push dkl init boot logic here

.dockerignore

@@ -1 +1,3 @@
 Dockerfile
+tmp/**/*
+dist/*

.gitignore

@@ -1 +1,5 @@
 .*.sw[po]
+/dist
+/qemu.pid
+/test-initrd.cpio
+/tmp

Dockerfile

@@ -1,19 +1,25 @@
-# ------------------------------------------------------------------------
-from mcluseau/golang-builder:1.15.5 as build
+from golang:1.21.4-alpine3.18 as build
+
+workdir /src
+copy go.mod go.sum .
+run go mod download
+
+copy . .
+run go test ./...
+run go build -o /go/bin/init -trimpath .
 
 # ------------------------------------------------------------------------
-from alpine:3.12
-
-env busybox_v=1.28.1-defconfig-multiarch \
-    arch=x86_64
-
-run apk add --update curl
+from alpine:3.18.4
 
 workdir /layer
+run wget -O- https://dl-cdn.alpinelinux.org/alpine/v3.18/releases/x86_64/alpine-minirootfs-3.18.4-x86_64.tar.gz |tar zxv
 
-add build-layer /
-run /build-layer
+run apk add --no-cache -p . musl lvm2 lvm2-dmeventd udev cryptsetup e2fsprogs btrfs-progs lsblk
+run rm -rf usr/share/apk var/cache/apk
 
-copy --from=build /go/bin/initrd /layer/init
+copy --from=build /go/bin/init .
+
+# check viability
+run chroot /layer /init hello
 
 entrypoint ["sh","-c","find |cpio -H newc -o |base64"]

ask-secret.go

@@ -0,0 +1,46 @@
+package main
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"io"
+	"os"
+)
+
+func askSecret(prompt string) []byte {
+	stdinTTY.EchoOff()
+
+	var (
+		in  io.Reader = stdin
+		out io.Writer = stdout
+	)
+
+	if stdin == nil {
+		in = os.Stdin
+		out = os.Stdout
+	}
+
+	out.Write([]byte(prompt + ": "))
+
+	if stdin != nil {
+		stdout.HideInput()
+	}
+
+	s, err := bufio.NewReader(in).ReadBytes('\n')
+
+	if stdin != nil {
+		stdout.ShowInput()
+	}
+
+	stdinTTY.Restore()
+
+	if err != nil {
+		fatalf("failed to read from stdin: %v", err)
+	}
+
+	fmt.Println()
+
+	s = bytes.TrimRight(s, "\r\n")
+	return s
+}

auth.go

@@ -0,0 +1,59 @@
+package main
+
+import (
+	"bytes"
+	"errors"
+	"log"
+
+	"golang.org/x/crypto/ssh"
+
+	config "novit.tech/direktil/pkg/bootstrapconfig"
+)
+
+var (
+	auths []config.Auth
+)
+
+func localAuth() bool {
+	sec := askSecret("password")
+
+	for _, auth := range auths {
+		if auth.Password == "" {
+			continue
+		}
+
+		if config.CheckPassword(auth.Password, sec) {
+			log.Printf("login with auth %q", auth.Name)
+			return true
+		}
+	}
+
+	return false
+}
+
+func sshCheckPubkey(conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
+	keyBytes := key.Marshal()
+
+	for _, auth := range auths {
+		if auth.SSHKey == "" {
+			continue
+		}
+
+		allowedKey, _, _, _, err := ssh.ParseAuthorizedKey([]byte(auth.SSHKey))
+		if err != nil {
+			log.Printf("SSH pubkey for %q invalid: %v", auth.Name, auth.SSHKey)
+			return nil, err
+		}
+
+		if bytes.Equal(allowedKey.Marshal(), keyBytes) {
+			log.Print("ssh: accepting public key for ", auth.Name)
+			return &ssh.Permissions{
+				Extensions: map[string]string{
+					"pubkey-fp": ssh.FingerprintSHA256(key),
+				},
+			}, nil
+		}
+	}
+
+	return nil, errors.New("no matching public key")
+}

boot-v1.go

@@ -0,0 +1,208 @@
+package main
+
+import (
+	"log"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"syscall"
+	"time"
+
+	yaml "gopkg.in/yaml.v2"
+	"novit.tech/direktil/pkg/sysfs"
+)
+
+var loopOffset = 0
+
+func bootV1() {
+	log.Print("-- boot v1 --")
+
+	// find and mount /boot
+	bootMatch := param("boot", "")
+	bootMounted := false
+	if bootMatch != "" {
+		bootFS := param("boot.fs", "vfat")
+		for i := 0; ; i++ {
+			devNames := sysfs.DeviceByProperty("block", bootMatch)
+
+			if len(devNames) == 0 {
+				if i > 30 {
+					fatal("boot partition not found after 30s")
+				}
+				log.Print("boot partition not found, retrying")
+				time.Sleep(1 * time.Second)
+				continue
+			}
+
+			devFile := filepath.Join("/dev", devNames[0])
+
+			log.Print("boot partition found: ", devFile)
+
+			mount(devFile, "/boot", bootFS, bootMountFlags, "")
+			bootMounted = true
+			break
+		}
+	} else {
+		log.Print("Assuming /boot is already populated.")
+	}
+
+	// load config
+	cfgPath := param("config", "/boot/config.yaml")
+
+	layersDir = filepath.Join("/boot", bootVersion, "layers")
+	applyConfig(cfgPath, bootMounted)
+
+	finalizeBoot()
+}
+
+func applyConfig(cfgPath string, bootMounted bool) (cfg *configV1) {
+	cfgBytes, err := os.ReadFile(cfgPath)
+	if err != nil {
+		fatalf("failed to read %s: %v", cfgPath, err)
+	}
+
+	cfg = &configV1{}
+	if err := yaml.Unmarshal(cfgBytes, cfg); err != nil {
+		fatal("failed to load config: ", err)
+	}
+
+	// mount layers
+	if len(cfg.Layers) == 0 {
+		fatal("no layers configured!")
+	}
+
+	log.Printf("wanted layers: %q", cfg.Layers)
+
+	layersInMemory := paramBool("layers-in-mem", false)
+
+	const layersInMemDir = "/layers-in-mem"
+	if layersInMemory {
+		mkdir(layersInMemDir, 0700)
+		mount("layers-mem", layersInMemDir, "tmpfs", 0, "")
+	}
+
+	lowers := make([]string, len(cfg.Layers))
+	for i, layer := range cfg.Layers {
+		path := layerPath(layer)
+
+		info, err := os.Stat(path)
+		if err != nil {
+			fatal(err)
+		}
+
+		log.Printf("layer %s found (%d bytes)", layer, info.Size())
+
+		if layersInMemory {
+			log.Print("  copying to memory...")
+			targetPath := filepath.Join(layersInMemDir, layer)
+			cp(path, targetPath)
+			path = targetPath
+		}
+
+		dir := "/layers/" + layer
+
+		lowers[i] = dir
+
+		mountSquahfs(path, dir)
+	}
+
+	// prepare system root
+	mount("mem", "/changes", "tmpfs", 0, "")
+
+	mkdir("/changes/workdir", 0755)
+	mkdir("/changes/upperdir", 0755)
+
+	mount("overlay", "/system", "overlay", rootMountFlags,
+		"lowerdir="+strings.Join(lowers, ":")+",upperdir=/changes/upperdir,workdir=/changes/workdir")
+
+	// make root rshared (default in systemd, required by Kubernetes 1.10+)
+	// equivalent to "mount --make-rshared /"
+	// see kernel's Documentation/sharedsubtree.txt (search rshared)
+	if err := syscall.Mount("", "/system", "", syscall.MS_SHARED|syscall.MS_REC, ""); err != nil {
+		fatalf("FATAL: mount --make-rshared / failed: %v", err)
+	}
+
+	if bootMounted {
+		if layersInMemory {
+			if err := syscall.Unmount("/boot", 0); err != nil {
+				log.Print("WARNING: failed to unmount /boot: ", err)
+				time.Sleep(2 * time.Second)
+			}
+
+		} else {
+			mount("/boot", "/system/boot", "", syscall.MS_BIND, "")
+		}
+	}
+
+	// - write configuration
+	log.Print("writing /config.yaml")
+	if err := os.WriteFile("/system/config.yaml", cfgBytes, 0600); err != nil {
+		fatal("failed: ", err)
+	}
+
+	// - write files
+	for _, fileDef := range cfg.Files {
+		log.Print("writing ", fileDef.Path)
+
+		filePath := filepath.Join("/system", fileDef.Path)
+
+		if err := os.MkdirAll(filepath.Dir(filePath), 0755); err != nil {
+			log.Printf("failed to create dir %s: %v", filepath.Dir(fileDef.Path), err)
+		}
+
+		mode := fileDef.Mode
+		if mode == 0 {
+			mode = 0644
+		}
+
+		err = os.WriteFile(filePath, []byte(fileDef.Content), mode)
+		if err != nil {
+			fatalf("failed to write %s: %v", fileDef.Path, err)
+		}
+	}
+
+	// - groups
+	for _, group := range cfg.Groups {
+		log.Print("creating group ", group.Name)
+
+		opts := make([]string, 0)
+		opts = append(opts /* chroot */, "/system", "groupadd", "-r")
+		if group.Gid != 0 {
+			opts = append(opts, "-g", strconv.Itoa(group.Gid))
+		}
+		opts = append(opts, group.Name)
+
+		run("chroot", opts...)
+	}
+
+	// - user
+	for _, user := range cfg.Users {
+		log.Print("creating user ", user.Name)
+
+		opts := make([]string, 0)
+		opts = append(opts /* chroot */, "/system", "useradd", "-r")
+		if user.Gid != 0 {
+			opts = append(opts, "-g", strconv.Itoa(user.Gid))
+		}
+		if user.Uid != 0 {
+			opts = append(opts, "-u", strconv.Itoa(user.Uid))
+		}
+		opts = append(opts, user.Name)
+
+		run("chroot", opts...)
+	}
+
+	return
+}
+
+func finalizeBoot() {
+	// clean zombies
+	cleanZombies()
+
+	// switch root
+	log.Print("switching root")
+	err := syscall.Exec("/sbin/switch_root", []string{"switch_root",
+		"-c", "/dev/console", "/system", "/sbin/init"}, os.Environ())
+	fatal("switch_root failed: ", err)
+}

boot-v2.go

@@ -0,0 +1,90 @@
+package main
+
+import (
+	"log"
+	"os"
+	"os/exec"
+
+	"gopkg.in/yaml.v3"
+
+	config "novit.tech/direktil/pkg/bootstrapconfig"
+)
+
+func bootV2() {
+	log.Print("-- boot v2 --")
+
+	kernelVersion := unameRelease()
+	log.Print("Linux version ", kernelVersion)
+
+	cfg := &config.Config{}
+
+	{
+		f, err := os.Open("/config.yaml")
+		if err != nil {
+			fatal("failed to open /config.yaml: ", err)
+		}
+
+		err = yaml.NewDecoder(f).Decode(cfg)
+		f.Close()
+
+		if err != nil {
+			fatal("failed to parse /config.yaml: ", err)
+		}
+	}
+
+	log.Print("config loaded")
+	log.Printf("anti-phishing code: %q", cfg.AntiPhishingCode)
+
+	auths = cfg.Auths
+
+	// mount kernel modules
+	if cfg.Modules == "" {
+		log.Print("NOT mounting modules (nothing specified)")
+	} else {
+		mountSquahfs(cfg.Modules, "/modules")
+
+		modulesSourcePath := "/modules/lib/modules/" + kernelVersion
+		if _, err := os.Stat(modulesSourcePath); err != nil {
+			fatal("invalid modules dir: ", err)
+		}
+
+		os.MkdirAll("/lib/modules", 0755)
+		if err := os.Symlink(modulesSourcePath, "/lib/modules/"+kernelVersion); err != nil {
+			fatal("failed to symlink modules: ", err)
+		}
+	}
+
+	// load basic modules
+	run("modprobe", "unix")
+
+	// devices init
+	err := exec.Command("udevd").Start()
+	if err != nil {
+		fatal("failed to start udevd: ", err)
+	}
+
+	log.Print("udevadm triggers")
+	run("udevadm", "trigger", "-c", "add", "-t", "devices")
+	run("udevadm", "trigger", "-c", "add", "-t", "subsystems")
+
+	log.Print("udevadm settle")
+	run("udevadm", "settle")
+
+	// networks
+	setupNetworks(cfg)
+
+	// Wireguard VPN
+	// TODO startVPN()
+
+	// SSH service
+	startSSH(cfg)
+
+	// LVM
+	setupLVM(cfg)
+
+	// bootstrap the system
+	bootstrap(cfg)
+
+	// finalize
+	finalizeBoot()
+}

bootstrap.go

@@ -0,0 +1,169 @@
+package main
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+
+	config "novit.tech/direktil/pkg/bootstrapconfig"
+)
+
+func bootstrap(cfg *config.Config) {
+	if cfg.Bootstrap.Dev == "" {
+		fatalf("bootstrap device not defined!")
+	}
+
+	const bsDir = "/bootstrap"
+	os.MkdirAll(bsDir, 0700)
+
+	run("mount", cfg.Bootstrap.Dev, bsDir)
+
+	baseDir := filepath.Join(bsDir, bootVersion)
+	sysCfgPath := filepath.Join(baseDir, "config.yaml")
+
+	if _, err := os.Stat(sysCfgPath); os.IsNotExist(err) {
+		log.Printf("bootstrap %q does not exist", bootVersion)
+
+		seed := cfg.Bootstrap.Seed
+		if seed == "" {
+			fatalf("boostrap seed not defined, admin required")
+		}
+
+		log.Printf("seeding bootstrap from %s", seed)
+
+		err = os.MkdirAll(baseDir, 0700)
+		if err != nil {
+			fatalf("failed to create bootstrap dir: %v", err)
+		}
+
+		bootstrapFile := filepath.Join(baseDir, "bootstrap.tar")
+
+		err = func() (err error) {
+			resp, err := http.Get(seed)
+			if err != nil {
+				return
+			}
+
+			if resp.StatusCode != http.StatusOK {
+				err = fmt.Errorf("bad HTTP status: %s", resp.Status)
+				return
+			}
+
+			defer resp.Body.Close()
+
+			out, err := os.Create(bootstrapFile)
+			if err != nil {
+				return
+			}
+
+			defer out.Close()
+
+			_, err = io.Copy(out, resp.Body)
+
+			return
+		}()
+
+		if err != nil {
+			fatalf("seeding failed: %v", err)
+		}
+
+		log.Print("unpacking bootstrap file")
+		run("tar", "xvf", bootstrapFile, "-C", baseDir)
+	}
+
+	layersDir = baseDir
+	layersOverride["modules"] = "/modules.sqfs"
+	sysCfg := applyConfig(sysCfgPath, false)
+
+	localGenDir := filepath.Join(bsDir, "local-gen")
+
+	// vpns are v2+
+	for _, vpn := range sysCfg.VPNs {
+		setupVPN(vpn, localGenDir)
+	}
+
+	// mounts are v2+
+	for _, mount := range sysCfg.Mounts {
+		log.Print("mount ", mount.Dev, " to system's ", mount.Path)
+
+		path := filepath.Join("/system", mount.Path)
+
+		os.MkdirAll(path, 0755)
+
+		args := []string{mount.Dev, path}
+		if mount.Type != "" {
+			args = append(args, "-t", mount.Type)
+		}
+		if mount.Options != "" {
+			args = append(args, "-o", mount.Options)
+		}
+
+		run("mount", args...)
+	}
+
+	// setup root user
+	if ph := sysCfg.RootUser.PasswordHash; ph != "" {
+		log.Print("setting root's password")
+		setUserPass("root", ph)
+	}
+	if ak := sysCfg.RootUser.AuthorizedKeys; len(ak) != 0 {
+		log.Print("setting root's authorized keys")
+		setAuthorizedKeys(ak)
+	}
+}
+
+func setUserPass(user, passwordHash string) {
+	const fpath = "/system/etc/shadow"
+
+	ba, err := os.ReadFile(fpath)
+	if err != nil {
+		fatalf("failed to read shadow: %v", err)
+	}
+
+	lines := bytes.Split(ba, []byte{'\n'})
+
+	buf := new(bytes.Buffer)
+	for _, line := range lines {
+		line := string(line)
+		p := strings.Split(line, ":")
+		if len(p) < 2 || p[0] != user {
+			buf.WriteString(line)
+			continue
+		}
+
+		p[1] = passwordHash
+		line = strings.Join(p, ":")
+
+		buf.WriteString(line)
+		buf.WriteByte('\n')
+	}
+
+	err = os.WriteFile(fpath, buf.Bytes(), 0600)
+	if err != nil {
+		fatalf("failed to write shadow: %v", err)
+	}
+}
+
+func setAuthorizedKeys(ak []string) {
+	buf := new(bytes.Buffer)
+	for _, k := range ak {
+		buf.WriteString(k)
+		buf.WriteByte('\n')
+	}
+
+	const sshDir = "/system/root/.ssh"
+	err := os.MkdirAll(sshDir, 0700)
+	if err != nil {
+		fatalf("failed to create %s: %v", sshDir, err)
+	}
+
+	err = os.WriteFile(filepath.Join(sshDir, "authorized_keys"), buf.Bytes(), 0600)
+	if err != nil {
+		fatalf("failed to write authorized keys: %v", err)
+	}
+}

build-layer

@@ -1,14 +1,6 @@
 #! /bin/sh
 set -ex
 
-mkdir dev
 mknod dev/null    -m 0666 c 1 3
 mknod dev/tty     -m 0666 c 5 0
 mknod dev/console -m 0600 c 5 1
-
-mkdir sys proc bin sbin usr usr/bin usr/sbin
-
-curl -L -o bin/busybox https://busybox.net/downloads/binaries/$busybox_v/busybox-$arch
-chmod +x bin/busybox
-
-chroot . /bin/busybox --install -s

colorio/colorio.go

@@ -0,0 +1,45 @@
+package colorio
+
+import "io"
+
+var (
+	Reset      = []byte("\033[0m")
+	Bold       = []byte("\033[1m")
+	Dim        = []byte("\033[2m")
+	Underlined = []byte("\033[4m")
+	Blink      = []byte("\033[5m")
+	Reverse    = []byte("\033[7m")
+	Hidden     = []byte("\033[8m")
+)
+
+type writer struct {
+	before []byte
+	after  []byte
+	w      io.Writer
+}
+
+func NewWriter(color []byte, w io.Writer) io.Writer {
+	return writer{
+		before: color,
+		after:  Reset,
+		w:      w,
+	}
+}
+
+func (w writer) Write(ba []byte) (n int, err error) {
+	b := make([]byte, len(w.before)+len(ba)+len(w.after))
+	copy(b, w.before)
+	copy(b[len(w.before):], ba)
+	copy(b[len(w.before)+len(ba):], w.after)
+
+	n, err = w.w.Write(b)
+
+	n -= len(w.before)
+	if n < 0 {
+		n = 0
+	} else if n > len(ba) {
+		n = len(ba)
+	}
+
+	return
+}

colorio/colorio_test.go

@@ -0,0 +1,21 @@
+package colorio
+
+import (
+	"bytes"
+	"fmt"
+	"testing"
+)
+
+func TestWriter(t *testing.T) {
+	buf := new(bytes.Buffer)
+
+	w := NewWriter(Bold, buf)
+
+	buf.WriteByte('{')
+	fmt.Fprintln(w, "hello")
+	buf.WriteByte('}')
+
+	if s, exp := buf.String(), "{"+string(Bold)+"hello\n"+string(Reset)+"}"; s != exp {
+		t.Errorf("%q != %q", s, exp)
+	}
+}

config.go

@@ -1,10 +1,7 @@
 package main
 
 import (
-	nconfig "novit.nc/direktil/pkg/config"
+	nconfig "novit.tech/direktil/pkg/config"
 )
 
-type config struct {
-	Layers []string          `yaml:"layers"`
-	Files  []nconfig.FileDef `yaml:"files"`
-}
+type configV1 = nconfig.Config

filter.go

@@ -0,0 +1,22 @@
+package main
+
+func filter[T any](values []T, accept func(T) bool) []T {
+	r := make([]T, 0, len(values))
+
+	for _, v := range values {
+		if accept(v) {
+			r = append(r, v)
+		}
+	}
+
+	return r
+}
+
+func contains[T any](values []T, accept func(T) bool) bool {
+	for _, v := range values {
+		if accept(v) {
+			return true
+		}
+	}
+	return false
+}

filter_test.go

@@ -0,0 +1,13 @@
+package main
+
+import (
+    "fmt"
+    "testing"
+)
+
+func TestFilter(t*testing.T) {
+    a := filter([]string{"a","b","c"}, func(v string) bool { return v != "b" })
+    if fmt.Sprint(a) != "[a c]" {
+        t.Errorf("bad result: %v", a)
+    }
+}

go.mod

@@ -1,10 +1,29 @@
 module novit.nc/direktil/initrd
 
 require (
-	golang.org/x/sys v0.0.0-20201119102817-f84b799fce68 // indirect
-	golang.org/x/term v0.0.0-20201117132131-f5c789dd3221
-	gopkg.in/yaml.v2 v2.3.0
-	novit.nc/direktil/pkg v0.0.0-20191211161950-96b0448b84c2
+	github.com/freddierice/go-losetup/v2 v2.0.1
+	github.com/kr/pty v1.1.8
+	github.com/pkg/term v1.1.0
+	golang.org/x/crypto v0.16.0
+	golang.org/x/sys v0.15.0
+	golang.org/x/term v0.15.0
+	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6
+	gopkg.in/yaml.v2 v2.4.0
+	gopkg.in/yaml.v3 v3.0.1
+	novit.tech/direktil/pkg v0.0.0-20230201224712-5e39572dc50e
 )
 
-go 1.13
+require (
+	github.com/cavaliergopher/cpio v1.0.1 // indirect
+	github.com/creack/pty v1.1.21 // indirect
+	github.com/google/go-cmp v0.6.0 // indirect
+	github.com/josharian/native v1.1.0 // indirect
+	github.com/mdlayher/genetlink v1.3.2 // indirect
+	github.com/mdlayher/netlink v1.7.2 // indirect
+	github.com/mdlayher/socket v0.5.0 // indirect
+	golang.org/x/net v0.19.0 // indirect
+	golang.org/x/sync v0.5.0 // indirect
+	golang.zx2c4.com/wireguard v0.0.0-20231022001213-2e0774f246fb // indirect
+)
+
+go 1.21

go.sum

@@ -1,21 +1,87 @@
+github.com/cavaliergopher/cpio v1.0.1 h1:KQFSeKmZhv0cr+kawA3a0xTQCU4QxXF1vhU7P7av2KM=
+github.com/cavaliergopher/cpio v1.0.1/go.mod h1:pBdaqQjnvXxdS/6CvNDwIANIFSP0xRKI16PX4xejRQc=
+github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
+github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
+github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
+github.com/creack/pty v1.1.21 h1:1/QdRyBaHHJP61QkWMXlOIBfsgdDeeKfK8SYVUWJKf0=
+github.com/creack/pty v1.1.21/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
+github.com/freddierice/go-losetup/v2 v2.0.1 h1:wPDx/Elu9nDV8y/CvIbEDz5Xi5Zo80y4h7MKbi3XaAI=
+github.com/freddierice/go-losetup/v2 v2.0.1/go.mod h1:TEyBrvlOelsPEhfWD5rutNXDmUszBXuFnwT1kIQF4J8=
+github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA=
+github.com/josharian/native v1.1.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
 github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/pty v1.1.8 h1:AkaSdXYQOWeaO3neb8EM634ahkXXe3jYbVh/F9lq+GI=
+github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw=
 github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/mdlayher/genetlink v1.3.1 h1:roBiPnual+eqtRkKX2Jb8UQN5ZPWnhDCGj/wR6Jlz2w=
+github.com/mdlayher/genetlink v1.3.1/go.mod h1:uaIPxkWmGk753VVIzDtROxQ8+T+dkHqOI0vB1NA9S/Q=
+github.com/mdlayher/genetlink v1.3.2 h1:KdrNKe+CTu+IbZnm/GVUMXSqBBLqcGpRDa0xkQy56gw=
+github.com/mdlayher/genetlink v1.3.2/go.mod h1:tcC3pkCrPUGIKKsCsp0B3AdaaKuHtaxoJRz3cc+528o=
+github.com/mdlayher/netlink v1.7.1 h1:FdUaT/e33HjEXagwELR8R3/KL1Fq5x3G5jgHLp/BTmg=
+github.com/mdlayher/netlink v1.7.1/go.mod h1:nKO5CSjE/DJjVhk/TNp6vCE1ktVxEA8VEh8drhZzxsQ=
+github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/g=
+github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
+github.com/mdlayher/socket v0.4.0 h1:280wsy40IC9M9q1uPGcLBwXpcTQDtoGwVt+BNoITxIw=
+github.com/mdlayher/socket v0.4.0/go.mod h1:xxFqz5GRCUN3UEOm9CZqEJsAbe1C8OwSK46NlmWuVoc=
+github.com/mdlayher/socket v0.5.0 h1:ilICZmJcQz70vrWVes1MFera4jGiWNocSkykwwoy3XI=
+github.com/mdlayher/socket v0.5.0/go.mod h1:WkcBFfvyG8QENs5+hfQPl1X6Jpd2yeLIYgrGFmJiJxI=
+github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721 h1:RlZweED6sbSArvlE924+mUcZuXKLBHA35U7LN621Bws=
+github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721/go.mod h1:Ickgr2WtCLZ2MDGd4Gr0geeCH5HybhRJbonOgQpvSxc=
+github.com/pkg/term v1.1.0 h1:xIAAdCMh3QIAy+5FrE8Ad8XoDhEU4ufwbaSozViP9kk=
+github.com/pkg/term v1.1.0/go.mod h1:E25nymQcrSllhX42Ok8MRm1+hyBdHY0dCeiKZ9jpNGw=
 github.com/ulikunitz/xz v0.5.6/go.mod h1:2bypXElzHzzJZwzH67Y6wb67pO62Rzfn7BSiF4ABRW8=
-golang.org/x/sys v0.0.0-20191026070338-33540a1f6037 h1:YyJpGZS1sBuBCzLAR1VEpK193GlqGZbnPFnPV/5Rsb4=
-golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68 h1:nxC68pudNYkKU6jWhgrqdreuFiOQWj1Fs7T3VrH4Pjw=
+golang.org/x/crypto v0.0.0-20220321153916-2c7772ba3064/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.5.0 h1:U/0M97KRkSFvyD/3FSmdP5W5swImpNgle/EHFhOsQPE=
+golang.org/x/crypto v0.5.0/go.mod h1:NK/OQwhpMQP3MwtdjgLlYHnH9ebylxKWv3e0fK+mkQU=
+golang.org/x/crypto v0.16.0 h1:mMMrFzRSCF0GvB7Ne27XVtVAaXLrPmgPC7/v0tkwHaY=
+golang.org/x/crypto v0.16.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
+golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.5.0 h1:GyT4nK/YDHSqa1c4753ouYCDajOYKTja9Xb/OHtgvSw=
+golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws=
+golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
+golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
+golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.5.0 h1:60k92dhOjHxJkrqnwsfl8KuaHbn/5dl0lUPUklKo3qE=
+golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sys v0.0.0-20200909081042-eff7692f9009/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/term v0.0.0-20201117132131-f5c789dd3221 h1:/ZHdbVpdR/jk3g30/d4yUL0JU9kksj8+F/bnQUVLGDM=
-golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.4.0 h1:Zr2JFtRQNX3BCZ8YtxRE9hNJYC8J6I1MVbMg6owUp18=
+golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
+golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.4.0 h1:O7UWfv5+A2qiuulQk30kVinPoMtoIPeVaKLEgLpVkvg=
+golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ=
+golang.org/x/term v0.15.0 h1:y/Oo/a/q3IXu26lQgl04j/gjuBDOBlx7X6Om1j2CPW4=
+golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.zx2c4.com/wireguard v0.0.0-20220920152132-bb719d3a6e2c h1:Okh6a1xpnJslG9Mn84pId1Mn+Q8cvpo4HCeeFWHo0cA=
+golang.zx2c4.com/wireguard v0.0.0-20220920152132-bb719d3a6e2c/go.mod h1:enML0deDxY1ux+B6ANGiwtg0yAJi1rctkTpcHNAVPyg=
+golang.zx2c4.com/wireguard v0.0.0-20231022001213-2e0774f246fb h1:c5tyN8sSp8jSDxdCCDXVOpJwYXXhmTkNMt+g0zTSOic=
+golang.zx2c4.com/wireguard v0.0.0-20231022001213-2e0774f246fb/go.mod h1:tkCQ4FQXmpAgYVh++1cq16/dH4QJtmvpRv19DWGAHSA=
+golang.zx2c4.com/wireguard/wgctrl v0.0.0-20221104135756-97bc4ad4a1cb h1:9aqVcYEDHmSNb0uOWukxV5lHV09WqiSiCuhEgWNETLY=
+golang.zx2c4.com/wireguard/wgctrl v0.0.0-20221104135756-97bc4ad4a1cb/go.mod h1:mQqgjkW8GQQcJQsbBvK890TKqUK1DfKWkuBGbOkuMHQ=
+golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6 h1:CawjfCvYQH2OU3/TnxLx97WDSUDRABfT18pCOYwc2GE=
+golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6/go.mod h1:3rxYc4HtVcSG9gVaTs2GEBdehh+sYPOwKtyUWEOTb80=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v2 v2.2.4 h1:/eiJrUcujPVeJ3xlSWaiNi3uSVmDGBK1pDHUHAnao1I=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
-gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-novit.nc/direktil/pkg v0.0.0-20191211161950-96b0448b84c2 h1:LN3K19gAJ1GamJXkzXAQmjbl8xCV7utqdxTTrM89MMc=
-novit.nc/direktil/pkg v0.0.0-20191211161950-96b0448b84c2/go.mod h1:zwTVO6U0tXFEaga73megQIBK7yVIKZJVePaIh/UtdfU=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+novit.nc/direktil/pkg v0.0.0-20220221171542-fd3ce3a1491b/go.mod h1:zwTVO6U0tXFEaga73megQIBK7yVIKZJVePaIh/UtdfU=
+novit.tech/direktil/pkg v0.0.0-20230201224712-5e39572dc50e h1:eQFbzcuB4wOSrnOhkcN30hFDCIack40VkIoqVRbWnWc=
+novit.tech/direktil/pkg v0.0.0-20230201224712-5e39572dc50e/go.mod h1:2Mir5x1eT/e295WeFGzzXa4siunKX4z+rmNPfVsXS0k=

losetup.go

@@ -0,0 +1,26 @@
+package main
+
+import (
+	"syscall"
+
+	"github.com/freddierice/go-losetup/v2"
+)
+
+var loDevices = map[string]losetup.Device{}
+
+func losetupAttach(file string) losetup.Device {
+	if _, ok := loDevices[file]; !ok {
+		dev, err := losetup.Attach(file, 0, true)
+		if err != nil {
+			fatalf("failed to attach %q to a loop device: %v", file, err)
+		}
+
+		loDevices[file] = dev
+	}
+	return loDevices[file]
+}
+
+func mountSquahfs(source, target string) {
+	dev := losetupAttach(source)
+	mount(dev.Path(), target, "squashfs", syscall.MS_RDONLY, "")
+}

lvm.go

@@ -0,0 +1,386 @@
+package main
+
+import (
+	"bytes"
+	"io/fs"
+	"log"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"sort"
+	"strconv"
+
+	"novit.nc/direktil/initrd/lvm"
+	config "novit.tech/direktil/pkg/bootstrapconfig"
+)
+
+func sortedKeys[T any](m map[string]T) (keys []string) {
+	keys = make([]string, 0, len(m))
+	for k := range m {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	return
+}
+
+func setupLVM(cfg *config.Config) {
+	if len(cfg.LVM) == 0 {
+		log.Print("no LVM VG configured.")
+		return
+	}
+
+	// [dev] = filesystem
+	// eg: [/dev/sda1] = ext4
+	createdDevs := map[string]string{}
+
+	run("pvscan")
+	run("vgscan", "--mknodes")
+
+	for _, vg := range cfg.LVM {
+		setupVG(vg)
+	}
+
+	for _, vg := range cfg.LVM {
+		setupLVs(vg, createdDevs)
+	}
+
+	run("vgchange", "--sysinit", "-a", "ly")
+
+	setupCrypt(cfg.Crypt, createdDevs)
+
+	devs := make([]string, 0, len(createdDevs))
+	for k := range createdDevs {
+		devs = append(devs, k)
+	}
+	sort.Strings(devs)
+
+	for _, dev := range devs {
+		setupFS(dev, createdDevs[dev])
+	}
+}
+
+func setupVG(vg config.LvmVG) {
+	pvs := lvm.PVSReport{}
+	err := runJSON(&pvs, "pvs", "--reportformat", "json")
+	if err != nil {
+		fatalf("failed to list LVM PVs: %v", err)
+	}
+
+	vgExists := false
+	devNeeded := vg.PVs.N
+	for _, pv := range pvs.PVs() {
+		if pv.VGName == vg.VG {
+			vgExists = true
+			devNeeded--
+		}
+	}
+
+	if devNeeded <= 0 {
+		log.Print("LVM VG ", vg.VG, " has all its devices")
+		return
+	}
+
+	if vgExists {
+		log.Printf("LVM VG %s misses %d devices", vg.VG, devNeeded)
+	} else {
+		log.Printf("LVM VG %s does not exists, creating", vg.VG)
+	}
+
+	devNames := make([]string, 0)
+	err = filepath.Walk("/dev", func(n string, fi fs.FileInfo, err error) error {
+		if fi.Mode().Type() == os.ModeDevice {
+			devNames = append(devNames, n)
+		}
+		return err
+	})
+	if err != nil {
+		fatalf("failed to walk /dev: %v", err)
+	}
+
+	devNames = filter(devNames, func(v string) bool {
+		for _, pv := range pvs.PVs() {
+			if v == pv.Name {
+				return false
+			}
+		}
+		return true
+	})
+
+	m := regexpSelectN(vg.PVs.N, vg.PVs.Regexps, devNames)
+	if len(m) == 0 {
+		log.Printf("no devices match the regexps %v", vg.PVs.Regexps)
+		for _, d := range devNames {
+			log.Print("- ", d)
+		}
+
+		fatalf("failed to setup VG %s", vg.VG)
+	}
+
+	if vgExists {
+		log.Print("- extending vg to ", m)
+		run("vgextend", append([]string{vg.VG}, m...)...)
+		devNeeded -= len(m)
+	} else {
+		log.Print("- creating vg with devices ", m)
+		run("vgcreate", append([]string{vg.VG}, m...)...)
+		devNeeded -= len(m)
+	}
+
+	if devNeeded > 0 {
+		fatalf("VG %s does not have enough devices (%d missing)", vg.VG, devNeeded)
+	}
+}
+
+func setupLVs(vg config.LvmVG, createdDevs map[string]string) {
+	lvsRep := lvm.LVSReport{}
+	err := runJSON(&lvsRep, "lvs", "--reportformat", "json")
+	if err != nil {
+		fatalf("lvs failed: %v", err)
+	}
+
+	lvs := lvsRep.LVs()
+
+	defaults := vg.Defaults
+
+	for _, lv := range vg.LVs {
+		lvKey := vg.VG + "/" + lv.Name
+
+		if contains(lvs, func(v lvm.LV) bool {
+			return v.VGName == vg.VG && v.Name == lv.Name
+		}) {
+			log.Printf("LV %s exists", lvKey)
+			continue
+		}
+
+		log.Printf("creating LV %s", lvKey)
+
+		if lv.Raid == nil {
+			lv.Raid = defaults.Raid
+		}
+
+		args := make([]string, 0)
+
+		if lv.Name == "" {
+			fatalf("LV has no name")
+		}
+		args = append(args, vg.VG, "--name", lv.Name)
+
+		if lv.Size != "" && lv.Extents != "" {
+			fatalf("LV has both size and extents defined!")
+		} else if lv.Size == "" && lv.Extents == "" {
+			fatalf("LV does not have size or extents defined!")
+		} else if lv.Size != "" {
+			args = append(args, "-L", lv.Size)
+		} else /* if lv.Extents != "" */ {
+			args = append(args, "-l", lv.Extents)
+		}
+
+		if raid := lv.Raid; raid != nil {
+			if raid.Mirrors != 0 {
+				args = append(args, "--mirrors", strconv.Itoa(raid.Mirrors))
+			}
+			if raid.Stripes != 0 {
+				args = append(args, "--stripes", strconv.Itoa(raid.Stripes))
+			}
+		}
+
+		log.Print("lvcreate args: ", args)
+		run("lvcreate", args...)
+
+		dev := "/dev/" + vg.VG + "/" + lv.Name
+		zeroDevStart(dev)
+
+		fs := lv.FS
+		if fs == "" {
+			fs = vg.Defaults.FS
+		}
+		createdDevs[dev] = fs
+	}
+}
+
+func zeroDevStart(dev string) {
+	f, err := os.OpenFile(dev, os.O_WRONLY, 0600)
+	if err != nil {
+		fatalf("failed to open %s: %v", dev, err)
+	}
+
+	defer f.Close()
+
+	_, err = f.Write(make([]byte, 8192))
+	if err != nil {
+		fatalf("failed to zero the beginning of %s: %v", dev, err)
+	}
+}
+
+func setupCrypt(devSpecs []config.CryptDev, createdDevs map[string]string) {
+	var password []byte
+	passwordVerified := false
+
+	// flat, expanded devices to open
+	devNames := make([]config.CryptDev, 0, len(devSpecs))
+
+	for _, devSpec := range devSpecs {
+		if devSpec.Dev == "" && devSpec.Prefix == "" {
+			fatalf("crypt: name %q: no dev or match set", devSpec.Name)
+		}
+		if devSpec.Dev != "" && devSpec.Prefix != "" {
+			fatalf("crypt: name %q: both dev (%q) and match (%q) are set", devSpec.Name, devSpec.Dev, devSpec.Prefix)
+		}
+
+		if devSpec.Dev != "" {
+			// already flat
+			devNames = append(devNames, devSpec)
+			continue
+		}
+
+		matches, err := filepath.Glob(devSpec.Prefix + "*")
+		if err != nil {
+			fatalf("failed to search for device matches: %v", err)
+		}
+
+		for _, m := range matches {
+			suffix := m[len(devSpec.Prefix):]
+
+			devNames = append(devNames, config.CryptDev{Dev: m, Name: devSpec.Name + suffix})
+		}
+	}
+
+	cryptDevs := map[string]bool{}
+
+	for _, devName := range devNames {
+		name, dev := devName.Name, devName.Dev
+
+		if name == "" {
+			name = filepath.Base(dev)
+		}
+
+		if cryptDevs[name] {
+			fatalf("duplicate crypt device name: %s", name)
+		}
+		cryptDevs[name] = true
+
+	retryOpen:
+		if len(password) == 0 {
+			password = askSecret("crypt password")
+
+			if len(password) == 0 {
+				fatalf("empty password given")
+			}
+		}
+
+		fs := createdDevs[dev]
+		delete(createdDevs, dev)
+
+		tgtDev := "/dev/mapper/" + name
+
+		needFormat := !devInitialized(dev)
+		if needFormat {
+			if !passwordVerified {
+			retry:
+				p2 := askSecret("verify crypt password")
+
+				eq := bytes.Equal(password, p2)
+
+				for i := range p2 {
+					p2[i] = 0
+				}
+
+				if !eq {
+					log.Print("passwords don't match")
+					goto retry
+				}
+			}
+
+			log.Print("formatting encrypted device ", dev)
+			cmd := exec.Command("cryptsetup", "luksFormat", dev, "--key-file=-")
+			cmd.Stdin = bytes.NewBuffer(password)
+			cmd.Stdout = stdout
+			cmd.Stderr = stderr
+			err := cmd.Run()
+			if err != nil {
+				fatalf("failed luksFormat: %v", err)
+			}
+
+			createdDevs[tgtDev] = fs
+		}
+
+		if len(password) == 0 {
+			password = askSecret("crypt password")
+
+			if len(password) == 0 {
+				fatalf("empty password given")
+			}
+		}
+
+		log.Print("openning encrypted device ", name, " from ", dev)
+		cmd := exec.Command("cryptsetup", "open", dev, name, "--key-file=-")
+		cmd.Stdin = bytes.NewBuffer(password)
+		cmd.Stdout = stdout
+		cmd.Stderr = stderr
+		err := cmd.Run()
+		if err != nil {
+			// maybe the password is wrong
+			for i := range password {
+				password[i] = 0
+			}
+			password = password[:0]
+			passwordVerified = false
+			goto retryOpen
+		}
+
+		if needFormat {
+			zeroDevStart(tgtDev)
+		}
+
+		passwordVerified = true
+	}
+
+	for i := range password {
+		password[i] = 0
+	}
+}
+
+func devInitialized(dev string) bool {
+	f, err := os.Open(dev)
+	if err != nil {
+		fatalf("failed to open %s: %v", dev, err)
+	}
+
+	defer f.Close()
+
+	ba := make([]byte, 8192)
+	_, err = f.Read(ba)
+	if err != nil {
+		fatalf("failed to read %s: %v", dev, err)
+	}
+
+	for _, b := range ba {
+		if b != 0 {
+			return true
+		}
+	}
+	return false
+}
+
+func setupFS(dev, fs string) {
+	if devInitialized(dev) {
+		log.Print("device ", dev, " already formatted")
+		return
+	}
+
+	if fs == "" {
+		fs = "ext4"
+	}
+
+	log.Print("formatting ", dev, " (", fs, ")")
+	args := make([]string, 0)
+
+	switch fs {
+	case "btrfs":
+		args = append(args, "-f")
+	case "ext4":
+		args = append(args, "-F")
+	}
+
+	run("mkfs."+fs, append(args, dev)...)
+}

lvm/lv.go

@@ -0,0 +1,19 @@
+package lvm
+
+type LVSReport struct {
+	Report []struct {
+		LV []LV `json:"lv"`
+	} `json:"report"`
+}
+
+type LV struct {
+	Name   string `json:"lv_name"`
+	VGName string `json:"vg_name"`
+}
+
+func (r LVSReport) LVs() (ret []LV) {
+	for _, rep := range r.Report {
+		ret = append(ret, rep.LV...)
+	}
+	return
+}

lvm/pv.go

@@ -0,0 +1,19 @@
+package lvm
+
+type PVSReport struct {
+	Report []struct {
+		PV []PV `json:"pv"`
+	} `json:"report"`
+}
+
+type PV struct {
+	Name   string `json:"pv_name"`
+	VGName string `json:"vg_name"`
+}
+
+func (r PVSReport) PVs() (ret []PV) {
+	for _, rep := range r.Report {
+		ret = append(ret, rep.PV...)
+	}
+	return
+}

main.go

@@ -3,24 +3,24 @@ package main
 import (
 	"fmt"
 	"io"
-	"io/ioutil"
 	"log"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"runtime"
-	"strings"
 	"syscall"
 	"time"
 
+	"github.com/pkg/term/termios"
 	"golang.org/x/term"
-	yaml "gopkg.in/yaml.v2"
-	"novit.nc/direktil/pkg/sysfs"
+
+	"novit.nc/direktil/initrd/colorio"
+	"novit.nc/direktil/initrd/shio"
 )
 
 const (
 	// VERSION is the current version of init
-	VERSION = "Direktil init v1.0"
+	VERSION = "Direktil init v2.0"
 
 	rootMountFlags  = 0
 	bootMountFlags  = syscall.MS_NOEXEC | syscall.MS_NODEV | syscall.MS_NOSUID | syscall.MS_RDONLY
@@ -29,155 +29,81 @@ const (
 
 var (
 	bootVersion string
+
+	stdin,
+	stdinPipe = newPipe()
+	stdout = shio.New()
+	stderr = colorio.NewWriter(colorio.Bold, stdout)
 )
 
+func newPipe() (io.ReadCloser, io.WriteCloser) {
+	return io.Pipe()
+}
+
 func main() {
+	switch baseName := filepath.Base(os.Args[0]); baseName {
+	case "init":
+		runInit()
+	default:
+		log.Fatal("unknown sub-command: ", baseName)
+	}
+}
+
+func runInit() {
+	if len(os.Args) > 1 && os.Args[1] == "hello" {
+		fmt.Println("hello world!")
+		os.Exit(0)
+	}
+
 	runtime.LockOSThread()
 
+	if pid := os.Getpid(); pid != 1 {
+		log.Fatal("init must be PID 1, not ", pid)
+	}
+
+	// move log to shio
+	go io.Copy(os.Stdout, stdout.NewReader())
+	log.SetOutput(stderr)
+
+	// copy os.Stdin to my stdin pipe
+	go io.Copy(stdinPipe, os.Stdin)
+
 	log.Print("Welcome to ", VERSION)
 
 	// essential mounts
 	mount("none", "/proc", "proc", 0, "")
 	mount("none", "/sys", "sysfs", 0, "")
 	mount("none", "/dev", "devtmpfs", 0, "")
+	mount("none", "/dev/pts", "devpts", 0, "gid=5,mode=620")
 
 	// get the "boot version"
 	bootVersion = param("version", "current")
 	log.Printf("booting system %q", bootVersion)
 
-	// find and mount /boot
-	bootMatch := param("boot", "")
-	bootMounted := false
-	if bootMatch != "" {
-		bootFS := param("boot.fs", "vfat")
-		for i := 0; ; i++ {
-			devNames := sysfs.DeviceByProperty("block", bootMatch)
+	os.Setenv("PATH", "/usr/bin:/bin:/usr/sbin:/sbin")
 
-			if len(devNames) == 0 {
-				if i > 30 {
-					fatal("boot partition not found after 30s")
-				}
-				log.Print("boot partition not found, retrying")
-				time.Sleep(1 * time.Second)
-				continue
-			}
-
-			devFile := filepath.Join("/dev", devNames[0])
-
-			log.Print("boot partition found: ", devFile)
-
-			mount(devFile, "/boot", bootFS, bootMountFlags, "")
-			bootMounted = true
-			break
-		}
-	} else {
-		log.Print("Assuming /boot is already populated.")
-	}
-
-	// load config
-	cfgPath := param("config", "/boot/config.yaml")
-
-	cfgBytes, err := ioutil.ReadFile(cfgPath)
+	_, err := os.Stat("/config.yaml")
 	if err != nil {
-		fatalf("failed to read %s: %v", cfgPath, err)
+		if os.IsNotExist(err) {
+			bootV1()
+			return
+		}
+		fatal("stat failed: ", err)
 	}
 
-	cfg := &config{}
-	if err := yaml.Unmarshal(cfgBytes, cfg); err != nil {
-		fatal("failed to load config: ", err)
+	bootV2()
 }
 
-	// mount layers
-	if len(cfg.Layers) == 0 {
-		fatal("no layers configured!")
-	}
-
-	log.Printf("wanted layers: %q", cfg.Layers)
-
-	layersInMemory := paramBool("layers-in-mem", false)
-
-	const layersInMemDir = "/layers-in-mem"
-	if layersInMemory {
-		mkdir(layersInMemDir, 0700)
-		mount("layers-mem", layersInMemDir, "tmpfs", 0, "")
-	}
-
-	lowers := make([]string, len(cfg.Layers))
-	for i, layer := range cfg.Layers {
-		path := layerPath(layer)
-
-		info, err := os.Stat(path)
-		if err != nil {
-			fatal(err)
-		}
-
-		log.Printf("layer %s found (%d bytes)", layer, info.Size())
-
-		if layersInMemory {
-			log.Print("  copying to memory...")
-			targetPath := filepath.Join(layersInMemDir, layer)
-			cp(path, targetPath)
-			path = targetPath
-		}
-
-		dir := "/layers/" + layer
-
-		lowers[i] = dir
-
-		loopDev := fmt.Sprintf("/dev/loop%d", i)
-		losetup(loopDev, path)
-
-		mount(loopDev, dir, "squashfs", layerMountFlags, "")
-	}
-
-	// prepare system root
-	mount("mem", "/changes", "tmpfs", 0, "")
-
-	mkdir("/changes/workdir", 0755)
-	mkdir("/changes/upperdir", 0755)
-
-	mount("overlay", "/system", "overlay", rootMountFlags,
-		"lowerdir="+strings.Join(lowers, ":")+",upperdir=/changes/upperdir,workdir=/changes/workdir")
-
-	if bootMounted {
-		if layersInMemory {
-			if err := syscall.Unmount("/boot", 0); err != nil {
-				log.Print("WARNING: failed to unmount /boot: ", err)
-				time.Sleep(2 * time.Second)
-			}
-
-		} else {
-			mount("/boot", "/system/boot", "", syscall.MS_BIND, "")
-		}
-	}
-
-	// - write configuration
-	log.Print("writing /config.yaml")
-	if err := ioutil.WriteFile("/system/config.yaml", cfgBytes, 0600); err != nil {
-		fatal("failed: ", err)
-	}
-
-	// - write files
-	for _, fileDef := range cfg.Files {
-		log.Print("writing ", fileDef.Path)
-
-		filePath := filepath.Join("/system", fileDef.Path)
-
-		ioutil.WriteFile(filePath, []byte(fileDef.Content), fileDef.Mode)
-	}
-
-	// clean zombies
-	cleanZombies()
-
-	// switch root
-	log.Print("switching root")
-	err = syscall.Exec("/sbin/switch_root", []string{"switch_root",
-		"-c", "/dev/console", "/system", "/sbin/init"}, os.Environ())
-	fatal("switch_root failed: ", err)
-}
+var (
+	layersDir      = "/boot/current/layers/"
+	layersOverride = map[string]string{}
+)
 
 func layerPath(name string) string {
-	return fmt.Sprintf("/boot/%s/layers/%s.fs", bootVersion, name)
+	if override, ok := layersOverride[name]; ok {
+		return override
+	}
+	return filepath.Join(layersDir, name+".fs")
 }
 
 func fatal(v ...interface{}) {
@@ -193,33 +119,77 @@ func fatalf(pattern string, v ...interface{}) {
 }
 
 func die() {
-	fmt.Println("\nwill reboot in 1 minute; press r to reboot now, o to power off")
+	log.SetOutput(os.Stderr)
+	stdout.Close()
+	stdin.Close()
+	stdinPipe.Close()
 
+	stdin = nil
+
+mainLoop:
+	for {
+		termios.Tcdrain(os.Stdin.Fd())
+		termios.Tcdrain(os.Stdout.Fd())
+		termios.Tcdrain(os.Stderr.Fd())
+
+		fmt.Print("\nr to reboot, o to power off, s to get a shell: ")
+
+		// TODO flush stdin (first char lost here?)
 		deadline := time.Now().Add(time.Minute)
-
-	term.MakeRaw(int(os.Stdin.Fd())) // disable line buffering
 		os.Stdin.SetReadDeadline(deadline)
 
-	b := []byte{0}
-	for {
+		termios.Tcflush(os.Stdin.Fd(), termios.TCIFLUSH)
+		term.MakeRaw(int(os.Stdin.Fd()))
+
+		b := make([]byte, 1)
 		_, err := os.Stdin.Read(b)
 		if err != nil {
-			break
+			log.Print("failed to read from stdin: ", err)
+			time.Sleep(5 * time.Second)
+			syscall.Reboot(syscall.LINUX_REBOOT_CMD_RESTART)
 		}
+		fmt.Println()
 
 		switch b[0] {
 		case 'o':
+			run("sync")
 			syscall.Reboot(syscall.LINUX_REBOOT_CMD_POWER_OFF)
 		case 'r':
+			run("sync")
 			syscall.Reboot(syscall.LINUX_REBOOT_CMD_RESTART)
-		}
+		case 's':
+			for _, sh := range []string{"bash", "ash", "sh", "busybox"} {
+				fullPath, err := exec.LookPath(sh)
+				if err != nil {
+					continue
 				}
 
-	syscall.Reboot(syscall.LINUX_REBOOT_CMD_RESTART)
+				args := make([]string, 0)
+				if sh == "busybox" {
+					args = append(args, "sh")
 				}
 
-func losetup(dev, file string) {
-	run("/sbin/losetup", dev, file)
+				if !localAuth() {
+					continue mainLoop
+				}
+
+				cmd := exec.Command(fullPath, args...)
+				cmd.Env = os.Environ()
+				cmd.Stdin = os.Stdin
+				cmd.Stdout = os.Stdout
+				cmd.Stderr = os.Stderr
+				err = cmd.Run()
+				if err != nil {
+					fmt.Println("shell failed:", err)
+				}
+				continue mainLoop
+			}
+			log.Print("failed to find a shell!")
+
+		default:
+			log.Printf("unknown choice: %q", string(b))
+		}
+	}
 }
 
 func run(cmd string, args ...string) {

modd.conf

@@ -1,6 +1,13 @@
-go.??? *.go {
+modd.conf {}
+
+go.??? **/*.go {
   prep: go test ./...
-  prep: dockb -t dkl-initrd .
-  prep: docker run dkl-initrd | docker exec -i dls sh -c "base64 -d >/var/lib/direktil/dist/initrd/1.0.7 && rm -rfv /var/lib/direktil/cache/*"
-  prep: curl -H'Autorization: Bearer adm1n' localhost:7606/hosts/m1/boot.iso >/tmp/m1-boot.iso
+  prep: mkdir -p dist
+  prep: go build -o dist/ ./tools/...
+}
+
+dist/init Dockerfile {
+  prep: docker build -t novit-initrd-gen .
+  prep: docker run novit-initrd-gen |base64 -d >dist/initrd.new
+  prep: mv dist/initrd.new dist/initrd
 }

modd.test.conf

@@ -0,0 +1,8 @@
+modd.test.conf {}
+
+dist/initrd dist/cpiocat test-initrd/* {
+    prep: cp -f dist/initrd test-initrd.cpio
+    prep: cd test-initrd && ../dist/cpiocat <../dist/initrd >../test-initrd.cpio *
+    prep: if cpio -t -F test-initrd.cpio 2>&1 |grep bytes.of.junk; then echo "bad cpio archive"; exit 1; fi
+    prep: kill $(<qemu.pid)
+}

network.go

@@ -0,0 +1,75 @@
+package main
+
+import (
+	"log"
+	"net"
+	"os/exec"
+	"strings"
+
+	config "novit.tech/direktil/pkg/bootstrapconfig"
+)
+
+func setupNetworks(cfg *config.Config) {
+	if len(cfg.Networks) == 0 {
+		log.Print("no networks configured.")
+		return
+	}
+
+	ifNames := make([]string, 0)
+	{
+		ifaces, err := net.Interfaces()
+		if err != nil {
+			fatal("failed")
+		}
+		for _, iface := range ifaces {
+			ifNames = append(ifNames, iface.Name)
+		}
+	}
+
+	assigned := map[string]bool{}
+
+	for _, network := range cfg.Networks {
+		log.Print("setting up network ", network.Name)
+
+		// compute available names
+		if len(assigned) != 0 {
+			newNames := make([]string, 0, len(ifNames))
+			for _, n := range ifNames {
+				if assigned[n] {
+					continue
+				}
+				newNames = append(newNames, n)
+			}
+			ifNames = newNames
+		}
+
+		// assign envvars
+		envvars := make([]string, 0, 1+len(network.Interfaces))
+		envvars = append(envvars, "PATH=/bin:/sbin:/usr/bin:/usr/sbin")
+
+		for _, match := range network.Interfaces {
+			envvar := new(strings.Builder)
+			envvar.WriteString(match.Var)
+			envvar.WriteByte('=')
+
+			for i, m := range regexpSelectN(match.N, match.Regexps, ifNames) {
+				if i != 0 {
+					envvar.WriteByte(' ')
+				}
+				envvar.WriteString(m)
+				assigned[m] = true
+			}
+
+			log.Print("- ", envvar)
+			envvars = append(envvars, envvar.String())
+		}
+
+		cmd := exec.Command("/bin/sh", "-c", network.Script)
+		cmd.Env = envvars
+		cmd.Stdout = stdout
+		cmd.Stderr = stderr
+		if err := cmd.Run(); err != nil {
+			fatal("failed to setup network: ", err)
+		}
+	}
+}

params.go

@@ -1,12 +1,12 @@
 package main
 
 import (
-	"io/ioutil"
+	"os"
 	"strings"
 )
 
 func param(name, defaultValue string) (value string) {
-	ba, err := ioutil.ReadFile("/proc/cmdline")
+	ba, err := os.ReadFile("/proc/cmdline")
 	if err != nil {
 		fatal("could not read /proc/cmdline: ", err)
 	}

regexp.go

@@ -0,0 +1,39 @@
+package main
+
+import (
+	"log"
+	"regexp"
+)
+
+func regexpSelectN(n int, regexps []string, names []string) (matches []string) {
+	if n <= 0 {
+		matches = make([]string, 0)
+	} else {
+		matches = make([]string, 0, n)
+	}
+
+	res := make([]*regexp.Regexp, 0, len(regexps))
+	for _, reStr := range regexps {
+		re, err := regexp.Compile(reStr)
+		if err != nil {
+			log.Printf("warning: invalid regexp ignored: %q: %v", reStr, err)
+			continue
+		}
+		res = append(res, re)
+	}
+
+namesLoop:
+	for _, name := range names {
+		if len(matches) == n {
+			break
+		}
+		for _, re := range res {
+			if re.MatchString(name) {
+				matches = append(matches, name)
+				continue namesLoop
+			}
+		}
+	}
+
+	return
+}

run-test.sh

@@ -0,0 +1,19 @@
+#! /bin/sh
+
+disk1=tmp/test-vda.qcow2
+disk2=tmp/test-vdb.qcow2
+
+if ! [ -e $disk1 ]; then
+    qemu-img create -f qcow2 $disk1 10G
+fi
+if ! [ -e $disk2 ]; then
+    qemu-img create -f qcow2 $disk2 10G
+fi
+
+exec qemu-system-x86_64 -pidfile qemu.pid -kernel test-kernel -initrd test-initrd.cpio \
+    -smp 2 -m 2048 \
+    -netdev bridge,br=novit,id=eth0 -device virtio-net-pci,netdev=eth0 \
+    -drive file=$disk1,if=virtio \
+    -drive file=$disk2,if=virtio \
+    -nographic -serial mon:stdio -append 'console=ttyS0'
+#    -display curses

run.go

@@ -0,0 +1,18 @@
+package main
+
+import (
+	"encoding/json"
+	"os/exec"
+)
+
+func runJSON(v interface{}, cmd string, args ...string) (err error) {
+	c := exec.Command(cmd, args...)
+	c.Stderr = stderr
+	ba, err := c.Output()
+	if err != nil {
+		return
+	}
+
+	err = json.Unmarshal(ba, v)
+	return
+}

shio/shio.go

@@ -0,0 +1,118 @@
+// Shared IO
+package shio
+
+import (
+	"io"
+	"sync"
+
+	"novit.nc/direktil/initrd/colorio"
+)
+
+type ShIO struct {
+	buf       []byte
+	closed    bool
+	cond      *sync.Cond
+	hideInput bool
+}
+
+func New() *ShIO {
+	return NewWithCap(1024)
+}
+func NewWithCap(capacity int) *ShIO {
+	return NewWithBytes(make([]byte, 0, capacity))
+}
+func NewWithBytes(content []byte) *ShIO {
+	return &ShIO{
+		buf:  content,
+		cond: sync.NewCond(&sync.Mutex{}),
+	}
+}
+
+var (
+	_ io.WriteCloser = New()
+)
+
+func (s *ShIO) Write(data []byte) (n int, err error) {
+	s.cond.L.Lock()
+	defer s.cond.L.Unlock()
+
+	if s.closed {
+		err = io.EOF
+		return
+	}
+
+	if s.hideInput {
+		s.buf = append(s.buf, colorio.Reset...)
+	}
+
+	s.buf = append(s.buf, data...)
+	n = len(data)
+
+	if s.hideInput {
+		s.buf = append(s.buf, colorio.Hidden...)
+	}
+
+	s.cond.Broadcast()
+	return
+}
+
+func (s *ShIO) HideInput() {
+	s.cond.L.Lock()
+	defer s.cond.L.Unlock()
+
+	if s.closed {
+		return
+	}
+
+	s.buf = append(s.buf, colorio.Hidden...)
+	s.hideInput = true
+}
+func (s *ShIO) ShowInput() {
+	s.cond.L.Lock()
+	defer s.cond.L.Unlock()
+
+	if s.closed {
+		return
+	}
+
+	s.buf = append(s.buf, colorio.Reset...)
+	s.hideInput = false
+}
+
+func (s *ShIO) Close() (err error) {
+	s.cond.L.Lock()
+	defer s.cond.L.Unlock()
+
+	s.closed = true
+
+	s.cond.Broadcast()
+	return
+}
+
+func (s *ShIO) NewReader() io.Reader {
+	return &shioReader{s, 0}
+}
+
+type shioReader struct {
+	in  *ShIO
+	pos int
+}
+
+func (r *shioReader) Read(ba []byte) (n int, err error) {
+	r.in.cond.L.Lock()
+	defer r.in.cond.L.Unlock()
+
+	for r.pos == len(r.in.buf) && !r.in.closed {
+		r.in.cond.Wait()
+	}
+
+	if r.pos == len(r.in.buf) && r.in.closed {
+		err = io.EOF
+		return
+	}
+
+	n = copy(ba, r.in.buf[r.pos:])
+	r.pos += n
+
+	return
+}

shio/shio_test.go

@@ -0,0 +1,52 @@
+package shio
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"sync"
+	"time"
+)
+
+func ExampleOutput() {
+	done := false
+	defer func() { done = true }()
+	go func() {
+		time.Sleep(time.Second)
+		if !done {
+			panic("timeout")
+		}
+	}()
+
+	shio := NewWithCap(3)
+
+	r1 := shio.NewReader()
+
+	// read as you write
+	wg := new(sync.WaitGroup)
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		io.Copy(os.Stdout, r1)
+		fmt.Println("-- r1 done --")
+	}()
+
+	fmt.Fprintln(shio, "hello1")
+	fmt.Fprintln(shio, "hello2")
+	shio.Close()
+
+	wg.Wait()
+
+	// read after close
+	r2 := shio.NewReader()
+	io.Copy(os.Stdout, r2)
+	fmt.Println("-- r2 done --")
+
+	// Output:
+	// hello1
+	// hello2
+	// -- r1 done --
+	// hello1
+	// hello2
+	// -- r2 done --
+}

ssh.go

@@ -0,0 +1,244 @@
+package main
+
+import (
+	"encoding/binary"
+	"fmt"
+	"io"
+	"log"
+	"net"
+	"os"
+	"os/exec"
+	"sync"
+	"syscall"
+	"unsafe"
+
+	"github.com/kr/pty"
+	"golang.org/x/crypto/ssh"
+
+	config "novit.tech/direktil/pkg/bootstrapconfig"
+)
+
+func startSSH(cfg *config.Config) {
+	sshConfig := &ssh.ServerConfig{
+		PublicKeyCallback: sshCheckPubkey,
+	}
+
+	pkBytes, err := os.ReadFile("/id_rsa") // TODO configurable
+	if err != nil {
+		fatalf("ssh: failed to load private key: %v", err)
+	}
+
+	pk, err := ssh.ParsePrivateKey(pkBytes)
+	if err != nil {
+		fatalf("ssh: failed to parse private key: %v", err)
+	}
+
+	sshConfig.AddHostKey(pk)
+
+	sshBind := ":22" // TODO configurable
+	listener, err := net.Listen("tcp", sshBind)
+	if err != nil {
+		fatalf("ssh: failed to listen on %s: %v", sshBind, err)
+	}
+
+	log.Print("SSH server listening on ", sshBind)
+
+	go func() {
+		for {
+			conn, err := listener.Accept()
+			if err != nil {
+				log.Print("ssh: accept conn failed: ", err)
+				continue
+			}
+
+			go sshHandleConn(conn, sshConfig)
+		}
+	}()
+}
+
+func sshHandleConn(conn net.Conn, sshConfig *ssh.ServerConfig) {
+	sshConn, chans, reqs, err := ssh.NewServerConn(conn, sshConfig)
+
+	if err != nil {
+		log.Print("ssh: handshake failed: ", err)
+		return
+	}
+
+	remoteAddr := sshConn.User() + "@" + sshConn.RemoteAddr().String()
+	log.Print("ssh: new connection from ", remoteAddr)
+
+	go sshHandleReqs(reqs)
+	go sshHandleChannels(remoteAddr, chans)
+}
+
+func sshHandleReqs(reqs <-chan *ssh.Request) {
+	for req := range reqs {
+		switch req.Type {
+		case "keepalive@openssh.com":
+			req.Reply(true, nil)
+
+		default:
+			log.Printf("ssh: discarding req: %+v", req)
+			req.Reply(false, nil)
+		}
+	}
+}
+
+func sshHandleChannels(remoteAddr string, chans <-chan ssh.NewChannel) {
+	for newChannel := range chans {
+		if t := newChannel.ChannelType(); t != "session" {
+			newChannel.Reject(ssh.UnknownChannelType, fmt.Sprintf("unknown channel type: %s", t))
+			continue
+		}
+
+		channel, requests, err := newChannel.Accept()
+		if err != nil {
+			log.Print("ssh: failed to accept channel: ", err)
+			continue
+		}
+
+		go sshHandleChannel(remoteAddr, channel, requests)
+	}
+}
+
+func sshHandleChannel(remoteAddr string, channel ssh.Channel, requests <-chan *ssh.Request) {
+	var (
+		ptyF, ttyF *os.File
+		termEnv    string
+	)
+
+	defer func() {
+		if ptyF != nil {
+			ptyF.Close()
+		}
+		if ttyF != nil {
+			ttyF.Close()
+		}
+	}()
+
+	var once sync.Once
+	closeCh := func() {
+		channel.Close()
+	}
+
+	for req := range requests {
+		switch req.Type {
+		case "exec":
+			command := string(req.Payload[4 : req.Payload[3]+4])
+			switch command {
+			case "init":
+				go func() {
+					io.Copy(channel, stdout.NewReader())
+					once.Do(closeCh)
+				}()
+				go func() {
+					io.Copy(stdinPipe, channel)
+					once.Do(closeCh)
+				}()
+
+				req.Reply(true, nil)
+
+			case "bootstrap":
+				// extract a new bootstrap package
+				os.MkdirAll("/bootstrap/current", 0750)
+
+				cmd := exec.Command("/bin/tar", "xv", "-C", "/bootstrap/current")
+				cmd.Stdin = channel
+				cmd.Stdout = channel
+				cmd.Stderr = channel.Stderr()
+
+				go func() {
+					cmd.Run()
+					closeCh()
+				}()
+
+				req.Reply(true, nil)
+
+			default:
+				req.Reply(false, nil)
+			}
+
+		case "shell":
+			cmd := exec.Command("/bin/ash")
+			cmd.Env = []string{"TERM=" + termEnv}
+			cmd.Stdin = ttyF
+			cmd.Stdout = ttyF
+			cmd.Stderr = ttyF
+			cmd.SysProcAttr = &syscall.SysProcAttr{
+				Setctty:   true,
+				Setsid:    true,
+				Pdeathsig: syscall.SIGKILL,
+			}
+
+			cmd.Start()
+
+			go func() {
+				cmd.Wait()
+				ptyF.Close()
+				ptyF = nil
+				ttyF.Close()
+				ttyF = nil
+			}()
+
+			go func() {
+				io.Copy(channel, ptyF)
+				once.Do(closeCh)
+			}()
+			go func() {
+				io.Copy(ptyF, channel)
+				once.Do(closeCh)
+			}()
+
+			req.Reply(true, nil)
+
+		case "pty-req":
+			if ptyF != nil || ttyF != nil {
+				req.Reply(false, nil)
+				continue
+			}
+
+			var err error
+			ptyF, ttyF, err = pty.Open()
+			if err != nil {
+				log.Print("PTY err: ", err)
+				req.Reply(false, nil)
+				continue
+			}
+
+			termLen := req.Payload[3]
+			termEnv = string(req.Payload[4 : termLen+4])
+			w, h := sshParseDims(req.Payload[termLen+4:])
+			sshSetWinsize(ptyF.Fd(), w, h)
+
+			req.Reply(true, nil)
+
+		case "window-change":
+			w, h := sshParseDims(req.Payload)
+			sshSetWinsize(ptyF.Fd(), w, h)
+			// no response
+
+		default:
+			req.Reply(false, nil)
+		}
+	}
+}
+
+func sshParseDims(b []byte) (uint32, uint32) {
+	w := binary.BigEndian.Uint32(b)
+	h := binary.BigEndian.Uint32(b[4:])
+	return w, h
+}
+
+// SetWinsize sets the size of the given pty.
+func sshSetWinsize(fd uintptr, w, h uint32) {
+	// Winsize stores the Height and Width of a terminal.
+	type Winsize struct {
+		Height uint16
+		Width  uint16
+		x      uint16 // unused
+		y      uint16 // unused
+	}
+
+	ws := &Winsize{Width: uint16(w), Height: uint16(h)}
+	syscall.Syscall(syscall.SYS_IOCTL, fd, uintptr(syscall.TIOCSWINSZ), uintptr(unsafe.Pointer(ws)))
+}

test-initrd/config.yaml

@@ -0,0 +1,80 @@
+---
+# early system configuration
+anti_phishing_code: "direktil<3"
+
+modules: /modules.sqfs
+
+auths:
+  - name:     novit
+    sshKey:   ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICkpbU6sf4t0f6XAv9DuW3XH5iLM0AI5rc8PT2jwea1N
+    password: bXlzZWVk:HMSxrg1cYphaPuUYUbtbl/htep/tVYYIQAuvkNMVpw0 # mypass
+
+networks:
+- name: loopback
+  interfaces: [ { var: iface, n: 1, regexps: [ "^lo$" ] } ]
+  script: |
+    ip a add 127.0.0.1/8 dev lo
+    ip a add ::1/128 dev lo
+    ip li set lo up
+- name: main
+  interfaces:
+  - var: iface
+    n: 1
+    regexps:
+    - eth.*
+    - veth.*
+    - eno.*
+    - enp.*
+  script: |
+    ip a add 2001:41d0:306:168f::1337:2eed/64 dev $iface
+    ip li set $iface up
+    #udhcpc $iface
+
+lvm:
+- vg: storage
+  pvs:
+    n: 2
+    regexps:
+    # to match full disks
+    - /dev/nvme[0-9]+n[0-9]+
+    - /dev/vd[a-z]+
+    - /dev/sd[a-z]+
+    - /dev/hd[a-z]+
+    # to match partitions:
+    #- /dev/nvme[0-9]+n[0-9]+p[0-9]+
+    #- /dev/vd[a-z]+[0-9]+
+    #- /dev/sd[a-z]+[0-9]+
+    #- /dev/hd[a-z]+[0-9]+
+
+  defaults:
+    fs: ext4
+    raid:
+      mirrors: 1
+
+  lvs:
+  - name: bootstrap
+    size: 2g
+
+  - name: varlog
+    extents: 10%FREE
+    # size: 10g
+
+  - name: podman
+    extents: 10%FREE
+    # size: 10g
+
+  - name: dls
+    extents: 100%FREE
+    # size: 10g
+
+crypt:
+- dev: /dev/storage/bootstrap
+- dev: /dev/storage/dls
+
+bootstrap:
+  dev: /dev/mapper/bootstrap
+  # TODO seed: https://direktil.novit.io/bootstraps/dls-crypt
+  seed: http://192.168.10.254:7606/hosts/m1/bootstrap.tar
+  # TODO seed_sign_key: "..."
+  # TODO load_and_close: true
+

test-initrd/env

@@ -0,0 +1,2 @@
+gateway=192.168.1.1/24
+address=192.168.1.27/24

test-initrd/id_rsa

@@ -0,0 +1,38 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
+NhAAAAAwEAAQAAAYEAy6Ppr/tBiVYsBYiteGwMPI+B2BSBn+CP36ZiKsx6IX+9E0/nGKgC
+khwWFfrmIzS2EIm+iIv7YT3sXsqcO96au2ewh77m5xUFIrqie5c13leNeOn+Xhy++v0705
+irYUuBVRbWukpQjhOrp0eqvBzOdlUoo2r7aF95rrMboAsIWh5gTTnVCXDSEQiHsvEGjs7T
+ytOXQ6zmYTECYEkk/wUWja7WNP8UZiaPuU20Hso8g7kHSthKEudUDFs7E/yx+na0AYCnfE
+UR6oxIbHH2ldgpnX7lTv5YhHVvNnqTIBQhmLTHrT/67N2z5AvdFC8T2UsrWs+3ebsdXb0o
+Kzx81+N9OpPxj93ehLznncuCCgAedye5Xm760SOaU1T2b3f0bEhhsVCMI39mPExeZ2wtnd
+g+Tmrqn3r59vb3iEYfJqvgLCTJ5L1BcFUTfulg7GfhfNvgBmgiiRTUC2G0SrV1tM84vsE7
+JyyTcJaXr0X+tUgsXoUqnlX53OEw7ABskWvZ0m0fAAAFiBu7krYbu5K2AAAAB3NzaC1yc2
+EAAAGBAMuj6a/7QYlWLAWIrXhsDDyPgdgUgZ/gj9+mYirMeiF/vRNP5xioApIcFhX65iM0
+thCJvoiL+2E97F7KnDvemrtnsIe+5ucVBSK6onuXNd5XjXjp/l4cvvr9O9OYq2FLgVUW1r
+pKUI4Tq6dHqrwcznZVKKNq+2hfea6zG6ALCFoeYE051Qlw0hEIh7LxBo7O08rTl0Os5mEx
+AmBJJP8FFo2u1jT/FGYmj7lNtB7KPIO5B0rYShLnVAxbOxP8sfp2tAGAp3xFEeqMSGxx9p
+XYKZ1+5U7+WIR1bzZ6kyAUIZi0x60/+uzds+QL3RQvE9lLK1rPt3m7HV29KCs8fNfjfTqT
+8Y/d3oS8553LggoAHncnuV5u+tEjmlNU9m939GxIYbFQjCN/ZjxMXmdsLZ3YPk5q6p96+f
+b294hGHyar4CwkyeS9QXBVE37pYOxn4Xzb4AZoIokU1AthtEq1dbTPOL7BOycsk3CWl69F
+/rVILF6FKp5V+dzhMOwAbJFr2dJtHwAAAAMBAAEAAAGBAJ0rDBBjtkgd9unqfCAmHCedht
+RTt1vCgKhXjQqFOHmkUjSWhcD04s8L2EvskjR32VDYTvKqP0Dk/wqGC6D1hKzBMXEDeMi+
+43DTZNZIdS3+mtTInCbcvtWOHt+HxDXahZ47e0zaUGPncKMx3+dBwGN6BFxkFFeQ4KRh3h
+9ehHqxWRghW3fm2GqHD9yew7XykWnIdsWnq0M2BSR1L5WXwrllSDQs7vyMJH8bJrpg0eXE
+J4mvdzQx0B+dRfJ+JIsvkwvieAPb6sPmSgY47moP0xhbvs7/1UxPEY0Q2FpjQALQ0CnIC2
+LRHvGb7NJEX/ASDy/s1CNlk5ro/iht28wh0Iq8iqqpRkgKyhYsr8+QChs6oxcbx2xPRVy4
+NOBMLW6ppjIQO3rE79zPrp9tTmew5iQ4V58+DqhAZxeI4A6YZE98rAvRREqnT6HVmqtfHl
+gPMlrSDw1I8ZN8QT1dD1sMbi4Ud0eHdg1xLUpJ3dStgN45yhBiWuR2x4Jbn8ayeZwJmQAA
+AMA971gUyqrb7D6oFerzx3prijJoZOLE1Zluo3Q9Ise4KgDZ66QDE7mQRzSEniZcy77mSt
+VOhjVmI5CXREbpdGU6LxJujIAm4pKwyVEV8XVAzII6s4He5QUBxiLYWHDro3bOSmOZ50tk
+WBTO7llCR5FGbi7iJ1CP0C+CXRSaH8ug8Xqd0HBzTB2nXTGJNyx9lBwLY837VcdUIRrr+7
+QzVD/BQ/v+Ch21Ck0kMtLCv+lrXAeowsK89ExDp4HqMnOHnT0AAADBAObxbkJeoXfkmV7e
+0nAyQ/IDTs3Zlm3517mTzvc7j2o0qJQty+9pLD60S5s0VUpQpgeT3LzXRZ2eZlq3FcWsRa
+HyiovF6L5OUik1gVc/QiP+x6QSLdFi/ROHRT7DZFQ+1/bquGgVsoEVZJPDz7NJvBPLYwmj
+EGRZeKWVjIcDLSGq6fek9aTFUe7bcDCHx+QuovxeFWncmTNYC7jaYMff6DtHjokLgsyOzF
+FjYEC9wFVrEz+9oegDxatiJpWJN1zTWwAAAMEA4bwhyUDs0oyQ+16xpdd4f8PYfQ0HoLow
+ckvWCNS2Xmpnbe+dYqqRw7mchnYj4uXvhi391LwWTea5bQ78Hj+DnMugOLmmcHuFAbkxeL
+9x97iCIUrli5wawGfJgwPiGJlATUVz9Y3BOcg+uBmQ9qGR6wdI6N+zuu/54gGzW2gVanYs
+Gs0JH+C+afZ2yitUuGXDIVlYdgjESIszdK0wNGzZ4HDleFVhK3jFiK1CHHBb89Tbmd6fMZ
+NWpcpue2AYSUyNAAAADXRlc3RAbm92aXQuaW8BAgMEBQ==
+-----END OPENSSH PRIVATE KEY-----

test-initrd/id_rsa.pub

@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDLo+mv+0GJViwFiK14bAw8j4HYFIGf4I/fpmIqzHohf70TT+cYqAKSHBYV+uYjNLYQib6Ii/thPexeypw73pq7Z7CHvubnFQUiuqJ7lzXeV4146f5eHL76/TvTmKthS4FVFta6SlCOE6unR6q8HM52VSijavtoX3musxugCwhaHmBNOdUJcNIRCIey8QaOztPK05dDrOZhMQJgSST/BRaNrtY0/xRmJo+5TbQeyjyDuQdK2EoS51QMWzsT/LH6drQBgKd8RRHqjEhscfaV2CmdfuVO/liEdW82epMgFCGYtMetP/rs3bPkC90ULxPZSytaz7d5ux1dvSgrPHzX4306k/GP3d6EvOedy4IKAB53J7lebvrRI5pTVPZvd/RsSGGxUIwjf2Y8TF5nbC2d2D5Oauqfevn29veIRh8mq+AsJMnkvUFwVRN+6WDsZ+F82+AGaCKJFNQLYbRKtXW0zzi+wTsnLJNwlpevRf61SCxehSqeVfnc4TDsAGyRa9nSbR8= test@novit.io

tools/cpiocat/main.go

@@ -0,0 +1,18 @@
+package main
+
+import (
+	"flag"
+	"log"
+	"os"
+
+	"novit.tech/direktil/pkg/cpiocat"
+)
+
+func main() {
+	flag.Parse()
+
+	err := cpiocat.Append(os.Stdout, os.Stdin, flag.Args())
+	if err != nil {
+		log.Fatal(err)
+	}
+}

tty.go

@@ -0,0 +1,38 @@
+package main
+
+import (
+	"os"
+
+	"golang.org/x/sys/unix"
+)
+
+var (
+	stdinTTY = &tty{int(os.Stdin.Fd()), nil}
+)
+
+type tty struct {
+	fd      int
+	termios *unix.Termios
+}
+
+func (t *tty) EchoOff() {
+	termios, err := unix.IoctlGetTermios(t.fd, unix.TCGETS)
+	if err != nil {
+		return
+	}
+
+	t.termios = termios
+
+	newState := *termios
+	newState.Lflag &^= unix.ECHO
+	newState.Lflag |= unix.ICANON | unix.ISIG
+	newState.Iflag |= unix.ICRNL
+	unix.IoctlSetTermios(t.fd, unix.TCSETS, &newState)
+}
+
+func (t *tty) Restore() {
+	if t.termios != nil {
+		unix.IoctlSetTermios(t.fd, unix.TCSETS, t.termios)
+		t.termios = nil
+	}
+}

uname.go

@@ -0,0 +1,20 @@
+package main
+
+import "syscall"
+
+func unameRelease() string {
+	uname := &syscall.Utsname{}
+	if err := syscall.Uname(uname); err != nil {
+		fatalf("failed to get kernel version: %v", err)
+	}
+
+	ba := make([]byte, 0, len(uname.Release))
+	for _, c := range uname.Release {
+		if c == 0 {
+			break
+		}
+		ba = append(ba, byte(c))
+	}
+
+	return string(ba)
+}

vpn.go

@@ -0,0 +1,125 @@
+package main
+
+import (
+	"log"
+	"net"
+	"os"
+	"path/filepath"
+
+	"golang.zx2c4.com/wireguard/wgctrl"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"novit.tech/direktil/pkg/config"
+)
+
+func setupVPN(vpn config.VPNDef, localGenDir string) {
+	log.Printf("setting up VPN %s", vpn.Name)
+
+	vpnDir := filepath.Join(localGenDir, vpn.Name)
+	os.MkdirAll(vpnDir, 0750)
+
+	// public/private key
+	keyFile := filepath.Join(vpnDir, "key")
+	keyBytes, err := os.ReadFile(keyFile)
+	if os.IsNotExist(err) {
+		key, err := wgtypes.GeneratePrivateKey()
+		if err != nil {
+			fatalf("failed to generate VPN key: %v", err)
+		}
+
+		keyBytes = []byte(key.String())
+
+		os.WriteFile(keyFile, keyBytes, 0600)
+	} else if err != nil {
+		fatalf("failed to read VPN key: %v", err)
+	}
+
+	key, err := wgtypes.ParseKey(string(keyBytes))
+	if err != nil {
+		fatalf("bad VPN key: %v", err)
+	}
+
+	log.Printf("VPN %s public key is %s", vpn.Name, key.PublicKey().String())
+
+	// pre-shared key
+	pskeyFile := filepath.Join(vpnDir, "pskey")
+	pskeyBytes, err := os.ReadFile(pskeyFile)
+	if os.IsNotExist(err) {
+		key, err := wgtypes.GenerateKey()
+		if err != nil {
+			fatalf("failed to generate VPN pre-shared key: %v", err)
+		}
+
+		pskeyBytes = []byte(key.String())
+
+		os.WriteFile(pskeyFile, pskeyBytes, 0600)
+	} else if err != nil {
+		fatalf("failed to read VPN pre-shared key: %v", err)
+	}
+
+	pskey, err := wgtypes.ParseKey(string(pskeyBytes))
+	if err != nil {
+		fatalf("bad VPN pre-shared key: %v", err)
+	}
+
+	log.Printf("VPN %s pre-shared key is %s", vpn.Name, key.String())
+
+	// setup interface
+	cfg := wgtypes.Config{
+		PrivateKey: &key,
+		ListenPort: vpn.ListenPort,
+		Peers:      make([]wgtypes.PeerConfig, 0, len(vpn.Peers)),
+	}
+
+	for idx, vpnPeer := range vpn.Peers {
+		vpnPeer := vpnPeer
+
+		wgPeer := wgtypes.PeerConfig{
+			Endpoint:   vpnPeer.Endpoint,
+			AllowedIPs: make([]net.IPNet, 0, len(vpnPeer.AllowedIPs)),
+
+			PersistentKeepaliveInterval: &vpnPeer.KeepAlive,
+		}
+
+		if vpnPeer.WithPreSharedKey {
+			wgPeer.PresharedKey = &pskey
+		}
+
+		pubkey, err := wgtypes.ParseKey(vpnPeer.PublicKey)
+		if err != nil {
+			fatalf("bad VPN peer[%d] public key: %v", idx, err)
+		}
+
+		wgPeer.PublicKey = pubkey
+
+		for _, ipnetStr := range vpnPeer.AllowedIPs {
+			_, ipnet, err := net.ParseCIDR(ipnetStr)
+			if err != nil {
+				fatalf("bad IP/net: %q: %v", ipnetStr, err)
+			}
+
+			wgPeer.AllowedIPs = append(wgPeer.AllowedIPs, *ipnet)
+		}
+
+		cfg.Peers = append(cfg.Peers, wgPeer)
+	}
+
+	wg, err := wgctrl.New()
+	if err != nil {
+		fatalf("failed to setup WireGuard client: %v", err)
+	}
+	defer wg.Close()
+
+	run("ip", "link", "add", vpn.Name, "type", "wireguard")
+
+	for _, ip := range vpn.IPs {
+		run("ip", "addr", "add", ip, "dev", vpn.Name)
+	}
+
+	err = wg.ConfigureDevice(vpn.Name, cfg)
+	if err != nil {
+		fatalf("failed to setup VPN %s: %v", vpn.Name, err)
+	}
+
+	run("ip", "link", "set", vpn.Name, "up")
+}

zombies.go

@@ -6,6 +6,8 @@ import (
 )
 
 func cleanZombies() {
+	return // FIXME noop... udhcpc is a daemon staying alive so we never finish
+
 	var wstatus syscall.WaitStatus
 
 	for {