diff options
| -rw-r--r-- | .gitignore | 2 | ||||
| -rw-r--r-- | mkosi.default | 19 | ||||
| -rw-r--r-- | mkosi.extra/etc/apt/apt.conf.d/20auto-upgrades | 9 | ||||
| -rw-r--r-- | mkosi.extra/etc/apt/apt.conf.d/50unattended-upgrades | 34 | ||||
| -rw-r--r-- | mkosi.extra/etc/systemd/system/etherpad.service | 15 | ||||
| -rw-r--r-- | mkosi.nspawn | 13 | ||||
| -rwxr-xr-x | mkosi.postinst | 27 |
7 files changed, 119 insertions, 0 deletions
diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..3dff6a2 --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +# mkosi cache +mkosi.cache/* diff --git a/mkosi.default b/mkosi.default new file mode 100644 index 0000000..e919749 --- /dev/null +++ b/mkosi.default @@ -0,0 +1,19 @@ +[Distribution] +Distribution=ubuntu +Release=focal +Repositories=main,universe +Mirror=http://no.archive.ubuntu.com/ubuntu + +[Output] +Format=directory +Output=/var/lib/machines/cgit + +[Packages] +WithNetwork=yes +Packages= + ca-certificates + unattended-upgrades + nodejs + npm + git + sudo diff --git a/mkosi.extra/etc/apt/apt.conf.d/20auto-upgrades b/mkosi.extra/etc/apt/apt.conf.d/20auto-upgrades new file mode 100644 index 0000000..4c725ab --- /dev/null +++ b/mkosi.extra/etc/apt/apt.conf.d/20auto-upgrades @@ -0,0 +1,9 @@ +APT::Periodic::Unattended-Upgrade "1"; + +APT::Periodic::Update-Package-Lists "1"; + + +APT::Periodic::AutocleanInterval "7"; + + + diff --git a/mkosi.extra/etc/apt/apt.conf.d/50unattended-upgrades b/mkosi.extra/etc/apt/apt.conf.d/50unattended-upgrades new file mode 100644 index 0000000..768347b --- /dev/null +++ b/mkosi.extra/etc/apt/apt.conf.d/50unattended-upgrades @@ -0,0 +1,34 @@ +// Unattended-Upgrade::Origins-Pattern controls which packages are +// upgraded. +Unattended-Upgrade::Origins-Pattern { + "origin=Ubuntu,archive=${distro_codename}-security"; + "o=Ubuntu,a=${distro_codename}"; + "o=Ubuntu,a=${distro_codename}-updates"; + "o=Ubuntu,a=${distro_codename}-proposed-updates"; + "o=Ubuntu,n=${distro_codename}-backports"; + }; + +// List of packages to not update (regexp are supported) +Unattended-Upgrade::Package-Blacklist { +}; + + +// Split the upgrade into the smallest possible chunks so that +// they can be interrupted with SIGUSR1. This makes the upgrade +// a bit slower but it has the benefit that shutdown while a upgrade +// is running is possible (with a small delay) +Unattended-Upgrade::MinimalSteps "true"; + + +// Do automatic removal of new unused dependencies after the upgrade +// (equivalent to apt-get autoremove) +Unattended-Upgrade::Remove-Unused-Dependencies "true"; + + +// Do upgrade application even if it requires restart after upgrade +// I.e. "XB-Upgrade-Requires: app-restart" is set in the debian/control file +Unattended-Upgrade::IgnoreAppsRequireRestart "true"; + +// Automatically run "dpkg --force-confold --configure -a". +Unattended-Upgrade::AutoFixInterruptedDpkg "true"; + diff --git a/mkosi.extra/etc/systemd/system/etherpad.service b/mkosi.extra/etc/systemd/system/etherpad.service new file mode 100644 index 0000000..edbf092 --- /dev/null +++ b/mkosi.extra/etc/systemd/system/etherpad.service @@ -0,0 +1,15 @@ +[Unit] +Description=Etherpad-lite, the collaborative editor. +After=syslog.target network.target + +[Service] +Type=simple +User=etherpad +Group=etherpad +WorkingDirectory=/opt/etherpad +Environment=NODE_ENV=production +ExecStart=/usr/bin/nodejs /opt/etherpad/node_modules/ep_etherpad-lite/node/server.js +Restart=always + +[Install] +WantedBy=multi-user.target diff --git a/mkosi.nspawn b/mkosi.nspawn new file mode 100644 index 0000000..4abcc08 --- /dev/null +++ b/mkosi.nspawn @@ -0,0 +1,13 @@ +[Exec] +Hostname=etherpad +ResolvConf=copy-host +Timezone=copy +PrivateUsers=pick +NoNewPrivileges=yes + +[Files] +PrivateUsersChown=true +BindReadOnly=/etc/etherpad/settings.json:/opt/etherpad/settings.json + +[Network] +VirtualEthernet=no diff --git a/mkosi.postinst b/mkosi.postinst new file mode 100755 index 0000000..8dca071 --- /dev/null +++ b/mkosi.postinst @@ -0,0 +1,27 @@ +#!/bin/sh +set -ex +export DEBIAN_FRONTEND=noninteractive + +# motd +chmod 644 /etc/update-motd.d/* +systemctl mask motd-news.service +systemctl mask motd-news.timer + +# Add update- and security-repositories, and perform upgrade +RELEASE=$(grep DISTRIB_CODENAME /etc/lsb-release | awk -F'=' '{print $2}') +echo "deb http://no.archive.ubuntu.com/ubuntu ${RELEASE}-security main universe" >> /etc/apt/sources.list +echo "deb http://no.archive.ubuntu.com/ubuntu ${RELEASE}-updates main universe" >> /etc/apt/sources.list +apt-get update && apt-get --yes full-upgrade && apt-get --yes autoremove + +# etherpad +groupadd --system etherpad +useradd --home-dir /opt/etherpad --system --gid etherpad etherpad + + +git clone --branch master https://github.com/ether/etherpad-lite.git /opt/etherpad +chmod 700 /opt/etherpad +chown -R etherpad: /opt/etherpad + +sudo -u etherpad -H /opt/etherpad/bin/installDeps.sh + +systemctl enable etherpad |