@le-space/rootfs 0.1.52 → 0.2.0

package/README.md

@@ -7,10 +7,14 @@ Shared rootfs contract parsing, reference profile assets, and build helpers.
 - typed parsing and validation of rootfs contract JSON
 - shell-env mapping compatible with the existing UC rootfs builder
 - copied `uc-go-peer` reference contract and guest asset set
+- copied `orbitdb-relay-pinner` reference contract and guest asset set,
+  including the delayed first-start, setup endpoint, Caddy, and AutoTLS flow
 
 ## Reference assets
 
-The first shared reference profile lives under:
+Current shared reference profiles live under:
 
 - `reference/uc-go-peer/contract.json`
 - `reference/uc-go-peer/rootfs/*`
+- `reference/orbitdb-relay-pinner/contract.json`
+- `reference/orbitdb-relay-pinner/rootfs/*`

package/index.d.ts

@@ -51,6 +51,7 @@ declare function referenceProfileRootfsDir(profile: string): string;
 type RootfsBuildDriver = 'auto' | 'host' | 'docker';
 interface RootfsBuildOptions {
     projectDir: string;
+    orbitdbRelayPinnerDir?: string;
     alephDir?: string;
     outDir?: string;
     contractPath?: string;
@@ -77,6 +78,7 @@ interface RootfsBuildPlan {
     contract: RootfsContract;
     contractPath: string;
     projectDir: string;
+    orbitdbRelayPinnerDir?: string;
     alephDir: string;
     outDir: string;
     driver: RootfsBuildDriver;
@@ -102,7 +104,9 @@ interface RootfsBuildPlan {
     baseImagePath: string;
     binaryPath: string;
 }
-declare function deriveRootfsVersion(options?: Pick<RootfsBuildOptions, 'rootfsVersion' | 'gitShortSha' | 'now'>): string;
+declare function deriveRootfsVersion(options?: Pick<RootfsBuildOptions, 'rootfsVersion' | 'gitShortSha' | 'now'> & {
+    defaultId?: string;
+}): string;
 declare function createRootfsBuildPlan(contract: RootfsContract, options: RootfsBuildOptions): RootfsBuildPlan;
 declare function rootfsBuildShellEnv(plan: RootfsBuildPlan): Record<string, string>;
 
@@ -166,6 +170,7 @@ interface RootfsExecutionPlanOptions {
     referenceRootfsDir?: string;
     projectMountPath?: string;
     rootfsMountPath?: string;
+    orbitdbRelayPinnerMountPath?: string;
     dockerImageTag?: string;
 }
 declare function createHostRootfsExecutionPlan(plan: RootfsBuildPlan, options?: RootfsExecutionPlanOptions): RootfsExecutionPlan;

package/index.js

@@ -165,21 +165,44 @@ function deriveRootfsVersion(options = {}) {
   if (options.rootfsVersion && options.rootfsVersion.trim()) {
     return options.rootfsVersion.trim();
   }
+  const defaultId = options.defaultId?.trim() || "uc-go-peer";
   if (options.gitShortSha && options.gitShortSha.trim()) {
     const now = options.now ?? /* @__PURE__ */ new Date();
     const yyyy = String(now.getUTCFullYear());
     const mm = String(now.getUTCMonth() + 1).padStart(2, "0");
     const dd = String(now.getUTCDate()).padStart(2, "0");
-    return `uc-go-peer-git-${yyyy}${mm}${dd}-${options.gitShortSha.trim()}`;
+    return `${defaultId}-git-${yyyy}${mm}${dd}-${options.gitShortSha.trim()}`;
   }
-  return "uc-go-peer-v0.1.0";
+  return `${defaultId}-v0.1.0`;
+}
+function defaultRootfsVersionId(contract) {
+  return contract.id.trim() || contract.rootfs.profile.trim() || "rootfs";
+}
+function defaultRootfsImageBasename(contract) {
+  return `aleph-${contract.rootfs.profile}.qcow2`;
+}
+function sourceSubdirectory(contract) {
+  const value = contract.source?.subdirectory?.trim();
+  return value && value !== "." ? value : null;
 }
 function createRootfsBuildPlan(contract, options) {
   const projectDir = path.resolve(options.projectDir);
-  const alephDir = path.resolve(options.alephDir ?? path.join(projectDir, "go-peer/aleph"));
+  const orbitdbRelayPinnerDir = options.orbitdbRelayPinnerDir?.trim() ? path.resolve(options.orbitdbRelayPinnerDir) : void 0;
+  const subdirectory = sourceSubdirectory(contract);
+  const defaultAlephDir = subdirectory ? path.join(projectDir, subdirectory, "aleph") : projectDir;
+  const alephDir = path.resolve(options.alephDir ?? defaultAlephDir);
   const outDir = path.resolve(options.outDir ?? path.join(alephDir, "dist-rootfs"));
-  const contractPath = path.resolve(options.contractPath ?? path.join(alephDir, "root-profiles", `${contract.id}.json`));
-  const rootfsVersion = deriveRootfsVersion(options);
+  const defaultContractDir = subdirectory ? path.join(alephDir, "root-profiles") : path.join(projectDir, "root-profiles");
+  const contractPath = path.resolve(options.contractPath ?? path.join(defaultContractDir, `${contract.id}.json`));
+  const versionId = defaultRootfsVersionId(contract);
+  const rootfsVersion = deriveRootfsVersion({
+    ...options,
+    defaultId: versionId,
+    rootfsVersion: options.rootfsVersion?.trim() || void 0,
+    gitShortSha: options.gitShortSha,
+    now: options.now
+  });
+  const imageBasename = defaultRootfsImageBasename(contract);
   const copyTarget = contract.manifest.copyTarget?.trim() ?? "";
   const latestManifestPath = copyTarget ? path.resolve(copyTarget.startsWith("/") ? copyTarget : path.join(projectDir, copyTarget)) : null;
   const versionedManifestPath = latestManifestPath ? path.join(path.dirname(latestManifestPath), `${rootfsVersion}.json`) : null;
@@ -187,6 +210,7 @@ function createRootfsBuildPlan(contract, options) {
     contract,
     contractPath,
     projectDir,
+    orbitdbRelayPinnerDir,
     alephDir,
     outDir,
     driver: options.driver ?? "auto",
@@ -208,13 +232,13 @@ function createRootfsBuildPlan(contract, options) {
     manifestPath: path.join(outDir, "rootfs-manifest.json"),
     latestManifestPath,
     versionedManifestPath,
-    imagePath: path.join(outDir, "aleph-uc-go-peer.qcow2"),
+    imagePath: path.join(outDir, imageBasename),
     baseImagePath: path.join(outDir, "debian-12-genericcloud-amd64.qcow2"),
-    binaryPath: path.join(outDir, "universal-chat-go")
+    binaryPath: path.join(outDir, path.basename(contract.rootfs.binaryPath || "artifact"))
   };
 }
 function rootfsBuildShellEnv(plan) {
-  return {
+  const env = {
     PROJECT_DIR: plan.projectDir,
     OUT_DIR: plan.outDir,
     ROOTFS_CONTRACT_FILE: plan.contractPath,
@@ -235,6 +259,10 @@ function rootfsBuildShellEnv(plan) {
     IPFS_GATEWAY_WAIT_ATTEMPTS: String(plan.ipfsGatewayWaitAttempts),
     IPFS_GATEWAY_WAIT_DELAY_SECONDS: String(plan.ipfsGatewayWaitDelaySeconds)
   };
+  if (plan.orbitdbRelayPinnerDir) {
+    env.ORBITDB_RELAY_PINNER_DIR = plan.orbitdbRelayPinnerDir;
+  }
+  return env;
 }
 
 // src/manifest.ts
@@ -360,6 +388,14 @@ function containerPathForProjectFile(hostPath, projectDir, mountPath, label) {
   const relative = ensurePathWithin(projectDir, hostPath, label);
   return path2.posix.join(mountPath, relative.split(path2.sep).join("/"));
 }
+function containerContractPathForFile(hostPath, projectDir, projectMountPath) {
+  const relative = path2.relative(projectDir, hostPath);
+  if (!relative.startsWith("..") && !path2.isAbsolute(relative)) {
+    return path2.posix.join(projectMountPath, relative.split(path2.sep).join("/"));
+  }
+  const basename = path2.posix.basename(hostPath);
+  return path2.posix.join("/workspace/shared-contracts", basename);
+}
 function resolveReferenceRootfsDir(contract, override) {
   if (override) {
     return path2.resolve(override);
@@ -376,12 +412,7 @@ function createHostRootfsExecutionPlan(plan, options = {}) {
       command: "/bin/bash",
       args: [path2.join(referenceRootfsDir, "build-rootfs-image.sh")],
       workdir: referenceRootfsDir,
-      env: {
-        PROJECT_DIR: plan.projectDir,
-        OUT_DIR: plan.outDir,
-        ROOTFS_CONTRACT_FILE: plan.contractPath,
-        ROOTFS_IMAGE_SIZE: plan.rootfsImageSize
-      }
+      env: rootfsBuildShellEnv(plan)
     }
   };
 }
@@ -389,12 +420,35 @@ function createDockerRootfsExecutionPlan(plan, options = {}) {
   const referenceRootfsDir = resolveReferenceRootfsDir(plan.contract, options.referenceRootfsDir);
   const projectMountPath = options.projectMountPath ?? "/workspace/project";
   const rootfsMountPath = options.rootfsMountPath ?? "/workspace/shared-rootfs";
+  const orbitdbRelayPinnerMountPath = options.orbitdbRelayPinnerMountPath ?? "/workspace-orbitdb-relay-pinner";
   const dockerImageTag = options.dockerImageTag ?? `${plan.contract.id}-rootfs-builder:local`;
   const containerProjectDir = projectMountPath;
-  const containerContractPath = containerPathForProjectFile(plan.contractPath, plan.projectDir, projectMountPath, "contractPath");
+  const containerContractPath = containerContractPathForFile(plan.contractPath, plan.projectDir, projectMountPath);
   const containerOutDir = containerPathForProjectFile(plan.outDir, plan.projectDir, projectMountPath, "outDir");
   const hostUid = typeof process.getuid === "function" ? String(process.getuid()) : "1000";
   const hostGid = typeof process.getgid === "function" ? String(process.getgid()) : "1000";
+  const runEnv = {
+    ...rootfsBuildShellEnv(plan),
+    PROJECT_DIR: containerProjectDir,
+    OUT_DIR: containerOutDir,
+    ROOTFS_CONTRACT_FILE: containerContractPath,
+    HOST_UID: hostUid,
+    HOST_GID: hostGid
+  };
+  const volumeMounts = [
+    "-v",
+    `${plan.projectDir}:${projectMountPath}`,
+    "-v",
+    `${referenceRootfsDir}:${rootfsMountPath}`
+  ];
+  const contractRelative = path2.relative(plan.projectDir, plan.contractPath);
+  if (contractRelative.startsWith("..") || path2.isAbsolute(contractRelative)) {
+    volumeMounts.push("-v", `${plan.contractPath}:${containerContractPath}:ro`);
+  }
+  if (plan.orbitdbRelayPinnerDir) {
+    runEnv.ORBITDB_RELAY_PINNER_DIR = orbitdbRelayPinnerMountPath;
+    volumeMounts.push("-v", `${plan.orbitdbRelayPinnerDir}:${orbitdbRelayPinnerMountPath}:ro`);
+  }
   return {
     mode: "docker",
     reason: "Using Dockerized Debian/libguestfs builder.",
@@ -422,22 +476,8 @@ function createDockerRootfsExecutionPlan(plan, options = {}) {
         "linux/amd64",
         "-e",
         "LIBGUESTFS_BACKEND=direct",
-        "-e",
-        `ROOTFS_CONTRACT_FILE=${containerContractPath}`,
-        "-e",
-        `OUT_DIR=${containerOutDir}`,
-        "-e",
-        `ROOTFS_IMAGE_SIZE=${plan.rootfsImageSize}`,
-        "-e",
-        `PROJECT_DIR=${containerProjectDir}`,
-        "-e",
-        `HOST_UID=${hostUid}`,
-        "-e",
-        `HOST_GID=${hostGid}`,
-        "-v",
-        `${plan.projectDir}:${projectMountPath}`,
-        "-v",
-        `${referenceRootfsDir}:${rootfsMountPath}`,
+        ...Object.entries(runEnv).flatMap(([key, value]) => ["-e", `${key}=${value}`]),
+        ...volumeMounts,
         "-w",
         rootfsMountPath,
         dockerImageTag,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/rootfs",
-  "version": "0.1.52",
+  "version": "0.2.0",
   "description": "Shared rootfs contract parsing, reference profile assets, and build helpers.",
   "license": "MIT",
   "type": "module",

package/reference/orbitdb-relay-pinner/contract.json

@@ -0,0 +1,70 @@
+{
+  "schemaVersion": 1,
+  "id": "orbitdb-relay-pinner",
+  "displayName": "OrbitDB Relay Pinner",
+  "source": {
+    "repository": "external",
+    "subdirectory": "."
+  },
+  "rootfs": {
+    "profile": "orbitdb-relay-pinner",
+    "installMode": "prebaked",
+    "installDir": "/opt/orbitdb-relay-pinner",
+    "binaryPath": "/usr/local/bin/orbitdb-relay-pinner",
+    "dataDir": "/var/lib/orbitdb-relay-pinner",
+    "envFile": "/etc/default/orbitdb-relay-pinner"
+  },
+  "services": {
+    "bootstrap": "orbitdb-relay-pinner-bootstrap.service",
+    "main": "orbitdb-relay-pinner.service",
+    "autotlsRefresh": "orbitdb-relay-pinner-autotls-refresh.service"
+  },
+  "ports": [
+    {
+      "port": 22,
+      "tcp": true,
+      "udp": false,
+      "purpose": "SSH"
+    },
+    {
+      "port": 80,
+      "tcp": true,
+      "udp": false,
+      "purpose": "Temporary setup endpoint"
+    },
+    {
+      "port": 9090,
+      "tcp": true,
+      "udp": false,
+      "purpose": "Metrics and health API"
+    },
+    {
+      "port": 9091,
+      "tcp": true,
+      "udp": false,
+      "purpose": "libp2p TCP"
+    },
+    {
+      "port": 443,
+      "tcp": true,
+      "udp": false,
+      "purpose": "Caddy HTTPS and WSS proxy"
+    },
+    {
+      "port": 9093,
+      "tcp": false,
+      "udp": true,
+      "purpose": "WebRTC direct"
+    },
+    {
+      "port": 9094,
+      "tcp": false,
+      "udp": true,
+      "purpose": "QUIC"
+    }
+  ],
+  "manifest": {
+    "copyTarget": "public/rootfs-manifest.json",
+    "notes": "The OrbitDB relay image prebakes Node.js, production dependencies, and Caddy into the qcow2, delays first relay start until Aleph host port mappings are known, exposes a temporary setup endpoint on port 80, and uses Caddy on port 443 to front both HTTPS helper routes and secure libp2p WSS transport for the configured proxy hostname."
+  }
+}

package/reference/orbitdb-relay-pinner/rootfs/Dockerfile.rootfs

@@ -0,0 +1,19 @@
+FROM --platform=linux/amd64 debian:12
+
+ENV DEBIAN_FRONTEND=noninteractive
+ENV LIBGUESTFS_BACKEND=direct
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    curl \
+    jq \
+    libguestfs-tools \
+    linux-image-amd64 \
+    python3 \
+    qemu-system-x86 \
+    qemu-utils \
+    tar \
+  && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /workspace/relay-deployer-pwa

package/reference/orbitdb-relay-pinner/rootfs/build-rootfs-image.sh

@@ -0,0 +1,335 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+APP_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
+REPO_DIR="$(cd "${APP_DIR}/.." && pwd)"
+ROOTFS_CONTRACT_FILE="${ROOTFS_CONTRACT_FILE:-}"
+ROOTFS_PROFILE="${ROOTFS_PROFILE:-}"
+ROOTFS_INSTALL_MODE="${ROOTFS_INSTALL_MODE:-}"
+PY_LIBP2P_DIR="${PY_LIBP2P_DIR:-${REPO_DIR}/py-libp2p}"
+ORBITDB_RELAY_PINNER_DIR="${ORBITDB_RELAY_PINNER_DIR:-}"
+UNIVERSAL_CONNECTIVITY_DIR="${UNIVERSAL_CONNECTIVITY_DIR:-}"
+OUT_DIR="${OUT_DIR:-${APP_DIR}/dist-rootfs}"
+BASE_URL="${BASE_URL:-https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2}"
+BASE_IMAGE="${OUT_DIR}/debian-12-genericcloud-amd64.qcow2"
+IMAGE_SIZE="${IMAGE_SIZE:-${ROOTFS_IMAGE_SIZE:-20G}}"
+ROOTFS_SPARSIFY="${ROOTFS_SPARSIFY:-1}"
+
+require() {
+  command -v "$1" >/dev/null 2>&1 || {
+    echo "Missing required command: $1" >&2
+    exit 1
+  }
+}
+
+require curl
+require qemu-img
+require virt-customize
+require tar
+
+load_rootfs_contract() {
+  [ -n "${ROOTFS_CONTRACT_FILE}" ] || return 0
+  require python3
+  [ -f "${ROOTFS_CONTRACT_FILE}" ] || {
+    echo "Rootfs contract does not exist: ${ROOTFS_CONTRACT_FILE}" >&2
+    exit 1
+  }
+
+  eval "$(python3 "${SCRIPT_DIR}/read-rootfs-contract.py" "${ROOTFS_CONTRACT_FILE}")"
+
+  if [ -n "${ROOTFS_PROFILE}" ] && [ "${ROOTFS_PROFILE}" != "${ROOTFS_CONTRACT_PROFILE}" ]; then
+    echo "ROOTFS_PROFILE=${ROOTFS_PROFILE} conflicts with contract profile ${ROOTFS_CONTRACT_PROFILE}" >&2
+    exit 1
+  fi
+  if [ -n "${ROOTFS_INSTALL_MODE}" ] && [ "${ROOTFS_INSTALL_MODE}" != "${ROOTFS_CONTRACT_INSTALL_MODE}" ]; then
+    echo "ROOTFS_INSTALL_MODE=${ROOTFS_INSTALL_MODE} conflicts with contract install mode ${ROOTFS_CONTRACT_INSTALL_MODE}" >&2
+    exit 1
+  fi
+
+  ROOTFS_PROFILE="${ROOTFS_CONTRACT_PROFILE}"
+  ROOTFS_INSTALL_MODE="${ROOTFS_INSTALL_MODE:-${ROOTFS_CONTRACT_INSTALL_MODE}}"
+  echo "Loaded rootfs contract: ${ROOTFS_CONTRACT_PATH}"
+}
+
+load_rootfs_contract
+ROOTFS_PROFILE="${ROOTFS_PROFILE:-py-libp2p}"
+ROOTFS_CONTRACT_INSTALL_DIR="${ROOTFS_CONTRACT_INSTALL_DIR:-/opt/go-peer}"
+ROOTFS_CONTRACT_DATA_DIR="${ROOTFS_CONTRACT_DATA_DIR:-/var/lib/uc-go-peer}"
+ROOTFS_CONTRACT_ENV_FILE="${ROOTFS_CONTRACT_ENV_FILE:-/etc/default/uc-go-peer}"
+ROOTFS_CONTRACT_BOOTSTRAP_SERVICE="${ROOTFS_CONTRACT_BOOTSTRAP_SERVICE:-uc-go-peer-bootstrap.service}"
+ROOTFS_CONTRACT_MAIN_SERVICE="${ROOTFS_CONTRACT_MAIN_SERVICE:-uc-go-peer.service}"
+ROOTFS_CONTRACT_AUTOTLS_SERVICE="${ROOTFS_CONTRACT_AUTOTLS_SERVICE:-uc-go-peer-autotls-refresh.service}"
+ROOTFS_CONTRACT_BINARY_PATH="${ROOTFS_CONTRACT_BINARY_PATH:-/usr/local/bin/universal-chat-go}"
+ROOTFS_CONTRACT_BINARY_DIR="$(dirname "${ROOTFS_CONTRACT_BINARY_PATH}")"
+
+case "${ROOTFS_PROFILE}" in
+  py-libp2p)
+    IMAGE="${OUT_DIR}/aleph-py-libp2p-relay.qcow2"
+    APP_TAR="${OUT_DIR}/py-libp2p.tar"
+    if [ -z "${ROOTFS_INSTALL_MODE}" ]; then
+      ROOTFS_INSTALL_MODE="thin"
+    fi
+    if [ ! -d "${PY_LIBP2P_DIR}" ]; then
+      echo "Missing py-libp2p directory: ${PY_LIBP2P_DIR}" >&2
+      exit 1
+    fi
+    ;;
+  orbitdb-relay-pinner)
+    IMAGE="${OUT_DIR}/aleph-orbitdb-relay-pinner.qcow2"
+    APP_TAR="${OUT_DIR}/orbitdb-relay-pinner.tar"
+    if [ -z "${ROOTFS_INSTALL_MODE}" ]; then
+      ROOTFS_INSTALL_MODE="prebaked"
+    fi
+    if [ -z "${ORBITDB_RELAY_PINNER_DIR}" ]; then
+      echo "ROOTFS_PROFILE=orbitdb-relay-pinner requires ORBITDB_RELAY_PINNER_DIR=/path/to/orbitdb-relay-pinner" >&2
+      exit 1
+    fi
+    if [ ! -d "${ORBITDB_RELAY_PINNER_DIR}" ]; then
+      echo "Missing orbitdb-relay-pinner directory: ${ORBITDB_RELAY_PINNER_DIR}" >&2
+      exit 1
+    fi
+    if [ ! -d "${ORBITDB_RELAY_PINNER_DIR}/dist" ]; then
+      echo "Missing orbitdb-relay-pinner dist directory: ${ORBITDB_RELAY_PINNER_DIR}/dist" >&2
+      echo "Build orbitdb-relay-pinner before creating this rootfs image." >&2
+      exit 1
+    fi
+    if [ "${ROOTFS_INSTALL_MODE}" = "thin" ]; then
+      echo "ROOTFS_PROFILE=orbitdb-relay-pinner now requires ROOTFS_INSTALL_MODE=prebaked." >&2
+      echo "The runtime is installed into the image, then configured with mapped ports before first start." >&2
+      exit 1
+    fi
+    ;;
+  uc-go-peer)
+    IMAGE="${OUT_DIR}/aleph-uc-go-peer.qcow2"
+    APP_TAR="${OUT_DIR}/uc-go-peer.tar"
+    if [ -z "${ROOTFS_INSTALL_MODE}" ]; then
+      ROOTFS_INSTALL_MODE="prebaked"
+    fi
+    if [ -z "${UNIVERSAL_CONNECTIVITY_DIR}" ]; then
+      echo "ROOTFS_PROFILE=uc-go-peer requires UNIVERSAL_CONNECTIVITY_DIR=/path/to/universal-connectivity" >&2
+      exit 1
+    fi
+    if [ ! -d "${UNIVERSAL_CONNECTIVITY_DIR}/go-peer" ]; then
+      echo "Missing go-peer directory: ${UNIVERSAL_CONNECTIVITY_DIR}/go-peer" >&2
+      exit 1
+    fi
+    if [ "${ROOTFS_INSTALL_MODE}" = "thin" ]; then
+      echo "ROOTFS_PROFILE=uc-go-peer requires ROOTFS_INSTALL_MODE=prebaked." >&2
+      echo "The Go binary is built into the image, then configured with mapped ports before first start." >&2
+      exit 1
+    fi
+    ;;
+  uc-rust-peer)
+    IMAGE="${OUT_DIR}/aleph-uc-rust-peer.qcow2"
+    APP_TAR="${OUT_DIR}/uc-rust-peer.tar"
+    if [ -z "${ROOTFS_INSTALL_MODE}" ]; then
+      ROOTFS_INSTALL_MODE="prebaked"
+    fi
+    if [ -z "${UNIVERSAL_CONNECTIVITY_DIR}" ]; then
+      echo "ROOTFS_PROFILE=uc-rust-peer requires UNIVERSAL_CONNECTIVITY_DIR=/path/to/universal-connectivity" >&2
+      exit 1
+    fi
+    if [ ! -d "${UNIVERSAL_CONNECTIVITY_DIR}/rust-peer" ]; then
+      echo "Missing rust-peer directory: ${UNIVERSAL_CONNECTIVITY_DIR}/rust-peer" >&2
+      exit 1
+    fi
+    if [ "${ROOTFS_INSTALL_MODE}" = "thin" ]; then
+      echo "ROOTFS_PROFILE=uc-rust-peer requires ROOTFS_INSTALL_MODE=prebaked." >&2
+      echo "The Rust binary and websocket bridge are built into the image, then configured with mapped ports before first start." >&2
+      exit 1
+    fi
+    ;;
+  *)
+    echo "Unsupported ROOTFS_PROFILE: ${ROOTFS_PROFILE}" >&2
+    echo "Expected one of: py-libp2p, orbitdb-relay-pinner, uc-go-peer, uc-rust-peer" >&2
+    exit 1
+    ;;
+esac
+
+case "${ROOTFS_INSTALL_MODE}" in
+  thin|prebaked)
+    ;;
+  *)
+    echo "Unsupported ROOTFS_INSTALL_MODE: ${ROOTFS_INSTALL_MODE}" >&2
+    echo "Expected one of: thin, prebaked" >&2
+    exit 1
+    ;;
+esac
+
+mkdir -p "${OUT_DIR}"
+
+echo "Building ${ROOTFS_PROFILE} image in ${ROOTFS_INSTALL_MODE} mode"
+
+if [ ! -f "${BASE_IMAGE}" ]; then
+  curl -L "${BASE_URL}" -o "${BASE_IMAGE}"
+fi
+
+cp "${BASE_IMAGE}" "${IMAGE}"
+qemu-img resize "${IMAGE}" "${IMAGE_SIZE}"
+
+case "${ROOTFS_PROFILE}" in
+  py-libp2p)
+    tar \
+      --exclude ".git" \
+      --exclude ".venv" \
+      --exclude "__pycache__" \
+      -C "$(dirname "${PY_LIBP2P_DIR}")" \
+      -cf "${APP_TAR}" \
+      "$(basename "${PY_LIBP2P_DIR}")"
+
+    py_customize_args=(
+      -a "${IMAGE}"
+      --mkdir /opt/py-libp2p
+      --mkdir /var/lib/py-libp2p-relay
+      --copy-in "${APP_TAR}:/opt"
+      --copy-in "${SCRIPT_DIR}/relay-bootstrap.sh:/usr/local/sbin"
+      --copy-in "${SCRIPT_DIR}/py-libp2p-relay.service:/etc/systemd/system"
+      --copy-in "${SCRIPT_DIR}/py-libp2p-relay-bootstrap.service:/etc/systemd/system"
+      --run-command "tar -xf /opt/$(basename "${APP_TAR}") -C /opt/py-libp2p --strip-components=1"
+      --run-command "chmod 0755 /usr/local/sbin/relay-bootstrap.sh"
+    )
+
+    if [ "${ROOTFS_INSTALL_MODE}" = "prebaked" ]; then
+      py_customize_args+=(
+        --run-command "BOOTSTRAP_STAMP=/var/lib/py-libp2p-relay/bootstrap-complete RELAY_PORT=4001 /usr/local/sbin/relay-bootstrap.sh"
+      )
+    fi
+
+    py_customize_args+=(
+      --run-command "systemctl enable py-libp2p-relay.service"
+      --run-command "rm -f /opt/$(basename "${APP_TAR}")"
+    )
+
+    virt-customize "${py_customize_args[@]}"
+    ;;
+  orbitdb-relay-pinner)
+    tar \
+      -C "${ORBITDB_RELAY_PINNER_DIR}" \
+      -cf "${APP_TAR}" \
+      dist \
+      deploy \
+      package.json \
+      pnpm-lock.yaml \
+      pnpm-workspace.yaml \
+      README.md \
+      LICENSE \
+      .env.example
+
+    orbitdb_customize_args=(
+      -a "${IMAGE}"
+      --mkdir /opt/orbitdb-relay-pinner
+      --mkdir /var/lib/orbitdb-relay-pinner
+      --mkdir /etc/systemd/system/orbitdb-relay-pinner.service.d
+      --copy-in "${APP_TAR}:/opt"
+      --copy-in "${SCRIPT_DIR}/orbitdb-relay-pinner-bootstrap.sh:/usr/local/sbin"
+      --copy-in "${SCRIPT_DIR}/orbitdb-relay-pinner-configure.sh:/usr/local/sbin"
+      --copy-in "${SCRIPT_DIR}/orbitdb-relay-pinner-autotls-refresh.py:/usr/local/sbin"
+      --copy-in "${SCRIPT_DIR}/orbitdb-relay-pinner-setup-server.py:/usr/local/sbin"
+      --copy-in "${SCRIPT_DIR}/orbitdb-relay-pinner-describe.py:/usr/local/sbin"
+      --copy-in "${SCRIPT_DIR}/orbitdb-relay-pinner-bootstrap.service:/etc/systemd/system"
+      --copy-in "${SCRIPT_DIR}/orbitdb-relay-pinner-autotls-refresh.service:/etc/systemd/system"
+      --copy-in "${SCRIPT_DIR}/orbitdb-relay-pinner-bootstrap.conf:/etc/systemd/system/orbitdb-relay-pinner.service.d"
+      --run-command "tar -xf /opt/$(basename "${APP_TAR}") -C /opt/orbitdb-relay-pinner"
+      --run-command "chmod 0755 /usr/local/sbin/orbitdb-relay-pinner-bootstrap.sh"
+      --run-command "chmod 0755 /usr/local/sbin/orbitdb-relay-pinner-configure.sh"
+      --run-command "chmod 0755 /usr/local/sbin/orbitdb-relay-pinner-autotls-refresh.py"
+      --run-command "chmod 0755 /usr/local/sbin/orbitdb-relay-pinner-setup-server.py"
+      --run-command "chmod 0755 /usr/local/sbin/orbitdb-relay-pinner-describe.py"
+      --run-command "cp /opt/orbitdb-relay-pinner/deploy/orbitdb-relay-pinner.service /etc/systemd/system/orbitdb-relay-pinner.service"
+      --run-command "INSTALL_DIR=/opt/orbitdb-relay-pinner DATA_DIR=/var/lib/orbitdb-relay-pinner ENV_FILE=/etc/default/orbitdb-relay-pinner SERVICE_USER=orbitdb-relay /usr/local/sbin/orbitdb-relay-pinner-bootstrap.sh"
+    )
+
+    orbitdb_customize_args+=(
+      --run-command "systemctl enable orbitdb-relay-pinner-bootstrap.service"
+      --run-command "systemctl enable orbitdb-relay-pinner.service"
+      --run-command "rm -f /opt/$(basename "${APP_TAR}")"
+    )
+
+    virt-customize "${orbitdb_customize_args[@]}"
+    ;;
+  uc-go-peer)
+    tar \
+      --exclude ".git" \
+      -C "${UNIVERSAL_CONNECTIVITY_DIR}" \
+      -cf "${APP_TAR}" \
+      go-peer
+
+    uc_go_customize_args=(
+      -a "${IMAGE}"
+      --mkdir "${ROOTFS_CONTRACT_INSTALL_DIR}"
+      --mkdir "${ROOTFS_CONTRACT_DATA_DIR}"
+      --mkdir "${ROOTFS_CONTRACT_BINARY_DIR}"
+      --copy-in "${APP_TAR}:/opt"
+      --copy-in "${SCRIPT_DIR}/uc-go-peer-bootstrap.sh:/usr/local/sbin"
+      --copy-in "${SCRIPT_DIR}/uc-go-peer-configure.sh:/usr/local/sbin"
+      --copy-in "${SCRIPT_DIR}/uc-go-peer-autotls-refresh.py:/usr/local/sbin"
+      --copy-in "${SCRIPT_DIR}/uc-go-peer-setup-server.py:/usr/local/sbin"
+      --copy-in "${SCRIPT_DIR}/uc-go-peer-describe.py:/usr/local/sbin"
+      --copy-in "${SCRIPT_DIR}/uc-go-peer-bootstrap.service:/etc/systemd/system"
+      --copy-in "${SCRIPT_DIR}/uc-go-peer-autotls-refresh.service:/etc/systemd/system"
+      --copy-in "${SCRIPT_DIR}/uc-go-peer.service:/etc/systemd/system"
+      --run-command "tar -xf /opt/$(basename "${APP_TAR}") -C /opt"
+      --run-command "chmod 0755 /usr/local/sbin/uc-go-peer-bootstrap.sh"
+      --run-command "chmod 0755 /usr/local/sbin/uc-go-peer-configure.sh"
+      --run-command "chmod 0755 /usr/local/sbin/uc-go-peer-autotls-refresh.py"
+      --run-command "chmod 0755 /usr/local/sbin/uc-go-peer-setup-server.py"
+      --run-command "chmod 0755 /usr/local/sbin/uc-go-peer-describe.py"
+      --run-command "INSTALL_DIR=${ROOTFS_CONTRACT_INSTALL_DIR} APP_BINARY=${ROOTFS_CONTRACT_BINARY_PATH} DATA_DIR=${ROOTFS_CONTRACT_DATA_DIR} ENV_FILE=${ROOTFS_CONTRACT_ENV_FILE} SERVICE_USER=uc-go-peer /usr/local/sbin/uc-go-peer-bootstrap.sh base"
+      --run-command "INSTALL_DIR=${ROOTFS_CONTRACT_INSTALL_DIR} APP_BINARY=${ROOTFS_CONTRACT_BINARY_PATH} DATA_DIR=${ROOTFS_CONTRACT_DATA_DIR} ENV_FILE=${ROOTFS_CONTRACT_ENV_FILE} SERVICE_USER=uc-go-peer /usr/local/sbin/uc-go-peer-bootstrap.sh build"
+      --run-command "INSTALL_DIR=${ROOTFS_CONTRACT_INSTALL_DIR} APP_BINARY=${ROOTFS_CONTRACT_BINARY_PATH} DATA_DIR=${ROOTFS_CONTRACT_DATA_DIR} ENV_FILE=${ROOTFS_CONTRACT_ENV_FILE} SERVICE_USER=uc-go-peer /usr/local/sbin/uc-go-peer-bootstrap.sh finalize"
+      --run-command "systemctl enable ${ROOTFS_CONTRACT_BOOTSTRAP_SERVICE}"
+      --run-command "systemctl enable ${ROOTFS_CONTRACT_AUTOTLS_SERVICE}"
+      --run-command "systemctl enable ${ROOTFS_CONTRACT_MAIN_SERVICE}"
+      --run-command "rm -f /opt/$(basename "${APP_TAR}")"
+    )
+
+    virt-customize "${uc_go_customize_args[@]}"
+    ;;
+  uc-rust-peer)
+    tar \
+      --exclude "target" \
+      --exclude ".git" \
+      -C "${UNIVERSAL_CONNECTIVITY_DIR}" \
+      -cf "${APP_TAR}" \
+      rust-peer
+
+    uc_rust_customize_args=(
+      -a "${IMAGE}"
+      --mkdir /opt/rust-peer
+      --mkdir /var/lib/uc-rust-peer
+      --copy-in "${APP_TAR}:/opt"
+      --copy-in "${SCRIPT_DIR}/uc-rust-peer-bootstrap.sh:/usr/local/sbin"
+      --copy-in "${SCRIPT_DIR}/uc-rust-peer-configure.sh:/usr/local/sbin"
+      --copy-in "${SCRIPT_DIR}/uc-rust-peer-setup-server.py:/usr/local/sbin"
+      --copy-in "${SCRIPT_DIR}/uc-rust-peer-ws-bridge.py:/usr/local/sbin"
+      --copy-in "${SCRIPT_DIR}/uc-rust-peer-run.sh:/usr/local/sbin"
+      --copy-in "${SCRIPT_DIR}/uc-rust-peer-bootstrap.service:/etc/systemd/system"
+      --copy-in "${SCRIPT_DIR}/uc-rust-peer.service:/etc/systemd/system"
+      --copy-in "${SCRIPT_DIR}/uc-rust-peer-ws-bridge.service:/etc/systemd/system"
+      --run-command "tar -xf /opt/$(basename "${APP_TAR}") -C /opt"
+      --run-command "chmod 0755 /usr/local/sbin/uc-rust-peer-bootstrap.sh"
+      --run-command "chmod 0755 /usr/local/sbin/uc-rust-peer-configure.sh"
+      --run-command "chmod 0755 /usr/local/sbin/uc-rust-peer-setup-server.py"
+      --run-command "chmod 0755 /usr/local/sbin/uc-rust-peer-ws-bridge.py"
+      --run-command "chmod 0755 /usr/local/sbin/uc-rust-peer-run.sh"
+      --run-command "INSTALL_DIR=/opt/rust-peer DATA_DIR=/var/lib/uc-rust-peer ENV_FILE=/etc/default/uc-rust-peer SERVICE_USER=uc-rust-peer /usr/local/sbin/uc-rust-peer-bootstrap.sh"
+      --run-command "systemctl enable uc-rust-peer-bootstrap.service"
+      --run-command "systemctl enable uc-rust-peer.service"
+      --run-command "systemctl enable uc-rust-peer-ws-bridge.service"
+      --run-command "rm -f /opt/$(basename "${APP_TAR}")"
+    )
+
+    virt-customize "${uc_rust_customize_args[@]}"
+    ;;
+esac
+
+if [ "${ROOTFS_SPARSIFY}" = "1" ] && command -v virt-sparsify >/dev/null 2>&1; then
+  SPARSE_IMAGE="${IMAGE%.qcow2}.sparse.qcow2"
+  rm -f "${SPARSE_IMAGE}"
+  echo "Sparsifying and compressing ${IMAGE}..."
+  virt-sparsify --compress "${IMAGE}" "${SPARSE_IMAGE}"
+  mv "${SPARSE_IMAGE}" "${IMAGE}"
+fi
+
+echo "Rootfs image ready at ${IMAGE}"