@underpostnet/cyberia 3.2.80

package/scripts/maas-setup.sh

@@ -0,0 +1,135 @@
+#!/bin/bash
+set -euo pipefail
+
+# Install jq for JSON parsing
+sudo snap install jq
+
+# Install MAAS
+sudo snap install maas
+
+# Get default interface and IP address
+INTERFACE=$(ip route | grep default | awk '{print $5}')
+IP_ADDRESS=$(ip -4 addr show dev "$INTERFACE" | grep -oP '(?<=inet\s)\d+(\.\d+){3}')
+
+# Change to the engine directory (assuming this is where your MAAS related configs are)
+cd /home/dd/engine
+
+# Load secrets for MAAS database and admin credentials
+underpost secret underpost --create-from-file /home/dd/engine/engine-private/conf/dd-cron/.env.production
+
+# Extract configuration values from secrets
+DB_PG_MAAS_USER=$(node bin config get --plain DB_PG_MAAS_USER)
+DB_PG_MAAS_PASS=$(node bin config get --plain DB_PG_MAAS_PASS)
+DB_PG_MAAS_HOST=$(node bin config get --plain DB_PG_MAAS_HOST)
+DB_PG_MAAS_NAME=$(node bin config get --plain DB_PG_MAAS_NAME)
+
+MAAS_ADMIN_USERNAME=$(node bin config get --plain MAAS_ADMIN_USERNAME)
+MAAS_ADMIN_EMAIL=$(node bin config get --plain MAAS_ADMIN_EMAIL)
+MAAS_ADMIN_PASS=$(node bin config get --plain MAAS_ADMIN_PASS)
+
+# Initialize MAAS region+rack controller
+maas init region+rack \
+    --database-uri "postgres://${DB_PG_MAAS_USER}:${DB_PG_MAAS_PASS}@${DB_PG_MAAS_HOST}/${DB_PG_MAAS_NAME}" \
+    --maas-url http://${IP_ADDRESS}:5240/MAAS
+
+# Allow MAAS to initialize (wait for services to come up)
+echo "Waiting for MAAS to initialize..."
+sleep 30
+
+# Create MAAS administrator account
+maas createadmin \
+    --username "$MAAS_ADMIN_USERNAME" \
+    --password "$MAAS_ADMIN_PASS" \
+    --email "$MAAS_ADMIN_EMAIL"
+
+# Get the API key for the admin user
+APIKEY=$(maas apikey --username "$MAAS_ADMIN_USERNAME")
+
+# Login to MAAS using the admin profile
+echo "Logging into MAAS..."
+maas login "$MAAS_ADMIN_USERNAME" "http://localhost:5240/MAAS/" "$APIKEY"
+
+# Set upstream DNS for MAAS
+echo "Setting upstream DNS to 8.8.8.8..."
+maas "$MAAS_ADMIN_USERNAME" maas set-config name=upstream_dns value=8.8.8.8
+
+# echo "Downloading Ubuntu Noble amd64/ga-24.04 image..."
+# maas $MAAS_ADMIN_USERNAME boot-source-selections create 1 \
+#     os="ubuntu" release="noble" arches="amd64" \
+#     subarches="ga-24.04" labels="*"
+
+# echo "Downloading Ubuntu Noble arm64/ga-24.04 image..."
+# maas $MAAS_ADMIN_USERNAME boot-source-selections create 1 \
+#     os="ubuntu" release="noble" arches="arm64" \
+#     subarches="ga-24.04" labels="*"
+
+# Import the newly selected boot images
+# echo "Importing boot images (this may take some time)..."
+# maas "$MAAS_ADMIN_USERNAME" boot-resources import
+
+# Disable the MAAS HTTP proxy
+echo "Disabling MAAS HTTP proxy..."
+maas "$MAAS_ADMIN_USERNAME" maas set-config name=enable_http_proxy value=false
+
+# Disable DNSSEC validation
+echo "Disabling DNSSEC validation..."
+maas "$MAAS_ADMIN_USERNAME" maas set-config name=dnssec_validation value=no
+
+# Set network discovery interval to 10 minutes (600 seconds)
+echo "Setting network discovery interval to 10 minutes..."
+maas "$MAAS_ADMIN_USERNAME" maas set-config name=active_discovery_interval value=600
+
+SSH_KEY=$(cat ~/.ssh/id_rsa.pub)
+maas $MAAS_ADMIN_USERNAME sshkeys create "key=$SSH_KEY"
+
+echo "MAAS setup script completed with new configurations."
+
+
+# maas $MAAS_ADMIN_USERNAME maas set-config name=default_storage_layout value=lvm
+# maas $MAAS_ADMIN_USERNAME maas set-config name=network_discovery value=disabled
+# maas $MAAS_ADMIN_USERNAME maas set-config name=enable_analytics value=false
+# maas $MAAS_ADMIN_USERNAME maas set-config name=enable_third_party_drivers value=false
+# maas $MAAS_ADMIN_USERNAME maas set-config name=curtin_verbose value=true
+
+
+
+echo "Configuring DHCP for the subnet's fabric (untagged VLAN)..."
+
+# Derive FABRIC_ID and VLAN_VID from the subnet that matches our CIDR
+SUBNET_CIDR="192.168.1.0/24"
+SUBNET_JSON=$(maas "$MAAS_ADMIN_USERNAME" subnets read | jq -r '.[] | select(.cidr == "'"$SUBNET_CIDR"'")')
+SUBNET_ID=$(echo "$SUBNET_JSON" | jq -r '.id')
+FABRIC_ID=$(echo "$SUBNET_JSON" | jq -r '.vlan.fabric_id')
+VLAN_VID=$(echo "$SUBNET_JSON" | jq -r '.vlan.vid')
+FABRIC_NAME=$(echo "$SUBNET_JSON" | jq -r '.vlan.fabric')
+echo "Detected subnet $SUBNET_CIDR on $FABRIC_NAME (fabric ID: $FABRIC_ID, VLAN VID: $VLAN_VID)"
+RACK_CONTROLLER_ID=$(maas "$MAAS_ADMIN_USERNAME" rack-controllers read | jq -r '[.[] | select(.ip_addresses[] == "'"$IP_ADDRESS"'") | .system_id] | .[0]')
+
+if [ -z "$RACK_CONTROLLER_ID" ] || [ "$RACK_CONTROLLER_ID" == "null" ]; then
+    echo "Warning: Could not find Rack Controller by IP $IP_ADDRESS. Attempting to use the first available Rack Controller..."
+    RACK_CONTROLLER_ID=$(maas "$MAAS_ADMIN_USERNAME" rack-controllers read | jq -r '.[0].system_id')
+fi
+
+if [ -z "$RACK_CONTROLLER_ID" ] || [ "$RACK_CONTROLLER_ID" == "null" ]; then
+    echo "Error: Could not find any Rack Controller."
+    exit 1
+fi
+
+START_IP="192.168.1.191"
+END_IP="192.168.1.254"
+
+if [ -z "$FABRIC_ID" ] || [ "$FABRIC_ID" == "null" ]; then
+    echo "Error: Could not find FABRIC_ID for subnet '$SUBNET_CIDR'. Please ensure the subnet exists in MAAS."
+    exit 1
+fi
+
+# Create a Dynamic IP Range for enlistment, commissioning, and deployment
+echo "Creating dynamic IP range from $START_IP to $END_IP..."
+maas "$MAAS_ADMIN_USERNAME" ipranges create type=dynamic start_ip="$START_IP" end_ip="$END_IP" || echo "Dynamic IP range likely already exists or conflicts. Proceeding..."
+
+# Enable DHCP on the VLAN associated with the subnet
+echo "Enabling DHCP on VLAN $VLAN_VID for $FABRIC_NAME (fabric ID: $FABRIC_ID)..."
+maas "$MAAS_ADMIN_USERNAME" vlan update "$FABRIC_ID" "$VLAN_VID" dhcp_on=true primary_rack="$RACK_CONTROLLER_ID"
+
+echo "Setting gateway IP for subnet $SUBNET_CIDR (ID: $SUBNET_ID) to $IP_ADDRESS..."
+maas "$MAAS_ADMIN_USERNAME" subnet update $SUBNET_ID gateway_ip=$IP_ADDRESS

package/scripts/maas-upload-boot-resource.sh

@@ -0,0 +1,183 @@
+#!/usr/bin/env bash
+# Script to upload boot resources to MAAS using the REST API with OAuth
+# Usage: ./maas-upload-boot-resource.sh <profile> <name> <title> <architecture> <base_image> <filetype> <file_path>
+
+set -euo pipefail
+
+if [ $# -lt 7 ]; then
+    echo "Usage: $0 <profile> <name> <title> <architecture> <base_image> <filetype> <file_path>"
+    echo ""
+    echo "Example:"
+    echo "  $0 maas custom/rocky9 'Rocky 9 Custom' amd64/generic rhel/9 tgz rocky9.tar.gz"
+    exit 1
+fi
+
+PROFILE="$1"
+NAME="$2"
+TITLE="$3"
+ARCHITECTURE="$4"
+BASE_IMAGE="$5"
+FILETYPE="$6"
+FILE_PATH="$7"
+
+# Verify file exists
+if [ ! -f "$FILE_PATH" ]; then
+    echo "Error: File not found: $FILE_PATH"
+    exit 1
+fi
+
+# Verify jq is installed
+if ! command -v jq &> /dev/null; then
+    echo "Error: jq is required for this script but not installed."
+    exit 1
+fi
+
+# Get MAAS API URL and credentials from profile
+MAAS_INFO=$(maas list | grep "^${PROFILE}")
+if [ -z "$MAAS_INFO" ]; then
+    echo "Error: MAAS profile '${PROFILE}' not found"
+    echo "Available profiles:"
+    maas list
+    exit 1
+fi
+
+API_URL=$(echo "$MAAS_INFO" | awk '{print $2}')
+API_KEY=$(echo "$MAAS_INFO" | awk '{print $3}')
+
+# Parse OAuth credentials
+CONSUMER_KEY=$(echo "$API_KEY" | cut -d: -f1)
+TOKEN_KEY=$(echo "$API_KEY" | cut -d: -f2)
+TOKEN_SECRET=$(echo "$API_KEY" | cut -d: -f3)
+
+# Calculate file hash and size
+echo "Calculating SHA256 checksum..."
+SHA256=$(sha256sum "$FILE_PATH" | awk '{print $1}')
+SIZE=$(stat -c%s "$FILE_PATH")
+
+echo "File: $FILE_PATH"
+echo "Size: $SIZE bytes ($(numfmt --to=iec-i --suffix=B $SIZE))"
+echo "SHA256: $SHA256"
+echo ""
+
+# Endpoint for boot resources
+ENDPOINT="${API_URL}boot-resources/"
+
+# Generate OAuth timestamp and nonce
+TIMESTAMP=$(date +%s)
+NONCE=$(openssl rand -hex 16)
+
+# OAuth parameters
+OAUTH_VERSION="1.0"
+OAUTH_SIGNATURE_METHOD="PLAINTEXT"
+OAUTH_SIGNATURE="&${TOKEN_SECRET}"
+
+echo "Initiating upload to MAAS..."
+echo "API URL: $ENDPOINT"
+echo "Name: $NAME"
+echo "Title: $TITLE"
+echo "Architecture: $ARCHITECTURE"
+echo "Base Image: $BASE_IMAGE"
+echo "Filetype: $FILETYPE"
+echo ""
+
+# 1. Initiate Upload (POST metadata)
+# We do NOT send the content here, just the metadata to create the resource and get the upload URI.
+RESPONSE=$(curl -s -X POST "${ENDPOINT}" \
+    -H "Authorization: OAuth oauth_version=\"${OAUTH_VERSION}\", oauth_signature_method=\"${OAUTH_SIGNATURE_METHOD}\", oauth_consumer_key=\"${CONSUMER_KEY}\", oauth_token=\"${TOKEN_KEY}\", oauth_signature=\"${OAUTH_SIGNATURE}\", oauth_timestamp=\"${TIMESTAMP}\", oauth_nonce=\"${NONCE}\"" \
+    -F "name=${NAME}" \
+    -F "title=${TITLE}" \
+    -F "architecture=${ARCHITECTURE}" \
+    -F "base_image=${BASE_IMAGE}" \
+    -F "filetype=${FILETYPE}" \
+    -F "sha256=${SHA256}" \
+    -F "size=${SIZE}")
+CURL_RET=$?
+
+if [ $CURL_RET -ne 0 ]; then
+    echo "Error: curl failed with exit code $CURL_RET"
+    exit 1
+fi
+
+# Validate JSON before parsing
+if ! echo "$RESPONSE" | jq . >/dev/null 2>&1; then
+    echo "Error: MAAS returned invalid JSON."
+    echo "Raw response:"
+    echo "$RESPONSE"
+    exit 1
+fi
+
+# Extract Upload URI
+UPLOAD_URI=$(echo "$RESPONSE" | jq -r '.sets | to_entries | sort_by(.key) | reverse | .[0].value.files | to_entries | .[0].value.upload_uri // empty')
+
+if [ -z "$UPLOAD_URI" ]; then
+    echo "✗ Failed to get upload URI from MAAS response."
+    echo "Response:"
+    echo "$RESPONSE" | jq . 2>/dev/null || echo "$RESPONSE"
+    exit 1
+fi
+
+echo "Upload URI obtained: $UPLOAD_URI"
+
+# Construct the full upload URL
+if [[ "$UPLOAD_URI" == http* ]]; then
+    FULL_UPLOAD_URL="$UPLOAD_URI"
+else
+    # Extract scheme and authority from API_URL
+    # e.g. http://192.168.1.5:5240/MAAS/api/2.0/ -> http://192.168.1.5:5240
+    MAAS_ROOT=$(echo "$API_URL" | sed -E 's|^(https?://[^/]+).*|\1|')
+
+    # Ensure UPLOAD_URI starts with /
+    [[ "$UPLOAD_URI" != /* ]] && UPLOAD_URI="/$UPLOAD_URI"
+
+    FULL_UPLOAD_URL="${MAAS_ROOT}${UPLOAD_URI}"
+fi
+
+echo "Full Upload URL: $FULL_UPLOAD_URL"
+
+# 2. Split file into chunks
+CHUNK_SIZE=$((4 * 1024 * 1024)) # 4MB
+TMP_DIR=$(mktemp -d)
+echo "Splitting file into 4MB chunks in $TMP_DIR..."
+split -b ${CHUNK_SIZE} "${FILE_PATH}" "${TMP_DIR}/chunk_"
+
+# 3. Upload chunks
+echo "Starting chunked upload..."
+CHUNK_COUNT=$(ls "${TMP_DIR}"/chunk_* | wc -l)
+CURRENT_CHUNK=0
+
+for chunk in "${TMP_DIR}"/chunk_*; do
+    CURRENT_CHUNK=$((CURRENT_CHUNK + 1))
+    CHUNK_SIZE_BYTES=$(stat -c%s "$chunk")
+
+    # Progress indicator
+    echo -ne "Uploading chunk $CURRENT_CHUNK of $CHUNK_COUNT ($CHUNK_SIZE_BYTES bytes)...\r"
+
+    # Generate new nonce/timestamp for each request
+    TIMESTAMP=$(date +%s)
+    NONCE=$(openssl rand -hex 16)
+
+    # Upload chunk
+    CHUNK_RESPONSE=$(curl -s -X PUT "${FULL_UPLOAD_URL}" \
+        -H "Content-Type: application/octet-stream" \
+        -H "Content-Length: ${CHUNK_SIZE_BYTES}" \
+        -H "Authorization: OAuth oauth_version=\"${OAUTH_VERSION}\", oauth_signature_method=\"${OAUTH_SIGNATURE_METHOD}\", oauth_consumer_key=\"${CONSUMER_KEY}\", oauth_token=\"${TOKEN_KEY}\", oauth_signature=\"${OAUTH_SIGNATURE}\", oauth_timestamp=\"${TIMESTAMP}\", oauth_nonce=\"${NONCE}\"" \
+        --data-binary @"${chunk}" \
+        -w "%{http_code}")
+
+    HTTP_CODE="${CHUNK_RESPONSE: -3}"
+
+    if [ "$HTTP_CODE" != "200" ] && [ "$HTTP_CODE" != "201" ]; then
+        echo ""
+        echo "✗ Chunk upload failed with status: $HTTP_CODE"
+        echo "Response: ${CHUNK_RESPONSE::-3}"
+        rm -r "${TMP_DIR}"
+        exit 1
+    fi
+
+    rm "$chunk"
+done
+
+echo ""
+echo "✓ Upload complete!"
+rm -r "${TMP_DIR}"
+exit 0

package/scripts/nat-iptables.sh

@@ -0,0 +1,111 @@
+#!/bin/bash
+set -euo pipefail
+
+echo "[INFO] Enabling firewalld..."
+sudo systemctl enable --now firewalld
+
+echo "[INFO] Configuring kernel networking..."
+
+sudo tee /etc/sysctl.d/99-kubernetes.conf >/dev/null <<'EOF'
+# Kubernetes networking
+net.ipv4.ip_forward = 1
+net.ipv6.conf.all.forwarding = 1
+
+# Required for Kubernetes iptables
+net.bridge.bridge-nf-call-iptables = 1
+net.bridge.bridge-nf-call-ip6tables = 1
+
+# Better conntrack handling
+net.netfilter.nf_conntrack_max = 131072
+EOF
+
+# Load br_netfilter immediately
+sudo modprobe br_netfilter
+
+# Apply sysctl
+sudo sysctl --system
+
+echo "[INFO] Opening common WAN/public services..."
+
+# Public services
+sudo firewall-cmd --permanent --zone=public --add-service=ssh
+sudo firewall-cmd --permanent --zone=public --add-service=http
+sudo firewall-cmd --permanent --zone=public --add-service=https
+
+echo "[INFO] Opening Kubernetes control plane ports..."
+
+# Kubernetes API Server
+sudo firewall-cmd --permanent --zone=public --add-port=6443/tcp
+
+# etcd
+sudo firewall-cmd --permanent --zone=public --add-port=2379-2380/tcp
+
+# kubelet API
+sudo firewall-cmd --permanent --zone=public --add-port=10250/tcp
+
+# kube-scheduler
+sudo firewall-cmd --permanent --zone=public --add-port=10259/tcp
+
+# kube-controller-manager
+sudo firewall-cmd --permanent --zone=public --add-port=10257/tcp
+
+echo "[INFO] Opening Kubernetes networking ports..."
+
+# CoreDNS
+sudo firewall-cmd --permanent --zone=public --add-port=53/tcp
+sudo firewall-cmd --permanent --zone=public --add-port=53/udp
+
+# NodePort Services
+sudo firewall-cmd --permanent --zone=public --add-port=30000-32767/tcp
+sudo firewall-cmd --permanent --zone=public --add-port=30000-32767/udp
+
+# Calico VXLAN
+sudo firewall-cmd --permanent --zone=public --add-port=4789/udp
+
+# Calico BGP
+sudo firewall-cmd --permanent --zone=public --add-port=179/tcp
+
+# Calico Typha (required for multi-node Calico deployments)
+sudo firewall-cmd --permanent --zone=public --add-port=5473/tcp
+
+# Calico WireGuard (optional encrypted overlay)
+sudo firewall-cmd --permanent --zone=public --add-port=51820/udp
+sudo firewall-cmd --permanent --zone=public --add-port=51821/udp
+
+# Flannel VXLAN (UDP, required if using Flannel CNI)
+sudo firewall-cmd --permanent --zone=public --add-port=8472/udp
+
+# kube-proxy healthz
+sudo firewall-cmd --permanent --zone=public --add-port=10256/tcp
+
+# metrics-server
+sudo firewall-cmd --permanent --zone=public --add-port=4443/tcp
+
+echo "[INFO] Configuring trusted zone for inter-node pod/service CIDRs..."
+# Allow all traffic from the default pod CIDR and service CIDR so that
+# cross-node pod-to-pod and service routing works without explicit per-port rules.
+sudo firewall-cmd --permanent --zone=trusted --add-source=192.168.0.0/16
+sudo firewall-cmd --permanent --zone=trusted --add-source=10.96.0.0/12
+
+echo "[INFO] Enabling masquerade and forwarding..."
+
+sudo firewall-cmd --permanent --zone=public --add-masquerade
+
+echo "[INFO] Reloading firewall..."
+
+sudo firewall-cmd --reload
+
+echo
+echo "[INFO] Sysctl status:"
+sudo sysctl \
+  net.ipv4.ip_forward \
+  net.ipv6.conf.all.forwarding \
+  net.bridge.bridge-nf-call-iptables \
+  net.bridge.bridge-nf-call-ip6tables
+
+echo
+echo "[INFO] Firewall status:"
+sudo firewall-cmd --zone=public --list-all
+
+echo
+echo "[INFO] Kubernetes firewall configuration completed."

package/scripts/nvim.sh

@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+sudo dnf install -y neovim
+
+
+sudo rm -rf ~/.config/nvim
+sudo rm -rf ~/.local/share/nvim
+
+mkdir -p ~/.config/nvim
+mkdir -p ~/.local/share/nvim/site/autoload
+
+# Install vim-plug for Neovim
+curl -fLo ~/.local/share/nvim/site/autoload/plug.vim --create-dirs \
+    https://cdn.jsdelivr.net/gh/junegunn/vim-plug@master/plug.vim
+
+# Create an init.vim with nvim-tree.lua + web-devicons + gruvbox (theme)
+cat > ~/.config/nvim/init.vim <<'EOF'
+" Minimal init.vim to use nvim-tree.lua + gruvbox theme via vim-plug
+
+" --- vim-plug manager
+call plug#begin('~/.local/share/nvim/plugged')
+
+" file explorer (nvim-tree)
+Plug 'nvim-tree/nvim-tree.lua'
+Plug 'nvim-tree/nvim-web-devicons'    " optional: file icons
+
+" colorscheme
+Plug 'morhetz/gruvbox'
+
+" sensible defaults, optional
+Plug 'tpope/vim-sensible'
+
+call plug#end()
+
+" --- UI settings
+syntax on
+filetype plugin indent on
+set number
+set relativenumber
+if has('termguicolors')
+  set termguicolors
+endif
+set background=dark
+
+" gruvbox options (optional)
+let g:gruvbox_contrast_dark = 'soft'
+colorscheme gruvbox
+
+" --- nvim-tree configuration (Lua block)
+lua << 'LUA'
+-- safe require
+local ok, tree = pcall(require, "nvim-tree")
+if not ok then
+  return
+end
+tree.setup{
+  view = {
+    width = 30,
+    side = "left",
+    preserve_window_proportions = true,
+  },
+  renderer = {
+    indent_markers = { enable = true },
+  },
+  actions = {
+    open_file = {
+      quit_on_open = false,
+    }
+  }
+}
+LUA
+
+" --- mappings: Ctrl-n toggles nvim-tree
+nnoremap <C-n> :NvimTreeToggle<CR>
+
+" Open nvim-tree on startup when opening nvim with no file args
+autocmd StdinReadPre * let s:std_in=1
+autocmd VimEnter * if argc() == 0 && !exists('s:std_in') | NvimTreeToggle | wincmd p | endif
+EOF
+
+# Fix permissions in case something was left owned by root (happens if you used sudo on these paths before)
+sudo chown -R "$USER":"$USER" ~/.config/nvim ~/.local/share/nvim 2>/dev/null
+
+# Install plugins automatically (non-interactive)
+nvim +PlugInstall +qall
+
+echo
+echo "Done. Plugins installed."
+echo "Run 'nvim' and press Ctrl-n to toggle the file tree."
+echo "If colorscheme is not correct, ensure your terminal supports truecolor and TERM is xterm-256color."

package/scripts/packer-init-vars-file.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# Script to Initialize VARS files for Packer builds
+# Usage: sudo ./scripts/packer-setup.sh
+
+set -euo pipefail
+
+# Packer needs writable VARS files for UEFI boot
+PACKER_DIR="$(dirname "$0")/../packer/images"
+
+# Find all packer image directories and create VARS files
+for image_dir in "$PACKER_DIR"/*; do
+    if [ -d "$image_dir" ]; then
+        image_name=$(basename "$image_dir")
+        echo "Checking UEFI VARS files for $image_name..."
+
+        # Create x86_64 VARS file if it doesn't exist
+        if [ ! -f "$image_dir/x86_64_VARS.fd" ]; then
+            for src in /usr/share/edk2/ovmf/OVMF_VARS.fd /usr/share/OVMF/OVMF_VARS.fd; do
+                if [ -f "$src" ]; then
+                    cp "$src" "$image_dir/x86_64_VARS.fd"
+                    echo "Created $image_dir/x86_64_VARS.fd from $src"
+                    break
+                fi
+            done
+        fi
+
+        # Create aarch64 VARS file if it doesn't exist
+        if [ ! -f "$image_dir/aarch64_VARS.fd" ]; then
+            for src in /usr/share/AAVMF/AAVMF_VARS.fd /usr/share/edk2/aarch64/AAVMF_VARS.fd /usr/share/edk2/aarch64/QEMU_VARS.fd; do
+                if [ -f "$src" ]; then
+                    cp "$src" "$image_dir/aarch64_VARS.fd"
+                    echo "Created $image_dir/aarch64_VARS.fd from $src"
+                    break
+                fi
+            done
+        fi
+    fi
+done
+
+echo "Packer and QEMU setup complete!"