@microck/raft 0.0.0-stage → 0.2.1

package/images/incus/build.sh

@@ -0,0 +1,57 @@
+#!/bin/bash
+# Run inside a fresh native ARM64 or AMD64 Debian 13 Incus image, without host secrets.
+set -eu
+case "$(dpkg --print-architecture)" in
+  arm64) node_arch=arm64 ;;
+  amd64) node_arch=x64 ;;
+  *) echo 'Raft images support ARM64 and AMD64' >&2; exit 1 ;;
+esac
+export DEBIAN_FRONTEND=noninteractive
+apt-get update -qq
+apt-get install -y --no-install-recommends apparmor ca-certificates curl git openssh-server rsync jq ripgrep file less sudo locales python3 python3-pip python3-venv pipx build-essential clang cmake ninja-build golang rustc cargo default-jdk maven gradle kotlin scala ruby ruby-bundler php-cli composer erlang-base elixir r-base docker.io docker-cli docker-buildx chromium chromium-sandbox ffmpeg unzip xz-utils tar x11vnc xvfb x11-utils novnc websockify openbox dbus-x11
+# Ubuntu hosts restrict unprofiled user namespaces. Load a guest-local rule
+# for Chromium's exact executable so its sandbox can create its namespaces.
+# Incus's outer confinement and the host-wide restriction remain in force.
+cat > /etc/apparmor.d/raft-chromium <<'PROFILE'
+abi <abi/4.0>,
+include <tunables/global>
+profile raft-chromium /usr/lib/chromium/chromium flags=(unconfined) {
+  userns,
+}
+PROFILE
+systemctl enable apparmor
+systemctl restart apparmor
+mkdir -p /workspace /opt/raft
+node_archive="node-v24.21.0-linux-${node_arch}.tar.xz"
+curl -fsSL -A 'OpenAI File Downloader, XaiImageApiFetch/1.0' "https://nodejs.org/dist/v24.21.0/${node_archive}" -o /tmp/raft-node.tar.xz
+curl -fsSL -A 'OpenAI File Downloader, XaiImageApiFetch/1.0' https://nodejs.org/dist/v24.21.0/SHASUMS256.txt -o /tmp/raft-node.sha256
+cd /tmp
+awk -v archive="$node_archive" '$2 == archive {print $1 "  raft-node.tar.xz"}' raft-node.sha256 | sha256sum -c -
+tar -xJf /tmp/raft-node.tar.xz -C /usr/local --strip-components=1
+PIPX_HOME=/opt/raft/pipx PIPX_BIN_DIR=/usr/local/bin pipx install uv==0.12.23
+npm install -g pnpm@12.9.1 bun@1.4.2 deno@2.9.6
+curl -fsSL -A 'OpenAI File Downloader, XaiImageApiFetch/1.0' https://dot.net/v1/dotnet-install.sh -o /tmp/raft-dotnet-install.sh
+bash /tmp/raft-dotnet-install.sh --version 10.0.401 --install-dir /usr/local/share/dotnet
+ln -s /usr/local/share/dotnet/dotnet /usr/local/bin/dotnet
+useradd -m -s /bin/bash developer
+printf 'developer ALL=(ALL) NOPASSWD:ALL\n' > /etc/sudoers.d/raft-developer
+chmod 440 /etc/sudoers.d/raft-developer
+mkdir -p /etc/ssh/sshd_config.d /etc/systemd/system/ssh.service.d
+printf 'PasswordAuthentication no\nKbdInteractiveAuthentication no\nPermitRootLogin prohibit-password\nHostKey /etc/ssh/ssh_host_ed25519_key\n' > /etc/ssh/sshd_config.d/00-raft.conf
+# Generate keys before sshd validates them; published templates contain no host keys.
+# Only the advertised Ed25519 key is needed; generating unused RSA keys slows first boot.
+cat > /etc/systemd/system/ssh.service.d/raft-keys.conf <<'UNIT'
+[Service]
+ExecStartPre=
+ExecStartPre=/bin/sh -ec 'test -f /etc/ssh/ssh_host_ed25519_key || ssh-keygen -q -t ed25519 -N "" -f /etc/ssh/ssh_host_ed25519_key'
+ExecStartPre=/usr/sbin/sshd -t
+UNIT
+systemctl enable docker ssh
+systemctl start docker
+docker info --format '{{.ServerVersion}}'
+dpkg-query -W > /opt/raft/packages.tsv
+npm list -g --depth=0 --json > /opt/raft/npm-packages.json
+apt-get clean
+rm -rf /var/lib/apt/lists/* /tmp/raft-node* /tmp/raft-dotnet-install.sh /root/.npm/_cacache /root/.npm/_logs
+rm -f /etc/ssh/ssh_host_*
+truncate -s 0 /etc/machine-id

package/images/incus/desktop.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+set -eu
+export DISPLAY=:99
+Xvfb :99 -screen 0 1280x720x24 -nolisten tcp &
+xvfb_pid=$!
+trap 'kill "$xvfb_pid" 2>/dev/null || true' EXIT
+# Start clients as soon as X accepts requests, rather than sleeping on every launch.
+attempt=0
+until xdpyinfo >/dev/null 2>&1; do
+  attempt=$((attempt + 1))
+  if [ "$attempt" -ge 100 ]; then
+    echo 'Xvfb did not become ready within five seconds' >&2
+    exit 1
+  fi
+  sleep 0.05
+done
+runuser -u developer -- env DISPLAY=:99 openbox &
+# This dedicated Xvfb display has no login manager to wait for.
+X11VNC_AVOID_WINDOWS=never x11vnc -display :99 -localhost -nopw -forever -shared -rfbport 5900 &
+websockify --web=/usr/share/novnc 0.0.0.0:6080 127.0.0.1:5900 &
+wait

package/images/incus/raft-desktop.service

@@ -0,0 +1,7 @@
+[Unit]
+Description=Private Raft desktop on demand
+After=network.target
+[Service]
+ExecStart=/usr/local/bin/raft-desktop
+Restart=on-failure
+KillMode=control-group

package/package.json

@@ -1,6 +1,48 @@
 {
   "name": "@microck/raft",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.1",
+  "description": "Self-hosted Linux workspaces powered by Incus, an open-source alternative to boat.dev",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Microck/raft.git"
+  },
+  "homepage": "https://raft.micr.dev",
+  "bugs": {
+    "url": "https://github.com/Microck/raft/issues"
+  },
+  "bin": {
+    "raft": "raft.py"
+  },
+  "os": [
+    "linux"
+  ],
+  "files": [
+    "raft.py",
+    "raft_files.py",
+    "deploy/*.py",
+    "deploy/*.sh",
+    "deploy/*.conf",
+    "deploy/*.service",
+    "deploy/*.timer",
+    "docs/**/*.md",
+    "docs/**/*.mdx",
+    "docs/**/*.json",
+    "images/incus/*.sh",
+    "images/incus/*.service",
+    "skills/raft-cli/SKILL.md",
+    ".github/assets/raft-logo.png"
+  ],
+  "keywords": [
+    "raft",
+    "sandbox",
+    "incus",
+    "self-hosted",
+    "linux",
+    "cli"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  }
+}