image:
  distribution: OpenWrt

source:
  downloader: openwrt-http
  url: https://downloads.openwrt.org
  # see https://openwrt.org/docs/guide-user/security/signatures
  #  or https://git.openwrt.org/?p=keyring.git;a=tree;f=gpg 
  keys:
# Universal GPG signing key from Nitrokey 3A key
# Fingerprint: 8A8B C12F 46B8 36C0 F9CD B36F 1D53 D187 7742 E911
  - |-
    -----BEGIN PGP PUBLIC KEY BLOCK-----
    
    mDMEZGYbnhYJKwYBBAHaRw8BAQdATHfcRHxMqX/Z/bRtFvHekZK6uM1BV13gDBvR
    uHWswEG0Nk9wZW5XcnQgQnVpbGQgU3lzdGVtIChOaXRyb2tleTMpIDxjb250YWN0
    QG9wZW53cnQub3JnPoiUBBMWCgA8FiEEiovBL0a4NsD5zbNvHVPRh3dC6REFAmRm
    G54CGwEFCRLMAwAECwkIBwQVCgkIBRYCAwEAAh4FAheAAAoJEB1T0Yd3QukRj7wA
    +wcedxIFa5zySg2+R7LtMnUuuICsnZAkt+dYLFpOg1+eAQC9mXQlUjxD6o7OmCUI
    D2dnaFUn5oaAx+Pp/1MaeYs+A4kCMwQQAQoAHRYhBFTMdDB6LG3JzmGCac2EvO1i
    ZHHxBQJkZimAAAoJEM2EvO1iZHHxmT4QAK58mk2DacqyPDgED8VkI1lTXOkQF7GD
    w/BQHoEtZun8NtvCjEYtJ+6JA6Z0GOKAl8LTIntX7j7wFaaJWiZ9B6jmwyl4DK+Q
    SRnstMCv3jYaEiTlT8GQQXZpTGBpPUCCzp3ykqG1E8Yq9erXsR+et9rinF+hxjvQ
    9a7lVETAec0EEpwA9WYpR/H8VJQVpT+PIRZnyI+mgQgmxJvYkJ1L6ubWPznjDvPm
    IpIeUKGym+oZjtwVT7uYWZFdfrYw3wOdOm+IytXAEQerbMwog9AAl+/n4xHVooFP
    0ZT4hOA1vgeobx2MRAdipJzhp6vNwCsJ9iCYU9LexveYzkUXqpED59iwnsQdIPSv
    DI9J0jNBbNFzqj3XxN4/lyFtvQG/Z4CE/682ez73E0jIhshvnZwuVcloQVuxpSAo
    hgFpy3QDUMr/BqP3q5kl04NaCxrTgmPACbj6LxHLXX7m7xnAdi9HNqsi23jTlC7T
    Fyk+xEnBwKsdpERPr0T3lIiizl3VIQrW36IRgdR8urRDETFWJ+TmhO2AiM2gmaYe
    l/UH2MiCNfsDEmCMp+Fjb8YcEp8ZVed8pEmaNzlG7ykf4qMzoeTR5uewupLf/ni9
    +QtruqXe93TZLuCn6OADAC/nZwFnO0AzELpIcB+1gECBMORzfl5O4F0gk/GN45Ti
    a+qYI/OBnO8BiQIzBBABCgAdFiEEv4VngaASk8hAmr5yzVToLa2zaE0FAmRmKagA
    CgkQzVToLa2zaE0kRxAAlTRGMJeUrUiHQ7t0ES+7trydHX//xQhH2XBJhEjESSHi
    ElYr9fnm+jthu5PqOeSho0mRhPlmKjgztX6eRF/dAxhbiCcUqKQcxrOLwRxP+BDB
    pJ5MEbGWtNiMmdqbTCPA/7ehys4lLnwPK2IkLiwc8cUuw3VSYPlDvEUE5f8XlcNQ
    q/7rijNM+zBGc/67qIAIemRDbF2nNVKd52fZ+v75CzSMkfje5F2j5L/zZSCYLMex
    n0TYW/XfSimjQRj0xoedt5GM6nfhDX1/cD85Ntzt6t5v5lEZsIh1F33ffCVjqq/x
    XHg3CVCZFxBN+zyrcjuW8CMvGCWYTOWQplGFNX1lU541foG0xKDtS/HBS+iwS7A2
    k9sOGP89SJGb4ECzYSybnRr1sYlKds77tYZQ3AS+KSUDeDi/zCyu8Y6DzioRAhls
    jeke8YRdZj+NSZJ+MTTQlrUcL/50f89B0gK5zY7Dvb0oVmC9eVeaHHmeRbTweTuv
    YjQerHl47L8vCpPSOKBIHAlFMv4gg992yQYjdwIIWNF6KlbwA8X5ie/LM8RPRyeU
    8wTy4dQnsD9sQaWfEri4lVylzhViK5w21Lg+gqfkSm8ur1SSWlBNSBRDrX/A3kMR
    t3+KulbfEDnAhFjA5YLjqI8vIOEi5c1Ls/QoUuXyG8jQCuTaXluebMN2/F85aZmJ
    AjMEEAEKAB0WIQRmcgXjebrzSIY6XGaIylnoj2gVgAUCZGYp1AAKCRCIylnoj2gV
    gC+lD/9KvdfZm9I3DuKXItH6EzBAtrrjUvlooj1dupsnIPdJKxypKA/PCrztALbJ
    dOBIKrsXX121L+NFShaqup9TYcoWPkBZkr7ATDGke/KjO1NRRE1awBQeDQDmoQsx
    EGtL+M+Dd0Jv7SZ9eHMQ8YBDXwpB11v9ZiCWFPfk0J8C8BzypByq8uXzAh1h9mXG
    LsRgNwl6ARORw03TtYiqMLhOyGt9/+qNQZ0UfIKoQ9JRVYRY0cg0HYp4J1zb/i0Q
    r6g8fvy9lNX+Fcpu1mPX08fRHKTtJJNmdl15N5o+h/NhUhkO88veqtAMdJCGim7F
    uL14o2izbTgP8lqDpQp3Q3Lmxfrx3B0MV05u/OsmUx0NOMyLEiTt8KJOKKlMXkqV
    wH7CD1f7y9CcmTUOp1n5UMdiMYpSOaLIlSKlrOE1wv2TLdFnnX7QAcs9/GIdAR5N
    EDscTG6tC5lqSWWwdvMp8ZSa04lMiOZft8GZdgxab4Dn4hLTRBYcCfda0abItO72
    BPa0GFU2Ok3uPDUIySP7r1SJGL0bm1tXbAnSuXRlwon6xEEOwBHds+6lHEKUs3Ym
    o+OLD4Sf02Jl1GF+1Y+bI2PBxbiVluaUGuZDnPBfjKTELktuSsRSBMgLVQpe37fm
    ISkQE1I6+g6LKdsq7bGT43KBX3F2q7YVCqlfV047TQb6EJ+VU7gzBGRmG54WCSsG
    AQQB2kcPAQEHQDz1QTCdR5SStzy65qlYiN9gWjSU347TG/9sKcztDvAsiPUEGBYK
    ACYWIQSKi8EvRrg2wPnNs28dU9GHd0LpEQUCZGYbngIbAgUJEswDAACBCRAdU9GH
    d0LpEXYgBBkWCgAdFiEEksVh3lWuZVLzxza4KwFRCQYG0dkFAmRmG54ACgkQKwFR
    CQYG0dlqGAEAsH7jgDtmeLnLfH+ucBZk0dhkuVA9adN3Dy8yW83zTiUBAK4KBz/o
    0mYEoOOVwGMdtvTWByr7PEt83N96b553uBIJ800A/2F7rSfPvh7z+iePy7/2wTd9
    8xw/e3wp+I1Wtxo5UYjrAQCIiS2AkkuaKsdqi1TPOFkigpUHMcb7CeusiXYVIoR5
    DA==
    =kEP/
    -----END PGP PUBLIC KEY BLOCK-----

targets:
  lxc:
    create_message: |
      You just created an {{ image.distribution }} container.
    config:
    - type: all
      content: |-
        lxc.include = LXC_TEMPLATE_CONFIG/common.conf

    - type: user
      content: |-
        lxc.include = LXC_TEMPLATE_CONFIG/userns.conf

    - type: all
      content: |-
        lxc.arch = {{ image.architecture_kernel }}

files:
- path: /etc/hostname
  generator: hostname

- path: /etc/hosts
  generator: hosts

- generator: incus-agent
  types:
    - vm

- path: /etc/config/network
  generator: dump
  content: |-
    config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

    config interface 'wan'
        option ifname 'eth0'
        option proto 'dhcp'

    config interface 'wan6'
        option ifname 'eth0'
        option proto 'dhcpv6'

    config globals 'globals'
        option ula_prefix 'auto'

packages:
  manager: apk
  update: false
  cleanup: true
  sets:
  - packages:
    - kmod-9pvirtio
    - kmod-fs-9p
    - kmod-vsock-virtio
    - virtio-console-helper
    action: install
    types:
      - vm

actions:
- trigger: post-unpack
  action: |
    #!/bin/sh
    echo "console::askfirst:/usr/libexec/login.sh" >> /etc/inittab
  types:
    - container

- trigger: post-files
  action: |
    #!/bin/sh
    # we don't need grub in a container
    rm -rf /boot/efi
  types:
    - container

- trigger: post-files
  action: |
    #!/bin/sh
    target=/boot/efi/boot/grub/grub.cfg
    sed -i "s#root=[^ ]*#root=${DISTROBUILDER_ROOT_PARTUUID}#g" "${target}"
  types:
    - vm
  architectures:
    - x86-64

- trigger: post-files
  action: |
    #!/bin/sh
    target=/boot/efi/efi/openwrt/grub.cfg
    sed -i "s#root=[^ ]*#root=${DISTROBUILDER_ROOT_PARTUUID}#g" "${target}"
  types:
    - vm
  architectures:
    - armsr-armv8

- trigger: post-files
  action: |
    #!/bin/sh

    # Disable process isolation to make dnsmasq work
    sed -i 's/procd_add_jail/: \0/g' /etc/init.d/dnsmasq
    # Disable conflicting sysntpd service to avoid crash loop
    rm -f /etc/rc.d/*sysntpd
  releases:
  - snapshot
  - 24.10
  - 25.12
  types:
    - container

mappings:
  architecture_map: openwrt
