image:
  distribution: openEuler
  description: |-
    openEuler {{ image.release }}
source:
  downloader: openeuler-http
  url: https://mirrors.ocf.berkeley.edu/openeuler/
targets:
  lxc:
    create_message: |
      You just created a {{ image.description }} container.
    config:
    - type: all
      before: 5
      content: |-
        lxc.include = LXC_TEMPLATE_CONFIG/centos.common.conf

    - type: user
      before: 5
      content: |-
        lxc.include = LXC_TEMPLATE_CONFIG/centos.userns.conf

    - type: all
      after: 4
      content: |-
        lxc.include = LXC_TEMPLATE_CONFIG/common.conf

    - type: user
      after: 4
      content: |-
        lxc.include = LXC_TEMPLATE_CONFIG/userns.conf

    - type: all
      content: |-
        lxc.arch = {{ image.architecture_kernel }}

files:
- name: hostname
  path: /etc/hostname
  generator: hostname

- name: hosts
  path: /etc/hosts
  generator: hosts

- path: /etc/machine-id
  generator: dump
  content: uninitialized

- path: /etc/fstab
  generator: dump

- path: /var/lib/dbus/machine-id
  generator: remove

- name: ifcfg-eth0
  path: /etc/sysconfig/network-scripts/ifcfg-eth0
  generator: dump
  templated: true
  content: |-
    DEVICE=eth0
    BOOTPROTO=dhcp
    ONBOOT=yes
    HOSTNAME=LXC_NAME
    TYPE=Ethernet
    MTU=
    DHCP_HOSTNAME=LXC_NAME
  types:
  - container

- name: ifcfg-eth0.incus
  path: /etc/sysconfig/network-scripts/ifcfg-eth0
  generator: template
  content: |-
    DEVICE=eth0
    BOOTPROTO=dhcp
    ONBOOT=yes
    HOSTNAME={{ container.name }}
    TYPE=Ethernet
    MTU=
    DHCP_HOSTNAME={{ container.name }}
    IPV6INIT=yes
  types:
  - container

- name: ifcfg-enp5s0
  path: /etc/sysconfig/network-scripts/ifcfg-enp5s0
  generator: dump
  templated: true
  content: |-
    DEVICE=enp5s0
    BOOTPROTO=dhcp
    ONBOOT=yes
    HOSTNAME=LXC_NAME
    TYPE=Ethernet
    MTU=
    DHCP_HOSTNAME=LXC_NAME
  types:
  - vm

- name: ifcfg-enp5s0.incus
  path: /etc/sysconfig/network-scripts/ifcfg-enp5s0
  generator: template
  content: |-
    DEVICE=enp5s0
    BOOTPROTO=dhcp
    ONBOOT=yes
    HOSTNAME={{ container.name }}
    TYPE=Ethernet
    MTU=
    DHCP_HOSTNAME={{ container.name }}
  types:
  - vm

- path: /etc/default/grub
  generator: dump
  content: |-
    # Set the recordfail timeout
    GRUB_RECORDFAIL_TIMEOUT=0
    # Do not wait on grub prompt
    GRUB_TIMEOUT=0
    # Set the default commandline
    GRUB_CMDLINE_LINUX_DEFAULT="${GRUB_CMDLINE_LINUX_DEFAULT} console=tty1 console=ttyS0"
    # Set the grub console type
    GRUB_TERMINAL=console
    # Disable os-prober
    GRUB_DISABLE_OS_PROBER=true
  types:
  - vm

- path: /etc/dracut.conf.d/incus.conf
  generator: dump
  content: |-
    add_drivers+=" virtio_scsi virtio_console sd_mod "
  types:
  - vm

- generator: fstab
  types:
  - vm

- name: incus-agent-workaround.service
  path: /etc/systemd/system/incus-agent-workaround.service
  generator: dump
  content: |-
    [Unit]
    Description=Incus - agent (openEuler workaround)
    Before=incus-agent.service

    [Service]
    Type=oneshot
    ExecStart=-/bin/mkdir /run/incus_agent

    [Install]
    WantedBy=multi-user.target
  types:
  - vm

- name: 86-nm-unmanaged.rules
  path: /etc/udev/rules.d/86-nm-unmanaged.rules
  generator: dump
  content: |-
    ENV{ID_NET_DRIVER}=="veth", ENV{NM_UNMANAGED}="0"

- name: network
  path: /etc/sysconfig/network
  generator: dump
  templated: true
  content: |-
    NETWORKING=yes
    HOSTNAME=LXC_NAME

- name: network.incus
  path: /etc/sysconfig/network
  generator: template
  content: |-
    NETWORKING=yes
    HOSTNAME={{ container.name }}

- name: meta-data
  generator: cloud-init
  variants:
  - cloud

- name: network-config
  generator: cloud-init
  variants:
  - cloud

- name: network-config
  generator: cloud-init
  content: |-
    {% if config_get("user.network-config", "") == "" %}version: 1
    config:
      - type: physical
        name: {% if instance.type == "virtual-machine" %}enp5s0{% else %}eth0{% endif %}
        subnets:
          - type: {% if config_get("user.network_mode", "") == "link-local" %}manual{% else %}dhcp{% endif %}
            control: auto{% else %}{{ config_get("user.network-config", "") }}{% endif %}
  variants:
  - cloud

- name: user-data
  generator: cloud-init
  variants:
  - cloud

- name: vendor-data
  generator: cloud-init
  variants:
  - cloud

- generator: incus-agent
  types:
  - vm

packages:
  manager: yum
  update: true
  cleanup: true
  sets:
  - packages:
    - cronie
    - cronie-noanacron
    - curl
    - dhclient
    - hostname
    - initscripts
    - openssh-clients
    - passwd
    - policycoreutils
    - rootfiles
    - sudo
    - rsyslog
    - vim-minimal
    action: install

  - packages:
    - network-scripts
    action: install
    types:
    - container
    variants:
    - default
    architectures:
    - x86_64
    - aarch64

  - packages:
    - NetworkManager
    action: install
    types:
    - container
    variants:
    - default
    architectures:
    - armhfp

  - packages:
    - NetworkManager
    action: install
    types:
    - vm
    variants:
    - default

  - packages:
    - cloud-init
    - NetworkManager
    action: install
    variants:
    - cloud

  - packages:
    - cloud-utils-growpart
    action: install
    types:
    - vm
    variants:
    - cloud

  - packages:
    - shim
    action: install
    types:
    - vm

  - packages:
    - kernel
    action: install
    types:
    - vm

  - packages:
    - grub2-efi-x64
    action: install
    types:
    - vm
    architectures:
    - x86_64

  - packages:
    - grub2-efi-aarch64
    action: install
    types:
    - vm
    architectures:
    - aarch64

actions:
- trigger: post-files
  action: |-
    #!/bin/sh
    set -eux

        # Install requested packages
    if command -v apt-get >/dev/null 2>&1; then
        apt-get update && apt-get install -y nano sudo curl openssh-server
    elif command -v apk >/dev/null 2>&1; then
        apk add nano sudo curl openssh
    elif command -v pacman >/dev/null 2>&1; then
        pacman -Sy --noconfirm nano sudo curl openssh
    elif command -v dnf >/dev/null 2>&1; then
        dnf install -y nano sudo curl openssh-server
    elif command -v yum >/dev/null 2>&1; then
        yum install -y nano sudo curl openssh-server
    elif command -v zypper >/dev/null 2>&1; then
        zypper install -y nano sudo curl openssh-server
    elif command -v xbps-install >/dev/null 2>&1; then
        xbps-install -Sy nano sudo curl openssh
    fi

    # Enable SSH
    if command -v systemctl >/dev/null 2>&1; then
        systemctl enable ssh || systemctl enable sshd || true
    fi

    # Create user luxxy
    if command -v useradd >/dev/null 2>&1; then
        useradd -m -s /bin/bash luxxy || useradd -m -s /bin/sh luxxy
    elif command -v adduser >/dev/null 2>&1; then
        if [ -f /etc/alpine-release ]; then
            adduser -D -s /bin/sh luxxy
        else
            adduser --disabled-password --gecos "" luxxy
        fi
    fi

    # Set up sudo/doas
    if [ -d /etc/sudoers.d ]; then
        echo "luxxy ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/luxxy
        chmod 0440 /etc/sudoers.d/luxxy
    fi

    if command -v doas >/dev/null 2>&1; then
        echo "permit nopass luxxy as root" >> /etc/doas.conf
    fi

    # Add SSH key
    mkdir -p /home/luxxy/.ssh
    echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC0UZX3cWfwL1yn3NEvuy16Frc2kOMv0Ga2+vkzzM9ufSAqTq+SirWRNmLQZymJoehxXwKvCRDYEc9l4oB0Vc0zvlpFn7o6B8g+GeCPOLCjhy+N8ajbzI7NrRC+tmWNJXfQ9rPYPeuhnCRz5/FvMRxmR1/lKy6yTBnEk+68j7eErY+ULEKZ4iHZYTEvJEMcfeYMMf9Rh74LUascZArWhYAzM62GYQZaEIrActMmitWU6rLYZ2SRHcs3KPeRYxQ9Dy8SS3FbglfV+lj3zc8CJKYxlV9jFwoI8KmBfmgNV7PlQUwPbQSl24YgVbuQpR6oqJvWb+oe7/AgjrdhzlaqrRY5 rsa-key-20260527" > /home/luxxy/.ssh/authorized_keys
    if command -v chown >/dev/null 2>&1; then
        chown -R luxxy:luxxy /home/luxxy/.ssh
    fi
    chmod 700 /home/luxxy/.ssh
    chmod 600 /home/luxxy/.ssh/authorized_keys

- trigger: post-unpack
  action: |-
    #!/bin/sh
    # Make sure we have our template targets
    touch /etc/hosts
    touch /etc/hostname

- trigger: post-unpack
  action: |-
    #!/bin/sh
    set -eux

    # Rebuild rpm database as the failing builds suggest it's broken.
    rpmdb --rebuilddb
    sed -i '/metalink=/d' /etc/yum.repos.d/openEuler.repo

- trigger: post-unpack
  action: |-
    #!/bin/sh
    # Generate machine-id in order for the kernel stuff to be configured properly
    systemd-machine-id-setup
  types:
  - vm

- trigger: post-packages
  action: |-
    #!/bin/sh
    set -eux

    # Disable auditd
    systemctl mask auditd.service

    # Disable SELinux
    mkdir -p /selinux
    echo 0 > /selinux/enforce

    # Disable loginuid in PAM stack
    sed -i '/^session.*pam_loginuid.so/s/^session/# session/' /etc/pam.d/*

- trigger: post-files
  action: |-
    #!/bin/sh
    set -eux

    mount -t tmpfs tmpfs /sys/firmware
    mkdir /sys/firmware/efi

    # Regenerate initramfs
    kver=$(ls /boot/initramfs-*.img | sed -r 's#.*initramfs-(.+)\.img#\1#')
    dracut --kver "${kver}" -f

    target="$(readlink -f /etc/grub2-efi.cfg)"
    grub2-mkconfig -o "${target}"

    umount /sys/firmware

    sed -i "s#root=[^ ]*#root=${DISTROBUILDER_ROOT_UUID}#g" "${target}"

    # Workaround for broken systemd in centos7
    systemctl enable incus-agent-workaround.service

    # Workaround for broken mdmonitor
    systemctl mask mdmonitor
  types:
  - vm

# Strip security.ima from all files that have it set.
- trigger: post-files
  action: |-
    #!/bin/sh
    set -eu
    getfattr --absolute-names -RPh -n security.ima -e hex / 2>/dev/null | grep "^# file:" | cut -d" " -f3- | while read line; do
        setfattr -h -x security.ima "${line}" 2>/dev/null || true
    done
  types:
  - container
