@underpostnet/cyberia 3.2.80

package/scripts/kubeadm-node-setup.sh

@@ -0,0 +1,317 @@
+#!/bin/bash
+set -euo pipefail
+
+# ---------------------------------------------------------------------------
+# Underpost Kubeadm Node Setup (bare-metal physical node)
+#
+# Mirrors scripts/k3s-node-setup.sh but for kubeadm on real hardware: it runs on
+# the freshly deployed OS (disk-installed Rocky) after first boot, installs NVM +
+# Node.js, ensures the engine source is present, and drives the cluster bring-up
+# through the local engine entrypoint `node bin cluster` (src/cli/cluster.js) —
+# reusing its kubeadm + Contour + host-init logic instead of reimplementing it.
+#
+# Modes:
+#   --control                 Initialize a new kubeadm control-plane (default).
+#   --worker                  Join an existing cluster.
+#
+# Worker join (controller supplies this over SSH; no manual token paste):
+#   --join-command="kubeadm join <ip>:6443 --token <t> --discovery-token-ca-cert-hash <h>"
+#   or:  --control-ip=<ip> --token=<t> --discovery-token-ca-cert-hash=<h>
+#
+# Engine source / options:
+#   --engine-root=<path>      Engine source path (default /home/dd/engine).
+#   --engine-repo=<url>       Git repo cloned if the engine source is missing.
+#   --engine-branch=<branch>  Branch to clone (default: repo default).
+#   --no-contour              Control mode: skip the Contour ingress install.
+# ---------------------------------------------------------------------------
+
+ROLE="control"
+JOIN_COMMAND=""
+CONTROL_IP=""
+CONTROL_ENDPOINT_HOST=""
+TOKEN=""
+CA_CERT_HASH=""
+JOIN_ONLY="0"
+INSTALL_CONTOUR="1"
+ENGINE_ROOT="/home/dd/engine"
+ENGINE_REPO="https://github.com/underpostnet/engine.git"
+ENGINE_BRANCH=""
+# Private repo holding secrets (engine-private/conf/.../.env.production) cloned
+# with a GitHub token. GITHUB_TOKEN/GITHUB_USERNAME come from the environment
+# (passed over SSH by the controller) or the --github-* args.
+ENGINE_PRIVATE_REPO="https://github.com/underpostnet/engine-private.git"
+ENGINE_PRIVATE_BRANCH=""
+GITHUB_TOKEN="${GITHUB_TOKEN:-}"
+GITHUB_USERNAME="${GITHUB_USERNAME:-}"
+CRI_SOCKET="unix:///var/run/crio/crio.sock"
+
+for arg in "$@"; do
+    case $arg in
+        --control)                          ROLE="control" ;;
+        --worker)                           ROLE="worker" ;;
+        --join-command=*)                   JOIN_COMMAND="${arg#*=}" ;;
+        --control-ip=*)                     CONTROL_IP="${arg#*=}" ;;
+        --control-endpoint-host=*)          CONTROL_ENDPOINT_HOST="${arg#*=}" ;;
+        --token=*)                          TOKEN="${arg#*=}" ;;
+        --discovery-token-ca-cert-hash=*)   CA_CERT_HASH="${arg#*=}" ;;
+        --join-only)                        JOIN_ONLY="1" ;;
+        --engine-root=*)                    ENGINE_ROOT="${arg#*=}" ;;
+        --engine-repo=*)                    ENGINE_REPO="${arg#*=}" ;;
+        --engine-branch=*)                  ENGINE_BRANCH="${arg#*=}" ;;
+        --engine-private-repo=*)            ENGINE_PRIVATE_REPO="${arg#*=}" ;;
+        --engine-private-branch=*)          ENGINE_PRIVATE_BRANCH="${arg#*=}" ;;
+        --github-token=*)                   GITHUB_TOKEN="${arg#*=}" ;;
+        --github-username=*)                GITHUB_USERNAME="${arg#*=}" ;;
+        --no-contour)                       INSTALL_CONTOUR="0" ;;
+    esac
+done
+
+log() { echo "$(date): [kubeadm-setup] $*"; }
+
+# worker_join: lightweight, idempotent kubeadm join. Centralizes the join logic
+# used by both the full worker flow and the --join-only short-circuit. Returns
+# non-zero on failure so `set -e` aborts the script (no false-positive success).
+worker_join() {
+    if [ -z "$JOIN_COMMAND" ]; then
+        if [ -n "$CONTROL_IP" ] && [ -n "$TOKEN" ] && [ -n "$CA_CERT_HASH" ]; then
+            JOIN_COMMAND="kubeadm join ${CONTROL_IP}:6443 --token ${TOKEN} --discovery-token-ca-cert-hash ${CA_CERT_HASH}"
+        else
+            echo "ERROR: worker mode needs --join-command=... OR --control-ip/--token/--discovery-token-ca-cert-hash" >&2
+            return 1
+        fi
+    fi
+
+    command -v kubeadm >/dev/null 2>&1 || {
+        echo "ERROR: kubeadm not found on node. Run a full (non --join-only) setup first." >&2
+        return 1
+    }
+
+    # Make the control-plane endpoint hostname resolve to the control IP. kubeadm
+    # reads the cluster-info / kubeadm-config ConfigMaps whose server URL is the
+    # control-plane endpoint (often 'localhost.localdomain:6443'); without this the
+    # worker dials [::1]:6443 and fails with "connection refused".
+    if [ -n "$CONTROL_ENDPOINT_HOST" ] && [ -n "$CONTROL_IP" ] && [ "$CONTROL_ENDPOINT_HOST" != "$CONTROL_IP" ]; then
+        log "Mapping control-plane endpoint '$CONTROL_ENDPOINT_HOST' -> $CONTROL_IP in /etc/hosts"
+        ESC_HOST="$(printf '%s' "$CONTROL_ENDPOINT_HOST" | sed 's/[.]/\\./g')"
+        # Strip the endpoint host from any existing (loopback) line so it no longer
+        # resolves to 127.0.0.1, then point it at the real control-plane IP.
+        sudo sed -i -E "s/[[:space:]]+${ESC_HOST}([[:space:]]|\$)/\1/g" /etc/hosts || true
+        if ! grep -qE "^${CONTROL_IP}[[:space:]].*${ESC_HOST}([[:space:]]|\$)" /etc/hosts; then
+            echo "${CONTROL_IP} ${CONTROL_ENDPOINT_HOST}" | sudo tee -a /etc/hosts >/dev/null
+        fi
+    fi
+
+    # Kernel/sysctl prereqs the kubeadm preflight needs (no engine/node required).
+    sudo swapoff -a || true
+    sudo sed -i '/swap/d' /etc/fstab || true
+    sudo modprobe br_netfilter || true
+    printf 'net.bridge.bridge-nf-call-iptables = 1\nnet.bridge.bridge-nf-call-ip6tables = 1\nnet.ipv4.ip_forward = 1\n' \
+    | sudo tee /etc/sysctl.d/99-kubernetes.conf >/dev/null
+    sudo sysctl --system >/dev/null 2>&1 || true
+
+    # Replace --discovery-token-ca-cert-hash with --discovery-token-unsafe-skip-ca-verification
+    # so token discovery does not depend on the pinned CA hash.
+    UNSAFE_JOIN="$(echo "${JOIN_COMMAND}" | sed 's/--discovery-token-ca-cert-hash [^ ]*/--discovery-token-unsafe-skip-ca-verification/')"
+
+    _do_join() {
+        # Reset any stale state from a previous failed join so kubeadm does not
+        # reuse cached config that points at an unreachable endpoint.
+        sudo kubeadm reset -f --cri-socket="${CRI_SOCKET}" >/dev/null 2>&1 || true
+        sudo rm -rf /etc/kubernetes/* /var/lib/kubelet/pki 2>/dev/null || true
+        log "Joining cluster: ${UNSAFE_JOIN%% --token*} ..."
+        sudo ${UNSAFE_JOIN} --cri-socket="${CRI_SOCKET}"
+    }
+
+    if _do_join; then
+        log "Worker joined the cluster."
+        return 0
+    fi
+    log "WARNING: kubeadm join attempt failed; resetting and retrying once..."
+    if _do_join; then
+        log "Worker joined the cluster."
+        return 0
+    fi
+    log "FATAL: kubeadm join failed after retry"
+    return 1
+}
+
+# --join-only: skip all prerequisite/engine/host setup and go straight to the
+# join (used by `baremetal --resume-join` on an already-provisioned node).
+if [ "$JOIN_ONLY" = "1" ]; then
+    [ "$ROLE" = "worker" ] || { echo "ERROR: --join-only is only valid with --worker" >&2; exit 1; }
+    log "--join-only: skipping prerequisites/engine setup; joining cluster directly"
+    worker_join
+    log "kubeadm worker (join-only) complete."
+    exit 0
+fi
+
+# ---------------------------------------------------------------------------
+# 0. Base prerequisites — a minimal @core Rocky install lacks tar/xz/git, which
+#    NVM needs to extract Node.js and the engine clone needs. Install them first.
+# ---------------------------------------------------------------------------
+log "Installing base prerequisites (tar, xz, gzip, git, curl)..."
+sudo dnf install -y tar xz gzip bzip2 git curl ca-certificates which findutils 2>/dev/null \
+|| dnf install -y tar xz gzip bzip2 git curl ca-certificates which findutils
+
+# ---------------------------------------------------------------------------
+# 1. NVM and Node.js — required for the `node bin ...` entrypoints. Idempotent so
+#    a retried run does not reinstall Node from scratch.
+# ---------------------------------------------------------------------------
+if command -v node >/dev/null 2>&1 && node --version 2>/dev/null | grep -q '^v24'; then
+    log "Node.js $(node --version) already installed; skipping NVM setup"
+else
+    log "Installing NVM and Node.js v24.15.0..."
+    curl -o- https://cdn.jsdelivr.net/gh/nvm-sh/nvm@v0.40.1/install.sh | bash
+    
+    export NVM_DIR="$([ -z "${XDG_CONFIG_HOME-}" ] && printf %s "${HOME}/.nvm" || printf %s "${XDG_CONFIG_HOME}/nvm")"
+    # shellcheck disable=SC1090
+    [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
+    
+    nvm install 24.15.0
+    nvm use 24.15.0
+    nvm alias default 24.15.0
+    ln -sf "$(command -v node)" /usr/local/bin/node
+    ln -sf "$(command -v npm)" /usr/local/bin/npm
+    ln -sf "$(command -v npx)" /usr/local/bin/npx
+fi
+
+echo "
+██╗░░░██╗███╗░░██╗██████╗░███████╗██████╗░██████╗░░█████╗░░██████╗████████╗
+██║░░░██║████╗░██║██╔══██╗██╔════╝██╔══██╗██╔══██╗██╔══██╗██╔════╝╚══██╔══╝
+██║░░░██║██╔██╗██║██║░░██║█████╗░░██████╔╝██████╔╝██║░░██║╚█████╗░░░░██║░░░
+██║░░░██║██║╚████║██║░░██║██╔══╝░░██╔══██╗██╔═══╝░██║░░██║░╚═══██╗░░░██║░░░
+╚██████╔╝██║░╚███║██████╔╝███████╗██║░░██║██║░░░░░╚█████╔╝██████╔╝░░░██║░░░
+░╚═════╝░╚═╝░░╚══╝╚═════╝░╚══════╝╚═╝░░╚═╝╚═╝░░░░░░╚════╝░╚═════╝░░░░╚═╝░░░
+
+Bringing up underpost kubeadm node (role=$ROLE) from $ENGINE_ROOT
+"
+
+# ---------------------------------------------------------------------------
+# 2. Engine source — required by `node bin cluster` (manifests + CLI).
+#    Normalizes any (custom-named) repo into the canonical paths, mirroring
+#    src/server/start.js: clone into a temp dir then copy the contents into the
+#    target, so the working tree is always $ENGINE_ROOT regardless of repo name.
+# ---------------------------------------------------------------------------
+command -v git >/dev/null 2>&1 || sudo dnf install -y git
+
+# clone_or_pull <repo-url> <branch> <target-dir> <remote-name> [mask-secret]
+# If <target-dir> exists with a git repo, does a git pull (fetch+reset) to
+# update it. Otherwise clones <repo-url> into a temp dir and copies contents
+# to <target-dir> so a custom repo (e.g. engine-test-test) always lands at
+# the canonical path. [mask-secret] is redacted from any logged output.
+clone_or_pull() {
+    local url="${1:-}" branch="${2:-}" target="${3:-}" remote="${4:-origin}" mask="${5:-}"
+    if [ -d "$target" ] && git -C "$target" rev-parse --git-dir >/dev/null 2>&1; then
+        log "$target already present; pulling latest ..."
+        if git -C "$target" remote get-url "$remote" >/dev/null 2>&1; then
+            # Temporarily set the authenticated URL so the fetch succeeds.
+            # The caller strips the token from the remote URL after this returns.
+            local saved_url; saved_url="$(git -C "$target" remote get-url "$remote" 2>/dev/null || true)"
+            git -C "$target" remote set-url "$remote" "$url" 2>/dev/null || true
+            if [ -n "$mask" ]; then
+                git -C "$target" fetch --depth 1 "$remote" 2>&1 | sed "s/${mask}/***/g" || true
+            else
+                git -C "$target" fetch --depth 1 "$remote" 2>&1 || true
+            fi
+            # Restore the saved (clean) URL immediately so the token is never persisted.
+            if [ -n "$saved_url" ]; then
+                git -C "$target" remote set-url "$remote" "$saved_url" 2>/dev/null || true
+            fi
+            if [ -n "$branch" ]; then
+                git -C "$target" reset --hard "$remote/$branch" 2>/dev/null || true
+            else
+                # No branch specified: pull whichever branch is HEAD on remote
+                git -C "$target" reset --hard "$remote/$(git -C "$target" rev-parse --abbrev-ref HEAD 2>/dev/null)" 2>/dev/null || true
+            fi
+            # Clean untracked files so stale artifacts don't accumulate
+            git -C "$target" clean -fd 2>/dev/null || true
+            log "$target updated via pull"
+            return 0
+        fi
+    fi
+    # Full clone + normalize path
+    log "Cloning + normalizing $url -> $target ..."
+    local tmp; tmp="$(mktemp -d)"
+    local ok=0
+    if [ -n "$branch" ]; then
+        if [ -n "$mask" ]; then git clone --depth 1 --branch "$branch" "$url" "$tmp/repo" 2>&1 | sed "s/${mask}/***/g"; ok=${PIPESTATUS[0]}; else git clone --depth 1 --branch "$branch" "$url" "$tmp/repo"; ok=$?; fi
+    else
+        if [ -n "$mask" ]; then git clone --depth 1 "$url" "$tmp/repo" 2>&1 | sed "s/${mask}/***/g"; ok=${PIPESTATUS[0]}; else git clone --depth 1 "$url" "$tmp/repo"; ok=$?; fi
+    fi
+    if [ "$ok" -ne 0 ] || [ ! -d "$tmp/repo" ]; then
+        rm -rf "$tmp"
+        return 1
+    fi
+    mkdir -p "$target"
+    cp -a "$tmp/repo/." "$target/"
+    rm -rf "$tmp"
+}
+
+if [ -n "$GITHUB_TOKEN" ]; then
+    ENGINE_REPO_URL="https://${GITHUB_USERNAME:-x-access-token}:${GITHUB_TOKEN}@${ENGINE_REPO#https://}"
+    # Mask the token in log output by routing through clone_or_pull with mask arg
+    clone_or_pull "$ENGINE_REPO_URL" "$ENGINE_BRANCH" "$ENGINE_ROOT" "origin" "$GITHUB_TOKEN" || { log "FATAL: engine clone failed"; exit 1; }
+    # Drop the token from the remote URL so it is not persisted on disk.
+    git -C "$ENGINE_ROOT" remote set-url origin "$ENGINE_REPO" 2>/dev/null || true
+else
+    clone_or_pull "$ENGINE_REPO" "$ENGINE_BRANCH" "$ENGINE_ROOT" "origin" "" || { log "FATAL: engine clone failed"; exit 1; }
+fi
+
+cd "$ENGINE_ROOT"
+
+# Clone + normalize the private secrets repo into $ENGINE_ROOT/engine-private
+# (where `node bin run secret` reads engine-private/conf/.../.env.production),
+# regardless of the private repo's name. The token is masked in logs and then
+# stripped from the saved remote URL.
+if [ -n "$GITHUB_TOKEN" ]; then
+    PRIV_URL="https://${GITHUB_USERNAME:-x-access-token}:${GITHUB_TOKEN}@${ENGINE_PRIVATE_REPO#https://}"
+    if clone_or_pull "$PRIV_URL" "$ENGINE_PRIVATE_BRANCH" "$ENGINE_ROOT/engine-private" "origin" "$GITHUB_TOKEN"; then
+        # Drop the token from the remote URL so it is not persisted on disk.
+        git -C "$ENGINE_ROOT/engine-private" remote set-url origin "$ENGINE_PRIVATE_REPO" 2>/dev/null || true
+    else
+        log "WARNING: engine-private clone failed — secrets will be unavailable"
+    fi
+else
+    log "WARNING: GITHUB_TOKEN not provided; engine-private not cloned — secrets will be unavailable"
+fi
+
+# Install JS deps and generate secrets using the local engine entrypoint.
+npm install
+npm install -g underpost
+node bin run secret
+
+# ---------------------------------------------------------------------------
+# 3. Host prerequisites (Docker, CRI-O, kubelet/kubeadm/kubectl, ...) via cluster.js
+# ---------------------------------------------------------------------------
+log "Installing Kubernetes host prerequisites (underpost cluster --init-host)..."
+# CRI-O is already installed by this point (idempotent dnf). The install-crio
+# runner also tries to install cri-tools (crictl) which is not in Rocky 9 repos.
+# That failure is non-fatal; CRI-O itself works fine without crictl.
+node bin cluster --dev --init-host || log "WARNING: init-host had minor errors (CRI-O is already installed)"
+
+# ---------------------------------------------------------------------------
+# 4. Role-specific bring-up, fully delegated to src/cli/cluster.js
+# ---------------------------------------------------------------------------
+if [ "$ROLE" = "control" ]; then
+    if [ "$INSTALL_CONTOUR" = "1" ]; then
+        log "Initializing kubeadm control-plane + Contour (underpost cluster --kubeadm --contour)..."
+        node bin cluster --dev --kubeadm --contour
+    else
+        log "Initializing kubeadm control-plane (underpost cluster --kubeadm)..."
+        node bin cluster --dev --kubeadm
+    fi
+    
+    echo ""
+    log "Control-plane ready. Join command for workers:"
+    sudo kubeadm token create --print-join-command
+    
+    elif [ "$ROLE" = "worker" ]; then
+    # Apply the same host configuration cluster.js uses (SELinux, swap, sysctl)
+    # before joining; worker_join then handles endpoint mapping + the join itself
+    # and fails the script (set -e) if the join does not succeed.
+    log "Applying host configuration (underpost cluster --config)..."
+    node bin cluster --dev --config
+    worker_join
+fi
+
+log "kubeadm ${ROLE} setup complete."

package/scripts/link-local-underpost-cli.sh

@@ -0,0 +1,6 @@
+
+#!/usr/bin/env bash
+set -euo pipefail
+
+cd /home/dd && underpost clone underpostnet/pwa-microservices-template
+cd /home/dd/pwa-microservices-template && npm install && npm link

package/scripts/lxd-vm-setup.sh

@@ -0,0 +1,208 @@
+#!/bin/bash
+set -euo pipefail
+
+# ---------------------------------------------------------------------------
+# LXD VM OS base setup. Runs inside the VM via `lxc exec`. Idempotent.
+# ---------------------------------------------------------------------------
+
+# lxdbr0 is a plain L2 bridge: LXD runs no DHCP/DNS on it (MAAS owns
+# provisioning), so VMs configure their NIC statically and deterministically.
+# The host pins the gateway (10.250.250.1) on the bridge and provides NAT; no
+# resolver listens there, so DNS must use public/MAAS resolvers, not the gateway.
+# LXD_NET_MODE=dhcp opts back into DHCP-first for VMs on a MAAS-served segment.
+LXD_NET_MODE="${LXD_NET_MODE:-static}"
+LXD_FALLBACK_IPV4_CIDR="${LXD_FALLBACK_IPV4_CIDR:-10.250.250.100/24}"
+LXD_FALLBACK_GATEWAY="${LXD_FALLBACK_GATEWAY:-10.250.250.1}"
+LXD_FALLBACK_DNS="${LXD_FALLBACK_DNS:-1.1.1.1 8.8.8.8}"
+ROCKY_MIRROR_HOST="${ROCKY_MIRROR_HOST:-mirrors.rockylinux.org}"
+
+current_ipv4() {
+    ip -4 addr show "$IFACE" | awk '/inet /{print $2; exit}'
+}
+
+wait_for_ipv4() {
+    local current_ip=""
+    
+    for _ in $(seq 1 10); do
+        current_ip="$(current_ipv4)"
+        if [ -n "$current_ip" ]; then
+            echo "$current_ip"
+            return 0
+        fi
+        sleep 1
+    done
+    
+    return 1
+}
+
+refresh_resolver_state() {
+    if command -v resolvectl >/dev/null 2>&1; then
+        sudo resolvectl flush-caches || true
+    fi
+    
+    if [ -f /run/NetworkManager/resolv.conf ]; then
+        sudo ln -sf /run/NetworkManager/resolv.conf /etc/resolv.conf || true
+    fi
+}
+
+verify_name_resolution() {
+    getent ahostsv4 "$ROCKY_MIRROR_HOST" >/dev/null 2>&1
+}
+
+retry_dnf() {
+    local attempt=1
+    local max_attempts=3
+    
+    until "$@"; do
+        if [ "$attempt" -ge "$max_attempts" ]; then
+            return 1
+        fi
+        
+        echo "DNF command failed (attempt $attempt/$max_attempts): $*"
+        echo "Refreshing resolver state before retry..."
+        refresh_resolver_state
+        verify_name_resolution || true
+        attempt=$((attempt + 1))
+    done
+}
+
+# k3s derives the node name from the system hostname. The Rocky image keeps
+# "localhost.localdomain" for every VM, so without this every node would try to
+# register under the same name — the second one is rejected ("Node password
+# rejected, duplicate hostname"). Pin the hostname to the LXD instance name so
+# node names are unique and deterministic (control plane labeling relies on it).
+if [ -n "${LXD_NODE_NAME:-}" ] && [ "$(hostname)" != "$LXD_NODE_NAME" ]; then
+    echo "--- Hostname ---"
+    echo "Setting hostname to ${LXD_NODE_NAME} (k3s node name)..."
+    sudo hostnamectl set-hostname "$LXD_NODE_NAME" 2>/dev/null || sudo hostname "$LXD_NODE_NAME"
+fi
+
+echo "--- Network Configuration ---"
+
+# 1. Detect primary non-loopback interface
+IFACE=$(ip -o link show up | awk -F': ' '$2!="lo"{print $2; exit}')
+echo "Using network interface: ${IFACE:-none}"
+
+if [ -z "$IFACE" ]; then
+    echo "CRITICAL ERROR: No network interface detected."
+    exit 1
+fi
+
+# 2. Force NetworkManager initialization if interface lacks an IP address
+CURRENT_IP="$(current_ipv4 || true)"
+
+if command -v nmcli >/dev/null 2>&1 && [ -z "$CURRENT_IP" ]; then
+    echo "Inspecting NetworkManager profiles..."
+    
+    # Check if a profile is tracking this device
+    NM_CON=$(nmcli -t -f NAME,DEVICE connection show | awk -F: -v iface="$IFACE" '$2==iface{print $1; exit}')
+    
+    if [ -z "$NM_CON" ]; then
+        echo "No connection profile matches $IFACE. Forcing generation of profile 'k3s-net'..."
+        nmcli connection add type ethernet con-name k3s-net ifname "$IFACE"
+        NM_CON="k3s-net"
+    fi
+
+    apply_static_ipv4() {
+        echo "Applying static LXD bridge address ${LXD_FALLBACK_IPV4_CIDR} (gw ${LXD_FALLBACK_GATEWAY}, dns ${LXD_FALLBACK_DNS})..."
+        nmcli connection modify "$NM_CON" \
+        connection.autoconnect yes \
+        connection.interface-name "$IFACE" \
+        ipv4.method manual \
+        ipv4.addresses "$LXD_FALLBACK_IPV4_CIDR" \
+        ipv4.gateway "$LXD_FALLBACK_GATEWAY" \
+        ipv4.dns "$LXD_FALLBACK_DNS" \
+        ipv4.ignore-auto-dns yes \
+        ipv6.method ignore
+        nmcli connection up "$NM_CON"
+        CURRENT_IP="$(wait_for_ipv4 || true)"
+    }
+
+    # Static-first: lxdbr0 has no DHCP, so a DHCP attempt only adds a ~45s
+    # activation timeout per boot. DHCP is opt-in for VMs on a MAAS-served
+    # segment (LXD_NET_MODE=dhcp), with a static fallback if no lease appears.
+    if [ "$LXD_NET_MODE" = "dhcp" ]; then
+        echo "Configuring DHCP-first NetworkManager profile '$NM_CON'..."
+        nmcli connection modify "$NM_CON" \
+        connection.autoconnect yes \
+        connection.interface-name "$IFACE" \
+        ipv4.method auto \
+        ipv4.dhcp-client-id mac \
+        ipv4.ignore-auto-dns no \
+        ipv6.method ignore
+        echo "Bringing network interface up with DHCP..."
+        nmcli connection up "$NM_CON" || echo "DHCP activation failed; static fallback will be applied."
+        CURRENT_IP="$(wait_for_ipv4 || true)"
+        if [ -z "$CURRENT_IP" ]; then
+            echo "No DHCP lease on $IFACE."
+            apply_static_ipv4
+        fi
+    else
+        echo "Configuring static NetworkManager profile '$NM_CON' for the plain LXD bridge..."
+        apply_static_ipv4
+    fi
+fi
+
+# 3. Give the network interface a short window to settle and lease an IP address
+echo "Waiting for IP address allocation..."
+CURRENT_IP="${CURRENT_IP:-$(wait_for_ipv4 || true)}"
+if [ -n "$CURRENT_IP" ]; then
+    echo "Interface $IFACE successfully initialized with IP: $CURRENT_IP"
+fi
+
+# 4. Verify DNS and outbound connectivity before proceeding (Fail Closed)
+echo "Verifying internet and DNS connectivity..."
+refresh_resolver_state
+if ! verify_name_resolution; then
+    echo "CRITICAL ERROR: DNS lookup failed for $ROCKY_MIRROR_HOST. Diagnostic snapshot:"
+    echo "=== /etc/resolv.conf ==="
+    cat /etc/resolv.conf || true
+    echo "=== Interface State ==="
+    ip -4 addr show "$IFACE" || true
+    echo "=== Routing Table ==="
+    ip route show || true
+    echo "=== NetworkManager Status ==="
+    nmcli device status || true
+    exit 1
+fi
+
+if ! timeout 15 curl -fsSL --max-time 10 "https://${ROCKY_MIRROR_HOST}" -o /dev/null; then
+    echo "CRITICAL ERROR: Network/DNS remains unreachable. Diagnostic snapshot:"
+    echo "=== /etc/resolv.conf ==="
+    cat /etc/resolv.conf || true
+    echo "=== Interface State ==="
+    ip -4 addr show "$IFACE" || true
+    echo "=== Routing Table ==="
+    ip route show || true
+    echo "=== NetworkManager Status ==="
+    nmcli device status || true
+    exit 1
+fi
+
+echo "--- Disk Resizing ---"
+if ! command -v parted >/dev/null 2>&1; then
+    sudo dnf install -y parted
+fi
+
+set +e
+sudo parted /dev/sda ---pretend-input-tty <<EOF
+unit s
+resizepart 2 100%
+Yes
+quit
+EOF
+set -e
+
+sudo resize2fs /dev/sda2
+echo "Disk partition and filesystem resized successfully."
+
+echo "--- Package Installation ---"
+retry_dnf sudo dnf install -y epel-release
+retry_dnf sudo dnf install -y tar bzip2 git curl jq
+retry_dnf sudo dnf -y update
+
+echo "--- Kernel Modules for K3s ---"
+sudo modprobe br_netfilter
+echo "br_netfilter" | sudo tee /etc/modules-load.d/k3s-br_netfilter.conf > /dev/null
+
+echo "Setup complete. System is ready for k3s-node-setup.sh"

package/scripts/maas-nat-firewalld.sh

@@ -0,0 +1,145 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# MAAS NAT + firewall helper
+# - Enables IPv4 forwarding and masquerading for the MAAS/provisioning subnet
+# - Opens the MAAS API on the uplink zone when requested
+# - Opens provisioning and optional NFS services on the zone bound to MAAS_LAN_CIDR
+#
+# Usage examples:
+#   sudo MAAS_LAN_CIDR="192.168.1.0/24" PUBLIC_ZONE="public" ./maas-nat-firewalld.sh
+#   sudo NFS_MODE="v3" CONFIGURE_NFS_V3_PORTS="true" ./maas-nat-firewalld.sh
+
+MAAS_LAN_CIDR="${MAAS_LAN_CIDR:-192.168.1.0/24}"
+PUBLIC_ZONE="${PUBLIC_ZONE:-public}"
+TRUSTED_ZONE="${TRUSTED_ZONE:-trusted}"
+NFS_MODE="${NFS_MODE:-v4}"                    # v4 or v3
+CONFIGURE_NFS_V3_PORTS="${CONFIGURE_NFS_V3_PORTS:-false}"
+EXPOSE_MAAS_API_PUBLIC="${EXPOSE_MAAS_API_PUBLIC:-true}"
+
+# Fixed NFSv3 ports (only used when CONFIGURE_NFS_V3_PORTS=true)
+NFS_MOUNTD_PORT="${NFS_MOUNTD_PORT:-20048}"
+NFS_STATD_PORT="${NFS_STATD_PORT:-32765}"
+# Outgoing port must differ from the listen port; rpc.statd exits 255 if they match.
+NFS_STATD_OUTGOING_PORT="${NFS_STATD_OUTGOING_PORT:-32766}"
+NFS_LOCKD_PORT="${NFS_LOCKD_PORT:-32803}"
+NFS_LOCKD_UDP_PORT="${NFS_LOCKD_UDP_PORT:-${NFS_LOCKD_PORT}}"
+NFS_CONF_DROPIN="/etc/nfs.conf.d/99-maas-nfs-v3-ports.conf"
+
+case "${NFS_MODE}" in
+    v3|v4) ;;
+    *)
+        echo "[ERROR] NFS_MODE must be 'v3' or 'v4'." >&2
+        exit 1
+    ;;
+esac
+
+# Ensure the kernel NFS server is enabled and actually running. `exportfs -rav` only populates the
+# export table; it does not start nfsd, and `systemctl try-restart` is a no-op when the unit is
+# stopped. Without this, clients hang on mount because nothing listens on 2049/mountd.
+ensure_nfs_server_running() {
+    if [[ "${NFS_MODE}" == "v3" ]]; then
+        # NFSv3 depends on the portmapper and the status monitor.
+        sudo systemctl enable --now rpcbind 2>/dev/null || true
+        sudo systemctl enable --now rpc-statd 2>/dev/null || true
+    fi
+    
+    local unit=""
+    for candidate in nfs-server nfs-kernel-server; do
+        if systemctl cat "${candidate}.service" >/dev/null 2>&1; then
+            unit="${candidate}"
+            break
+        fi
+    done
+    if [[ -z "${unit}" ]]; then
+        echo "[ERROR] No NFS server unit found (nfs-server/nfs-kernel-server). Install nfs-utils or nfs-kernel-server." >&2
+        return 1
+    fi
+    
+    echo "[INFO] Enabling and (re)starting ${unit} to apply exports and fixed ports..."
+    sudo systemctl enable "${unit}" 2>/dev/null || true
+    sudo systemctl restart "${unit}"
+}
+
+echo "[INFO] Enabling firewalld..."
+sudo systemctl enable --now firewalld
+
+echo "[INFO] Enabling kernel forwarding..."
+sudo tee /etc/sysctl.d/99-maas-nat.conf >/dev/null <<'EOF'
+net.ipv4.ip_forward = 1
+EOF
+
+sudo sysctl --system >/dev/null
+
+echo "[INFO] Allowing NAT for the MAAS LAN..."
+sudo firewall-cmd --permanent --zone="${PUBLIC_ZONE}" --add-masquerade
+sudo firewall-cmd --permanent --zone="${TRUSTED_ZONE}" --add-source="${MAAS_LAN_CIDR}"
+
+echo "[INFO] Opening MAAS services on the MAAS LAN zone..."
+sudo firewall-cmd --permanent --zone="${TRUSTED_ZONE}" --add-port=5240/tcp
+for service in dns dhcp tftp; do
+    sudo firewall-cmd --permanent --zone="${TRUSTED_ZONE}" --add-service="${service}"
+done
+
+if [[ "${EXPOSE_MAAS_API_PUBLIC}" == "true" ]]; then
+    echo "[INFO] Opening MAAS API on the uplink zone..."
+    sudo firewall-cmd --permanent --zone="${PUBLIC_ZONE}" --add-port=5240/tcp
+fi
+
+echo "[INFO] Opening NFS ports on the MAAS LAN zone..."
+
+if [[ "${NFS_MODE}" == "v4" ]]; then
+    # NFSv4 normally needs only TCP 2049.
+    sudo firewall-cmd --permanent --zone="${TRUSTED_ZONE}" --add-port=2049/tcp
+else
+    # NFSv3 side-band daemons need fixed ports for deterministic firewall rules.
+    if [[ "${CONFIGURE_NFS_V3_PORTS}" != "true" ]]; then
+        echo "[ERROR] NFSv3 requires CONFIGURE_NFS_V3_PORTS=true for consistent firewalld rules." >&2
+        echo "[ERROR] Re-run with CONFIGURE_NFS_V3_PORTS=true or switch to NFS_MODE=v4." >&2
+        exit 1
+    fi
+    
+    echo "[INFO] Writing fixed NFSv3 port configuration..."
+    sudo install -d -m 0755 /etc/nfs.conf.d
+        sudo tee "${NFS_CONF_DROPIN}" >/dev/null <<EOF
+[nfsd]
+vers3=y
+
+[mountd]
+port=${NFS_MOUNTD_PORT}
+
+[statd]
+port=${NFS_STATD_PORT}
+outgoing-port=${NFS_STATD_OUTGOING_PORT}
+
+[lockd]
+port=${NFS_LOCKD_PORT}
+udp-port=${NFS_LOCKD_UDP_PORT}
+EOF
+    
+    sudo firewall-cmd --permanent --zone="${TRUSTED_ZONE}" --add-service=rpc-bind
+    sudo firewall-cmd --permanent --zone="${TRUSTED_ZONE}" --add-port=2049/tcp
+    for proto in tcp udp; do
+        sudo firewall-cmd --permanent --zone="${TRUSTED_ZONE}" --add-port="${NFS_MOUNTD_PORT}/${proto}"
+        sudo firewall-cmd --permanent --zone="${TRUSTED_ZONE}" --add-port="${NFS_STATD_PORT}/${proto}"
+        # Outgoing port is the fixed source for SM_NOTIFY; peers need to reach it.
+        sudo firewall-cmd --permanent --zone="${TRUSTED_ZONE}" --add-port="${NFS_STATD_OUTGOING_PORT}/${proto}"
+    done
+    sudo firewall-cmd --permanent --zone="${TRUSTED_ZONE}" --add-port="${NFS_LOCKD_PORT}/tcp"
+    sudo firewall-cmd --permanent --zone="${TRUSTED_ZONE}" --add-port="${NFS_LOCKD_UDP_PORT}/udp"
+fi
+
+ensure_nfs_server_running
+
+echo "[INFO] Reloading firewall..."
+sudo firewall-cmd --reload
+
+echo
+echo "[INFO] Firewall status:"
+sudo firewall-cmd --zone="${PUBLIC_ZONE}" --list-all
+echo
+echo "[INFO] MAAS LAN zone (${TRUSTED_ZONE}):"
+sudo firewall-cmd --zone="${TRUSTED_ZONE}" --list-all
+
+echo
+echo "[INFO] MAAS NAT + firewall configuration completed."