From c104750a0288803a0857b5d0f0dd4d2ea8a81160 Mon Sep 17 00:00:00 2001
From: yeti <yeti@alps>
Date: Thu, 17 Apr 2025 21:36:03 +0100
Subject: [PATCH] feat(buildah): add some packages and set permissions to
 specific files

---
 build-workspace.sh | 65 ++++++++++++++++++++++++++++++++++++----------
 1 file changed, 51 insertions(+), 14 deletions(-)

diff --git a/build-workspace.sh b/build-workspace.sh
index 8a43805..d9747b0 100755
--- a/build-workspace.sh
+++ b/build-workspace.sh
@@ -12,38 +12,75 @@ DEV_HOME=/home/$DEV_USER
 ctr=$(buildah from archlinux)
 
 buildah run "$ctr" -- bash -c "\
-  pacman -Sy --noconfirm && pacman -S --noconfirm neovim git zsh tmux podman \
-  fzf fd ripgrep jdk-openjdk && pacman -Scc --noconfirm && \
+  pacman -Sy --noconfirm && pacman -S --noconfirm --needed base-devel neovim git zsh tmux \
+  nodejs python podman fzf fd ripgrep jdk-openjdk zsh-completions zsh-syntax-highlighting \
+  lazygit zsh-autosuggestions luarocks python-pynvim npm bash-completion tree-sitter-cli \
+  pkgconf lua51 && pacman -Scc --noconfirm && \
   groupadd secproc && useradd -ms /bin/zsh -G secproc $DEV_USER && \
   useradd --system --no-create-home -s /usr/sbin/nologin -G $DEV_USER viewer && \
-  mkdir -p /tmp/tmux-shared && chown -R $DEV_USER:$DEV_USER /tmp/tmux-shared && \
+  mkdir -p /tmp/tmux-shared && chown $DEV_USER:$DEV_USER /tmp/tmux-shared && \
+  chmod 750 /tmp/tmux-shared && \
   mkdir -p $SECURE && chmod -R 500 $SECURE && \
   mkdir /app && chmod 700 /app && chown $DEV_USER:$DEV_USER /app
 "
 # copy start script
 buildah copy "$ctr" start.sh $DEV_HOME/start.sh
+# copy zshrc, neovim and tmux setup
+buildah copy "$ctr" zshrc $DEV_HOME/.zshrc
+buildah copy "$ctr" config $DEV_HOME/.config
 
 # copy ssh setup
 buildah copy "$ctr" ssh $SECURE/ssh
 
-# copy zshrc, neovim and tmux setup
-buildah copy "$ctr" zshrc $DEV_HOME/.zshrc
-buildah copy "$ctr" config $DEV_HOME/.config
-buildah copy "$ctr" local $DEV_HOME/.local
-
 # zsh and tmux config (immutable)
-buildah run "$ctr" -- bash -c "
-  chown -R $DEV_USER:$DEV_USER $DEV_HOME && \
-  find $DEV_HOME -type f -exec chmod 750 {} + && \
-  find $DEV_HOME -type f -exec chown root:secproc {} + && \
-  setfacl -R -m u:devuser:--x $DEV_HOME && \ 
+buildah run "$ctr" -- chown -R $DEV_USER:$DEV_USER $DEV_HOME
+buildah run --user $DEV_USER "$ctr" -- nvim --headless "+Lazy! sync" +qa
+
+# lock the files
+buildah run "$ctr" -- bash -c "\
+  chmod 750 $DEV_HOME/start.sh \
+  $DEV_HOME/.config/lazygit/config.yml \
+  $DEV_HOME/.config/nvim/lua/config/lazy.lua \
+  $DEV_HOME/.config/nvim/lazyvim.json \
+  $DEV_HOME/.config/nvim/lazy-lock.json \
+  $DEV_HOME/.config/nvim/init.lua \
+  $DEV_HOME/.config/nvim/README.md \
+  $DEV_HOME/.config/nvim/LICENSE \
+  $DEV_HOME/.config/tmux/tmux.conf \
+  $DEV_HOME/.config/tmux/tmux.conf.local \
+  $DEV_HOME/.config/zsh/fzf-git.sh && \
+  setfacl -m u:devuser:--x $DEV_HOME/start.sh \
+  $DEV_HOME/.config/lazygit/config.yml \
+  $DEV_HOME/.config/nvim/lua/config/lazy.lua \
+  $DEV_HOME/.config/nvim/lazyvim.json \
+  $DEV_HOME/.config/nvim/lazy-lock.json \
+  $DEV_HOME/.config/nvim/init.lua \
+  $DEV_HOME/.config/nvim/README.md \
+  $DEV_HOME/.config/nvim/LICENSE \
+  $DEV_HOME/.config/tmux/tmux.conf \
+  $DEV_HOME/.config/tmux/tmux.conf.local \
+  $DEV_HOME/.config/zsh/fzf-git.sh && \
+  chown root:secproc $DEV_HOME/start.sh \
+  $DEV_HOME/.config/lazygit/config.yml \
+  $DEV_HOME/.config/nvim/lua/config/lazy.lua \
+  $DEV_HOME/.config/nvim/lazyvim.json \
+  $DEV_HOME/.config/nvim/lazy-lock.json \
+  $DEV_HOME/.config/nvim/init.lua \
+  $DEV_HOME/.config/nvim/README.md \
+  $DEV_HOME/.config/nvim/LICENSE \
+  $DEV_HOME/.config/tmux/tmux.conf \
+  $DEV_HOME/.config/tmux/tmux.conf.local \
+  $DEV_HOME/.config/zsh/fzf-git.sh && \
+  chmod -R 750 $DEV_HOME/.config/zsh/ohmyzsh && \
+  setfacl -R -m u:devuser:--x $DEV_HOME/.config/zsh/ohmyzsh && \
+  chown -R root:secproc $DEV_HOME/.config/zsh/ohmyzsh
 "
 
 buildah config \
   --user $DEV_USER \
   --workingdir /app \
   --env CONTAINER_HOST=unix:///run/podman/podman.sock \
-  --cmd "$DEV_HOME/start.sh" \
+  --cmd '["/home/devuser/start.sh"]' \
   "$ctr"
 
 buildah commit "$ctr" $IMG_NAME