Commit b748b415 authored by jan.koester's avatar jan.koester
Browse files

test

parent 9a868f9a

debian/blogi.nspawn

+1 −6
Original line number Diff line number Diff line
@@ -6,12 +6,7 @@ WorkingDirectory=/var/lib/blogi 
NotifyReady=no



[Files]

# Read-only bind mounts for the binary and plugins

BindReadOnly=/usr/bin/blogi

BindReadOnly=/usr/lib/blogi

BindReadOnly=/usr/share/blogi



# Configuration

# Configuration from host

BindReadOnly=/etc/blogi



# Writable state directory

debian/blogi.postinst

+4 −2
Original line number Diff line number Diff line
@@ -38,8 +38,10 @@ case "$1" in 
            chmod 644 /etc/blogi/ssl/cert.der

        fi



        # Setup nspawn container rootfs

        /usr/lib/blogi/container-setup.sh

        # Ensure container state directory ownership

        if [ -d /opt/blogi/var/lib/blogi ]; then

            chown 999:999 /opt/blogi/var/lib/blogi

        fi

        ;;

esac

debian/blogi.service

+1 −2
Original line number Diff line number Diff line
@@ -4,10 +4,9 @@ After=network.target authdb.service 


[Service]

Type=simple

ExecStartPre=/usr/lib/blogi/container-setup.sh

ExecStart=/usr/bin/systemd-nspawn \

    --machine=blogi \

    --directory=/var/lib/machines/blogi \

    --directory=/opt/blogi \

    --settings=override \

    --keep-unit \

    --quiet

debian/container-setup.sh

+9 −36
Original line number Diff line number Diff line 
#!/bin/sh

# container-setup.sh — Create minimal nspawn rootfs for blogi

# musl-linked binary needs no glibc, just a bare filesystem

# container-setup.sh — Ensure runtime state for blogi nspawn container

# The chroot at /opt/blogi is pre-built in the .deb package.

# This script only fixes up ownership after install.

set -e



MACHINE_DIR="/var/lib/machines/blogi"

CHROOT="/opt/blogi"



echo "Setting up blogi container rootfs at $MACHINE_DIR ..."

# Ensure blogi user owns the state directory inside the chroot

if [ -d "$CHROOT/var/lib/blogi" ]; then

    chown 999:999 "$CHROOT/var/lib/blogi"

fi



# Create minimal directory structure

mkdir -p "$MACHINE_DIR/usr/bin"

mkdir -p "$MACHINE_DIR/usr/lib/blogi/plugins"

mkdir -p "$MACHINE_DIR/usr/share/blogi"

mkdir -p "$MACHINE_DIR/etc/blogi/ssl"

mkdir -p "$MACHINE_DIR/var/lib/blogi"

mkdir -p "$MACHINE_DIR/proc"

mkdir -p "$MACHINE_DIR/sys"

mkdir -p "$MACHINE_DIR/dev"

mkdir -p "$MACHINE_DIR/run"

mkdir -p "$MACHINE_DIR/tmp"



# Create minimal /etc files for the container

echo "blogi" > "$MACHINE_DIR/etc/hostname"

cat > "$MACHINE_DIR/etc/os-release" <<'EOF'

PRETTY_NAME="blogi container"

NAME="blogi"

EOF



# Create blogi user/group inside container

echo "root:x:0:0:root:/root:/bin/false" > "$MACHINE_DIR/etc/passwd"

echo "blogi:x:999:999:blogi:/var/lib/blogi:/bin/false" >> "$MACHINE_DIR/etc/passwd"

echo "root:x:0:" > "$MACHINE_DIR/etc/group"

echo "blogi:x:999:" >> "$MACHINE_DIR/etc/group"

echo "root:!:1::::::" > "$MACHINE_DIR/etc/shadow"

echo "blogi:!:1::::::" >> "$MACHINE_DIR/etc/shadow"

chmod 640 "$MACHINE_DIR/etc/shadow"



# Set ownership for state directory

chown 999:999 "$MACHINE_DIR/var/lib/blogi"



echo "blogi container rootfs ready."
 
echo "blogi container ready."

debian/rules

+40 −2
Original line number Diff line number Diff line
@@ -49,10 +49,48 @@ override_dh_install: 
	dh_install

ifneq ($(IS_EDITOR),)

	@echo "Editor build — skipping server config files"

else ifneq ($(IS_NSPAWN),)

	@echo "Nspawn build — assembling complete chroot at /opt/blogi"

	# musl dynamic linker (binary interpreter: /lib/ld-musl-x86_64.so.1)

	mkdir -p debian/blogi/opt/blogi/lib

	cp -a /usr/local/musl/lib/ld-musl-x86_64.so.1 debian/blogi/opt/blogi/lib/

	# musl libc (RUNPATH: /usr/local/musl/lib)

	mkdir -p debian/blogi/opt/blogi/usr/local/musl/lib

	cp -a /usr/local/musl/lib/libc.so debian/blogi/opt/blogi/usr/local/musl/lib/

	# All musl-built shared libraries (RUNPATH: /usr/local/lib)

	mkdir -p debian/blogi/opt/blogi/usr/local/lib

	cp -a /usr/local/lib/*.so* debian/blogi/opt/blogi/usr/local/lib/

	# blogi binary

	mkdir -p debian/blogi/opt/blogi/usr/bin

	cp -a debian/blogi/usr/bin/blogi debian/blogi/opt/blogi/usr/bin/

	# blogi plugins

	mkdir -p debian/blogi/opt/blogi/usr/lib/blogi/plugins

	-cp -a debian/blogi/usr/lib/blogi/plugins/*.so debian/blogi/opt/blogi/usr/lib/blogi/plugins/

	# blogidev library (plugin runtime dependency)

	-cp -a debian/blogi/usr/lib/blogi/libblogidev.* debian/blogi/opt/blogi/usr/lib/blogi/

	# Static content (templates, JS, CSS)

	mkdir -p debian/blogi/opt/blogi/usr/share/blogi

	-cp -a debian/blogi/usr/share/blogi/* debian/blogi/opt/blogi/usr/share/blogi/

	# Minimal container filesystem

	mkdir -p debian/blogi/opt/blogi/etc/blogi/ssl

	mkdir -p debian/blogi/opt/blogi/var/lib/blogi

	mkdir -p debian/blogi/opt/blogi/proc

	mkdir -p debian/blogi/opt/blogi/sys

	mkdir -p debian/blogi/opt/blogi/dev

	mkdir -p debian/blogi/opt/blogi/run

	mkdir -p debian/blogi/opt/blogi/tmp

	# Container user database

	echo "root:x:0:0:root:/root:/bin/false" > debian/blogi/opt/blogi/etc/passwd

	echo "blogi:x:999:999:blogi:/var/lib/blogi:/bin/false" >> debian/blogi/opt/blogi/etc/passwd

	echo "root:x:0:" > debian/blogi/opt/blogi/etc/group

	echo "blogi:x:999:" >> debian/blogi/opt/blogi/etc/group

	# nspawn and systemd config

	install -D -m 644 debian/blogi.nspawn debian/blogi/etc/systemd/nspawn/blogi.nspawn

	install -D -m 644 debian/blogi.default-config.yaml debian/blogi/usr/share/blogi/blogi.default-config.yaml

	install -D -m 644 debian/blogi.tmpfiles debian/blogi/usr/lib/tmpfiles.d/blogi.conf

	install -D -m 644 debian/blogi.sysusers debian/blogi/usr/lib/sysusers.d/blogi.conf

else

	install -D -m 644 debian/blogi.default-config.yaml debian/blogi/usr/share/blogi/blogi.default-config.yaml

	install -D -m 644 debian/blogi.tmpfiles debian/blogi/usr/lib/tmpfiles.d/blogi.conf

	install -D -m 644 debian/blogi.sysusers debian/blogi/usr/lib/sysusers.d/blogi.conf

	install -D -m 644 debian/blogi.nspawn debian/blogi/etc/systemd/nspawn/blogi.nspawn

	install -D -m 755 debian/container-setup.sh debian/blogi/usr/lib/blogi/container-setup.sh

endif