openeuler.yaml

image:
  distribution: openEuler
  description: |-
    openEuler {{ image.release }}
source:
  downloader: openeuler-http
  url: https://repo.openeuler.org
targets:
  lxc:
    create_message: |
      You just created a {{ image.description }} container.
    config:
    - type: all
      before: 5
      content: |-
        lxc.include = LXC_TEMPLATE_CONFIG/centos.common.conf

    - type: user
      before: 5
      content: |-
        lxc.include = LXC_TEMPLATE_CONFIG/centos.userns.conf

    - type: all
      after: 4
      content: |-
        lxc.include = LXC_TEMPLATE_CONFIG/common.conf

    - type: user
      after: 4
      content: |-
        lxc.include = LXC_TEMPLATE_CONFIG/userns.conf

    - type: all
      content: |-
        lxc.arch = {{ image.architecture_kernel }}

files:
- name: hostname
  path: /etc/hostname
  generator: hostname

- name: hosts
  path: /etc/hosts
  generator: hosts

- path: /etc/machine-id
  generator: dump

- path: /etc/fstab
  generator: dump

- path: /var/lib/dbus/machine-id
  generator: remove

- name: ifcfg-eth0
  path: /etc/sysconfig/network-scripts/ifcfg-eth0
  generator: dump
  templated: true
  content: |-
    DEVICE=eth0
    BOOTPROTO=dhcp
    ONBOOT=yes
    HOSTNAME=LXC_NAME
    TYPE=Ethernet
    MTU=
    DHCP_HOSTNAME=LXC_NAME
  types:
  - container

- name: ifcfg-eth0.incus
  path: /etc/sysconfig/network-scripts/ifcfg-eth0
  generator: template
  content: |-
    DEVICE=eth0
    BOOTPROTO=dhcp
    ONBOOT=yes
    HOSTNAME={{ container.name }}
    TYPE=Ethernet
    MTU=
    DHCP_HOSTNAME={{ container.name }}
    IPV6INIT=yes
  types:
  - container

- name: ifcfg-enp5s0
  path: /etc/sysconfig/network-scripts/ifcfg-enp5s0
  generator: dump
  templated: true
  content: |-
    DEVICE=enp5s0
    BOOTPROTO=dhcp
    ONBOOT=yes
    HOSTNAME=LXC_NAME
    TYPE=Ethernet
    MTU=
    DHCP_HOSTNAME=LXC_NAME
  types:
  - vm

- name: ifcfg-enp5s0.incus
  path: /etc/sysconfig/network-scripts/ifcfg-enp5s0
  generator: template
  content: |-
    DEVICE=enp5s0
    BOOTPROTO=dhcp
    ONBOOT=yes
    HOSTNAME={{ container.name }}
    TYPE=Ethernet
    MTU=
    DHCP_HOSTNAME={{ container.name }}
  types:
  - vm

- path: /etc/default/grub
  generator: dump
  content: |-
    # Set the recordfail timeout
    GRUB_RECORDFAIL_TIMEOUT=0
    # Do not wait on grub prompt
    GRUB_TIMEOUT=0
    # Set the default commandline
    GRUB_CMDLINE_LINUX_DEFAULT="${GRUB_CMDLINE_LINUX_DEFAULT} console=tty1 console=ttyS0"
    # Set the grub console type
    GRUB_TERMINAL=console
    # Disable os-prober
    GRUB_DISABLE_OS_PROBER=true
  types:
  - vm

- path: /etc/dracut.conf.d/incus.conf
  generator: dump
  content: |-
    add_drivers+=" virtio_scsi virtio_console sd_mod "
  types:
  - vm

- generator: fstab
  types:
  - vm

- name: incus-agent-workaround.service
  path: /etc/systemd/system/incus-agent-workaround.service
  generator: dump
  content: |-
    [Unit]
    Description=Incus - agent (openEuler workaround)
    Before=incus-agent.service

    [Service]
    Type=oneshot
    ExecStart=-/bin/mkdir /run/incus_agent

    [Install]
    WantedBy=multi-user.target
  types:
  - vm

- name: 86-nm-unmanaged.rules
  path: /etc/udev/rules.d/86-nm-unmanaged.rules
  generator: dump
  content: |-
    ENV{ID_NET_DRIVER}=="veth", ENV{NM_UNMANAGED}="0"

- name: network
  path: /etc/sysconfig/network
  generator: dump
  templated: true
  content: |-
    NETWORKING=yes
    HOSTNAME=LXC_NAME

- name: network.incus
  path: /etc/sysconfig/network
  generator: template
  content: |-
    NETWORKING=yes
    HOSTNAME={{ container.name }}

- name: meta-data
  generator: cloud-init
  variants:
  - cloud

- name: network-config
  generator: cloud-init
  variants:
  - cloud

- name: network-config
  generator: cloud-init
  content: |-
    {% if config_get("user.network-config", "") == "" %}version: 1
    config:
      - type: physical
        name: {% if instance.type == "virtual-machine" %}enp5s0{% else %}eth0{% endif %}
        subnets:
          - type: {% if config_get("user.network_mode", "") == "link-local" %}manual{% else %}dhcp{% endif %}
            control: auto{% else %}{{ config_get("user.network-config", "") }}{% endif %}
  variants:
  - cloud

- name: user-data
  generator: cloud-init
  variants:
  - cloud

- name: vendor-data
  generator: cloud-init
  variants:
  - cloud

- generator: incus-agent
  types:
  - vm

packages:
  manager: yum
  update: true
  cleanup: true
  sets:
  - packages:
    - cronie
    - cronie-noanacron
    - curl
    - dhclient
    - hostname
    - initscripts
    - openssh-clients
    - passwd
    - policycoreutils
    - rootfiles
    - sudo
    - rsyslog
    - vim-minimal
    - curl
    - wget
    - bash
    - lsof
    - sshpass
    - openssh-server
    - iptables
    - dos2unix
    - cronie
    action: install

  - packages:
    - network-scripts
    action: install
    types:
    - container
    variants:
    - default
    architectures:
    - x86_64
    - aarch64

  - packages:
    - NetworkManager
    action: install
    types:
    - container
    variants:
    - default
    architectures:
    - armhfp

  - packages:
    - NetworkManager
    action: install
    types:
    - vm
    variants:
    - default

  - packages:
    - cloud-init
    - NetworkManager
    action: install
    variants:
    - cloud

  - packages:
    - cloud-utils-growpart
    action: install
    types:
    - vm
    variants:
    - cloud

  - packages:
    - shim
    action: install
    types:
    - vm

  - packages:
    - kernel
    action: install
    types:
    - vm

  - packages:
    - grub2-efi-x64
    action: install
    types:
    - vm
    architectures:
    - x86_64

  - packages:
    - grub2-efi-aarch64
    action: install
    types:
    - vm
    architectures:
    - aarch64

actions:
- trigger: post-unpack
  action: |-
    #!/bin/sh
    # Make sure we have our template targets
    touch /etc/hosts
    touch /etc/hostname

- trigger: post-unpack
  action: |-
    #!/bin/sh
    set -eux

    # Rebuild rpm database as the failing builds suggest it's broken.
    rpmdb --rebuilddb
    sed -i '/metalink=/d' /etc/yum.repos.d/openEuler.repo

- trigger: post-unpack
  action: |-
    #!/bin/sh
    # Generate machine-id in order for the kernel stuff to be configured properly
    systemd-machine-id-setup
  types:
  - vm

- trigger: post-packages
  action: |-
    #!/bin/sh
    set -eux

    # Disable auditd
    systemctl mask auditd.service

    # Disable SELinux
    mkdir -p /selinux
    echo 0 > /selinux/enforce

    # Disable loginuid in PAM stack
    sed -i '/^session.*pam_loginuid.so/s/^session/# session/' /etc/pam.d/*

- trigger: post-files
  action: |-
    #!/bin/sh
    set -eux

    mount -t tmpfs tmpfs /sys/firmware
    mkdir /sys/firmware/efi

    # Regenerate initramfs
    kver=$(ls /boot/initramfs-*.img | sed -r 's#.*initramfs-(.+)\.img#\1#')
    dracut --kver "${kver}" -f

    target="$(readlink -f /etc/grub2-efi.cfg)"
    grub2-mkconfig -o "${target}"

    umount /sys/firmware

    sed -i "s#root=[^ ]*#root=${DISTROBUILDER_ROOT_UUID}#g" "${target}"

    # Workaround for broken systemd in centos7
    systemctl enable incus-agent-workaround.service

    # Workaround for broken mdmonitor
    systemctl mask mdmonitor
  types:
  - vm

# Strip security.ima from all files that have it set.
- trigger: post-files
  action: |-
    #!/bin/sh
    set -eu
    getfattr --absolute-names -RPh -n security.ima -e hex / 2>/dev/null | grep "^# file:" | cut -d" " -f3- | while read line; do
        setfattr -h -x security.ima "${line}" 2>/dev/null || true
    done
  types:
  - container

- trigger: post-files
  action: |-
    #!/bin/sh
    set -eux

    systemctl disable iptables || true
    systemctl enable sshd || true
    systemctl enable ssh || true
    # sshd_config
    sed -i "s/^#\?\(Port\).*/\1 22/" /etc/ssh/sshd_config || true
    sed -i -E 's/^#?(Port).*/\1 22/' /etc/ssh/sshd_config || true
    sed -i 's/^#\?Port.*/Port 22/g' /etc/ssh/sshd_config || true
    sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin yes/g' /etc/ssh/sshd_config || true
    sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication yes/g' /etc/ssh/sshd_config || true
    sed -i 's/#ListenAddress 0.0.0.0/ListenAddress 0.0.0.0/' /etc/ssh/sshd_config || true
    sed -i 's/#ListenAddress ::/ListenAddress ::/' /etc/ssh/sshd_config || true
    sed -i 's/#AddressFamily any/AddressFamily any/' /etc/ssh/sshd_config || true
    sed -i 's/^#\?PubkeyAuthentication.*/PubkeyAuthentication no/g' /etc/ssh/sshd_config || true
    sed -i '/^#UsePAM\\|UsePAM/c #UsePAM no' /etc/ssh/sshd_config || true
    sed -i '/^AuthorizedKeysFile/s/^/#/' /etc/ssh/sshd_config || true
    # cloud-init
    sed -i "s/^#\?\(Port\).*/\1 22/" /etc/ssh/sshd_config.d/50-cloud-init.conf || true
    sed -i -E 's/^#?(Port).*/\1 22/' /etc/ssh/sshd_config.d/50-cloud-init.conf || true
    sed -i 's/^#\?Port.*/Port 22/g' /etc/ssh/sshd_config.d/50-cloud-init.conf || true
    sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin yes/g' /etc/ssh/sshd_config.d/50-cloud-init.conf || true
    sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication yes/g' /etc/ssh/sshd_config.d/50-cloud-init.conf || true
    sed -i 's/#ListenAddress 0.0.0.0/ListenAddress 0.0.0.0/' /etc/ssh/sshd_config.d/50-cloud-init.conf || true
    sed -i 's/#ListenAddress ::/ListenAddress ::/' /etc/ssh/sshd_config.d/50-cloud-init.conf || true
    sed -i 's/#AddressFamily any/AddressFamily any/' /etc/ssh/sshd_config.d/50-cloud-init.conf || true
    sed -i 's/^#\?PubkeyAuthentication.*/PubkeyAuthentication no/g' /etc/ssh/sshd_config.d/50-cloud-init.conf || true
    sed -i '/^#UsePAM\\|UsePAM/c #UsePAM no' /etc/ssh/sshd_config.d/50-cloud-init.conf || true
    sed -i '/^AuthorizedKeysFile/s/^/#/' /etc/ssh/sshd_config.d/50-cloud-init.conf || true
    # other config
    sed -i.bak '/^SELINUX=/cSELINUX=disabled' /etc/sysconfig/selinux || true
    sed -i.bak '/^SELINUX=/cSELINUX=disabled' /etc/selinux/config || true
    grep -q '^PermitRootLogin yes' /etc/ssh/sshd_config || echo "PermitRootLogin yes" >> /etc/ssh/sshd_config || true
    echo "Related repo https://github.com/oneclickvirt/lxc_amd64_images\n--by https://t.me/spiritlhl" >> /etc/motd || true
    echo "Related repo https://github.com/oneclickvirt/lxc_amd64_images\n--by https://t.me/spiritlhl" >> /etc/banner || true

  types:
  - container
  variants:
  - cloud
  - default