introduce rust

upgrade go+deps
unix module disappeared
2025-06-23 02:03:02 +02:00 · 2025-06-02 14:53:05 +02:00 · 2025-06-02 14:51:26 +02:00 · 2024-11-06 00:42:51 +01:00 · 2024-11-04 22:06:48 +01:00 · 2024-11-04 17:33:23 +01:00
74 changed files with 3715 additions and 519 deletions
--- a/.dockerignore
+++ b/.dockerignore
@ -1 +1,10 @@
 Dockerfile
+modd.*
+tmp/**/*
+dist/*
+go.work
+go.work.sum
+modd.*conf
+test-initrd*
+test-initrd/**/*
+target
--- a/.gitignore
+++ b/.gitignore
@ -3,3 +3,6 @@
 /qemu.pid
 /test-initrd.cpio
 /tmp
+/go.work
+/go.work.sum
+/target
--- a/Cargo.lock
+++ b/Cargo.lock
@ -0,0 +1,634 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "addr2line"
+version = "0.24.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dfbe277e56a376000877090da837660b4427aad530e3028d44e0bffe4f89a1c1"
+dependencies = [
+ "gimli",
+]
+
+[[package]]
+name = "adler2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "anstream"
+version = "0.6.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "301af1932e46185686725e0fad2f8f2aa7da69dd70bf6ecc44d6b703844a3933"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "862ed96ca487e809f1c8e5a8447f6ee2cf102f846893800b20cebdf541fc6bbd"
+
+[[package]]
+name = "anstyle-parse"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c8bdeb6047d8983be085bab0ba1472e6dc604e7041dbf6fcd5e71523014fae9"
+dependencies = [
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "403f75924867bb1033c59fbf0797484329750cfbe3c4325cd33127941fabc882"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "backtrace"
+version = "0.3.75"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6806a6321ec58106fea15becdad98371e28d92ccbc7c8f1b3b6dd724fe8f1002"
+dependencies = [
+ "addr2line",
+ "cfg-if",
+ "libc",
+ "miniz_oxide",
+ "object",
+ "rustc-demangle",
+ "windows-targets",
+]
+
+[[package]]
+name = "bitflags"
+version = "2.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b8e56985ec62d17e9c1001dc89c88ecd7dc08e47eba5ec7c29c7b5eeecde967"
+
+[[package]]
+name = "bytes"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9555578bc9e57714c812a1f84e4fc5b4d21fcb063490c624de019f7464c91268"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+
+[[package]]
+name = "colorchoice"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
+
+[[package]]
+name = "either"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+
+[[package]]
+name = "env_filter"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "186e05a59d4c50738528153b83b0b0194d3a29507dfec16eccd4b342903397d0"
+dependencies = [
+ "log",
+ "regex",
+]
+
+[[package]]
+name = "env_logger"
+version = "0.11.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c863f0904021b108aa8b2f55046443e6b1ebde8fd4a15c399893aae4fa069f"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "env_filter",
+ "jiff",
+ "log",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "eyre"
+version = "0.6.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd915d99f24784cdc19fd37ef22b97e3ff0ae756c7e492e9fbfe897d61e2aec"
+dependencies = [
+ "indenter",
+ "once_cell",
+]
+
+[[package]]
+name = "gimli"
+version = "0.31.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
+
+[[package]]
+name = "hashbrown"
+version = "0.15.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5971ac85611da7067dbfcabef3c70ebb5606018acd9e2a3903a0da507521e0d5"
+
+[[package]]
+name = "indenter"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce23b50ad8242c51a442f3ff322d56b02f08852c77e4c0b4d3fd684abc89c683"
+
+[[package]]
+name = "indexmap"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cea70ddb795996207ad57735b50c5982d8844f38ba9ee5f1aedcfb708a2aa11e"
+dependencies = [
+ "equivalent",
+ "hashbrown",
+]
+
+[[package]]
+name = "init"
+version = "2.1.0"
+dependencies = [
+ "env_logger",
+ "eyre",
+ "itertools",
+ "libc",
+ "log",
+ "nix",
+ "regex",
+ "serde",
+ "serde_json",
+ "serde_yaml",
+ "shell-escape",
+ "termios",
+ "tokio",
+]
+
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
+
+[[package]]
+name = "itertools"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
+
+[[package]]
+name = "jiff"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be1f93b8b1eb69c77f24bbb0afdf66f54b632ee39af40ca21c4365a1d7347e49"
+dependencies = [
+ "jiff-static",
+ "log",
+ "portable-atomic",
+ "portable-atomic-util",
+ "serde",
+]
+
+[[package]]
+name = "jiff-static"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03343451ff899767262ec32146f6d559dd759fdadf42ff0e227c7c48f72594b4"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.173"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8cfeafaffdbc32176b64fb251369d52ea9f0a8fbc6f8759edffef7b525d64bb"
+
+[[package]]
+name = "log"
+version = "0.4.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
+
+[[package]]
+name = "memchr"
+version = "2.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a282da65faaf38286cf3be983213fcf1d2e2a58700e808f83f4ea9a4804bc0"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+dependencies = [
+ "adler2",
+]
+
+[[package]]
+name = "mio"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78bed444cc8a2160f01cbcf811ef18cac863ad68ae8ca62092e8db51d51c761c"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "nix"
+version = "0.30.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
+[[package]]
+name = "object"
+version = "0.36.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4895175b425cb1f87721b59f0f286c2092bd4af812243672510e1ac53e2e0ad"
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
+
+[[package]]
+name = "portable-atomic"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f84267b20a16ea918e43c6a88433c2d54fa145c92a811b5b047ccbe153674483"
+
+[[package]]
+name = "portable-atomic-util"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8a2f0d8d040d7848a709caf78912debcc3f33ee4b3cac47d73d1e1069e83507"
+dependencies = [
+ "portable-atomic",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.95"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02b3e5e68a3a1a02aad3ec490a98007cbc13c37cbe84a3cd7b8e406d76e7f778"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "regex"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
+
+[[package]]
+name = "rustc-demangle"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "989e6739f80c4ad5b13e0fd7fe89531180375b18520cc8c82080e4dc4035b84f"
+
+[[package]]
+name = "ryu"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
+
+[[package]]
+name = "serde"
+version = "1.0.219"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.219"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.140"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20068b6e96dc6c9bd23e01df8827e6c7e1f2fddd43c21810382803c136b99373"
+dependencies = [
+ "itoa",
+ "memchr",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serde_yaml"
+version = "0.9.34+deprecated"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47"
+dependencies = [
+ "indexmap",
+ "itoa",
+ "ryu",
+ "serde",
+ "unsafe-libyaml",
+]
+
+[[package]]
+name = "shell-escape"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "45bb67a18fa91266cc7807181f62f9178a6873bfad7dc788c42e6430db40184f"
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9203b8055f63a2a00e2f593bb0510367fe707d7ff1e5c872de2f537b339e5410"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "socket2"
+version = "0.5.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
+dependencies = [
+ "libc",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.103"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4307e30089d6fd6aff212f2da3a1f9e32f3223b1f010fb09b7c95f90f3ca1e8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "termios"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "411c5bf740737c7918b8b1fe232dca4dc9f8e754b8ad5e20966814001ed0ac6b"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "tokio"
+version = "1.45.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75ef51a33ef1da925cea3e4eb122833cb377c61439ca401b770f54902b806779"
+dependencies = [
+ "backtrace",
+ "bytes",
+ "libc",
+ "mio",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2",
+ "tokio-macros",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e06d43f1345a3bcd39f6a56dbb7dcab2ba47e68e8ac134855e7e2bdbaf8cab8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
+
+[[package]]
+name = "unsafe-libyaml"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
--- a/Cargo.toml
+++ b/Cargo.toml
@ -0,0 +1,26 @@
+[package]
+name = "init"
+version = "2.1.0"
+edition = "2024"
+
+[profile.release]
+strip = true
+panic = "abort"
+opt-level = "z"
+lto = true
+codegen-units = 1
+
+[dependencies]
+libc = { version = "0.2", default-features = false }
+env_logger = "0.11.3"
+eyre = "0.6.12"
+itertools = "0.14.0"
+log = "0.4.21"
+nix = { version = "0.30.1", features = ["feature", "mount", "process", "reboot"] }
+regex = "1.11.1"
+serde = { version = "1.0.198", features = ["derive"] }
+serde_json = "1.0.116"
+serde_yaml = "0.9.34"
+shell-escape = "0.1.5"
+tokio = { version = "1.38.0", features = ["rt", "net", "fs", "process", "io-std", "io-util", "sync", "macros", "signal"] }
+termios = "0.3.3"
--- a/37
+++ b/37
@ -0,0 +1,37 @@
+from rust:1.87.0-alpine as rust
+
+run apk add --no-cache git musl-dev libudev-zero-dev # pkgconfig cryptsetup-dev lvm2-dev clang-dev clang-static
+
+workdir /src
+copy . .
+run --mount=type=cache,id=novit-rs,target=/usr/local/cargo/registry \
+    --mount=type=cache,id=novit-rs-target,sharing=private,target=/src/target \
+    cargo build --release && cp target/release/init /
+
+# ------------------------------------------------------------------------
+from alpine:3.22.0 as initrd
+
+workdir /layer
+
+run . /etc/os-release \
+ && wget -O- https://dl-cdn.alpinelinux.org/alpine/v${VERSION_ID%.*}/releases/x86_64/alpine-minirootfs-${VERSION_ID}-x86_64.tar.gz |tar zxv
+
+run apk add --no-cache --update -p . musl coreutils \
+ lvm2 lvm2-extra lvm2-dmeventd udev cryptsetup \
+ e2fsprogs lsblk openssh-server \
+ && rm -rf usr/share/apk var/cache/apk etc/motd
+
+copy etc/sshd_config etc/ssh/sshd_config
+
+copy --from=rust /init init
+run cd bin && for cmd in init-version init-connect bootstrap; do ln -s ../init $cmd; done
+
+# check viability
+run chroot . init-version
+
+run find |cpio -H newc -o >/initrd
+
+# ------------------------------------------------------------------------
+from alpine:3.22.0
+copy --from=initrd /initrd /
+entrypoint ["base64","/initrd"]
--- a/Dockerfile.build
+++ b/Dockerfile.build
@ -0,0 +1,5 @@
+from rust:1.77.1-alpine as rust
+
+run apk add --no-cache musl-dev
+run apk add --no-cache musl lvm2 lvm2-extra lvm2-dmeventd udev cryptsetup e2fsprogs btrfs-progs lsblk
+
--- a/Dockerfile.test
+++ b/Dockerfile.test
@ -0,0 +1,2 @@
+from alpine:3.19.0
+run apk add --no-cache musl lvm2 lvm2-extra lvm2-dmeventd udev cryptsetup e2fsprogs btrfs-progs lsblk
--- a/alpine/Dockerfile
+++ b/alpine/Dockerfile
@ -1,12 +0,0 @@
-# ------------------------------------------------------------------------
-from alpine:3.15
-
-add alpine-minirootfs-3.15.0-x86_64.tar.gz /layer/
-
-workdir /layer
-
-run apk update
-run apk add -p . musl lvm2 lvm2-dmeventd udev cryptsetup e2fsprogs btrfs-progs
-run rm -rf usr/share/apk var/cache/apk
-
-entrypoint ["sh","-c","find |cpio -H newc -o |base64"]
--- a/alpine/alpine-minirootfs-3.15.0-x86_64.tar.gz
+++ b/alpine/alpine-minirootfs-3.15.0-x86_64.tar.gz
--- a/apply-config.go
+++ b/apply-config.go
@ -0,0 +1,140 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/rs/zerolog/log"
+	yaml "gopkg.in/yaml.v2"
+
+	"novit.tech/direktil/pkg/config/apply"
+)
+
+var loopOffset = 0
+
+func applyConfig(cfgPath string, bootMounted bool) (cfg *configV1) {
+	cfgBytes, err := os.ReadFile(cfgPath)
+	if err != nil {
+		fatalf("failed to read %s: %v", cfgPath, err)
+	}
+
+	cfg = &configV1{}
+	if err := yaml.Unmarshal(cfgBytes, cfg); err != nil {
+		fatal("failed to load config: ", err)
+	}
+
+	// mount layers
+	if len(cfg.Layers) == 0 {
+		fatal("no layers configured!")
+	}
+
+	layersInMemory := paramBool("layers-in-mem", false)
+
+	log.Info().Strs("layers", cfg.Layers).Bool("in-memory", layersInMemory).Msg("mounting layers")
+
+	const layersInMemDir = "/layers-in-mem"
+	if layersInMemory {
+		mkdir(layersInMemDir, 0700)
+		mount("layers-mem", layersInMemDir, "tmpfs", 0, "")
+	}
+
+	lowers := make([]string, len(cfg.Layers))
+	for i, layer := range cfg.Layers {
+		log := log.With().Str("layer", layer).Logger()
+
+		path := layerPath(layer)
+
+		info, err := os.Stat(path)
+		if err != nil {
+			fatal(err)
+		}
+
+		log.Info().Int64("size", info.Size()).Msg("layer found")
+
+		if layersInMemory {
+			log.Info().Msg("copying to memory")
+			targetPath := filepath.Join(layersInMemDir, layer)
+			cp(path, targetPath)
+			path = targetPath
+		}
+
+		dir := "/layers/" + layer
+
+		lowers[i] = dir
+
+		mountSquahfs(path, dir)
+	}
+
+	// prepare system root
+	mount("mem", "/changes", "tmpfs", 0, "")
+
+	mkdir("/changes/workdir", 0755)
+	mkdir("/changes/upperdir", 0755)
+
+	mount("overlay", "/system", "overlay", rootMountFlags,
+		"lowerdir="+strings.Join(lowers, ":")+",upperdir=/changes/upperdir,workdir=/changes/workdir")
+
+	// make root rshared (default in systemd, required by Kubernetes 1.10+)
+	// equivalent to "mount --make-rshared /"
+	// see kernel's Documentation/sharedsubtree.txt (search rshared)
+	if err := syscall.Mount("", "/system", "", syscall.MS_SHARED|syscall.MS_REC, ""); err != nil {
+		fatalf("FATAL: mount --make-rshared / failed: %v", err)
+	}
+
+	if bootMounted {
+		if layersInMemory {
+			if err := syscall.Unmount("/boot", 0); err != nil {
+				log.Warn().Err(err).Msg("failed to unmount /boot")
+				time.Sleep(2 * time.Second)
+			}
+
+		} else {
+			mount("/boot", "/system/boot", "", syscall.MS_BIND, "")
+		}
+	}
+
+	// - write files
+	apply.Files(cfg.Files, "/system")
+
+	// - groups
+	for _, group := range cfg.Groups {
+		logEvt := log.Info().Str("group", group.Name)
+
+		opts := make([]string, 0)
+		opts = append(opts /* chroot */, "/system", "groupadd", "-r")
+		if group.Gid != 0 {
+			opts = append(opts, "-g", strconv.Itoa(group.Gid))
+			logEvt.Int("gid", group.Gid)
+		}
+		opts = append(opts, group.Name)
+
+		logEvt.Msg("creating group")
+		run("chroot", opts...)
+	}
+
+	// - user
+	for _, user := range cfg.Users {
+		logEvt := log.Info().Str("user", user.Name)
+
+		opts := make([]string, 0)
+		opts = append(opts /* chroot */, "/system", "useradd", "-r")
+		if user.Gid != 0 {
+			opts = append(opts, "-g", strconv.Itoa(user.Gid))
+			logEvt.Int("gid", user.Gid)
+		}
+		if user.Uid != 0 {
+			opts = append(opts, "-u", strconv.Itoa(user.Uid))
+			logEvt.Int("uid", user.Uid)
+		}
+		opts = append(opts, user.Name)
+
+		logEvt.Msg("creating user")
+		run("chroot", opts...)
+	}
+
+	return
+}
--- a/ask-secret.go
+++ b/ask-secret.go
@ -6,10 +6,25 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"sync"
+	"sync/atomic"
 )

-func askSecret(prompt string) []byte {
-	stdinTTY.EchoOff()
+var (
+	inputTTYs    = new(sync.Map)
+	askingSecret atomic.Bool
+)
+
+func registerInput(in *tty)  { inputTTYs.Store(in, in) }
+func unregiterInput(in *tty) { inputTTYs.Delete(in) }
+
+func askSecret(prompt string) (s []byte) {
+	err := func() (err error) {
+		askingSecret.Store(true)
+		defer askingSecret.Store(false)
+
+		inputTTYs.Range(func(k, v any) (con bool) { v.(*tty).EchoOff(); return true })
+		defer inputTTYs.Range(func(k, v any) (con bool) { v.(*tty).Restore(); return true })

 		var (
 			in  io.Reader = stdin
@ -23,24 +38,19 @@ func askSecret(prompt string) []byte {

 		out.Write([]byte(prompt + ": "))

-	if stdin != nil {
-		stdout.HideInput()
+		s, err = bufio.NewReader(in).ReadBytes('\n')
+		if err != nil {
+			return
 		}

-	s, err := bufio.NewReader(in).ReadBytes('\n')
-
-	if stdin != nil {
-		stdout.ShowInput()
-	}
-
-	stdinTTY.Restore()
+		fmt.Println()
+		s = bytes.TrimRight(s, "\r\n")
+		return
+	}()

 	if err != nil {
 		fatalf("failed to read from stdin: %v", err)
 	}

-	fmt.Println()
-
-	s = bytes.TrimRight(s, "\r\n")
-	return s
+	return
 }
--- a/auth.go
+++ b/auth.go
@ -3,8 +3,8 @@ package main
 import (
 	"bytes"
 	"errors"
-	"log"

+	"github.com/rs/zerolog/log"
 	"golang.org/x/crypto/ssh"

 	config "novit.tech/direktil/pkg/bootstrapconfig"
@ -23,7 +23,7 @@ func localAuth() bool {
 		}

 		if config.CheckPassword(auth.Password, sec) {
-			log.Printf("login with auth %q", auth.Name)
+			log.Info().Msgf("login with auth %q", auth.Name)
 			return true
 		}
 	}
@ -41,12 +41,12 @@ func sshCheckPubkey(conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions,

 		allowedKey, _, _, _, err := ssh.ParseAuthorizedKey([]byte(auth.SSHKey))
 		if err != nil {
-			log.Printf("SSH pubkey for %q invalid: %v", auth.Name, auth.SSHKey)
+			log.Warn().Err(err).Str("user", auth.Name).Str("key", auth.SSHKey).Msg("SSH public key is invalid")
 			return nil, err
 		}

 		if bytes.Equal(allowedKey.Marshal(), keyBytes) {
-			log.Print("ssh: accepting public key for ", auth.Name)
+			log.Info().Str("user", auth.Name).Msg("ssh: accepting public key")
 			return &ssh.Permissions{
 				Extensions: map[string]string{
 					"pubkey-fp": ssh.FingerprintSHA256(key),
--- a/boot-v1.go
+++ b/boot-v1.go
@ -1,168 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"log"
-	"os"
-	"path/filepath"
-	"strings"
-	"syscall"
-	"time"
-
-	yaml "gopkg.in/yaml.v2"
-	"novit.tech/direktil/pkg/sysfs"
-)
-
-var loopOffset = 0
-
-func bootV1() {
-	log.Print("-- boot v1 --")
-
-	// find and mount /boot
-	bootMatch := param("boot", "")
-	bootMounted := false
-	if bootMatch != "" {
-		bootFS := param("boot.fs", "vfat")
-		for i := 0; ; i++ {
-			devNames := sysfs.DeviceByProperty("block", bootMatch)
-
-			if len(devNames) == 0 {
-				if i > 30 {
-					fatal("boot partition not found after 30s")
-				}
-				log.Print("boot partition not found, retrying")
-				time.Sleep(1 * time.Second)
-				continue
-			}
-
-			devFile := filepath.Join("/dev", devNames[0])
-
-			log.Print("boot partition found: ", devFile)
-
-			mount(devFile, "/boot", bootFS, bootMountFlags, "")
-			bootMounted = true
-			break
-		}
-	} else {
-		log.Print("Assuming /boot is already populated.")
-	}
-
-	// load config
-	cfgPath := param("config", "/boot/config.yaml")
-
-	layersDir = filepath.Join("/boot", bootVersion, "layers")
-	applyConfig(cfgPath, bootMounted)
-
-	finalizeBoot()
-}
-
-func applyConfig(cfgPath string, bootMounted bool) (cfg *configV1) {
-	cfgBytes, err := os.ReadFile(cfgPath)
-	if err != nil {
-		fatalf("failed to read %s: %v", cfgPath, err)
-	}
-
-	cfg = &configV1{}
-	if err := yaml.Unmarshal(cfgBytes, cfg); err != nil {
-		fatal("failed to load config: ", err)
-	}
-
-	// mount layers
-	if len(cfg.Layers) == 0 {
-		fatal("no layers configured!")
-	}
-
-	log.Printf("wanted layers: %q", cfg.Layers)
-
-	layersInMemory := paramBool("layers-in-mem", false)
-
-	const layersInMemDir = "/layers-in-mem"
-	if layersInMemory {
-		mkdir(layersInMemDir, 0700)
-		mount("layers-mem", layersInMemDir, "tmpfs", 0, "")
-	}
-
-	lowers := make([]string, len(cfg.Layers))
-	for i, layer := range cfg.Layers {
-		path := layerPath(layer)
-
-		info, err := os.Stat(path)
-		if err != nil {
-			fatal(err)
-		}
-
-		log.Printf("layer %s found (%d bytes)", layer, info.Size())
-
-		if layersInMemory {
-			log.Print("  copying to memory...")
-			targetPath := filepath.Join(layersInMemDir, layer)
-			cp(path, targetPath)
-			path = targetPath
-		}
-
-		dir := "/layers/" + layer
-
-		lowers[i] = dir
-
-		loopDev := fmt.Sprintf("/dev/loop%d", i+loopOffset)
-		losetup(loopDev, path)
-
-		mount(loopDev, dir, "squashfs", layerMountFlags, "")
-	}
-
-	// prepare system root
-	mount("mem", "/changes", "tmpfs", 0, "")
-
-	mkdir("/changes/workdir", 0755)
-	mkdir("/changes/upperdir", 0755)
-
-	mount("overlay", "/system", "overlay", rootMountFlags,
-		"lowerdir="+strings.Join(lowers, ":")+",upperdir=/changes/upperdir,workdir=/changes/workdir")
-
-	if bootMounted {
-		if layersInMemory {
-			if err := syscall.Unmount("/boot", 0); err != nil {
-				log.Print("WARNING: failed to unmount /boot: ", err)
-				time.Sleep(2 * time.Second)
-			}
-
-		} else {
-			mount("/boot", "/system/boot", "", syscall.MS_BIND, "")
-		}
-	}
-
-	// - write configuration
-	log.Print("writing /config.yaml")
-	if err := os.WriteFile("/system/config.yaml", cfgBytes, 0600); err != nil {
-		fatal("failed: ", err)
-	}
-
-	// - write files
-	for _, fileDef := range cfg.Files {
-		log.Print("writing ", fileDef.Path)
-
-		filePath := filepath.Join("/system", fileDef.Path)
-
-		if err := os.MkdirAll(filepath.Dir(filePath), 0755); err != nil {
-			log.Printf("failed to create dir %s: %v", filepath.Dir(fileDef.Path), err)
-		}
-
-		err = os.WriteFile(filePath, []byte(fileDef.Content), fileDef.Mode)
-		if err != nil {
-			fatalf("failed to write %s: %v", fileDef.Path, err)
-		}
-	}
-
-	return
-}
-
-func finalizeBoot() {
-	// clean zombies
-	cleanZombies()
-
-	// switch root
-	log.Print("switching root")
-	err := syscall.Exec("/sbin/switch_root", []string{"switch_root",
-		"-c", "/dev/console", "/system", "/sbin/init"}, os.Environ())
-	fatal("switch_root failed: ", err)
-}
--- a/boot-v2.go
+++ b/boot-v2.go
@ -1,17 +1,21 @@
 package main

 import (
-	"log"
 	"os"
 	"os/exec"
+	"syscall"

+	"github.com/rs/zerolog/log"
 	"gopkg.in/yaml.v3"

 	config "novit.tech/direktil/pkg/bootstrapconfig"
 )

 func bootV2() {
-	log.Print("-- boot v2 --")
+	log.Info().Msg("-- boot v2 --")
+
+	kernelVersion := unameRelease()
+	log.Info().Str("version", kernelVersion).Msg("Linux")

 	cfg := &config.Config{}

@ -29,43 +33,44 @@ func bootV2() {
 		}
 	}

-	log.Print("config loaded")
-	log.Printf("anti-phishing code: %q", cfg.AntiPhishingCode)
+	log.Info().Msg("config loaded")
+
+	if cfg.AntiPhishingCode != "" {
+		log.Info().Str("anti-phishing-code", cfg.AntiPhishingCode).Send()
+	}

 	auths = cfg.Auths

 	// mount kernel modules
-	if cfg.Modules != "" {
-		log.Print("mount modules from ", cfg.Modules)
+	if cfg.Modules == "" {
+		log.Warn().Msg("NOT mounting modules (\"modules:\" not specified)")
+	} else {
+		log.Info().Str("from", cfg.Modules).Msg("mounting modules")
+		mountSquahfs(cfg.Modules, "/modules")

-		err := os.MkdirAll("/modules", 0755)
-		if err != nil {
-			fatal("failed to create /modules: ", err)
+		modulesSourcePath := "/modules/lib/modules/" + kernelVersion
+		if _, err := os.Stat(modulesSourcePath); err != nil {
+			fatal("invalid modules dir: ", err)
 		}

-		run("mount", cfg.Modules, "/modules")
-		loopOffset++
-
-		err = os.Symlink("/modules/lib/modules", "/lib/modules")
-		if err != nil {
+		os.MkdirAll("/lib/modules", 0755)
+		if err := os.Symlink(modulesSourcePath, "/lib/modules/"+kernelVersion); err != nil {
 			fatal("failed to symlink modules: ", err)
 		}
 	}

-	// load basic modules
-	run("modprobe", "unix")
-
 	// devices init
+	log.Info().Msg("starting udevd")
 	err := exec.Command("udevd").Start()
 	if err != nil {
 		fatal("failed to start udevd: ", err)
 	}

-	log.Print("udevadm triggers")
+	log.Info().Msg("udevadm triggers")
 	run("udevadm", "trigger", "-c", "add", "-t", "devices")
 	run("udevadm", "trigger", "-c", "add", "-t", "subsystems")

-	log.Print("udevadm settle")
+	log.Info().Msg("udevadm settle")
 	run("udevadm", "settle")

 	// networks
@ -77,6 +82,9 @@ func bootV2() {
 	// SSH service
 	startSSH(cfg)

+	// dmcrypt blockdevs
+	setupCrypt(cfg.PreLVMCrypt, map[string]string{})
+
 	// LVM
 	setupLVM(cfg)

@ -86,3 +94,11 @@ func bootV2() {
 	// finalize
 	finalizeBoot()
 }
+
+func finalizeBoot() {
+	// switch root
+	log.Info().Msg("switching root")
+	err := syscall.Exec("/sbin/switch_root", []string{"switch_root",
+		"-c", "/dev/console", "/system", "/sbin/init"}, os.Environ())
+	fatal("switch_root failed: ", err)
+}
--- a/bootstrap.go
+++ b/bootstrap.go
@ -4,11 +4,13 @@ import (
 	"bytes"
 	"fmt"
 	"io"
-	"log"
 	"net/http"
 	"os"
 	"path/filepath"
 	"strings"
+	"time"
+
+	"github.com/rs/zerolog/log"

 	config "novit.tech/direktil/pkg/bootstrapconfig"
 )
@ -27,14 +29,14 @@ func bootstrap(cfg *config.Config) {
 	sysCfgPath := filepath.Join(baseDir, "config.yaml")

 	if _, err := os.Stat(sysCfgPath); os.IsNotExist(err) {
-		log.Printf("bootstrap %q does not exist", bootVersion)
+		log.Warn().Msgf("bootstrap %q does not exist", bootVersion)

 		seed := cfg.Bootstrap.Seed
 		if seed == "" {
 			fatalf("boostrap seed not defined, admin required")
 		}

-		log.Printf("seeding bootstrap from %s", seed)
+		log.Info().Str("from", seed).Msgf("seeding bootstrap")

 		err = os.MkdirAll(baseDir, 0700)
 		if err != nil {
@ -44,9 +46,18 @@ func bootstrap(cfg *config.Config) {
 		bootstrapFile := filepath.Join(baseDir, "bootstrap.tar")

 		err = func() (err error) {
-			resp, err := http.Get(seed)
+			var resp *http.Response
+
+			start := time.Now()
+			for time.Since(start) <= time.Minute {
+				resp, err = http.Get(seed)
+				if err == nil {
+					break
+				}
+				time.Sleep(time.Second)
+			}
 			if err != nil {
-				return
+				return fmt.Errorf("failed to fetch bootstrap")
 			}

 			if resp.StatusCode != http.StatusOK {
@ -72,7 +83,7 @@ func bootstrap(cfg *config.Config) {
 			fatalf("seeding failed: %v", err)
 		}

-		log.Print("unpacking bootstrap file")
+		log.Info().Msg("unpacking bootstrap file")
 		run("tar", "xvf", bootstrapFile, "-C", baseDir)
 	}

@ -80,6 +91,13 @@ func bootstrap(cfg *config.Config) {
 	layersOverride["modules"] = "/modules.sqfs"
 	sysCfg := applyConfig(sysCfgPath, false)

+	// load requested modules
+	for _, mod := range sysCfg.Modules {
+		log.Info().Str("module", mod).Msg("loading module")
+		run("modprobe", mod)
+	}
+
+	// localy-generated assets dir
 	localGenDir := filepath.Join(bsDir, "local-gen")

 	// vpns are v2+
@ -89,7 +107,7 @@ func bootstrap(cfg *config.Config) {

 	// mounts are v2+
 	for _, mount := range sysCfg.Mounts {
-		log.Print("mount ", mount.Dev, " to system's ", mount.Path)
+		log.Info().Str("source", mount.Dev).Str("target", mount.Path).Msg("mount")

 		path := filepath.Join("/system", mount.Path)

@ -108,13 +126,17 @@ func bootstrap(cfg *config.Config) {

 	// setup root user
 	if ph := sysCfg.RootUser.PasswordHash; ph != "" {
-		log.Print("setting root's password")
+		log.Info().Msg("setting root's password")
 		setUserPass("root", ph)
 	}
 	if ak := sysCfg.RootUser.AuthorizedKeys; len(ak) != 0 {
-		log.Print("setting root's authorized keys")
+		log.Info().Msg("setting root's authorized keys")
 		setAuthorizedKeys(ak)
 	}
+
+	// update-ca-certificates
+	log.Info().Msg("updating CA certificates")
+	run("chroot", "/system", "update-ca-certificates")
 }

 func setUserPass(user, passwordHash string) {
@ -133,6 +155,7 @@ func setUserPass(user, passwordHash string) {
 		p := strings.Split(line, ":")
 		if len(p) < 2 || p[0] != user {
 			buf.WriteString(line)
+			buf.WriteByte('\n')
 			continue
 		}

--- a/27
+++ b/27
@ -0,0 +1,27 @@
+set -ex
+
+which podman &>/dev/null && docker=podman || docker=docker
+
+mkdir -p empty
+$docker build -t nv-rs-build --network=host -f Dockerfile.build empty
+
+case $1 in
+  release)
+    opts=--release
+    bindir=target/release
+    ;;
+  "")
+    bindir=target/debug
+    ;;
+  *)
+    echo >&2 "invalid arg: $1"
+    exit 1
+    ;;
+esac
+
+$docker run --rm -i --net=host --user=$UID \
+    nv-rs-build \
+    cargo build $opts
+
+mkdir -p dist
+cp $bindir/init dist/
--- a/build.rs
+++ b/build.rs
@ -0,0 +1,9 @@
+use std::process::Command;
+fn main() {
+    let output = Command::new("git")
+        .args(&["rev-parse", "HEAD"])
+        .output()
+        .unwrap();
+    let git_commit = String::from_utf8(output.stdout).unwrap();
+    println!("cargo:rustc-env=GIT_COMMIT={}", git_commit);
+}
--- a/buildenv/Dockerfile
+++ b/buildenv/Dockerfile
@ -1,5 +0,0 @@
-from golang:1.18beta2-alpine3.15
-
-run apk add --update musl-dev git
-
-workdir /src
--- a/debug/bootstrap
+++ b/debug/bootstrap
@ -0,0 +1 @@
+../target/debug/init
--- a/debug/connect-boot
+++ b/debug/connect-boot
@ -0,0 +1 @@
+../target/debug/init
--- a/debug/init
+++ b/debug/init
@ -0,0 +1 @@
+../target/debug/init
--- a/debug/init-version
+++ b/debug/init-version
@ -0,0 +1 @@
+../target/debug/init
--- a/etc/sshd_config
+++ b/etc/sshd_config
@ -0,0 +1,7 @@
+KbdInteractiveAuthentication no
+PasswordAuthentication no
+
+PubkeyAuthentication yes
+
+PermitRootLogin yes
+AllowUsers root
--- a/go.mod
+++ b/go.mod
@ -1,28 +1,35 @@
-module novit.nc/direktil/initrd
+module novit.tech/direktil/initrd

 require (
-	github.com/kr/pty v1.1.8
+	github.com/creack/pty v1.1.24
+	github.com/freddierice/go-losetup/v2 v2.0.1
+	github.com/jochenvg/go-udev v0.0.0-20240801134859-b65ed646224b
 	github.com/pkg/term v1.1.0
-	golang.org/x/crypto v0.5.0
-	golang.org/x/sys v0.4.0
-	golang.org/x/term v0.4.0
-	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20221104135756-97bc4ad4a1cb
+	github.com/rs/zerolog v1.34.0
+	golang.org/x/crypto v0.38.0
+	golang.org/x/sys v0.33.0
+	golang.org/x/term v0.32.0
+	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10
 	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
-	novit.tech/direktil/pkg v0.0.0-20230201224712-5e39572dc50e
+	novit.tech/direktil/pkg v0.0.0-20240415130406-0d2e181a4ed6
 )

 require (
 	github.com/cavaliergopher/cpio v1.0.1 // indirect
-	github.com/creack/pty v1.1.18 // indirect
-	github.com/google/go-cmp v0.5.9 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/jkeiser/iter v0.0.0-20200628201005-c8aa0ae784d1 // indirect
 	github.com/josharian/native v1.1.0 // indirect
-	github.com/mdlayher/genetlink v1.3.1 // indirect
-	github.com/mdlayher/netlink v1.7.1 // indirect
-	github.com/mdlayher/socket v0.4.0 // indirect
-	golang.org/x/net v0.5.0 // indirect
-	golang.org/x/sync v0.1.0 // indirect
-	golang.zx2c4.com/wireguard v0.0.0-20220920152132-bb719d3a6e2c // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mdlayher/genetlink v1.3.2 // indirect
+	github.com/mdlayher/netlink v1.7.2 // indirect
+	github.com/mdlayher/socket v0.5.1 // indirect
+	golang.org/x/net v0.40.0 // indirect
+	golang.org/x/sync v0.14.0 // indirect
+	golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb // indirect
 )

-go 1.21
+go 1.23.1
+
+toolchain go1.24.3
--- a/go.sum
+++ b/go.sum
@ -1,60 +1,104 @@
 github.com/cavaliergopher/cpio v1.0.1 h1:KQFSeKmZhv0cr+kawA3a0xTQCU4QxXF1vhU7P7av2KM=
 github.com/cavaliergopher/cpio v1.0.1/go.mod h1:pBdaqQjnvXxdS/6CvNDwIANIFSP0xRKI16PX4xejRQc=
-github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
-github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
-github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
+github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
+github.com/freddierice/go-losetup/v2 v2.0.1 h1:wPDx/Elu9nDV8y/CvIbEDz5Xi5Zo80y4h7MKbi3XaAI=
+github.com/freddierice/go-losetup/v2 v2.0.1/go.mod h1:TEyBrvlOelsPEhfWD5rutNXDmUszBXuFnwT1kIQF4J8=
+github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/jkeiser/iter v0.0.0-20200628201005-c8aa0ae784d1 h1:smvLGU3obGU5kny71BtE/ibR0wIXRUiRFDmSn0Nxz1E=
+github.com/jkeiser/iter v0.0.0-20200628201005-c8aa0ae784d1/go.mod h1:fP/NdyhRVOv09PLRbVXrSqHhrfQypdZwgE2L4h2U5C8=
+github.com/jochenvg/go-udev v0.0.0-20240801134859-b65ed646224b h1:Pzf7tldbCVqwl3NnOnTamEWdh/rL41fsoYCn2HdHgRA=
+github.com/jochenvg/go-udev v0.0.0-20240801134859-b65ed646224b/go.mod h1:IBDUGq30U56w969YNPomhMbRje1GrhUsCh7tHdwgLXA=
 github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA=
 github.com/josharian/native v1.1.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
-github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/pty v1.1.8 h1:AkaSdXYQOWeaO3neb8EM634ahkXXe3jYbVh/F9lq+GI=
-github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw=
-github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/mdlayher/genetlink v1.3.1 h1:roBiPnual+eqtRkKX2Jb8UQN5ZPWnhDCGj/wR6Jlz2w=
-github.com/mdlayher/genetlink v1.3.1/go.mod h1:uaIPxkWmGk753VVIzDtROxQ8+T+dkHqOI0vB1NA9S/Q=
-github.com/mdlayher/netlink v1.7.1 h1:FdUaT/e33HjEXagwELR8R3/KL1Fq5x3G5jgHLp/BTmg=
-github.com/mdlayher/netlink v1.7.1/go.mod h1:nKO5CSjE/DJjVhk/TNp6vCE1ktVxEA8VEh8drhZzxsQ=
-github.com/mdlayher/socket v0.4.0 h1:280wsy40IC9M9q1uPGcLBwXpcTQDtoGwVt+BNoITxIw=
-github.com/mdlayher/socket v0.4.0/go.mod h1:xxFqz5GRCUN3UEOm9CZqEJsAbe1C8OwSK46NlmWuVoc=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mdlayher/genetlink v1.3.2 h1:KdrNKe+CTu+IbZnm/GVUMXSqBBLqcGpRDa0xkQy56gw=
+github.com/mdlayher/genetlink v1.3.2/go.mod h1:tcC3pkCrPUGIKKsCsp0B3AdaaKuHtaxoJRz3cc+528o=
+github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/g=
+github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
+github.com/mdlayher/socket v0.5.1 h1:VZaqt6RkGkt2OE9l3GcC6nZkqD3xKeQLyfleW/uBcos=
+github.com/mdlayher/socket v0.5.1/go.mod h1:TjPLHI1UgwEv5J1B5q0zTZq12A/6H7nKmtTanQE37IQ=
 github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721 h1:RlZweED6sbSArvlE924+mUcZuXKLBHA35U7LN621Bws=
+github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721/go.mod h1:Ickgr2WtCLZ2MDGd4Gr0geeCH5HybhRJbonOgQpvSxc=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/term v1.1.0 h1:xIAAdCMh3QIAy+5FrE8Ad8XoDhEU4ufwbaSozViP9kk=
 github.com/pkg/term v1.1.0/go.mod h1:E25nymQcrSllhX42Ok8MRm1+hyBdHY0dCeiKZ9jpNGw=
-github.com/ulikunitz/xz v0.5.6/go.mod h1:2bypXElzHzzJZwzH67Y6wb67pO62Rzfn7BSiF4ABRW8=
-golang.org/x/crypto v0.0.0-20220321153916-2c7772ba3064/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.5.0 h1:U/0M97KRkSFvyD/3FSmdP5W5swImpNgle/EHFhOsQPE=
-golang.org/x/crypto v0.5.0/go.mod h1:NK/OQwhpMQP3MwtdjgLlYHnH9ebylxKWv3e0fK+mkQU=
-golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.5.0 h1:GyT4nK/YDHSqa1c4753ouYCDajOYKTja9Xb/OHtgvSw=
-golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws=
-golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
+github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
+github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
+github.com/rs/zerolog v1.31.0/go.mod h1:/7mN4D5sKwJLZQ2b/znpjC3/GQWY/xaDXUM0kKWRHss=
+github.com/rs/zerolog v1.34.0 h1:k43nTLIwcTVQAncfCw4KZ2VY6ukYoZaBPNOE8txlOeY=
+github.com/rs/zerolog v1.34.0/go.mod h1:bJsvje4Z08ROH4Nhs5iH600c3IkWhwp44iRc54W6wYQ=
+github.com/ulikunitz/xz v0.5.11/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
+golang.org/x/crypto v0.38.0 h1:jt+WWG8IZlBnVbomuhg2Mdq0+BBQaHbtqHEFEigjUV8=
+golang.org/x/crypto v0.38.0/go.mod h1:MvrbAqul58NNYPKnOra203SB9vpuZW0e+RRZV+Ggqjw=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.40.0 h1:79Xs7wF06Gbdcg4kdCCIQArK11Z1hr5POQ6+fIYHNuY=
+golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.14.0 h1:woo0S4Yywslg6hp4eUFjTVOyKt0RookbpAHG4c1HmhQ=
+golang.org/x/sync v0.14.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20200909081042-eff7692f9009/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.4.0 h1:Zr2JFtRQNX3BCZ8YtxRE9hNJYC8J6I1MVbMg6owUp18=
-golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
+golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.4.0 h1:O7UWfv5+A2qiuulQk30kVinPoMtoIPeVaKLEgLpVkvg=
-golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ=
-golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
+golang.org/x/term v0.32.0 h1:DR4lr0TjUs3epypdhTOkMmuF5CDFJ/8pOnbzMZPQ7bg=
+golang.org/x/term v0.32.0/go.mod h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.zx2c4.com/wireguard v0.0.0-20220920152132-bb719d3a6e2c h1:Okh6a1xpnJslG9Mn84pId1Mn+Q8cvpo4HCeeFWHo0cA=
-golang.zx2c4.com/wireguard v0.0.0-20220920152132-bb719d3a6e2c/go.mod h1:enML0deDxY1ux+B6ANGiwtg0yAJi1rctkTpcHNAVPyg=
-golang.zx2c4.com/wireguard/wgctrl v0.0.0-20221104135756-97bc4ad4a1cb h1:9aqVcYEDHmSNb0uOWukxV5lHV09WqiSiCuhEgWNETLY=
-golang.zx2c4.com/wireguard/wgctrl v0.0.0-20221104135756-97bc4ad4a1cb/go.mod h1:mQqgjkW8GQQcJQsbBvK890TKqUK1DfKWkuBGbOkuMHQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb h1:whnFRlWMcXI9d+ZbWg+4sHnLp52d5yiIPUxMBSt4X9A=
+golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
+golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10 h1:3GDAcqdIg1ozBNLgPy4SLT84nfcBjr6rhGtXYtrkWLU=
+golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10/go.mod h1:T97yPqesLiNrOYxkwmhMI0ZIlJDm+p0PMR8eRVeR5tQ=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-novit.nc/direktil/pkg v0.0.0-20220221171542-fd3ce3a1491b/go.mod h1:zwTVO6U0tXFEaga73megQIBK7yVIKZJVePaIh/UtdfU=
-novit.tech/direktil/pkg v0.0.0-20230201224712-5e39572dc50e h1:eQFbzcuB4wOSrnOhkcN30hFDCIack40VkIoqVRbWnWc=
-novit.tech/direktil/pkg v0.0.0-20230201224712-5e39572dc50e/go.mod h1:2Mir5x1eT/e295WeFGzzXa4siunKX4z+rmNPfVsXS0k=
+novit.tech/direktil/pkg v0.0.0-20240415130406-0d2e181a4ed6 h1:D0TN5GyZ4d88ILpgVZgcZ62027lW8/LLnQSpQyN2yOw=
+novit.tech/direktil/pkg v0.0.0-20240415130406-0d2e181a4ed6/go.mod h1:zjezU6tELE880oYHs/WAauGBupKIEQQ7KqWTB69RW10=
--- a/1
+++ b/1
@ -0,0 +1 @@
+target/debug/init
--- a/losetup.go
+++ b/losetup.go
@ -0,0 +1,26 @@
+package main
+
+import (
+	"syscall"
+
+	"github.com/freddierice/go-losetup/v2"
+)
+
+var loDevices = map[string]losetup.Device{}
+
+func losetupAttach(file string) losetup.Device {
+	if _, ok := loDevices[file]; !ok {
+		dev, err := losetup.Attach(file, 0, true)
+		if err != nil {
+			fatalf("failed to attach %q to a loop device: %v", file, err)
+		}
+
+		loDevices[file] = dev
+	}
+	return loDevices[file]
+}
+
+func mountSquahfs(source, target string) {
+	dev := losetupAttach(source)
+	mount(dev.Path(), target, "squashfs", syscall.MS_RDONLY, "")
+}
--- a/lvm.go
+++ b/lvm.go
@ -3,15 +3,19 @@ package main
 import (
 	"bytes"
 	"io/fs"
-	"log"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"sort"
 	"strconv"
+	"syscall"
+
+	udev "github.com/jochenvg/go-udev"
+	"github.com/rs/zerolog/log"

-	"novit.nc/direktil/initrd/lvm"
 	config "novit.tech/direktil/pkg/bootstrapconfig"
+
+	"novit.tech/direktil/initrd/lvm"
 )

 func sortedKeys[T any](m map[string]T) (keys []string) {
@ -25,7 +29,7 @@ func sortedKeys[T any](m map[string]T) (keys []string) {

 func setupLVM(cfg *config.Config) {
 	if len(cfg.LVM) == 0 {
-		log.Print("no LVM VG configured.")
+		log.Info().Msg("no LVM VG configured.")
 		return
 	}

@ -75,53 +79,73 @@ func setupVG(vg config.LvmVG) {
 		}
 	}

+	log := log.With().Str("vg", vg.VG).Logger()
+
 	if devNeeded <= 0 {
-		log.Print("LVM VG ", vg.VG, " has all its devices")
+		log.Info().Msg("LVM VG has all its devices")
 		return
 	}

 	if vgExists {
-		log.Printf("LVM VG %s misses %d devices", vg.VG, devNeeded)
+		log.Info().Msgf("LVM VG misses %d devices", devNeeded)
 	} else {
-		log.Printf("LVM VG %s does not exists, creating", vg.VG)
+		log.Info().Msg("LVM VG does not exists, creating")
+	}
+
+	devNames := make([]NameAliases, 0)
+	{
+		devRefs := map[uint64]*NameAliases{}
+
+		enum := new(udev.Udev).NewEnumerate()
+		enum.AddMatchSubsystem("block")
+
+		devs, err := enum.Devices()
+		if err != nil {
+			fatal("udev enumeration failed")
+		}
+
+		for _, dev := range devs {
+			num := dev.Devnum()
+
+			n := dev.PropertyValue("DEVNAME")
+			idx := len(devNames)
+			devNames = append(devNames, nameAlias(n))
+
+			ref := uint64(num.Major())<<8 | uint64(num.Minor())
+			devRefs[ref] = &devNames[idx]
 		}

-	devNames := make([]string, 0)
 		err = filepath.Walk("/dev", func(n string, fi fs.FileInfo, err error) error {
 			if fi.Mode().Type() == os.ModeDevice {
-			devNames = append(devNames, n)
+				stat := fi.Sys().(*syscall.Stat_t)
+				ref := stat.Rdev
+				if na := devRefs[ref]; na != nil {
+					na.AddAlias(n)
+				}
 			}
 			return err
 		})
 		if err != nil {
 			fatalf("failed to walk /dev: %v", err)
 		}
+	}

-	devNames = filter(devNames, func(v string) bool {
-		for _, pv := range pvs.PVs() {
-			if v == pv.Name {
-				return false
+	for _, dev := range devNames {
+		log.Info().Str("name", dev.Name).Any("aliases", dev.Aliases).Msg("found block device")
 	}
-		}
-		return true
-	})

 	m := regexpSelectN(vg.PVs.N, vg.PVs.Regexps, devNames)
 	if len(m) == 0 {
-		log.Printf("no devices match the regexps %v", vg.PVs.Regexps)
-		for _, d := range devNames {
-			log.Print("- ", d)
-		}
-
+		log.Error().Strs("regexps", vg.PVs.Regexps).Msg("no device match the regexps")
 		fatalf("failed to setup VG %s", vg.VG)
 	}

 	if vgExists {
-		log.Print("- extending vg to ", m)
+		log.Info().Strs("devices", m).Msg("LVM VG: extending")
 		run("vgextend", append([]string{vg.VG}, m...)...)
 		devNeeded -= len(m)
 	} else {
-		log.Print("- creating vg with devices ", m)
+		log.Info().Strs("devices", m).Msg("LVM VG: creating")
 		run("vgcreate", append([]string{vg.VG}, m...)...)
 		devNeeded -= len(m)
 	}
@ -142,17 +166,17 @@ func setupLVs(vg config.LvmVG, createdDevs map[string]string) {

 	defaults := vg.Defaults

-	for _, lv := range vg.LVs {
-		lvKey := vg.VG + "/" + lv.Name
+	for idx, lv := range vg.LVs {
+		log := log.With().Str("vg", vg.VG).Str("lv", lv.Name).Logger()

 		if contains(lvs, func(v lvm.LV) bool {
 			return v.VGName == vg.VG && v.Name == lv.Name
 		}) {
-			log.Printf("LV %s exists", lvKey)
+			log.Info().Msg("LV exists")
 			continue
 		}

-		log.Printf("creating LV %s", lvKey)
+		log.Info().Msg("LV does not exist")

 		if lv.Raid == nil {
 			lv.Raid = defaults.Raid
@ -161,7 +185,7 @@ func setupLVs(vg config.LvmVG, createdDevs map[string]string) {
 		args := make([]string, 0)

 		if lv.Name == "" {
-			fatalf("LV has no name")
+			fatalf("LV[%d] has no name", idx)
 		}
 		args = append(args, vg.VG, "--name", lv.Name)

@ -184,7 +208,7 @@ func setupLVs(vg config.LvmVG, createdDevs map[string]string) {
 			}
 		}

-		log.Print("lvcreate args: ", args)
+		log.Info().Strs("args", args).Msg("LV: creating")
 		run("lvcreate", args...)

 		dev := "/dev/" + vg.VG + "/" + lv.Name
@ -212,6 +236,8 @@ func zeroDevStart(dev string) {
 	}
 }

+var cryptDevs = map[string]bool{}
+
 func setupCrypt(devSpecs []config.CryptDev, createdDevs map[string]string) {
 	var password []byte
 	passwordVerified := false
@ -245,8 +271,6 @@ func setupCrypt(devSpecs []config.CryptDev, createdDevs map[string]string) {
 		}
 	}

-	cryptDevs := map[string]bool{}
-
 	for _, devName := range devNames {
 		name, dev := devName.Name, devName.Dev

@ -286,12 +310,12 @@ func setupCrypt(devSpecs []config.CryptDev, createdDevs map[string]string) {
 				}

 				if !eq {
-					log.Print("passwords don't match")
+					log.Error().Msg("passwords don't match")
 					goto retry
 				}
 			}

-			log.Print("formatting encrypted device ", dev)
+			log.Info().Str("dev", dev).Msg("formatting encrypted device")
 			cmd := exec.Command("cryptsetup", "luksFormat", dev, "--key-file=-")
 			cmd.Stdin = bytes.NewBuffer(password)
 			cmd.Stdout = stdout
@ -312,7 +336,7 @@ func setupCrypt(devSpecs []config.CryptDev, createdDevs map[string]string) {
 			}
 		}

-		log.Print("openning encrypted device ", name, " from ", dev)
+		log.Info().Str("name", name).Str("dev", dev).Msg("openning encrypted device")
 		cmd := exec.Command("cryptsetup", "open", dev, name, "--key-file=-")
 		cmd.Stdin = bytes.NewBuffer(password)
 		cmd.Stdout = stdout
@ -364,7 +388,7 @@ func devInitialized(dev string) bool {

 func setupFS(dev, fs string) {
 	if devInitialized(dev) {
-		log.Print("device ", dev, " already formatted")
+		log.Info().Str("dev", dev).Msg("device already formatted")
 		return
 	}

@ -372,7 +396,7 @@ func setupFS(dev, fs string) {
 		fs = "ext4"
 	}

-	log.Print("formatting ", dev, " (", fs, ")")
+	log.Info().Str("dev", dev).Str("fs", fs).Msg("formatting device")
 	args := make([]string, 0)

 	switch fs {
--- a/main.go
+++ b/main.go
@ -3,7 +3,6 @@ package main
 import (
 	"fmt"
 	"io"
-	"log"
 	"os"
 	"os/exec"
 	"path/filepath"
@ -12,10 +11,12 @@ import (
 	"time"

 	"github.com/pkg/term/termios"
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
 	"golang.org/x/term"

-	"novit.nc/direktil/initrd/colorio"
-	"novit.nc/direktil/initrd/shio"
+	"novit.tech/direktil/initrd/colorio"
+	"novit.tech/direktil/initrd/shio"
 )

 const (
@ -41,29 +42,39 @@ func newPipe() (io.ReadCloser, io.WriteCloser) {
 }

 func main() {
+	log.Logger = log.Output(zerolog.ConsoleWriter{Out: os.Stderr})
+
+	registerInput(newTTY(os.Stdin.Fd()))
+
 	switch baseName := filepath.Base(os.Args[0]); baseName {
 	case "init":
 		runInit()
 	default:
-		log.Fatal("unknown sub-command: ", baseName)
+		log.Fatal().Msgf("unknown sub-command: %q", baseName)
 	}
 }

 func runInit() {
-	runtime.LockOSThread()
-
-	if pid := os.Getpid(); pid != 1 {
-		log.Fatal("init must be PID 1, not ", pid)
+	if len(os.Args) > 1 && os.Args[1] == "hello" {
+		fmt.Println("hello world!")
+		os.Exit(0)
 	}

+	runtime.LockOSThread()
+
 	// move log to shio
 	go io.Copy(os.Stdout, stdout.NewReader())
-	log.SetOutput(stderr)
+	log.Logger = log.Output(zerolog.ConsoleWriter{Out: stderr})
+
+	// check the PID is 1
+	if pid := os.Getpid(); pid != 1 {
+		log.Fatal().Int("pid", pid).Msg("init must be PID 1")
+	}

 	// copy os.Stdin to my stdin pipe
 	go io.Copy(stdinPipe, os.Stdin)

-	log.Print("Welcome to ", VERSION)
+	log.Info().Msg("Welcome to " + VERSION)

 	// essential mounts
 	mount("none", "/proc", "proc", 0, "")
@ -73,17 +84,14 @@ func runInit() {

 	// get the "boot version"
 	bootVersion = param("version", "current")
-	log.Printf("booting system %q", bootVersion)
+	log.Info().Msgf("booting system %q", bootVersion)

 	os.Setenv("PATH", "/usr/bin:/bin:/usr/sbin:/sbin")

 	_, err := os.Stat("/config.yaml")
 	if err != nil {
-		if os.IsNotExist(err) {
-			bootV1()
-			return
-		}
-		fatal("stat failed: ", err)
+		log.Error().Err(err).Msg("config not found")
+		fatal()
 	}

 	bootV2()
@ -102,19 +110,20 @@ func layerPath(name string) string {
 }

 func fatal(v ...interface{}) {
-	log.Print("*** FATAL ***")
-	log.Print(v...)
+	log.Error().Msg("*** FATAL ***")
+	log.Error().Msg(fmt.Sprint(v...))
 	die()
 }

 func fatalf(pattern string, v ...interface{}) {
-	log.Print("*** FATAL ***")
-	log.Printf(pattern, v...)
+	log.Error().Msg("*** FATAL ***")
+	log.Error().Msgf(pattern, v...)
 	die()
 }

 func die() {
-	log.SetOutput(os.Stderr)
+	log.Logger = log.Output(zerolog.ConsoleWriter{Out: os.Stderr})
+
 	stdout.Close()
 	stdin.Close()
 	stdinPipe.Close()
@ -133,13 +142,13 @@ mainLoop:
 		deadline := time.Now().Add(time.Minute)
 		os.Stdin.SetReadDeadline(deadline)

-		termios.Tcflush(os.Stdin.Fd(), termios.TCIFLUSH)
 		term.MakeRaw(int(os.Stdin.Fd()))
+		termios.Tcflush(os.Stdin.Fd(), termios.TCIFLUSH)

 		b := make([]byte, 1)
 		_, err := os.Stdin.Read(b)
 		if err != nil {
-			log.Print("failed to read from stdin: ", err)
+			log.Error().Err(err).Msg("failed to read from stdin")
 			time.Sleep(5 * time.Second)
 			syscall.Reboot(syscall.LINUX_REBOOT_CMD_RESTART)
 		}
@ -179,18 +188,14 @@ mainLoop:
 				}
 				continue mainLoop
 			}
-			log.Print("failed to find a shell!")
+			log.Error().Msg("failed to find a shell!")

 		default:
-			log.Printf("unknown choice: %q", string(b))
+			log.Error().Msgf("unknown choice: %q", string(b))
 		}
 	}
 }

-func losetup(dev, file string) {
-	run("/sbin/losetup", "-r", dev, file)
-}
-
 func run(cmd string, args ...string) {
 	if output, err := exec.Command(cmd, args...).CombinedOutput(); err != nil {
 		fatalf("command %s %q failed: %v\n%s", cmd, args, err, string(output))
@ -211,7 +216,7 @@ func mount(source, target, fstype string, flags uintptr, data string) {
 	if err := syscall.Mount(source, target, fstype, flags, data); err != nil {
 		fatalf("mount %q %q -t %q -o %q failed: %v", source, target, fstype, data, err)
 	}
-	log.Printf("mounted %q", target)
+	log.Info().Str("target", target).Msg("mounted")
 }

 func cp(srcPath, dstPath string) {
--- a/modd.conf
+++ b/modd.conf
@ -1,24 +1,14 @@
 modd.conf {}

-alpine/Dockerfile {
-  prep: docker build -t dkl-initrd alpine
-  prep: docker run --rm dkl-initrd | base64 -d >dist/base-initrd
+**/*.rs Cargo.* {
+  prep: cargo test
+  prep: cargo build
+  prep: debug/init-version
 }

-buildenv/Dockerfile {
-  prep: docker build -t dkl-initrd-build buildenv
-}
-
-go.??? **/*.go {
-  prep: go test ./...
-  prep: mkdir -p dist
-  prep: go build -o dist/ ./tools/...
-
-  prep: mkdir -p tmp/go tmp/.cache
-  prep: docker run --rm -v novit-go:/go -e GOCACHE=/go/.cache -v $PWD:/src -u $(id -u):$(id -g) dkl-initrd-build go build -o dist/init .
-}
-
-dist/init dist/base-initrd {
-  prep: cd dist && ../dist/cpiocat init <base-initrd >initrd.new
+target/debug/init Dockerfile {
+  prep: docker build --network host -t novit-initrd-gen .
+  prep: docker run --net=host --rm novit-initrd-gen |base64 -d >dist/initrd.new
  prep: mv dist/initrd.new dist/initrd
+  prep: ls -sh dist/initrd
 }
--- a/modd.test.conf
+++ b/modd.test.conf
@ -1,8 +1,10 @@
 modd.test.conf {}

-dist/initrd dist/cpiocat test-initrd/* {
+dist/initrd dist/cpiocat dist/testconf test-initrd/**/* {
+    prep: dist/testconf test-initrd/config.yaml
    prep: cp -f dist/initrd test-initrd.cpio
-    prep: cd test-initrd && ../dist/cpiocat <../dist/initrd >../test-initrd.cpio *
-    prep: if cpio -t -F test-initrd.cpio 2>&1 |grep bytes.of.junk; then echo "bad cpio archive"; exit 1; fi
+    prep: cd test-initrd && cat ../dist/initrd | ../dist/cpiocat * |lz4 -l9v >../test-initrd.cpio.new
+    prep: mv test-initrd.cpio.new test-initrd.cpio
+    prep: if lz4cat test-initrd.cpio | cpio -t 2>&1 |grep bytes.of.junk; then echo "bad cpio archive"; exit 1; fi
    prep: kill $(<qemu.pid)
 }
--- a/network.go
+++ b/network.go
@ -1,47 +1,58 @@
 package main

 import (
-	"log"
-	"net"
 	"os/exec"
 	"strings"

+	udev "github.com/jochenvg/go-udev"
+	"github.com/rs/zerolog/log"
+
 	config "novit.tech/direktil/pkg/bootstrapconfig"
 )

 func setupNetworks(cfg *config.Config) {
 	if len(cfg.Networks) == 0 {
-		log.Print("no networks configured.")
+		log.Info().Msg("no networks configured.")
 		return
 	}

-	ifNames := make([]string, 0)
-	{
-		ifaces, err := net.Interfaces()
-		if err != nil {
-			fatal("failed")
+	type Iface struct {
+		Name    string
+		AliasOf string
 	}
-		for _, iface := range ifaces {
-			ifNames = append(ifNames, iface.Name)
+
+	ifaces := make([]NameAliases, 0)
+	{
+		enum := new(udev.Udev).NewEnumerate()
+		enum.AddMatchSubsystem("net")
+
+		devs, err := enum.Devices()
+		if err != nil {
+			fatal("udev enumeration failed")
+		}
+
+		for _, dev := range devs {
+			iface := nameAliases(dev.Sysname(),
+				dev.PropertyValue("INTERFACE"),
+				dev.PropertyValue("ID_NET_NAME"),
+				dev.PropertyValue("ID_NET_NAME_PATH"),
+				dev.PropertyValue("ID_NET_NAME_MAC"),
+				dev.PropertyValue("ID_NET_NAME_SLOT"),
+			)
+			log.Info().Str("name", iface.Name).Any("aliases", iface.Aliases).Msg("found network device")
+			ifaces = append(ifaces, iface)
 		}
 	}

 	assigned := map[string]bool{}

 	for _, network := range cfg.Networks {
-		log.Print("setting up network ", network.Name)
+		log := log.With().Str("network", network.Name).Logger()
+		log.Info().Msg("setting up network")

-		// compute available names
-		if len(assigned) != 0 {
-			newNames := make([]string, 0, len(ifNames))
-			for _, n := range ifNames {
-				if assigned[n] {
-					continue
-				}
-				newNames = append(newNames, n)
-			}
-			ifNames = newNames
-		}
+		unassigned := filter(ifaces, func(iface NameAliases) bool {
+			return !assigned[iface.Name]
+		})

 		// assign envvars
 		envvars := make([]string, 0, 1+len(network.Interfaces))
@ -51,19 +62,20 @@ func setupNetworks(cfg *config.Config) {
 			envvar := new(strings.Builder)
 			envvar.WriteString(match.Var)
 			envvar.WriteByte('=')
+			for i, m := range regexpSelectN(match.N, match.Regexps, unassigned) {
+				assigned[m] = true

-			for i, m := range regexpSelectN(match.N, match.Regexps, ifNames) {
 				if i != 0 {
 					envvar.WriteByte(' ')
 				}
 				envvar.WriteString(m)
-				assigned[m] = true
 			}

-			log.Print("- ", envvar)
 			envvars = append(envvars, envvar.String())
 		}

+		log.Info().Strs("env", envvars).Msg("running script")
+
 		cmd := exec.Command("/bin/sh", "-c", network.Script)
 		cmd.Env = envvars
 		cmd.Stdout = stdout
--- a/regexp.go
+++ b/regexp.go
@ -1,36 +1,62 @@
 package main

 import (
-	"log"
 	"regexp"
+
+	"github.com/rs/zerolog/log"
 )

-func regexpSelectN(n int, regexps []string, names []string) (matches []string) {
-	if n <= 0 {
-		matches = make([]string, 0)
-	} else {
-		matches = make([]string, 0, n)
+type NameAliases struct {
+	Name    string
+	Aliases []string
 }

+func nameAlias(name string) NameAliases {
+	return NameAliases{Name: name, Aliases: []string{name}}
+}
+func nameAliases(name string, aliases ...string) NameAliases {
+	na := NameAliases{Name: name, Aliases: make([]string, 0, len(aliases)+1)}
+	na.Aliases = append(na.Aliases, name)
+	for _, alias := range aliases {
+		na.AddAlias(alias)
+	}
+
+	return na
+}
+func (na *NameAliases) AddAlias(alias string) {
+	if alias == "" {
+		return
+	}
+	if contains(na.Aliases, func(s string) bool { return s == alias }) {
+		return
+	}
+	na.Aliases = append(na.Aliases, alias)
+}
+
+func regexpSelectN(n int, regexps []string, nameAliases []NameAliases) (matches []string) {
+	matches = make([]string, 0)
+
 	res := make([]*regexp.Regexp, 0, len(regexps))
 	for _, reStr := range regexps {
 		re, err := regexp.Compile(reStr)
 		if err != nil {
-			log.Printf("warning: invalid regexp ignored: %q: %v", reStr, err)
+			log.Warn().Err(err).Str("regexp", reStr).Msg("invalid regexp, ignored")
 			continue
 		}
 		res = append(res, re)
 	}

-namesLoop:
-	for _, name := range names {
+nameAliasesLoop:
+	for _, item := range nameAliases {
 		if len(matches) == n {
 			break
 		}
 		for _, re := range res {
-			if re.MatchString(name) {
-				matches = append(matches, name)
-				continue namesLoop
+			for _, alias := range item.Aliases {
+				if re.MatchString(alias) {
+					matches = append(matches, item.Name)
+					continue nameAliasesLoop
+				}
 			}
 		}
 	}
--- a/2
+++ b/2
@ -0,0 +1,2 @@
+docker build -t nv-initrd-test -f Dockerfile.test empty
+docker run -d --name nv-initrd-test -it --privileged -v $PWD:/src --workdir /src/test-initrd nv-initrd-test
--- a/run-test.sh
+++ b/run-test.sh
@ -10,7 +10,8 @@ if ! [ -e $disk2 ]; then
    qemu-img create -f qcow2 $disk2 10G
 fi

-exec qemu-system-x86_64 -pidfile qemu.pid -kernel test-kernel -initrd test-initrd.cpio \
+exec qemu-system-x86_64 -pidfile qemu.pid \
+    -kernel test-kernel -initrd test-initrd.cpio \
    -smp 2 -m 2048 \
    -netdev bridge,br=novit,id=eth0 -device virtio-net-pci,netdev=eth0 \
    -drive file=$disk1,if=virtio \
--- a/shio/shio.go
+++ b/shio/shio.go
@ -5,7 +5,7 @@ import (
 	"io"
 	"sync"

-	"novit.nc/direktil/initrd/colorio"
+	"novit.tech/direktil/initrd/colorio"
 )

 type ShIO struct {
--- a/shio/shio_test.go
+++ b/shio/shio_test.go
@ -8,7 +8,7 @@ import (
 	"time"
 )

-func ExampleOutput() {
+func Example_output() {
 	done := false
 	defer func() { done = true }()
 	go func() {
--- a/src/blockdev.rs
+++ b/src/blockdev.rs
@ -0,0 +1,13 @@
+use tokio::fs;
+use tokio::io::{AsyncReadExt, Result};
+
+/// Checks if a block device is uninitialized.
+/// It assumed that a initialized device always has a non-zero byte in the first 8kiB.
+pub async fn is_uninitialized(dev_path: &str) -> Result<bool> {
+    let mut dev = fs::File::open(dev_path).await?;
+
+    let mut buf = [0u8; 8 << 10];
+    dev.read_exact(&mut buf).await?;
+
+    Ok(buf.into_iter().all(|b| b == 0))
+}
--- a/src/bootstrap.rs
+++ b/src/bootstrap.rs
@ -0,0 +1 @@
+pub mod config;
--- a/src/bootstrap/config.rs
+++ b/src/bootstrap/config.rs
@ -0,0 +1,209 @@
+pub const TAKE_ALL: i16 = -1;
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+pub struct Config {
+    pub anti_phishing_code: String,
+
+    pub keymap: Option<String>,
+    pub modules: Option<String>,
+
+    pub auths: Vec<Auth>,
+
+    pub networks: Vec<Network>,
+
+    #[serde(default)]
+    pub ssh: SSHServer,
+
+    #[serde(default)]
+    pub pre_lvm_crypt: Vec<CryptDev>,
+    #[serde(default)]
+    pub lvm: Vec<LvmVG>,
+    #[serde(default)]
+    pub crypt: Vec<CryptDev>,
+
+    pub bootstrap: Bootstrap,
+}
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+pub struct Auth {
+    pub name: String,
+    #[serde(rename = "sshKey")]
+    pub ssh_key: String,
+    pub password: String,
+}
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+pub struct Network {
+    pub name: String,
+    pub interfaces: Vec<NetworkInterface>,
+    pub script: String,
+}
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+pub struct NetworkInterface {
+    pub var: String,
+    pub n: i16,
+    pub regexps: Vec<String>,
+}
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+pub struct SSHServer {
+    pub listen: String,
+    pub keys: SSHKeys,
+}
+impl Default for SSHServer {
+    fn default() -> Self {
+        Self {
+            listen: "[::]:22".to_string(),
+            keys: SSHKeys::default(),
+        }
+    }
+}
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+pub struct SSHKeys {
+    dsa: Option<String>,
+    rsa: Option<String>,
+    ecdsa: Option<String>,
+    ed25519: Option<String>,
+}
+impl SSHKeys {
+    pub fn iter(&self) -> impl Iterator<Item = &str> {
+        [
+            self.dsa.iter(),
+            self.rsa.iter(),
+            self.ecdsa.iter(),
+            self.ed25519.iter(),
+        ]
+        .into_iter()
+        .flatten()
+        .map(String::as_str)
+    }
+}
+impl Default for SSHKeys {
+    fn default() -> Self {
+        Self {
+            dsa: Some("id_dsa".to_string()),
+            rsa: Some("id_rsa".to_string()),
+            ecdsa: Some("id_ecdsa".to_string()),
+            ed25519: Some("id_ed25519".to_string()),
+        }
+    }
+}
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+pub struct LvmVG {
+    #[serde(alias = "vg")]
+    pub name: String,
+    pub pvs: LvmPV,
+
+    #[serde(default)]
+    pub defaults: LvmLVDefaults,
+
+    pub lvs: Vec<LvmLV>,
+}
+
+#[derive(Debug, Default, serde::Deserialize, serde::Serialize)]
+pub struct LvmLVDefaults {
+    #[serde(default)]
+    pub fs: Filesystem,
+    #[serde(default)]
+    pub raid: Raid,
+}
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum Filesystem {
+    Ext4,
+    Xfs,
+    Btrfs,
+    Other(String),
+}
+
+impl Filesystem {
+    pub fn fstype(&self) -> &str {
+        use Filesystem as F;
+        match self {
+            F::Ext4 => "ext4",
+            F::Xfs => "xfs",
+            F::Btrfs => "btrfs",
+            F::Other(t) => t,
+        }
+    }
+}
+
+impl Default for Filesystem {
+    fn default() -> Self {
+        Filesystem::Ext4
+    }
+}
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+pub struct LvmLV {
+    pub name: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub fs: Option<Filesystem>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub raid: Option<Raid>,
+    #[serde(flatten)]
+    pub size: LvSize,
+}
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum LvSize {
+    Size(String),
+    Extents(String),
+}
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+pub struct LvmPV {
+    pub n: i16,
+    pub regexps: Vec<String>,
+}
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+pub struct CryptDev {
+    pub name: String,
+    #[serde(flatten)]
+    pub filter: DevFilter,
+    pub optional: Option<bool>,
+}
+impl CryptDev {
+    pub fn optional(&self) -> bool {
+        self.optional.unwrap_or_else(|| self.filter.is_prefix())
+    }
+}
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum DevFilter {
+    Dev(String),
+    Prefix(String),
+}
+impl DevFilter {
+    pub fn is_dev(&self) -> bool {
+        match self {
+            Self::Dev(_) => true,
+            _ => false,
+        }
+    }
+    pub fn is_prefix(&self) -> bool {
+        match self {
+            Self::Prefix(_) => true,
+            _ => false,
+        }
+    }
+}
+
+#[derive(Debug, Default, Clone, serde::Deserialize, serde::Serialize)]
+pub struct Raid {
+    pub mirrors: Option<u8>,
+    pub stripes: Option<u8>,
+}
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+pub struct Bootstrap {
+    pub dev: String,
+    pub seed: Option<String>,
+}
--- a/src/cmd.rs
+++ b/src/cmd.rs
@ -0,0 +1,5 @@
+pub mod bootstrap;
+pub mod connect_boot;
+pub mod init;
+pub mod init_input;
+pub mod version;
--- a/src/cmd/bootstrap.rs
+++ b/src/cmd/bootstrap.rs
--- a/src/cmd/connect_boot.rs
+++ b/src/cmd/connect_boot.rs
--- a/src/cmd/init.rs
+++ b/src/cmd/init.rs
@ -0,0 +1,271 @@
+use eyre::{format_err, Result};
+use log::{error, info, warn};
+use std::collections::BTreeSet as Set;
+use std::os::unix::fs::symlink;
+use tokio::sync::Mutex;
+use tokio::{fs, process::Command};
+
+use crate::{bootstrap::config::Config, cmd::version::version_string, dklog, input};
+
+mod bootstrap;
+mod dmcrypt;
+mod lvm;
+mod networks;
+mod sshd;
+
+// devices used by any block target (DM, LVM...)
+static USED_DEVS: Mutex<Set<String>> = Mutex::const_new(Set::new());
+
+pub async fn run() {
+    if std::process::id() != 1 {
+        error!("init must run as PID 1, not {}", std::process::id());
+        std::process::exit(1);
+    }
+
+    unsafe {
+        use std::env;
+        env::set_var("PATH", "/bin:/sbin:/usr/bin:/usr/sbin");
+        env::set_var("HOME", "/root");
+    }
+
+    info!("Welcome to {}", version_string());
+
+    let uname = nix::sys::utsname::uname().expect("uname should work");
+    let kernel_version = uname.release().to_string_lossy();
+    info!("Linux version {kernel_version}");
+
+    let cfg: Config = retry(async || {
+        let cfg = (fs::read("config.yaml").await)
+            .map_err(|e| format_err!("failed to read config: {e}"))?;
+        serde_yaml::from_slice(cfg.as_slice())
+            .map_err(|e| format_err!("failed to parse config: {e}"))
+    })
+    .await;
+
+    info!("config loaded");
+    info!("anti-phishing-code: {}", cfg.anti_phishing_code);
+
+    // seem to occasionaly race with Child::wait
+    // tokio::spawn(child_reaper());
+
+    // open input channels
+    tokio::spawn(crate::input::answer_requests_from_stdin());
+    tokio::spawn(crate::input::answer_requests_from_socket());
+
+    // mount basic filesystems
+    mount("none", "/proc", "proc", None).await;
+    mount("none", "/sys", "sysfs", None).await;
+    mount("none", "/dev", "devtmpfs", None).await;
+    mount("none", "/dev/pts", "devpts", Some("gid=5,mode=620")).await;
+
+    // mount modules
+    if let Some(ref modules) = cfg.modules {
+        retry_or_ignore(async || {
+            info!("mounting modules");
+            mount(modules, "/modules", "squashfs", None).await;
+
+            fs::create_dir_all("/lib/modules").await?;
+            let modules_path = &format!("/modules/lib/modules/{kernel_version}");
+
+            if !std::fs::exists(modules_path)? {
+                return Err(format_err!(
+                    "invalid modules package: {modules_path} should exist"
+                ));
+            }
+
+            symlink(modules_path, format!("/lib/modules/{kernel_version}"))?;
+            Ok(())
+        })
+        .await;
+    } else {
+        warn!("modules NOT mounted (not configured)");
+    }
+
+    // init devices
+    info!("initializing devices");
+    start_daemon("udevd", &[]).await;
+
+    exec("udevadm", &["trigger", "-c", "add", "-t", "devices"]).await;
+    exec("udevadm", &["trigger", "-c", "add", "-t", "subsystems"]).await;
+    exec("udevadm", &["settle"]).await;
+
+    // Wireguard VPN
+    // TODO startVPN()
+
+    // SSH service
+    sshd::start(&cfg).await;
+
+    // networks
+    networks::setup(&cfg).await;
+
+    // pre-lvm dmcrypt devs
+    dmcrypt::setup(&cfg.pre_lvm_crypt).await;
+
+    // LVM
+    lvm::setup(&cfg).await;
+
+    // post-lvm dmcrypt devs
+    dmcrypt::setup(&cfg.crypt).await;
+
+    // bootstrap the system
+    bootstrap::bootstrap(cfg).await;
+
+    // finalize
+    retry(async || switch_root("/system").await).await;
+}
+
+async fn switch_root(root: &str) -> Result<()> {
+    use std::ffi::CString;
+
+    macro_rules! c {
+        ($s:expr) => {
+            CString::new($s)?.as_c_str()
+        };
+    }
+
+    info!("switching root");
+    dklog::LOG.close().await;
+
+    nix::unistd::execv(
+        c!("/sbin/switch_root"),
+        &[
+            c!("switch_root"),
+            c!("-c"),
+            c!("/dev/console"),
+            c!(root),
+            c!("/sbin/init"),
+        ],
+    )?;
+    Ok(())
+}
+
+async fn mount(src: &str, dst: &str, fstype: &str, opts: Option<&str>) {
+    if let Err(e) = fs::create_dir_all(dst).await {
+        error!("failed to create dir {dst}: {e}");
+    }
+
+    match fstype {
+        "ext4" => {
+            exec("fsck", &["-p", src]).await;
+        }
+        _ => {}
+    }
+
+    let mut args = vec![src, dst];
+    if !fstype.is_empty() {
+        args.extend(&["-t", fstype]);
+    }
+    if let Some(opts) = opts {
+        args.extend(["-o", opts]);
+    }
+    exec("mount", &args).await;
+}
+
+async fn start_daemon(prog: &str, args: &[&str]) {
+    let (cmd_str, mut cmd) = cmd_str(prog, args);
+    retry_or_ignore(async || {
+        info!("starting as daemon: {cmd_str}");
+        cmd.spawn()?;
+        Ok(())
+    })
+    .await;
+}
+
+async fn try_exec(prog: &str, args: &[&str]) -> Result<()> {
+    let (cmd_str, mut cmd) = cmd_str(prog, args);
+    info!("# {cmd_str}");
+
+    let s = cmd.status().await?;
+    if s.success() {
+        Ok(())
+    } else {
+        Err(format_err!("command failed: {s}"))
+    }
+}
+
+async fn exec(prog: &str, args: &[&str]) {
+    retry_or_ignore(async || try_exec(prog, args).await).await;
+}
+
+async fn retry_or_ignore(mut action: impl AsyncFnMut() -> Result<()>) {
+    loop {
+        match action().await {
+            Ok(_) => return,
+            Err(e) => {
+                error!("{e}");
+
+                match input::read_choice(["[r]etry", "[i]gnore", "[s]hell"]).await {
+                    'r' => {}
+                    'i' => return,
+                    's' => exec_shell().await,
+                    _ => unreachable!(),
+                }
+            }
+        }
+    }
+}
+
+async fn retry<T>(mut action: impl AsyncFnMut() -> Result<T>) -> T {
+    loop {
+        match action().await {
+            Ok(v) => return v,
+            Err(e) => {
+                error!("{e}");
+
+                match input::read_choice(["[r]etry", "[s]hell"]).await {
+                    'r' => {}
+                    's' => exec_shell().await,
+                    _ => unreachable!(),
+                }
+            }
+        }
+    }
+}
+
+async fn exec_shell() {
+    let mut child = match Command::new("ash").spawn() {
+        Ok(c) => c,
+        Err(e) => {
+            error!("failed to exec shell: {e}");
+            return;
+        }
+    };
+
+    let _ = child.wait().await;
+}
+
+fn cmd_str(prog: &str, args: &[&str]) -> (String, Command) {
+    use std::borrow::Cow;
+
+    let mut buf = String::new();
+
+    buf.push_str(&shell_escape::escape(Cow::Borrowed(prog)));
+
+    for &arg in args {
+        buf.push(' ');
+        buf.push_str(&shell_escape::escape(Cow::Borrowed(arg)));
+    }
+
+    let mut cmd = Command::new(prog);
+    cmd.args(args);
+
+    (buf, cmd)
+}
+
+#[allow(unused)]
+async fn child_reaper() {
+    use nix::sys::wait::{waitpid, WaitPidFlag};
+    use nix::unistd::Pid;
+    use tokio::signal::unix::{signal, SignalKind};
+
+    let Ok(mut sigs) =
+        signal(SignalKind::child()).inspect_err(|e| warn!("failed to setup SIGCHLD handler: {e}"))
+    else {
+        return;
+    };
+
+    loop {
+        sigs.recv().await;
+        let _ = waitpid(Some(Pid::from_raw(-1)), Some(WaitPidFlag::WNOHANG));
+    }
+}
--- a/src/cmd/init/bootstrap.rs
+++ b/src/cmd/init/bootstrap.rs
@ -0,0 +1,310 @@
+use eyre::{format_err, Result};
+use log::{info, warn};
+use std::path::Path;
+use tokio::{
+    fs,
+    io::{AsyncBufReadExt, BufReader},
+};
+
+use super::{exec, mount, retry, retry_or_ignore, try_exec};
+use crate::bootstrap::config::Config;
+use crate::dkl;
+
+pub async fn bootstrap(cfg: Config) {
+    let bs = cfg.bootstrap;
+
+    retry_or_ignore(async || {
+        fs::create_dir_all("/boostrap").await?;
+        mount(&bs.dev, "/bootstrap", "auto", None).await;
+        Ok(())
+    })
+    .await;
+
+    let boot_version = "current"; // FIXME need to parse kernel cmdline
+    let base_dir = &format!("/bootstrap/{boot_version}");
+
+    retry_or_ignore(async || {
+        if !fs::try_exists(&base_dir).await? {
+            info!("creating {base_dir}");
+            fs::create_dir_all(&base_dir).await?
+        }
+        Ok(())
+    })
+    .await;
+
+    let sys_cfg: dkl::Config = retry(async || {
+        let sys_cfg_bytes = seed_config(base_dir, &bs.seed).await?;
+        Ok(serde_yaml::from_slice(&sys_cfg_bytes)?)
+    })
+    .await;
+
+    mount_system(&sys_cfg, base_dir).await;
+
+    retry_or_ignore(async || apply_files(&sys_cfg.files, "/system").await).await;
+
+    apply_groups(&sys_cfg.groups, "/system").await;
+    apply_users(&sys_cfg.users, "/system").await;
+
+    // TODO VPNs
+
+    mount_filesystems(&sys_cfg.mounts, "/system").await;
+
+    retry_or_ignore(async || {
+        info!("setting up root user");
+        setup_root_user(&sys_cfg.root_user, "/system").await
+    })
+    .await;
+}
+
+async fn seed_config(base_dir: &str, seed_url: &Option<String>) -> Result<Vec<u8>> {
+    let cfg_path = &format!("{base_dir}/config.yaml");
+
+    if fs::try_exists(cfg_path).await? {
+        return Ok(fs::read(cfg_path).await?);
+    }
+
+    let bs_tar = "/bootstrap.tar";
+    if !fs::try_exists(bs_tar).await? {
+        if let Some(seed_url) = seed_url.as_ref() {
+            fetch_bootstrap(seed_url, bs_tar).await?;
+        } else {
+            return Err(format_err!(
+                "no {cfg_path}, no {bs_tar} and no seed, can't bootstrap"
+            ));
+        }
+    }
+
+    try_exec("tar", &["xf", bs_tar, "-C", base_dir]).await?;
+
+    if !fs::try_exists(cfg_path).await? {
+        return Err(format_err!("{cfg_path} does not exist after seeding"));
+    }
+
+    Ok(fs::read(cfg_path).await?)
+}
+
+async fn fetch_bootstrap(seed_url: &str, output_file: &str) -> Result<()> {
+    let tmp_file = &format!("{output_file}.new");
+    let _ = fs::remove_file(tmp_file).await;
+    try_exec("wget", &["-O", tmp_file, seed_url]).await?;
+
+    fs::rename(tmp_file, output_file)
+        .await
+        .map_err(|e| format_err!("seed rename failed: {e}"))?;
+
+    Ok(())
+}
+
+async fn mount_system(cfg: &dkl::Config, bs_dir: &str) {
+    let mem_dir = "/mem";
+    mount("none", mem_dir, "tmpfs", Some("size=512m")).await;
+
+    let layers_dir = &format!("{mem_dir}/layers");
+    let mut lower_dir = String::new();
+
+    for layer in &cfg.layers {
+        let src = if layer == "modules" {
+            "/modules.sqfs"
+        } else {
+            &format!("{bs_dir}/{layer}.fs")
+        };
+        let tgt = &format!("{mem_dir}/{layer}.fs");
+        retry(async || {
+            info!("copying layer {layer} from {src}");
+            fs::copy(src, tgt).await?;
+            Ok(())
+        })
+        .await;
+
+        let layer_dir = &format!("{layers_dir}/{layer}");
+        mount(tgt, layer_dir, "squashfs", None).await;
+
+        if !lower_dir.is_empty() {
+            lower_dir.push(':');
+        }
+        lower_dir.push_str(&layer_dir);
+    }
+
+    let upper_dir = &format!("{mem_dir}/upper");
+    let work_dir = &format!("{mem_dir}/work");
+
+    retry_or_ignore(async || {
+        fs::create_dir_all(upper_dir).await?;
+        fs::create_dir_all(work_dir).await?;
+        Ok(())
+    })
+    .await;
+
+    mount(
+        "none",
+        "/system",
+        "overlay",
+        Some(&format!(
+            "lowerdir={lower_dir},upperdir={upper_dir},workdir={work_dir}"
+        )),
+    )
+    .await;
+
+    // make root rshared (default in systemd, required by Kubernetes 1.10+)
+    // equivalent to "mount --make-rshared /"
+    // see kernel's Documentation/sharedsubtree.txt (search rshared)
+    retry_or_ignore(async || {
+        use nix::mount::MsFlags as M;
+        const NONE: Option<&str> = None;
+        nix::mount::mount(NONE, "/system", NONE, M::MS_SHARED | M::MS_REC, NONE)?;
+        Ok(())
+    })
+    .await;
+}
+
+fn chroot(root: &str, path: &str) -> String {
+    format!("{root}/{}", path.trim_start_matches(|c| c == '/'))
+}
+
+async fn apply_files(files: &[dkl::File], root: &str) -> Result<()> {
+    for file in files {
+        let path = chroot(root, &file.path);
+        let path = Path::new(&path);
+
+        if let Some(parent) = path.parent() {
+            fs::create_dir_all(parent).await?;
+        }
+
+        use crate::dkl::FileKind as K;
+        match &file.kind {
+            K::Content(content) => fs::write(path, content.as_bytes()).await?,
+            K::Dir(true) => fs::create_dir(path).await?,
+            K::Dir(false) => {} // shouldn't happen, but semantic is to ignore
+            K::Symlink(tgt) => fs::symlink(tgt, path).await?,
+        }
+
+        match file.kind {
+            K::Symlink(_) => warn!("{}: can set perms on symlink", file.path),
+            _ => set_perms(path, file.mode).await?,
+        }
+
+        info!("created {}", file.path);
+    }
+
+    Ok(())
+}
+
+async fn set_perms(path: impl AsRef<Path>, mode: Option<u32>) -> std::io::Result<()> {
+    if let Some(mode) = mode.filter(|m| *m != 0) {
+        use std::os::unix::fs::PermissionsExt;
+        let mode = std::fs::Permissions::from_mode(mode);
+        fs::set_permissions(path, mode).await?;
+    }
+    Ok(())
+}
+
+async fn apply_groups(groups: &[dkl::Group], root: &str) {
+    for group in groups {
+        let mut args = vec![root, "groupadd", "-r"];
+
+        let gid = group.gid.map(|s| s.to_string());
+        if let Some(gid) = gid.as_ref() {
+            args.extend(&["-g", gid]);
+        }
+
+        args.push(group.name.as_str());
+
+        exec("chroot", &args).await;
+    }
+}
+
+async fn apply_users(users: &[dkl::User], root: &str) {
+    for user in users {
+        let mut args = vec![root, "useradd", "-r"];
+
+        let uid = user.uid.map(|s| s.to_string());
+        if let Some(uid) = uid.as_ref() {
+            args.extend(&["-u", uid]);
+        }
+        let gid = user.gid.map(|s| s.to_string());
+        if let Some(gid) = gid.as_ref() {
+            args.extend(&["-g", gid]);
+        }
+
+        args.push(user.name.as_str());
+
+        exec("chroot", &args).await;
+    }
+}
+
+async fn mount_filesystems(mounts: &[dkl::Mount], root: &str) {
+    for m in mounts {
+        let path = chroot(root, &m.path);
+
+        mount(
+            &m.dev,
+            &path,
+            m.r#type.as_ref().map_or("", |v| v.as_str()),
+            m.options
+                .as_ref()
+                .filter(|v| !v.is_empty())
+                .map(|s| s.as_str()),
+        )
+        .await;
+    }
+}
+
+async fn setup_root_user(user: &dkl::RootUser, root: &str) -> Result<()> {
+    if let Some(pw_hash) = user.password_hash.as_ref().filter(|v| !v.is_empty()) {
+        set_user_password("root", &pw_hash, root).await?;
+    }
+
+    let mut authorized_keys = Vec::new();
+    for ak in &user.authorized_keys {
+        authorized_keys.extend(ak.as_bytes());
+        authorized_keys.push(b'\n');
+    }
+
+    let ssh_dir = &chroot(root, "root/.ssh");
+    fs::create_dir_all(ssh_dir)
+        .await
+        .map_err(|e| format_err!("mkdir -p {ssh_dir} failed: {e}"))?;
+    set_perms(ssh_dir, Some(0o700))
+        .await
+        .map_err(|e| format_err!("chmod {ssh_dir} failed: {e}"))?;
+
+    let ak_path = &format!("{ssh_dir}/authorized_keys");
+    fs::write(ak_path, authorized_keys)
+        .await
+        .map_err(|e| format_err!("write {ak_path} failed: {e}"))?;
+
+    Ok(())
+}
+
+async fn set_user_password(user: &str, password_hash: &str, root: &str) -> Result<()> {
+    info!("setting password for {user}");
+
+    let user = user.as_bytes();
+    let password_hash = password_hash.as_bytes();
+
+    let mut buf = Vec::new();
+
+    let pw_file = &chroot(root, "etc/shadow");
+    let rd = fs::File::open(pw_file)
+        .await
+        .map_err(|e| format_err!("open {pw_file} failed: {e}"))?;
+    let mut rd = BufReader::new(rd);
+
+    let mut line = Vec::new();
+    while (rd.read_until(b'\n', &mut line).await)
+        .map_err(|e| format_err!("read {pw_file} failed: {e}"))?
+        != 0
+    {
+        let mut split: Vec<_> = line.split(|c| *c == b':').collect();
+        if split.len() > 2 && split[0] == user {
+            split[1] = password_hash;
+            buf.extend(split.join(&b':'));
+        } else {
+            buf.extend(&line);
+        }
+        line.clear();
+    }
+
+    fs::write(pw_file, buf).await?;
+    Ok(())
+}
--- a/src/cmd/init/dmcrypt.rs
+++ b/src/cmd/init/dmcrypt.rs
@ -0,0 +1,142 @@
+use eyre::{format_err, Result};
+use log::{error, info};
+use std::collections::BTreeSet as Set;
+use std::process::Stdio;
+use tokio::io::AsyncWriteExt;
+use tokio::process::Command;
+use tokio::sync::Mutex;
+
+use super::{retry_or_ignore, USED_DEVS};
+use crate::blockdev::is_uninitialized;
+use crate::bootstrap::config::{CryptDev, DevFilter};
+use crate::fs::walk_dir;
+use crate::input;
+
+pub async fn setup(devs: &[CryptDev]) {
+    if devs.is_empty() {
+        return;
+    }
+
+    let mut used_devs = USED_DEVS.lock().await;
+
+    // CryptDev.name that have a least one assignment done
+    let mut done = Set::new();
+
+    // dmcrypt devices opened here
+    let mut done_crypt = Set::new();
+
+    retry_or_ignore(async || {
+        let all_devs = walk_dir("/dev").await;
+
+        for dev in devs {
+            let mut mappings = find_dev(dev, &all_devs);
+            mappings.retain(|(_, dev_path)| !used_devs.contains(dev_path));
+
+            if mappings.is_empty() && !dev.optional() && !done.contains(&dev.name) {
+                return Err(format_err!("no device found for crypt dev {}", dev.name));
+            }
+
+            for (crypt_dev, dev_path) in mappings {
+                if done_crypt.contains(&crypt_dev) {
+                    continue;
+                }
+
+                info!("crypt dev {crypt_dev}: using {dev_path}");
+
+                crypt_open(&crypt_dev, &dev_path).await?;
+
+                done_crypt.insert(crypt_dev);
+                used_devs.insert(dev_path);
+                done.insert(&dev.name);
+            }
+        }
+
+        Ok(())
+    })
+    .await;
+}
+
+static PREV_PW: Mutex<String> = Mutex::const_new(String::new());
+
+async fn crypt_open(crypt_dev: &str, dev_path: &str) -> Result<()> {
+    'open_loop: loop {
+        let mut prev_pw = PREV_PW.lock().await;
+        let prompt = if prev_pw.is_empty() {
+            format!("crypt password for {crypt_dev}? ")
+        } else {
+            format!("crypt password for {crypt_dev} (enter = reuse previous)? ")
+        };
+
+        let mut pw = input::read_password(prompt).await;
+        if pw.is_empty() {
+            pw = prev_pw.clone();
+        }
+        if pw.is_empty() {
+            error!("empty password provided!");
+            continue;
+        }
+
+        *prev_pw = pw.clone();
+
+        if cryptsetup(&pw, ["open", dev_path, crypt_dev]).await? {
+            return Ok(());
+        }
+
+        error!("crypt open {crypt_dev} from {dev_path} failed");
+
+        if is_uninitialized(dev_path).await? {
+            // we can format the device
+            match input::read_choice(["[f]ormat", "[r]etry", "[i]gnore"]).await {
+                'r' => continue 'open_loop,
+                'i' => return Ok(()),
+                'f' => {
+                    if !cryptsetup(&pw, ["luksFormat", dev_path]).await? {
+                        return Err(format_err!("cryptsetup luksFormat failed"));
+                    }
+                    if !cryptsetup(&pw, ["open", dev_path, crypt_dev]).await? {
+                        return Err(format_err!("open after format failed"));
+                    }
+                    return Ok(());
+                }
+                _ => unreachable!(),
+            }
+        } else {
+            // device looks initialized, don't allow format
+            match input::read_choice(["[r]etry", "[i]gnore"]).await {
+                'r' => continue 'open_loop,
+                'i' => return Ok(()),
+                _ => unreachable!(),
+            }
+        }
+    }
+}
+
+async fn cryptsetup<const N: usize>(pw: &str, args: [&str; N]) -> Result<bool> {
+    let mut child = Command::new("cryptsetup")
+        .args(args)
+        .arg("--key-file=-")
+        .stdin(Stdio::piped())
+        .spawn()?;
+
+    (child.stdin.as_mut().unwrap())
+        .write_all(pw.as_bytes())
+        .await?;
+
+    Ok(child.wait().await?.success())
+}
+
+fn find_dev(dev: &CryptDev, all_devs: &[String]) -> Vec<(String, String)> {
+    let dev_name = &dev.name;
+    match dev.filter {
+        DevFilter::Dev(ref path) => (all_devs.iter())
+            .filter(|dev_path| dev_path == &path)
+            .map(|dev_path| (dev.name.clone(), dev_path.clone()))
+            .collect(),
+        DevFilter::Prefix(ref prefix) => (all_devs.iter())
+            .filter_map(|path| {
+                let suffix = path.strip_prefix(prefix)?;
+                Some((format!("{dev_name}{suffix}"), path.clone()))
+            })
+            .collect(),
+    }
+}
--- a/src/cmd/init/lvm.rs
+++ b/src/cmd/init/lvm.rs
@ -0,0 +1,208 @@
+use eyre::{format_err, Result};
+use log::{error, info};
+use tokio::process::Command;
+
+use super::{exec, retry, retry_or_ignore, USED_DEVS};
+use crate::bootstrap::config::{Config, Filesystem, LvSize, LvmLV, LvmVG, TAKE_ALL};
+use crate::fs::walk_dir;
+use crate::{blockdev, lvm};
+
+pub async fn setup(cfg: &Config) {
+    if cfg.lvm.is_empty() {
+        info!("no LVM VG configured");
+        return;
+    }
+
+    exec("pvscan", &[]).await;
+    exec("vgscan", &["--mknodes"]).await;
+
+    for vg in &cfg.lvm {
+        retry_or_ignore(async || setup_vg(vg).await).await
+    }
+
+    let lvs = retry(lvm::lvs).await;
+
+    for vg in &cfg.lvm {
+        let vg_name = vg.name.as_str();
+
+        for lv in &vg.lvs {
+            let lv_name = lv.name.as_str();
+
+            if (lvs.iter()).any(|lv| lv.equal_name(vg_name, lv_name)) {
+                info!("LVM LV {vg_name}/{lv_name} exists");
+            } else {
+                retry_or_ignore(async || setup_lv(&vg, &lv).await).await;
+            }
+        }
+    }
+
+    exec("vgchange", &["--sysinit", "-a", "ly"]).await;
+
+    for vg in &cfg.lvm {
+        for lv in &vg.lvs {
+            retry_or_ignore(async || format_lv(&vg, &lv).await).await;
+        }
+    }
+}
+
+async fn setup_vg(vg: &LvmVG) -> Result<()> {
+    let vg_name = vg.name.as_str();
+
+    let pvs = retry(lvm::pvs).await;
+
+    let mut dev_done = pvs.iter().filter(|pv| pv.vg_name == vg.name).count();
+    let dev_needed = vg.pvs.n;
+    macro_rules! missing_count {
+        () => {
+            (dev_needed as usize) - dev_done
+        };
+    }
+
+    if dev_needed == TAKE_ALL {
+        if dev_done == 0 {
+            info!("setting up LVM VG {vg_name} using all matching devices");
+        } else {
+            // in "take all" mode, don't extend as existing vg at boot
+            info!("LVM VG {vg_name} exists");
+            return Ok(());
+        }
+    } else if dev_done >= (dev_needed as usize) {
+        info!("LVM VG {vg_name} exists with enough devices");
+        return Ok(()); // already set up
+    } else {
+        info!("setting up LVM VG {vg_name} ({dev_done}/{dev_needed} devices configured)");
+    }
+
+    let regexps: Vec<regex::Regex> = (vg.pvs.regexps.iter())
+        .filter_map(|re_str| {
+            (re_str.parse())
+                .inspect_err(|e| error!("invalid regex ignored: {re_str:?}: {e}"))
+                .ok()
+        })
+        .collect();
+
+    let mut used_devs = USED_DEVS.lock().await;
+
+    let matching_devs = (walk_dir("/dev").await.into_iter())
+        .filter(|path| !used_devs.contains(path.as_str()))
+        .filter(|path| regexps.iter().any(|re| re.is_match(path)));
+
+    let devs: Vec<_> = if dev_needed == TAKE_ALL {
+        matching_devs.collect()
+    } else {
+        matching_devs.take(missing_count!()).collect()
+    };
+
+    let cmd = if dev_done == 0 {
+        "vgcreate"
+    } else {
+        "vgextend"
+    };
+    let status = (Command::new(cmd).arg(vg_name).args(&devs))
+        .status()
+        .await?;
+    if !status.success() {
+        return Err(format_err!("{cmd} failed: {status}"));
+    }
+
+    dev_done += devs.len();
+    used_devs.extend(devs);
+
+    if dev_needed != TAKE_ALL && dev_done < (dev_needed as usize) {
+        return Err(format_err!(
+            "LVM VG {vg_name} needs {} more device(s)",
+            missing_count!()
+        ));
+    }
+
+    Ok(())
+}
+
+async fn setup_lv(vg: &LvmVG, lv: &LvmLV) -> Result<()> {
+    let name = format!("{}/{}", vg.name, lv.name);
+    info!("creating LV {name}");
+
+    let mut cmd = Command::new("lvcreate");
+    cmd.arg(&vg.name);
+    cmd.args(&["--name", &lv.name]);
+
+    match &lv.size {
+        LvSize::Size(sz) => cmd.args(&["-L", sz]),
+        LvSize::Extents(sz) => cmd.args(&["-l", sz]),
+    };
+
+    let raid = lv.raid.as_ref().unwrap_or(&vg.defaults.raid);
+
+    if let Some(mirrors) = raid.mirrors {
+        cmd.args(&["--mirrors", &mirrors.to_string()]);
+    }
+    if let Some(stripes) = raid.stripes {
+        cmd.args(&["--stripes", &stripes.to_string()]);
+    }
+
+    let status = cmd.status().await?;
+    if !status.success() {
+        return Err(format_err!("lvcreate failed: {status}"));
+    }
+
+    Ok(())
+}
+
+async fn format_lv(vg: &LvmVG, lv: &LvmLV) -> Result<()> {
+    let name = &format!("{}/{}", vg.name, lv.name);
+    let dev = &format!("/dev/{name}");
+
+    if !blockdev::is_uninitialized(&dev).await? {
+        info!("{dev} looks initialized");
+        return Ok(());
+    }
+
+    let fs = lv.fs.as_ref().unwrap_or(&vg.defaults.fs);
+    info!("initializing {} filesystem on {dev}", fs.fstype());
+
+    let mkfs = format!("mkfs.{}", fs.fstype());
+
+    let mut cmd = Command::new(&mkfs);
+
+    // filesystem specific flags
+    match fs {
+        Filesystem::Ext4 => {
+            cmd.arg("-F");
+        }
+        Filesystem::Btrfs | Filesystem::Xfs => {
+            cmd.arg("-f");
+        }
+        &Filesystem::Other(_) => {}
+    }
+
+    cmd.arg(dev);
+
+    let mut child = match cmd.spawn() {
+        Ok(v) => v,
+        Err(e) => {
+            // try simple fixes
+            match fs {
+                Filesystem::Xfs => install_package("xfsprogs").await?,
+                Filesystem::Btrfs => install_package("btrs-progs").await?,
+                _ => Err(format_err!("{mkfs} failed: {e}"))?,
+            }
+            cmd.spawn().map_err(|e| format_err!("{mkfs} failed: {e}"))?
+        }
+    };
+
+    let status = child.wait().await?;
+    if !status.success() {
+        return Err(format_err!("{mkfs} failed: {status}"));
+    }
+
+    Ok(())
+}
+
+async fn install_package(pkg: &str) -> Result<()> {
+    let status = Command::new("apk").arg("add").arg(pkg).status().await?;
+    if status.success() {
+        Ok(())
+    } else {
+        Err(format_err!("failed to install package {pkg}: {status}"))
+    }
+}
--- a/src/cmd/init/networks.rs
+++ b/src/cmd/init/networks.rs
@ -0,0 +1,94 @@
+use itertools::Itertools;
+use log::{info, warn};
+use std::collections::BTreeSet as Set;
+use tokio::process::Command;
+
+use super::{format_err, retry_or_ignore, Config, Result};
+use crate::{
+    bootstrap::config,
+    udev,
+    utils::{select_n_by_regex, NameAliases},
+};
+
+pub async fn setup(cfg: &Config) {
+    if cfg.networks.is_empty() {
+        warn!("no networks configured");
+        return;
+    }
+
+    let mut assigned = Set::new();
+
+    for net in &cfg.networks {
+        retry_or_ignore(async || setup_network(net, &mut assigned).await).await;
+    }
+}
+
+async fn setup_network(net: &config::Network, assigned: &mut Set<String>) -> Result<()> {
+    info!("setting up network {}", net.name);
+
+    let netdevs = get_interfaces()?
+        .filter(|dev| !assigned.contains(dev.name()))
+        .collect::<Vec<_>>();
+
+    for dev in &netdevs {
+        info!(
+            "- available network device: {}, aliases [{}]",
+            dev.name(),
+            dev.aliases().join(", ")
+        );
+    }
+
+    let mut cmd = Command::new("ash");
+    cmd.arg("-c");
+    cmd.arg(&net.script);
+
+    let mut selected = Vec::new();
+
+    for iface in &net.interfaces {
+        let var = &iface.var;
+
+        let netdevs = netdevs.iter().filter(|na| !assigned.contains(na.name()));
+        let if_names = select_n_by_regex(iface.n, &iface.regexps, netdevs);
+
+        if if_names.is_empty() {
+            return Err(format_err!("- no interface match for {var:?}"));
+        }
+
+        let value = if_names.join(" ");
+        info!("- {var}={value}");
+        cmd.env(var, value);
+
+        selected.extend(if_names);
+    }
+
+    info!("- running script");
+    let status = cmd.status().await?;
+    if !status.success() {
+        return Err(format_err!("setup script failed: {status}"));
+    }
+
+    assigned.extend(selected);
+    Ok(())
+}
+
+fn get_interfaces() -> Result<impl Iterator<Item = NameAliases>> {
+    Ok(udev::get_devices("net")?.into_iter().map(|dev| {
+        let mut na = NameAliases::new(dev.sysname().to_string());
+
+        for (property, value) in dev.properties() {
+            if [
+                "INTERFACE",
+                "ID_NET_NAME",
+                "ID_NET_NAME_PATH",
+                "ID_NET_NAME_MAC",
+                "ID_NET_NAME_SLOT",
+            ]
+            .contains(&property)
+            {
+                na.push(value.to_string());
+            }
+        }
+
+        na
+    }))
+}
--- a/src/cmd/init/sshd.rs
+++ b/src/cmd/init/sshd.rs
@ -0,0 +1,91 @@
+use log::{info, warn};
+use std::fs;
+use std::io::Write;
+use std::os::unix::fs::PermissionsExt;
+use std::process::Stdio;
+use tokio::net;
+use tokio::process::Command;
+
+use super::{retry_or_ignore, Config};
+
+pub async fn start(cfg: &Config) {
+    retry_or_ignore(async || {
+        info!("ssh: writing authorized keys");
+
+        let ssh_dir = "/root/.ssh";
+        let authorized_keys = format!("{ssh_dir}/authorized_keys");
+
+        fs::create_dir_all(ssh_dir)?;
+        fs::set_permissions(ssh_dir, fs::Permissions::from_mode(0o700))?;
+
+        let mut ak = Vec::new();
+
+        for auth in &cfg.auths {
+            writeln!(ak, "{} {}", auth.ssh_key, auth.name)?;
+        }
+
+        fs::write(authorized_keys, ak)?;
+        Ok(())
+    })
+    .await;
+
+    retry_or_ignore(async || {
+        let mut sshd_args = Vec::new();
+
+        sshd_args.extend(["-i", "-E", "/var/log/sshd.log"]);
+
+        for key_path in cfg.ssh.keys.iter() {
+            if !fs::exists(key_path).is_ok_and(|b| b) {
+                info!("ssh: host key not found (ignored): {key_path}");
+                continue;
+            }
+            sshd_args.extend(["-h", key_path]);
+        }
+
+        let sshd_args = sshd_args.into_iter().map(String::from).collect();
+
+        // don't pre-start sshd as it should rarely be useful at this stage, use inetd-style.
+        let listen_addr = cfg.ssh.listen.clone();
+        info!("ssh: starting listener on {listen_addr}");
+
+        let listener = net::TcpListener::bind(listen_addr).await?;
+
+        tokio::spawn(handle_ssh_connections(listener, sshd_args));
+
+        Ok(())
+    })
+    .await;
+}
+
+async fn handle_ssh_connections(listener: net::TcpListener, sshd_args: Vec<String>) {
+    loop {
+        let (stream, remote) = match listener.accept().await {
+            Ok(v) => v,
+            Err(e) => {
+                warn!("ssh: listener stopped: {e}");
+                return;
+            }
+        };
+
+        info!("ssh: new connection from {remote}");
+
+        use std::os::unix::io::{AsRawFd, FromRawFd};
+        let fd = stream.as_raw_fd();
+
+        let mut cmd = Command::new("/usr/sbin/sshd");
+        cmd.args(&sshd_args);
+
+        cmd.stdin(unsafe { Stdio::from_raw_fd(fd) });
+        cmd.stdout(unsafe { Stdio::from_raw_fd(fd) });
+        cmd.stderr(Stdio::null());
+
+        match cmd.spawn() {
+            Ok(mut child) => {
+                tokio::spawn(async move { child.wait().await });
+            }
+            Err(e) => {
+                warn!("ssh: failed to start server: {e}");
+            }
+        }
+    }
+}
--- a/src/cmd/init_input.rs
+++ b/src/cmd/init_input.rs
@ -0,0 +1,11 @@
+use crate::input;
+
+pub async fn run() {
+    tokio::spawn(async {
+        if let Err(e) = input::forward_requests_from_socket().await {
+            eprintln!("failed to forwards requests from socket: {e}");
+            std::process::exit(1);
+        }
+    });
+    input::answer_requests_from_stdin().await;
+}
--- a/src/cmd/version.rs
+++ b/src/cmd/version.rs
@ -0,0 +1,12 @@
+pub fn run() {
+    println!("{}", version_string());
+}
+
+pub fn version_string() -> String {
+    format!(
+        "Direktil {} v{} (git commit {})",
+        env!("CARGO_PKG_NAME"),
+        env!("CARGO_PKG_VERSION"),
+        env!("GIT_COMMIT")
+    )
+}
--- a/src/dkl.rs
+++ b/src/dkl.rs
@ -0,0 +1,57 @@
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+pub struct Config {
+    pub layers: Vec<String>,
+    pub root_user: RootUser,
+    pub mounts: Vec<Mount>,
+    pub files: Vec<File>,
+    pub groups: Vec<Group>,
+    pub users: Vec<User>,
+}
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+pub struct RootUser {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub password_hash: Option<String>,
+    pub authorized_keys: Vec<String>,
+}
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+pub struct Mount {
+    pub r#type: Option<String>,
+    pub dev: String,
+    pub path: String,
+    pub options: Option<String>,
+}
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+pub struct Group {
+    pub name: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub gid: Option<u32>,
+}
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+pub struct User {
+    pub name: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub uid: Option<u32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub gid: Option<u32>,
+}
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+pub struct File {
+    pub path: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub mode: Option<u32>,
+    #[serde(flatten)]
+    pub kind: FileKind,
+}
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum FileKind {
+    Content(String),
+    Symlink(String),
+    Dir(bool),
+}
--- a/src/dklog.rs
+++ b/src/dklog.rs
@ -0,0 +1,136 @@
+use std::io::Write;
+use std::sync::{LazyLock, Mutex};
+use std::time::SystemTime;
+use tokio::sync::watch;
+use tokio::task::JoinSet;
+
+pub static LOG: LazyLock<Log> = LazyLock::new(Log::new);
+
+pub fn init() {
+    log::set_logger(&*LOG).expect("set_logger should not fail");
+    log::set_max_level(log::LevelFilter::Info);
+}
+
+pub struct Log {
+    start: SystemTime,
+    log: Mutex<Vec<u8>>,
+    tx: Mutex<Option<watch::Sender<usize>>>,
+    rx: watch::Receiver<usize>,
+    tasks: Mutex<Option<JoinSet<()>>>,
+}
+
+impl Log {
+    pub fn new() -> Self {
+        let (tx, rx) = watch::channel(0);
+        Self {
+            start: SystemTime::now(),
+            log: Mutex::new(Vec::new()),
+            tx: Mutex::new(Some(tx)),
+            rx,
+            tasks: Mutex::new(Some(JoinSet::new())),
+        }
+    }
+
+    pub fn spawn(&self, task: impl Future<Output = ()> + Send + 'static) {
+        if let Some(tasks) = self.tasks.lock().unwrap().as_mut() {
+            tasks.spawn(task);
+        }
+    }
+
+    pub fn subscribe(&self) -> LogWatch {
+        LogWatch {
+            log: self,
+            pos: 0,
+            rx: self.rx.clone(),
+        }
+    }
+
+    pub async fn copy_to<W: tokio::io::AsyncWrite + Unpin>(&self, mut out: W) {
+        let mut log = self.subscribe();
+        use tokio::io::AsyncWriteExt;
+        while let Some(chunk) = log.next().await {
+            let _ = out.write_all(&chunk).await;
+            let _ = out.flush().await;
+        }
+    }
+
+    pub async fn close(&self) {
+        self.tx.lock().unwrap().take();
+        if let Some(tasks) = self.tasks.lock().unwrap().take() {
+            tasks.join_all().await;
+        }
+    }
+}
+
+impl log::Log for Log {
+    fn enabled(&self, metadata: &log::Metadata) -> bool {
+        use log::Level::*;
+        match metadata.level() {
+            Trace | Debug => false,
+            Info | Warn | Error => true,
+        }
+    }
+
+    fn log(&self, record: &log::Record) {
+        if !self.enabled(record.metadata()) {
+            return;
+        }
+
+        let ts = self.start.elapsed().unwrap_or_default();
+
+        use log::Level::*;
+        let level = match record.level() {
+            Trace => "\x1b[2mTRC\x1b[0m",
+            Debug => "\x1b[34mDBG\x1b[0m",
+            Info => "\x1b[32mINF\x1b[0m",
+            Warn => "\x1b[93mWRN\x1b[0m",
+            Error => "\x1b[91mERR\x1b[0m",
+        };
+
+        let Ok(mut log) = self.log.lock() else {
+            return;
+        };
+
+        writeln!(
+            log,
+            "{:3}.{:03} {level} {}",
+            ts.as_secs(),
+            ts.subsec_millis(),
+            record.args()
+        )
+        .expect("write to buf should not fail");
+
+        if let Some(tx) = self.tx.lock().unwrap().as_mut() {
+            tx.send_replace(log.len());
+        }
+    }
+
+    fn flush(&self) {
+        // always flushed
+    }
+}
+
+pub struct LogWatch<'t> {
+    log: &'t Log,
+    pos: usize,
+    rx: watch::Receiver<usize>,
+}
+
+impl<'t> LogWatch<'t> {
+    pub async fn next(&mut self) -> Option<Vec<u8>> {
+        loop {
+            let new_pos = self.rx.borrow_and_update().clone();
+            if new_pos <= self.pos {
+                if self.rx.changed().await.is_err() {
+                    return None; // finished
+                }
+                continue;
+            }
+
+            let mut chunk = Vec::new();
+            chunk.extend(&self.log.log.lock().unwrap()[self.pos..new_pos]);
+            self.pos = new_pos;
+            return Some(chunk);
+        }
+    }
+}
--- a/src/fs.rs
+++ b/src/fs.rs
@ -0,0 +1,43 @@
+use log::warn;
+use std::io::Result;
+use tokio::fs;
+
+pub async fn walk_dir(dir: &str) -> Vec<String> {
+    let mut todo = Vec::new();
+    if let Ok(rd) = read_dir(dir).await {
+        todo.push(rd);
+    }
+
+    let mut results = Vec::new();
+
+    while let Some(rd) = todo.pop() {
+        for (path, is_dir) in rd {
+            if is_dir {
+                let Ok(child_rd) = (read_dir(&path).await)
+                    .inspect_err(|e| warn!("reading dir {path} failed: {e}"))
+                else {
+                    continue;
+                };
+                todo.push(child_rd);
+            } else {
+                results.push(path);
+            }
+        }
+    }
+
+    results
+}
+
+async fn read_dir(dir: &str) -> Result<Vec<(String, bool)>> {
+    let mut rd = fs::read_dir(dir).await?;
+    let mut entries = Vec::new();
+
+    while let Some(entry) = rd.next_entry().await? {
+        if let Some(path) = entry.path().to_str() {
+            entries.push((path.to_string(), entry.file_type().await?.is_dir()));
+        }
+    }
+
+    entries.sort(); // we want a deterministic & intuitive order
+    Ok(entries)
+}
--- a/src/input.rs
+++ b/src/input.rs
@ -0,0 +1,277 @@
+use log::warn;
+use std::fmt::Display;
+use std::sync::{Arc, LazyLock};
+use tokio::io::{self, AsyncBufReadExt, AsyncWriteExt, BufReader};
+use tokio::net;
+use tokio::sync::{oneshot, watch, Mutex};
+
+pub async fn read_line(prompt: impl Display) -> String {
+    read(prompt, false).await
+}
+
+pub async fn read_password(prompt: impl Display) -> String {
+    read(prompt, true).await
+}
+
+fn choice_char(s: &str) -> char {
+    s.chars().skip_while(|c| *c != '[').skip(1).next().unwrap()
+}
+
+#[test]
+fn test_choice_char() {
+    assert_eq!('r', choice_char("[r]etry"));
+    assert_eq!('b', choice_char("re[b]boot"));
+}
+
+/// ```no_run
+/// use init::input;
+///
+/// #[tokio::main(flavor = "current_thread")]
+/// async fn main() {
+///     tokio::spawn(input::answer_requests_from_stdin());
+///     match input::read_choice(["[r]etry","[i]gnore","re[b]oot"]).await {
+///         'r' => todo!(),
+///         'i' => todo!(),
+///         'b' => todo!(),
+///         _ => unreachable!(),
+///     }
+/// }
+/// ```
+pub async fn read_choice<const N: usize>(choices: [&str; N]) -> char {
+    let chars = choices.map(choice_char);
+
+    let mut prompt = String::new();
+    for s in choices {
+        if !prompt.is_empty() {
+            prompt.push_str(", ");
+        }
+        prompt.push_str(s);
+    }
+    prompt.push_str("? ");
+
+    loop {
+        let line = read_line(&prompt).await;
+        let Some(ch) = line.chars().nth(0) else {
+            continue;
+        };
+
+        for choice in chars {
+            if ch == choice {
+                return choice;
+            }
+        }
+    }
+}
+
+#[derive(Clone, serde::Deserialize, serde::Serialize)]
+pub struct InputRequest {
+    prompt: String,
+    hide: bool,
+}
+
+pub type Reply = Arc<Mutex<Option<oneshot::Sender<String>>>>;
+
+static REQ: LazyLock<Mutex<watch::Sender<Option<(InputRequest, Reply)>>>> = LazyLock::new(|| {
+    let (tx, _) = watch::channel(None);
+    Mutex::new(tx)
+});
+static READ_MUTEX: Mutex<()> = Mutex::const_new(());
+
+async fn read(prompt: impl Display, hide_input: bool) -> String {
+    let _read_lock = READ_MUTEX.lock();
+
+    let req = InputRequest {
+        prompt: prompt.to_string(),
+        hide: hide_input,
+    };
+
+    let (tx, rx) = oneshot::channel();
+    let reply = Arc::new(Mutex::new(Some(tx)));
+
+    REQ.lock().await.send_replace(Some((req, reply)));
+
+    let input = rx.await.expect("reply sender should not be closed");
+
+    REQ.lock().await.send_replace(None);
+
+    input
+}
+
+pub async fn answer_requests_from_stdin() {
+    let mut stdin = BufReader::new(io::stdin()).lines();
+    let mut stdout = io::stdout();
+
+    let mut current_req = REQ.lock().await.subscribe();
+    current_req.mark_changed();
+
+    loop {
+        // TODO check is stdin has been closed (using C-c is enough for now)
+        (current_req.changed().await).expect("input request should not close");
+
+        let Some((req, reply)) = current_req.borrow_and_update().clone() else {
+            continue;
+        };
+
+        // handle hide
+        let mut saved_termios = None;
+        if req.hide {
+            match termios::Termios::from_fd(0) {
+                Ok(mut tio) => {
+                    saved_termios = Some(tio.clone());
+                    tio.c_lflag &= !termios::ECHO;
+                    if let Err(e) = termios::tcsetattr(0, termios::TCSAFLUSH, &tio) {
+                        warn!("password may be echoed! {e}");
+                    }
+                }
+                Err(e) => {
+                    warn!("password may be echoed! {e}");
+                }
+            }
+        }
+
+        // print the prompt and wait for user input
+        stdout.write_all(req.prompt.as_bytes()).await.unwrap();
+        stdout.flush().await.unwrap();
+
+        tokio::select!(
+            r = stdin.next_line() => {
+                let Ok(Some(line)) = r else {
+                    warn!("stdin closed");
+                    return;
+                };
+
+                if let Some(tx) = reply.lock().await.take() {
+                    let _ = tx.send(line);
+                }
+
+                if saved_termios.is_some() {
+                    // final '\n' is hidden too so fix it
+                    stdout.write_all(b"\n").await.unwrap();
+                    stdout.flush().await.unwrap();
+                }
+            }
+            _ = current_req.changed() => {
+                // reply came from somewhere else
+                stdout.write_all(b"<answered>\n").await.unwrap();
+                stdout.flush().await.unwrap();
+
+                current_req.mark_changed();
+            }
+        );
+
+        // restore term if input was hidden
+        if let Some(tio) = saved_termios {
+            if let Err(e) = termios::tcsetattr(0, termios::TCSAFLUSH, &tio) {
+                warn!("failed to restore pty attrs: {e}");
+            }
+        }
+    }
+}
+
+const SOCKET_PATH: &str = "/run/init.sock";
+
+pub async fn answer_requests_from_socket() {
+    let Ok(listener) = net::UnixListener::bind(SOCKET_PATH)
+        .inspect_err(|e| warn!("failed start input socket listener: {e}"))
+    else {
+        return;
+    };
+
+    loop {
+        let Ok((conn, _)) = (listener.accept())
+            .await
+            .inspect_err(|e| warn!("input socket listener failed: {e}"))
+        else {
+            return;
+        };
+
+        tokio::spawn(handle_connection(conn));
+    }
+}
+
+async fn handle_connection(conn: net::UnixStream) {
+    let mut current_req = REQ.lock().await.subscribe();
+    current_req.mark_changed();
+
+    let (rd, mut wr) = io::split(conn);
+    let mut rd = BufReader::new(rd).lines();
+
+    loop {
+        (current_req.changed().await).expect("input request should not close");
+        let Some((req, reply)) = current_req.borrow_and_update().clone() else {
+            if wr.write_all(b"null\n").await.is_err() {
+                return;
+            }
+            if wr.flush().await.is_err() {
+                return;
+            }
+
+            continue;
+        };
+
+        {
+            let mut buf = serde_json::to_vec(&req).unwrap();
+            buf.push(b'\n');
+
+            if (wr.write_all(&buf).await).is_err() {
+                return;
+            }
+            if wr.flush().await.is_err() {
+                return;
+            }
+        }
+
+        tokio::select!(
+            r = rd.next_line() => {
+                let Ok(Some(line)) = r else {
+                    return; // closed
+                };
+
+                if let Some(tx) = reply.lock().await.take() {
+                    let _ = tx.send(line);
+                }
+            }
+            _ = current_req.changed() => {
+                // reply came from somewhere else
+                current_req.mark_changed();
+            }
+        );
+    }
+}
+
+pub async fn forward_requests_from_socket() -> eyre::Result<()> {
+    let stream = net::UnixStream::connect(SOCKET_PATH).await?;
+
+    let (rd, mut wr) = io::split(stream);
+    let mut rd = BufReader::new(rd).lines();
+
+    let mut line = rd.next_line().await?;
+
+    loop {
+        let Some(req) = line else {
+            return Ok(());
+        };
+
+        let req: Option<InputRequest> = serde_json::from_str(&req)?;
+
+        let Some(req) = req else {
+            // request answered from somewhere else
+            REQ.lock().await.send_replace(None);
+            line = rd.next_line().await?;
+            continue;
+        };
+
+        tokio::select!(
+            mut r = read(req.prompt, req.hide) => {
+                r.push('\n');
+                wr.write_all(r.as_bytes()).await?;
+                wr.flush().await?;
+
+                line = rd.next_line().await?;
+            }
+            l = rd.next_line() => {
+                line = l?;
+            }
+        );
+    }
+}
--- a/src/lib.rs
+++ b/src/lib.rs
@ -0,0 +1,11 @@
+pub mod bootstrap;
+pub mod cmd;
+pub mod lsblk;
+pub mod lvm;
+pub mod udev;
+pub mod utils;
+pub mod input;
+pub mod blockdev;
+pub mod fs;
+pub mod dkl;
+pub mod dklog;
--- a/src/lsblk.rs
+++ b/src/lsblk.rs
@ -0,0 +1,27 @@
+use std::io;
+use std::process::Command;
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+pub struct Report {
+    pub blockdevices: Vec<BlockDev>,
+}
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+pub struct BlockDev {
+    pub name: String,
+    #[serde(rename = "maj:min")]
+    pub maj_min: String,
+    pub rm: bool,
+    pub size: String,
+    pub ro: bool,
+    #[serde(rename = "type")]
+    pub dev_type: String,
+    pub mountpoints: Vec<Option<String>>,
+    #[serde(default)]
+    pub children: Vec<BlockDev>,
+}
+
+pub fn report() -> io::Result<Report> {
+    let output = Command::new("lsblk").arg("--json").output()?;
+    Ok(serde_json::from_slice(output.stdout.as_slice()).unwrap())
+}
--- a/src/lvm.rs
+++ b/src/lvm.rs
@ -0,0 +1,102 @@
+use eyre::{format_err, Result};
+use tokio::process::Command;
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+struct Report {
+    report: Vec<ReportObj>,
+}
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+enum ReportObj {
+    #[serde(rename = "pv")]
+    PV(Vec<PV>),
+    #[serde(rename = "vg")]
+    VG(Vec<VG>),
+    #[serde(rename = "lv")]
+    LV(Vec<LV>),
+}
+
+#[derive(Debug, Clone, serde::Deserialize, serde::Serialize)]
+pub struct PV {
+    pub pv_name: String,
+    pub vg_name: String,
+    pub pv_fmt: String,
+    pub pv_attr: String,
+    pub pv_size: String,
+    pub pv_free: String,
+}
+
+#[derive(Debug, Clone, serde::Deserialize, serde::Serialize)]
+pub struct VG {
+    pub vg_name: String,
+    pub pv_count: String,
+    pub lv_count: String,
+    pub snap_count: String,
+    pub vg_attr: String,
+    pub vg_size: String,
+    pub vg_free: String,
+}
+
+#[derive(Debug, Clone, serde::Deserialize, serde::Serialize)]
+pub struct LV {
+    pub lv_name: String,
+    pub vg_name: String,
+    pub lv_attr: String,
+    pub lv_size: String,
+    pub pool_lv: String,
+    pub origin: String,
+    pub data_percent: String,
+    pub metadata_percent: String,
+    pub move_pv: String,
+    pub mirror_log: String,
+    pub copy_percent: String,
+    pub convert_lv: String,
+}
+
+impl LV {
+    pub fn equal_name(&self, vg_name: &str, lv_name: &str) -> bool {
+        vg_name == &self.vg_name && lv_name == &self.lv_name
+    }
+}
+
+pub async fn pvs() -> Result<Vec<PV>> {
+    report_cmd("pvs", |o| match o {
+        ReportObj::PV(pv) => Some(pv),
+        _ => None,
+    })
+    .await
+}
+
+pub async fn vgs() -> Result<Vec<VG>> {
+    report_cmd("vgs", |o| match o {
+        ReportObj::VG(vg) => Some(vg),
+        _ => None,
+    })
+    .await
+}
+
+pub async fn lvs() -> Result<Vec<LV>> {
+    report_cmd("lvs", |o| match o {
+        ReportObj::LV(lv) => Some(lv),
+        _ => None,
+    })
+    .await
+}
+
+async fn report_cmd<T>(cmd: &str, find: fn(ReportObj) -> Option<Vec<T>>) -> Result<Vec<T>> {
+    let output = Command::new(cmd)
+        .arg("--reportformat=json")
+        .output()
+        .await?;
+
+    if !output.status.success() {
+        let stderr = String::from_utf8_lossy(&output.stderr.trim_ascii());
+        return Err(format_err!("{cmd} failed: {}", stderr));
+    }
+
+    let report: Report = serde_json::from_slice(&output.stdout).unwrap();
+    Ok((report.report.into_iter())
+        .filter_map(find)
+        .flatten()
+        .collect())
+}
--- a/src/main.rs
+++ b/src/main.rs
@ -0,0 +1,42 @@
+use eyre::Result;
+use log::warn;
+use std::env;
+use std::process::exit;
+
+use init::cmd;
+use init::dklog;
+
+#[tokio::main(flavor = "current_thread")]
+async fn main() -> Result<()> {
+    dklog::LOG.spawn(dklog::LOG.copy_to(tokio::io::stderr()));
+
+    dklog::init();
+
+    let call_name = env::args().next().unwrap_or("init".into());
+    let call_name = (call_name.rsplit_once('/').map(|(_, n)| n)).unwrap_or(call_name.as_str());
+
+    if call_name == "init" {
+        dklog::LOG.spawn(async {
+            let Ok(log_file) = (tokio::fs::File::create("/var/log/init.log").await)
+                .inspect_err(|e| warn!("failed to open init.log: {e}"))
+            else {
+                return;
+            };
+            dklog::LOG.copy_to(log_file).await;
+        });
+    }
+
+    match call_name {
+        "init" => cmd::init::run().await,
+        "init-version" => cmd::version::run(),
+        "init-connect" => cmd::init_input::run().await,
+
+        _ => {
+            eprintln!("invalid call name: {call_name:?}");
+            exit(1);
+        }
+    };
+
+    dklog::LOG.close().await;
+    Ok(())
+}
--- a/src/udev.rs
+++ b/src/udev.rs
@ -0,0 +1,65 @@
+use eyre::Result;
+use log::error;
+
+pub struct Device {
+    sysname: String,
+    output: String,
+}
+
+impl Device {
+    pub fn sysname(&self) -> &str {
+        self.sysname.as_str()
+    }
+
+    pub fn properties(&self) -> impl Iterator<Item = (&str, &str)> {
+        self.output
+            .lines()
+            .filter_map(|line| line.strip_prefix("E: ")?.split_once('='))
+    }
+}
+
+pub fn get_devices(class: &str) -> Result<Vec<Device>> {
+    let mut devices = Vec::new();
+
+    // none of libudev and udev crates were able to list network devices.
+    // falling back to manual sysfs scanning :(
+    //
+    // Even when given a syspath,
+    // - udev crate failed to see all properties;
+    // - libudev crate segfaulted on the second property (SYSNUM ok, then segfault).
+    // falling back to parsing udevadm output :(
+    //
+    // The best fix would be to check what's wrong with udev crate.
+
+    let entries = std::fs::read_dir(format!("/sys/class/{class}"))?;
+    for entry in entries {
+        let Ok(entry) = entry else {
+            continue;
+        };
+
+        let path = entry.path();
+        let path = path.to_string_lossy();
+
+        let output = std::process::Command::new("udevadm")
+            .args(&["info", &format!("--path={path}")])
+            .stderr(std::process::Stdio::piped())
+            .output()?;
+
+        if !output.status.success() {
+            error!("udevadm fail for {path}");
+            continue;
+        }
+
+        let output = String::from_utf8_lossy(&output.stdout);
+
+        let name = entry.file_name();
+        let dev = Device {
+            sysname: name.to_string_lossy().to_string(),
+            output: output.into_owned(),
+        };
+
+        devices.push(dev);
+    }
+
+    Ok(devices)
+}
--- a/src/utils.rs
+++ b/src/utils.rs
@ -0,0 +1,61 @@
+use log::error;
+use std::collections::BTreeSet as Set;
+
+pub struct NameAliases {
+    name: String,
+    aliases: Set<String>,
+}
+
+impl NameAliases {
+    pub fn new(name: String) -> Self {
+        Self {
+            name,
+            aliases: Set::new(),
+        }
+    }
+
+    pub fn name(&self) -> &str {
+        self.name.as_str()
+    }
+    pub fn aliases(&self) -> impl Iterator<Item = &str> {
+        self.aliases.iter().map(|s| s.as_str())
+    }
+
+    pub fn iter(&self) -> impl Iterator<Item = &str> {
+        std::iter::once(self.name()).chain(self.aliases())
+    }
+
+    pub fn push(&mut self, alias: String) {
+        if self.name == alias {
+            return;
+        }
+        self.aliases.insert(alias);
+    }
+}
+
+pub fn select_n_by_regex<'t>(
+    n: i16,
+    regexs: &Vec<String>,
+    nas: impl Iterator<Item = &'t NameAliases>,
+) -> Vec<String> {
+    // compile regexs
+    let regexs: Vec<_> = (regexs.iter())
+        .filter_map(|re| {
+            regex::Regex::new(re)
+                .inspect_err(|e| error!("invalid regex ignored: {re:?}: {e}"))
+                .ok()
+        })
+        .collect();
+
+    let matching = |name| regexs.iter().any(|re| re.is_match(name));
+
+    let nas = nas
+        .filter(|na| na.iter().any(matching))
+        .map(|na| na.name().to_string());
+
+    if n == -1 {
+        nas.collect()
+    } else {
+        nas.take(n as usize).collect()
+    }
+}
--- a/ssh.go
+++ b/ssh.go
@ -4,15 +4,16 @@ import (
 	"encoding/binary"
 	"fmt"
 	"io"
-	"log"
 	"net"
 	"os"
 	"os/exec"
 	"sync"
 	"syscall"
+	"time"
 	"unsafe"

-	"github.com/kr/pty"
+	"github.com/creack/pty"
+	"github.com/rs/zerolog/log"
 	"golang.org/x/crypto/ssh"

 	config "novit.tech/direktil/pkg/bootstrapconfig"
@ -23,17 +24,32 @@ func startSSH(cfg *config.Config) {
 		PublicKeyCallback: sshCheckPubkey,
 	}

-	pkBytes, err := os.ReadFile("/id_rsa") // TODO configurable
+	hostKeyLoaded := false
+
+	for _, format := range []string{"rsa", "dsa", "ecdsa", "ed25519"} {
+		log := log.With().Str("format", format).Logger()
+
+		pkBytes, err := os.ReadFile("/id_" + format)
 		if err != nil {
-		fatalf("ssh: failed to load private key: %v", err)
+			log.Error().Err(err).Msg("ssh: failed to load host key")
+			continue
 		}

 		pk, err := ssh.ParsePrivateKey(pkBytes)
 		if err != nil {
-		fatalf("ssh: failed to parse private key: %v", err)
+			log.Error().Err(err).Msg("ssh: failed to parse host key")
+			continue
 		}

 		sshConfig.AddHostKey(pk)
+		hostKeyLoaded = true
+
+		log.Info().Msg("ssh: loaded host key")
+	}
+
+	if !hostKeyLoaded {
+		fatalf("ssh: failed to load any host key")
+	}

 	sshBind := ":22" // TODO configurable
 	listener, err := net.Listen("tcp", sshBind)
@ -41,13 +57,13 @@ func startSSH(cfg *config.Config) {
 		fatalf("ssh: failed to listen on %s: %v", sshBind, err)
 	}

-	log.Print("SSH server listening on ", sshBind)
+	log.Info().Str("bind-address", sshBind).Msg("SSH server listening")

 	go func() {
 		for {
 			conn, err := listener.Accept()
 			if err != nil {
-				log.Print("ssh: accept conn failed: ", err)
+				log.Info().Err(err).Msg("ssh: accept conn failed")
 				continue
 			}

@ -60,12 +76,12 @@ func sshHandleConn(conn net.Conn, sshConfig *ssh.ServerConfig) {
 	sshConn, chans, reqs, err := ssh.NewServerConn(conn, sshConfig)

 	if err != nil {
-		log.Print("ssh: handshake failed: ", err)
+		log.Error().Err(err).Msg("ssh: handshake failed")
 		return
 	}

 	remoteAddr := sshConn.User() + "@" + sshConn.RemoteAddr().String()
-	log.Print("ssh: new connection from ", remoteAddr)
+	log.Info().Str("remote", remoteAddr).Msg("ssh: new connection")

 	go sshHandleReqs(reqs)
 	go sshHandleChannels(remoteAddr, chans)
@ -78,7 +94,7 @@ func sshHandleReqs(reqs <-chan *ssh.Request) {
 			req.Reply(true, nil)

 		default:
-			log.Printf("ssh: discarding req: %+v", req)
+			log.Info().Str("type", req.Type).Msg("ssh: discarding request")
 			req.Reply(false, nil)
 		}
 	}
@ -93,7 +109,7 @@ func sshHandleChannels(remoteAddr string, chans <-chan ssh.NewChannel) {

 		channel, requests, err := newChannel.Accept()
 		if err != nil {
-			log.Print("ssh: failed to accept channel: ", err)
+			log.Error().Err(err).Msg("ssh: failed to accept channel")
 			continue
 		}

@ -127,7 +143,10 @@ func sshHandleChannel(remoteAddr string, channel ssh.Channel, requests <-chan *s
 			command := string(req.Payload[4 : req.Payload[3]+4])
 			switch command {
 			case "init":
+				if ptyF == nil {
 					go func() {
+						channel.Stderr().Write([]byte("\033[5m\033[31;1m\n\nWARNING: no TTY requested, passwords will be echoed!\n\n\033[0m"))
+						time.Sleep(3 * time.Second)
 						io.Copy(channel, stdout.NewReader())
 						once.Do(closeCh)
 					}()
@ -136,6 +155,24 @@ func sshHandleChannel(remoteAddr string, channel ssh.Channel, requests <-chan *s
 						once.Do(closeCh)
 					}()

+				} else {
+					stdinTTY := newTTY(ptyF.Fd())
+					if askingSecret.Load() {
+						stdinTTY.EchoOff()
+					}
+					registerInput(stdinTTY)
+					defer unregiterInput(stdinTTY)
+
+					go func() {
+						io.Copy(ttyF, stdout.NewReader())
+						once.Do(closeCh)
+					}()
+					go func() {
+						io.Copy(stdinPipe, ttyF)
+						once.Do(closeCh)
+					}()
+				}
+
 				req.Reply(true, nil)

 			case "bootstrap":
@ -180,15 +217,6 @@ func sshHandleChannel(remoteAddr string, channel ssh.Channel, requests <-chan *s
 				ttyF = nil
 			}()

-			go func() {
-				io.Copy(channel, ptyF)
-				once.Do(closeCh)
-			}()
-			go func() {
-				io.Copy(ptyF, channel)
-				once.Do(closeCh)
-			}()
-
 			req.Reply(true, nil)

 		case "pty-req":
@ -200,7 +228,7 @@ func sshHandleChannel(remoteAddr string, channel ssh.Channel, requests <-chan *s
 			var err error
 			ptyF, ttyF, err = pty.Open()
 			if err != nil {
-				log.Print("PTY err: ", err)
+				log.Error().Err(err).Msg("ssh: PTY open failed")
 				req.Reply(false, nil)
 				continue
 			}
@ -212,6 +240,15 @@ func sshHandleChannel(remoteAddr string, channel ssh.Channel, requests <-chan *s

 			req.Reply(true, nil)

+			go func() {
+				io.Copy(channel, ptyF)
+				once.Do(closeCh)
+			}()
+			go func() {
+				io.Copy(ptyF, channel)
+				once.Do(closeCh)
+			}()
+
 		case "window-change":
 			w, h := sshParseDims(req.Payload)
 			sshSetWinsize(ptyF.Fd(), w, h)
--- a/test-initrd/config.yaml
+++ b/test-initrd/config.yaml
@ -26,20 +26,27 @@ networks:
    - eno.*
    - enp.*
  script: |
-    ip a add 2001:41d0:306:168f::1337:2eed/64 dev $iface
    ip li set $iface up
-    #udhcpc $iface
+    udhcpc -i $iface -b -t1 -T1 -A5 ||
+    ip a add 2001:41d0:306:168f::1337:2eed/64 dev $iface
+
+pre_lvm_crypt:
+- dev: /dev/vda
+  name: sys0
+- dev: /dev/vdb
+  name: sys1

 lvm:
 - vg: storage
  pvs:
    n: 2
    regexps:
+    - /dev/mapper/sys[01]
    # to match full disks
-    - /dev/nvme[0-9]+n[0-9]+
-    - /dev/vd[a-z]+
-    - /dev/sd[a-z]+
-    - /dev/hd[a-z]+
+    #- /dev/nvme[0-9]+n[0-9]+
+    #- /dev/vd[a-z]+
+    #- /dev/sd[a-z]+
+    #- /dev/hd[a-z]+
    # to match partitions:
    #- /dev/nvme[0-9]+n[0-9]+p[0-9]+
    #- /dev/vd[a-z]+[0-9]+
@ -67,12 +74,13 @@ lvm:
    extents: 100%FREE
    # size: 10g

-crypt:
- dev: /dev/storage/bootstrap
- dev: /dev/storage/dls
+#crypt:
+#- dev: /dev/storage/bootstrap
+#- dev: /dev/storage/dls

 bootstrap:
-  dev: /dev/mapper/bootstrap
+  #dev: /dev/mapper/bootstrap
+  dev: /dev/storage/bootstrap
  # TODO seed: https://direktil.novit.io/bootstraps/dls-crypt
  seed: http://192.168.10.254:7606/hosts/m1/bootstrap.tar
  # TODO seed_sign_key: "..."
--- a/test-initrd/id_ecdsa
+++ b/test-initrd/id_ecdsa
@ -0,0 +1,9 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS
+1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQSlevO48OA0/yB8zTP1naijVU3wsB0c
+4s6Jc/8y7YwNq51/SlieeGeRFcCSke5Z67rNX2JFiv+tsGQB6TczZm/6AAAAqDU5b2c1OW
+9nAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKV687jw4DT/IHzN
+M/WdqKNVTfCwHRzizolz/zLtjA2rnX9KWJ54Z5EVwJKR7lnrus1fYkWK/62wZAHpNzNmb/
+oAAAAhANenGXlP1ZPgcyb/+O57MbpGDOZS4e7UNiyvkD8I3hNnAAAACW53cmtAbndyawEC
+AwQFBg==
+-----END OPENSSH PRIVATE KEY-----
--- a/test-initrd/id_ed25519
+++ b/test-initrd/id_ed25519
@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACCCMX0zm3Fi7vXWevHuJvzU30l5F06NAC2qloUewVSoDQAAAJDnq/y456v8
+uAAAAAtzc2gtZWQyNTUxOQAAACCCMX0zm3Fi7vXWevHuJvzU30l5F06NAC2qloUewVSoDQ
+AAAEDXYq507MsjSN34Qw87guf3d5D4Dt2IrF788CeBcYSNe4IxfTObcWLu9dZ68e4m/NTf
+SXkXTo0ALaqWhR7BVKgNAAAACW53cmtAbndyawECAwQ=
+-----END OPENSSH PRIVATE KEY-----
--- a/test-initrd/id_rsa.pub
+++ b/test-initrd/id_rsa.pub
@ -1 +0,0 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDLo+mv+0GJViwFiK14bAw8j4HYFIGf4I/fpmIqzHohf70TT+cYqAKSHBYV+uYjNLYQib6Ii/thPexeypw73pq7Z7CHvubnFQUiuqJ7lzXeV4146f5eHL76/TvTmKthS4FVFta6SlCOE6unR6q8HM52VSijavtoX3musxugCwhaHmBNOdUJcNIRCIey8QaOztPK05dDrOZhMQJgSST/BRaNrtY0/xRmJo+5TbQeyjyDuQdK2EoS51QMWzsT/LH6drQBgKd8RRHqjEhscfaV2CmdfuVO/liEdW82epMgFCGYtMetP/rs3bPkC90ULxPZSytaz7d5ux1dvSgrPHzX4306k/GP3d6EvOedy4IKAB53J7lebvrRI5pTVPZvd/RsSGGxUIwjf2Y8TF5nbC2d2D5Oauqfevn29veIRh8mq+AsJMnkvUFwVRN+6WDsZ+F82+AGaCKJFNQLYbRKtXW0zzi+wTsnLJNwlpevRf61SCxehSqeVfnc4TDsAGyRa9nSbR8= test@novit.io
--- a/test-initrd/modules.sqfs
+++ b/test-initrd/modules.sqfs
--- a/BIN
+++ b/BIN
--- a/tools/cpiocat/main.go
+++ b/tools/cpiocat/main.go
@ -2,7 +2,7 @@ package main

 import (
 	"flag"
-	"log"
+	"fmt"
 	"os"

 	"novit.tech/direktil/pkg/cpiocat"
@ -13,6 +13,7 @@ func main() {

 	err := cpiocat.Append(os.Stdout, os.Stdin, flag.Args())
 	if err != nil {
-		log.Fatal(err)
+		fmt.Fprintln(os.Stderr, err.Error())
+		os.Exit(1)
 	}
 }
--- a/tools/testconf/main.go
+++ b/tools/testconf/main.go
@ -0,0 +1,37 @@
+package main
+
+import (
+	"bytes"
+	"flag"
+	"fmt"
+	"os"
+
+	"gopkg.in/yaml.v3"
+	config "novit.tech/direktil/pkg/bootstrapconfig"
+)
+
+func main() {
+	flag.Parse()
+
+	for _, arg := range flag.Args() {
+		fmt.Println("testing", arg)
+
+		cfgBytes, err := os.ReadFile(arg)
+		fail(err)
+
+		cfg := config.Config{}
+
+		dec := yaml.NewDecoder(bytes.NewBuffer(cfgBytes))
+		dec.KnownFields(true)
+
+		err = dec.Decode(&cfg)
+		fail(err)
+	}
+}
+
+func fail(err error) {
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err.Error())
+		os.Exit(1)
+	}
+}
--- a/tty.go
+++ b/tty.go
@ -1,29 +1,25 @@
 package main

 import (
-	"os"
-
 	"golang.org/x/sys/unix"
 )

-var (
-	stdinTTY = &tty{int(os.Stdin.Fd()), nil}
-)
-
 type tty struct {
 	fd      int
 	termios *unix.Termios
 }

+func newTTY(fd uintptr) *tty {
+	termios, _ := unix.IoctlGetTermios(int(fd), unix.TCGETS)
+	return &tty{int(fd), termios}
+}
+
 func (t *tty) EchoOff() {
-	termios, err := unix.IoctlGetTermios(t.fd, unix.TCGETS)
-	if err != nil {
+	if t.termios == nil {
 		return
 	}

-	t.termios = termios
-
-	newState := *termios
+	newState := *t.termios
 	newState.Lflag &^= unix.ECHO
 	newState.Lflag |= unix.ICANON | unix.ISIG
 	newState.Iflag |= unix.ICRNL
@ -31,8 +27,9 @@ func (t *tty) EchoOff() {
 }

 func (t *tty) Restore() {
-	if t.termios != nil {
+	if t.termios == nil {
+		return
+	}
+
 	unix.IoctlSetTermios(t.fd, unix.TCSETS, t.termios)
-		t.termios = nil
-	}
 }
--- a/uname.go
+++ b/uname.go
@ -0,0 +1,20 @@
+package main
+
+import "syscall"
+
+func unameRelease() string {
+	uname := &syscall.Utsname{}
+	if err := syscall.Uname(uname); err != nil {
+		fatalf("failed to get kernel version: %v", err)
+	}
+
+	ba := make([]byte, 0, len(uname.Release))
+	for _, c := range uname.Release {
+		if c == 0 {
+			break
+		}
+		ba = append(ba, byte(c))
+	}
+
+	return string(ba)
+}
--- a/vpn.go
+++ b/vpn.go
@ -1,11 +1,11 @@
 package main

 import (
-	"log"
 	"net"
 	"os"
 	"path/filepath"

+	"github.com/rs/zerolog/log"
 	"golang.zx2c4.com/wireguard/wgctrl"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"

@ -13,11 +13,18 @@ import (
 )

 func setupVPN(vpn config.VPNDef, localGenDir string) {
-	log.Printf("setting up VPN %s", vpn.Name)
+	log := log.With().Str("vpn", vpn.Name).Logger()
+
+	log.Info().Msg("VPN: setting up")

 	vpnDir := filepath.Join(localGenDir, vpn.Name)
 	os.MkdirAll(vpnDir, 0750)

+	logMsg := log.Info()
+	if vpn.ListenPort != nil {
+		logMsg.Int("ListenPort", *vpn.ListenPort)
+	}
+
 	// public/private key
 	keyFile := filepath.Join(vpnDir, "key")
 	keyBytes, err := os.ReadFile(keyFile)
@ -39,7 +46,7 @@ func setupVPN(vpn config.VPNDef, localGenDir string) {
 		fatalf("bad VPN key: %v", err)
 	}

-	log.Printf("VPN %s public key is %s", vpn.Name, key.PublicKey().String())
+	logMsg.Stringer("PublicKey", key.PublicKey())

 	// pre-shared key
 	pskeyFile := filepath.Join(vpnDir, "pskey")
@ -62,7 +69,10 @@ func setupVPN(vpn config.VPNDef, localGenDir string) {
 		fatalf("bad VPN pre-shared key: %v", err)
 	}

-	log.Printf("VPN %s pre-shared key is %s", vpn.Name, key.String())
+	{
+		keyStr := key.String()
+		logMsg.Str("PresharedKey", keyStr[0:4]+"..."+keyStr[len(keyStr)-4:])
+	}

 	// setup interface
 	cfg := wgtypes.Config{
@ -110,12 +120,14 @@ func setupVPN(vpn config.VPNDef, localGenDir string) {
 	}
 	defer wg.Close()

+	log.Info().Strs("ips", vpn.IPs).Msg("VPN: creating interface")
 	run("ip", "link", "add", vpn.Name, "type", "wireguard")

 	for _, ip := range vpn.IPs {
 		run("ip", "addr", "add", ip, "dev", vpn.Name)
 	}

+	logMsg.Msg("VPN: configuring interface")
 	err = wg.ConfigureDevice(vpn.Name, cfg)
 	if err != nil {
 		fatalf("failed to setup VPN %s: %v", vpn.Name, err)
--- a/zombies.go
+++ b/zombies.go
@ -1,26 +0,0 @@
-package main
-
-import (
-	"log"
-	"syscall"
-)
-
-func cleanZombies() {
-	return // FIXME noop... udhcpc is a daemon staying alive so we never finish
-
-	var wstatus syscall.WaitStatus
-
-	for {
-		pid, err := syscall.Wait4(-1, &wstatus, 0, nil)
-		switch err {
-		case nil:
-			log.Printf("collected PID %v", pid)
-
-		case syscall.ECHILD:
-			return
-
-		default:
-			log.Printf("unknown error: %v", err)
-		}
-	}
-}
Author	SHA1	Message	Date
Mikaël Cluseau	55884f92ea	introduce rust	2025-06-23 02:03:02 +02:00
Mikaël Cluseau	6e1cb57e03	upgrade go+deps	2025-06-02 14:53:05 +02:00
Mikaël Cluseau	3f2549c746	unix module disappeared	2025-06-02 14:51:26 +02:00
Mikaël Cluseau	91eb83d6e1	bootstrap: attemps fetching for 1 minute before giving up	2024-11-06 00:42:51 +01:00
Mikaël Cluseau	5924705b24	shrink exec	2024-11-04 22:06:48 +01:00
Mikaël Cluseau	0f9679d91e	use udev for lvm & net	2024-11-04 17:33:23 +01:00
Mikaël Cluseau	7325ee1c0c	don't write config.yaml anymore	2024-01-21 15:42:15 +01:00
Mikaël Cluseau	4a12e1ba8f	rework ssh 'init' command	2024-01-21 15:32:51 +01:00
Mikaël Cluseau	2df68d3fca	bump pkg mod to support symlink&dir in file def	2024-01-20 18:28:28 +01:00
Mikaël Cluseau	5fd3a9d925	remove boot-v1	2024-01-20 17:31:57 +01:00
Mikaël Cluseau	6bf1d1ccf2	move to zerolog	2024-01-20 16:41:54 +01:00
Mikaël Cluseau	5ab8b74041	Dockerfile: bump 'from'	2024-01-08 09:50:02 +01:00
Mikaël Cluseau	7b62140d2a	bootstrap: update-ca-certificates	2024-01-08 09:47:40 +01:00
Mikaël Cluseau	650c913930	ssh: load more host key formats than rsa	2023-12-17 17:16:53 +01:00
Mikaël Cluseau	d69f2f27ee	lz4 test (and better build)	2023-12-17 14:28:32 +01:00
Mikaël Cluseau	12bfa6cfd6	feature: pre_lvm_crypt	2023-12-17 13:48:18 +01:00
Mikaël Cluseau	898c43b954	push dkl init boot logic here	2023-12-04 17:47:57 +01:00
Mikaël Cluseau	1555419549	files: default mode	2023-11-27 16:08:09 +01:00
Mikaël Cluseau	3f2cd997a0	better build	2023-11-27 14:40:15 +01:00
				`@ -1 +0,0 @@`
				ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDLo+mv+0GJViwFiK14bAw8j4HYFIGf4I/fpmIqzHohf70TT+cYqAKSHBYV+uYjNLYQib6Ii/thPexeypw73pq7Z7CHvubnFQUiuqJ7lzXeV4146f5eHL76/TvTmKthS4FVFta6SlCOE6unR6q8HM52VSijavtoX3musxugCwhaHmBNOdUJcNIRCIey8QaOztPK05dDrOZhMQJgSST/BRaNrtY0/xRmJo+5TbQeyjyDuQdK2EoS51QMWzsT/LH6drQBgKd8RRHqjEhscfaV2CmdfuVO/liEdW82epMgFCGYtMetP/rs3bPkC90ULxPZSytaz7d5ux1dvSgrPHzX4306k/GP3d6EvOedy4IKAB53J7lebvrRI5pTVPZvd/RsSGGxUIwjf2Y8TF5nbC2d2D5Oauqfevn29veIRh8mq+AsJMnkvUFwVRN+6WDsZ+F82+AGaCKJFNQLYbRKtXW0zzi+wTsnLJNwlpevRf61SCxehSqeVfnc4TDsAGyRa9nSbR8= test@novit.io