DC4631BD1A"/
        # report myself as the packager
        s/^#PACKAGER=.*/PACKAGER="Stefan Majewsky <holo-pacman@posteo.de>"/
    '
"""

# unpack secrets
[[directory]]
path = "/etc/secrets"
mode = "0700"

[[file]]
path = "/etc/secrets/key"
mode = "0600"
contentFrom = "/dev/null" # needs to be filled by root on setup

[[file]]
path        = "/usr/bin/unpack-secrets"
mode        = "0755"
contentFrom = "src/unpack-secrets.sh"

# sudo
[[file]]
path    = "/usr/share/holo/files/00-base/etc/sudoers"
content = """
    root    ALL=(ALL) ALL
    %sudo   ALL=(ALL) ALL

    Defaults env_keep+="http_proxy https_proxy ftp_proxy all_proxy socks_proxy no_proxy"
"""

# systemd-networkd
[[symlink]]
path   = "/etc/systemd/system/multi-user.target.wants/systemd-networkd.service"
target = "/usr/lib/systemd/system/systemd-networkd.service"
[[symlink]]
path   = "/etc/systemd/system/sockets.target.wants/systemd-networkd.socket"
target = "/usr/lib/systemd/system/systemd-networkd.socket"

# systemd-timesyncd
[[file]]
path    = "/etc/systemd/timesyncd.conf.d/hologram-base.conf"
content = """
    [Time]
    FallbackNTP=ptbtime1.ptb.de
"""

[[symlink]]
path   = "/etc/systemd/system/sysinit.target.wants/systemd-timesyncd.service"
target = "/usr/lib/systemd/system/systemd-timesyncd.service"

# git is stupid and wants a name/email even when only pulling, even on servers
[[file]]
path = "/etc/gitconfig"
content = '''
    [user]
    name = Fake
    email = fake@example.com
'''

# home directory including SSH keys
[[directory]]
path  = "/home/stefan"
mode  = "0700"
owner = 1001 # stefan
group = 100  # users

[[directory]]
path  = "/home/stefan/.ssh"
mode  = "0700"
owner = 1001 # stefan
group = 100  # users

# development environment bootstrapping
[[directory]]
path  = "/x"
mode  = "0700"
owner = 1001 # stefan
group = 100  # users

[[file]]
path = "/usr/bin/bootstrap-devenv"
mode = "0755"
contentFrom = "src/bootstrap-devenv.sh"

# disable faillock
[[file]]
path    = "/usr/share/holo/files/00-base/etc/security/faillock.conf.holoscript"
mode = "0755"
content = '''
    #!/bin/sh
    cat
    echo 'deny = 0'
'''