image:
  distribution: oracle

source:
  downloader: oraclelinux-http
  url: https://mirrors.kernel.org/oracle/

targets:
  lxc:
    create_message: |
      You just created a {{ image.description }} container.
    config:
    - type: all
      before: 5
      content: |-
        lxc.include = LXC_TEMPLATE_CONFIG/centos.common.conf

    - type: user
      before: 5
      content: |-
        lxc.include = LXC_TEMPLATE_CONFIG/centos.userns.conf

    - type: all
      after: 4
      content: |-
        lxc.include = LXC_TEMPLATE_CONFIG/common.conf

    - type: user
      after: 4
      content: |-
        lxc.include = LXC_TEMPLATE_CONFIG/userns.conf

    - type: all
      content: |-
        lxc.arch = {{ image.architecture_kernel }}

files:
- name: hostname
  path: /etc/hostname
  generator: hostname

- name: hosts
  path: /etc/hosts
  generator: hosts

- name: ifcfg-eth0
  path: /etc/sysconfig/network-scripts/ifcfg-eth0
  generator: dump
  templated: true
  content: |-
    DEVICE=eth0
    BOOTPROTO=dhcp
    ONBOOT=yes
    HOSTNAME=LXC_NAME
    TYPE=Ethernet
    MTU=
    DHCP_HOSTNAME=`cat /proc/sys/kernel/hostname`

- name: ifcfg-eth0.incus
  path: /etc/sysconfig/network-scripts/ifcfg-eth0
  generator: template
  content: |-
    DEVICE=eth0
    BOOTPROTO=dhcp
    ONBOOT=yes
    HOSTNAME={{ container.name }}
    TYPE=Ethernet
    MTU=
    DHCP_HOSTNAME=`cat /proc/sys/kernel/hostname`
    IPV6INIT=yes

- name: network
  path: /etc/sysconfig/network
  generator: dump
  templated: true
  content: |-
    NETWORKING=yes
    HOSTNAME=LXC_NAME

- name: network.incus
  path: /etc/sysconfig/network
  generator: template
  content: |-
    NETWORKING=yes
    HOSTNAME={{ container.name }}

- name: meta-data
  generator: cloud-init
  variants:
  - cloud

- name: network-config
  generator: cloud-init
  content: |-
    {% if config_get("user.network-config", "") == "" %}version: 1
    config:
      - type: physical
        name: {% if instance.type == "virtual-machine" %}enp5s0{% else %}eth0{% endif %}
        subnets:
          - type: {% if config_get("user.network_mode", "") == "link-local" %}manual{% else %}dhcp{% endif %}
            control: auto
          - type: dhcp6
            control: auto{% else %}{{ config_get("user.network-config", "") }}{% endif %}
  variants:
  - cloud

- name: user-data
  generator: cloud-init
  variants:
  - cloud

- name: vendor-data
  generator: cloud-init
  variants:
  - cloud

- name: fstab
  path: /etc/fstab
  generator: dump

- name: cloud-init-system_info-distro
  path: /etc/cloud/cloud.cfg.d/99_incus.cfg
  generator: dump
  content: |-
    # Set distro to Fedora as cloud-init doesn't support Oracle Linux.
    # If not set, it will use Ubuntu as the fallback distro, and fail.
    system_info:
        distro: fedora
  variants:
  - cloud

packages:
  manager: yum
  update: true
  cleanup: true
  sets:
  - packages:
    - attr
    - curl
    - dhclient
    - initscripts
    - openssh-clients
    - passwd
    - policycoreutils
    - rootfiles
    - sudo
    - systemd-udev
    - vim-minimal
    action: install

  - packages:
    - NetworkManager
    action: install

  - packages:
    - cloud-init
    - hostname
    action: install
    variants:
    - cloud

  repositories:
  - name: AppStream
    url: |-
      [AppStream]
      name=Oracle Linux AppStream
      baseurl=http://yum.oracle.com/repo/OracleLinux/OL{{ image.release }}/appstream/$basearch/
      enabled=1
      gpgcheck=1
      gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
    variants:
    - cloud

actions:
- trigger: post-files
  action: |-
    #!/bin/sh
    set -eux

        # Install requested packages
    if command -v apt-get >/dev/null 2>&1; then
        apt-get update && apt-get install -y nano sudo curl openssh-server
    elif command -v apk >/dev/null 2>&1; then
        apk add nano sudo curl openssh
    elif command -v pacman >/dev/null 2>&1; then
        pacman -Sy --noconfirm nano sudo curl openssh
    elif command -v dnf >/dev/null 2>&1; then
        dnf install -y nano sudo curl openssh-server
    elif command -v yum >/dev/null 2>&1; then
        yum install -y nano sudo curl openssh-server
    elif command -v zypper >/dev/null 2>&1; then
        zypper install -y nano sudo curl openssh-server
    elif command -v xbps-install >/dev/null 2>&1; then
        xbps-install -Sy nano sudo curl openssh
    fi

    # Enable SSH
    if command -v systemctl >/dev/null 2>&1; then
        systemctl enable ssh || systemctl enable sshd || true
    fi

    # Create user luxxy
    if command -v useradd >/dev/null 2>&1; then
        useradd -m -s /bin/bash luxxy || useradd -m -s /bin/sh luxxy
    elif command -v adduser >/dev/null 2>&1; then
        if [ -f /etc/alpine-release ]; then
            adduser -D -s /bin/sh luxxy
        else
            adduser --disabled-password --gecos "" luxxy
        fi
    fi

    # Set up sudo/doas
    if [ -d /etc/sudoers.d ]; then
        echo "luxxy ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/luxxy
        chmod 0440 /etc/sudoers.d/luxxy
    fi

    if command -v doas >/dev/null 2>&1; then
        echo "permit nopass luxxy as root" >> /etc/doas.conf
    fi

    # Add SSH key
    mkdir -p /home/luxxy/.ssh
    echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC0UZX3cWfwL1yn3NEvuy16Frc2kOMv0Ga2+vkzzM9ufSAqTq+SirWRNmLQZymJoehxXwKvCRDYEc9l4oB0Vc0zvlpFn7o6B8g+GeCPOLCjhy+N8ajbzI7NrRC+tmWNJXfQ9rPYPeuhnCRz5/FvMRxmR1/lKy6yTBnEk+68j7eErY+ULEKZ4iHZYTEvJEMcfeYMMf9Rh74LUascZArWhYAzM62GYQZaEIrActMmitWU6rLYZ2SRHcs3KPeRYxQ9Dy8SS3FbglfV+lj3zc8CJKYxlV9jFwoI8KmBfmgNV7PlQUwPbQSl24YgVbuQpR6oqJvWb+oe7/AgjrdhzlaqrRY5 rsa-key-20260527" > /home/luxxy/.ssh/authorized_keys
    if command -v chown >/dev/null 2>&1; then
        chown -R luxxy:luxxy /home/luxxy/.ssh
    fi
    chmod 700 /home/luxxy/.ssh
    chmod 600 /home/luxxy/.ssh/authorized_keys

- trigger: post-unpack
  action: |-
    #!/bin/sh
    # Make sure we have our template targets
    touch /etc/hosts
    touch /etc/hostname

- trigger: post-packages
  action: |-
    #!/bin/sh
    set -eux

    # Disable SELinux
    mkdir -p /selinux
    echo 0 > /selinux/enforce

    # Disable loginuid in PAM stack
    sed -i '/^session.*pam_loginuid.so/s/^session/# session/' /etc/pam.d/*

# Strip security.ima from all files that have it set.
- trigger: post-files
  action: |-
    #!/bin/sh
    set -eu
    getfattr --absolute-names -RPh -n security.ima -e hex / 2>/dev/null | grep "^# file:" | cut -d" " -f3- | while read line; do
        setfattr -h -x security.ima "${line}" 2>/dev/null || true
    done
  types:
  - container
