@ydkn/pulumi-components 0.4.0

package/lib/fcos/assets/rpm-ostree-install.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=Layer packages with rpm-ostree
+Wants=network-online.target
+After=network-online.target
+Before=zincati.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/local/sbin/rpm-opstree-install
+
+[Install]
+WantedBy=multi-user.target

package/lib/fcos/config.d.ts

@@ -0,0 +1,156 @@
+import * as pulumi from "@pulumi/pulumi";
+import { ComponentResource } from "../common";
+export interface UserArgs {
+    /**
+     * Username
+     */
+    name: pulumi.Input<string>;
+    /**
+     * Optional: Groups
+     */
+    groups?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Optional: SSH authorized keys
+     */
+    sshAuthorizedKeys?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Optional: Password hash
+     */
+    passwordHash?: pulumi.Input<string>;
+}
+export interface PartitionArgs {
+    /**
+     * Label
+     */
+    label: pulumi.Input<string>;
+    /**
+     * Size in MiB
+     */
+    size: pulumi.Input<number>;
+    /**
+     * Optional: Start in MiB
+     */
+    start?: pulumi.Input<number>;
+    /**
+     * Optional: Partition number
+     */
+    number?: pulumi.Input<number>;
+    /**
+     * Optional: Resize partition
+     */
+    resize?: pulumi.Input<boolean>;
+}
+export interface DiskArgs {
+    /**
+     * Device
+     */
+    device: pulumi.Input<string>;
+    /**
+     * Partitions
+     */
+    partitions: pulumi.Input<pulumi.Input<PartitionArgs>[]>;
+    /**
+     * Optional: Wipe table
+     */
+    wipeTable?: pulumi.Input<boolean>;
+}
+export interface FilesystemArgs {
+    /**
+     * Device
+     */
+    device: pulumi.Input<string>;
+    /**
+     * Path
+     */
+    path: pulumi.Input<string>;
+    /**
+     * Filesystem type
+     */
+    format: pulumi.Input<string>;
+    /**
+     * Optional: Label
+     */
+    label?: pulumi.Input<string>;
+}
+export interface FilesArgs {
+    /**
+     * Path
+     */
+    path: pulumi.Input<string>;
+    /**
+     * Contents
+     */
+    contents: pulumi.Input<string>;
+    /**
+     * Optional: Mode
+     */
+    mode?: pulumi.Input<number>;
+}
+export interface SystemdUnitArgs {
+    /**
+     * Name
+     */
+    name: pulumi.Input<string>;
+    /**
+     * Optional: Enabled
+     */
+    enabled?: pulumi.Input<boolean>;
+    /**
+     * Optional: Masked
+     */
+    mask?: pulumi.Input<boolean>;
+    /**
+     * Optional: Contents
+     */
+    contents?: pulumi.Input<string>;
+}
+export interface IgnitionArgs {
+    /**
+     * Optional: Modules
+     */
+    modules?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Optional: Packages
+     */
+    packages?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Optional: Users
+     */
+    users?: pulumi.Input<pulumi.Input<UserArgs>[]>;
+    /**
+     * Optional: Disks
+     */
+    disks?: pulumi.Input<pulumi.Input<DiskArgs>[]>;
+    /**
+     * Optional: Filesystems
+     */
+    filesystems?: pulumi.Input<pulumi.Input<FilesystemArgs>[]>;
+    /**
+     * Optional: Files
+     */
+    files?: pulumi.Input<pulumi.Input<FilesArgs>[]>;
+    /**
+     * Optional: Systemd units
+     */
+    systemdUnits?: pulumi.Input<pulumi.Input<SystemdUnitArgs>[]>;
+}
+export interface ConfigArgs extends IgnitionArgs {
+    /**
+     * Hostname
+     */
+    hostname: pulumi.Input<string>;
+}
+export declare class Config extends ComponentResource {
+    readonly ignitionConfig: pulumi.Output<string>;
+    /**
+     * Create a new FCOS config resource.
+     * @param name The name of the FCOS config resource.
+     * @param args A bag of arguments to control the FCOS config creation.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: ConfigArgs, opts?: pulumi.ComponentResourceOptions);
+    private defaultConfig;
+    private assetContent;
+    private storageContents;
+}
+//# sourceMappingURL=config.d.ts.map

package/lib/fcos/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../lib/fcos/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAIzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9C;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzD;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IACxD;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,YAAY;IAC3B;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/C;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAChD;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC/C;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC/C;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IAC3D;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChD;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,UAAW,SAAQ,YAAY;IAC9C;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;CAChC;AAED,qBAAa,MAAO,SAAQ,iBAAiB;IAC3C,SAAgB,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEtD;;;;;OAKG;gBACS,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,wBAAwB;IAsGlF,OAAO,CAAC,aAAa;IAqDrB,OAAO,CAAC,YAAY;IAKpB,OAAO,CAAC,eAAe;CAMxB"}

package/lib/fcos/config.js

@@ -0,0 +1,168 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Config = void 0;
+const pulumi = require("@pulumi/pulumi");
+const path = require("path");
+const fs = require("fs");
+const compress = require("zlib");
+const common_1 = require("../common");
+class Config extends common_1.ComponentResource {
+    ignitionConfig;
+    /**
+     * Create a new FCOS config resource.
+     * @param name The name of the FCOS config resource.
+     * @param args A bag of arguments to control the FCOS config creation.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name, args, opts) {
+        super("fcos:config", name, args, opts);
+        this.ignitionConfig = pulumi
+            .all([
+            this.defaultConfig(),
+            args.hostname,
+            args.modules,
+            args.packages,
+            args.users,
+            args.disks,
+            args.filesystems,
+            args.files,
+            args.systemdUnits,
+        ])
+            .apply(([config, hostname, modules, packages, users, disks, filesystems, files, systemdUnits]) => {
+            if (hostname !== undefined) {
+                config.storage.files.push({
+                    path: "/etc/hostname",
+                    contents: this.storageContents(hostname),
+                    mode: 0o644,
+                });
+            }
+            for (const module of modules || []) {
+                config.storage.files.push({
+                    path: `/etc/modules-load.d/${module}.conf`,
+                    contents: this.storageContents(module),
+                    mode: 0o644,
+                });
+            }
+            for (const pkg of packages || []) {
+                config.storage.files.push({ path: `/etc/rpm-opstree-install/${pkg}` });
+            }
+            for (const user of users || []) {
+                config.passwd.users.push(user);
+            }
+            for (const disk of disks || []) {
+                config.storage.disks.push({
+                    device: disk.device,
+                    partitions: disk.partitions.map((partition) => {
+                        return {
+                            label: partition.label,
+                            size_mib: partition.size,
+                            start_mib: partition.start,
+                            number: partition.number,
+                            resize: partition.resize,
+                        };
+                    }),
+                    wipe_table: disk.wipeTable,
+                });
+            }
+            for (const filesystem of filesystems || []) {
+                config.storage.filesystems.push({
+                    device: filesystem.device,
+                    path: filesystem.path,
+                    format: filesystem.format,
+                    label: filesystem.label,
+                });
+                const checkSystemdName = filesystem.device.replace(/-/g, "\\x2d").replace(/^\//, "").replace(/\//g, "-");
+                config.systemd.units.push({
+                    name: `${filesystem.path.replace(/^\//, "").replace(/\//g, "-")}.mount`,
+                    enabled: true,
+                    contents: [
+                        "[Unit]",
+                        "Before=local-fs.target",
+                        `Requires=systemd-fsck@${checkSystemdName}.service`,
+                        `After=systemd-fsck@${checkSystemdName}.service`,
+                        "[Mount]",
+                        `Where=${filesystem.path}`,
+                        `What=${filesystem.device}`,
+                        `Type=${filesystem.format}`,
+                        "[Install]",
+                        "RequiredBy=local-fs.target",
+                    ].join("\n"),
+                });
+            }
+            for (const file of files || []) {
+                config.storage.files.push({
+                    path: file.path,
+                    contents: this.storageContents(file.contents),
+                    mode: file.mode ?? 0o644,
+                });
+            }
+            for (const unit of systemdUnits || []) {
+                config.systemd.units.push(unit);
+            }
+            return JSON.stringify(config);
+        });
+        this.registerOutputs();
+    }
+    defaultConfig() {
+        return {
+            ignition: { version: "3.3.0" },
+            passwd: {
+                users: [],
+            },
+            storage: {
+                disks: [],
+                filesystems: [],
+                directories: [{ path: "/etc/rpm-opstree-install" }],
+                files: [
+                    {
+                        path: "/etc/sysctl.d/20-silence-audit.conf",
+                        contents: this.storageContents("kernel.printk=4"),
+                        mode: 0o644,
+                    },
+                    {
+                        overwrite: true,
+                        path: "/etc/sysctl.d/10-fs-inotify.conf",
+                        contents: this.storageContents("fs.inotify.max_user_instances = 8192\nfs.inotify.max_user_watches = 524288"),
+                    },
+                    {
+                        overwrite: true,
+                        path: "/etc/sysctl.d/90-ipv4-ip-forward.conf",
+                        contents: this.storageContents("net.ipv4.ip_forward = 1"),
+                    },
+                    {
+                        overwrite: true,
+                        path: "/etc/sysctl.d/90-ipv6-ip-forwarding.conf",
+                        contents: this.storageContents("net.ipv6.conf.all.forwarding = 1"),
+                    },
+                    { overwrite: false, path: "/etc/systemd/resolved.conf", append: [this.storageContents("LLMNR=no")] },
+                    {
+                        path: "/usr/local/sbin/rpm-opstree-install",
+                        contents: this.storageContents(this.assetContent("rpm-opstree-install.sh")),
+                        mode: 0o755,
+                    },
+                ],
+            },
+            systemd: {
+                units: [
+                    {
+                        name: "rpm-ostree-install.service",
+                        enabled: true,
+                        contents: this.assetContent("rpm-ostree-install.service"),
+                    },
+                ],
+            },
+        };
+    }
+    assetContent(filename) {
+        // eslint-disable-next-line security/detect-non-literal-fs-filename
+        return fs.readFileSync(path.join(__dirname, "assets", filename), "utf-8");
+    }
+    storageContents(data) {
+        return {
+            compression: "gzip",
+            source: `data:;base64,${compress.gzipSync(Buffer.from(data), { level: 9 }).toString("base64")}`,
+        };
+    }
+}
+exports.Config = Config;
+//# sourceMappingURL=config.js.map

package/lib/fcos/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../lib/fcos/config.ts"],"names":[],"mappings":";;;AAAA,yCAAyC;AACzC,6BAA6B;AAC7B,yBAAyB;AACzB,iCAAiC;AACjC,sCAA8C;AAsJ9C,MAAa,MAAO,SAAQ,0BAAiB;IAC3B,cAAc,CAAwB;IAEtD;;;;;OAKG;IACH,YAAY,IAAY,EAAE,IAAgB,EAAE,IAAsC;QAChF,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAEvC,IAAI,CAAC,cAAc,GAAG,MAAM;aACzB,GAAG,CAAC;YACH,IAAI,CAAC,aAAa,EAAE;YACpB,IAAI,CAAC,QAAQ;YACb,IAAI,CAAC,OAAO;YACZ,IAAI,CAAC,QAAQ;YACb,IAAI,CAAC,KAAK;YACV,IAAI,CAAC,KAAK;YACV,IAAI,CAAC,WAAW;YAChB,IAAI,CAAC,KAAK;YACV,IAAI,CAAC,YAAY;SAClB,CAAC;aACD,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,EAAE;YAC/F,IAAI,QAAQ,KAAK,SAAS,EAAE;gBAC1B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;oBACxB,IAAI,EAAE,eAAe;oBACrB,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC;oBACxC,IAAI,EAAE,KAAK;iBACZ,CAAC,CAAC;aACJ;YAED,KAAK,MAAM,MAAM,IAAI,OAAO,IAAI,EAAE,EAAE;gBAClC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;oBACxB,IAAI,EAAE,uBAAuB,MAAM,OAAO;oBAC1C,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;oBACtC,IAAI,EAAE,KAAK;iBACZ,CAAC,CAAC;aACJ;YAED,KAAK,MAAM,GAAG,IAAI,QAAQ,IAAI,EAAE,EAAE;gBAChC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,4BAA4B,GAAG,EAAE,EAAE,CAAC,CAAC;aACxE;YAED,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,EAAE,EAAE;gBAC9B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aAChC;YAED,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,EAAE,EAAE;gBAC9B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;oBACxB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAwB,EAAE,EAAE;wBAC3D,OAAO;4BACL,KAAK,EAAE,SAAS,CAAC,KAAK;4BACtB,QAAQ,EAAE,SAAS,CAAC,IAAI;4BACxB,SAAS,EAAE,SAAS,CAAC,KAAK;4BAC1B,MAAM,EAAE,SAAS,CAAC,MAAM;4BACxB,MAAM,EAAE,SAAS,CAAC,MAAM;yBACzB,CAAC;oBACJ,CAAC,CAAC;oBACF,UAAU,EAAE,IAAI,CAAC,SAAS;iBAC3B,CAAC,CAAC;aACJ;YAED,KAAK,MAAM,UAAU,IAAI,WAAW,IAAI,EAAE,EAAE;gBAC1C,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;oBAC9B,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,KAAK,EAAE,UAAU,CAAC,KAAK;iBACxB,CAAC,CAAC;gBAEH,MAAM,gBAAgB,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAEzG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;oBACxB,IAAI,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ;oBACvE,OAAO,EAAE,IAAI;oBACb,QAAQ,EAAE;wBACR,QAAQ;wBACR,wBAAwB;wBACxB,yBAAyB,gBAAgB,UAAU;wBACnD,sBAAsB,gBAAgB,UAAU;wBAChD,SAAS;wBACT,SAAS,UAAU,CAAC,IAAI,EAAE;wBAC1B,QAAQ,UAAU,CAAC,MAAM,EAAE;wBAC3B,QAAQ,UAAU,CAAC,MAAM,EAAE;wBAC3B,WAAW;wBACX,4BAA4B;qBAC7B,CAAC,IAAI,CAAC,IAAI,CAAC;iBACb,CAAC,CAAC;aACJ;YAED,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,EAAE,EAAE;gBAC9B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;oBACxB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAC7C,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK;iBACzB,CAAC,CAAC;aACJ;YAED,KAAK,MAAM,IAAI,IAAI,YAAY,IAAI,EAAE,EAAE;gBACrC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aACjC;YAED,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEL,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAEO,aAAa;QACnB,OAAO;YACL,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE;YAC9B,MAAM,EAAE;gBACN,KAAK,EAAE,EAAE;aACV;YACD,OAAO,EAAE;gBACP,KAAK,EAAE,EAAE;gBACT,WAAW,EAAE,EAAE;gBACf,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;gBACnD,KAAK,EAAE;oBACL;wBACE,IAAI,EAAE,qCAAqC;wBAC3C,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC;wBACjD,IAAI,EAAE,KAAK;qBACZ;oBACD;wBACE,SAAS,EAAE,IAAI;wBACf,IAAI,EAAE,kCAAkC;wBACxC,QAAQ,EAAE,IAAI,CAAC,eAAe,CAC5B,4EAA4E,CAC7E;qBACF;oBACD;wBACE,SAAS,EAAE,IAAI;wBACf,IAAI,EAAE,uCAAuC;wBAC7C,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,yBAAyB,CAAC;qBAC1D;oBACD;wBACE,SAAS,EAAE,IAAI;wBACf,IAAI,EAAE,0CAA0C;wBAChD,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,kCAAkC,CAAC;qBACnE;oBACD,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,EAAE;oBACpG;wBACE,IAAI,EAAE,qCAAqC;wBAC3C,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,CAAC;wBAC3E,IAAI,EAAE,KAAK;qBACZ;iBACF;aACF;YACD,OAAO,EAAE;gBACP,KAAK,EAAE;oBACL;wBACE,IAAI,EAAE,4BAA4B;wBAClC,OAAO,EAAE,IAAI;wBACb,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,4BAA4B,CAAC;qBAC1D;iBACF;aACF;SACF,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,QAAgB;QACnC,mEAAmE;QACnE,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;IAC5E,CAAC;IAEO,eAAe,CAAC,IAAY;QAClC,OAAO;YACL,WAAW,EAAE,MAAM;YACnB,MAAM,EAAE,gBAAgB,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;SAChG,CAAC;IACJ,CAAC;CACF;AA/KD,wBA+KC"}

package/lib/fcos/host.d.ts

@@ -0,0 +1,34 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as tls from "@pulumi/tls";
+import { ComponentResource } from "../common";
+import { ConfigArgs } from "./config";
+export interface HostUserArgs {
+    /**
+     * Username
+     */
+    name: pulumi.Input<string>;
+    /**
+     * Optional: Groups
+     */
+    groups?: pulumi.Input<pulumi.Input<string>[]>;
+}
+export interface HostArgs extends ConfigArgs {
+    /**
+     * Optional: Users with SSH access
+     */
+    sshUsers?: pulumi.Input<pulumi.Input<HostUserArgs>[]>;
+}
+export declare class Host extends ComponentResource {
+    readonly sshPrivateKeys: pulumi.Output<{
+        [key: string]: tls.PrivateKey;
+    }>;
+    readonly ignitionConfig: pulumi.Output<string>;
+    /**
+     * Create a new FCOS host resource.
+     * @param name The name of the FCOS host resource.
+     * @param args A bag of arguments to control the FCOS host creation.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: HostArgs, opts?: pulumi.ComponentResourceOptions);
+}
+//# sourceMappingURL=host.d.ts.map

package/lib/fcos/host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../../lib/fcos/host.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAY,UAAU,EAAU,MAAM,UAAU,CAAC;AAExD,MAAM,WAAW,YAAY;IAC3B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,QAAS,SAAQ,UAAU;IAC1C;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;CACvD;AAED,qBAAa,IAAK,SAAQ,iBAAiB;IACzC,SAAgB,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,UAAU,CAAA;KAAE,CAAC,CAAC;IACjF,SAAgB,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEtD;;;;;OAKG;gBACS,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,wBAAwB;CAyDjF"}

package/lib/fcos/host.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Host = void 0;
+const pulumi = require("@pulumi/pulumi");
+const tls = require("@pulumi/tls");
+const common_1 = require("../common");
+const config_1 = require("./config");
+class Host extends common_1.ComponentResource {
+    sshPrivateKeys;
+    ignitionConfig;
+    /**
+     * Create a new FCOS host resource.
+     * @param name The name of the FCOS host resource.
+     * @param args A bag of arguments to control the FCOS host creation.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name, args, opts) {
+        super("fcos:host", name, args, opts);
+        const emptyOpts = this.opts();
+        this.sshPrivateKeys = pulumi.all([args.sshUsers]).apply(([sshUsers]) => {
+            const sshPrivateKeys = {};
+            for (const sshUser of sshUsers || []) {
+                sshPrivateKeys[sshUser.name] = new tls.PrivateKey(`${name}-${sshUser.name}`, { algorithm: "ED25519" }, emptyOpts);
+            }
+            return sshPrivateKeys;
+        });
+        this.ignitionConfig = new config_1.Config(name, {
+            ...args,
+            modules: pulumi.all([args.modules]).apply(([modules]) => (modules || []).concat("wireguard")),
+            packages: pulumi
+                .all([args.packages])
+                .apply(([packages]) => (packages || []).concat("netcat", "tcpdump", "iperf3", "htop", "golang-gvisor")),
+            users: pulumi
+                .all([args.users, args.sshUsers, this.sshPrivateKeys])
+                .apply(([users, sshUsers, sshPrivateKeys]) => {
+                const allUsers = [];
+                for (const user of users || []) {
+                    allUsers.push(user);
+                }
+                for (const sshUser of sshUsers || []) {
+                    allUsers.push({
+                        name: sshUser.name,
+                        groups: sshUser.groups,
+                        sshAuthorizedKeys: sshPrivateKeys[sshUser.name].publicKeyOpenssh.apply((key) => [key.trim()]),
+                    });
+                }
+                return allUsers;
+            }),
+            systemdUnits: pulumi
+                .all([args.systemdUnits])
+                .apply(([systemdUnits]) => (systemdUnits || []).concat({ mask: true, name: "docker.service" }, { mask: true, name: "docker.socket" })),
+        }, emptyOpts).ignitionConfig;
+        this.registerOutputs();
+    }
+}
+exports.Host = Host;
+//# sourceMappingURL=host.js.map

package/lib/fcos/host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.js","sourceRoot":"","sources":["../../../lib/fcos/host.ts"],"names":[],"mappings":";;;AAAA,yCAAyC;AACzC,mCAAmC;AACnC,sCAA8C;AAC9C,qCAAwD;AAoBxD,MAAa,IAAK,SAAQ,0BAAiB;IACzB,cAAc,CAAmD;IACjE,cAAc,CAAwB;IAEtD;;;;;OAKG;IACH,YAAY,IAAY,EAAE,IAAc,EAAE,IAAsC;QAC9E,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAErC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE9B,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE;YACrE,MAAM,cAAc,GAAsC,EAAE,CAAC;YAE7D,KAAK,MAAM,OAAO,IAAI,QAAQ,IAAI,EAAE,EAAE;gBACpC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAC/C,GAAG,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,EACzB,EAAE,SAAS,EAAE,SAAS,EAAE,EACxB,SAAS,CACV,CAAC;aACH;YAED,OAAO,cAAc,CAAC;QACxB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,cAAc,GAAG,IAAI,eAAM,CAC9B,IAAI,EACJ;YACE,GAAG,IAAI;YACP,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC7F,QAAQ,EAAE,MAAM;iBACb,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;iBACpB,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;YACzG,KAAK,EAAE,MAAM;iBACV,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;iBACrD,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,cAAc,CAAC,EAAE,EAAE;gBAC3C,MAAM,QAAQ,GAA6B,EAAE,CAAC;gBAE9C,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,EAAE,EAAE;oBAC9B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;iBACrB;gBAED,KAAK,MAAM,OAAO,IAAI,QAAQ,IAAI,EAAE,EAAE;oBACpC,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,iBAAiB,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;qBAC9F,CAAC,CAAC;iBACJ;gBAED,OAAO,QAAQ,CAAC;YAClB,CAAC,CAAC;YACJ,YAAY,EAAE,MAAM;iBACjB,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;iBACxB,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,CACxB,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAC3G;SACJ,EACD,SAAS,CACV,CAAC,cAAc,CAAC;QAEjB,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;CACF;AAnED,oBAmEC"}

package/lib/fcos/index.d.ts

@@ -0,0 +1,4 @@
+import { PartitionArgs, DiskArgs, FilesystemArgs, UserArgs, FilesArgs, SystemdUnitArgs, IgnitionArgs, ConfigArgs, Config } from "./config";
+import { HostUserArgs, HostArgs, Host } from "./host";
+export { PartitionArgs, DiskArgs, FilesystemArgs, UserArgs, FilesArgs, SystemdUnitArgs, IgnitionArgs, ConfigArgs, Config, HostUserArgs, HostArgs, Host, };
+//# sourceMappingURL=index.d.ts.map

package/lib/fcos/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/fcos/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,QAAQ,EACR,cAAc,EACd,QAAQ,EACR,SAAS,EACT,eAAe,EACf,YAAY,EACZ,UAAU,EACV,MAAM,EACP,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAEtD,OAAO,EACL,aAAa,EACb,QAAQ,EACR,cAAc,EACd,QAAQ,EACR,SAAS,EACT,eAAe,EACf,YAAY,EACZ,UAAU,EACV,MAAM,EACN,YAAY,EACZ,QAAQ,EACR,IAAI,GACL,CAAC"}

package/lib/fcos/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Host = exports.Config = void 0;
+const config_1 = require("./config");
+Object.defineProperty(exports, "Config", { enumerable: true, get: function () { return config_1.Config; } });
+const host_1 = require("./host");
+Object.defineProperty(exports, "Host", { enumerable: true, get: function () { return host_1.Host; } });
+//# sourceMappingURL=index.js.map

package/lib/fcos/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../lib/fcos/index.ts"],"names":[],"mappings":";;;AAAA,qCAUkB;AAYhB,uFAbA,eAAM,OAaA;AAXR,iCAAsD;AAcpD,qFAd+B,WAAI,OAc/B"}

package/lib/freeradius/assets/clients.conf.tmpl

@@ -0,0 +1,23 @@
+client localhost {
+  ipaddr = 127.0.0.1
+  proto = *
+  secret = {{ localSecret }}
+  require_message_authenticator = no
+  nas_type = other
+
+  limit {
+    max_connections = 32
+    lifetime = 0
+    idle_timeout = 30
+  }
+}
+
+client localhost_ipv6 {
+  ipv6addr = ::1
+  secret = {{ localSecret }}
+}
+
+client user_defined_client {
+  ipaddr = 0.0.0.0/0
+  secret = {{ clientSecret }}
+}

package/lib/freeradius/assets/default.tmpl

@@ -0,0 +1,116 @@
+server default {
+  listen {
+    type = auth
+    ipaddr = *
+    port = 0
+
+    limit {
+      max_connections = 32
+      lifetime = 0
+      idle_timeout = 30
+    }
+  }
+
+  listen {
+    type = acct
+    ipaddr = *
+    port = 0
+
+    limit {
+    }
+  }
+
+  authorize {
+    filter_username
+    preprocess
+    digest
+    suffix
+
+    eap {
+      ok = return
+    }
+
+    files
+    -sql
+    ldap
+    expiration
+    logintime
+    pap
+
+    if (User-Password) {
+      update control {
+        Auth-Type := ldap
+      }
+    }
+  }
+
+  authenticate {
+    Auth-Type PAP {
+      ldap
+    }
+
+    Auth-Type CHAP {
+      chap
+    }
+
+    Auth-Type MS-CHAP {
+      mschap
+    }
+
+    mschap
+    digest
+    ldap
+    eap
+  }
+
+  preacct {
+    preprocess
+    acct_unique
+    suffix
+    files
+  }
+
+  accounting {
+    detail
+    unix
+    -sql
+    exec
+    attr_filter.accounting_response
+  }
+
+  session {
+  }
+
+  post-auth {
+    if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) {
+      update reply {
+        &User-Name !* ANY
+      }
+    }
+
+    update {
+      &reply: += &session-state:
+    }
+
+    -sql
+    exec
+    remove_reply_message_if_eap
+
+    Post-Auth-Type REJECT {
+      -sql
+      attr_filter.access_reject
+      eap
+      remove_reply_message_if_eap
+    }
+
+    Post-Auth-Type Challenge {
+    }
+  }
+
+  pre-proxy {
+  }
+
+  post-proxy {
+    eap
+  }
+}