ConfigLMM 0.3.0 → 0.5.0

data/Plugins/Apps/YaCy/YaCy.lmm.rb

@@ -0,0 +1,160 @@
+require 'digest'
+
+module ConfigLMM
+    module LMM
+        class YaCy < Framework::Plugin
+
+            USER = 'yacy'
+            HOME_DIR = '/var/lib/yacy'
+            PORT = 8090
+
+            def actionYaCyDeploy(id, target, activeState, context, options)
+                self.withConnection(target['Location'], target) do |connection|
+                    Linux.withConnection(connection) do |linuxConnection|
+                        if !target.key?('Proxy') || target['Proxy'] == false
+                            deployYaCyService(linuxConnection, target, activeState, context, options)
+                        end
+
+                        deployYaCyProxy(linuxConnection, target, activeState, context, options)
+
+                        if !target.key?('Proxy') || target['Proxy'] == false
+                            linuxConnection.reloadUserServices(USER, options)
+                            linuxConnection.restartUserService(USER, 'YaCy', options)
+                        end
+                    end
+                end
+            end
+
+            def deployYaCyService(linuxConnection, target, activeState, context, options)
+                Podman.ensurePresent(linuxConnection, options)
+                Podman.createUser(USER, HOME_DIR, 'YaCy', linuxConnection, options)
+                linuxConnection.withUserShell(USER) do |shell|
+                    shell.createDirs(options, '~/DATA')
+                end
+
+                path = Podman.containersPath(HOME_DIR)
+
+                linuxConnection.fileWrite("#{path}/YaCy.env", '', options)
+
+                linuxConnection.setUserGroup("#{path}/YaCy.env", USER, USER, options)
+                linuxConnection.setPrivate("#{path}/YaCy.env", options)
+
+                linuxConnection.upload(__dir__ + '/YaCy.container', path, options)
+
+                linuxConnection.reloadUserServices(USER, options)
+
+                configMissing = !linuxConnection.filePresent?("#{HOME_DIR}/DATA/SETTINGS/yacy.conf", { **options, 'dry': false })
+
+                linuxConnection.restartUserService(USER, 'YaCy', options) if configMissing
+
+                linuxConnection.stopUserService(USER, 'YaCy', options)
+
+                settings = target['Settings'].to_h
+                settings['remotesearch.https.preferred'] = true if settings['remotesearch.https.preferred'] != false
+                settings['network.unit.protocol.https.preferred'] = true if settings['network.unit.protocol.https.preferred'] != false
+                settings['upnp.enabled'] = false if settings['upnp.enabled'] != true
+                settings['browserPopUpTrigger'] = false if settings['browserPopUpTrigger'] != false
+                settings['seedFilePath'] = '/opt/yacy_search_server/DATA/HTDOCS/seed.txt' unless settings['seedFilePath']
+
+                settings['adminAccountUserName'] = nil
+                settings['adminRealm'] = nil
+
+                if !target['Admin'].to_h.empty?
+                    settings['adminAccountUserName'] = target['Admin']['Username']
+                    settings['adminRealm'] = target['Admin']['Realm']
+                end
+
+                if !settings['adminAccountUserName']
+                    settings['adminAccountUserName'] = linuxConnection.exec("grep '^adminAccountUserName=' '#{HOME_DIR}/DATA/SETTINGS/yacy.conf' | cut -d= -f2").strip
+                end
+
+                if !settings['adminRealm']
+                    settings['adminRealm'] = linuxConnection.exec("grep '^adminRealm=' '#{HOME_DIR}/DATA/SETTINGS/yacy.conf' | cut -d= -f2").strip
+                end
+
+                adminPassword = context.secrets.load(target['SecretId'], 'ADMIN_PASSWORD')
+                if !adminPassword
+                    adminPassword = SecureRandom.alphanumeric(30)
+                    if !options['dry']
+                        context.secrets.store(target['SecretId'], 'ADMIN_PASSWORD', adminPassword)
+                        context.secrets.print("YaCy Admin '#{settings['adminAccountUserName']}' password", adminPassword)
+                    end
+                end
+
+                settings['adminAccountBase64MD5'] = 'MD5:' + Digest::MD5.hexdigest("#{settings['adminAccountUserName']}:#{settings['adminRealm']}:#{adminPassword}")
+
+                settings.each do |name, value|
+                    hide = name == 'adminAccountBase64MD5'
+                    linuxConnection.fileReplace("#{HOME_DIR}/DATA/SETTINGS/yacy.conf", "^#{name}=.*", "#{name}=#{value}", { **options, hide: hide })
+                end
+
+                target['Profile'].to_h.each do |name, value|
+                    linuxConnection.fileReplace("#{HOME_DIR}/DATA/SETTINGS/profile.txt", "^#{name}=.*", "#{name}=#{value.gsub(':', '\\:')}", options)
+                end
+
+                if settings['staticIP']
+                    linuxConnection.fileReplace("#{HOME_DIR}/DATA/INDEX/freeworld/NETWORK/mySeed.txt", "IP=[^,]*,", "IP=#{settings['staticIP']},", options)
+                end
+
+                if target['PeerName']
+                    linuxConnection.fileReplace("#{HOME_DIR}/DATA/INDEX/freeworld/NETWORK/mySeed.txt", "Name=[^,]*,", "Name=#{target['PeerName']},", options)
+                end
+
+                if target['SeedURL']
+                    linuxConnection.fileReplace("#{HOME_DIR}/DATA/INDEX/freeworld/NETWORK/mySeed.txt", "seedURL=[^,]*,", "seedURL=#{target['SeedURL']},", options)
+                end
+
+                settings['adminAccountBase64MD5'] = '<REDACTED>'
+            end
+
+            def deployYaCyProxy(linuxConnection, target, activeState, context, options)
+                if !target.key?('Proxy') || target['Proxy']
+                    raise Framework::PluginProcessError.new('Domain field must be set!') if !target['Domain'] && (!target.key?('Proxy') || target['Proxy'])
+                    Nginx.withConnection(linuxConnection) do |nginxConnection|
+                        target['Server'] = '127.0.0.1:' + PORT.to_s unless target['Server']
+                        target['Server'] += ':'  + PORT.to_s unless target['Server'].include?(':')
+                        nginxConnection.writeConfig(__dir__, 'YaCy', target, activeState, context, options)
+                        nginxConnection.deployAllConfigs(target, activeState, context, options)
+                    end
+                elsif target.key?('Proxy') && target['Proxy'] == false
+                    path = Podman.containersPath(HOME_DIR)
+                    linuxConnection.fileReplace("#{path}/YaCy.container", 'PublishPort=127.0.0.1:', 'PublishPort=0.0.0.0:', options)
+                    linuxConnection.firewallAddPort("#{PORT}/tcp", options)
+                end
+            end
+
+            def cleanup(configs, state, context, options)
+                cleanupType(:YaCy, configs, state, context, options) do |item, id, state, context, options, connection|
+                    Linux.withConnection(connection) do |linuxConnection|
+
+                        if !item['Config'].key?('Proxy') || item['Config']['Proxy']
+                            Nginx.withConnection(linuxConnection) do |nginxConnection|
+                                nginxConnection.cleanupConfig('YaCy', context, options)
+                                nginxConnection.reload(options)
+                            end
+                        elsif item['Config'].key?('Proxy') && item['Config']['Proxy'] == false
+                            linuxConnection.firewallRemovePort("#{PORT}/tcp", options)
+                        end
+
+                        if !target.key?('Proxy') || target['Proxy'] == false
+                            linuxConnection.stopUserService(USER, 'YaCy', options)
+
+                            path = Podman.containersPath(HOME_DIR)
+                            linuxConnection.rm(path + '/YaCy.container', options[:dry])
+
+                            state.item(id)['Status'] = State::STATUS_DELETED unless options[:dry]
+
+                            if options[:destroy]
+                                linuxConnection.deleteUserAndGroup(USER, options)
+                                state.item(id)['Status'] = State::STATUS_DESTROYED unless options[:dry]
+                            end
+                        else
+                            state.item(id)['Status'] = options[:destroy] ? State::STATUS_DESTROYED : State::STATUS_DELETED unless options[:dry]
+                        end
+                    end
+                end
+            end
+
+        end
+    end
+end

data/Plugins/Apps/ZooKeeper/ZooKeeper.container

@@ -0,0 +1,24 @@
+
+[Unit]
+Description=Apache ZooKeeper container
+After=local-fs.target
+
+[Container]
+ContainerName=ZooKeeper
+Image=docker.io/bitnami/zookeeper:latest
+EnvironmentFile=/var/lib/zookeeper/.config/containers/systemd/ZooKeeper.env
+PublishPort=127.0.0.1:2181:2181
+PublishPort=127.0.0.1:2888:2888
+PublishPort=127.0.0.1:3888:3888
+PublishPort=127.0.0.1:18500:8080
+UserNS=keep-id:uid=1001,gid=1001
+Volume=/var/lib/zookeeper/data:/bitnami/zookeeper/data
+LogDriver=journald
+AutoUpdate=registry
+
+[Service]
+TimeoutStartSec=6min
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target default.target

data/Plugins/Apps/ZooKeeper/ZooKeeper.lmm.rb

@@ -0,0 +1,68 @@
+
+module ConfigLMM
+    module LMM
+        class ZooKeeper < Framework::Plugin
+
+            USER = 'zookeeper'
+            HOME_DIR = '/var/lib/zookeeper'
+            SERVICE_NAME = 'ZooKeeper'
+
+            def actionZooKeeperDeploy(id, target, activeState, context, options)
+                self.withConnection(target['Location'], target) do |connection|
+                    Linux.withConnection(connection) do |linuxConnection|
+                        Podman.ensurePresent(linuxConnection, options)
+                        Podman.createUser(USER, HOME_DIR, 'ZooKeeper', linuxConnection, options)
+                        linuxConnection.withUserShell(USER) do |shell|
+                            shell.createDirs(options, '~/data')
+                        end
+
+                        username = target['Username'] || context.secrets.load(target['SecretId'], 'USERNAME') || 'zookeeper'
+                        context.secrets.store(target['SecretId'], 'USERNAME', username)
+                        password = context.secrets.load(target['SecretId'], 'PASSWORD')
+                        if password.nil?
+                            password = SecureRandom.alphanumeric(20)
+                            context.secrets.store(target['SecretId'], 'PASSWORD', password)
+                            context.secrets.print("#{username} password", password)
+                        end
+
+                        path = Podman.containersPath(HOME_DIR)
+                        linuxConnection.fileWrite("#{path}/ZooKeeper.env", 'ZOO_ENABLE_AUTH=yes', options)
+                        linuxConnection.fileAppend("#{path}/ZooKeeper.env", 'ZOO_AUTOPURGE_INTERVAL=1', options)
+
+                        if target['ServerID']
+                            linuxConnection.fileAppend("#{path}/ZooKeeper.env", "ZOO_SERVER_ID=#{target['ServerID']}", options)
+                        end
+
+                        linuxConnection.fileAppend("#{path}/ZooKeeper.env", "ZOO_SERVER_USERS=#{username}", options)
+                        linuxConnection.fileAppend("#{path}/ZooKeeper.env", "ZOO_SERVER_PASSWORDS=#{password}", { **options, hide: true })
+                        linuxConnection.setUserGroup("#{path}/ZooKeeper.env", USER, USER, options)
+                        linuxConnection.setPrivate("#{path}/ZooKeeper.env", options)
+
+                        linuxConnection.upload(__dir__ + '/ZooKeeper.container', path, options)
+                        linuxConnection.reloadUserServices(USER, options)
+                        linuxConnection.restartUserService(USER, SERVICE_NAME, options)
+                    end
+                end
+            end
+
+            def cleanup(configs, state, context, options)
+                cleanupType(:ZooKeeper, configs, state, context, options) do |item, id, state, context, options, connection|
+                    Linux.withConnection(connection) do |linuxConnection|
+                        linuxConnection.stopUserService(USER, SERVICE_NAME, options)
+
+                        path = Podman.containersPath(HOME_DIR)
+                        linuxConnection.rm("#{path}/ZooKeeper.container", options[:dry])
+
+                        state.item(id)['Status'] = State::STATUS_DELETED unless options[:dry]
+
+                        if options[:destroy]
+                            linuxConnection.deleteUserAndGroup(USER, options)
+                            state.item(id)['Status'] = State::STATUS_DESTROYED unless options[:dry]
+                        end
+                    end
+                end
+            end
+
+        end
+    end
+end

data/Plugins/Apps/bitmagnet/bitmagnet.conf.erb

@@ -16,9 +16,6 @@ server {
 
     server_name <%= config['Domain'] %>;
 
-    access_log  /var/log/nginx/bitmagnet.access.log;
-    error_log   /var/log/nginx/bitmagnet.error.log;
-
     include config-lmm/private.conf;
     include config-lmm/errors.conf;
 

data/Plugins/Apps/bitmagnet/bitmagnet.lmm.rb

@@ -10,7 +10,6 @@ module ConfigLMM
             def actionBitmagnetDeploy(id, target, activeState, context, options)
                 if !target['Location'] || target['Location'] == '@me'
                     deployNginxConfig(id, target, activeState, context, options)
-                    activeState['Location'] = '@me'
                 end
             end
 

data/Plugins/Apps/gollum/gollum.conf.erb

@@ -33,11 +33,11 @@ server {
         root               <%= config['Root'] %>;
     <% end %>
 
-    access_log  /var/log/nginx/gollum.access.log;
-    error_log   /var/log/nginx/gollum.error.log;
+    <% if config['AuthentikDomain'].nil? %>
+        include config-lmm/private.conf;
+    <% end %>
 
-    include config-lmm/private.conf;
-    include config-lmm/errors.conf;
+    include config-lmm/gateway-errors.conf;
 
     <% if config['CertName'] %>
         ssl_certificate "/etc/letsencrypt/live/<%= config['CertName'] %>/fullchain.pem";
@@ -62,7 +62,43 @@ server {
         location / {
             proxy_pass <%= config['Server'] %>;
 
+            <% if config['AuthentikDomain'] %>
+                error_page       401 = @authenticate;
+                include config-lmm/errors.conf;
+
+                auth_request     /outpost.goauthentik.io/auth/nginx;
+
+                # translate headers from the outposts back to the actual upstream
+                auth_request_set $authentik_username $upstream_http_x_authentik_username;
+                auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
+                auth_request_set $authentik_email $upstream_http_x_authentik_email;
+                auth_request_set $authentik_name $upstream_http_x_authentik_name;
+                auth_request_set $authentik_uid $upstream_http_x_authentik_uid;
+
+                proxy_set_header REMOTE_USER $authentik_username;
+                proxy_set_header REMOTE_GROUPS $authentik_groups;
+                proxy_set_header REMOTE_EMAIL $authentik_email;
+                proxy_set_header REMOTE_NAME $authentik_name;
+                proxy_set_header REMOTE_UID $authentik_uid;
+            <% end %>
+
             include config-lmm/proxy.conf;
         }
     <% end %>
+
+    <% if config['AuthentikDomain'] %>
+        location /outpost.goauthentik.io {
+            proxy_pass              https://<%= config['AuthentikDomain'] %>/outpost.goauthentik.io;
+            proxy_ssl_protocols     TLSv1.2 TLSv1.3;
+            proxy_set_header        X-Authentik-Host $host;
+            proxy_set_header        X-Original-URL $scheme://$http_host$request_uri;
+            proxy_pass_request_body off;
+            proxy_set_header        Content-Length "";
+        }
+
+        location @authenticate {
+            internal;
+            return 302 /outpost.goauthentik.io/start?rd=$request_uri;
+        }
+    <% end %>
 }

data/Plugins/Apps/gollum/gollum.container

@@ -3,10 +3,19 @@ Description=gollum container
 After=local-fs.target
 
 [Container]
-Image=gollumwiki/gollum:master
+ContainerName=gollum
+Image=docker.io/gollumwiki/gollum:master
+Exec=--config=/config/config.rb
 PublishPort=0.0.0.0:14567:4567
 UserNS=keep-id:uid=1000,gid=1000
 Volume=/srv/gollum/repo:/wiki
+Volume=/srv/gollum/config:/config
+LogDriver=journald
+AutoUpdate=registry
+
+[Service]
+TimeoutStartSec=6min
+Restart=on-failure
 
 [Install]
 WantedBy=multi-user.target default.target

data/Plugins/Apps/gollum/gollum.lmm.rb

@@ -1,19 +1,21 @@
 
 module ConfigLMM
     module LMM
-        class Gollum < Framework::NginxApp
+        class Gollum < Framework::Plugin
 
             NAME = 'gollum'
             USER = 'gollum'
             GOLLUM_PATH = '/srv/gollum'
-            HOME_DIR = '/var/lib/authentik'
+            GOLLUM_PORT = '14567'
 
             def actionGollumBuild(id, target, activeState, context, options)
-                writeNginxConfig(__dir__, NAME, id, target, activeState, context, options)
+                Nginx.withConnection(local) do |nginxConnection|
+                    nginxConnection.writeConfig(__dir__, NAME, target, state, context, options)
+                end
                 targetDir = options['output'] + GOLLUM_PATH
-                mkdir(targetDir, options['dry'])
-                copy(__dir__ + '/config.ru', targetDir, options['dry'])
-                `git init #{targetDir}/repo`
+                local.mkdir(targetDir + '/config', options['dry'])
+                local.copy(__dir__ + '/config.ru', targetDir, options['dry'])
+                local.exec("git init #{targetDir}/repo", options)
             end
 
             def actionGollumRefresh(id, target, activeState, context, options)
@@ -21,57 +23,64 @@ module ConfigLMM
             end
 
             def actionGollumDeploy(id, target, activeState, context, options)
-                if target['Location'] && target['Location'] != '@me'
-                    uri = Addressable::URI.parse(target['Location'])
-                    self.class.sshStart(uri) do |ssh|
+                self.withConnection(target['Location'], target) do |connection|
+                    Linux.withConnection(connection) do |linuxConnection|
                         if !target.key?('Proxy') || !!target['Proxy']
-                            self.class.prepareNginxConfig(target, ssh)
-                            if !target['Root']
-                                gollumPath = ssh.exec!('gem which gollum').strip
-                                target['Root'] = File.dirname(gollumPath) + '/gollum/public'
+                            #if !target['Root']
+                            #    gollumPath = linuxConnection.exec('gem which gollum', true).strip
+                            #    target['Root'] = File.dirname(gollumPath) + '/gollum/public'
+                            #end
+
+                            Nginx.withConnection(linuxConnection) do |nginxConnection|
+                                target['ConfigName'] = target['Name']
+                                nginxConnection.provision(__dir__, NAME, target, activeState, context, options)
                             end
-                            writeNginxConfig(__dir__, NAME, id, target, state, context, options)
-                            deployNginxConfig(id, target, activeState, context, options)
                         end
                         if !target.key?('Proxy') || target['Proxy'] != 'only'
-                            distroInfo = Framework::LinuxApp.currentDistroInfo(ssh)
-                            Framework::LinuxApp.configurePodmanServiceOverSSH(USER, GOLLUM_PATH, 'gollum', distroInfo, ssh)
-                            self.class.uploadFolder(options['output'] + GOLLUM_PATH, '/srv', ssh)
-                            path = Framework::LinuxApp::SYSTEMD_CONTAINERS_PATH.gsub('~', GOLLUM_PATH)
-                            ssh.scp.upload!(__dir__ + '/gollum.container', path)
-                            self.class.sshExec!(ssh, "chown -R #{USER}:#{USER} #{GOLLUM_PATH}")
-                            self.class.sshExec!(ssh, "systemctl --user --machine=#{USER}@ daemon-reload")
-                            self.class.sshExec!(ssh, "systemctl --user --machine=#{USER}@ start gollum")
-                        end
-                    end
-                else
-                    targetDir = GOLLUM_PATH
-                    mkdir(targetDir, options['dry'])
-                    if !target.key?('Proxy') || !!target['Proxy']
-                        self.class.prepareNginxConfig(target)
-                        if !target['Root']
-                            target['Root'] = File.dirname(`gem which gollum`.strip) + '/gollum/public'
+                            Podman.ensurePresent(linuxConnection, options)
+                            Podman.createUser(USER, GOLLUM_PATH, 'gollum', linuxConnection, options)
+                            linuxConnection.withUserShell(USER) do |shell|
+                                shell.createDirs(options, '~/data')
+                            end
+
+                            if !linuxConnection.filePresent?(GOLLUM_PATH, options)
+                                if target['Config']
+                                    local.copy(target['Config'], "#{options['output'] + GOLLUM_PATH}/config/config.rb", options['dry'])
+                                else
+                                    local.fileWrite(options['output'] + GOLLUM_PATH + "/config/config.rb", '', options['dry'])
+                                end
+                                linuxConnection.uploadFolder(options['output'] + GOLLUM_PATH, '/srv', options)
+                            else
+                                if target['Config']
+                                    linuxConnection.upload(target['Config'], "#{GOLLUM_PATH}/config/config.rb", options)
+                                end
+                            end
+
+                            path = Podman.containersPath(GOLLUM_PATH)
+                            linuxConnection.upload(__dir__ + '/gollum.container', path, options)
+
+                            linuxConnection.setUserGroup(GOLLUM_PATH, USER, USER, options)
+                            linuxConnection.reloadUserServices(USER, options)
+                            linuxConnection.restartUserService(USER, 'gollum', options)
+                            if target['Proxy'] != 'only'
+                                linuxConnection.firewallAddPort(GOLLUM_PORT + '/tcp', options)
+                            end
                         end
-                        writeNginxConfig(__dir__, NAME, id, target, state, context, options)
-                        deployNginxConfig(id, target, activeState, context, options)
-                    end
-                    if !target.key?('Proxy') || target['Proxy'] != 'only'
-                        copy(options['output'] + GOLLUM_PATH + '/config.ru', GOLLUM_PATH, options['dry'])
-                        copyNotPresent(options['output'] + GOLLUM_PATH + '/repo', GOLLUM_PATH, options['dry'])
-                        chown('http', 'http', GOLLUM_PATH, options['dry'])
                     end
-                    activeState['Location'] = '@me'
                 end
             end
 
             def cleanup(configs, state, context, options)
-                items = state.selectType(:Gollum)
-                items.each do |id, item|
-                    if !configs.key?(id)
-                        if item['Location'] == '@me'
-                            cleanupNginxConfig(NAME, id, state, context, options)
-                        else
-                            # TODO
+                cleanupType(:Gollum, configs, state, context, options) do |item, id, state, context, options, connection|
+                    if !item['Config'].key?('Proxy') || !!item['Config']['Proxy']
+                        Linux.withConnection(connection) do |linuxConnection|
+                            Nginx.withConnection(linuxConnection) do |nginxConnection|
+                                configName = NAME
+                                configName = item['Config']['ConfigName'] if item['Config']['ConfigName']
+                                nginxConnection.cleanupConfig(configName, context, options)
+                                nginxConnection.reload(options)
+                            end
+                            state.item(id)['Status'] = State::STATUS_DESTROYED unless options[:dry]
                         end
                     end
                 end

data/Plugins/Apps/llama.cpp/llama.cpp.container

@@ -0,0 +1,28 @@
+
+[Unit]
+Description=llama.cpp container
+After=local-fs.target
+
+[Container]
+ContainerName=llama.cpp
+Image=ghcr.io/ggml-org/llama.cpp:full
+Exec=--server --host 0.0.0.0 $ARGS
+EnvironmentFile=/var/lib/llama.cpp/.config/containers/systemd/llama.cpp.env
+PublishPort=127.0.0.1:18900:8080
+UserNS=keep-id:uid=1000,gid=1000
+# Need newer Podman to use this
+#GroupAdd=keep-groups
+PodmanArgs=--group-add keep-groups
+#PodmanArgs=--passwd-entry 'llama.cpp:x:1000:1000:llama.cpp:/home/llama.cpp:/bin/bash'
+Volume=/var/lib/llama.cpp/.cache:/app/.cache
+Volume=/var/lib/llama.cpp/models:/models
+$DEVICES
+LogDriver=journald
+AutoUpdate=registry
+
+[Service]
+TimeoutStartSec=12min
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target default.target

data/Plugins/Apps/llama.cpp/llama.cpp.lmm.rb

@@ -0,0 +1,90 @@
+
+
+module ConfigLMM
+    module LMM
+        class Llamacpp < Framework::Plugin
+
+            USER = 'llama.cpp'
+            HOME_DIR = '/var/lib/llama.cpp'
+            PORT = 18900
+
+            def actionLlamacppDeploy(id, target, activeState, context, options)
+                raise Framework::PluginProcessError.new('Model field must be set!') unless target['Model']
+
+                self.withConnection(target['Location'], target) do |connection|
+                    Linux.withConnection(connection) do |linuxConnection|
+                        Podman.ensurePresent(linuxConnection, options)
+                        Podman.createUser(USER, HOME_DIR, 'llama.cpp', linuxConnection, options)
+                        linuxConnection.withUserShell(USER) do |shell|
+                            shell.createDirs(options, '~/models', '~/.cache')
+                        end
+
+                        path = Podman.containersPath(HOME_DIR)
+
+                        linuxConnection.fileWrite("#{path}/llama.cpp.env", '', options)
+                        if target['Model'].end_with?('.gguf')
+                            linuxConnection.fileAppend("#{path}/llama.cpp.env", 'LLAMA_ARG_MODEL=' + target['Model'], options)
+                        else
+                            linuxConnection.fileAppend("#{path}/llama.cpp.env", 'LLAMA_ARG_HF_REPO=' + target['Model'], options)
+                        end
+
+                        linuxConnection.setUserGroup("#{path}/llama.cpp.env", USER, USER, options)
+                        linuxConnection.setPrivate("#{path}/llama.cpp.env", options)
+
+                        linuxConnection.upload(__dir__ + '/llama.cpp.container', path, options)
+
+                        devices = linuxConnection.getGPUDevices(options)
+                        groups = linuxConnection.getGPUGroups(devices, options)
+                        linuxConnection.userAddGroups(USER, groups, options)
+
+                        image = nil
+                        if devices.include?('/dev/kfd')
+                            #image = 'full-rocm'
+                        elsif devices.include?('nvidia.com/gpu=all')
+                            image = 'full-cuda'
+                        end
+
+                        if image
+                            linuxConnection.fileReplace("#{path}/llama.cpp.container", ':full', ':' + image, options)
+                        end
+
+                        args = target['Args'].to_s
+                        linuxConnection.fileReplace("#{path}/llama.cpp.container", '\$ARGS', args, options)
+
+                        devicesString = ''
+                        if !devices.empty?
+                            devicesString = devices.map { |device| "AddDevice=#{device}" }.join('\n')
+                        end
+                        linuxConnection.fileReplace("#{path}/llama.cpp.container", '\$DEVICES', devicesString, { **options, escape: false })
+
+                        linuxConnection.reloadUserServices(USER, options)
+                        linuxConnection.restartUserService(USER, 'llama.cpp', options)
+                    end
+                end
+            end
+
+            def cleanup(configs, state, context, options)
+                cleanupType(:llamacpp, configs, state, context, options) do |item, id, state, context, options, connection|
+                    Linux.withConnection(connection) do |linuxConnection|
+
+                        linuxConnection.stopUserService(USER, 'llama.cpp', options)
+
+                        path = Podman.containersPath(HOME_DIR)
+                        linuxConnection.rm(path + '/llama.cpp.container', options[:dry])
+
+                        linuxConnection.reloadUserServices(USER, options)
+
+                        state.item(id)['Status'] = State::STATUS_DELETED unless options[:dry]
+
+                        if options[:destroy]
+                            linuxConnection.deleteUserAndGroup(USER, options)
+                            state.item(id)['Status'] = State::STATUS_DESTROYED unless options[:dry]
+                        end
+                    end
+                end
+            end
+
+        end
+    end
+end
+

data/Plugins/Apps/vLLM/vLLM.container

@@ -0,0 +1,32 @@
+
+[Unit]
+Description=vLLM container
+After=local-fs.target
+
+[Container]
+ContainerName=vLLM
+Image=$IMAGE
+Entrypoint=["python3", "-m", "vllm.entrypoints.openai.api_server"]
+Exec=$ARGS
+EnvironmentFile=/var/lib/vllm/.config/containers/systemd/vLLM.env
+PublishPort=127.0.0.1:18050:8000
+UserNS=keep-id:uid=1000,gid=1000
+# Need newer Podman to use this
+#GroupAdd=keep-groups
+PodmanArgs=--group-add keep-groups
+#PodmanArgs=--passwd-entry 'vllm:x:1000:1000:vLLM:/home/vllm:/bin/bash'
+Volume=/var/lib/vllm/.cache:/app/.cache
+Volume=/var/lib/vllm/.triton:/app/.triton
+Volume=/var/lib/vllm/.cache:/root/.cache
+Volume=/var/lib/vllm/.cache:/workspace/.cache
+ShmSize=1G
+$DEVICES
+LogDriver=journald
+AutoUpdate=registry
+
+[Service]
+TimeoutStartSec=12min
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target default.target