test

[Unit]

Description=Setup blogi nspawn container rootfs

ConditionPathExists=!/var/lib/machines/blogi/usr/bin/blogi

Before=blogi.service

[Service]

Type=oneshot

RemainAfterExit=yes

ExecStart=/usr/lib/blogi/container-setup.sh

[Install]

WantedBy=multi-user.target

[Exec]

Boot=no

Parameters=/usr/bin/blogi -c yaml:/etc/blogi/config.yaml -f true

WorkingDirectory=/var/lib/blogi

PrivateUsers=pick

NotifyReady=yes

[Files]

# Read-only bind mounts for the binary and plugins

BindReadOnly=/usr/bin/blogi

BindReadOnly=/usr/lib/blogi

BindReadOnly=/usr/share/blogi

# Configuration (read-only from container perspective)

BindReadOnly=/etc/blogi

# Writable state directory

Bind=/var/lib/blogi

# SSL certificates (read-only, renewed by host)

BindReadOnly=/etc/blogi/ssl

# DNS resolution

BindReadOnly=/etc/resolv.conf

[Network]

VirtualEthernet=no

Port=tcp:8080:8080

Port=tcp:8443:8443

case "$1" in

    configure)

        # Create system user if it does not exist

        # Create system user on the host (for file ownership)

        if ! getent passwd blogi >/dev/null 2>&1; then

            adduser --system --group --home /var/lib/blogi \

                --no-create-home --disabled-login --quiet blogi

            chmod 600 /etc/blogi/ssl/key.der

            chmod 644 /etc/blogi/ssl/cert.der

        fi

        # Setup nspawn container rootfs

        /usr/lib/blogi/container-setup.sh

        # Enable and start container-setup and blogi services

        if [ -d /run/systemd/system ]; then

            systemctl daemon-reload

            systemctl enable blogi-container-setup.service blogi.service

        fi

        ;;

esac

[Unit]

Description=Blogi Blog Engine Server

Description=Blogi Blog Engine Server (nspawn container)

After=network.target authdb.service

Requires=blogi-container-setup.service

[Service]

Type=simple

AmbientCapabilities=CAP_NET_BIND_SERVICE

ExecStart=/usr/bin/blogi -c yaml:/etc/blogi/config.yaml -f true

Type=notify

ExecStart=/usr/bin/systemd-nspawn \

    --machine=blogi \

    --directory=/var/lib/machines/blogi \

    --settings=override \

    --notify-ready=yes \

    --keep-unit \

    --quiet

Restart=on-failure

RestartSec=5

User=blogi

Group=blogi

StateDirectory=blogi

ConfigurationDirectory=blogi

ProtectSystem=strict

ReadWritePaths=/var/lib/blogi

KillMode=mixed

TimeoutStopSec=30

# Hardening

ProtectHome=yes

NoNewPrivileges=yes

PrivateTmp=yes

[Install]

#!/bin/sh

# container-setup.sh — Create minimal nspawn rootfs for blogi

# musl-linked binary needs no glibc, just a bare filesystem

set -e

MACHINE_DIR="/var/lib/machines/blogi"

echo "Setting up blogi container rootfs at $MACHINE_DIR ..."

# Create minimal directory structure

mkdir -p "$MACHINE_DIR"/{usr/bin,usr/lib/blogi/plugins,usr/share/blogi}

mkdir -p "$MACHINE_DIR"/{etc/blogi/ssl,var/lib/blogi}

mkdir -p "$MACHINE_DIR"/{proc,sys,dev,run,tmp}

# Create minimal /etc files for the container

echo "blogi" > "$MACHINE_DIR/etc/hostname"

cat > "$MACHINE_DIR/etc/os-release" <<'EOF'

PRETTY_NAME="blogi container"

NAME="blogi"

EOF

# Create blogi user/group inside container

echo "root:x:0:0:root:/root:/bin/false" > "$MACHINE_DIR/etc/passwd"

echo "blogi:x:999:999:blogi:/var/lib/blogi:/bin/false" >> "$MACHINE_DIR/etc/passwd"

echo "root:x:0:" > "$MACHINE_DIR/etc/group"

echo "blogi:x:999:" >> "$MACHINE_DIR/etc/group"

echo "root:!:1::::::" > "$MACHINE_DIR/etc/shadow"

echo "blogi:!:1::::::" >> "$MACHINE_DIR/etc/shadow"

chmod 640 "$MACHINE_DIR/etc/shadow"

# Set ownership for state directory

chown 999:999 "$MACHINE_DIR/var/lib/blogi"

echo "blogi container rootfs ready."