mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-01-18 00:48:10 +01:00
test(packer): add initial packer file to create archlinux & ubuntu tests image.
This commit is contained in:
Alexandre Pujol
parent
af2c6d0716
commit
bbb43cdf55
5 changed files with 425 additions and 0 deletions
73
tests/packer/archlinux.pkr.hcl
Normal file
73
tests/packer/archlinux.pkr.hcl
Normal file
|
|
@ -0,0 +1,73 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
source "qemu" "archlinux-gnome" {
|
||||
disk_image = true
|
||||
iso_url = "https://geo.mirror.pkgbuild.com/images/latest/Arch-Linux-x86_64-cloudimg.qcow2"
|
||||
iso_checksum = "file:https://geo.mirror.pkgbuild.com/images/latest/Arch-Linux-x86_64-cloudimg.qcow2.SHA256"
|
||||
iso_target_path = "${var.iso_dir}/archlinux-cloudimg-amd64.img"
|
||||
cpus = 6
|
||||
memory = 4096
|
||||
disk_size = "${var.disk_size}"
|
||||
accelerator = "kvm"
|
||||
headless = true
|
||||
ssh_username = "${var.username}"
|
||||
ssh_password = "${var.password}"
|
||||
ssh_port = 22
|
||||
ssh_wait_timeout = "1000s"
|
||||
disk_compression = true
|
||||
disk_detect_zeroes = "unmap"
|
||||
disk_discard = "unmap"
|
||||
output_directory = "${var.output}"
|
||||
vm_name = "${var.prefix}-${source.name}.qcow2"
|
||||
boot_wait = "10s"
|
||||
shutdown_command = "echo ${var.password} | sudo shutdown -hP now"
|
||||
cd_label = "cidata"
|
||||
cd_content = {
|
||||
"meta-data" = ""
|
||||
"user-data" = templatefile("${path.cwd}/packer/init/${source.name}.user-data.yml",
|
||||
{
|
||||
username = "${var.username}"
|
||||
password = "${var.password}"
|
||||
ssh_key = file("${var.ssh_publickey}")
|
||||
hostname = "${var.prefix}-${source.name}"
|
||||
}
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
source "qemu" "archlinux-kde" {
|
||||
disk_image = true
|
||||
iso_url = "https://geo.mirror.pkgbuild.com/images/latest/Arch-Linux-x86_64-cloudimg.qcow2"
|
||||
iso_checksum = "file:https://geo.mirror.pkgbuild.com/images/latest/Arch-Linux-x86_64-cloudimg.qcow2.SHA256"
|
||||
iso_target_path = "${var.iso_dir}/archlinux-cloudimg-amd64.img"
|
||||
cpus = 6
|
||||
memory = 4096
|
||||
disk_size = "${var.disk_size}"
|
||||
accelerator = "kvm"
|
||||
headless = true
|
||||
ssh_username = "${var.username}"
|
||||
ssh_password = "${var.password}"
|
||||
ssh_port = 22
|
||||
ssh_wait_timeout = "1000s"
|
||||
disk_compression = true
|
||||
disk_detect_zeroes = "unmap"
|
||||
disk_discard = "unmap"
|
||||
output_directory = "${var.output}"
|
||||
vm_name = "${var.prefix}-${source.name}.qcow2"
|
||||
boot_wait = "10s"
|
||||
shutdown_command = "echo ${var.password} | sudo shutdown -hP now"
|
||||
cd_label = "cidata"
|
||||
cd_content = {
|
||||
"meta-data" = ""
|
||||
"user-data" = templatefile("${path.cwd}/packer/init/${source.name}.user-data.yml",
|
||||
{
|
||||
username = "${var.username}"
|
||||
password = "${var.password}"
|
||||
ssh_key = file("${var.ssh_publickey}")
|
||||
hostname = "${var.prefix}-${source.name}"
|
||||
}
|
||||
)
|
||||
}
|
||||
}
|
||||
184
tests/packer/init/clean.sh
Executable file
184
tests/packer/init/clean.sh
Executable file
|
|
@ -0,0 +1,184 @@
|
|||
#!/usr/bin/env bash
|
||||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
set -u
|
||||
|
||||
# shellcheck source=/dev/null
|
||||
_lsb_release() { . /etc/os-release || exit 1; echo "$ID"; }
|
||||
DISTRIBUTION="$(_lsb_release)"
|
||||
readonly SELF="$0"
|
||||
readonly DISTRIBUTION
|
||||
|
||||
export HISTSIZE=0
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
|
||||
readonly green='\e[0;32m' Bold='\e[1m'
|
||||
_msg() { printf '%b- %s%b\n' "$Bold" "$*" "$green" >&2; }
|
||||
_disksize() { df --total --block-size=1 --output=size | tail -1; }
|
||||
_diskused() { df --total --block-size=1 --output=used | tail -1; }
|
||||
|
||||
_sshdgenkeys() {
|
||||
cat <<-_EOF >/usr/lib/systemd/system/sshdgenkeys.service
|
||||
[Unit]
|
||||
Description=SSH Key Generation
|
||||
ConditionPathExists=|!/etc/ssh/ssh_host_ecdsa_key
|
||||
ConditionPathExists=|!/etc/ssh/ssh_host_ecdsa_key.pub
|
||||
ConditionPathExists=|!/etc/ssh/ssh_host_ed25519_key
|
||||
ConditionPathExists=|!/etc/ssh/ssh_host_ed25519_key.pub
|
||||
ConditionPathExists=|!/etc/ssh/ssh_host_rsa_key
|
||||
ConditionPathExists=|!/etc/ssh/ssh_host_rsa_key.pub
|
||||
|
||||
[Service]
|
||||
ExecStart=/usr/bin/ssh-keygen -A
|
||||
Type=oneshot
|
||||
RemainAfterExit=yes
|
||||
_EOF
|
||||
mkdir -p /usr/lib/systemd/system/ssh.service.d
|
||||
cat <<-_EOF >/usr/lib/systemd/system/ssh.service.d/sshdgenkeys.conf
|
||||
[Unit]
|
||||
Wants=sshdgenkeys.service
|
||||
After=sshdgenkeys.service
|
||||
_EOF
|
||||
}
|
||||
|
||||
clean_debian() {
|
||||
_msg "Apt clean configuration"
|
||||
|
||||
_msg "Full system upgrade"
|
||||
apt-get update -y
|
||||
apt-get -qq -y --no-install-recommends upgrade
|
||||
apt-get -qq -y --no-install-recommends dist-upgrade
|
||||
|
||||
_msg "Clean the apt cache"
|
||||
apt-get -y autoremove --purge
|
||||
apt-get -y autoclean
|
||||
apt-get -y clean
|
||||
}
|
||||
|
||||
clean_arch() {
|
||||
_msg "Pacman clean configuration"
|
||||
|
||||
pacman -Syu --noconfirm
|
||||
pacman -Rsccn --noconfirm "$(pacman -Qdtq)"
|
||||
pacman -Scc --noconfirm
|
||||
}
|
||||
|
||||
clean_opensuse() {
|
||||
_msg "zypper clean configuration"
|
||||
|
||||
zypper update -y
|
||||
zypper clean -y
|
||||
}
|
||||
|
||||
# Make the image as impersonal as possible.
|
||||
impersonalize() {
|
||||
_msg "Make the image as impersonal as possible."
|
||||
|
||||
# Remove remaining pkg file, docs and caches
|
||||
dirs=(
|
||||
/usr/share/doc
|
||||
/usr/share/man
|
||||
/var/cache/
|
||||
/var/lib/apt
|
||||
/var/lib/dhcp
|
||||
/var/tmp
|
||||
)
|
||||
for dir in "${dirs[@]}"; do
|
||||
if [[ -d "$dir" ]]; then
|
||||
find "$dir" -mindepth 1 -delete
|
||||
fi
|
||||
done
|
||||
|
||||
# Truncate any logs that have built up during the install
|
||||
find /var/log -type f -exec truncate --size=0 {} \;
|
||||
|
||||
# Truncate the machine-id
|
||||
truncate --size=0 /etc/machine-id
|
||||
truncate --size=0 /var/lib/dbus/machine-id
|
||||
|
||||
remove=(
|
||||
# Remove remaining pkg file, docs and caches
|
||||
/usr/share/info/
|
||||
/usr/share/lintian/
|
||||
/usr/share/linda/
|
||||
|
||||
# Remove history & unique ids
|
||||
/etc/adjtime
|
||||
/etc/ansible/
|
||||
/etc/ssh/ssh_host_*_key*
|
||||
/home/*/.ansible/
|
||||
/home/*/.bash_history
|
||||
/home/*/.sudo_as_admin_successful
|
||||
/home/*/.zsh_history
|
||||
/root/.ansible/
|
||||
/root/.bash_history
|
||||
/root/.wget-hsts
|
||||
/var/cache/ldconfig/aux-cache
|
||||
/var/lib/systemd/random-seed
|
||||
/var/log/private
|
||||
|
||||
# Remove itself
|
||||
"$(readlink -f "$SELF")"
|
||||
)
|
||||
rm -rvf "${remove[@]}"
|
||||
}
|
||||
|
||||
|
||||
# Free all unused storage block.
|
||||
trim() {
|
||||
local swapuuid swappart max size
|
||||
max=11811160064 # Maximum size to reduce filesystem in RAM (11G)
|
||||
size=$(_disksize)
|
||||
|
||||
if swapuuid=$(blkid -o value -l -s UUID -t TYPE=swap); then
|
||||
swappart=$(readlink -f /dev/disk/by-uuid/"$swapuuid")
|
||||
_msg "Fill with 0 the swap partition to reduce box size"
|
||||
swapoff "$swappart"
|
||||
dd if=/dev/zero of="$swappart" bs=1M || true
|
||||
mkswap -U "$swapuuid" "$swappart"
|
||||
elif [[ -f /swap/swapfile ]];then
|
||||
swapoff /swap/swapfile
|
||||
truncate --size=0 /swap/swapfile
|
||||
fi
|
||||
|
||||
if [[ "$size" -lt "$max" ]]; then
|
||||
_msg "Fill root filesystem with 0 to reduce box size"
|
||||
dd if=/dev/zero of=/EMPTY bs=1M || true
|
||||
rm -f /EMPTY
|
||||
fi
|
||||
|
||||
# Block until the empty file has been removed, otherwise, Packer will
|
||||
# try to kill the box while the disk is still full and that is bad.
|
||||
sync
|
||||
}
|
||||
|
||||
main() {
|
||||
local begin end
|
||||
begin=$(_diskused)
|
||||
case "$DISTRIBUTION" in
|
||||
debian | ubuntu )
|
||||
clean_debian
|
||||
_sshdgenkeys
|
||||
;;
|
||||
|
||||
opensuse*)
|
||||
clean_opensuse
|
||||
;;
|
||||
|
||||
arch)
|
||||
clean_arch
|
||||
;;
|
||||
esac
|
||||
impersonalize
|
||||
trim
|
||||
|
||||
end="$(_diskused)"
|
||||
((res = begin - end))
|
||||
echo "Inital used space: $(numfmt --to=iec "$begin")"
|
||||
echo "Final space: $(numfmt --to=iec "$end")"
|
||||
echo "Saved space: $(numfmt --to=iec "$res")"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
54
tests/packer/main.pkr.hcl
Normal file
54
tests/packer/main.pkr.hcl
Normal file
|
|
@ -0,0 +1,54 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
build {
|
||||
name = "main"
|
||||
sources = [
|
||||
"source.qemu.archlinux-gnome",
|
||||
"source.qemu.archlinux-kde",
|
||||
"source.qemu.ubuntu-server",
|
||||
]
|
||||
|
||||
provisioner "file" {
|
||||
destination = "/tmp"
|
||||
sources = ["${path.cwd}/packer/src"]
|
||||
}
|
||||
|
||||
provisioner "file" {
|
||||
only = ["qemu.archlinux-gnome", "qemu.archlinux-kde"]
|
||||
destination = "/tmp/src/"
|
||||
sources = ["${path.cwd}/../apparmor.d-${var.version}-x86_64.pkg.tar.zst"]
|
||||
}
|
||||
|
||||
provisioner "file" {
|
||||
only = ["qemu.ubuntu-server", "qemu.ubuntu-desktop"]
|
||||
destination = "/tmp/src/"
|
||||
sources = ["${path.cwd}/../apparmor.d_${var.version}_all.deb"]
|
||||
}
|
||||
|
||||
provisioner "shell" {
|
||||
execute_command = "echo '${var.password}' | sudo -S sh -c '{{ .Vars }} {{ .Path }}'"
|
||||
inline = [
|
||||
"while [ ! -f /var/lib/cloud/instance/boot-finished ]; do echo 'Waiting for Cloud-Init...'; sleep 20; done",
|
||||
"cloud-init clean", # Remove logs and artifacts so cloud-init can re-run
|
||||
"sh /tmp/src/init.sh"
|
||||
]
|
||||
}
|
||||
|
||||
provisioner "shell" {
|
||||
script = "${path.cwd}/packer/init/clean.sh"
|
||||
execute_command = "echo '${var.password}' | sudo -S sh -c '{{ .Vars }} {{ .Path }}'"
|
||||
}
|
||||
|
||||
post-processor "vagrant" {
|
||||
output = "${var.iso_dir}/packer_${var.prefix}-${source.name}.box"
|
||||
}
|
||||
|
||||
post-processor "shell-local" {
|
||||
inline = [
|
||||
"vagrant box add --force --name ${var.prefix}-${source.name} ${var.iso_dir}/packer_${var.prefix}-${source.name}.box"
|
||||
]
|
||||
}
|
||||
|
||||
}
|
||||
39
tests/packer/ubuntu.pkr.hcl
Normal file
39
tests/packer/ubuntu.pkr.hcl
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
source "qemu" "ubuntu-server" {
|
||||
disk_image = true
|
||||
iso_url = "https://cloud-images.ubuntu.com/${var.release.ubuntu}/current/${var.release.ubuntu}-server-cloudimg-amd64.img"
|
||||
iso_checksum = "file:https://cloud-images.ubuntu.com/${var.release.ubuntu}/current/SHA256SUMS"
|
||||
iso_target_path = "${var.iso_dir}/${source.name}-cloudimg-amd64.img"
|
||||
cpus = 4
|
||||
memory = 2048
|
||||
disk_size = "${var.disk_size}"
|
||||
accelerator = "kvm"
|
||||
headless = true
|
||||
ssh_username = "${var.username}"
|
||||
ssh_password = "${var.password}"
|
||||
ssh_port = 22
|
||||
ssh_wait_timeout = "1000s"
|
||||
disk_compression = true
|
||||
disk_detect_zeroes = "unmap"
|
||||
disk_discard = "unmap"
|
||||
output_directory = "${var.output}/"
|
||||
vm_name = "${var.prefix}-${source.name}.qcow2"
|
||||
boot_wait = "10s"
|
||||
firmware = "/usr/share/edk2-ovmf/x64/OVMF_CODE.fd"
|
||||
shutdown_command = "echo ${var.password} | sudo -S /sbin/shutdown -hP now"
|
||||
cd_label = "cidata"
|
||||
cd_content = {
|
||||
"meta-data" = ""
|
||||
"user-data" = templatefile("${path.cwd}/packer/init/${source.name}.user-data.yml",
|
||||
{
|
||||
username = "${var.username}"
|
||||
password = "${var.password}"
|
||||
ssh_key = file("${var.ssh_publickey}")
|
||||
hostname = "${var.prefix}-${source.name}"
|
||||
}
|
||||
)
|
||||
}
|
||||
}
|
||||
75
tests/packer/variables.pkr.hcl
Normal file
75
tests/packer/variables.pkr.hcl
Normal file
|
|
@ -0,0 +1,75 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
# Variables definitions
|
||||
|
||||
variable "username" {
|
||||
description = "Admin username"
|
||||
type = string
|
||||
default = "user"
|
||||
}
|
||||
|
||||
variable "password" {
|
||||
description = "Default admin password"
|
||||
type = string
|
||||
default = "user"
|
||||
}
|
||||
|
||||
variable "ssh_publickey" {
|
||||
description = "Path to the ssh public key"
|
||||
type = string
|
||||
default = "~/.ssh/id_ed25519.pub"
|
||||
}
|
||||
|
||||
variable "ssh_privatekey" {
|
||||
description = "Path to the ssh private key"
|
||||
type = string
|
||||
default = "~/.ssh/id_ed25519"
|
||||
}
|
||||
|
||||
variable "disk_size" {
|
||||
description = "Disk size of the App VM to build"
|
||||
type = string
|
||||
default = "10G"
|
||||
}
|
||||
|
||||
variable "iso_dir" {
|
||||
description = "Original ISO file directory"
|
||||
type = string
|
||||
default = "/var/lib/libvirt/images"
|
||||
}
|
||||
|
||||
variable "output" {
|
||||
description = "Output build directory"
|
||||
type = string
|
||||
default = "/tmp/packer"
|
||||
}
|
||||
|
||||
variable "prefix" {
|
||||
description = "Image name prefix"
|
||||
type = string
|
||||
default = "aa"
|
||||
}
|
||||
|
||||
variable "version" {
|
||||
description = "apparmor.d version"
|
||||
type = string
|
||||
default = "0.001"
|
||||
}
|
||||
|
||||
variable "release" {
|
||||
description = "Distribution release to use"
|
||||
type = map(string)
|
||||
default = {
|
||||
"ubuntu" : "jammy", # 22.04 LTS
|
||||
"debian" : "bullseye", # 11
|
||||
"opensuse" : "9",
|
||||
}
|
||||
}
|
||||
|
||||
variable "flavor" {
|
||||
description = "Distribution flavor to use (-desktop, -gnome, -kde...)"
|
||||
type = string
|
||||
default = ""
|
||||
}
|
||||
Loading…
Reference in a new issue