61 lines
2.4 KiB
Bash
61 lines
2.4 KiB
Bash
#!/bin/bash
|
|
# build-persistent-devbox.sh
|
|
# Persistent Fedora Minimal-based devbox with SSH, Git, and GitOps secrets (immutable config files)
|
|
|
|
set -euo pipefail
|
|
|
|
IMG_NAME="analytics-backend-workspace"
|
|
SECURE=/opt/secure
|
|
|
|
ctr=$(buildah from registry.fedoraproject.org/fedora-minimal:40)
|
|
|
|
buildah run "$ctr" -- microdnf update -y
|
|
buildah run "$ctr" -- microdnf install -y \
|
|
neovim git zsh tmux podman openssh-server \
|
|
java-17-openjdk maven sudo shadow-utils gnupg attr &&
|
|
microdnf clean all
|
|
|
|
buildah run "$ctr" -- useradd -ms /bin/zsh devuser
|
|
buildah run "$ctr" -- bash -c 'echo "devuser ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/devuser'
|
|
|
|
# SSH setup
|
|
buildah run "$ctr" -- mkdir -p /"$SECURE"/ssh
|
|
buildah copy "$ctr" ssh/config /"$SECURE"/ssh/config
|
|
buildah copy "$ctr" ssh/ssh_blocker.sh /"$SECURE"/ssh/ssh_blocker.sh
|
|
buildah run "$ctr" -- chmod 100 /"$SECURE"/ssh/ssh_blocker.sh
|
|
buildah run "$ctr" -- chmod 000 /"$SECURE"/ssh/config
|
|
buildah run "$ctr" -- chown -R root:root ssh/config /"$SECURE"/ssh_blocker.sh
|
|
buildah run "$ctr" -- chattr -R +i /"$SECURE"/ssh
|
|
|
|
# Neovim config (immutable)
|
|
buildah copy "$ctr" config/nvim /home/devuser/.config/nvim
|
|
buildah run "$ctr" -- chmod -R 600 /home/devuser/.config/nvim
|
|
|
|
# zsh and tmux config (immutable)
|
|
buildah copy "$ctr" ./zshrc /home/devuser/.zshrc
|
|
buildah run "$ctr" -- chattr +i /home/devuser/.zshrc
|
|
buildah run "$ctr" -- bash -c 'echo "set -g mouse on" > /home/devuser/.tmux.conf'
|
|
buildah run "$ctr" -- chattr +i /home/devuser/.tmux.conf
|
|
|
|
# Git config and secrets placeholder (immutable)
|
|
buildah run "$ctr" -- mkdir -p /home/devuser/.gnupg /home/devuser/.git-credentials
|
|
buildah copy "$ctr" ./gitconfig /home/devuser/.gitconfig
|
|
buildah copy "$ctr" ./gpg-key.asc /home/devuser/.gnupg/gpg-key.asc
|
|
buildah run "$ctr" -- chattr +i /home/devuser/.gitconfig
|
|
buildah run "$ctr" -- chattr +i /home/devuser/.gnupg/gpg-key.asc
|
|
|
|
buildah run "$ctr" -- chattr -R +i /home/devuser/.config
|
|
buildah run "$ctr" -- chown -R devuser:devuser /home/devuser
|
|
buildah run "$ctr" -- chattr -R +i /home/devuser
|
|
|
|
buildah config --user devuser "$ctr"
|
|
buildah config --workingdir /home/devuser "$ctr"
|
|
buildah config --env CONTAINER_HOST=unix:///run/podman/podman.sock "$ctr"
|
|
buildah config --env GIT_SSH=/usr/local/bin/git-ssh-wrapper.sh "$ctr"
|
|
buildah config --port 22 "$ctr"
|
|
buildah config --cmd "/home/devuser/start.sh" "$ctr"
|
|
|
|
buildah commit "$ctr" $IMG_NAME
|
|
|
|
echo "✅ $IMG_NAME built."
|