Introduce a new approach to dtb-building:
Old way: `rsync` an overlay containing our dt source to the kernel,
and then build via buildroot's `_INTREE_DTS_NAME`. This does not work
in recent kernels (at least since 6.12), which requires all dtb's to
be explicitly listed in a `Makefile`.
New way: Create a separate package for every board, and build the
device trees via the kernel's standard interface for building external
modules. This has two main advantages:
1. We can easily interpose a patched version of an upstream device
tree. E.g., we can easily set the factory password.
2. It is much easier to get an overview of which boards are enabled,
rather than scrolling back and forth in the `_INTREE_DTS_NAME` list.
Enable all fully supported boards in the defconfigs.
Since `conmon` only logs the output from the monitored container's
`stdout`/`stderr`, we might as well get rid of `k8s-logger`, and let
the output pass through to finit, which will then pipe the messages to
syslog.
Fix#836
Declare that confd-test-mode depends on confd, otherwise with 'select',
a call to `make update-defconfig` will remove BR2_PACKAGE_CONFD=y, which
we feel is very confusing -- in particular when comparing any defconfig
that does not have test-mode package.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
NETOPEER2 requries the OpenSSL backend of libssh. By default, except on
minimal builds, is to use GCrypt backend. Gcrypt is selected because of
Podman, which is not in the minimal builds.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Sync (make update-defconfig)
- test-mode selects confd
- gencert seclets openssl which in turn selects LIBSSH*_OPENSSL
- rest is relocaations according to Config.in
- Add LIBMNL to x86_64 targets, otherwise iproute2 does not install devlink
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This intoduce a new sysrepo plugin to handle a new YANG
model 'infix-test'. Today only contains the actions.
This is required to run tests on infix using infamy.
This is a part of #561
Signed-off-by: Mattias Walström <lazzer@gmail.com>
The PAM plugin lastlog, previously used (optional) by Netopeer2 and
Rousette, does not rotate /var/log/lastlog, and since we don't have
cron and logrotate this can potentially fill up /var.
This patch disables pam_lastlog.so from the build and drops the two
matching session lines for both Netopeer2 and Rousette. Both still
log user access to sysrepo, so no critical functionality is lost.
Follow-up to issue #542
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Backport pam-lastlog build fix from latest Buildroot master and enable
in all defconfigs to fix syslog warning:
login[2819]: PAM unable to dlopen(/lib/security/pam_lastlog.so)
Fixes#542
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change builds on top of the earlier work to bootstrap Infix YANG
modules at build time. Adding a step at the end of post-build.sh to
call the yangdoc tool. The resulting yangdoc.html is a stand-alone HTML
file of (almost) all YANG nodes. Almost because some top-level nodes
are unused by Infix atm. and have been filtered out for readability.
Fixes#432
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Sync after `make update-defconfig`:
- avahi selected by mdns-alias package (all)
- iptables and ca-certs selected by other packages (r2s)
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Add sshd 'UsePAM yes'
- Buildroot automatically adds and enables:
- /etc/pam.d/ with authentication for login, sshd, and sudo
- PAM support in BusyBox login
Also, prepare for adding RADIUS authentication support to ietf-system
the only tricky part is testing against a RADIUS server.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Relocate the default landing page from the rootfs overlay to a package
so that customer repos can override it.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The massive-parallel build change added recently is a bit shaky still,
so while we stabilze that, we revert it and also take the oppportunity
to tag the new build server.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Today, only one certificate is shipped with infix, it is
selectable in menuconfig. It is also possible to add extra
certificates, useful when using infix as a submodule.
The Finit @console construct detects what your actual serial console is
by looking it up in /sys/class/tty/console/active. This to avoid any
weird problems that might occur when using /dev/console.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Converting to gunicorn, which is the recommended production server for
Flask apps, means app main() function is no longer called at startup, so
we have to factor out the mDNS CNAME functionality for infix.local and
network.local to a separate app.
We take this opportunity to collapse the structure, move non-class
methods to __init.py__, and rename the AvahiAlias class. A prototype
for replacing the overhead of mdns-alias with a C daemon is in its
early stages.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Advertises the build-time $hostname.local as a CNAME to the A and
AAAA records already advertised by Avahi
- Advertises a special network.local CNAME and provides a fastcgi
service on unix:/tmp/netbrowse.sock for browsing mDNS services
This commit also activates netbrowse by default with nginx listeing
to port 80 on IPv4 and IPv6 /browse by default but also / if called
with server name network.local.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With Classic builds out of the way we can move everything back to common
again to simplify and reduce our collective cognitive overhead a bit.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Mattias Walström