bluebluesodaandCommandCodeBot
471b0653a6
- host sysctl (20-network.sh): tcp_rmem/tcp_wmem max, rmem_max and wmem_max all go from 4194304 to 8388608 - image builds (50/60/70/80/90 + eol-debian11): tcp_rmem/tcp_wmem max bumped the same way - autotune defaults (262144) and the min values are untouched Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
133 lines
6.1 KiB
Bash
Executable File
133 lines
6.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# 50-image.sh — pre-pull Debian 13 and build a slim local "Debian 13 + sshd"
|
|
# image with the universal tooling baked in (curl/wget/ca-certificates/less/
|
|
# bind9-dnsutils/openssh-client/unzip/nano). apt lists/archives and logs are
|
|
# cleaned inside the builder before publishing, and the Debian base image (a
|
|
# build intermediate only) is deleted afterwards so only the modified
|
|
# vpsmgr/debian-sshd stays on disk.
|
|
set -uo pipefail
|
|
|
|
log(){ echo "[50] $*"; }
|
|
|
|
incus info >/dev/null 2>&1 || { echo "[50] error: Incus not ready" >&2; exit 1; }
|
|
|
|
# --- prebuilt sshd image ---
|
|
# Check this FIRST: on reinstall/upgrade the sshd image already exists, so we
|
|
# must not pull the base image (or download anything) just to discover that.
|
|
if incus image show vpsmgr/debian-sshd >/dev/null 2>&1; then
|
|
log "sshd image vpsmgr/debian-sshd already present"
|
|
exit 0
|
|
fi
|
|
|
|
# --- base image ---
|
|
if incus image show vpsmgr-debian-13 >/dev/null 2>&1; then
|
|
log "base image vpsmgr-debian-13 already present"
|
|
else
|
|
log "pulling images:debian/13 (fallback images:debian/trixie)..."
|
|
if ! incus image copy images:debian/13 local: --alias vpsmgr-debian-13; then
|
|
log " debian/13 alias failed, trying debian/trixie"
|
|
incus image copy images:debian/trixie local: --alias vpsmgr-debian-13 \
|
|
|| log " warn: image pull failed — add-user needs network and will retry"
|
|
fi
|
|
fi
|
|
|
|
if ! incus image show vpsmgr-debian-13 >/dev/null 2>&1; then
|
|
log " warn: base image unavailable, skipping sshd image build (add-user will install sshd on the fly)"
|
|
exit 0
|
|
fi
|
|
|
|
log "building sshd image (this takes a few minutes)..."
|
|
NAME=tmp-sshd-builder
|
|
incus delete --force "$NAME" >/dev/null 2>&1 || true
|
|
if incus launch vpsmgr-debian-13 "$NAME"; then
|
|
# wait until usable
|
|
for i in $(seq 1 60); do
|
|
if incus exec "$NAME" -- /bin/true >/dev/null 2>&1; then break; fi
|
|
sleep 2
|
|
done
|
|
# DNS can lag agent readiness; running apt before it is up fails the update
|
|
# and, without a gate, a broken sshd image would still be published.
|
|
DNS_OK=
|
|
for i in $(seq 1 30); do
|
|
if incus exec "$NAME" -- getent hosts deb.debian.org >/dev/null 2>&1; then
|
|
DNS_OK=1; break
|
|
fi
|
|
sleep 2
|
|
done
|
|
if [ -z "$DNS_OK" ]; then
|
|
log " warn: builder never got working DNS; skipping sshd image (add-user will install sshd on the fly)"
|
|
incus delete --force "$NAME" >/dev/null 2>&1 || true
|
|
elif incus exec "$NAME" -- sh -c 'export DEBIAN_FRONTEND=noninteractive
|
|
set -e
|
|
# universal user tooling (small, every container hits these): curl/wget need
|
|
# ca-certificates or HTTPS fails; dnsutils is bind9-dnsutils on Debian 13.
|
|
apt-get update -qq && apt-get install -y -qq --no-install-recommends openssh-server ca-certificates curl wget less openssh-client unzip nano
|
|
# hard gate: never publish an image without sshd baked in
|
|
command -v sshd >/dev/null || { echo "sshd install failed" >&2; exit 1; }
|
|
mkdir -p /etc/ssh/sshd_config.d
|
|
printf "PermitRootLogin yes\nPasswordAuthentication yes\n" > /etc/ssh/sshd_config.d/99-vpsmgr.conf
|
|
systemctl enable ssh
|
|
# Containers route peer IPv6 through the host, so they must not treat the
|
|
# parent prefix as on-link. Tell systemd-networkd to skip RA on-link and route
|
|
# prefixes; peer traffic then always goes to the default gateway. DHCPv6 is
|
|
# off: its dynamic address would fall outside the routed /112 (dropped by
|
|
# ipv6_filtering), and on reinstall the stale DHCPv6 lease for the
|
|
# deterministic block would hand a fresh container that useless address.
|
|
if [ -f /etc/systemd/network/eth0.network ]; then
|
|
sed -i "s/^DHCP=true\$/DHCP=ipv4/" /etc/systemd/network/eth0.network
|
|
printf "\n[IPv6AcceptRA]\nUseGateway=false\nUseOnLinkPrefix=false\nUseRoutePrefix=false\nUseAutonomousPrefix=false\nDHCPv6Client=no\n" >> /etc/systemd/network/eth0.network
|
|
fi
|
|
# vpsmgr TCP tuning: BBR congestion control, larger autotuned buffers, window
|
|
# scaling on, and no slow-start reset after idle (better for long-lived SSH and
|
|
# tunnel connections). Baked into /etc/sysctl.conf so it applies at container
|
|
# boot; sysctl -p is a best-effort apply during the build (an unprivileged
|
|
# container may deny net.* sysctls — that is non-fatal).
|
|
cat >> /etc/sysctl.conf <<SYSCTL
|
|
|
|
# vpsmgr TCP tuning
|
|
net.ipv4.tcp_congestion_control = bbr
|
|
net.ipv4.tcp_rmem = 8192 262144 8388608
|
|
net.ipv4.tcp_wmem = 4096 16384 8388608
|
|
net.ipv4.tcp_window_scaling = 1
|
|
net.ipv4.tcp_slow_start_after_idle = 0
|
|
SYSCTL
|
|
sysctl -p 2>/dev/null || true
|
|
|
|
# slim the published image: drop apt lists/archives and logs. Without this the
|
|
# image balloons ~70MiB beyond just openssh (apt lists alone are ~50MiB).
|
|
apt-get clean 2>/dev/null || true
|
|
rm -rf /var/lib/apt/lists/* 2>/dev/null || true
|
|
rm -rf /var/log/* 2>/dev/null || true
|
|
rm -rf /tmp/* /var/tmp/* 2>/dev/null || true
|
|
# A machine-id baked into the image would be shared by every container:
|
|
# systemd-networkd derives its DHCPv6 DUID from it, so two containers look
|
|
# like the same DHCPv6 client and dnsmasq lease renewals break (the global
|
|
# IPv6 drops at the 1h lease mark). Drop it so each container generates its
|
|
# own on first boot.
|
|
rm -f /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null || true'; then
|
|
incus stop "$NAME" --timeout=30 || true
|
|
if incus publish "$NAME" --alias vpsmgr/debian-sshd; then
|
|
incus delete --force "$NAME" || true
|
|
# keep only the modified image — the Debian base was a build intermediate
|
|
# and is never used to launch containers (fallback is the remote images:).
|
|
if incus image delete vpsmgr-debian-13 >/dev/null 2>&1; then
|
|
log "removed base image vpsmgr-debian-13 (only vpsmgr/debian-sshd kept)"
|
|
else
|
|
log " warn: could not remove base image vpsmgr-debian-13"
|
|
fi
|
|
log "sshd image published: vpsmgr/debian-sshd"
|
|
else
|
|
log " warn: publish FAILED — sshd image NOT built (base image kept; re-run to retry)"
|
|
incus delete --force "$NAME" >/dev/null 2>&1 || true
|
|
exit 1
|
|
fi
|
|
else
|
|
log " warn: sshd install in builder failed; add-user will install sshd on the fly"
|
|
incus delete --force "$NAME" >/dev/null 2>&1 || true
|
|
fi
|
|
else
|
|
log " warn: could not launch builder; add-user will install sshd on the fly"
|
|
fi
|
|
|
|
echo "[50] image ready"
|