image:
  distribution: rockylinux

source:
  downloader: rockylinux-http
  url: https://download.rockylinux.org/pub/rocky/
  keys:
  # RPM-GPG-KEY-rockylinux-8
  - |-
    -----BEGIN PGP PUBLIC KEY BLOCK-----

    mQINBGAofzYBEAC6yS1azw6f3wmaVd//3aSy6O2c9+jeetulRQvg2LvhRRS1eNqp
    /x9tbBhfohu/tlDkGpYHV7diePgMml9SZDy1sKlI3tDhx6GZ3xwF0fd1vWBZpmNk
    D9gRkUmYBeLotmcXQZ8ZpWLicosFtDpJEYpLUhuIgTKwt4gxJrHvkWsGQiBkJxKD
    u3/RlL4IYA3Ot9iuCBflc91EyAw1Yj0gKcDzbOqjvlGtS3ASXgxPqSfU0uLC9USF
    uKDnP2tcnlKKGfj0u6VkqISliSuRAzjlKho9Meond+mMIFOTT6qp4xyu+9Dj3IjZ
    IC6rBXRU3xi8z0qYptoFZ6hx70NV5u+0XUzDMXdjQ5S859RYJKijiwmfMC7gZQAf
    OkdOcicNzen/TwD/slhiCDssHBNEe86Wwu5kmDoCri7GJlYOlWU42Xi0o1JkVltN
    D8ZId+EBDIms7ugSwGOVSxyZs43q2IAfFYCRtyKHFlgHBRe9/KTWPUrnsfKxGJgC
    Do3Yb63/IYTvfTJptVfhQtL1AhEAeF1I+buVoJRmBEyYKD9BdU4xQN39VrZKziO3
    hDIGng/eK6PaPhUdq6XqvmnsZ2h+KVbyoj4cTo2gKCB2XA7O2HLQsuGduHzYKNjf
    QR9j0djjwTrsvGvzfEzchP19723vYf7GdcLvqtPqzpxSX2FNARpCGXBw9wARAQAB
    tDNSZWxlYXNlIEVuZ2luZWVyaW5nIDxpbmZyYXN0cnVjdHVyZUByb2NreWxpbnV4
    Lm9yZz6JAk4EEwEIADgWIQRwUcRwqSn0VM6+N7cVr12sbXRaYAUCYCh/NgIbDwUL
    CQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRAVr12sbXRaYLFmEACSMvoO1FDdyAbu
    1m6xEzDhs7FgnZeQNzLZECv2j+ggFSJXezlNVOZ5I1I8umBan2ywfKQD8M+IjmrW
    k9/7h9i54t8RS/RN7KNo7ECGnKXqXDPzBBTs1Gwo1WzltAoaDKUfXqQ4oJ4aCP/q
    /XPVWEzgpJO1XEezvCq8VXisutyDiXEjjMIeBczxb1hbamQX+jLTIQ1MDJ4Zo1YP
    zlUqrHW434XC2b1/WbSaylq8Wk9cksca5J+g3FqTlgiWozyy0uxygIRjb6iTzKXk
    V7SYxeXp3hNTuoUgiFkjh5/0yKWCwx7aQqlHar9GjpxmBDAO0kzOlgtTw//EqTwR
    KnYZLig9FW0PhwvZJUigr0cvs/XXTTb77z/i/dfHkrjVTTYenNyXogPtTtSyxqca
    61fbPf0B/S3N43PW8URXBRS0sykpX4SxKu+PwKCqf+OJ7hMEVAapqzTt1q9T7zyB
    QwvCVx8s7WWvXbs2d6ZUrArklgjHoHQcdxJKdhuRmD34AuXWCLW+gH8rJWZpuNl3
    +WsPZX4PvjKDgMw6YMcV7zhWX6c0SevKtzt7WP3XoKDuPhK1PMGJQqQ7spegGB+5
    DZvsJS48Ip0S45Qfmj82ibXaCBJHTNZE8Zs+rdTjQ9DS5qvzRA1sRA1dBb/7OLYE
    JmeWf4VZyebm+gc50szsg6Ut2yT8hw==
    =AiP8
    -----END PGP PUBLIC KEY BLOCK-----

  # RPM-GPG-KEY-rockylinux-9
  - |-
    -----BEGIN PGP PUBLIC KEY BLOCK-----
    Version: resf.keykeeper.v1
    Comment: Keykeeper

    xsFNBGJ5RksBEADF/Lzssm7uryV6+VHAgL36klyCVcHwvx9Bk853LBOuHVEZWsme
    kbJF3fQG7i7gfCKGuV5XW15xINToe4fBThZteGJziboSZRpkEQ2z3lYcbg34X7+d
    co833lkBNgz1v6QO7PmAdY/x76Q6Hx0J9yiJWd+4j+vRi4hbWuh64vUtTd7rPwk8
    0y3g4oK1YT0NR0Xm/QUO9vWmkSTVflQ6y82HhHIUrG+1vQnSOrWaC0O1lqUI3Nuo
    b6jTARCmbaPsi+XVQnBbsnPPq6Tblwc+NYJSqj5d9nT0uEXT7Zovj4Je5oWVFXp9
    P1OWkbo2z5XkKjoeobM/zKDESJR78h+YQAN9IOKFjL/u/Gzrk1oEgByCABXOX+H5
    hfucrq5U3bbcKy4e5tYgnnZxqpELv3fN/2l8iZknHEh5aYNT5WXVHpD/8u2rMmwm
    I9YTEMueEtmVy0ZV3opUzOlC+3ZUwjmvAJtdfJyeVW/VMy3Hw3Ih0Fij91rO613V
    7n72ggVlJiX25jYyT4AXlaGfAOMndJNVgBps0RArOBYsJRPnvfHlLi5cfjVd7vYx
    QhGX9ODYuvyJ/rW70dMVikeSjlBDKS08tvdqOgtiYy4yhtY4ijQC9BmCE9H9gOxU
    FN297iLimAxr0EVsED96fP96TbDGILWsfJuxAvoqmpkElv8J+P1/F7to2QARAQAB
    zU9Sb2NreSBFbnRlcnByaXNlIFNvZnR3YXJlIEZvdW5kYXRpb24gLSBSZWxlYXNl
    IGtleSAyMDIyIDxyZWxlbmdAcm9ja3lsaW51eC5vcmc+wsGKBBMBCAA0BQJieUZL
    FiEEIcslauFvxUxuZSlJcC1CbTUNJ10CGwMCHgECGQEDCwkHAhUIAxYAAgIiAQAK
    CRBwLUJtNQ0nXWQ5D/9472seOyRO6//bQ2ns3w9lE+aTLlJ5CY0GSTb4xNuyv+AD
    IXpgvLSMtTR0fp9GV3vMw6QIWsehDqt7O5xKWi+3tYdaXRpb1cvnh8r/oCcvI4uL
    k8kImNgsx+Cj+drKeQo03vFxBTDi1BTQFkfEt32fA2Aw5gYcGElM717sNMAMQFEH
    P+OW5hYDH4kcLbtUypPXFbcXUbaf6jUjfiEp5lLjqquzAyDPLlkzMr5RVa9n3/rI
    R6OQp5loPVzCRZMgDLALBU2TcFXLVP+6hAW8qM77c+q/rOysP+Yd+N7GAd0fvEvA
    mfeA4Y6dP0mMRu96EEAJ1qSKFWUul6K6nuqy+JTxktpw8F/IBAz44na17Tf02MJH
    GCUWyM0n5vuO5kK+Ykkkwd+v43ZlqDnwG7akDkLwgj6O0QNx2TGkdgt3+C6aHN5S
    MiF0pi0qYbiN9LO0e05Ai2r3zTFC/pCaBWlG1ph2jx1pDy4yUVPfswWFNfe5I+4i
    CMHPRFsZNYxQnIA2Prtgt2YMwz3VIGI6DT/Z56Joqw4eOfaJTTQSXCANts/gD7qW
    D3SZXPc7wQD63TpDEjJdqhmepaTECbxN7x/p+GwIZYWJN+AYhvrfGXfjud3eDu8/
    i+YIbPKH1TAOMwiyxC106mIL705p+ORf5zATZMyB8Y0OvRIz5aKkBDFZM2QN6A==
    =PzIf
    -----END PGP PUBLIC KEY BLOCK-----

  # RPM-GPG-KEY-Rocky-10
  - |-
    -----BEGIN PGP PUBLIC KEY BLOCK-----

    mQINBGgq4akBEADFYHb9OX5/hlSJuYezxnzab01PUnec4/WvRdU5QRCySzlSicxd
    CYRrasQEYnytGBrTMM7fGSDOH9BtVpKfFvOW8yxfBXgkXbBT2p2/PK96qjIistbG
    GZK5yU5qhHTO4H30MaKvO8u+q3Icdtxc1I2OuGTrWQ0+MAI7dZPmNTqrvBlqks/V
    D6Uj9SSYpV0n12GdFQZI36+MXuI170vr0qRWaU8cl0Ew3nqU9rOBvnHPzab5UhCy
    g5+XE7QwRpKKziRxWNc40hU1OpT8yr4hoZdw9LimdA0yc7mniz7cWGPffMrfBQck
    1TKfLC8WsTSJ32ZPT/GildTIyEOv229ofhfBnY8H+MeD1ccW352yHflvKr9Pfhxt
    2lQuN7qCFpm5kip13hgKSnBL9M8JRICvjedrY4Q3yOfFZytWIsYsY2KAHe8lLTaR
    afPtnC8TWkiqR3P+dpaWopnoayuVAVFIK2jzix8PgC+TwYSH+IJcmw1O1WwpDt8q
    JfAE9Sh9X07mfbGnp0tJGG/+HXuSdwII/GXQeRE0L34DT7XcY3e3tuYCCoSpnvtm
    VvKpW42TfGfjwRWpW/fia30YHLXSoff26G38E5LfQTjjl95uyQWv3wpDExUrDOez
    d2hDZ3iJVWRZP3YZ1zgJexwlVoPTbDUe/wPcrFo5Don4YFD54ctUp/O39wARAQAB
    tDxSZWxlYXNlIEVuZ2luZWVyaW5nIChSb2NreSBMaW51eCAxMCkgPHJlbGVuZ0By
    b2NreWxpbnV4Lm9yZz6JAlIEEwEIADwWIQT8ImhZwIYL8N25WwhbEGxzb+38hQUC
    aCrhqQIbDwULCQgHAgMiAgEGFQoJCAsCBBYCAwECHgcCF4AACgkQWxBsc2/t/IWE
    sA/8CrZAFJwkMo2geIhcWW37XCGfKwUfB42QKkJQYoF2biOQxIcGGYU3AaA4HSfx
    o3CvutpwTgOQmG4ZfQd920KXMcSLd0actHQ+iJP+NPFv50ks2igv51QdPLQtZKvg
    A/tlKh4Oc0kgNBxueD5AZv8FJBEPQ7I0J/Ph9Ev1ShJrjnlVpTelNAdTNoNqf0xD
    LH7J0kyYgqbea+vxQposbc9hnaqRWv7hbAOj8cYbhkvvtG6oyn+AZaJoM00rTAsL
    cPjZk+HQdyUYB6JSKRZ5J16yn+D0UMwmmTI02dpd5ClFopGD/mT2erOn8hAhvvqF
    Wr1EZEKH6YwF6PzdZ9KtbGPhRcRzVeO7EOAmZu0jhvkMTjNODYHy4xsueJ+rHf1I
    M4rDSL579tPLAqYmnW1S3AbrJ0WkJc9KsWwzNRC5r+ftq2eTncfTU7RfGtw9shqR
    fTkB4NUMfTOtSUrDeWYYEQtCekexoqhaP7gjsUqWNTSPgConOFIwMsT0XOvPPJgS
    Dc0hnV6ew148jAf2L03hgDctqgsrUW3KB18bpkjUE7zfL1tweSqU3VDEQStxX9h8
    hG+VGHS7G7F4yYTcZOTlYfDU8ex/HkudPSOfwMnftqVnXqUpnQDKkUUPyxSCVKr8
    yN2apurNRzlrmWlJ8IuBtYFSSEqJ6sncQ/LrJRQQLTKp7sE=
    =32Ym
    -----END PGP PUBLIC KEY BLOCK-----

  variant: minimal

targets:
  lxc:
    create_message: |
      You just created a {{ image.description }} container.
    config:
    - type: all
      before: 5
      content: |-
        lxc.include = LXC_TEMPLATE_CONFIG/rocky.common.conf
    - type: user
      before: 5
      content: |-
        lxc.include = LXC_TEMPLATE_CONFIG/rocky.userns.conf
    - type: all
      after: 4
      content: |-
        lxc.include = LXC_TEMPLATE_CONFIG/common.conf

    - type: user
      after: 4
      content: |-
        lxc.include = LXC_TEMPLATE_CONFIG/userns.conf

    - type: all
      content: |-
        lxc.arch = {{ image.architecture_kernel }}

files:
- name: hostname
  path: /etc/hostname
  generator: hostname

- name: hosts
  path: /etc/hosts
  generator: hosts

- path: /etc/machine-id
  generator: dump
  content: uninitialized

- path: /var/lib/dbus/machine-id
  generator: remove

- name: ifcfg-eth0
  path: /etc/sysconfig/network-scripts/ifcfg-eth0
  generator: dump
  templated: true
  content: |-
    DEVICE=eth0
    BOOTPROTO=dhcp
    ONBOOT=yes
    HOSTNAME=LXC_NAME
    TYPE=Ethernet
    MTU=
    DHCP_HOSTNAME=LXC_NAME
  types:
  - container

- name: ifcfg-eth0.incus
  path: /etc/sysconfig/network-scripts/ifcfg-eth0
  generator: template
  content: |-
    DEVICE=eth0
    BOOTPROTO=dhcp
    ONBOOT=yes
    HOSTNAME={{ container.name }}
    TYPE=Ethernet
    MTU=
    DHCP_HOSTNAME={{ container.name }}
    IPV6INIT=yes
  types:
  - container

- name: ifcfg-enp5s0.incus
  path: /etc/sysconfig/network-scripts/ifcfg-enp5s0
  generator: template
  content: |-
    DEVICE=enp5s0
    BOOTPROTO=dhcp
    ONBOOT=yes
    HOSTNAME={{ container.name }}
    TYPE=Ethernet
    MTU=
    DHCP_HOSTNAME={{ container.name }}
  types:
  - vm

- path: /etc/default/grub
  generator: dump
  content: |-
    # Set the recordfail timeout
    GRUB_RECORDFAIL_TIMEOUT=0
    # Do not wait on grub prompt
    GRUB_TIMEOUT=0
    # Set the default commandline
    GRUB_CMDLINE_LINUX_DEFAULT="${GRUB_CMDLINE_LINUX_DEFAULT} console=tty1 console=ttyS0"
    # Set the grub console type
    GRUB_TERMINAL=console
    # Disable os-prober
    GRUB_DISABLE_OS_PROBER=true
  types:
  - vm

- path: /etc/dracut.conf.d/incus.conf
  generator: dump
  content: |-
    add_drivers+=" virtio_scsi virtio_console sd_mod "
  types:
  - vm

- generator: fstab
  types:
  - vm

- name: 86-nm-unmanaged.rules
  path: /etc/udev/rules.d/86-nm-unmanaged.rules
  generator: dump
  content: |-
    ENV{ID_NET_DRIVER}=="veth", ENV{NM_UNMANAGED}="0"

- name: network
  path: /etc/sysconfig/network
  generator: dump
  templated: true
  content: |-
    NETWORKING=yes
    HOSTNAME=LXC_NAME

- name: network.incus
  path: /etc/sysconfig/network
  generator: template
  content: |-
    NETWORKING=yes
    HOSTNAME={{ container.name }}

- name: meta-data
  generator: cloud-init
  variants:
  - cloud

- name: network-config
  generator: cloud-init
  content: |-
    {% if config_get("user.network-config", "") == "" %}version: 1
    config:
      - type: physical
        name: {% if instance.type == "virtual-machine" %}enp5s0{% else %}eth0{% endif %}
        subnets:
          - type: {% if config_get("user.network_mode", "") == "link-local" %}manual{% else %}dhcp{% endif %}
            control: auto
          - type: dhcp6
            control: auto{% else %}{{ config_get("user.network-config", "") }}{% endif %}
  variants:
  - cloud

- name: user-data
  generator: cloud-init
  variants:
  - cloud

- name: vendor-data
  generator: cloud-init
  variants:
  - cloud

- generator: incus-agent
  types:
  - vm

packages:
  manager: yum
  update: true
  cleanup: true
  sets:
  - packages:
    - cronie
    - cronie-noanacron
    - curl
    - glibc-langpack-en
    - glibc-locale-source
    - hostname
    - initscripts
    - iproute
    - openssh-clients
    - passwd
    - policycoreutils
    - rootfiles
    - rsyslog
    - sudo
    - vim-minimal
    action: install

  - packages:
    - dhclient
    action: install
    releases: # dhclient is not available in 10
    - 8
    - 9

  - packages:
    - network-scripts
    action: install
    types:
    - container
    releases:
    - 8

  - packages:
    - NetworkManager
    action: install
    types:
    - vm
    variants:
    - default

  - packages:
    - cloud-init
    - NetworkManager
    action: install
    variants:
    - cloud

  - packages:
    - NetworkManager
    action: install
    types:
    - container
    releases:
    - 9
    - 10
    variants:
    - default

  - packages:
    - cloud-utils-growpart
    action: install
    types:
    - vm
    variants:
    - cloud

  - packages:
    - shim
    action: install
    types:
    - vm

  - packages:
    - kernel
    action: install
    types:
    - vm

  - packages:
    - grub2-efi-x64
    action: install
    types:
    - vm
    architectures:
    - x86_64

  - packages:
    - grub2-efi-aarch64
    action: install
    types:
    - vm
    architectures:
    - aaarch64

actions:
- trigger: post-unpack
  action: |-
    #!/bin/sh
    # Make sure we have our template targets
    touch /etc/hosts
    touch /etc/hostname

- trigger: post-unpack
  action: |-
    #!/bin/sh
    # Generate machine-id in order for the kernel stuff to be configured properly
    systemd-machine-id-setup
  types:
  - vm

- trigger: post-packages
  action: |-
    #!/bin/sh
    set -eux

    # Disable SELinux
    mkdir -p /selinux
    echo 0 > /selinux/enforce

    # Disable loginuid in PAM stack
    sed -i '/^session.*pam_loginuid.so/s/^session/# session/' /etc/pam.d/*

    # Set default locale
    localedef -i en_US -f UTF-8 en_US.UTF-8
    echo 'LANG=en_US.utf8' > /etc/locale.conf

    # Disable first boot wizard
    systemctl mask systemd-firstboot.service

- trigger: post-files
  action: |-
    #!/bin/sh
    set -eux

    # Regenerate initramfs
    kver=$(ls /boot/initramfs-*.img | sed -r 's#.*initramfs-(.+)\.img#\1#')
    dracut --kver "${kver}" -f

    target="$(readlink -f /etc/grub2-efi.cfg)"
    grub2-mkconfig -o "${target}"

    sed -i "s#root=[^ ]*#root=${DISTROBUILDER_ROOT_UUID}#g" "${target}"
  types:
  - vm
  releases:
  - 8

- trigger: post-files
  action: |-
    #!/bin/sh
    set -eux
    kver=$(ls /boot/initramfs-*.img | sed -r 's#.*initramfs-(.+)\.img#\1#')
    target=/boot/efi/EFI/rocky/grub.cfg
    # Create grub.cfg file
    grub2-mkconfig -o "${target}"
    sed -i "s#root=[^ ]*#root=${DISTROBUILDER_ROOT_UUID}#g" "${target}"

    # Update files in /boot/loader/entries/. `grubby` needs to be run after
    # `grub2-mkconfig` as the latter overwrites files in /boot/loader/entries/.
    grubby --update-kernel=/boot/vmlinuz-${kver} --args="root=${DISTROBUILDER_ROOT_UUID} ro"

    # Regenerate initramfs
    dracut --kver "${kver}" -f
  types:
  - vm
  releases:
  - 9

- trigger: post-files
  action: |-
    #!/bin/sh
    set -eux

    # Track down the kernel
    kver=$(basename /boot/initramfs-*.img | sed -r 's#initramfs-(.+)\.img#\1#' | head -n1)
    if [ -z "$kver" ]; then
      echo "No initramfs found in /boot!" >&2
      exit 1
    fi

    kernel_path=$(find /boot -name "vmlinuz-${kver}" || true)
    if [ -z "$kernel_path" ]; then
      echo "Kernel image /boot/vmlinuz-${kver} not found!" >&2
      ls -l /boot >&2
      exit 1
    fi

    # Track down the root disk
    root_dev=$(df / | tail -n1 | awk '{print $1}')
    if [ -b "$root_dev" ]; then
      root_uuid=$(blkid -s UUID -o value "$root_dev")
      if [ -z "$root_uuid" ]; then
        echo "Failed to get UUID for $root_dev" >&2
        exit 1
      fi
    else
      echo "Error: Root device $root_dev not found!" >&2
      exit 1
    fi

    # Re-generate the initrd
    . /etc/os-release
    GRUB_ENTRY_NAME="${NAME} ${VERSION} ${kver}"
    dracut --kver "${kver}" -f --no-hostonly --add-drivers "virtio_scsi virtio_console sd_mod ext4 virtio_blk virtio_pci scsi_mod" --install "blkid"


    # Track down the EFI partition
    disk_dev=$(lsblk -no pkname "$root_dev" | head -n1)
    if [ -z "$disk_dev" ]; then
      echo "Failed to find disk device for $root_dev" >&2
      exit 1
    fi
    disk_dev="/dev/$disk_dev"

    efi_part="${disk_dev}p1"
    if [ ! -b "$efi_part" ]; then
      echo "EFI partition $efi_part not found!" >&2
      exit 1
    fi

    # Generate the grub configuration
    mkdir -p /mnt/efi
    mount "$efi_part" /mnt/efi

    mkdir -p /mnt/efi/EFI/rocky
    cat > "/mnt/efi/EFI/rocky/grub.cfg" <<EOF
    set timeout=5
    set default=0

    menuentry '${GRUB_ENTRY_NAME}' {
        set root=(hd0,gpt2)
        linux /boot/vmlinuz-${kver} root=UUID=${root_uuid} ro console=tty1 console=ttyS0
        initrd /boot/initramfs-${kver}.img
    }

    menuentry 'UEFI Firmware Settings' {
        fwsetup
    }
    EOF

    umount /mnt/efi
    mkdir -p /boot/grub2
    touch /boot/grub2/grubenv
  types:
  - vm
  releases:
  - 10

- trigger: post-files
  action: |-
    #!/bin/sh
    set -eux

    systemctl enable NetworkManager.service
  types:
  - vm
  variants:
  - default

- trigger: post-files
  action: |-
    #!/bin/sh
    set -eux

    mkdir -p /etc/NetworkManager/conf.d/
    printf "[main]\ndhcp=internal\n" > /etc/NetworkManager/conf.d/dhcp-client.conf

    systemctl enable NetworkManager.service
  types:
  - container
  variants:
  - default
  releases:
  - 10

- trigger: post-files
  action: |-
    #!/bin/sh
    set -eux

    mkdir -p /etc/NetworkManager/conf.d/
    printf "[main]\ndhcp=dhclient\n" > /etc/NetworkManager/conf.d/dhcp-client.conf

    systemctl enable NetworkManager.service
  types:
  - container
  variants:
  - default
  releases:
  - 9

- trigger: post-files
  action: |-
    #!/bin/sh
    set -eux

    systemctl enable network
  types:
  - container
  variants:
  - default
  releases:
  - 8
