This patch affects the various artiact file names in release tarballs.
The files /etc/os-release and /etc/version in the image use the actual
GIT commit (git describe), as per post-build.sh
Guiding principle: artifacts without release suffix are development or
"nightly" builds. Artifacts *with* release suffix are released ones.
This drops the $GITVER from .img files for consistency with the other
artifacts, e.g. .gns3a and .pkg.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To set up proper factory defaults in Infix we need to drop the default
/etc/sysrepo datastores, initialized at compile-time by Buildroot when
installing netopeer2. The pre-initialized datastores cannot be set up
with new {factory} data in any other way.
The system factory-config is constructed from two parts: static data and
generated data. The latter is:
- hostname (product name + the three last octets of the base MAC)
- interface defaults (depends on number of ports on the device) that
enable IPv6 link-local on all interfaces, and
- per-device unique SSH hostkey for remote NETCONF access, requires
openssl binary on target. Can maybe use openssh for this (TODO).
The hostkeys are saved in /cfg/factory.d/ to prevent them from being
regenerated on every boot.
The script gen-hostkeys and the update of 10-netconf-server.json are
inspired by the netopeer2 scripts merge_hostkey.sh and merge_config.sh,
which do just about the same thing for regular systems.
We bootstrap sysrepo early with all the required models, netopeer2 as
well as our own, by calling sysrepoctl with initial data for {factory}
and {startup} datastores. A local patch to sysrepo is used to allow it
to look for an /etc/factory-default.json instead of compile-time default
data, the patch allows us to have variable amount of objects in the init
data, e.g. number of interface objects.
A system startup-config is generated, if one is mising, from {running}.
We then drop the initial {running} datastore before starting the daemons
sysrepo-plugind and netopeer2-server so that they, and our plugins, are
ready when we load the system startup-config.
Some sanity checks and debug possibilities:
- Ensure /etc/sysrepo exists before copying factory-config
- Keep factory-default.json for debug
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Primarily intended for minimal/testing images, but likely also useful
for other use-cases as well.
Defaults remain to sign all images.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since qemu.sh is now tied to the directory it's ran from, it makes
sense to change into that directory before starting to resolve any
file paths. This let's us start the script from any directory without
the need for any (cd && qemu) subshell.
This change drops Qemu menuconfig from the regular 'make menuconfig' in
favor of full release tarball support. Meaning "make update-defconfig"
will not longer cause unwanted diffs for Qemu defaults checked in when
the defconfigs are updated.
Details:
- For "make run, run-menuconfig" and bootstrapping qemu.cfg we want to
use the Buildroot menuconfig system. However, we must set the proper
environment variables for it to not overwrite our product's .config,
so the calls to conf and mconf are not pretty.
- The qemu.sh script can probably be cleaned up further, I've just set
a CONFIG_ prefix to all variables and dropped any images/ prefix vs.
the original. The CONFIG_ prefix is to make the qemu.cfg compatible
with kconfig-mconf from the kconfig-frontends package.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
First basic step, we also want a menuconfig-like way of changing the
settings, e.g., networking options.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When evolving to a new generation fails, users will typically abandon
it (so that a new attempt can be made). However, the generated
scripts and the logged output is very valuable from a debugging
perspective.
Therefore, keep the data around by just renaming the generation
directory.
Later, we can include these directories in the garbage collecting
process, if we want to.
Initial analysis of system default users gives that there is no real
need for a default 'factory' user to trigger a factory reset. On an
actual physical device we will have a reset button or a menu option in
the bootloader to trigger factory reset, and in both physical and
virtual (GNS3) devices a logged in admin user can call the factory
command.
A virtual device that cannot be logged in to will have to be removed and
have its persistent backing store deleted, but that is the only real
downside to removing this user. The idea is to set a kernel command
line flag from the bootloader, and that could also be done from, e.g.,
GNS3.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The /var, and particularly /var/lib, directories are used for persistent
storage for various system daemons. While adding support for containers
it became clear we had to change how we make these directories writable.
Both LXC and Podman use OverlayFS for the writable layer, and you cannot
set up an overlay on top of another overlay.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Podman (POD manager) is an open source tool for developing, managing,
and running containers on your Linux systems.
Based on work by Christian Stewart and Nathaniel Husted.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A generic replacement for src/net with some advantages:
- Shell script is well-suited to these kinds of tasks, making this
implementation much simpler.
- Allow arbitrary number of actions (not just init/exit), this can be
used to implement things like `dagger exec up/down`.
- Allow arbitrary number of scripts for each action/node tuple. This
will let us handle more complex scenarios in confd without having to
fiddle about with src/net.
This allows you to define a single "logical" config that can be
tailored to the specific system based on the available interfaces,
base MAC address etc.
This commit enables support for running custom startup scripts at boot,
allowing a mix of a NETCONF-based system and Classic /etc. For example,
use NETCONF to set up network interfaces, users, etc. and runparts for
enabling and configuring the device as an OSPF router.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the introduction of the -classic defconfigs we need to also make
sure to name the resulting artifacts accordingly:
- infix-$ARCH.{gns3a,img,pkg}
- infix-$ARCH-classic.{gns3a,img,pkg}
For release builds the version (-23.02-$REV) will be appended before
the file suffix, e.g., infix-x86-64-classic-23.02-3.img
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- board/common: drop everything not needed by NETCONF mode
- board/classic: most board/common helpers relocated here
- Simplify Finit scripts for critical services
- Source variant from /etc/os-release to select ramdisk /etc
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A long standing internal debate comes to its logical conclusion. Arch
naming should follow GCC. The "native /etc" has also found a better
name: classic!
README and GitHub action has been updated accordingly.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Drop unused packages in NETCONF (default) mode
In the default build we will use the net tool instead of iupdown-ng,
p-net & Profeth will move to customer-specifc builds with another
licensing model.
- Split out NETCONF specific parts from board/common to board/netconf
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This build is intended as a base reference and for use as a very simple
end device. The default starts DHCP and IPv4LL (ZeroConf) on eth0, but
can be configured by editing /etc/network/interfaces.d/*
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the new templating support in Finit, and this patch, we can now
very easily enable a ZeroConf service on, e.g., eth0:
$ initctl enable zeroconf@eth0
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The root user is by default not allowed to log in over SSH, so we add an
admin user with limited root privileges for this purpose.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The per-interface and per-af setting in the ietf-ip yang module allow
the user to enable a more granular forwarding between interfaces, which
is disabled by default.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of having to rely on the kernel command line, we convert all the
kernel functionality in question into modules and rely on the auto-load
feature in the kernel and modprobe to add options at load time.
The fb_tunnels setting is a net core setting, for that we use sysctl.
This commit also syncs the kernel config between our two main archs,
disabling DRM and SOUND for the Amd64 build as a spin-off.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds multi-nameserver support using openresolv (resolvconf)
and dnsmasq. This means that a DHCP client (dhcpcd) or VPN client can
be providers of nameservers to the system. Dnsmasq takes over as the
system resolver, except when the user has set up static configuration.
Static nameserver(s), as well as search and options, are always added
first by openresolv to /etc/resolv.conf.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In managed NETCONF mode /etc is always based on the image's read-only
/etc with a read-writable overlay as a RAM disk. We control the image
and know the default rc.local is empty and the interfaces file only
list the loopback interface.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Only disable default services we don't need, prevents touching
services mid-air in runlevel S. Allow nginx now as well
- Enable fcgi based RESTCONF interface via nginx by default
- Enable auth:none for customer demo
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Chrony drops privs after startup to user chrony, when restarting it
writes its state in /var/lib/chrony, so the directory needs to have
the correct permissions for that user.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
