195 lines
8.7 KiB
Bash
Executable File
195 lines
8.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# 80-debian-dev-image.sh — OPTIONAL: build a "Debian 13 dev" image on top of
|
|
# images:debian/13 with a full dev toolchain baked in: the universal
|
|
# sshd/tooling set from 50-image.sh, python3 + pip + venv,
|
|
# git/sqlite3/ripgrep/jq/gh/sshpass, Go 1.26.7 and nvm + Node.js 24. Run as
|
|
# root AFTER install.sh, only when you actually want the heavier dev image (a
|
|
# toy panel should not build it on every box).
|
|
#
|
|
# sudo bash scripts/80-debian-dev-image.sh
|
|
#
|
|
# Same hygiene as 50-image.sh: apt lists/archives and logs cleaned inside the
|
|
# builder before publishing, and the Debian base image (a build intermediate
|
|
# only) is deleted afterwards so only vpsmgr/debian-dev-sshd stays on disk.
|
|
set -uo pipefail
|
|
|
|
|
|
REMOTE_ALIAS=images:debian/13
|
|
FALLBACK_ALIAS=images:debian/trixie
|
|
IMAGE=vpsmgr/debian-dev-sshd
|
|
BASE_ALIAS=vpsmgr-debian-13-dev
|
|
|
|
log(){ echo "[80] $*"; }
|
|
|
|
incus info >/dev/null 2>&1 || { echo "[80] error: Incus not ready" >&2; exit 1; }
|
|
|
|
if incus image show "$IMAGE" >/dev/null 2>&1; then
|
|
log "image $IMAGE already present"
|
|
exit 0
|
|
fi
|
|
|
|
if ! incus image list "$BASE_ALIAS" --format=csv 2>/dev/null | grep -q .; then
|
|
log "pulling $REMOTE_ALIAS (fallback $FALLBACK_ALIAS, deleted after build)..."
|
|
if ! incus image copy "$REMOTE_ALIAS" local: --alias "$BASE_ALIAS"; then
|
|
log " retrying with $FALLBACK_ALIAS"
|
|
incus image copy "$FALLBACK_ALIAS" local: --alias "$BASE_ALIAS" \
|
|
|| { log " warn: image pull failed — nothing built"; exit 0; }
|
|
fi
|
|
else
|
|
log "base image $BASE_ALIAS already present"
|
|
fi
|
|
|
|
log "building $IMAGE (this takes a while: apt + Go + Node downloads)..."
|
|
NAME=tmp-debian-dev-builder
|
|
incus delete --force "$NAME" >/dev/null 2>&1 || true
|
|
if incus launch "$BASE_ALIAS" "$NAME"; then
|
|
# wait until usable
|
|
for i in $(seq 1 60); do
|
|
if incus exec "$NAME" -- /bin/true >/dev/null 2>&1; then break; fi
|
|
sleep 2
|
|
done
|
|
# DNS can lag agent readiness; running apt before it is up fails the update
|
|
# and, without a gate, a broken dev image would still be published.
|
|
DNS_OK=
|
|
for i in $(seq 1 30); do
|
|
if incus exec "$NAME" -- getent hosts deb.debian.org >/dev/null 2>&1; then
|
|
DNS_OK=1; break
|
|
fi
|
|
sleep 2
|
|
done
|
|
if [ -z "$DNS_OK" ]; then
|
|
log " warn: builder never got working DNS; nothing built"
|
|
incus delete --force "$NAME" >/dev/null 2>&1 || true
|
|
incus image delete "$BASE_ALIAS" >/dev/null 2>&1 || true
|
|
elif incus exec "$NAME" -- bash -c 'set -e
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
# universal user tooling (same set as 50-image.sh, but with
|
|
# --no-install-recommends so the dev image stays lean)
|
|
apt-get update -qq
|
|
apt-get install -y -qq --no-install-recommends openssh-server ca-certificates curl wget less bind9-dnsutils openssh-client unzip nano
|
|
# dev toolchain. --no-install-recommends means pip/venv are NOT pulled in by
|
|
# python3 (Debian disables ensurepip), so they are explicit packages here.
|
|
apt-get install -y -qq --no-install-recommends python3 python3-pip python3-venv git sqlite3 ripgrep jq gh sshpass rsync
|
|
# hard gate: never publish an image without sshd baked in (mgr.Provision does
|
|
# NOT rewrite sshd config for vpsmgr/* images)
|
|
command -v sshd >/dev/null || { echo "sshd install failed" >&2; exit 1; }
|
|
mkdir -p /etc/ssh/sshd_config.d
|
|
printf "PermitRootLogin yes\nPasswordAuthentication yes\n" > /etc/ssh/sshd_config.d/99-vpsmgr.conf
|
|
systemctl enable ssh
|
|
# same IPv6 on-link fix as 50-image.sh: containers route peer IPv6 through the
|
|
# host, so the parent prefix must not be treated as on-link
|
|
if [ -f /etc/systemd/network/eth0.network ]; then
|
|
sed -i "s/^DHCP=true$/DHCP=ipv4/" /etc/systemd/network/eth0.network
|
|
printf "\n[IPv6AcceptRA]\nUseGateway=false\nUseOnLinkPrefix=false\nUseRoutePrefix=false\nUseAutonomousPrefix=false\nDHCPv6Client=no\n" >> /etc/systemd/network/eth0.network
|
|
fi
|
|
# --- Go 1.26.7 (manual install, arch-aware, checksum-verified) ---
|
|
GO_VERSION=1.26.7
|
|
case "$(uname -m)" in
|
|
x86_64) GO_ARCH=amd64 ;;
|
|
aarch64) GO_ARCH=arm64 ;;
|
|
*) echo "unsupported arch for Go: $(uname -m)" >&2; exit 1 ;;
|
|
esac
|
|
GO_TAR="go${GO_VERSION}.linux-${GO_ARCH}.tar.gz"
|
|
curl -fsSL -O "https://go.dev/dl/${GO_TAR}"
|
|
# go.dev does not serve a plain .sha256 file for the tarball (the URL
|
|
# redirects to the download page), so the checksum is read from the dl JSON
|
|
# API and compared with jq.
|
|
GO_SHA=$(curl -fsSL "https://go.dev/dl/?mode=json&include=all" | jq -r --arg v "go${GO_VERSION}" --arg f "${GO_TAR}" ".[] | select(.version == \$v) | .files[] | select(.filename == \$f) | .sha256")
|
|
[ -n "$GO_SHA" ] && [ "$(sha256sum "${GO_TAR}" | cut -d" " -f1)" = "$GO_SHA" ] || { echo "go checksum mismatch for ${GO_TAR}" >&2; exit 1; }
|
|
rm -rf /usr/local/go
|
|
tar -C /usr/local -xzf "${GO_TAR}"
|
|
rm -f "${GO_TAR}"
|
|
cat > /etc/profile.d/go.sh <<EOF
|
|
export PATH=\$PATH:/usr/local/go/bin
|
|
export GOPATH=\$HOME/go
|
|
export PATH=\$PATH:\$GOPATH/bin
|
|
EOF
|
|
chmod 644 /etc/profile.d/go.sh
|
|
# --- nvm + Node.js 24 (manual install; nvm needs bash, so the builder runs
|
|
# under bash -c). The container only ever logs in as root, so baking into
|
|
# /root/.nvm covers every user. ---
|
|
export NVM_VERSION=v0.40.7
|
|
export NODE_VERSION=24
|
|
export NVM_DIR=/root/.nvm
|
|
curl -fsSL -o /tmp/nvm-install.sh "https://raw.githubusercontent.com/nvm-sh/nvm/${NVM_VERSION}/install.sh"
|
|
NVM_DIR="${NVM_DIR}" bash /tmp/nvm-install.sh
|
|
rm -f /tmp/nvm-install.sh
|
|
. "${NVM_DIR}/nvm.sh"
|
|
nvm install "${NODE_VERSION}"
|
|
nvm use "${NODE_VERSION}"
|
|
nvm alias default "${NODE_VERSION}"
|
|
NODE_BIN_DIR="$(dirname "$(command -v node)")"
|
|
cat > /etc/profile.d/nodejs.sh <<EOF
|
|
export NVM_DIR="\$HOME/.nvm"
|
|
[ -s "\$NVM_DIR/nvm.sh" ] && . "\$NVM_DIR/nvm.sh"
|
|
export PATH="${NODE_BIN_DIR}:\$PATH"
|
|
EOF
|
|
chmod 644 /etc/profile.d/nodejs.sh
|
|
# hard gates: the dev image must actually ship go + node (PATH here does not
|
|
# yet include /usr/local/go/bin, so check the binaries directly)
|
|
[ -x /usr/local/go/bin/go ] || { echo "go install failed" >&2; exit 1; }
|
|
[ -n "$NODE_BIN_DIR" ] && [ -x "${NODE_BIN_DIR}/node" ] || { echo "node install failed" >&2; exit 1; }
|
|
# profile.d is only read by login shells; non-interactive `ssh host 'cmd'`
|
|
# (CI, rsync, scripts) runs bash -c and would miss go/node. Symlink the tools
|
|
# into /usr/local/bin, which is on the default PATH for every shell. nvm still
|
|
# wins when loaded (its bin dir is prepended), so a later `nvm install` can
|
|
# shadow these.
|
|
ln -sf /usr/local/go/bin/go /usr/local/bin/go
|
|
ln -sf /usr/local/go/bin/gofmt /usr/local/bin/gofmt
|
|
ln -sf "${NODE_BIN_DIR}/node" /usr/local/bin/node
|
|
ln -sf "${NODE_BIN_DIR}/npm" /usr/local/bin/npm
|
|
ln -sf "${NODE_BIN_DIR}/npx" /usr/local/bin/npx
|
|
# vpsmgr TCP tuning: BBR congestion control, larger autotuned buffers, window
|
|
# scaling on, and no slow-start reset after idle (better for long-lived SSH and
|
|
# tunnel connections). Baked into /etc/sysctl.conf so it applies at container
|
|
# boot; sysctl -p is a best-effort apply during the build (an unprivileged
|
|
# container may deny net.* sysctls — that is non-fatal).
|
|
cat >> /etc/sysctl.conf <<SYSCTL
|
|
|
|
# vpsmgr TCP tuning
|
|
net.ipv4.tcp_congestion_control = bbr
|
|
net.ipv4.tcp_rmem = 8192 262144 4194304
|
|
net.ipv4.tcp_wmem = 4096 16384 4194304
|
|
net.ipv4.tcp_window_scaling = 1
|
|
net.ipv4.tcp_slow_start_after_idle = 0
|
|
SYSCTL
|
|
sysctl -p 2>/dev/null || true
|
|
|
|
# slim the published image: apt lists/archives, logs, nvm caches (.cache holds
|
|
# the downloaded node tarballs; .git is the repo cloned by nvm installer), npm
|
|
# and root caches. Without this the image balloons ~150MiB beyond the tools.
|
|
apt-get clean 2>/dev/null || true
|
|
rm -rf /var/lib/apt/lists/* /var/log/* /tmp/* /var/tmp/* 2>/dev/null || true
|
|
rm -rf /root/.nvm/.cache /root/.nvm/.git /root/.npm /root/.cache 2>/dev/null || true
|
|
# A machine-id baked into the image would be shared by every container:
|
|
# systemd-networkd derives its DHCPv6 DUID from it, so two containers look
|
|
# like the same DHCPv6 client and dnsmasq lease renewals break (the global
|
|
# IPv6 drops at the 1h lease mark). Drop it so each container generates its
|
|
# own on first boot.
|
|
rm -f /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null || true'; then
|
|
incus stop "$NAME" --timeout=30 || true
|
|
if incus publish "$NAME" --alias "$IMAGE"; then
|
|
incus delete --force "$NAME" || true
|
|
# keep only the modified image — the Debian base was a build intermediate
|
|
if incus image delete "$BASE_ALIAS" >/dev/null 2>&1; then
|
|
log "removed base image $BASE_ALIAS (only $IMAGE kept)"
|
|
else
|
|
log " warn: could not remove base image $BASE_ALIAS"
|
|
fi
|
|
log "image published: $IMAGE"
|
|
else
|
|
log " warn: publish FAILED — $IMAGE NOT built (base image kept; re-run to retry)"
|
|
incus delete --force "$NAME" >/dev/null 2>&1 || true
|
|
exit 1
|
|
fi
|
|
else
|
|
log " warn: install in builder failed; nothing built"
|
|
incus delete --force "$NAME" >/dev/null 2>&1 || true
|
|
incus image delete "$BASE_ALIAS" >/dev/null 2>&1 || true
|
|
fi
|
|
else
|
|
log " warn: could not launch builder; nothing built"
|
|
fi
|
|
|
|
echo "[80] done"
|