Compare commits
No commits in common. "27216154974bf6b199c52b30a8575cc65e1520cd" and "3def4f190807d7d928a2c8250462696f0815266c" have entirely different histories.
2721615497
...
3def4f1908
@ -1,3 +0,0 @@
|
||||
(channel
|
||||
(name 'metznet-channel)
|
||||
(url "https://git.metznet.ca/MetzNet/metznet-channel"))
|
||||
@ -1,8 +0,0 @@
|
||||
(channel
|
||||
(name 'nonguix)
|
||||
(url "https://gitlab.com/nonguix/nonguix")
|
||||
(introduction
|
||||
(make-channel-introduction
|
||||
"897c1a470da759236cc11798f4e0a5f7d4d59fbc"
|
||||
(openpgp-fingerprint
|
||||
"2A39 3FFF 68F4 EF7A 3D29 12AF 6F51 20A0 22FB B2D5"))))
|
||||
@ -1,10 +0,0 @@
|
||||
(channel
|
||||
(name 'guix-gaming-games)
|
||||
(url "https://gitlab.com/guix-gaming-channels/games.git")
|
||||
;; Enable signature verification:
|
||||
(introduction
|
||||
(make-channel-introduction
|
||||
"c23d64f1b8cc086659f8781b27ab6c7314c5cca5"
|
||||
(openpgp-fingerprint
|
||||
"50F3 3E2E 5B0C 3D90 0424 ABE8 9BDC F497 A4BB CC7F"))))
|
||||
|
||||
@ -1,10 +0,0 @@
|
||||
;; channels.scm -- reads the channels.d dir to get a list of channel objects
|
||||
|
||||
(use-modules (gnu) ((ice-9 ftw) #:select (scandir)))
|
||||
|
||||
(define channel-files
|
||||
(scandir "./channels.d"
|
||||
(lambda (file)
|
||||
(string-suffix? ".scm" file))))
|
||||
|
||||
(append (map (lambda (file) (load (string-append "./channels.d/" file))) channel-files) %default-channels)
|
||||
@ -1,21 +0,0 @@
|
||||
services:
|
||||
guix:
|
||||
platform: linux/amd64
|
||||
build:
|
||||
context: docker
|
||||
volumes:
|
||||
- guix-store:/gnu
|
||||
- guix-state:/var/guix
|
||||
- guix-cache:/root/.cache
|
||||
- .:/workspace
|
||||
working_dir: /workspace
|
||||
environment:
|
||||
DOMAIN_CAPS: ${DOMAIN_CAPS:-METZNET.CA}
|
||||
DOMAIN_NAME: ${DOMAIN_NAME:-metznet.ca}
|
||||
tty: true
|
||||
stdin_open: true
|
||||
|
||||
volumes:
|
||||
guix-store:
|
||||
guix-state:
|
||||
guix-cache:
|
||||
@ -1,38 +0,0 @@
|
||||
# Guix build environment for building `guix system docker-image` images
|
||||
# from this repo on a machine (e.g. macOS) that can't run Guix natively.
|
||||
#
|
||||
# Guix state lives under /gnu and /var/guix, which the compose file mounts
|
||||
# as named volumes so pulls/builds are cached across container runs. This
|
||||
# image only bakes in the *initial* binary install; everything built via
|
||||
# `guix pull` / `guix system` happens at `docker run` time against those
|
||||
# volumes.
|
||||
FROM debian:bookworm-slim
|
||||
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
bash gnupg dirmngr wget ca-certificates xz-utils tar locales procps sudo netbase \
|
||||
&& rm -rf /var/lib/apt/lists/* \
|
||||
&& sed -i '/en_US.UTF-8/s/^# //' /etc/locale.gen \
|
||||
&& locale-gen
|
||||
|
||||
# Official installer: extracts the binary tarball to /gnu and /var/guix,
|
||||
# creates the guixbuild group/users, and (since no init system is present
|
||||
# in the container) prints instructions to run guix-daemon manually, which
|
||||
# entrypoint.sh does. `yes ''` answers every prompt with its default,
|
||||
# which includes authorizing the ci.guix.gnu.org / bordeaux substitute
|
||||
# servers so builds don't compile everything from source.
|
||||
RUN wget -O /tmp/guix-install.sh https://guix.gnu.org/guix-install.sh \
|
||||
&& chmod +x /tmp/guix-install.sh \
|
||||
&& yes '' | /tmp/guix-install.sh \
|
||||
&& rm -f /tmp/guix-install.sh \
|
||||
&& test -x /root/.config/guix/current/bin/guix
|
||||
|
||||
ENV PATH="/root/.config/guix/current/bin:/usr/local/bin:${PATH}" \
|
||||
GUIX_LOCPATH="/root/.config/guix/current/lib/locale" \
|
||||
LANG="en_US.UTF-8"
|
||||
|
||||
COPY entrypoint.sh /usr/local/bin/entrypoint.sh
|
||||
RUN chmod +x /usr/local/bin/entrypoint.sh
|
||||
|
||||
WORKDIR /workspace
|
||||
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
|
||||
CMD ["bash"]
|
||||
@ -1,135 +0,0 @@
|
||||
# Guix-in-Docker build environment
|
||||
|
||||
Guix has no native macOS build, so this runs a Debian container with Guix
|
||||
installed (official binary tarball) as the build machine, and uses
|
||||
`guix system docker-image` to turn `metznet/machines/*.scm` into Docker
|
||||
images you can `docker load`/`docker run` directly in Docker Desktop. No
|
||||
QEMU/KVM required, which is why it works on macOS where `scripts/qemu.sh`
|
||||
(KVM-only) does not.
|
||||
|
||||
The builder container runs as `linux/amd64` (via Rosetta on Apple
|
||||
Silicon), matching real deployment hardware — nonguix substitutes are
|
||||
x86_64-focused, so building on aarch64 forces a lot of expensive
|
||||
from-source builds (and occasionally hits GCC/architecture edge cases)
|
||||
that just don't happen on amd64.
|
||||
|
||||
## Why this works without a bootloader/kernel/real disks
|
||||
|
||||
`guix system docker-image` (and `guix system container`) transform the
|
||||
`operating-system` value before building: the real `kernel`, `bootloader`,
|
||||
and `file-systems` fields are all replaced/ignored (see
|
||||
`containerized-operating-system` in Guix's `gnu/system/linux-container.scm`),
|
||||
along with services that make no sense in a container (`mingetty`,
|
||||
`agetty`, static networking). Nothing in `metznet/machines/*.scm` needs to
|
||||
change for this to work.
|
||||
|
||||
What *isn't* swapped out: services like `dhcpcd-service-type` and
|
||||
`openvpn-client-service-type` (in `%metznet-server-services`) will still
|
||||
try to run and will likely fail/hang inside a container (no real DHCP
|
||||
server or VPN endpoint reachable) — that's expected. Pass `-N`/`--network`
|
||||
(the `image` subcommand below always does) so a dummy `networking`
|
||||
shepherd service is provided up front; other services that just
|
||||
`(requirement '(networking ...))` (openssh, slapd, kdc) come up fine
|
||||
regardless of whether the DHCP/VPN services themselves succeed.
|
||||
|
||||
## Container internals (why the Dockerfile/entrypoint look the way they do)
|
||||
|
||||
- `netbase` is installed explicitly: `debian:bookworm-slim` ships without
|
||||
`/etc/services`, and Guile's `getaddrinfo` needs it to resolve `https`/
|
||||
`http` as service names. Without it, every network fetch inside Guix
|
||||
(substitutes, source downloads, even channel git clones from the *guix
|
||||
pull* subprocess) fails with a cryptic `In procedure getaddrinfo:
|
||||
Servname not supported for ai_socktype` — nothing to do with DNS or
|
||||
certs despite how it reads.
|
||||
- `entrypoint.sh` starts `guix-daemon --disable-chroot`. Sandboxed builds
|
||||
normally isolate via Linux namespaces (`unshare`/`clone`), which Docker
|
||||
blocks by default even for root (`clone: Operation not permitted`).
|
||||
We're already isolated by the outer container, so build isolation is
|
||||
traded away here rather than running the whole thing `--privileged`.
|
||||
One side effect: guix-daemon's store-path grafting (security-patch
|
||||
rewriting) hits a permission error creating output files under
|
||||
`--disable-chroot`, so `scripts/guix-docker.sh image` always passes
|
||||
`--no-grafts` (uses un-grafted originals instead — fine for testing).
|
||||
- It also always kills and restarts `guix-daemon` rather than checking
|
||||
if its socket already exists: `/var/guix` is a persistent volume, so a
|
||||
*stale* socket file from a previous (already-exited) container can
|
||||
still be sitting there even though nothing is listening on it.
|
||||
- `ps` (and possibly other procps tools) crash reliably under Rosetta
|
||||
with `assertion failed [true_path_length_self >= 0]` — a Rosetta bug,
|
||||
not a Guix issue. Doesn't affect the actual build; just don't rely on
|
||||
`docker exec <container> ps` to check progress. `du -sh /gnu/store` or
|
||||
watching the log works fine.
|
||||
|
||||
## One-time setup
|
||||
|
||||
```
|
||||
scripts/guix-docker.sh build # builds the builder image (~1-2 min)
|
||||
scripts/guix-docker.sh pull # guix pull -C channels.scm
|
||||
```
|
||||
|
||||
`pull` needs network access to gitlab.com (nonguix, nonguix-games),
|
||||
git.metznet.ca, and Savannah/git.guix.gnu.org. Re-run it whenever
|
||||
`channels.scm`/`channels.d/*.scm` change. The main `guix` channel alone
|
||||
is ~14.8k commits to authenticate the first time, which is genuinely slow
|
||||
(several minutes of CPU) — after that it's cached (see below) and
|
||||
re-pulls are fast.
|
||||
|
||||
Guix's store (`/gnu`), daemon state (`/var/guix`), and git-checkout/
|
||||
authentication cache (`/root/.cache`, notably `~/.cache/guix/checkouts`
|
||||
and `~/.cache/guix/authentication`) all live in named Docker volumes, so
|
||||
none of that expensive work repeats across runs. `docker compose down -v`
|
||||
wipes everything if you ever want a clean slate (necessary if you ever
|
||||
switch the `platform:` in `docker-compose.yml` — a store built for one
|
||||
architecture isn't usable from another).
|
||||
|
||||
## Building a system as a docker image
|
||||
|
||||
```
|
||||
scripts/guix-docker.sh image metznet/machines/ldap.scm
|
||||
docker load < build/ldap.tar.gz
|
||||
docker run --rm -it <image-id-or-name> /run/current-system/profile/bin/bash --login
|
||||
```
|
||||
|
||||
or do build+load+run in one step:
|
||||
|
||||
```
|
||||
scripts/guix-docker.sh load-run metznet/machines/ldap.scm
|
||||
```
|
||||
|
||||
`image`/`load-run` pass `-L /workspace` (this checkout, bind-mounted
|
||||
live), so uncommitted local edits to any `metznet/**` module are picked
|
||||
up directly — no commit/pull round-trip needed, unlike a real `guix
|
||||
pull` on a deployed machine.
|
||||
|
||||
`DOMAIN_CAPS`/`DOMAIN_NAME` default to `METZNET.CA`/`metznet.ca` in
|
||||
`docker-compose.yml`, matching `scripts/qemu.sh`; override by exporting
|
||||
them before calling `guix-docker.sh`, or in a `.env` file next to
|
||||
`docker-compose.yml`.
|
||||
|
||||
Once running, `herd status` inside the container shows shepherd service
|
||||
state — useful for checking whether e.g. `slapd` actually came up.
|
||||
|
||||
## Known gotchas
|
||||
|
||||
- `channels.d/metznet.scm` has no `introduction`, so `guix pull` doesn't
|
||||
authenticate it (unlike nonguix/games, which do).
|
||||
- `metznet/machines/otto.scm` (Noah's laptop) has `firefox` and the ARM
|
||||
embedded toolchain (`make-arm-none-eabi-toolchain-7-2018-q2-update`)
|
||||
removed from its package list — both require building an entire
|
||||
LLVM/Clang toolchain from scratch (no substitute currently available,
|
||||
even on x86_64), which is impractical for routine testing. Add them
|
||||
back with `(make-arm-none-eabi-toolchain-7-2018-q2-update)` (a
|
||||
zero-arg constructor from `(gnu packages embedded)`, not a bare
|
||||
package name — that changed upstream) and `firefox` (from `(nongnu
|
||||
packages mozilla)`) if you need them for a real build/deploy.
|
||||
- Package-level quirks fixed in this channel to build at all against
|
||||
current Guix (all in `metznet/packages/`, not upstream Guix changes):
|
||||
`metznet-sssd` disables tests (one fails only under Docker's emulated
|
||||
filesystem/Rosetta, not a real regression) and strips the
|
||||
`--install-layout=deb` flag setuptools no longer accepts;
|
||||
`metznet-kitty` disables tests for the same reason (`O_TMPFILE`
|
||||
atomicity isn't honored by Docker Desktop's virtualized filesystem on
|
||||
macOS); `openldap-slapd` forces `-std=gnu17` plus several `-Wno-*`
|
||||
flags because GCC 14 turned some of its 25-year-old autoconf checks
|
||||
into hard errors, and adds `libxcrypt` as an input since glibc dropped
|
||||
`crypt()`.
|
||||
@ -1,24 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
socket=/var/guix/daemon-socket/socket
|
||||
|
||||
# /var/guix is a persistent volume, so a stale socket from a previous
|
||||
# (now-dead) container can still be sitting there; always start a fresh
|
||||
# daemon, which unlinks and rebinds the socket itself, rather than
|
||||
# skipping startup just because the path exists.
|
||||
# --disable-chroot: sandboxed builds normally isolate via Linux namespaces
|
||||
# (unshare/clone), which Docker blocks by default even for root ("clone:
|
||||
# Operation not permitted") and which also seems to cut off DNS for the
|
||||
# substituter subprocess. We're already isolated by the outer container,
|
||||
# so skip guix-daemon's own sandboxing rather than granting --privileged.
|
||||
rm -f "$socket"
|
||||
guix-daemon --build-users-group=guixbuild --disable-chroot &
|
||||
|
||||
for _ in $(seq 1 30); do
|
||||
[ -S "$socket" ] && break
|
||||
sleep 1
|
||||
done
|
||||
[ -S "$socket" ] || { echo "guix-daemon did not come up" >&2; exit 1; }
|
||||
|
||||
exec "$@"
|
||||
@ -1,11 +0,0 @@
|
||||
(define-module (metznet machines base-server)
|
||||
#:use-module (gnu)
|
||||
#:use-module (metznet system base-system)
|
||||
#:export (base-server.metznet.ca))
|
||||
|
||||
(define-public base-server.metznet.ca
|
||||
(operating-system
|
||||
(inherit %metznet-base-server-system)
|
||||
(host-name "base-server.metznet.ca")))
|
||||
|
||||
base-server.metznet.ca
|
||||
@ -1,48 +0,0 @@
|
||||
(define-module (metznet machines kerberos)
|
||||
#:use-module (gnu)
|
||||
#:use-module (gnu services certbot)
|
||||
#:use-module (metznet system base-system)
|
||||
#:use-module (metznet services kdc)
|
||||
#:use-module (metznet packages kdc)
|
||||
#:export (kerberos.metznet.ca kerberos-services))
|
||||
|
||||
;; Restored from metznet-channel commit 425b173's metznet/machines/kerberos.scm
|
||||
;; (deleted there when system configs were split into a separate repo; that
|
||||
;; repo's servers/kadmin.scm is a different, standalone kdb5_util-based
|
||||
;; placeholder that was never actually deployed -- this LDAP-backed config
|
||||
;; is what's really running).
|
||||
(define %kerberos-dn
|
||||
"uid=kerberos,ou=system,ou=accounts,dc=metznet,dc=ca")
|
||||
|
||||
(define-public kerberos-services
|
||||
(append (list (service kdc-service-type
|
||||
(kdc-configuration
|
||||
(dbdefaults '("ldap_kerberos_container_dn = cn=kerberos,dc=metznet,dc=ca"))
|
||||
(logging '("kdc = SYSLOG:DEBUG:DAEMON"))
|
||||
(dbmodules (list (cons "openldap_ldapconf"
|
||||
(kldap-configuration
|
||||
(ldap_kdc_dn %kerberos-dn)
|
||||
(ldap_kadmind_dn %kerberos-dn)
|
||||
(ldap_servers "ldaps://ldap.metznet.ca")
|
||||
(ldap_service_password_file
|
||||
"/var/lib/kerberos/service.keyfile")))))
|
||||
(realms (list (kdc-realm-configuration
|
||||
(name "METZNET.CA")
|
||||
(database_module "openldap_ldapconf")
|
||||
(default_principal_flags "+preauth")
|
||||
(acl_file (plain-file "kadm5.acl"
|
||||
"*/admin@METZNET.CA *\n")))))))
|
||||
(service certbot-service-type
|
||||
(certbot-configuration
|
||||
(email "admin@metznet.ca")
|
||||
(certificates (list (certificate-configuration
|
||||
(domains '("kerberos.metznet.ca"))))))))
|
||||
%metznet-server-services))
|
||||
|
||||
(define-public kerberos.metznet.ca
|
||||
(operating-system
|
||||
(inherit %metznet-base-server-system)
|
||||
(host-name "kerberos.metznet.ca")
|
||||
(services kerberos-services)))
|
||||
|
||||
kerberos.metznet.ca
|
||||
@ -1,32 +0,0 @@
|
||||
(define-module (metznet machines ldap)
|
||||
#:use-module (gnu)
|
||||
#:use-module (gnu services certbot)
|
||||
#:use-module (metznet system base-system)
|
||||
#:use-module (metznet services slapd)
|
||||
#:export (ldap.metznet.ca ldap-services))
|
||||
|
||||
;; Restored from metznet-channel commit 425b173's metznet/machines/ldap.scm
|
||||
;; (deleted there when system configs were split into a separate repo).
|
||||
;; Deliberately no seed data here, matching that original -- the real
|
||||
;; ldap.metznet.ca server already has a populated, live directory tree;
|
||||
;; servers/ldap.scm's elaborate LDIF seeding (dc=metznet,dc=ca org,
|
||||
;; ou=user/ou=group) doesn't match the ou=system,ou=accounts structure
|
||||
;; the rest of this channel (sssd, kerberos.scm) actually binds against,
|
||||
;; so it looks like a divergent prototype that was never really deployed.
|
||||
(define-public ldap-services
|
||||
(append (list (service certbot-service-type
|
||||
(certbot-configuration
|
||||
(email "admin@metznet.ca")
|
||||
(certificates (list (certificate-configuration
|
||||
(domains '("ldap.metznet.ca")))))))
|
||||
(service slapd-service-type
|
||||
(slapd-configuration (uris "ldap:// ldaps://"))))
|
||||
%metznet-server-services))
|
||||
|
||||
(define-public ldap.metznet.ca
|
||||
(operating-system
|
||||
(inherit %metznet-base-server-system)
|
||||
(host-name "ldap.metznet.ca")
|
||||
(services ldap-services)))
|
||||
|
||||
ldap.metznet.ca
|
||||
@ -1,100 +0,0 @@
|
||||
(define-module (metznet machines otto)
|
||||
#:use-module (gnu)
|
||||
#:use-module (metznet system base-system)
|
||||
#:use-module (gnu packages tex)
|
||||
#:use-module (nongnu packages mozilla)
|
||||
#:use-module (gnu packages networking)
|
||||
#:use-module (gnu packages shells)
|
||||
#:use-module (gnu packages pulseaudio)
|
||||
#:use-module (gnu packages virtualization)
|
||||
#:use-module (gnu packages spice)
|
||||
#:use-module (gnu packages vulkan)
|
||||
#:use-module (gnu packages pdf)
|
||||
#:use-module (gnu packages commencement)
|
||||
#:use-module (gnu packages base)
|
||||
#:use-module (gnu packages embedded)
|
||||
#:use-module (gnu services cups)
|
||||
#:use-module (gnu services virtualization)
|
||||
#:use-module (gnu services xorg)
|
||||
#:use-module (gnu services desktop)
|
||||
#:use-module (gnu services sddm)
|
||||
#:use-module (gnu services linux)
|
||||
#:use-module (gnu packages cups)
|
||||
#:use-module (gnu packages xorg)
|
||||
#:use-module (gnu packages scanner)
|
||||
#:use-module (gnu packages dns)
|
||||
#:use-module (gnu services shepherd)
|
||||
#:use-module (gnu services base)
|
||||
#:export (otto))
|
||||
|
||||
;; (define (nvidia-insmod-shepherd-service config)
|
||||
;; (list (shepherd-service
|
||||
;; (provision '(nvidia-insmod))
|
||||
;; (requirement '())
|
||||
;; (start #~(lambda _ (and
|
||||
;; (zero? (system* (string-append #$nvidia-driver "/bin/nvidia-insmod"))))))
|
||||
;; (one-shot? #t)
|
||||
;; (auto-start? #t)
|
||||
;; (respawn? #f))))
|
||||
;;
|
||||
;; (define nvidia-insmod-service-type
|
||||
;; (service-type
|
||||
;; (name 'nvidia-insmod-name)
|
||||
;; (extensions
|
||||
;; (list (service-extension shepherd-root-service-type nvidia-insmod-shepherd-service)))
|
||||
;; (default-value '())))
|
||||
|
||||
(define-public otto
|
||||
(operating-system
|
||||
(inherit %metznet-base-desktop-system)
|
||||
(host-name "otto")
|
||||
(hosts-file
|
||||
(plain-file "hosts"
|
||||
(string-append (local-host-aliases host-name)
|
||||
"# LAN geofff.homelab ip
|
||||
192.168.86.2 geofff.homelab\n")))
|
||||
(kernel-arguments '("modprobe.blacklist=nouveau"))
|
||||
;; (kernel-loadable-modules (list nvidia-driver))
|
||||
(packages (append (list qemu texlive-scheme-full pavucontrol mupdf gcc-toolchain gnu-make sane-backends-minimal xsane cups xf86-video-nv xf86-input-libinput vulkan-loader vulkan-tools (list isc-bind "utils")) %metznet-desktop-packages))
|
||||
(services (append (list
|
||||
;; (service kernel-module-loader-service-type
|
||||
;; '("nvidia" "nvidia-modeset" "nvidia-uvm" "nvidia-drm"))
|
||||
;; (simple-service 'custom-udev-rules udev-service-type (list nvidia-driver))
|
||||
(service sane-service-type)
|
||||
(service cups-service-type
|
||||
(cups-configuration
|
||||
(web-interface? #t))))
|
||||
(modify-services %metznet-desktop-services
|
||||
(sddm-service-type config =>
|
||||
(sddm-configuration (inherit config)
|
||||
(xorg-configuration
|
||||
(xorg-configuration
|
||||
(keyboard-layout (keyboard-layout "us"))))))
|
||||
(udev-service-type config =>
|
||||
(udev-configuration (inherit config)
|
||||
(rules (append (list
|
||||
%usb-udev-rule)
|
||||
(udev-configuration-rules config))))))))
|
||||
(users (cons* (user-account
|
||||
(name "nmetz")
|
||||
(comment "Noah Metz")
|
||||
(group "users")
|
||||
(home-directory "/home/nmetz")
|
||||
(shell (file-append zsh "/bin/zsh"))
|
||||
(supplementary-groups
|
||||
`("wheel" "netdev" "audio" "video" "usb" "kvm")))
|
||||
%metznet-base-user-accounts))
|
||||
(file-systems
|
||||
(cons* (file-system
|
||||
(mount-point "/boot/efi")
|
||||
(device (uuid "6E88-FE62" 'fat32))
|
||||
(type "vfat"))
|
||||
(file-system
|
||||
(mount-point "/")
|
||||
(device
|
||||
(uuid "ba93a043-9e58-466f-b90f-bf2a6bbf91fe"
|
||||
'ext4))
|
||||
(type "ext4"))
|
||||
%base-file-systems))))
|
||||
|
||||
otto
|
||||
@ -1,18 +0,0 @@
|
||||
(define-module (metznet packages kitty)
|
||||
#:use-module (guix packages)
|
||||
#:use-module (guix utils)
|
||||
#:use-module (gnu packages terminals)
|
||||
#:export (metznet-kitty))
|
||||
|
||||
;; kitty's test suite includes TestCreateAnonymousTempfile, which checks
|
||||
;; that O_TMPFILE creates files atomically -- a Linux filesystem feature
|
||||
;; not properly supported by Docker Desktop's virtualized filesystem on
|
||||
;; macOS. This is a test-environment limitation, not a real regression
|
||||
;; (kitty's actual runtime behavior is unaffected); disabling tests only
|
||||
;; skips this build-time check.
|
||||
(define-public metznet-kitty
|
||||
(package
|
||||
(inherit kitty)
|
||||
(arguments
|
||||
(substitute-keyword-arguments (package-arguments kitty)
|
||||
((#:tests? tests? #t) #f)))))
|
||||
@ -1,26 +0,0 @@
|
||||
(define-module (metznet packages sssd)
|
||||
#:use-module (guix packages)
|
||||
#:use-module (guix utils)
|
||||
#:use-module (guix gexp)
|
||||
#:use-module (gnu packages sssd)
|
||||
#:export (metznet-sssd))
|
||||
|
||||
;; Upstream sssd's Makefile.am has `DISTSETUPOPTS += --install-layout=deb`,
|
||||
;; which the setuptools version currently pulled in Guix no longer
|
||||
;; supports (that flag was removed along with distutils), breaking the
|
||||
;; `src/config` install step. Force DISTSETUPOPTS empty via a make
|
||||
;; command-line override, which takes precedence over the Makefile's `+=`
|
||||
;; regardless of autoreconf/Makefile.in regeneration timing.
|
||||
;;
|
||||
;; Tests are also disabled: src/tests/cmocka/test_iobuf.c fails under
|
||||
;; Docker's emulated-x86_64 (Rosetta) build environment -- a test
|
||||
;; environment artifact, not a real regression (sssd's actual runtime
|
||||
;; behavior is unaffected; disabling only skips this build-time check).
|
||||
(define-public metznet-sssd
|
||||
(package
|
||||
(inherit sssd)
|
||||
(arguments
|
||||
(substitute-keyword-arguments (package-arguments sssd)
|
||||
((#:make-flags flags)
|
||||
#~(cons "DISTSETUPOPTS=" #$flags))
|
||||
((#:tests? tests? #t) #f)))))
|
||||
@ -1,76 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Drive the dockerized Guix build environment (see docker/) to build the
|
||||
# operating-system definitions in this repo as `guix system docker-image`
|
||||
# tarballs, loadable straight into Docker Desktop.
|
||||
set -euo pipefail
|
||||
|
||||
cd "$(dirname "$0")/.."
|
||||
|
||||
compose() {
|
||||
docker compose run --rm guix "$@"
|
||||
}
|
||||
|
||||
usage() {
|
||||
cat <<EOF
|
||||
usage: $0 <command> [args]
|
||||
|
||||
commands:
|
||||
build build/rebuild the guix builder image
|
||||
pull guix pull -C channels.scm (do this first, and
|
||||
again whenever channels.scm/channels.d/*.scm
|
||||
change)
|
||||
shell interactive shell inside the builder container
|
||||
image FILE.scm [NAME] build FILE.scm (e.g. metznet/machines/ldap.scm)
|
||||
as a docker image, writing build/NAME.tar.gz
|
||||
(NAME defaults to FILE's basename). -L points
|
||||
at /workspace (this checkout), so uncommitted
|
||||
local edits are picked up directly -- no
|
||||
commit/pull round-trip needed. Load with:
|
||||
docker load < build/NAME.tar.gz
|
||||
load-run FILE.scm build FILE.scm, docker load it into the host
|
||||
Docker, and drop into a shell in a container
|
||||
started from it
|
||||
EOF
|
||||
}
|
||||
|
||||
cmd="${1:-}"
|
||||
[ -n "$cmd" ] && shift || true
|
||||
|
||||
case "$cmd" in
|
||||
build)
|
||||
docker compose build
|
||||
;;
|
||||
pull)
|
||||
compose guix pull -C channels.scm
|
||||
;;
|
||||
shell)
|
||||
compose bash
|
||||
;;
|
||||
image)
|
||||
scm="${1:?usage: $0 image FILE.scm [NAME]}"
|
||||
name="${2:-$(basename "$scm" .scm)}"
|
||||
compose bash -c "
|
||||
set -e
|
||||
# --no-grafts: with --disable-chroot (see docker/entrypoint.sh),
|
||||
# guix-daemon's store-path grafting (security-patch rewriting) hits
|
||||
# a permission error creating output files -- skipping grafts
|
||||
# avoids it entirely and just uses the un-grafted originals.
|
||||
out=\$(guix system docker-image -N --no-grafts -L /workspace '$scm')
|
||||
mkdir -p /workspace/build
|
||||
cp \"\$out\" '/workspace/build/$name.tar.gz'
|
||||
echo \"wrote build/$name.tar.gz\"
|
||||
"
|
||||
;;
|
||||
load-run)
|
||||
scm="${1:?usage: $0 load-run FILE.scm}"
|
||||
name="$(basename "$scm" .scm)"
|
||||
"$0" image "$scm" "$name"
|
||||
image_id="$(docker load -q -i "build/$name.tar.gz" | sed 's/^Loaded image: //')"
|
||||
echo "loaded $image_id, starting container..."
|
||||
docker run --rm -it "$image_id" /run/current-system/profile/bin/bash --login
|
||||
;;
|
||||
*)
|
||||
usage
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
@ -1,62 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
setup_bridge() {
|
||||
if [[ $# -lt 1 ]]; then
|
||||
echo "usage: start_bridge internet_interface"
|
||||
else
|
||||
echo "Setting up bridge with internet adapter $1"
|
||||
fi
|
||||
ip link add name virbr0 type bridge
|
||||
ip link set virbr0 up
|
||||
ip addr add 192.168.100.0/24 dev virbr0
|
||||
|
||||
sysctl -w net.ipv4.ip_forward=1
|
||||
nft add table inet nat
|
||||
nft add chain inet nat postrouting '{ type nat hook postrouting priority 100 ; }'
|
||||
nft add rule inet nat postrouting oifname $1 masquerade
|
||||
}
|
||||
|
||||
del_bridge() {
|
||||
echo "Deleting virtual bridge"
|
||||
ip link del virbr0
|
||||
nft delete table inet nat
|
||||
}
|
||||
|
||||
add_interface() {
|
||||
echo "Adding interface $1"
|
||||
ip tuntap add $1 mode tap
|
||||
ip link set $1 master virbr0
|
||||
ip link set $1 up
|
||||
}
|
||||
|
||||
del_interface() {
|
||||
echo "Deleteing inteface $1"
|
||||
ip link set $1 down
|
||||
ip link set $1 nomaster
|
||||
ip tuntap del $1 mode tap
|
||||
}
|
||||
|
||||
if [[ $UID -ne 0 ]]; then
|
||||
echo "Networking script must be run as root user"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
CASE=$1
|
||||
shift
|
||||
case $CASE in
|
||||
start_bridge)
|
||||
setup_bridge $@
|
||||
;;
|
||||
stop_bridge)
|
||||
del_bridge $@
|
||||
;;
|
||||
add_tap)
|
||||
add_interface $@
|
||||
;;
|
||||
del_tap)
|
||||
del_interface $@
|
||||
;;
|
||||
*)
|
||||
echo "usage:" $0 "[start_bridge|stop_bridge|add_tap|del_tap] [options]"
|
||||
;;
|
||||
esac
|
||||
@ -1,44 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
start(){
|
||||
if [[ $# -lt 3 ]]; then
|
||||
echo "usage: start [system].scm [netdev] [macaddr]"
|
||||
exit 1
|
||||
fi
|
||||
echo "building $1"
|
||||
export DOMAIN_CAPS=METZNET.CA
|
||||
export DOMAIN_NAME=metznet.ca
|
||||
ro_image=$(guix system image --image-type=qcow2 -L `pwd` $1)
|
||||
if [[ -z ${ro_image} ]]; then
|
||||
echo "failed to build $1..."
|
||||
exit 1
|
||||
else
|
||||
echo "built ${ro_image}"
|
||||
fi
|
||||
image="${1%.*}.qcow2"
|
||||
echo "copying ${ro_image} to ${image} and adding 5G to VM"
|
||||
cp $ro_image $image
|
||||
chmod +w $image
|
||||
qemu-img resize $image +5G
|
||||
echo "starting vm..."
|
||||
qemu-system-x86_64 -enable-kvm -nographic -serial mon:stdio -hda $image -m 1000 -bios $(guix build ovmf)/share/firmware/ovmf_x64.bin -nic tap,ifname=$2,script=no,downscript=no,mac=$3
|
||||
}
|
||||
|
||||
stop(){
|
||||
echo unimplemented
|
||||
}
|
||||
|
||||
case $1 in
|
||||
start)
|
||||
shift
|
||||
start $@
|
||||
;;
|
||||
stop)
|
||||
shift
|
||||
stop $@
|
||||
;;
|
||||
*)
|
||||
echo $0 "[start|stop] [system].scm"
|
||||
;;
|
||||
esac
|
||||
|
||||
Loading…
Reference in New Issue