From 8e37ca195f2e3d0c2dc87fbb9ea93d1522c05adf Mon Sep 17 00:00:00 2001
From: phoenix <phoenix@sphinx>
Date: Thu, 17 Apr 2025 04:54:18 +0100
Subject: [PATCH] feat: add chatgpt bootstrap shell script for building
 workspace image

---
 build-analytics-backend-workspace.sh | 79 ++++++++++++++++++++++++++++
 1 file changed, 79 insertions(+)
 create mode 100644 build-analytics-backend-workspace.sh

diff --git a/build-analytics-backend-workspace.sh b/build-analytics-backend-workspace.sh
new file mode 100644
index 0000000..851e52f
--- /dev/null
+++ b/build-analytics-backend-workspace.sh
@@ -0,0 +1,79 @@
+#!/bin/bash
+# build-persistent-devbox.sh
+# Persistent Fedora Minimal-based devbox with SSH, Git, and GitOps secrets (immutable config files)
+
+set -euo pipefail
+
+IMG_NAME="analytics-backend-workspace"
+
+ctr=$(buildah from registry.fedoraproject.org/fedora-minimal:40)
+
+buildah run "$ctr" -- microdnf update -y
+buildah run "$ctr" -- microdnf install -y \
+  neovim git zsh tmux podman openssh-server \
+  java-17-openjdk maven sudo shadow-utils gnupg attr &&
+  microdnf clean all
+
+buildah run "$ctr" -- useradd -ms /bin/zsh devuser
+buildah run "$ctr" -- bash -c 'echo "devuser ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/devuser'
+
+# SSH setup
+buildah run "$ctr" -- mkdir -p /root/ssh
+buildah copy "$ctr" ssh/config /root/ssh/config
+buildah copy "$ctr" ssh/ssh_blocker.sh /root/ssh/ssh_blocker.sh
+buildah run "$ctr" -- chmod 100 /root/ssh/ssh_blocker.sh
+buildah run "$ctr" -- chattr +i /root/ssh/ssh_blocker.sh
+buildah run "$ctr" -- chmod 000 /root/ssh/config
+buildah run "$ctr" -- chattr +i /root/ssh/config
+
+# Neovim config (immutable)
+buildah copy "$ctr" config/nvim /home/devuser/.config/nvim
+buildah run "$ctr" -- chmod -R 600 /home/devuser/.config/nvim
+buildah run "$ctr" -- chattr -R +i /home/devuser/.config/nvim
+
+# zsh and tmux config (immutable)
+buildah copy "$ctr" ./zshrc /home/devuser/.zshrc
+buildah run "$ctr" -- chattr +i /home/devuser/.zshrc
+buildah run "$ctr" -- bash -c 'echo "set -g mouse on" > /home/devuser/.tmux.conf'
+buildah run "$ctr" -- chattr +i /home/devuser/.tmux.conf
+
+# Git config and secrets placeholder (immutable)
+buildah run "$ctr" -- mkdir -p /home/devuser/.gnupg /home/devuser/.git-credentials
+buildah copy "$ctr" ./gitconfig /home/devuser/.gitconfig
+buildah copy "$ctr" ./gpg-key.asc /home/devuser/.gnupg/gpg-key.asc
+buildah run "$ctr" -- chattr +i /home/devuser/.gitconfig
+buildah run "$ctr" -- chattr +i /home/devuser/.gnupg/gpg-key.asc
+
+# Secure SSH wrapper and config
+buildah run "$ctr" -- mkdir -p /opt/secure/ssh
+buildah copy "$ctr" ./id_ed25519 /opt/secure/ssh/id_ed25519
+buildah copy "$ctr" ./ssh_config /opt/secure/ssh/config
+buildah run "$ctr" -- chmod 600 /opt/secure/ssh/id_ed25519
+buildah run "$ctr" -- chmod 100 /opt/secure/ssh/config
+buildah run "$ctr" -- chown root:root /opt/secure/ssh/id_ed25519 /opt/secure/ssh/config
+buildah run "$ctr" -- chattr +i /opt/secure/ssh/id_ed25519 /opt/secure/ssh/config
+
+# Create SSH wrapper script
+buildah run "$ctr" -- bash -c '
+cat <<EOF > /usr/local/bin/git-ssh-wrapper.sh
+#!/bin/bash
+exec ssh -F /opt/secure/ssh/config "\$@"
+EOF
+chmod +x /usr/local/bin/git-ssh-wrapper.sh'
+
+# Entrypoint to start SSH
+buildah run "$ctr" -- mkdir -p /run/sshd
+buildah run "$ctr" -- bash -c 'echo "/usr/sbin/sshd -D" > /home/devuser/start.sh && chmod +x /home/devuser/start.sh'
+
+buildah run "$ctr" -- chown -R devuser:devuser /home/devuser
+
+buildah config --user devuser "$ctr"
+buildah config --workingdir /home/devuser "$ctr"
+buildah config --env CONTAINER_HOST=unix:///run/podman/podman.sock "$ctr"
+buildah config --env GIT_SSH=/usr/local/bin/git-ssh-wrapper.sh "$ctr"
+buildah config --port 22 "$ctr"
+buildah config --cmd "/home/devuser/start.sh" "$ctr"
+
+buildah commit "$ctr" $IMG_NAME
+
+echo "✅ $IMG_NAME built."