wip

no real benefit vs go for now
introduce rust
2024-06-28 21:54:17 +02:00 · 2024-05-15 09:59:57 +11:00 · 2024-04-29 12:54:25 +02:00
72 changed files with 2725 additions and 2803 deletions
--- a/.dockerignore
+++ b/.dockerignore
@ -1,5 +1,4 @@
 Dockerfile
 modd.*
 tmp/**/*
 dist/*
 go.work
--- a/.gitignore
+++ b/.gitignore
@ -2,7 +2,6 @@
 /dist
 /qemu.pid
 /test-initrd.cpio
 /bootstrap.tar
 /tmp
 /go.work
 /go.work.sum
--- a/Cargo.lock
+++ b/Cargo.lock
@ -1,21 +1,21 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
-version = 4
+version = 3
 [[package]]
 name = "addr2line"
-version = "0.24.2"
+version = "0.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfbe277e56a376000877090da837660b4427aad530e3028d44e0bffe4f89a1c1"
+checksum = "6e4503c46a5c0c7844e948c9a4d6acd9f50cccb4de1c48eb9e291ea17470c678"
 dependencies = [
 "gimli",
 ]
 [[package]]
-name = "adler2"
+name = "adler"
-version = "2.0.1"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
 [[package]]
 name = "aho-corasick"
@ -28,9 +28,9 @@ dependencies = [
 [[package]]
 name = "anstream"
-version = "0.6.19"
+version = "0.6.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "301af1932e46185686725e0fad2f8f2aa7da69dd70bf6ecc44d6b703844a3933"
+checksum = "418c75fa768af9c03be99d17643f93f79bbba589895012a80e3452a19ddda15b"
 dependencies = [
 "anstyle",
 "anstyle-parse",
@ -43,112 +43,88 @@ dependencies = [
 [[package]]
 name = "anstyle"
-version = "1.0.11"
+version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "862ed96ca487e809f1c8e5a8447f6ee2cf102f846893800b20cebdf541fc6bbd"
+checksum = "038dfcf04a5feb68e9c60b21c9625a54c2c0616e79b72b0fd87075a056ae1d1b"
 [[package]]
 name = "anstyle-parse"
-version = "0.2.7"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2"
+checksum = "c03a11a9034d92058ceb6ee011ce58af4a9bf61491aa7e1e59ecd24bd40d22d4"
 dependencies = [
 "utf8parse",
 ]
 [[package]]
 name = "anstyle-query"
-version = "1.1.3"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c8bdeb6047d8983be085bab0ba1472e6dc604e7041dbf6fcd5e71523014fae9"
+checksum = "a64c907d4e79225ac72e2a354c9ce84d50ebb4586dee56c82b3ee73004f537f5"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.52.0",
 ]
 [[package]]
 name = "anstyle-wincon"
-version = "3.0.9"
+version = "3.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "403f75924867bb1033c59fbf0797484329750cfbe3c4325cd33127941fabc882"
+checksum = "61a38449feb7068f52bb06c12759005cf459ee52bb4adc1d5a7c4322d716fb19"
 dependencies = [
 "anstyle",
- "once_cell_polyfill",
+ "windows-sys 0.52.0",
 "windows-sys 0.59.0",
 ]
 [[package]]
-name = "backtrace"
+name = "anyhow"
-version = "0.3.75"
+version = "1.0.86"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6806a6321ec58106fea15becdad98371e28d92ccbc7c8f1b3b6dd724fe8f1002"
+checksum = "b3d1d046238990b9cf5bcde22a3fb3584ee5cf65fb2765f454ed428c7a0063da"
 [[package]]
 name = "backtrace"
 version = "0.3.73"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5cc23269a4f8976d0a4d2e7109211a419fe30e8d88d677cd60b6bc79c5732e0a"
 dependencies = [
 "addr2line",
 "cc",
 "cfg-if",
 "libc",
 "miniz_oxide",
 "object",
 "rustc-demangle",
 "windows-targets",
 ]
 [[package]]
 name = "bitflags"
 version = "2.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b8e56985ec62d17e9c1001dc89c88ecd7dc08e47eba5ec7c29c7b5eeecde967"
 [[package]]
 name = "bytes"
-version = "1.10.1"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
+checksum = "514de17de45fdb8dc022b1a7975556c53c86f9f0aa5f534b98977b171857c2c9"
 [[package]]
 name = "cc"
-version = "1.2.27"
+version = "1.0.101"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d487aa071b5f64da6f19a3e848e3578944b726ee5a4854b82172f02aa876bfdc"
+checksum = "ac367972e516d45567c7eafc73d24e1c193dcf200a8d94e9db7b3d38b349572d"
 dependencies = [
 "jobserver",
 "libc",
 "shlex",
 ]
 [[package]]
 name = "cfg-if"
-version = "1.0.1"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9555578bc9e57714c812a1f84e4fc5b4d21fcb063490c624de019f7464c91268"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 [[package]]
 name = "cfg_aliases"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 [[package]]
 name = "colorchoice"
-version = "1.0.4"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
+checksum = "0b6a852b24ab71dffc585bcb46eaf7959d175cb865a7152e35b348d1b2960422"
 [[package]]
 name = "cpio"
 version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "938e716cb1ade5d6c8f959c13a7248b889c07491fc7e41167c3afe20f8f0de1e"
 [[package]]
 name = "either"
 version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
 [[package]]
 name = "env_filter"
-version = "0.1.3"
+version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "186e05a59d4c50738528153b83b0b0194d3a29507dfec16eccd4b342903397d0"
+checksum = "a009aa4810eb158359dda09d0c87378e4bbb89b5a801f016885a4707ba24f7ea"
 dependencies = [
 "log",
 "regex",
@ -156,68 +132,46 @@ dependencies = [
 [[package]]
 name = "env_logger"
-version = "0.11.8"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13c863f0904021b108aa8b2f55046443e6b1ebde8fd4a15c399893aae4fa069f"
+checksum = "38b35839ba51819680ba087cd351788c9a3c476841207e0b8cee0b04722343b9"
 dependencies = [
 "anstream",
 "anstyle",
 "env_filter",
- "jiff",
+ "humantime",
 "log",
 ]
 [[package]]
 name = "equivalent"
-version = "1.0.2"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
 [[package]]
 name = "eyre"
 version = "0.6.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7cd915d99f24784cdc19fd37ef22b97e3ff0ae756c7e492e9fbfe897d61e2aec"
 dependencies = [
 "indenter",
 "once_cell",
 ]
 [[package]]
 name = "getrandom"
 version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
 dependencies = [
 "cfg-if",
 "libc",
 "r-efi",
 "wasi 0.14.2+wasi-0.2.4",
 ]
 [[package]]
 name = "gimli"
-version = "0.31.1"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
+checksum = "40ecd4077b5ae9fd2e9e169b102c6c330d0605168eb0e8bf79952b256dbefffd"
 [[package]]
 name = "hashbrown"
-version = "0.15.4"
+version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5971ac85611da7067dbfcabef3c70ebb5606018acd9e2a3903a0da507521e0d5"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
 [[package]]
-name = "indenter"
+name = "humantime"
-version = "0.3.3"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce23b50ad8242c51a442f3ff322d56b02f08852c77e4c0b4d3fd684abc89c683"
+checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
 [[package]]
 name = "indexmap"
-version = "2.9.0"
+version = "2.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cea70ddb795996207ad57735b50c5982d8844f38ba9ee5f1aedcfb708a2aa11e"
+checksum = "168fb715dda47215e360912c096649d23d58bf392ac62f73919e831745e40f26"
 dependencies = [
 "equivalent",
 "hashbrown",
@ -225,228 +179,105 @@ dependencies = [
 [[package]]
 name = "init"
-version = "2.4.0"
+version = "0.1.0"
 dependencies = [
- "cpio",
+ "anyhow",
 "env_logger",
 "eyre",
 "itertools",
 "libc",
 "log",
 "lz4",
 "nix",
 "regex",
 "serde",
 "serde_json",
 "serde_yaml",
 "shell-escape",
 "termios",
 "tokio",
 "unix_mode",
 "zstd",
 ]
 [[package]]
 name = "is_terminal_polyfill"
-version = "1.70.1"
+version = "1.70.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
+checksum = "f8478577c03552c21db0e2724ffb8986a5ce7af88107e6be5d2ee6e158c12800"
 [[package]]
 name = "itertools"
 version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
 dependencies = [
 "either",
 ]
 [[package]]
 name = "itoa"
-version = "1.0.15"
+version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
+checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
 [[package]]
 name = "jiff"
 version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "be1f93b8b1eb69c77f24bbb0afdf66f54b632ee39af40ca21c4365a1d7347e49"
 dependencies = [
 "jiff-static",
 "log",
 "portable-atomic",
 "portable-atomic-util",
 "serde",
 ]
 [[package]]
 name = "jiff-static"
 version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "03343451ff899767262ec32146f6d559dd759fdadf42ff0e227c7c48f72594b4"
 dependencies = [
 "proc-macro2",
 "quote",
 "syn",
 ]
 [[package]]
 name = "jobserver"
 version = "0.1.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "38f262f097c174adebe41eb73d66ae9c06b2844fb0da69969647bbddd9b0538a"
 dependencies = [
 "getrandom",
 "libc",
 ]
 [[package]]
 name = "libc"
-version = "0.2.173"
+version = "0.2.155"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8cfeafaffdbc32176b64fb251369d52ea9f0a8fbc6f8759edffef7b525d64bb"
+checksum = "97b3888a4aecf77e811145cadf6eef5901f4782c53886191b2f693f24761847c"
 [[package]]
 name = "log"
-version = "0.4.27"
+version = "0.4.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
+checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"
 [[package]]
 name = "lz4"
 version = "1.28.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a20b523e860d03443e98350ceaac5e71c6ba89aea7d960769ec3ce37f4de5af4"
 dependencies = [
 "lz4-sys",
 ]
 [[package]]
 name = "lz4-sys"
 version = "1.11.1+lz4-1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6bd8c0d6c6ed0cd30b3652886bb8711dc4bb01d637a68105a3d5158039b418e6"
 dependencies = [
 "cc",
 "libc",
 ]
 [[package]]
 name = "memchr"
-version = "2.7.5"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a282da65faaf38286cf3be983213fcf1d2e2a58700e808f83f4ea9a4804bc0"
+checksum = "6c8640c5d730cb13ebd907d8d04b52f55ac9a2eec55b440c8892f40d56c76c1d"
 [[package]]
 name = "miniz_oxide"
-version = "0.8.9"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+checksum = "b8a240ddb74feaf34a79a7add65a741f3167852fba007066dcac1ca548d89c08"
 dependencies = [
- "adler2",
+ "adler",
 ]
 [[package]]
 name = "mio"
-version = "1.0.4"
+version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78bed444cc8a2160f01cbcf811ef18cac863ad68ae8ca62092e8db51d51c761c"
+checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
 dependencies = [
 "libc",
- "wasi 0.11.1+wasi-snapshot-preview1",
+ "wasi",
- "windows-sys 0.59.0",
+ "windows-sys 0.48.0",
 ]
 [[package]]
 name = "nix"
 version = "0.30.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
 dependencies = [
 "bitflags",
 "cfg-if",
 "cfg_aliases",
 "libc",
 ]
 [[package]]
 name = "object"
-version = "0.36.7"
+version = "0.36.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87"
+checksum = "576dfe1fc8f9df304abb159d767a29d0476f7750fbf8aa7ad07816004a207434"
 dependencies = [
 "memchr",
 ]
 [[package]]
 name = "once_cell"
 version = "1.21.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
 [[package]]
 name = "once_cell_polyfill"
 version = "1.70.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a4895175b425cb1f87721b59f0f286c2092bd4af812243672510e1ac53e2e0ad"
 [[package]]
 name = "pin-project-lite"
-version = "0.2.16"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
+checksum = "bda66fc9667c18cb2758a2ac84d1167245054bcf85d5d1aaa6923f45801bdd02"
 [[package]]
 name = "pkg-config"
 version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
 [[package]]
 name = "portable-atomic"
 version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f84267b20a16ea918e43c6a88433c2d54fa145c92a811b5b047ccbe153674483"
 [[package]]
 name = "portable-atomic-util"
 version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d8a2f0d8d040d7848a709caf78912debcc3f33ee4b3cac47d73d1e1069e83507"
 dependencies = [
 "portable-atomic",
 ]
 [[package]]
 name = "proc-macro2"
-version = "1.0.95"
+version = "1.0.81"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02b3e5e68a3a1a02aad3ec490a98007cbc13c37cbe84a3cd7b8e406d76e7f778"
+checksum = "3d1597b0c024618f09a9c3b8655b7e430397a36d23fdafec26d6965e9eec3eba"
 dependencies = [
 "unicode-ident",
 ]
 [[package]]
 name = "quote"
-version = "1.0.40"
+version = "1.0.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
+checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
 dependencies = [
 "proc-macro2",
 ]
 [[package]]
 name = "r-efi"
 version = "5.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
 [[package]]
 name = "regex"
-version = "1.11.1"
+version = "1.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
+checksum = "c117dbdfde9c8308975b6a18d71f3f385c89461f7b3fb054288ecf2a2058ba4c"
 dependencies = [
 "aho-corasick",
 "memchr",
@ -456,9 +287,9 @@ dependencies = [
 [[package]]
 name = "regex-automata"
-version = "0.4.9"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
+checksum = "86b83b8b9847f9bf95ef68afb0b8e6cdb80f498442f5179a29fad448fcc1eaea"
 dependencies = [
 "aho-corasick",
 "memchr",
@ -467,36 +298,36 @@ dependencies = [
 [[package]]
 name = "regex-syntax"
-version = "0.8.5"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
+checksum = "adad44e29e4c806119491a7f06f03de4d1af22c3a680dd47f1e6e179439d1f56"
 [[package]]
 name = "rustc-demangle"
-version = "0.1.25"
+version = "0.1.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "989e6739f80c4ad5b13e0fd7fe89531180375b18520cc8c82080e4dc4035b84f"
+checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
 [[package]]
 name = "ryu"
-version = "1.0.20"
+version = "1.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
+checksum = "e86697c916019a8588c99b5fac3cead74ec0b4b819707a682fd4d23fa0ce1ba1"
 [[package]]
 name = "serde"
-version = "1.0.219"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
+checksum = "0c9f6e76df036c77cd94996771fb40db98187f096dd0b9af39c6c6e452ba966a"
 dependencies = [
 "serde_derive",
 ]
 [[package]]
 name = "serde_derive"
-version = "1.0.219"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
+checksum = "11bd257a6541e141e42ca6d24ae26f7714887b47e89aa739099104c7e4d3b7fc"
 dependencies = [
 "proc-macro2",
 "quote",
@ -505,12 +336,11 @@ dependencies = [
 [[package]]
 name = "serde_json"
-version = "1.0.140"
+version = "1.0.116"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20068b6e96dc6c9bd23e01df8827e6c7e1f2fddd43c21810382803c136b99373"
+checksum = "3e17db7126d17feb94eb3fad46bf1a96b034e8aacbc2e775fe81505f8b0b2813"
 dependencies = [
 "itoa",
 "memchr",
 "ryu",
 "serde",
 ]
@ -528,62 +358,31 @@ dependencies = [
 "unsafe-libyaml",
 ]
 [[package]]
 name = "shell-escape"
 version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "45bb67a18fa91266cc7807181f62f9178a6873bfad7dc788c42e6430db40184f"
 [[package]]
 name = "shlex"
 version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 [[package]]
 name = "signal-hook-registry"
-version = "1.4.5"
+version = "1.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9203b8055f63a2a00e2f593bb0510367fe707d7ff1e5c872de2f537b339e5410"
+checksum = "a9e9e0b4211b72e7b8b6e85c807d36c212bdb33ea8587f7569562a84df5465b1"
 dependencies = [
 "libc",
 ]
 [[package]]
 name = "socket2"
 version = "0.5.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
 dependencies = [
 "libc",
 "windows-sys 0.52.0",
 ]
 [[package]]
 name = "syn"
-version = "2.0.103"
+version = "2.0.60"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e4307e30089d6fd6aff212f2da3a1f9e32f3223b1f010fb09b7c95f90f3ca1e8"
+checksum = "909518bc7b1c9b779f1bbf07f2929d35af9f0f37e47c6e9ef7f9dddc1e1821f3"
 dependencies = [
 "proc-macro2",
 "quote",
 "unicode-ident",
 ]
 [[package]]
 name = "termios"
 version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "411c5bf740737c7918b8b1fe232dca4dc9f8e754b8ad5e20966814001ed0ac6b"
 dependencies = [
 "libc",
 ]
 [[package]]
 name = "tokio"
-version = "1.45.1"
+version = "1.38.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75ef51a33ef1da925cea3e4eb122833cb377c61439ca401b770f54902b806779"
+checksum = "ba4f4a02a7a80d6f274636f0aa95c7e383b912d41fe721a31f29e29698585a4a"
 dependencies = [
 "backtrace",
 "bytes",
@ -591,16 +390,15 @@ dependencies = [
 "mio",
 "pin-project-lite",
 "signal-hook-registry",
 "socket2",
 "tokio-macros",
- "windows-sys 0.52.0",
+ "windows-sys 0.48.0",
 ]
 [[package]]
 name = "tokio-macros"
-version = "2.5.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e06d43f1345a3bcd39f6a56dbb7dcab2ba47e68e8ac134855e7e2bdbaf8cab8"
+checksum = "5f5ae998a069d4b5aba8ee9dad856af7d520c3699e6159b185c2acd48155d39a"
 dependencies = [
 "proc-macro2",
 "quote",
@ -609,15 +407,9 @@ dependencies = [
 [[package]]
 name = "unicode-ident"
-version = "1.0.18"
+version = "1.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
 [[package]]
 name = "unix_mode"
 version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b55eedc365f81a3c32aea49baf23fa965e3cd85bcc28fb8045708c7388d124ef"
 [[package]]
 name = "unsafe-libyaml"
@ -627,23 +419,23 @@ checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
 [[package]]
 name = "utf8parse"
-version = "0.2.2"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+checksum = "711b9620af191e0cdc7468a8d14e709c3dcdb115b36f838e601583af800a370a"
 [[package]]
 name = "wasi"
-version = "0.11.1+wasi-snapshot-preview1"
+version = "0.11.0+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 [[package]]
-name = "wasi"
+name = "windows-sys"
-version = "0.14.2+wasi-0.2.4"
+version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9683f9a5a998d873c0d21fcbe3c083009670149a8fab228644b8bd36b2c48cb3"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
 dependencies = [
- "wit-bindgen-rt",
+ "windows-targets 0.48.5",
 ]
 [[package]]
@ -652,115 +444,126 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets",
+ "windows-targets 0.52.5",
 ]
 [[package]]
 name = "windows-sys"
 version = "0.59.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
 dependencies = [
 "windows-targets",
 ]
 [[package]]
 name = "windows-targets"
-version = "0.52.6"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
 dependencies = [
- "windows_aarch64_gnullvm",
+ "windows_aarch64_gnullvm 0.48.5",
- "windows_aarch64_msvc",
+ "windows_aarch64_msvc 0.48.5",
- "windows_i686_gnu",
+ "windows_i686_gnu 0.48.5",
 "windows_i686_msvc 0.48.5",
 "windows_x86_64_gnu 0.48.5",
 "windows_x86_64_gnullvm 0.48.5",
 "windows_x86_64_msvc 0.48.5",
 ]
 [[package]]
 name = "windows-targets"
 version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6f0713a46559409d202e70e28227288446bf7841d3211583a4b53e3f6d96e7eb"
 dependencies = [
 "windows_aarch64_gnullvm 0.52.5",
 "windows_aarch64_msvc 0.52.5",
 "windows_i686_gnu 0.52.5",
 "windows_i686_gnullvm",
- "windows_i686_msvc",
+ "windows_i686_msvc 0.52.5",
- "windows_x86_64_gnu",
+ "windows_x86_64_gnu 0.52.5",
- "windows_x86_64_gnullvm",
+ "windows_x86_64_gnullvm 0.52.5",
- "windows_x86_64_msvc",
+ "windows_x86_64_msvc 0.52.5",
 ]
 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.52.6"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7088eed71e8b8dda258ecc8bac5fb1153c5cffaf2578fc8ff5d61e23578d3263"
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.52.6"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9985fd1504e250c615ca5f281c3f7a6da76213ebd5ccc9561496568a2752afb6"
 [[package]]
 name = "windows_i686_gnu"
-version = "0.52.6"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
 [[package]]
 name = "windows_i686_gnu"
 version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "88ba073cf16d5372720ec942a8ccbf61626074c6d4dd2e745299726ce8b89670"
 [[package]]
 name = "windows_i686_gnullvm"
-version = "0.52.6"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+checksum = "87f4261229030a858f36b459e748ae97545d6f1ec60e5e0d6a3d32e0dc232ee9"
 [[package]]
 name = "windows_i686_msvc"
-version = "0.52.6"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
 [[package]]
 name = "windows_i686_msvc"
 version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "db3c2bf3d13d5b658be73463284eaf12830ac9a26a90c717b7f771dfe97487bf"
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.52.6"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4e4246f76bdeff09eb48875a0fd3e2af6aada79d409d33011886d3e1581517d9"
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.52.6"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "852298e482cd67c356ddd9570386e2862b5673c85bd5f88df9ab6802b334c596"
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.52.6"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
 [[package]]
-name = "wit-bindgen-rt"
+name = "windows_x86_64_msvc"
-version = "0.39.0"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1"
+checksum = "bec47e5bfd1bff0eeaf6d8b485cc1074891a197ab4225d504cb7a1ab88b02bf0"
 dependencies = [
 "bitflags",
 ]
 [[package]]
 name = "zstd"
 version = "0.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
 dependencies = [
 "zstd-safe",
 ]
 [[package]]
 name = "zstd-safe"
 version = "7.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d"
 dependencies = [
 "zstd-sys",
 ]
 [[package]]
 name = "zstd-sys"
 version = "2.0.15+zstd.1.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eb81183ddd97d0c74cedf1d50d85c8d08c1b8b68ee863bdee9e706eedba1a237"
 dependencies = [
 "cc",
 "pkg-config",
 ]
--- a/Cargo.toml
+++ b/Cargo.toml
@ -1,30 +1,15 @@
 [package]
 name = "init"
-version = "2.4.0"
+version = "0.1.0"
-edition = "2024"
+edition = "2021"
-[profile.release]
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 strip = true
 panic = "abort"
 opt-level = "z"
 lto = true
 codegen-units = 1
 [dependencies]
-libc = { version = "0.2", default-features = false }
+anyhow = "1.0.86"
 env_logger = "0.11.3"
 eyre = "0.6.12"
 itertools = "0.14.0"
 log = "0.4.21"
 nix = { version = "0.30.1", features = ["feature", "mount", "process", "reboot", "signal"] }
 regex = "1.11.1"
 serde = { version = "1.0.198", features = ["derive"] }
 serde_json = "1.0.116"
 serde_yaml = "0.9.34"
-shell-escape = "0.1.5"
+tokio = { version = "1.38.0", features = ["rt", "signal", "process", "macros"] }
 tokio = { version = "1.38.0", features = ["rt", "net", "fs", "process", "io-std", "io-util", "sync", "macros", "signal"] }
 termios = "0.3.3"
 zstd = "0.13.3"
 unix_mode = "0.1.4"
 cpio = "0.4.1"
 lz4 = "1.28.1"
--- a/49
+++ b/49
@ -1,44 +1,49 @@
-from rust:1.87.0-alpine as rust
+# ------------------------------------------------------------------------
 from rust:1.79.0-alpine3.20 as rust
-run apk add --no-cache git musl-dev libudev-zero-dev # pkgconfig cryptsetup-dev lvm2-dev clang-dev clang-static
+run apk add --no-cache musl-dev # pkgconfig cryptsetup-dev lvm2-dev clang-dev clang-static
 workdir /src
-copy . .
+copy Cargo.* .
 copy src src
 run --mount=type=cache,id=novit-rs,target=/usr/local/cargo/registry \
    --mount=type=cache,id=novit-rs-target,sharing=private,target=/src/target \
    cargo build --release && cp target/release/init /
 # ------------------------------------------------------------------------
-from alpine:3.22.0 as initrd
+from golang:1.22.4-alpine3.20 as build
 run apk add zstd lz4
-workdir /system
+workdir /src
 copy . .
 run \
  --mount=type=cache,id=gomod,target=/go/pkg/mod \
  --mount=type=cache,id=gobuild,target=/root/.cache/go-build \
   go test ./... \
 && go build -o /go/bin/init -trimpath .
 # ------------------------------------------------------------------------
 from alpine:3.20.0 as initrd
 run apk add --no-cache xz
 workdir /layer
 run . /etc/os-release \
 && wget -O- https://dl-cdn.alpinelinux.org/alpine/v${VERSION_ID%.*}/releases/x86_64/alpine-minirootfs-${VERSION_ID}-x86_64.tar.gz |tar zxv
-run apk add --no-cache --update -p . musl coreutils \
+run apk add --no-cache -p . musl lvm2 lvm2-extra lvm2-dmeventd udev cryptsetup e2fsprogs btrfs-progs lsblk
- lvm2 lvm2-extra lvm2-dmeventd udev cryptsetup \
+run rm -rf usr/share/apk var/cache/apk
 e2fsprogs lsblk openssh-server wireguard-tools-wg-quick \
 && rm -rf usr/share/apk var/cache/apk etc/motd
-copy etc/sshd_config etc/ssh/sshd_config
+#copy --from=build /go/bin/init .
-
+copy --from=rust /init .
 run mkdir /layer \
 && mv dev /layer \
 # && find |cpio -H newc -o |lz4 >/layer/system.alz4
 && find |cpio -H newc -o |zstd -19 >/layer/system.azstd
 workdir /layer
 copy --from=rust /init init
 run mkdir -p bin run var/log; cd bin && for cmd in init-version init-connect bootstrap; do ln -s ../init $cmd; done
 # check viability
-run chroot . init-version
+run chroot . /init hello
 run find |cpio -H newc -o >/initrd
 # ------------------------------------------------------------------------
-from alpine:3.22.0
+from alpine:3.20.0
 copy --from=initrd /initrd /
 entrypoint ["base64","/initrd"]
--- a/apply-config.go
+++ b/apply-config.go
@ -0,0 +1,140 @@
 package main
 import (
 	"os"
 	"path/filepath"
 	"strconv"
 	"strings"
 	"syscall"
 	"time"
 	"github.com/rs/zerolog/log"
 	yaml "gopkg.in/yaml.v2"
 	"novit.tech/direktil/pkg/config/apply"
 )
 var loopOffset = 0
 func applyConfig(cfgPath string, bootMounted bool) (cfg *configV1) {
 	cfgBytes, err := os.ReadFile(cfgPath)
 	if err != nil {
 		fatalf("failed to read %s: %v", cfgPath, err)
 	}
 	cfg = &configV1{}
 	if err := yaml.Unmarshal(cfgBytes, cfg); err != nil {
 		fatal("failed to load config: ", err)
 	}
 	// mount layers
 	if len(cfg.Layers) == 0 {
 		fatal("no layers configured!")
 	}
 	layersInMemory := paramBool("layers-in-mem", false)
 	log.Info().Strs("layers", cfg.Layers).Bool("in-memory", layersInMemory).Msg("mounting layers")
 	const layersInMemDir = "/layers-in-mem"
 	if layersInMemory {
 		mkdir(layersInMemDir, 0700)
 		mount("layers-mem", layersInMemDir, "tmpfs", 0, "")
 	}
 	lowers := make([]string, len(cfg.Layers))
 	for i, layer := range cfg.Layers {
 		log := log.With().Str("layer", layer).Logger()
 		path := layerPath(layer)
 		info, err := os.Stat(path)
 		if err != nil {
 			fatal(err)
 		}
 		log.Info().Int64("size", info.Size()).Msg("layer found")
 		if layersInMemory {
 			log.Info().Msg("copying to memory")
 			targetPath := filepath.Join(layersInMemDir, layer)
 			cp(path, targetPath)
 			path = targetPath
 		}
 		dir := "/layers/" + layer
 		lowers[i] = dir
 		mountSquahfs(path, dir)
 	}
 	// prepare system root
 	mount("mem", "/changes", "tmpfs", 0, "")
 	mkdir("/changes/workdir", 0755)
 	mkdir("/changes/upperdir", 0755)
 	mount("overlay", "/system", "overlay", rootMountFlags,
 		"lowerdir="+strings.Join(lowers, ":")+",upperdir=/changes/upperdir,workdir=/changes/workdir")
 	// make root rshared (default in systemd, required by Kubernetes 1.10+)
 	// equivalent to "mount --make-rshared /"
 	// see kernel's Documentation/sharedsubtree.txt (search rshared)
 	if err := syscall.Mount("", "/system", "", syscall.MS_SHARED|syscall.MS_REC, ""); err != nil {
 		fatalf("FATAL: mount --make-rshared / failed: %v", err)
 	}
 	if bootMounted {
 		if layersInMemory {
 			if err := syscall.Unmount("/boot", 0); err != nil {
 				log.Warn().Err(err).Msg("failed to unmount /boot")
 				time.Sleep(2 * time.Second)
 			}
 		} else {
 			mount("/boot", "/system/boot", "", syscall.MS_BIND, "")
 		}
 	}
 	// - write files
 	apply.Files(cfg.Files, "/system")
 	// - groups
 	for _, group := range cfg.Groups {
 		logEvt := log.Info().Str("group", group.Name)
 		opts := make([]string, 0)
 		opts = append(opts /* chroot */, "/system", "groupadd", "-r")
 		if group.Gid != 0 {
 			opts = append(opts, "-g", strconv.Itoa(group.Gid))
 			logEvt.Int("gid", group.Gid)
 		}
 		opts = append(opts, group.Name)
 		logEvt.Msg("creating group")
 		run("chroot", opts...)
 	}
 	// - user
 	for _, user := range cfg.Users {
 		logEvt := log.Info().Str("user", user.Name)
 		opts := make([]string, 0)
 		opts = append(opts /* chroot */, "/system", "useradd", "-r")
 		if user.Gid != 0 {
 			opts = append(opts, "-g", strconv.Itoa(user.Gid))
 			logEvt.Int("gid", user.Gid)
 		}
 		if user.Uid != 0 {
 			opts = append(opts, "-u", strconv.Itoa(user.Uid))
 			logEvt.Int("uid", user.Uid)
 		}
 		opts = append(opts, user.Name)
 		logEvt.Msg("creating user")
 		run("chroot", opts...)
 	}
 	return
 }
--- a/ask-secret.go
+++ b/ask-secret.go
@ -0,0 +1,56 @@
 package main
 import (
 	"bufio"
 	"bytes"
 	"fmt"
 	"io"
 	"os"
 	"sync"
 	"sync/atomic"
 )
 var (
 	inputTTYs    = new(sync.Map)
 	askingSecret atomic.Bool
 )
 func registerInput(in *tty)  { inputTTYs.Store(in, in) }
 func unregiterInput(in *tty) { inputTTYs.Delete(in) }
 func askSecret(prompt string) (s []byte) {
 	err := func() (err error) {
 		askingSecret.Store(true)
 		defer askingSecret.Store(false)
 		inputTTYs.Range(func(k, v any) (con bool) { v.(*tty).EchoOff(); return true })
 		defer inputTTYs.Range(func(k, v any) (con bool) { v.(*tty).Restore(); return true })
 		var (
 			in  io.Reader = stdin
 			out io.Writer = stdout
 		)
 		if stdin == nil {
 			in = os.Stdin
 			out = os.Stdout
 		}
 		out.Write([]byte(prompt + ": "))
 		s, err = bufio.NewReader(in).ReadBytes('\n')
 		if err != nil {
 			return
 		}
 		fmt.Println()
 		s = bytes.TrimRight(s, "\r\n")
 		return
 	}()
 	if err != nil {
 		fatalf("failed to read from stdin: %v", err)
 	}
 	return
 }
--- a/auth.go
+++ b/auth.go
@ -0,0 +1,59 @@
 package main
 import (
 	"bytes"
 	"errors"
 	"github.com/rs/zerolog/log"
 	"golang.org/x/crypto/ssh"
 	config "novit.tech/direktil/pkg/bootstrapconfig"
 )
 var (
 	auths []config.Auth
 )
 func localAuth() bool {
 	sec := askSecret("password")
 	for _, auth := range auths {
 		if auth.Password == "" {
 			continue
 		}
 		if config.CheckPassword(auth.Password, sec) {
 			log.Info().Msgf("login with auth %q", auth.Name)
 			return true
 		}
 	}
 	return false
 }
 func sshCheckPubkey(conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
 	keyBytes := key.Marshal()
 	for _, auth := range auths {
 		if auth.SSHKey == "" {
 			continue
 		}
 		allowedKey, _, _, _, err := ssh.ParseAuthorizedKey([]byte(auth.SSHKey))
 		if err != nil {
 			log.Warn().Err(err).Str("user", auth.Name).Str("key", auth.SSHKey).Msg("SSH public key is invalid")
 			return nil, err
 		}
 		if bytes.Equal(allowedKey.Marshal(), keyBytes) {
 			log.Info().Str("user", auth.Name).Msg("ssh: accepting public key")
 			return &ssh.Permissions{
 				Extensions: map[string]string{
 					"pubkey-fp": ssh.FingerprintSHA256(key),
 				},
 			}, nil
 		}
 	}
 	return nil, errors.New("no matching public key")
 }
--- a/boot-v2.go
+++ b/boot-v2.go
@ -0,0 +1,110 @@
 package main
 import (
 	"os"
 	"os/exec"
 	"syscall"
 	"github.com/rs/zerolog/log"
 	"gopkg.in/yaml.v3"
 	config "novit.tech/direktil/pkg/bootstrapconfig"
 )
 func bootV2() {
 	log.Info().Msg("-- boot v2 --")
 	kernelVersion := unameRelease()
 	log.Info().Str("version", kernelVersion).Msg("Linux")
 	cfg := &config.Config{}
 	{
 		f, err := os.Open("/config.yaml")
 		if err != nil {
 			fatal("failed to open /config.yaml: ", err)
 		}
 		err = yaml.NewDecoder(f).Decode(cfg)
 		f.Close()
 		if err != nil {
 			fatal("failed to parse /config.yaml: ", err)
 		}
 	}
 	log.Info().Msg("config loaded")
 	if cfg.AntiPhishingCode != "" {
 		log.Info().Str("anti-phishing-code", cfg.AntiPhishingCode).Send()
 	}
 	auths = cfg.Auths
 	// mount kernel modules
 	if cfg.Modules == "" {
 		log.Warn().Msg("NOT mounting modules (\"modules:\" not specified)")
 	} else {
 		log.Info().Str("from", cfg.Modules).Msg("mounting modules")
 		mountSquahfs(cfg.Modules, "/modules")
 		modulesSourcePath := "/modules/lib/modules/" + kernelVersion
 		if _, err := os.Stat(modulesSourcePath); err != nil {
 			fatal("invalid modules dir: ", err)
 		}
 		os.MkdirAll("/lib/modules", 0755)
 		if err := os.Symlink(modulesSourcePath, "/lib/modules/"+kernelVersion); err != nil {
 			fatal("failed to symlink modules: ", err)
 		}
 	}
 	// load basic modules
 	for _, module := range []string{"unix"} {
 		log.Info().Str("module", module).Msg("loading module")
 		run("modprobe", module)
 	}
 	// devices init
 	log.Info().Msg("starting udevd")
 	err := exec.Command("udevd").Start()
 	if err != nil {
 		fatal("failed to start udevd: ", err)
 	}
 	log.Info().Msg("udevadm triggers")
 	run("udevadm", "trigger", "-c", "add", "-t", "devices")
 	run("udevadm", "trigger", "-c", "add", "-t", "subsystems")
 	log.Info().Msg("udevadm settle")
 	run("udevadm", "settle")
 	// networks
 	setupNetworks(cfg)
 	// Wireguard VPN
 	// TODO startVPN()
 	// SSH service
 	startSSH(cfg)
 	// dmcrypt blockdevs
 	setupCrypt(cfg.PreLVMCrypt, map[string]string{})
 	// LVM
 	setupLVM(cfg)
 	// bootstrap the system
 	bootstrap(cfg)
 	// finalize
 	finalizeBoot()
 }
 func finalizeBoot() {
 	// switch root
 	log.Info().Msg("switching root")
 	err := syscall.Exec("/sbin/switch_root", []string{"switch_root",
 		"-c", "/dev/console", "/system", "/sbin/init"}, os.Environ())
 	fatal("switch_root failed: ", err)
 }
--- a/bootstrap.go
+++ b/bootstrap.go
@ -0,0 +1,182 @@
 package main
 import (
 	"bytes"
 	"fmt"
 	"io"
 	"net/http"
 	"os"
 	"path/filepath"
 	"strings"
 	"github.com/rs/zerolog/log"
 	config "novit.tech/direktil/pkg/bootstrapconfig"
 )
 func bootstrap(cfg *config.Config) {
 	if cfg.Bootstrap.Dev == "" {
 		fatalf("bootstrap device not defined!")
 	}
 	const bsDir = "/bootstrap"
 	os.MkdirAll(bsDir, 0700)
 	run("mount", cfg.Bootstrap.Dev, bsDir)
 	baseDir := filepath.Join(bsDir, bootVersion)
 	sysCfgPath := filepath.Join(baseDir, "config.yaml")
 	if _, err := os.Stat(sysCfgPath); os.IsNotExist(err) {
 		log.Warn().Msgf("bootstrap %q does not exist", bootVersion)
 		seed := cfg.Bootstrap.Seed
 		if seed == "" {
 			fatalf("boostrap seed not defined, admin required")
 		}
 		log.Info().Str("from", seed).Msgf("seeding bootstrap")
 		err = os.MkdirAll(baseDir, 0700)
 		if err != nil {
 			fatalf("failed to create bootstrap dir: %v", err)
 		}
 		bootstrapFile := filepath.Join(baseDir, "bootstrap.tar")
 		err = func() (err error) {
 			resp, err := http.Get(seed)
 			if err != nil {
 				return
 			}
 			if resp.StatusCode != http.StatusOK {
 				err = fmt.Errorf("bad HTTP status: %s", resp.Status)
 				return
 			}
 			defer resp.Body.Close()
 			out, err := os.Create(bootstrapFile)
 			if err != nil {
 				return
 			}
 			defer out.Close()
 			_, err = io.Copy(out, resp.Body)
 			return
 		}()
 		if err != nil {
 			fatalf("seeding failed: %v", err)
 		}
 		log.Info().Msg("unpacking bootstrap file")
 		run("tar", "xvf", bootstrapFile, "-C", baseDir)
 	}
 	layersDir = baseDir
 	layersOverride["modules"] = "/modules.sqfs"
 	sysCfg := applyConfig(sysCfgPath, false)
 	// load requested modules
 	for _, mod := range sysCfg.Modules {
 		log.Info().Str("module", mod).Msg("loading module")
 		run("modprobe", mod)
 	}
 	// localy-generated assets dir
 	localGenDir := filepath.Join(bsDir, "local-gen")
 	// vpns are v2+
 	for _, vpn := range sysCfg.VPNs {
 		setupVPN(vpn, localGenDir)
 	}
 	// mounts are v2+
 	for _, mount := range sysCfg.Mounts {
 		log.Info().Str("source", mount.Dev).Str("target", mount.Path).Msg("mount")
 		path := filepath.Join("/system", mount.Path)
 		os.MkdirAll(path, 0755)
 		args := []string{mount.Dev, path}
 		if mount.Type != "" {
 			args = append(args, "-t", mount.Type)
 		}
 		if mount.Options != "" {
 			args = append(args, "-o", mount.Options)
 		}
 		run("mount", args...)
 	}
 	// setup root user
 	if ph := sysCfg.RootUser.PasswordHash; ph != "" {
 		log.Info().Msg("setting root's password")
 		setUserPass("root", ph)
 	}
 	if ak := sysCfg.RootUser.AuthorizedKeys; len(ak) != 0 {
 		log.Info().Msg("setting root's authorized keys")
 		setAuthorizedKeys(ak)
 	}
 	// update-ca-certificates
 	log.Info().Msg("updating CA certificates")
 	run("chroot", "/system", "update-ca-certificates")
 }
 func setUserPass(user, passwordHash string) {
 	const fpath = "/system/etc/shadow"
 	ba, err := os.ReadFile(fpath)
 	if err != nil {
 		fatalf("failed to read shadow: %v", err)
 	}
 	lines := bytes.Split(ba, []byte{'\n'})
 	buf := new(bytes.Buffer)
 	for _, line := range lines {
 		line := string(line)
 		p := strings.Split(line, ":")
 		if len(p) < 2 || p[0] != user {
 			buf.WriteString(line)
 			buf.WriteByte('\n')
 			continue
 		}
 		p[1] = passwordHash
 		line = strings.Join(p, ":")
 		buf.WriteString(line)
 		buf.WriteByte('\n')
 	}
 	err = os.WriteFile(fpath, buf.Bytes(), 0600)
 	if err != nil {
 		fatalf("failed to write shadow: %v", err)
 	}
 }
 func setAuthorizedKeys(ak []string) {
 	buf := new(bytes.Buffer)
 	for _, k := range ak {
 		buf.WriteString(k)
 		buf.WriteByte('\n')
 	}
 	const sshDir = "/system/root/.ssh"
 	err := os.MkdirAll(sshDir, 0700)
 	if err != nil {
 		fatalf("failed to create %s: %v", sshDir, err)
 	}
 	err = os.WriteFile(filepath.Join(sshDir, "authorized_keys"), buf.Bytes(), 0600)
 	if err != nil {
 		fatalf("failed to write authorized keys: %v", err)
 	}
 }
--- a/build.rs
+++ b/build.rs
@ -1,9 +0,0 @@
 use std::process::Command;
 fn main() {
    let output = Command::new("git")
        .args(&["rev-parse", "HEAD"])
        .output()
        .unwrap();
    let git_commit = String::from_utf8(output.stdout).unwrap();
    println!("cargo:rustc-env=GIT_COMMIT={}", git_commit);
 }
--- a/colorio/colorio.go
+++ b/colorio/colorio.go
@ -0,0 +1,45 @@
 package colorio
 import "io"
 var (
 	Reset      = []byte("\033[0m")
 	Bold       = []byte("\033[1m")
 	Dim        = []byte("\033[2m")
 	Underlined = []byte("\033[4m")
 	Blink      = []byte("\033[5m")
 	Reverse    = []byte("\033[7m")
 	Hidden     = []byte("\033[8m")
 )
 type writer struct {
 	before []byte
 	after  []byte
 	w      io.Writer
 }
 func NewWriter(color []byte, w io.Writer) io.Writer {
 	return writer{
 		before: color,
 		after:  Reset,
 		w:      w,
 	}
 }
 func (w writer) Write(ba []byte) (n int, err error) {
 	b := make([]byte, len(w.before)+len(ba)+len(w.after))
 	copy(b, w.before)
 	copy(b[len(w.before):], ba)
 	copy(b[len(w.before)+len(ba):], w.after)
 	n, err = w.w.Write(b)
 	n -= len(w.before)
 	if n < 0 {
 		n = 0
 	} else if n > len(ba) {
 		n = len(ba)
 	}
 	return
 }
--- a/colorio/colorio_test.go
+++ b/colorio/colorio_test.go
@ -0,0 +1,21 @@
 package colorio
 import (
 	"bytes"
 	"fmt"
 	"testing"
 )
 func TestWriter(t *testing.T) {
 	buf := new(bytes.Buffer)
 	w := NewWriter(Bold, buf)
 	buf.WriteByte('{')
 	fmt.Fprintln(w, "hello")
 	buf.WriteByte('}')
 	if s, exp := buf.String(), "{"+string(Bold)+"hello\n"+string(Reset)+"}"; s != exp {
 		t.Errorf("%q != %q", s, exp)
 	}
 }
--- a/config.go
+++ b/config.go
@ -0,0 +1,7 @@
 package main
 import (
 	nconfig "novit.tech/direktil/pkg/config"
 )
 type configV1 = nconfig.Config
--- a/debug/bootstrap
+++ b/debug/bootstrap
@ -1 +0,0 @@
 ../target/debug/init
--- a/debug/connect-boot
+++ b/debug/connect-boot
@ -1 +0,0 @@
 ../target/debug/init
--- a/debug/init
+++ b/debug/init
@ -1 +0,0 @@
 ../target/debug/init
--- a/debug/init-version
+++ b/debug/init-version
@ -1 +0,0 @@
 ../target/debug/init
--- a/etc/sshd_config
+++ b/etc/sshd_config
@ -1,7 +0,0 @@
 KbdInteractiveAuthentication no
 PasswordAuthentication no
 PubkeyAuthentication yes
 PermitRootLogin yes
 AllowUsers root
--- a/filter.go
+++ b/filter.go
@ -0,0 +1,22 @@
 package main
 func filter[T any](values []T, accept func(T) bool) []T {
 	r := make([]T, 0, len(values))
 	for _, v := range values {
 		if accept(v) {
 			r = append(r, v)
 		}
 	}
 	return r
 }
 func contains[T any](values []T, accept func(T) bool) bool {
 	for _, v := range values {
 		if accept(v) {
 			return true
 		}
 	}
 	return false
 }
--- a/filter_test.go
+++ b/filter_test.go
@ -0,0 +1,13 @@
 package main
 import (
    "fmt"
    "testing"
 )
 func TestFilter(t*testing.T) {
    a := filter([]string{"a","b","c"}, func(v string) bool { return v != "b" })
    if fmt.Sprint(a) != "[a c]" {
        t.Errorf("bad result: %v", a)
    }
 }
--- a/go.mod
+++ b/go.mod
@ -0,0 +1,31 @@
 module novit.tech/direktil/initrd
 require (
 	github.com/creack/pty v1.1.21
 	github.com/freddierice/go-losetup/v2 v2.0.1
 	github.com/pkg/term v1.1.0
 	github.com/rs/zerolog v1.31.0
 	golang.org/x/crypto v0.18.0
 	golang.org/x/sys v0.16.0
 	golang.org/x/term v0.16.0
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6
 	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
 	novit.tech/direktil/pkg v0.0.0-20240120172717-8498a102796f
 )
 require (
 	github.com/cavaliergopher/cpio v1.0.1 // indirect
 	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/josharian/native v1.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mdlayher/genetlink v1.3.2 // indirect
 	github.com/mdlayher/netlink v1.7.2 // indirect
 	github.com/mdlayher/socket v0.5.0 // indirect
 	golang.org/x/net v0.20.0 // indirect
 	golang.org/x/sync v0.6.0 // indirect
 	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173 // indirect
 )
 go 1.21
--- a/go.sum
+++ b/go.sum
@ -0,0 +1,94 @@
 github.com/cavaliergopher/cpio v1.0.1 h1:KQFSeKmZhv0cr+kawA3a0xTQCU4QxXF1vhU7P7av2KM=
 github.com/cavaliergopher/cpio v1.0.1/go.mod h1:pBdaqQjnvXxdS/6CvNDwIANIFSP0xRKI16PX4xejRQc=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/creack/pty v1.1.21 h1:1/QdRyBaHHJP61QkWMXlOIBfsgdDeeKfK8SYVUWJKf0=
 github.com/creack/pty v1.1.21/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
 github.com/freddierice/go-losetup/v2 v2.0.1 h1:wPDx/Elu9nDV8y/CvIbEDz5Xi5Zo80y4h7MKbi3XaAI=
 github.com/freddierice/go-losetup/v2 v2.0.1/go.mod h1:TEyBrvlOelsPEhfWD5rutNXDmUszBXuFnwT1kIQF4J8=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA=
 github.com/josharian/native v1.1.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mdlayher/genetlink v1.3.2 h1:KdrNKe+CTu+IbZnm/GVUMXSqBBLqcGpRDa0xkQy56gw=
 github.com/mdlayher/genetlink v1.3.2/go.mod h1:tcC3pkCrPUGIKKsCsp0B3AdaaKuHtaxoJRz3cc+528o=
 github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/g=
 github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
 github.com/mdlayher/socket v0.5.0 h1:ilICZmJcQz70vrWVes1MFera4jGiWNocSkykwwoy3XI=
 github.com/mdlayher/socket v0.5.0/go.mod h1:WkcBFfvyG8QENs5+hfQPl1X6Jpd2yeLIYgrGFmJiJxI=
 github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721 h1:RlZweED6sbSArvlE924+mUcZuXKLBHA35U7LN621Bws=
 github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721/go.mod h1:Ickgr2WtCLZ2MDGd4Gr0geeCH5HybhRJbonOgQpvSxc=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/term v1.1.0 h1:xIAAdCMh3QIAy+5FrE8Ad8XoDhEU4ufwbaSozViP9kk=
 github.com/pkg/term v1.1.0/go.mod h1:E25nymQcrSllhX42Ok8MRm1+hyBdHY0dCeiKZ9jpNGw=
 github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
 github.com/rs/zerolog v1.31.0 h1:FcTR3NnLWW+NnTwwhFWiJSZr4ECLpqCm6QsEnyvbV4A=
 github.com/rs/zerolog v1.31.0/go.mod h1:/7mN4D5sKwJLZQ2b/znpjC3/GQWY/xaDXUM0kKWRHss=
 github.com/ulikunitz/xz v0.5.11/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.18.0 h1:PGVlW0xEltQnzFZ55hkuX5+KLyrMYhHld1YHO4AKcdc=
 golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.20.0 h1:aCL9BSgETF1k+blQaYUBx9hJ9LOGP3gAVemcZlf1Kpo=
 golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20200909081042-eff7692f9009/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.16.0 h1:xWw16ngr6ZMtmxDyKyIgsE93KNKz5HKmMa3b8ALHidU=
 golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/term v0.16.0 h1:m+B6fahuftsE9qjo0VWp2FW0mB3MTJvR0BaMQrq0pmE=
 golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173 h1:/jFs0duh4rdb8uIfPMv78iAJGcPKDeqAFnaLBropIC4=
 golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173/go.mod h1:tkCQ4FQXmpAgYVh++1cq16/dH4QJtmvpRv19DWGAHSA=
 golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6 h1:CawjfCvYQH2OU3/TnxLx97WDSUDRABfT18pCOYwc2GE=
 golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6/go.mod h1:3rxYc4HtVcSG9gVaTs2GEBdehh+sYPOwKtyUWEOTb80=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 novit.tech/direktil/pkg v0.0.0-20240120172717-8498a102796f h1:7y11nLhChrrsLQwRaW7wn/9x+Xn2gEVtzj75VkOpJ+o=
 novit.tech/direktil/pkg v0.0.0-20240120172717-8498a102796f/go.mod h1:zjezU6tELE880oYHs/WAauGBupKIEQQ7KqWTB69RW10=
--- a/losetup.go
+++ b/losetup.go
@ -0,0 +1,26 @@
 package main
 import (
 	"syscall"
 	"github.com/freddierice/go-losetup/v2"
 )
 var loDevices = map[string]losetup.Device{}
 func losetupAttach(file string) losetup.Device {
 	if _, ok := loDevices[file]; !ok {
 		dev, err := losetup.Attach(file, 0, true)
 		if err != nil {
 			fatalf("failed to attach %q to a loop device: %v", file, err)
 		}
 		loDevices[file] = dev
 	}
 	return loDevices[file]
 }
 func mountSquahfs(source, target string) {
 	dev := losetupAttach(source)
 	mount(dev.Path(), target, "squashfs", syscall.MS_RDONLY, "")
 }
--- a/lvm.go
+++ b/lvm.go
@ -0,0 +1,386 @@
 package main
 import (
 	"bytes"
 	"io/fs"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"sort"
 	"strconv"
 	"github.com/rs/zerolog/log"
 	config "novit.tech/direktil/pkg/bootstrapconfig"
 	"novit.tech/direktil/initrd/lvm"
 )
 func sortedKeys[T any](m map[string]T) (keys []string) {
 	keys = make([]string, 0, len(m))
 	for k := range m {
 		keys = append(keys, k)
 	}
 	sort.Strings(keys)
 	return
 }
 func setupLVM(cfg *config.Config) {
 	if len(cfg.LVM) == 0 {
 		log.Info().Msg("no LVM VG configured.")
 		return
 	}
 	// [dev] = filesystem
 	// eg: [/dev/sda1] = ext4
 	createdDevs := map[string]string{}
 	run("pvscan")
 	run("vgscan", "--mknodes")
 	for _, vg := range cfg.LVM {
 		setupVG(vg)
 	}
 	for _, vg := range cfg.LVM {
 		setupLVs(vg, createdDevs)
 	}
 	run("vgchange", "--sysinit", "-a", "ly")
 	setupCrypt(cfg.Crypt, createdDevs)
 	devs := make([]string, 0, len(createdDevs))
 	for k := range createdDevs {
 		devs = append(devs, k)
 	}
 	sort.Strings(devs)
 	for _, dev := range devs {
 		setupFS(dev, createdDevs[dev])
 	}
 }
 func setupVG(vg config.LvmVG) {
 	pvs := lvm.PVSReport{}
 	err := runJSON(&pvs, "pvs", "--reportformat", "json")
 	if err != nil {
 		fatalf("failed to list LVM PVs: %v", err)
 	}
 	vgExists := false
 	devNeeded := vg.PVs.N
 	for _, pv := range pvs.PVs() {
 		if pv.VGName == vg.VG {
 			vgExists = true
 			devNeeded--
 		}
 	}
 	log := log.With().Str("vg", vg.VG).Logger()
 	if devNeeded <= 0 {
 		log.Info().Msg("LVM VG has all its devices")
 		return
 	}
 	if vgExists {
 		log.Info().Msgf("LVM VG misses %d devices", devNeeded)
 	} else {
 		log.Info().Msg("LVM VG does not exists, creating")
 	}
 	devNames := make([]string, 0)
 	err = filepath.Walk("/dev", func(n string, fi fs.FileInfo, err error) error {
 		if fi.Mode().Type() == os.ModeDevice {
 			devNames = append(devNames, n)
 		}
 		return err
 	})
 	if err != nil {
 		fatalf("failed to walk /dev: %v", err)
 	}
 	devNames = filter(devNames, func(v string) bool {
 		for _, pv := range pvs.PVs() {
 			if v == pv.Name {
 				return false
 			}
 		}
 		return true
 	})
 	m := regexpSelectN(vg.PVs.N, vg.PVs.Regexps, devNames)
 	if len(m) == 0 {
 		log.Error().Strs("regexps", vg.PVs.Regexps).Msg("no device match the regexps")
 		fatalf("failed to setup VG %s", vg.VG)
 	}
 	if vgExists {
 		log.Info().Strs("devices", m).Msg("LVM VG: extending")
 		run("vgextend", append([]string{vg.VG}, m...)...)
 		devNeeded -= len(m)
 	} else {
 		log.Info().Strs("devices", m).Msg("LVM VG: creating")
 		run("vgcreate", append([]string{vg.VG}, m...)...)
 		devNeeded -= len(m)
 	}
 	if devNeeded > 0 {
 		fatalf("VG %s does not have enough devices (%d missing)", vg.VG, devNeeded)
 	}
 }
 func setupLVs(vg config.LvmVG, createdDevs map[string]string) {
 	lvsRep := lvm.LVSReport{}
 	err := runJSON(&lvsRep, "lvs", "--reportformat", "json")
 	if err != nil {
 		fatalf("lvs failed: %v", err)
 	}
 	lvs := lvsRep.LVs()
 	defaults := vg.Defaults
 	for idx, lv := range vg.LVs {
 		log := log.With().Str("vg", vg.VG).Str("lv", lv.Name).Logger()
 		if contains(lvs, func(v lvm.LV) bool {
 			return v.VGName == vg.VG && v.Name == lv.Name
 		}) {
 			log.Info().Msg("LV exists")
 			continue
 		}
 		log.Info().Msg("LV does not exist")
 		if lv.Raid == nil {
 			lv.Raid = defaults.Raid
 		}
 		args := make([]string, 0)
 		if lv.Name == "" {
 			fatalf("LV[%d] has no name", idx)
 		}
 		args = append(args, vg.VG, "--name", lv.Name)
 		if lv.Size != "" && lv.Extents != "" {
 			fatalf("LV has both size and extents defined!")
 		} else if lv.Size == "" && lv.Extents == "" {
 			fatalf("LV does not have size or extents defined!")
 		} else if lv.Size != "" {
 			args = append(args, "-L", lv.Size)
 		} else /* if lv.Extents != "" */ {
 			args = append(args, "-l", lv.Extents)
 		}
 		if raid := lv.Raid; raid != nil {
 			if raid.Mirrors != 0 {
 				args = append(args, "--mirrors", strconv.Itoa(raid.Mirrors))
 			}
 			if raid.Stripes != 0 {
 				args = append(args, "--stripes", strconv.Itoa(raid.Stripes))
 			}
 		}
 		log.Info().Strs("args", args).Msg("LV: creating")
 		run("lvcreate", args...)
 		dev := "/dev/" + vg.VG + "/" + lv.Name
 		zeroDevStart(dev)
 		fs := lv.FS
 		if fs == "" {
 			fs = vg.Defaults.FS
 		}
 		createdDevs[dev] = fs
 	}
 }
 func zeroDevStart(dev string) {
 	f, err := os.OpenFile(dev, os.O_WRONLY, 0600)
 	if err != nil {
 		fatalf("failed to open %s: %v", dev, err)
 	}
 	defer f.Close()
 	_, err = f.Write(make([]byte, 8192))
 	if err != nil {
 		fatalf("failed to zero the beginning of %s: %v", dev, err)
 	}
 }
 var cryptDevs = map[string]bool{}
 func setupCrypt(devSpecs []config.CryptDev, createdDevs map[string]string) {
 	var password []byte
 	passwordVerified := false
 	// flat, expanded devices to open
 	devNames := make([]config.CryptDev, 0, len(devSpecs))
 	for _, devSpec := range devSpecs {
 		if devSpec.Dev == "" && devSpec.Prefix == "" {
 			fatalf("crypt: name %q: no dev or match set", devSpec.Name)
 		}
 		if devSpec.Dev != "" && devSpec.Prefix != "" {
 			fatalf("crypt: name %q: both dev (%q) and match (%q) are set", devSpec.Name, devSpec.Dev, devSpec.Prefix)
 		}
 		if devSpec.Dev != "" {
 			// already flat
 			devNames = append(devNames, devSpec)
 			continue
 		}
 		matches, err := filepath.Glob(devSpec.Prefix + "*")
 		if err != nil {
 			fatalf("failed to search for device matches: %v", err)
 		}
 		for _, m := range matches {
 			suffix := m[len(devSpec.Prefix):]
 			devNames = append(devNames, config.CryptDev{Dev: m, Name: devSpec.Name + suffix})
 		}
 	}
 	for _, devName := range devNames {
 		name, dev := devName.Name, devName.Dev
 		if name == "" {
 			name = filepath.Base(dev)
 		}
 		if cryptDevs[name] {
 			fatalf("duplicate crypt device name: %s", name)
 		}
 		cryptDevs[name] = true
 	retryOpen:
 		if len(password) == 0 {
 			password = askSecret("crypt password")
 			if len(password) == 0 {
 				fatalf("empty password given")
 			}
 		}
 		fs := createdDevs[dev]
 		delete(createdDevs, dev)
 		tgtDev := "/dev/mapper/" + name
 		needFormat := !devInitialized(dev)
 		if needFormat {
 			if !passwordVerified {
 			retry:
 				p2 := askSecret("verify crypt password")
 				eq := bytes.Equal(password, p2)
 				for i := range p2 {
 					p2[i] = 0
 				}
 				if !eq {
 					log.Error().Msg("passwords don't match")
 					goto retry
 				}
 			}
 			log.Info().Str("dev", dev).Msg("formatting encrypted device")
 			cmd := exec.Command("cryptsetup", "luksFormat", dev, "--key-file=-")
 			cmd.Stdin = bytes.NewBuffer(password)
 			cmd.Stdout = stdout
 			cmd.Stderr = stderr
 			err := cmd.Run()
 			if err != nil {
 				fatalf("failed luksFormat: %v", err)
 			}
 			createdDevs[tgtDev] = fs
 		}
 		if len(password) == 0 {
 			password = askSecret("crypt password")
 			if len(password) == 0 {
 				fatalf("empty password given")
 			}
 		}
 		log.Info().Str("name", name).Str("dev", dev).Msg("openning encrypted device")
 		cmd := exec.Command("cryptsetup", "open", dev, name, "--key-file=-")
 		cmd.Stdin = bytes.NewBuffer(password)
 		cmd.Stdout = stdout
 		cmd.Stderr = stderr
 		err := cmd.Run()
 		if err != nil {
 			// maybe the password is wrong
 			for i := range password {
 				password[i] = 0
 			}
 			password = password[:0]
 			passwordVerified = false
 			goto retryOpen
 		}
 		if needFormat {
 			zeroDevStart(tgtDev)
 		}
 		passwordVerified = true
 	}
 	for i := range password {
 		password[i] = 0
 	}
 }
 func devInitialized(dev string) bool {
 	f, err := os.Open(dev)
 	if err != nil {
 		fatalf("failed to open %s: %v", dev, err)
 	}
 	defer f.Close()
 	ba := make([]byte, 8192)
 	_, err = f.Read(ba)
 	if err != nil {
 		fatalf("failed to read %s: %v", dev, err)
 	}
 	for _, b := range ba {
 		if b != 0 {
 			return true
 		}
 	}
 	return false
 }
 func setupFS(dev, fs string) {
 	if devInitialized(dev) {
 		log.Info().Str("dev", dev).Msg("device already formatted")
 		return
 	}
 	if fs == "" {
 		fs = "ext4"
 	}
 	log.Info().Str("dev", dev).Str("fs", fs).Msg("formatting device")
 	args := make([]string, 0)
 	switch fs {
 	case "btrfs":
 		args = append(args, "-f")
 	case "ext4":
 		args = append(args, "-F")
 	}
 	run("mkfs."+fs, append(args, dev)...)
 }
--- a/lvm/lv.go
+++ b/lvm/lv.go
@ -0,0 +1,19 @@
 package lvm
 type LVSReport struct {
 	Report []struct {
 		LV []LV `json:"lv"`
 	} `json:"report"`
 }
 type LV struct {
 	Name   string `json:"lv_name"`
 	VGName string `json:"vg_name"`
 }
 func (r LVSReport) LVs() (ret []LV) {
 	for _, rep := range r.Report {
 		ret = append(ret, rep.LV...)
 	}
 	return
 }
--- a/lvm/pv.go
+++ b/lvm/pv.go
@ -0,0 +1,19 @@
 package lvm
 type PVSReport struct {
 	Report []struct {
 		PV []PV `json:"pv"`
 	} `json:"report"`
 }
 type PV struct {
 	Name   string `json:"pv_name"`
 	VGName string `json:"vg_name"`
 }
 func (r PVSReport) PVs() (ret []PV) {
 	for _, rep := range r.Report {
 		ret = append(ret, rep.PV...)
 	}
 	return
 }
--- a/main.go
+++ b/main.go
@ -0,0 +1,245 @@
 package main
 import (
 	"fmt"
 	"io"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"runtime"
 	"syscall"
 	"time"
 	"github.com/pkg/term/termios"
 	"github.com/rs/zerolog"
 	"github.com/rs/zerolog/log"
 	"golang.org/x/term"
 	"novit.tech/direktil/initrd/colorio"
 	"novit.tech/direktil/initrd/shio"
 )
 const (
 	// VERSION is the current version of init
 	VERSION = "Direktil init v2.0"
 	rootMountFlags  = 0
 	bootMountFlags  = syscall.MS_NOEXEC | syscall.MS_NODEV | syscall.MS_NOSUID | syscall.MS_RDONLY
 	layerMountFlags = syscall.MS_RDONLY
 )
 var (
 	bootVersion string
 	stdin,
 	stdinPipe = newPipe()
 	stdout = shio.New()
 	stderr = colorio.NewWriter(colorio.Bold, stdout)
 )
 func newPipe() (io.ReadCloser, io.WriteCloser) {
 	return io.Pipe()
 }
 func main() {
 	log.Logger = log.Output(zerolog.ConsoleWriter{Out: os.Stderr})
 	registerInput(newTTY(os.Stdin.Fd()))
 	switch baseName := filepath.Base(os.Args[0]); baseName {
 	case "init":
 		runInit()
 	default:
 		log.Fatal().Msgf("unknown sub-command: %q", baseName)
 	}
 }
 func runInit() {
 	if len(os.Args) > 1 && os.Args[1] == "hello" {
 		fmt.Println("hello world!")
 		os.Exit(0)
 	}
 	runtime.LockOSThread()
 	// move log to shio
 	go io.Copy(os.Stdout, stdout.NewReader())
 	log.Logger = log.Output(zerolog.ConsoleWriter{Out: stderr})
 	// check the PID is 1
 	if pid := os.Getpid(); pid != 1 {
 		log.Fatal().Int("pid", pid).Msg("init must be PID 1")
 	}
 	// copy os.Stdin to my stdin pipe
 	go io.Copy(stdinPipe, os.Stdin)
 	log.Info().Msg("Welcome to " + VERSION)
 	// essential mounts
 	mount("none", "/proc", "proc", 0, "")
 	mount("none", "/sys", "sysfs", 0, "")
 	mount("none", "/dev", "devtmpfs", 0, "")
 	mount("none", "/dev/pts", "devpts", 0, "gid=5,mode=620")
 	// get the "boot version"
 	bootVersion = param("version", "current")
 	log.Info().Msgf("booting system %q", bootVersion)
 	os.Setenv("PATH", "/usr/bin:/bin:/usr/sbin:/sbin")
 	_, err := os.Stat("/config.yaml")
 	if err != nil {
 		log.Error().Err(err).Msg("config not found")
 		fatal()
 	}
 	bootV2()
 }
 var (
 	layersDir      = "/boot/current/layers/"
 	layersOverride = map[string]string{}
 )
 func layerPath(name string) string {
 	if override, ok := layersOverride[name]; ok {
 		return override
 	}
 	return filepath.Join(layersDir, name+".fs")
 }
 func fatal(v ...interface{}) {
 	log.Error().Msg("*** FATAL ***")
 	log.Error().Msg(fmt.Sprint(v...))
 	die()
 }
 func fatalf(pattern string, v ...interface{}) {
 	log.Error().Msg("*** FATAL ***")
 	log.Error().Msgf(pattern, v...)
 	die()
 }
 func die() {
 	log.Logger = log.Output(zerolog.ConsoleWriter{Out: os.Stderr})
 	stdout.Close()
 	stdin.Close()
 	stdinPipe.Close()
 	stdin = nil
 mainLoop:
 	for {
 		termios.Tcdrain(os.Stdin.Fd())
 		termios.Tcdrain(os.Stdout.Fd())
 		termios.Tcdrain(os.Stderr.Fd())
 		fmt.Print("\nr to reboot, o to power off, s to get a shell: ")
 		// TODO flush stdin (first char lost here?)
 		deadline := time.Now().Add(time.Minute)
 		os.Stdin.SetReadDeadline(deadline)
 		term.MakeRaw(int(os.Stdin.Fd()))
 		termios.Tcflush(os.Stdin.Fd(), termios.TCIFLUSH)
 		b := make([]byte, 1)
 		_, err := os.Stdin.Read(b)
 		if err != nil {
 			log.Error().Err(err).Msg("failed to read from stdin")
 			time.Sleep(5 * time.Second)
 			syscall.Reboot(syscall.LINUX_REBOOT_CMD_RESTART)
 		}
 		fmt.Println()
 		switch b[0] {
 		case 'o':
 			run("sync")
 			syscall.Reboot(syscall.LINUX_REBOOT_CMD_POWER_OFF)
 		case 'r':
 			run("sync")
 			syscall.Reboot(syscall.LINUX_REBOOT_CMD_RESTART)
 		case 's':
 			for _, sh := range []string{"bash", "ash", "sh", "busybox"} {
 				fullPath, err := exec.LookPath(sh)
 				if err != nil {
 					continue
 				}
 				args := make([]string, 0)
 				if sh == "busybox" {
 					args = append(args, "sh")
 				}
 				if !localAuth() {
 					continue mainLoop
 				}
 				cmd := exec.Command(fullPath, args...)
 				cmd.Env = os.Environ()
 				cmd.Stdin = os.Stdin
 				cmd.Stdout = os.Stdout
 				cmd.Stderr = os.Stderr
 				err = cmd.Run()
 				if err != nil {
 					fmt.Println("shell failed:", err)
 				}
 				continue mainLoop
 			}
 			log.Error().Msg("failed to find a shell!")
 		default:
 			log.Error().Msgf("unknown choice: %q", string(b))
 		}
 	}
 }
 func run(cmd string, args ...string) {
 	if output, err := exec.Command(cmd, args...).CombinedOutput(); err != nil {
 		fatalf("command %s %q failed: %v\n%s", cmd, args, err, string(output))
 	}
 }
 func mkdir(dir string, mode os.FileMode) {
 	if err := os.MkdirAll(dir, mode); err != nil {
 		fatalf("mkdir %q failed: %v", dir, err)
 	}
 }
 func mount(source, target, fstype string, flags uintptr, data string) {
 	if _, err := os.Stat(target); os.IsNotExist(err) {
 		mkdir(target, 0755)
 	}
 	if err := syscall.Mount(source, target, fstype, flags, data); err != nil {
 		fatalf("mount %q %q -t %q -o %q failed: %v", source, target, fstype, data, err)
 	}
 	log.Info().Str("target", target).Msg("mounted")
 }
 func cp(srcPath, dstPath string) {
 	var err error
 	defer func() {
 		if err != nil {
 			fatalf("cp %s %s failed: %v", srcPath, dstPath, err)
 		}
 	}()
 	src, err := os.Open(srcPath)
 	if err != nil {
 		return
 	}
 	defer src.Close()
 	dst, err := os.Create(dstPath)
 	if err != nil {
 		return
 	}
 	defer dst.Close()
 	_, err = io.Copy(dst, src)
 }
--- a/modd.conf
+++ b/modd.conf
@ -1,14 +1,21 @@
 modd.conf {}
 go.??? **/*.go {
  prep: go test ./...
  prep: mkdir -p dist
  prep: go build -o dist/init .
  prep: go build -o dist/ ./tools/...
 }
 **/*.rs Cargo.* {
  prep: cargo test
-  prep: cargo build
+  #prep: cargo build
  prep: debug/init-version
 }
 target/debug/init Dockerfile {
  prep: docker build --network host -t novit-initrd-gen .
  prep: docker run --net=host --rm novit-initrd-gen |base64 -d >dist/initrd.new
  prep: mv dist/initrd.new dist/initrd
  prep: ls -sh dist/initrd
 }
 #dist/init Dockerfile {
 #  prep: docker build --network host -t novit-initrd-gen .
 #  prep: docker run --net=host --rm novit-initrd-gen |base64 -d >dist/initrd.new
 #  prep: mv dist/initrd.new dist/initrd
 #}
--- a/modd.test.conf
+++ b/modd.test.conf
@ -1,6 +1,7 @@
 modd.test.conf {}
-dist/initrd dist/cpiocat test-initrd/**/* {
+dist/initrd dist/cpiocat dist/testconf test-initrd/**/* {
    prep: dist/testconf test-initrd/config.yaml
    prep: cp -f dist/initrd test-initrd.cpio
    prep: cd test-initrd && cat ../dist/initrd | ../dist/cpiocat * |lz4 -l9v >../test-initrd.cpio.new
    prep: mv test-initrd.cpio.new test-initrd.cpio
--- a/network.go
+++ b/network.go
@ -0,0 +1,78 @@
 package main
 import (
 	"net"
 	"os/exec"
 	"strings"
 	"github.com/rs/zerolog/log"
 	config "novit.tech/direktil/pkg/bootstrapconfig"
 )
 func setupNetworks(cfg *config.Config) {
 	if len(cfg.Networks) == 0 {
 		log.Info().Msg("no networks configured.")
 		return
 	}
 	ifNames := make([]string, 0)
 	{
 		ifaces, err := net.Interfaces()
 		if err != nil {
 			fatal("failed")
 		}
 		for _, iface := range ifaces {
 			ifNames = append(ifNames, iface.Name)
 		}
 	}
 	assigned := map[string]bool{}
 	for _, network := range cfg.Networks {
 		log := log.With().Str("network", network.Name).Logger()
 		log.Info().Msg("setting up network")
 		// compute available names
 		if len(assigned) != 0 {
 			newNames := make([]string, 0, len(ifNames))
 			for _, n := range ifNames {
 				if assigned[n] {
 					continue
 				}
 				newNames = append(newNames, n)
 			}
 			ifNames = newNames
 		}
 		// assign envvars
 		envvars := make([]string, 0, 1+len(network.Interfaces))
 		envvars = append(envvars, "PATH=/bin:/sbin:/usr/bin:/usr/sbin")
 		for _, match := range network.Interfaces {
 			envvar := new(strings.Builder)
 			envvar.WriteString(match.Var)
 			envvar.WriteByte('=')
 			for i, m := range regexpSelectN(match.N, match.Regexps, ifNames) {
 				if i != 0 {
 					envvar.WriteByte(' ')
 				}
 				envvar.WriteString(m)
 				assigned[m] = true
 			}
 			envvars = append(envvars, envvar.String())
 		}
 		log.Info().Strs("env", envvars).Msg("running script")
 		cmd := exec.Command("/bin/sh", "-c", network.Script)
 		cmd.Env = envvars
 		cmd.Stdout = stdout
 		cmd.Stderr = stderr
 		if err := cmd.Run(); err != nil {
 			fatal("failed to setup network: ", err)
 		}
 	}
 }
--- a/params.go
+++ b/params.go
@ -0,0 +1,39 @@
 package main
 import (
 	"os"
 	"strings"
 )
 func param(name, defaultValue string) (value string) {
 	ba, err := os.ReadFile("/proc/cmdline")
 	if err != nil {
 		fatal("could not read /proc/cmdline: ", err)
 	}
 	prefixes := []string{
 		"direktil." + name + "=",
 		"dkl." + name + "=",
 	}
 	value = defaultValue
 	for _, part := range strings.Split(string(ba), " ") {
 		for _, prefix := range prefixes {
 			if strings.HasPrefix(part, prefix) {
 				value = strings.TrimSpace(part[len(prefix):])
 			}
 		}
 	}
 	return
 }
 func paramBool(name string, defaultValue bool) (value bool) {
 	defaultValueS := "false"
 	if defaultValue {
 		defaultValueS = "true"
 	}
 	return "true" == param(name, defaultValueS)
 }
--- a/regexp.go
+++ b/regexp.go
@ -0,0 +1,40 @@
 package main
 import (
 	"regexp"
 	"github.com/rs/zerolog/log"
 )
 func regexpSelectN(n int, regexps []string, names []string) (matches []string) {
 	if n <= 0 {
 		matches = make([]string, 0)
 	} else {
 		matches = make([]string, 0, n)
 	}
 	res := make([]*regexp.Regexp, 0, len(regexps))
 	for _, reStr := range regexps {
 		re, err := regexp.Compile(reStr)
 		if err != nil {
 			log.Warn().Err(err).Str("regexp", reStr).Msg("invalid regexp, ignored")
 			continue
 		}
 		res = append(res, re)
 	}
 namesLoop:
 	for _, name := range names {
 		if len(matches) == n {
 			break
 		}
 		for _, re := range res {
 			if re.MatchString(name) {
 				matches = append(matches, name)
 				continue namesLoop
 			}
 		}
 	}
 	return
 }
--- a/run-test.sh
+++ b/run-test.sh
@ -10,8 +10,7 @@ if ! [ -e $disk2 ]; then
    qemu-img create -f qcow2 $disk2 10G
 fi
-exec qemu-system-x86_64 -pidfile qemu.pid \
+exec qemu-system-x86_64 -pidfile qemu.pid -kernel test-kernel -initrd test-initrd.cpio \
    -kernel test-kernel -initrd test-initrd.cpio \
    -smp 2 -m 2048 \
    -netdev bridge,br=novit,id=eth0 -device virtio-net-pci,netdev=eth0 \
    -drive file=$disk1,if=virtio \
--- a/run.go
+++ b/run.go
@ -0,0 +1,18 @@
 package main
 import (
 	"encoding/json"
 	"os/exec"
 )
 func runJSON(v interface{}, cmd string, args ...string) (err error) {
 	c := exec.Command(cmd, args...)
 	c.Stderr = stderr
 	ba, err := c.Output()
 	if err != nil {
 		return
 	}
 	err = json.Unmarshal(ba, v)
 	return
 }
--- a/shio/shio.go
+++ b/shio/shio.go
@ -0,0 +1,118 @@
 // Shared IO
 package shio
 import (
 	"io"
 	"sync"
 	"novit.tech/direktil/initrd/colorio"
 )
 type ShIO struct {
 	buf       []byte
 	closed    bool
 	cond      *sync.Cond
 	hideInput bool
 }
 func New() *ShIO {
 	return NewWithCap(1024)
 }
 func NewWithCap(capacity int) *ShIO {
 	return NewWithBytes(make([]byte, 0, capacity))
 }
 func NewWithBytes(content []byte) *ShIO {
 	return &ShIO{
 		buf:  content,
 		cond: sync.NewCond(&sync.Mutex{}),
 	}
 }
 var (
 	_ io.WriteCloser = New()
 )
 func (s *ShIO) Write(data []byte) (n int, err error) {
 	s.cond.L.Lock()
 	defer s.cond.L.Unlock()
 	if s.closed {
 		err = io.EOF
 		return
 	}
 	if s.hideInput {
 		s.buf = append(s.buf, colorio.Reset...)
 	}
 	s.buf = append(s.buf, data...)
 	n = len(data)
 	if s.hideInput {
 		s.buf = append(s.buf, colorio.Hidden...)
 	}
 	s.cond.Broadcast()
 	return
 }
 func (s *ShIO) HideInput() {
 	s.cond.L.Lock()
 	defer s.cond.L.Unlock()
 	if s.closed {
 		return
 	}
 	s.buf = append(s.buf, colorio.Hidden...)
 	s.hideInput = true
 }
 func (s *ShIO) ShowInput() {
 	s.cond.L.Lock()
 	defer s.cond.L.Unlock()
 	if s.closed {
 		return
 	}
 	s.buf = append(s.buf, colorio.Reset...)
 	s.hideInput = false
 }
 func (s *ShIO) Close() (err error) {
 	s.cond.L.Lock()
 	defer s.cond.L.Unlock()
 	s.closed = true
 	s.cond.Broadcast()
 	return
 }
 func (s *ShIO) NewReader() io.Reader {
 	return &shioReader{s, 0}
 }
 type shioReader struct {
 	in  *ShIO
 	pos int
 }
 func (r *shioReader) Read(ba []byte) (n int, err error) {
 	r.in.cond.L.Lock()
 	defer r.in.cond.L.Unlock()
 	for r.pos == len(r.in.buf) && !r.in.closed {
 		r.in.cond.Wait()
 	}
 	if r.pos == len(r.in.buf) && r.in.closed {
 		err = io.EOF
 		return
 	}
 	n = copy(ba, r.in.buf[r.pos:])
 	r.pos += n
 	return
 }
--- a/shio/shio_test.go
+++ b/shio/shio_test.go
@ -0,0 +1,52 @@
 package shio
 import (
 	"fmt"
 	"io"
 	"os"
 	"sync"
 	"time"
 )
 func ExampleOutput() {
 	done := false
 	defer func() { done = true }()
 	go func() {
 		time.Sleep(time.Second)
 		if !done {
 			panic("timeout")
 		}
 	}()
 	shio := NewWithCap(3)
 	r1 := shio.NewReader()
 	// read as you write
 	wg := new(sync.WaitGroup)
 	wg.Add(1)
 	go func() {
 		defer wg.Done()
 		io.Copy(os.Stdout, r1)
 		fmt.Println("-- r1 done --")
 	}()
 	fmt.Fprintln(shio, "hello1")
 	fmt.Fprintln(shio, "hello2")
 	shio.Close()
 	wg.Wait()
 	// read after close
 	r2 := shio.NewReader()
 	io.Copy(os.Stdout, r2)
 	fmt.Println("-- r2 done --")
 	// Output:
 	// hello1
 	// hello2
 	// -- r1 done --
 	// hello1
 	// hello2
 	// -- r2 done --
 }
--- a/src/blockdev.rs
+++ b/src/blockdev.rs
@ -1,21 +0,0 @@
 use tokio::fs;
 use tokio::io::{AsyncReadExt, AsyncWriteExt, Result};
 /// Checks if a block device is uninitialized.
 /// It assumed that a initialized device always has a non-zero byte in the first 8kiB.
 pub async fn is_uninitialized(dev_path: &str) -> Result<bool> {
    let mut dev = fs::File::open(dev_path).await?;
    let mut buf = [0u8; 8 << 10];
    dev.read_exact(&mut buf).await?;
    Ok(buf.into_iter().all(|b| b == 0))
 }
 /// zeroes the first 8kiB of the device so it looks uninitialized again.
 pub async fn uninitialize(dev_path: &str) -> Result<()> {
    let mut dev = fs::File::options().write(true).open(dev_path).await?;
    let buf = [0u8; 8 << 10];
    dev.write_all(&buf).await
 }
--- a/src/bootstrap/config.rs
+++ b/src/bootstrap/config.rs
@ -1,53 +1,40 @@
 use std::collections::BTreeMap as Map;
 pub const TAKE_ALL: i16 = -1;
 #[derive(Debug, serde::Deserialize, serde::Serialize)]
 pub struct Config {
-    pub anti_phishing_code: String,
+    anti_phishing_code: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
+    keymap: Option<String>,
-    pub keymap: Option<String>,
+    modules: String,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub modules: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
+    auths: Vec<Auth>,
-    pub resolv_conf: Option<String>,
+
    networks: Vec<Network>,
    #[serde(default)]
-    pub vpns: Map<String, String>,
+    ssh: SSHServer,
    pub networks: Vec<Network>,
    pub auths: Vec<Auth>,
    #[serde(default)]
    pub ssh: SSHServer,
    #[serde(default)]
-    pub pre_lvm_crypt: Vec<CryptDev>,
+    pre_lvm_crypt: Vec<CryptDev>,
    #[serde(default)]
-    pub lvm: Vec<LvmVG>,
+    lvm: Vec<LvmVG>,
    #[serde(default)]
-    pub crypt: Vec<CryptDev>,
+    crypt: Vec<CryptDev>,
-    pub bootstrap: Bootstrap,
+    bootstrap: Bootstrap,
 }
 #[derive(Debug, serde::Deserialize, serde::Serialize)]
 pub struct Auth {
-    pub name: String,
+    name: String,
-    #[serde(alias = "sshKey")]
+    #[serde(rename = "sshKey")]
-    #[serde(skip_serializing_if = "Option::is_none")]
+    ssh_key: String,
-    pub ssh_key: Option<String>,
+    password: String,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub password: Option<String>,
 }
 #[derive(Debug, serde::Deserialize, serde::Serialize)]
 pub struct Network {
-    pub name: String,
+    name: String,
-    pub interfaces: Vec<NetworkInterface>,
+    interfaces: Vec<NetworkInterface>,
-    pub script: String,
+    script: String,
 }
 #[derive(Debug, serde::Deserialize, serde::Serialize)]
@ -59,8 +46,8 @@ pub struct NetworkInterface {
 #[derive(Debug, serde::Deserialize, serde::Serialize)]
 pub struct SSHServer {
-    pub listen: String,
+    listen: String,
-    pub keys: SSHKeys,
+    keys: SSHKeys,
 }
 impl Default for SSHServer {
    fn default() -> Self {
@ -73,152 +60,86 @@ impl Default for SSHServer {
 #[derive(Debug, serde::Deserialize, serde::Serialize)]
 pub struct SSHKeys {
-    #[serde(skip_serializing_if = "Option::is_none")]
+    dsa: String,
-    dsa: Option<String>,
+    rsa: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
+    ecdsa: String,
-    rsa: Option<String>,
+    ed25519: String,
    #[serde(skip_serializing_if = "Option::is_none")]
    ecdsa: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    ed25519: Option<String>,
 }
 impl SSHKeys {
    pub fn iter(&self) -> impl Iterator<Item = &str> {
        [
            self.dsa.iter(),
            self.rsa.iter(),
            self.ecdsa.iter(),
            self.ed25519.iter(),
        ]
        .into_iter()
        .flatten()
        .map(String::as_str)
    }
 }
 impl Default for SSHKeys {
    fn default() -> Self {
        Self {
-            dsa: Some("id_dsa".to_string()),
+            dsa: "id_dsa".to_string(),
-            rsa: Some("id_rsa".to_string()),
+            rsa: "id_rsa".to_string(),
-            ecdsa: Some("id_ecdsa".to_string()),
+            ecdsa: "id_ecdsa".to_string(),
-            ed25519: Some("id_ed25519".to_string()),
+            ed25519: "id_ed25519".to_string(),
        }
    }
 }
 #[derive(Debug, serde::Deserialize, serde::Serialize)]
 pub struct LvmVG {
-    #[serde(alias = "vg")]
+    vg: String,
-    pub name: String,
+    pvs: LvmPV,
    pub pvs: LvmPV,
    #[serde(default)]
-    pub defaults: LvmLVDefaults,
+    defaults: LvmLVDefaults,
-    pub lvs: Vec<LvmLV>,
+    lvs: Vec<LvmLV>,
 }
 #[derive(Debug, Default, serde::Deserialize, serde::Serialize)]
 pub struct LvmLVDefaults {
    #[serde(default)]
    pub fs: Filesystem,
    #[serde(default)]
    pub raid: Raid,
 }
 #[derive(Debug, serde::Deserialize, serde::Serialize)]
-#[serde(rename_all = "snake_case")]
+pub struct LvmLVDefaults {
-pub enum Filesystem {
+    #[serde(default = "default_fs")]
-    Ext4,
+    fs: String,
-    Xfs,
+    raid: Option<Raid>,
    Btrfs,
    Other(String),
 }
-
+impl Default for LvmLVDefaults {
-impl Filesystem {
+    fn default() -> Self {
-    pub fn fstype(&self) -> &str {
+        Self {
-        use Filesystem as F;
+            fs: default_fs(),
-        match self {
+            raid: None,
            F::Ext4 => "ext4",
            F::Xfs => "xfs",
            F::Btrfs => "btrfs",
            F::Other(t) => t,
        }
    }
 }
-impl Default for Filesystem {
+fn default_fs() -> String {
-    fn default() -> Self {
+    "ext4".to_string()
        Filesystem::Ext4
    }
 }
 #[derive(Debug, serde::Deserialize, serde::Serialize)]
 pub struct LvmLV {
-    pub name: String,
+    name: String,
    #[serde(skip_serializing_if = "Option::is_none")]
-    pub fs: Option<Filesystem>,
+    fs: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
-    pub raid: Option<Raid>,
+    raid: Option<Raid>,
-    #[serde(flatten)]
+    #[serde(skip_serializing_if = "Option::is_none")]
-    pub size: LvSize,
+    size: Option<String>,
-}
+    #[serde(skip_serializing_if = "Option::is_none")]
-
+    extents: Option<String>,
 #[derive(Debug, serde::Deserialize, serde::Serialize)]
 #[serde(rename_all = "snake_case")]
 pub enum LvSize {
    Size(String),
    Extents(String),
 }
 #[derive(Debug, serde::Deserialize, serde::Serialize)]
 pub struct LvmPV {
-    pub n: i16,
+    n: i16,
-    pub regexps: Vec<String>,
+    regexps: Vec<String>,
 }
 #[derive(Debug, serde::Deserialize, serde::Serialize)]
 pub struct CryptDev {
-    pub name: String,
+    name: String,
-    #[serde(flatten)]
+    dev: Option<String>,
-    pub filter: DevFilter,
+    prefix: Option<String>,
    pub optional: Option<bool>,
 }
 impl CryptDev {
    pub fn optional(&self) -> bool {
        self.optional.unwrap_or_else(|| self.filter.is_prefix())
    }
 }
 #[derive(Debug, serde::Deserialize, serde::Serialize)]
 #[serde(rename_all = "snake_case")]
 pub enum DevFilter {
    Dev(String),
    Prefix(String),
 }
 impl DevFilter {
    pub fn is_dev(&self) -> bool {
        match self {
            Self::Dev(_) => true,
            _ => false,
        }
    }
    pub fn is_prefix(&self) -> bool {
        match self {
            Self::Prefix(_) => true,
            _ => false,
        }
    }
 }
 #[derive(Debug, Default, Clone, serde::Deserialize, serde::Serialize)]
 pub struct Raid {
-    pub mirrors: Option<u8>,
+    mirrors: Option<u8>,
-    pub stripes: Option<u8>,
+    stripes: Option<u8>,
 }
 #[derive(Debug, serde::Deserialize, serde::Serialize)]
 pub struct Bootstrap {
-    pub dev: String,
+    dev: String,
-    pub seed: Option<String>,
+    seed: String,
 }
--- a/src/cmd.rs
+++ b/src/cmd.rs
@ -1,5 +0,0 @@
 pub mod bootstrap;
 pub mod connect_boot;
 pub mod init;
 pub mod init_input;
 pub mod version;
--- a/src/cmd/bootstrap.rs
+++ b/src/cmd/bootstrap.rs
@ -1,19 +0,0 @@
 use eyre::Result;
 use tokio::{fs, io, io::AsyncWriteExt};
 pub async fn run() -> Result<()> {
    let mut input = io::stdin();
    let mut out = fs::File::create("/bootstrap.tar.part").await?;
    let n = io::copy(&mut input, &mut out).await?;
    out.flush().await?;
    drop(out);
    eprintln!("copied {n} bytes");
    fs::rename("/bootstrap.tar.part", "/bootstrap.tar").await?;
    eprintln!("/bootstrap.tar ready to use");
    Ok(())
 }
--- a/src/cmd/connect_boot.rs
+++ b/src/cmd/connect_boot.rs
--- a/src/cmd/init.rs
+++ b/src/cmd/init.rs
@ -1,400 +0,0 @@
 use eyre::{format_err, Result};
 use log::{error, info, warn};
 use std::collections::BTreeSet as Set;
 use std::os::unix::fs::symlink;
 use tokio::sync::Mutex;
 use tokio::{fs, process::Command};
 use crate::{bootstrap::config::Config, cmd::version::version_string, dklog, input};
 mod bootstrap;
 mod dmcrypt;
 mod lvm;
 mod networks;
 mod sshd;
 // devices used by any block target (DM, LVM...)
 static USED_DEVS: Mutex<Set<String>> = Mutex::const_new(Set::new());
 pub async fn run() {
    if std::process::id() != 1 {
        error!("init must run as PID 1, not {}", std::process::id());
        std::process::exit(1);
    }
    unsafe {
        use std::env;
        env::set_var("PATH", "/bin:/sbin:/usr/bin:/usr/sbin");
        env::set_var("HOME", "/root");
    }
    // open input channels
    tokio::spawn(crate::input::answer_requests_from_stdin());
    tokio::spawn(crate::input::answer_requests_from_socket());
    // welcome
    info!("Welcome to {}", version_string());
    let uname = nix::sys::utsname::uname().expect("uname should work");
    let kernel_version = uname.release().to_string_lossy();
    info!("Linux version {kernel_version}");
    // extract system archive
    retry_or_ignore(async || {
        if fs::try_exists("system.azstd").await? {
            info!("unpacking system.azstd");
            let zarch = fs::read("system.azstd").await?;
            let arch = zstd::Decoder::new(zarch.as_slice())?;
            extract_cpio(arch).await
        } else if fs::try_exists("system.alz4").await? {
            info!("unpacking system.alz4");
            let zarch = fs::read("system.alz4").await?;
            let arch = lz4::Decoder::new(zarch.as_slice())?;
            extract_cpio(arch).await
        } else {
            return Ok(());
        }
    })
    .await;
    // load config
    let cfg: Config = retry(async || {
        let cfg = (fs::read("config.yaml").await)
            .map_err(|e| format_err!("failed to read config: {e}"))?;
        serde_yaml::from_slice(cfg.as_slice())
            .map_err(|e| format_err!("failed to parse config: {e}"))
    })
    .await;
    info!("config loaded");
    info!("anti-phishing-code: {}", cfg.anti_phishing_code);
    // seem to occasionaly race with Child::wait
    // tokio::spawn(child_reaper());
    // mount basic filesystems
    mount("none", "/proc", "proc", None).await;
    mount("none", "/sys", "sysfs", None).await;
    mount("none", "/dev", "devtmpfs", None).await;
    mount("none", "/dev/pts", "devpts", Some("gid=5,mode=620")).await;
    // mount modules
    if let Some(ref modules) = cfg.modules {
        retry_or_ignore(async || {
            info!("mounting modules");
            mount(modules, "/modules", "squashfs", None).await;
            fs::create_dir_all("/lib/modules").await?;
            let modules_path = &format!("/modules/lib/modules/{kernel_version}");
            if !std::fs::exists(modules_path)? {
                return Err(format_err!(
                    "invalid modules package: {modules_path} should exist"
                ));
            }
            symlink(modules_path, format!("/lib/modules/{kernel_version}"))?;
            Ok(())
        })
        .await;
    } else {
        warn!("modules NOT mounted (not configured)");
    }
    // init devices
    info!("initializing devices");
    start_daemon("udevd", &[]).await;
    exec("udevadm", &["trigger", "-c", "add", "-t", "devices"]).await;
    exec("udevadm", &["trigger", "-c", "add", "-t", "subsystems"]).await;
    exec("udevadm", &["settle"]).await;
    // resolv.conf
    if let Some(ref resolv_conf) = cfg.resolv_conf {
        retry_or_ignore(async || {
            let path = "/etc/resolv.conf";
            info!("writing /etc/resolv.conf");
            fs::write(path, resolv_conf.as_bytes()).await?;
            Ok(())
        })
        .await;
    }
    // Wireguard VPNs
    for (name, conf) in &cfg.vpns {
        retry_or_ignore(async || {
            let dir = "/etc/wireguard";
            fs::create_dir_all(dir).await?;
            let path = &format!("{dir}/{name}.conf");
            fs::write(path, conf.as_bytes()).await?;
            chmod(path, 0o600).await?;
            try_exec("wg-quick", &["up", name]).await?;
            Ok(())
        })
        .await
    }
    // SSH service
    sshd::start(&cfg).await;
    // networks
    networks::setup(&cfg).await;
    // pre-lvm dmcrypt devs
    dmcrypt::setup(&cfg.pre_lvm_crypt).await;
    // LVM
    lvm::setup(&cfg).await;
    // post-lvm dmcrypt devs
    dmcrypt::setup(&cfg.crypt).await;
    // bootstrap the system
    bootstrap::bootstrap(cfg).await;
    // finalize
    {}
    retry(async || switch_root("/system").await).await;
 }
 use std::path::Path;
 async fn extract_cpio(mut arch: impl std::io::Read) -> Result<()> {
    loop {
        let rd = cpio::NewcReader::new(&mut arch)?;
        let entry = rd.entry();
        if entry.is_trailer() {
            return Ok(());
        }
        let path = entry.name().to_string();
        if let Err(e) = extract_cpio_entry(rd, &path).await {
            return Err(format_err!("failed to extract {path}: {e}"));
        }
    }
 }
 async fn chmod(path: impl AsRef<Path>, mode: u32) -> std::io::Result<()> {
    use std::fs::Permissions;
    use std::os::unix::fs::PermissionsExt;
    let perms = Permissions::from_mode(mode);
    fs::set_permissions(path, perms).await
 }
 async fn extract_cpio_entry<R: std::io::Read>(
    rd: cpio::NewcReader<R>,
    path: impl AsRef<Path>,
 ) -> Result<()> {
    use std::os::unix::fs::chown;
    use unix_mode::Type;
    let entry = rd.entry();
    let path = path.as_ref();
    if let Some(parent) = path.parent() {
        fs::create_dir_all(parent).await?;
    }
    let mode = entry.mode();
    let uid = entry.uid();
    let gid = entry.gid();
    match Type::from(mode) {
        Type::Dir => {
            fs::create_dir_all(path).await?;
        }
        Type::File => {
            let mut data = vec![];
            rd.to_writer(&mut data)?;
            fs::write(path, data).await?;
        }
        Type::Symlink => {
            let mut data = vec![];
            rd.to_writer(&mut data)?;
            let target = &Path::new(std::str::from_utf8(&data)?);
            tokio::fs::symlink(target, path).await?;
            return Ok(());
        }
        _ => {
            warn!("{path:?}: unknown file type: {:?}", Type::from(mode));
            return Ok(());
        }
    }
    chmod(path, mode).await?;
    chown(path, Some(uid), Some(gid))?;
    Ok(())
 }
 async fn switch_root(root: &str) -> Result<()> {
    use std::ffi::CString;
    macro_rules! c {
        ($s:expr) => {
            CString::new($s)?.as_c_str()
        };
    }
    info!("killing all processes and switching root");
    dklog::LOG.close().await;
    use nix::sys::signal::{kill, SIGKILL};
    use nix::unistd::Pid;
    if let Err(e) = kill(Pid::from_raw(-1), SIGKILL) {
        eprintln!("failed to kill processes: {e}");
    }
    nix::unistd::execv(
        c!("/sbin/switch_root"),
        &[
            c!("switch_root"),
            c!("-c"),
            c!("/dev/console"),
            c!(root),
            c!("/sbin/init"),
        ],
    )
    .unwrap();
    unreachable!();
 }
 async fn mount(src: &str, dst: &str, fstype: &str, opts: Option<&str>) {
    if let Err(e) = fs::create_dir_all(dst).await {
        error!("failed to create dir {dst}: {e}");
    }
    match fstype {
        "ext4" => {
            exec("fsck", &["-p", src]).await;
        }
        _ => {}
    }
    let mut args = vec![src, dst];
    if !fstype.is_empty() {
        args.extend(&["-t", fstype]);
    }
    if let Some(opts) = opts {
        args.extend(["-o", opts]);
    }
    exec("mount", &args).await;
 }
 async fn start_daemon(prog: &str, args: &[&str]) {
    let (cmd_str, mut cmd) = cmd_str(prog, args);
    retry_or_ignore(async || {
        info!("starting as daemon: {cmd_str}");
        cmd.spawn()?;
        Ok(())
    })
    .await;
 }
 async fn try_exec(prog: &str, args: &[&str]) -> Result<()> {
    let (cmd_str, mut cmd) = cmd_str(prog, args);
    info!("# {cmd_str}");
    let s = cmd.status().await?;
    if s.success() {
        Ok(())
    } else {
        Err(format_err!("command failed: {s}"))
    }
 }
 async fn exec(prog: &str, args: &[&str]) {
    retry_or_ignore(async || try_exec(prog, args).await).await;
 }
 async fn retry_or_ignore(mut action: impl AsyncFnMut() -> Result<()>) {
    loop {
        match action().await {
            Ok(_) => return,
            Err(e) => {
                error!("{e}");
                match input::read_choice(["[r]etry", "[i]gnore", "[s]hell"]).await {
                    'r' => {}
                    'i' => return,
                    's' => exec_shell().await,
                    _ => unreachable!(),
                }
            }
        }
    }
 }
 async fn retry<T>(mut action: impl AsyncFnMut() -> Result<T>) -> T {
    loop {
        match action().await {
            Ok(v) => return v,
            Err(e) => {
                error!("{e}");
                match input::read_choice(["[r]etry", "[s]hell"]).await {
                    'r' => {}
                    's' => exec_shell().await,
                    _ => unreachable!(),
                }
            }
        }
    }
 }
 async fn exec_shell() {
    let mut child = match Command::new("ash").spawn() {
        Ok(c) => c,
        Err(e) => {
            error!("failed to exec shell: {e}");
            return;
        }
    };
    let _ = child.wait().await;
 }
 fn cmd_str(prog: &str, args: &[&str]) -> (String, Command) {
    use std::borrow::Cow;
    let mut buf = String::new();
    buf.push_str(&shell_escape::escape(Cow::Borrowed(prog)));
    for &arg in args {
        buf.push(' ');
        buf.push_str(&shell_escape::escape(Cow::Borrowed(arg)));
    }
    let mut cmd = Command::new(prog);
    cmd.args(args);
    (buf, cmd)
 }
 #[allow(unused)]
 async fn child_reaper() {
    use nix::sys::wait::{waitpid, WaitPidFlag};
    use nix::unistd::Pid;
    use tokio::signal::unix::{signal, SignalKind};
    let Ok(mut sigs) =
        signal(SignalKind::child()).inspect_err(|e| warn!("failed to setup SIGCHLD handler: {e}"))
    else {
        return;
    };
    loop {
        sigs.recv().await;
        let _ = waitpid(Some(Pid::from_raw(-1)), Some(WaitPidFlag::WNOHANG));
    }
 }
--- a/src/cmd/init/bootstrap.rs
+++ b/src/cmd/init/bootstrap.rs
@ -1,320 +0,0 @@
 use eyre::{format_err, Result};
 use log::info;
 use std::path::Path;
 use tokio::{
    fs,
    io::{AsyncBufReadExt, BufReader},
 };
 use super::{exec, mount, retry, retry_or_ignore, try_exec};
 use crate::bootstrap::config::Config;
 use crate::{dkl, utils};
 pub async fn bootstrap(cfg: Config) {
    let bs = cfg.bootstrap;
    retry_or_ignore(async || {
        fs::create_dir_all("/boostrap").await?;
        mount(&bs.dev, "/bootstrap", "auto", None).await;
        Ok(())
    })
    .await;
    let boot_version = utils::param("version", "current");
    let base_dir = &format!("/bootstrap/{boot_version}");
    retry_or_ignore(async || {
        if !fs::try_exists(&base_dir).await? {
            info!("creating {base_dir}");
            fs::create_dir_all(&base_dir).await?
        }
        Ok(())
    })
    .await;
    let sys_cfg: dkl::Config = retry(async || {
        let sys_cfg_bytes = seed_config(base_dir, &bs.seed).await?;
        Ok(serde_yaml::from_slice(&sys_cfg_bytes)?)
    })
    .await;
    mount_system(&sys_cfg, base_dir).await;
    retry_or_ignore(async || {
        let path = "/etc/resolv.conf";
        if fs::try_exists(path).await? {
            info!("cp /etc/resolv.conf");
            fs::copy(path, &format!("/system{path}")).await?;
        }
        Ok(())
    })
    .await;
    retry_or_ignore(async || apply_files(&sys_cfg.files, "/system").await).await;
    apply_groups(&sys_cfg.groups, "/system").await;
    apply_users(&sys_cfg.users, "/system").await;
    // TODO VPNs
    mount_filesystems(&sys_cfg.mounts, "/system").await;
    retry_or_ignore(async || {
        info!("setting up root user");
        setup_root_user(&sys_cfg.root_user, "/system").await
    })
    .await;
 }
 async fn seed_config(base_dir: &str, seed_url: &Option<String>) -> Result<Vec<u8>> {
    let cfg_path = &format!("{base_dir}/config.yaml");
    if fs::try_exists(cfg_path).await? {
        return Ok(fs::read(cfg_path).await?);
    }
    let bs_tar = "/bootstrap.tar";
    if !fs::try_exists(bs_tar).await? {
        if let Some(seed_url) = seed_url.as_ref() {
            fetch_bootstrap(seed_url, bs_tar).await?;
        } else {
            return Err(format_err!(
                "no {cfg_path}, no {bs_tar} and no seed, can't bootstrap"
            ));
        }
    }
    try_exec("tar", &["xf", bs_tar, "-C", base_dir]).await?;
    if !fs::try_exists(cfg_path).await? {
        return Err(format_err!("{cfg_path} does not exist after seeding"));
    }
    Ok(fs::read(cfg_path).await?)
 }
 async fn fetch_bootstrap(seed_url: &str, output_file: &str) -> Result<()> {
    let tmp_file = &format!("{output_file}.new");
    let _ = fs::remove_file(tmp_file).await;
    try_exec("wget", &["-O", tmp_file, seed_url]).await?;
    fs::rename(tmp_file, output_file)
        .await
        .map_err(|e| format_err!("seed rename failed: {e}"))?;
    Ok(())
 }
 async fn mount_system(cfg: &dkl::Config, bs_dir: &str) {
    let mem_dir = "/mem";
    mount("none", mem_dir, "tmpfs", Some("size=512m")).await;
    let layers_dir = &format!("{mem_dir}/layers");
    let mut lower_dir = String::new();
    for layer in &cfg.layers {
        let src = if layer == "modules" {
            "/modules.sqfs"
        } else {
            &format!("{bs_dir}/{layer}.fs")
        };
        let tgt = &format!("{mem_dir}/{layer}.fs");
        retry(async || {
            info!("copying layer {layer} from {src}");
            fs::copy(src, tgt).await?;
            Ok(())
        })
        .await;
        let layer_dir = &format!("{layers_dir}/{layer}");
        mount(tgt, layer_dir, "squashfs", None).await;
        if !lower_dir.is_empty() {
            lower_dir.push(':');
        }
        lower_dir.push_str(&layer_dir);
    }
    let upper_dir = &format!("{mem_dir}/upper");
    let work_dir = &format!("{mem_dir}/work");
    retry_or_ignore(async || {
        fs::create_dir_all(upper_dir).await?;
        fs::create_dir_all(work_dir).await?;
        Ok(())
    })
    .await;
    mount(
        "none",
        "/system",
        "overlay",
        Some(&format!(
            "lowerdir={lower_dir},upperdir={upper_dir},workdir={work_dir}"
        )),
    )
    .await;
    // make root rshared (default in systemd, required by Kubernetes 1.10+)
    // equivalent to "mount --make-rshared /"
    // see kernel's Documentation/sharedsubtree.txt (search rshared)
    retry_or_ignore(async || {
        use nix::mount::MsFlags as M;
        const NONE: Option<&str> = None;
        nix::mount::mount(NONE, "/system", NONE, M::MS_SHARED | M::MS_REC, NONE)?;
        Ok(())
    })
    .await;
 }
 fn chroot(root: &str, path: &str) -> String {
    format!("{root}/{}", path.trim_start_matches(|c| c == '/'))
 }
 async fn apply_files(files: &[dkl::File], root: &str) -> Result<()> {
    for file in files {
        let path = chroot(root, &file.path);
        let path = Path::new(&path);
        if let Some(parent) = path.parent() {
            fs::create_dir_all(parent).await?;
        }
        use crate::dkl::FileKind as K;
        match &file.kind {
            K::Content(content) => fs::write(path, content.as_bytes()).await?,
            K::Dir(true) => fs::create_dir(path).await?,
            K::Dir(false) => {} // shouldn't happen, but semantic is to ignore
            K::Symlink(tgt) => fs::symlink(tgt, path).await?,
        }
        match file.kind {
            K::Symlink(_) => {}
            _ => set_perms(path, file.mode).await?,
        }
        info!("created {}", file.path);
    }
    Ok(())
 }
 async fn set_perms(path: impl AsRef<Path>, mode: Option<u32>) -> std::io::Result<()> {
    if let Some(mode) = mode.filter(|m| *m != 0) {
        use std::os::unix::fs::PermissionsExt;
        let mode = std::fs::Permissions::from_mode(mode);
        fs::set_permissions(path, mode).await?;
    }
    Ok(())
 }
 async fn apply_groups(groups: &[dkl::Group], root: &str) {
    for group in groups {
        let mut args = vec![root, "groupadd", "-r"];
        let gid = group.gid.map(|s| s.to_string());
        if let Some(gid) = gid.as_ref() {
            args.extend(&["-g", gid]);
        }
        args.push(group.name.as_str());
        exec("chroot", &args).await;
    }
 }
 async fn apply_users(users: &[dkl::User], root: &str) {
    for user in users {
        let mut args = vec![root, "useradd", "-r"];
        let uid = user.uid.map(|s| s.to_string());
        if let Some(uid) = uid.as_ref() {
            args.extend(&["-u", uid]);
        }
        let gid = user.gid.map(|s| s.to_string());
        if let Some(gid) = gid.as_ref() {
            args.extend(&["-g", gid]);
        }
        args.push(user.name.as_str());
        exec("chroot", &args).await;
    }
 }
 async fn mount_filesystems(mounts: &[dkl::Mount], root: &str) {
    for m in mounts {
        let path = chroot(root, &m.path);
        mount(
            &m.dev,
            &path,
            m.r#type.as_ref().map_or("", |v| v.as_str()),
            m.options
                .as_ref()
                .filter(|v| !v.is_empty())
                .map(|s| s.as_str()),
        )
        .await;
    }
 }
 async fn setup_root_user(user: &dkl::RootUser, root: &str) -> Result<()> {
    if let Some(pw_hash) = user.password_hash.as_ref().filter(|v| !v.is_empty()) {
        set_user_password("root", &pw_hash, root).await?;
    }
    let mut authorized_keys = Vec::new();
    for ak in &user.authorized_keys {
        authorized_keys.extend(ak.as_bytes());
        authorized_keys.push(b'\n');
    }
    let ssh_dir = &chroot(root, "root/.ssh");
    fs::create_dir_all(ssh_dir)
        .await
        .map_err(|e| format_err!("mkdir -p {ssh_dir} failed: {e}"))?;
    set_perms(ssh_dir, Some(0o700))
        .await
        .map_err(|e| format_err!("chmod {ssh_dir} failed: {e}"))?;
    let ak_path = &format!("{ssh_dir}/authorized_keys");
    fs::write(ak_path, authorized_keys)
        .await
        .map_err(|e| format_err!("write {ak_path} failed: {e}"))?;
    Ok(())
 }
 async fn set_user_password(user: &str, password_hash: &str, root: &str) -> Result<()> {
    info!("setting password for {user}");
    let user = user.as_bytes();
    let password_hash = password_hash.as_bytes();
    let mut buf = Vec::new();
    let pw_file = &chroot(root, "etc/shadow");
    let rd = fs::File::open(pw_file)
        .await
        .map_err(|e| format_err!("open {pw_file} failed: {e}"))?;
    let mut rd = BufReader::new(rd);
    let mut line = Vec::new();
    while (rd.read_until(b'\n', &mut line).await)
        .map_err(|e| format_err!("read {pw_file} failed: {e}"))?
        != 0
    {
        let mut split: Vec<_> = line.split(|c| *c == b':').collect();
        if split.len() > 2 && split[0] == user {
            split[1] = password_hash;
            buf.extend(split.join(&b':'));
        } else {
            buf.extend(&line);
        }
        line.clear();
    }
    fs::write(pw_file, buf).await?;
    Ok(())
 }
--- a/src/cmd/init/dmcrypt.rs
+++ b/src/cmd/init/dmcrypt.rs
@ -1,151 +0,0 @@
 use eyre::{format_err, Result};
 use log::{error, info, warn};
 use std::collections::BTreeSet as Set;
 use std::process::Stdio;
 use tokio::io::AsyncWriteExt;
 use tokio::process::Command;
 use tokio::sync::Mutex;
 use super::{retry_or_ignore, USED_DEVS};
 use crate::blockdev::{is_uninitialized, uninitialize};
 use crate::bootstrap::config::{CryptDev, DevFilter};
 use crate::fs::walk_dir;
 use crate::input;
 pub async fn setup(devs: &[CryptDev]) {
    if devs.is_empty() {
        return;
    }
    let mut used_devs = USED_DEVS.lock().await;
    // CryptDev.name that have a least one assignment done
    let mut done = Set::new();
    // dmcrypt devices opened here
    let mut done_crypt = Set::new();
    retry_or_ignore(async || {
        let all_devs = walk_dir("/dev").await;
        for dev in devs {
            let mut mappings = find_dev(dev, &all_devs);
            mappings.retain(|(_, dev_path)| !used_devs.contains(dev_path));
            if mappings.is_empty() && !dev.optional() && !done.contains(&dev.name) {
                return Err(format_err!("no device found for crypt dev {}", dev.name));
            }
            for (crypt_dev, dev_path) in mappings {
                if done_crypt.contains(&crypt_dev) {
                    continue;
                }
                info!("crypt dev {crypt_dev}: using {dev_path}");
                crypt_open(&crypt_dev, &dev_path).await?;
                done_crypt.insert(crypt_dev);
                used_devs.insert(dev_path);
                done.insert(&dev.name);
            }
        }
        Ok(())
    })
    .await;
 }
 static PREV_PW: Mutex<String> = Mutex::const_new(String::new());
 async fn crypt_open(crypt_dev: &str, dev_path: &str) -> Result<()> {
    'open_loop: loop {
        let mut prev_pw = PREV_PW.lock().await;
        let prompt = if prev_pw.is_empty() {
            format!("crypt password for {crypt_dev}? ")
        } else {
            format!("crypt password for {crypt_dev} (enter = reuse previous)? ")
        };
        let mut pw = input::read_password(prompt).await;
        if pw.is_empty() {
            pw = prev_pw.clone();
        }
        if pw.is_empty() {
            error!("empty password provided!");
            continue;
        }
        *prev_pw = pw.clone();
        if cryptsetup(&pw, ["open", dev_path, crypt_dev]).await? {
            return Ok(());
        }
        error!("crypt open {crypt_dev} from {dev_path} failed");
        if is_uninitialized(dev_path).await? {
            // we can format the device
            info!("{dev_path} looks uninitialized, it may be formatted");
            match input::read_choice(["[f]ormat", "[r]etry", "[i]gnore"]).await {
                'r' => continue 'open_loop,
                'i' => return Ok(()),
                'f' => {
                    if !cryptsetup(&pw, ["luksFormat", dev_path]).await? {
                        return Err(format_err!("cryptsetup luksFormat failed"));
                    }
                    if !cryptsetup(&pw, ["open", dev_path, crypt_dev]).await? {
                        return Err(format_err!("open after format failed"));
                    }
                    if let Err(e) = uninitialize(&format!("/dev/mapper/{crypt_dev}")).await {
                        warn!("uninitialize failed (ignored): {e}");
                    }
                    return Ok(());
                }
                _ => unreachable!(),
            }
        } else {
            // device looks initialized, don't allow format
            warn!("{dev_path} looks initialized, formatting not allowed from init");
            match input::read_choice(["[r]etry", "[i]gnore"]).await {
                'r' => continue 'open_loop,
                'i' => return Ok(()),
                _ => unreachable!(),
            }
        }
    }
 }
 async fn cryptsetup<const N: usize>(pw: &str, args: [&str; N]) -> Result<bool> {
    let mut child = Command::new("cryptsetup")
        .args(args)
        .arg("--key-file=-")
        .stdin(Stdio::piped())
        .spawn()?;
    (child.stdin.as_mut().unwrap())
        .write_all(pw.as_bytes())
        .await?;
    Ok(child.wait().await?.success())
 }
 fn find_dev(dev: &CryptDev, all_devs: &[String]) -> Vec<(String, String)> {
    let dev_name = &dev.name;
    match dev.filter {
        DevFilter::Dev(ref path) => (all_devs.iter())
            .filter(|dev_path| dev_path == &path)
            .map(|dev_path| (dev.name.clone(), dev_path.clone()))
            .collect(),
        DevFilter::Prefix(ref prefix) => (all_devs.iter())
            .filter_map(|path| {
                let suffix = path.strip_prefix(prefix)?;
                Some((format!("{dev_name}{suffix}"), path.clone()))
            })
            .collect(),
    }
 }
--- a/src/cmd/init/lvm.rs
+++ b/src/cmd/init/lvm.rs
@ -1,212 +0,0 @@
 use eyre::{format_err, Result};
 use log::{error, info, warn};
 use tokio::process::Command;
 use super::{exec, retry, retry_or_ignore, USED_DEVS};
 use crate::bootstrap::config::{Config, Filesystem, LvSize, LvmLV, LvmVG, TAKE_ALL};
 use crate::fs::walk_dir;
 use crate::{blockdev, lvm};
 pub async fn setup(cfg: &Config) {
    if cfg.lvm.is_empty() {
        info!("no LVM VG configured");
        return;
    }
    exec("pvscan", &[]).await;
    exec("vgscan", &["--mknodes"]).await;
    for vg in &cfg.lvm {
        retry_or_ignore(async || setup_vg(vg).await).await
    }
    let lvs = retry(lvm::lvs).await;
    for vg in &cfg.lvm {
        let vg_name = vg.name.as_str();
        for lv in &vg.lvs {
            let lv_name = lv.name.as_str();
            if (lvs.iter()).any(|lv| lv.equal_name(vg_name, lv_name)) {
                info!("LVM LV {vg_name}/{lv_name} exists");
            } else {
                retry_or_ignore(async || setup_lv(&vg, &lv).await).await;
            }
        }
    }
    exec("vgchange", &["--sysinit", "-a", "ly"]).await;
    for vg in &cfg.lvm {
        for lv in &vg.lvs {
            retry_or_ignore(async || format_lv(&vg, &lv).await).await;
        }
    }
 }
 async fn setup_vg(vg: &LvmVG) -> Result<()> {
    let vg_name = vg.name.as_str();
    let pvs = retry(lvm::pvs).await;
    let mut dev_done = pvs.iter().filter(|pv| pv.vg_name == vg.name).count();
    let dev_needed = vg.pvs.n;
    macro_rules! missing_count {
        () => {
            (dev_needed as usize) - dev_done
        };
    }
    if dev_needed == TAKE_ALL {
        if dev_done == 0 {
            info!("setting up LVM VG {vg_name} using all matching devices");
        } else {
            // in "take all" mode, don't extend as existing vg at boot
            info!("LVM VG {vg_name} exists");
            return Ok(());
        }
    } else if dev_done >= (dev_needed as usize) {
        info!("LVM VG {vg_name} exists with enough devices");
        return Ok(()); // already set up
    } else {
        info!("setting up LVM VG {vg_name} ({dev_done}/{dev_needed} devices configured)");
    }
    let regexps: Vec<regex::Regex> = (vg.pvs.regexps.iter())
        .filter_map(|re_str| {
            (re_str.parse())
                .inspect_err(|e| error!("invalid regex ignored: {re_str:?}: {e}"))
                .ok()
        })
        .collect();
    let mut used_devs = USED_DEVS.lock().await;
    let matching_devs = (walk_dir("/dev").await.into_iter())
        .filter(|path| !used_devs.contains(path.as_str()))
        .filter(|path| regexps.iter().any(|re| re.is_match(path)));
    let devs: Vec<_> = if dev_needed == TAKE_ALL {
        matching_devs.collect()
    } else {
        matching_devs.take(missing_count!()).collect()
    };
    let cmd = if dev_done == 0 {
        "vgcreate"
    } else {
        "vgextend"
    };
    let status = (Command::new(cmd).arg(vg_name).args(&devs))
        .status()
        .await?;
    if !status.success() {
        return Err(format_err!("{cmd} failed: {status}"));
    }
    dev_done += devs.len();
    used_devs.extend(devs);
    if dev_needed != TAKE_ALL && dev_done < (dev_needed as usize) {
        return Err(format_err!(
            "LVM VG {vg_name} needs {} more device(s)",
            missing_count!()
        ));
    }
    Ok(())
 }
 async fn setup_lv(vg: &LvmVG, lv: &LvmLV) -> Result<()> {
    let name = format!("{}/{}", vg.name, lv.name);
    info!("creating LV {name}");
    let mut cmd = Command::new("lvcreate");
    cmd.arg(&vg.name);
    cmd.args(&["--name", &lv.name]);
    match &lv.size {
        LvSize::Size(sz) => cmd.args(&["-L", sz]),
        LvSize::Extents(sz) => cmd.args(&["-l", sz]),
    };
    let raid = lv.raid.as_ref().unwrap_or(&vg.defaults.raid);
    if let Some(mirrors) = raid.mirrors {
        cmd.args(&["--mirrors", &mirrors.to_string()]);
    }
    if let Some(stripes) = raid.stripes {
        cmd.args(&["--stripes", &stripes.to_string()]);
    }
    let status = cmd.status().await?;
    if !status.success() {
        return Err(format_err!("lvcreate failed: {status}"));
    }
    if let Err(e) = blockdev::uninitialize(&format!("/dev/{name}")).await {
        warn!("uninitialize failed (ignored): {e}");
    }
    Ok(())
 }
 async fn format_lv(vg: &LvmVG, lv: &LvmLV) -> Result<()> {
    let name = &format!("{}/{}", vg.name, lv.name);
    let dev = &format!("/dev/{name}");
    if !blockdev::is_uninitialized(&dev).await? {
        info!("{dev} looks initialized");
        return Ok(());
    }
    let fs = lv.fs.as_ref().unwrap_or(&vg.defaults.fs);
    info!("initializing {} filesystem on {dev}", fs.fstype());
    let mkfs = format!("mkfs.{}", fs.fstype());
    let mut cmd = Command::new(&mkfs);
    // filesystem specific flags
    match fs {
        Filesystem::Ext4 => {
            cmd.arg("-F");
        }
        Filesystem::Btrfs | Filesystem::Xfs => {
            cmd.arg("-f");
        }
        &Filesystem::Other(_) => {}
    }
    cmd.arg(dev);
    let mut child = match cmd.spawn() {
        Ok(v) => v,
        Err(e) => {
            // try simple fixes
            match fs {
                Filesystem::Xfs => install_package("xfsprogs").await?,
                Filesystem::Btrfs => install_package("btrs-progs").await?,
                _ => Err(format_err!("{mkfs} failed: {e}"))?,
            }
            cmd.spawn().map_err(|e| format_err!("{mkfs} failed: {e}"))?
        }
    };
    let status = child.wait().await?;
    if !status.success() {
        return Err(format_err!("{mkfs} failed: {status}"));
    }
    Ok(())
 }
 async fn install_package(pkg: &str) -> Result<()> {
    let status = Command::new("apk").arg("add").arg(pkg).status().await?;
    if status.success() {
        Ok(())
    } else {
        Err(format_err!("failed to install package {pkg}: {status}"))
    }
 }
--- a/src/cmd/init/networks.rs
+++ b/src/cmd/init/networks.rs
@ -1,94 +0,0 @@
 use itertools::Itertools;
 use log::{info, warn};
 use std::collections::BTreeSet as Set;
 use tokio::process::Command;
 use super::{format_err, retry_or_ignore, Config, Result};
 use crate::{
    bootstrap::config,
    udev,
    utils::{select_n_by_regex, NameAliases},
 };
 pub async fn setup(cfg: &Config) {
    if cfg.networks.is_empty() {
        warn!("no networks configured");
        return;
    }
    let mut assigned = Set::new();
    for net in &cfg.networks {
        retry_or_ignore(async || setup_network(net, &mut assigned).await).await;
    }
 }
 async fn setup_network(net: &config::Network, assigned: &mut Set<String>) -> Result<()> {
    info!("setting up network {}", net.name);
    let netdevs = get_interfaces()?
        .filter(|dev| !assigned.contains(dev.name()))
        .collect::<Vec<_>>();
    for dev in &netdevs {
        info!(
            "- available network device: {}, aliases [{}]",
            dev.name(),
            dev.aliases().join(", ")
        );
    }
    let mut cmd = Command::new("ash");
    cmd.arg("-c");
    cmd.arg(&net.script);
    let mut selected = Vec::new();
    for iface in &net.interfaces {
        let var = &iface.var;
        let netdevs = netdevs.iter().filter(|na| !assigned.contains(na.name()));
        let if_names = select_n_by_regex(iface.n, &iface.regexps, netdevs);
        if if_names.is_empty() {
            return Err(format_err!("- no interface match for {var:?}"));
        }
        let value = if_names.join(" ");
        info!("- {var}={value}");
        cmd.env(var, value);
        selected.extend(if_names);
    }
    info!("- running script");
    let status = cmd.status().await?;
    if !status.success() {
        return Err(format_err!("setup script failed: {status}"));
    }
    assigned.extend(selected);
    Ok(())
 }
 fn get_interfaces() -> Result<impl Iterator<Item = NameAliases>> {
    Ok(udev::get_devices("net")?.into_iter().map(|dev| {
        let mut na = NameAliases::new(dev.sysname().to_string());
        for (property, value) in dev.properties() {
            if [
                "INTERFACE",
                "ID_NET_NAME",
                "ID_NET_NAME_PATH",
                "ID_NET_NAME_MAC",
                "ID_NET_NAME_SLOT",
            ]
            .contains(&property)
            {
                na.push(value.to_string());
            }
        }
        na
    }))
 }
--- a/src/cmd/init/sshd.rs
+++ b/src/cmd/init/sshd.rs
@ -1,96 +0,0 @@
 use log::{info, warn};
 use std::fs;
 use std::io::Write;
 use std::os::unix::fs::PermissionsExt;
 use std::process::Stdio;
 use tokio::net;
 use tokio::process::Command;
 use super::{retry_or_ignore, Config};
 pub async fn start(cfg: &Config) {
    retry_or_ignore(async || {
        info!("ssh: writing authorized keys");
        let ssh_dir = "/root/.ssh";
        let authorized_keys = format!("{ssh_dir}/authorized_keys");
        fs::create_dir_all(ssh_dir)?;
        fs::set_permissions(ssh_dir, fs::Permissions::from_mode(0o700))?;
        let mut ak = Vec::new();
        for auth in &cfg.auths {
            let Some(ref key) = auth.ssh_key else {
                continue;
            };
            writeln!(ak, "{key} {}", auth.name)?;
        }
        fs::write(authorized_keys, ak)?;
        Ok(())
    })
    .await;
    retry_or_ignore(async || {
        let mut sshd_args = Vec::new();
        sshd_args.extend(["-i", "-E", "/var/log/sshd.log"]);
        for key_path in cfg.ssh.keys.iter() {
            if !fs::exists(key_path).is_ok_and(|b| b) {
                info!("ssh: host key not found (ignored): {key_path}");
                continue;
            }
            sshd_args.extend(["-h", key_path]);
        }
        let sshd_args = sshd_args.into_iter().map(String::from).collect();
        // don't pre-start sshd as it should rarely be useful at this stage, use inetd-style.
        let listen_addr = cfg.ssh.listen.clone();
        info!("ssh: starting listener on {listen_addr}");
        let listener = net::TcpListener::bind(listen_addr).await?;
        tokio::spawn(handle_ssh_connections(listener, sshd_args));
        Ok(())
    })
    .await;
 }
 async fn handle_ssh_connections(listener: net::TcpListener, sshd_args: Vec<String>) {
    loop {
        let (stream, remote) = match listener.accept().await {
            Ok(v) => v,
            Err(e) => {
                warn!("ssh: listener stopped: {e}");
                return;
            }
        };
        use std::os::unix::io::{AsRawFd, FromRawFd};
        let fd = stream.as_raw_fd();
        let mut cmd = Command::new("/usr/sbin/sshd");
        cmd.args(&sshd_args);
        cmd.stdin(unsafe { Stdio::from_raw_fd(fd) });
        cmd.stdout(unsafe { Stdio::from_raw_fd(fd) });
        cmd.stderr(Stdio::null());
        let Ok(mut child) =
            (cmd.spawn()).inspect_err(|e| warn!("ssh: failed to start server: {e}"))
        else {
            continue;
        };
        let pid = child.id().unwrap();
        info!("ssh: new connection from {remote}, sshd PID {pid}");
        tokio::spawn(async move {
            let _ = child.wait().await;
        });
    }
 }
--- a/src/cmd/init_input.rs
+++ b/src/cmd/init_input.rs
@ -1,11 +0,0 @@
 use crate::input;
 pub async fn run() {
    tokio::spawn(async {
        if let Err(e) = input::forward_requests_from_socket().await {
            eprintln!("failed to forwards requests from socket: {e}");
            std::process::exit(1);
        }
    });
    input::answer_requests_from_stdin().await;
 }
--- a/src/cmd/version.rs
+++ b/src/cmd/version.rs
@ -1,12 +0,0 @@
 pub fn run() {
    println!("{}", version_string());
 }
 pub fn version_string() -> String {
    format!(
        "Direktil {} v{} (git commit {})",
        env!("CARGO_PKG_NAME"),
        env!("CARGO_PKG_VERSION"),
        env!("GIT_COMMIT")
    )
 }
--- a/src/dkl.rs
+++ b/src/dkl.rs
@ -1,61 +0,0 @@
 #[derive(Debug, serde::Deserialize, serde::Serialize)]
 pub struct Config {
    pub layers: Vec<String>,
    pub root_user: RootUser,
    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    pub mounts: Vec<Mount>,
    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    pub files: Vec<File>,
    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    pub groups: Vec<Group>,
    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    pub users: Vec<User>,
 }
 #[derive(Debug, serde::Deserialize, serde::Serialize)]
 pub struct RootUser {
    #[serde(skip_serializing_if = "Option::is_none")]
    pub password_hash: Option<String>,
    pub authorized_keys: Vec<String>,
 }
 #[derive(Debug, serde::Deserialize, serde::Serialize)]
 pub struct Mount {
    pub r#type: Option<String>,
    pub dev: String,
    pub path: String,
    pub options: Option<String>,
 }
 #[derive(Debug, serde::Deserialize, serde::Serialize)]
 pub struct Group {
    pub name: String,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub gid: Option<u32>,
 }
 #[derive(Debug, serde::Deserialize, serde::Serialize)]
 pub struct User {
    pub name: String,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub uid: Option<u32>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub gid: Option<u32>,
 }
 #[derive(Debug, serde::Deserialize, serde::Serialize)]
 pub struct File {
    pub path: String,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub mode: Option<u32>,
    #[serde(flatten)]
    pub kind: FileKind,
 }
 #[derive(Debug, serde::Deserialize, serde::Serialize)]
 #[serde(rename_all = "snake_case")]
 pub enum FileKind {
    Content(String),
    Symlink(String),
    Dir(bool),
 }
--- a/src/dklog.rs
+++ b/src/dklog.rs
@ -1,136 +0,0 @@
 use std::io::Write;
 use std::sync::{LazyLock, Mutex};
 use std::time::SystemTime;
 use tokio::sync::watch;
 use tokio::task::JoinSet;
 pub static LOG: LazyLock<Log> = LazyLock::new(Log::new);
 pub fn init() {
    log::set_logger(&*LOG).expect("set_logger should not fail");
    log::set_max_level(log::LevelFilter::Info);
 }
 pub struct Log {
    start: SystemTime,
    log: Mutex<Vec<u8>>,
    tx: Mutex<Option<watch::Sender<usize>>>,
    rx: watch::Receiver<usize>,
    tasks: Mutex<Option<JoinSet<()>>>,
 }
 impl Log {
    pub fn new() -> Self {
        let (tx, rx) = watch::channel(0);
        Self {
            start: SystemTime::now(),
            log: Mutex::new(Vec::new()),
            tx: Mutex::new(Some(tx)),
            rx,
            tasks: Mutex::new(Some(JoinSet::new())),
        }
    }
    pub fn spawn(&self, task: impl Future<Output = ()> + Send + 'static) {
        if let Some(tasks) = self.tasks.lock().unwrap().as_mut() {
            tasks.spawn(task);
        }
    }
    pub fn subscribe(&self) -> LogWatch {
        LogWatch {
            log: self,
            pos: 0,
            rx: self.rx.clone(),
        }
    }
    pub async fn copy_to<W: tokio::io::AsyncWrite + Unpin>(&self, mut out: W) {
        let mut log = self.subscribe();
        use tokio::io::AsyncWriteExt;
        while let Some(chunk) = log.next().await {
            let _ = out.write_all(&chunk).await;
            let _ = out.flush().await;
        }
    }
    pub async fn close(&self) {
        self.tx.lock().unwrap().take();
        if let Some(tasks) = self.tasks.lock().unwrap().take() {
            tasks.join_all().await;
        }
    }
 }
 impl log::Log for Log {
    fn enabled(&self, metadata: &log::Metadata) -> bool {
        use log::Level::*;
        match metadata.level() {
            Trace | Debug => false,
            Info | Warn | Error => true,
        }
    }
    fn log(&self, record: &log::Record) {
        if !self.enabled(record.metadata()) {
            return;
        }
        let ts = self.start.elapsed().unwrap_or_default();
        use log::Level::*;
        let level = match record.level() {
            Trace => "\x1b[2mTRC\x1b[0m",
            Debug => "\x1b[34mDBG\x1b[0m",
            Info => "\x1b[32mINF\x1b[0m",
            Warn => "\x1b[93mWRN\x1b[0m",
            Error => "\x1b[91mERR\x1b[0m",
        };
        let Ok(mut log) = self.log.lock() else {
            return;
        };
        writeln!(
            log,
            "{:3}.{:03} {level} {}",
            ts.as_secs(),
            ts.subsec_millis(),
            record.args()
        )
        .expect("write to buf should not fail");
        if let Some(tx) = self.tx.lock().unwrap().as_mut() {
            tx.send_replace(log.len());
        }
    }
    fn flush(&self) {
        // always flushed
    }
 }
 pub struct LogWatch<'t> {
    log: &'t Log,
    pos: usize,
    rx: watch::Receiver<usize>,
 }
 impl<'t> LogWatch<'t> {
    pub async fn next(&mut self) -> Option<Vec<u8>> {
        loop {
            let new_pos = self.rx.borrow_and_update().clone();
            if new_pos <= self.pos {
                if self.rx.changed().await.is_err() {
                    return None; // finished
                }
                continue;
            }
            let mut chunk = Vec::new();
            chunk.extend(&self.log.log.lock().unwrap()[self.pos..new_pos]);
            self.pos = new_pos;
            return Some(chunk);
        }
    }
 }
--- a/src/fs.rs
+++ b/src/fs.rs
@ -1,43 +0,0 @@
 use log::warn;
 use std::io::Result;
 use tokio::fs;
 pub async fn walk_dir(dir: &str) -> Vec<String> {
    let mut todo = Vec::new();
    if let Ok(rd) = read_dir(dir).await {
        todo.push(rd);
    }
    let mut results = Vec::new();
    while let Some(rd) = todo.pop() {
        for (path, is_dir) in rd {
            if is_dir {
                let Ok(child_rd) = (read_dir(&path).await)
                    .inspect_err(|e| warn!("reading dir {path} failed: {e}"))
                else {
                    continue;
                };
                todo.push(child_rd);
            } else {
                results.push(path);
            }
        }
    }
    results
 }
 async fn read_dir(dir: &str) -> Result<Vec<(String, bool)>> {
    let mut rd = fs::read_dir(dir).await?;
    let mut entries = Vec::new();
    while let Some(entry) = rd.next_entry().await? {
        if let Some(path) = entry.path().to_str() {
            entries.push((path.to_string(), entry.file_type().await?.is_dir()));
        }
    }
    entries.sort(); // we want a deterministic & intuitive order
    Ok(entries)
 }
--- a/src/input.rs
+++ b/src/input.rs
@ -1,343 +0,0 @@
 use log::warn;
 use std::fmt::Display;
 use std::sync::{Arc, LazyLock};
 use tokio::io::{self, AsyncBufReadExt, AsyncWriteExt, BufReader};
 use tokio::net;
 use tokio::sync::{oneshot, watch, Mutex};
 pub async fn read_line(prompt: impl Display) -> String {
    read(prompt, false).await
 }
 pub async fn read_password(prompt: impl Display) -> String {
    read(prompt, true).await
 }
 fn choice_char(s: &str) -> char {
    s.chars().skip_while(|c| *c != '[').skip(1).next().unwrap()
 }
 #[test]
 fn test_choice_char() {
    assert_eq!('r', choice_char("[r]etry"));
    assert_eq!('b', choice_char("re[b]boot"));
 }
 /// ```no_run
 /// use init::input;
 ///
 /// #[tokio::main(flavor = "current_thread")]
 /// async fn main() {
 ///     tokio::spawn(input::answer_requests_from_stdin());
 ///     match input::read_choice(["[r]etry","[i]gnore","re[b]oot"]).await {
 ///         'r' => todo!(),
 ///         'i' => todo!(),
 ///         'b' => todo!(),
 ///         _ => unreachable!(),
 ///     }
 /// }
 /// ```
 pub async fn read_choice<const N: usize>(choices: [&str; N]) -> char {
    let chars = choices.map(choice_char);
    let mut prompt = String::new();
    for s in choices {
        if !prompt.is_empty() {
            prompt.push_str(", ");
        }
        prompt.push_str(s);
    }
    prompt.push_str("? ");
    loop {
        let line = read_line(&prompt).await;
        let Some(ch) = line.chars().nth(0) else {
            continue;
        };
        for choice in chars {
            if ch == choice {
                return choice;
            }
        }
    }
 }
 #[derive(Clone, serde::Deserialize, serde::Serialize)]
 pub struct InputRequest {
    prompt: String,
    hide: bool,
 }
 pub type Reply = Arc<Mutex<Option<oneshot::Sender<String>>>>;
 static REQ: LazyLock<Mutex<watch::Sender<Option<(InputRequest, Reply)>>>> = LazyLock::new(|| {
    let (tx, _) = watch::channel(None);
    Mutex::new(tx)
 });
 static READ_MUTEX: Mutex<()> = Mutex::const_new(());
 async fn read(prompt: impl Display, hide_input: bool) -> String {
    let _read_lock = READ_MUTEX.lock();
    let req = InputRequest {
        prompt: prompt.to_string(),
        hide: hide_input,
    };
    let (tx, rx) = oneshot::channel();
    let reply = Arc::new(Mutex::new(Some(tx)));
    REQ.lock().await.send_replace(Some((req, reply)));
    let input = rx.await.expect("reply sender should not be closed");
    REQ.lock().await.send_replace(None);
    input
 }
 pub async fn answer_requests_from_stdin() {
    let mut stdin = BufReader::new(io::stdin()).lines();
    let mut stdout = io::stdout();
    let mut current_req = REQ.lock().await.subscribe();
    current_req.mark_changed();
    loop {
        // TODO check is stdin has been closed (using C-c is enough for now)
        (current_req.changed().await).expect("input request should not close");
        let Some((req, reply)) = current_req.borrow_and_update().clone() else {
            continue;
        };
        // handle hide
        let mut saved_termios = None;
        if req.hide {
            match termios::Termios::from_fd(0) {
                Ok(mut tio) => {
                    saved_termios = Some(tio.clone());
                    tio.c_lflag &= !termios::ECHO;
                    if let Err(e) = termios::tcsetattr(0, termios::TCSAFLUSH, &tio) {
                        warn!("password may be echoed! {e}");
                    }
                }
                Err(e) => {
                    warn!("password may be echoed! {e}");
                }
            }
        }
        // print the prompt and wait for user input
        stdout.write_all(req.prompt.as_bytes()).await.unwrap();
        stdout.flush().await.unwrap();
        tokio::select!(
            r = stdin.next_line() => {
                let Ok(Some(line)) = r else {
                    warn!("stdin closed");
                    return;
                };
                if let Some(tx) = reply.lock().await.take() {
                    let _ = tx.send(line);
                }
                if saved_termios.is_some() {
                    // final '\n' is hidden too so fix it
                    stdout.write_all(b"\n").await.unwrap();
                    stdout.flush().await.unwrap();
                }
            }
            _ = current_req.changed() => {
                // reply came from somewhere else
                stdout.write_all(b"<answered>\n").await.unwrap();
                stdout.flush().await.unwrap();
                current_req.mark_changed();
            }
        );
        // restore term if input was hidden
        if let Some(tio) = saved_termios {
            if let Err(e) = termios::tcsetattr(0, termios::TCSAFLUSH, &tio) {
                warn!("failed to restore pty attrs: {e}");
            }
        }
    }
 }
 const SOCKET_PATH: &str = "/run/init.sock";
 pub async fn answer_requests_from_socket() {
    let Ok(listener) = net::UnixListener::bind(SOCKET_PATH)
        .inspect_err(|e| warn!("failed start input socket listener: {e}"))
    else {
        return;
    };
    loop {
        let Ok((conn, _)) = (listener.accept())
            .await
            .inspect_err(|e| warn!("input socket listener failed: {e}"))
        else {
            return;
        };
        tokio::spawn(handle_connection(conn));
    }
 }
 #[derive(serde::Deserialize, serde::Serialize)]
 enum Message {
    #[serde(rename = "l")]
    Log(Vec<u8>),
    #[serde(rename = "r")]
    Req(Option<InputRequest>),
 }
 async fn handle_connection(conn: net::UnixStream) {
    use crate::dklog;
    let mut log = dklog::LOG.subscribe();
    let mut current_req = REQ.lock().await.subscribe();
    current_req.mark_changed();
    let (rd, mut wr) = io::split(conn);
    let mut rd = BufReader::new(rd).lines();
    macro_rules! wr {
        ($msg:expr) => {
            let mut buf = serde_json::to_vec(&$msg).unwrap();
            buf.push(b'\n');
            if wr.write_all(&buf).await.is_err() {
                return;
            }
            if wr.flush().await.is_err() {
                return;
            }
        };
    }
    loop {
        tokio::select!(
            r = current_req.changed() => {
                r.expect("input request should not close");
            },
            l = log.next() => {
                let Some(l) = l else { return; };
                wr!(Message::Log(l));
                continue;
            },
        );
        let Some((req, reply)) = current_req.borrow_and_update().clone() else {
            wr!(Message::Req(None));
            continue;
        };
        wr!(Message::Req(Some(req)));
        loop {
            tokio::select!(
                r = rd.next_line() => {
                    let Ok(Some(line)) = r else {
                        return; // closed
                    };
                    if let Some(tx) = reply.lock().await.take() {
                        let _ = tx.send(line);
                    }
                }
                _ = current_req.changed() => {
                    // reply came from somewhere else
                    current_req.mark_changed();
                }
                l = log.next() => {
                    let Some(l) = l else { return; };
                    wr!(Message::Log(l));
                    continue;
                },
            );
            break;
        }
    }
 }
 pub async fn forward_requests_from_socket() -> eyre::Result<()> {
    let stream = net::UnixStream::connect(SOCKET_PATH).await?;
    let (rd, mut wr) = io::split(stream);
    let mut rd = BufReader::new(rd).lines();
    let (tx, mut rx) = tokio::sync::mpsc::channel(1);
    tokio::spawn(async move {
        loop {
            let Ok(line) = (rd.next_line().await).inspect_err(|e| warn!("socket read error: {e}"))
            else {
                return;
            };
            let Some(line) = line else {
                // end of stream
                return;
            };
            let Ok(msg) = serde_json::from_str::<Message>(&line)
                .inspect_err(|e| warn!("invalid message received: {e}"))
            else {
                continue;
            };
            match msg {
                Message::Req(req) => {
                    if tx.send(req).await.is_err() {
                        // closed
                        return;
                    }
                }
                Message::Log(l) => {
                    let mut out = io::stderr();
                    let _ = out.write_all(&l).await;
                    let _ = out.flush().await;
                }
            };
        }
    });
    // the recv request if any, otherwise wait for the next
    let mut recv = None;
    loop {
        let req = match recv.take() {
            // value already available
            Some(v) => v,
            // no value available, wait for the next
            None => match rx.recv().await {
                Some(v) => v,
                // end of requests
                None => return Ok(()),
            },
        };
        let Some(req) = req else {
            REQ.lock().await.send_replace(None);
            continue;
        };
        tokio::select!(
            mut r = read(req.prompt, req.hide) => {
                r.push('\n');
                wr.write_all(r.as_bytes()).await?;
                wr.flush().await?;
            }
            r = rx.recv() => {
                recv = r
            }
        );
    }
 }
--- a/src/lib.rs
+++ b/src/lib.rs
@ -1,11 +0,0 @@
 pub mod bootstrap;
 pub mod cmd;
 pub mod lsblk;
 pub mod lvm;
 pub mod udev;
 pub mod utils;
 pub mod input;
 pub mod blockdev;
 pub mod fs;
 pub mod dkl;
 pub mod dklog;
--- a/src/lvm.rs
+++ b/src/lvm.rs
@ -1,5 +1,5 @@
-use eyre::{format_err, Result};
+use std::io;
-use tokio::process::Command;
+use std::process::Command;
 #[derive(Debug, serde::Deserialize, serde::Serialize)]
 struct Report {
@ -7,13 +7,11 @@ struct Report {
 }
 #[derive(Debug, serde::Deserialize, serde::Serialize)]
 #[serde(untagged)]
 enum ReportObj {
-    #[serde(rename = "pv")]
+    PV { pv: Vec<PV> },
-    PV(Vec<PV>),
+    VG { vg: Vec<VG> },
-    #[serde(rename = "vg")]
+    LV { lv: Vec<LV> },
    VG(Vec<VG>),
    #[serde(rename = "lv")]
    LV(Vec<LV>),
 }
 #[derive(Debug, Clone, serde::Deserialize, serde::Serialize)]
@ -39,63 +37,47 @@ pub struct VG {
 #[derive(Debug, Clone, serde::Deserialize, serde::Serialize)]
 pub struct LV {
-    pub lv_name: String,
+    lv_name: String,
-    pub vg_name: String,
+    vg_name: String,
-    pub lv_attr: String,
+    lv_attr: String,
-    pub lv_size: String,
+    lv_size: String,
-    pub pool_lv: String,
+    pool_lv: String,
-    pub origin: String,
+    origin: String,
-    pub data_percent: String,
+    data_percent: String,
-    pub metadata_percent: String,
+    metadata_percent: String,
-    pub move_pv: String,
+    move_pv: String,
-    pub mirror_log: String,
+    mirror_log: String,
-    pub copy_percent: String,
+    copy_percent: String,
-    pub convert_lv: String,
+    convert_lv: String,
 }
-impl LV {
+pub fn pvs() -> io::Result<Vec<PV>> {
    pub fn equal_name(&self, vg_name: &str, lv_name: &str) -> bool {
        vg_name == &self.vg_name && lv_name == &self.lv_name
    }
 }
 pub async fn pvs() -> Result<Vec<PV>> {
    report_cmd("pvs", |o| match o {
-        ReportObj::PV(pv) => Some(pv),
+        ReportObj::PV { pv } => Some(pv),
        _ => None,
    })
    .await
 }
-pub async fn vgs() -> Result<Vec<VG>> {
+pub fn vgs() -> io::Result<Vec<VG>> {
    report_cmd("vgs", |o| match o {
-        ReportObj::VG(vg) => Some(vg),
+        ReportObj::VG { vg } => Some(vg),
        _ => None,
    })
    .await
 }
-pub async fn lvs() -> Result<Vec<LV>> {
+pub fn lvs() -> io::Result<Vec<LV>> {
    report_cmd("lvs", |o| match o {
-        ReportObj::LV(lv) => Some(lv),
+        ReportObj::LV { lv } => Some(lv),
        _ => None,
    })
    .await
 }
-async fn report_cmd<T>(cmd: &str, find: fn(ReportObj) -> Option<Vec<T>>) -> Result<Vec<T>> {
+fn report_cmd<T>(cmd: &str, find: fn(ReportObj) -> Option<Vec<T>>) -> io::Result<Vec<T>> {
-    let output = Command::new(cmd)
+    let output = Command::new(cmd).arg("--reportformat=json").output()?;
-        .arg("--reportformat=json")
+    let report: Report = serde_json::from_slice(output.stdout.as_slice()).unwrap();
-        .output()
+    Ok(report
-        .await?;
+        .report
-
+        .into_iter()
    if !output.status.success() {
        let stderr = String::from_utf8_lossy(&output.stderr.trim_ascii());
        return Err(format_err!("{cmd} failed: {}", stderr));
    }
    let report: Report = serde_json::from_slice(&output.stdout).unwrap();
    Ok((report.report.into_iter())
        .filter_map(find)
        .flatten()
        .collect())
--- a/src/main.rs
+++ b/src/main.rs
@ -1,52 +1,51 @@
-use eyre::Result;
+mod bootstrap;
-use log::warn;
+mod lsblk;
-use std::env;
+mod lvm;
 use std::process::exit;
-use init::cmd;
+use anyhow::format_err;
-use init::dklog;
+use log::error;
 use std::io::{self, Read, Write};
 use std::process::exit;
 use std::{env, fs};
 #[tokio::main(flavor = "current_thread")]
-async fn main() -> Result<()> {
+async fn main() -> anyhow::Result<()> {
-    dklog::LOG.spawn(dklog::LOG.copy_to(tokio::io::stderr()));
+    if let None = env::var_os("RUST_LOG") {
        env::set_var("RUST_LOG", "info");
    }
    env_logger::init();
-    dklog::init();
+    if let Some(arg) = env::args().into_iter().nth(1) {
-
+        match arg.as_str() {
-    let call_name = env::args().next().unwrap_or("init".into());
+            "hello" => println!("hello"),
-    let call_name = (call_name.rsplit_once('/').map(|(_, n)| n)).unwrap_or(call_name.as_str());
+            _ => {
-
+                error!("invalid arg: {arg}");
-    if call_name == "init" {
+                exit(1);
-        dklog::LOG.spawn(async {
+            }
-            let Ok(log_file) = (tokio::fs::File::create("/var/log/init.log").await)
+        };
-                .inspect_err(|e| warn!("failed to open init.log: {e}"))
+        exit(0);
            else {
                return;
            };
            dklog::LOG.copy_to(log_file).await;
        });
    }
-    let result = match call_name {
+    let cfg = fs::read("config.yaml").map_err(|e| format_err!("failed to read config: {e}"))?;
        "init" => {
            cmd::init::run().await;
            Ok(())
        }
        "init-version" => {
            cmd::version::run();
            Ok(())
        }
        "init-connect" => {
            cmd::init_input::run().await;
            Ok(())
        }
        "bootstrap" => cmd::bootstrap::run().await,
-        _ => {
+    let cfg: bootstrap::config::Config = serde_yaml::from_slice(cfg.as_slice())
-            eprintln!("invalid call name: {call_name:?}");
+        .map_err(|e| format_err!("failed to parse config: {e}"))?;
            exit(1);
        }
    };
-    dklog::LOG.close().await;
+    serde_yaml::to_writer(io::stdout(), &cfg)?;
-    result
+
    for pv in lvm::pvs().unwrap() {
        println!("pv: {pv:?}");
    }
    for vg in lvm::vgs().unwrap() {
        println!("vg: {vg:?}");
    }
    for lv in lvm::lvs().unwrap() {
        println!("lv: {lv:?}");
    }
    println!("lsblk: {:?}", lsblk::report());
    // TODO
    Ok(())
 }
--- a/src/udev.rs
+++ b/src/udev.rs
@ -1,65 +0,0 @@
 use eyre::Result;
 use log::error;
 pub struct Device {
    sysname: String,
    output: String,
 }
 impl Device {
    pub fn sysname(&self) -> &str {
        self.sysname.as_str()
    }
    pub fn properties(&self) -> impl Iterator<Item = (&str, &str)> {
        self.output
            .lines()
            .filter_map(|line| line.strip_prefix("E: ")?.split_once('='))
    }
 }
 pub fn get_devices(class: &str) -> Result<Vec<Device>> {
    let mut devices = Vec::new();
    // none of libudev and udev crates were able to list network devices.
    // falling back to manual sysfs scanning :(
    //
    // Even when given a syspath,
    // - udev crate failed to see all properties;
    // - libudev crate segfaulted on the second property (SYSNUM ok, then segfault).
    // falling back to parsing udevadm output :(
    //
    // The best fix would be to check what's wrong with udev crate.
    let entries = std::fs::read_dir(format!("/sys/class/{class}"))?;
    for entry in entries {
        let Ok(entry) = entry else {
            continue;
        };
        let path = entry.path();
        let path = path.to_string_lossy();
        let output = std::process::Command::new("udevadm")
            .args(&["info", &format!("--path={path}")])
            .stderr(std::process::Stdio::piped())
            .output()?;
        if !output.status.success() {
            error!("udevadm fail for {path}");
            continue;
        }
        let output = String::from_utf8_lossy(&output.stdout);
        let name = entry.file_name();
        let dev = Device {
            sysname: name.to_string_lossy().to_string(),
            output: output.into_owned(),
        };
        devices.push(dev);
    }
    Ok(devices)
 }
--- a/src/utils.rs
+++ b/src/utils.rs
@ -1,81 +0,0 @@
 use log::error;
 use std::collections::BTreeSet as Set;
 use std::sync::LazyLock;
 static CMDLINE: LazyLock<String> = LazyLock::new(|| {
    std::fs::read("/proc/cmdline")
        .map(|c| String::from_utf8_lossy(&c).to_string())
        .unwrap_or_default()
 });
 pub fn param<'t>(name: &'t str, default: &'t str) -> &'t str {
    let prefix1 = &format!("dkl.{name}=");
    let prefix2 = &format!("direktil.{name}=");
    CMDLINE
        .split_ascii_whitespace()
        .find_map(|part| {
            part.strip_prefix(prefix1)
                .or_else(|| part.strip_prefix(prefix2))
        })
        .unwrap_or(default)
 }
 pub struct NameAliases {
    name: String,
    aliases: Set<String>,
 }
 impl NameAliases {
    pub fn new(name: String) -> Self {
        Self {
            name,
            aliases: Set::new(),
        }
    }
    pub fn name(&self) -> &str {
        self.name.as_str()
    }
    pub fn aliases(&self) -> impl Iterator<Item = &str> {
        self.aliases.iter().map(|s| s.as_str())
    }
    pub fn iter(&self) -> impl Iterator<Item = &str> {
        std::iter::once(self.name()).chain(self.aliases())
    }
    pub fn push(&mut self, alias: String) {
        if self.name == alias {
            return;
        }
        self.aliases.insert(alias);
    }
 }
 pub fn select_n_by_regex<'t>(
    n: i16,
    regexs: &Vec<String>,
    nas: impl Iterator<Item = &'t NameAliases>,
 ) -> Vec<String> {
    // compile regexs
    let regexs: Vec<_> = (regexs.iter())
        .filter_map(|re| {
            regex::Regex::new(re)
                .inspect_err(|e| error!("invalid regex ignored: {re:?}: {e}"))
                .ok()
        })
        .collect();
    let matching = |name| regexs.iter().any(|re| re.is_match(name));
    let nas = nas
        .filter(|na| na.iter().any(matching))
        .map(|na| na.name().to_string());
    if n == -1 {
        nas.collect()
    } else {
        nas.take(n as usize).collect()
    }
 }
--- a/ssh.go
+++ b/ssh.go
@ -0,0 +1,281 @@
 package main
 import (
 	"encoding/binary"
 	"fmt"
 	"io"
 	"net"
 	"os"
 	"os/exec"
 	"sync"
 	"syscall"
 	"time"
 	"unsafe"
 	"github.com/creack/pty"
 	"github.com/rs/zerolog/log"
 	"golang.org/x/crypto/ssh"
 	config "novit.tech/direktil/pkg/bootstrapconfig"
 )
 func startSSH(cfg *config.Config) {
 	sshConfig := &ssh.ServerConfig{
 		PublicKeyCallback: sshCheckPubkey,
 	}
 	hostKeyLoaded := false
 	for _, format := range []string{"rsa", "dsa", "ecdsa", "ed25519"} {
 		log := log.With().Str("format", format).Logger()
 		pkBytes, err := os.ReadFile("/id_" + format)
 		if err != nil {
 			log.Error().Err(err).Msg("ssh: failed to load host key")
 			continue
 		}
 		pk, err := ssh.ParsePrivateKey(pkBytes)
 		if err != nil {
 			log.Error().Err(err).Msg("ssh: failed to parse host key")
 			continue
 		}
 		sshConfig.AddHostKey(pk)
 		hostKeyLoaded = true
 		log.Info().Msg("ssh: loaded host key")
 	}
 	if !hostKeyLoaded {
 		fatalf("ssh: failed to load any host key")
 	}
 	sshBind := ":22" // TODO configurable
 	listener, err := net.Listen("tcp", sshBind)
 	if err != nil {
 		fatalf("ssh: failed to listen on %s: %v", sshBind, err)
 	}
 	log.Info().Str("bind-address", sshBind).Msg("SSH server listening")
 	go func() {
 		for {
 			conn, err := listener.Accept()
 			if err != nil {
 				log.Info().Err(err).Msg("ssh: accept conn failed")
 				continue
 			}
 			go sshHandleConn(conn, sshConfig)
 		}
 	}()
 }
 func sshHandleConn(conn net.Conn, sshConfig *ssh.ServerConfig) {
 	sshConn, chans, reqs, err := ssh.NewServerConn(conn, sshConfig)
 	if err != nil {
 		log.Error().Err(err).Msg("ssh: handshake failed")
 		return
 	}
 	remoteAddr := sshConn.User() + "@" + sshConn.RemoteAddr().String()
 	log.Info().Str("remote", remoteAddr).Msg("ssh: new connection")
 	go sshHandleReqs(reqs)
 	go sshHandleChannels(remoteAddr, chans)
 }
 func sshHandleReqs(reqs <-chan *ssh.Request) {
 	for req := range reqs {
 		switch req.Type {
 		case "keepalive@openssh.com":
 			req.Reply(true, nil)
 		default:
 			log.Info().Str("type", req.Type).Msg("ssh: discarding request")
 			req.Reply(false, nil)
 		}
 	}
 }
 func sshHandleChannels(remoteAddr string, chans <-chan ssh.NewChannel) {
 	for newChannel := range chans {
 		if t := newChannel.ChannelType(); t != "session" {
 			newChannel.Reject(ssh.UnknownChannelType, fmt.Sprintf("unknown channel type: %s", t))
 			continue
 		}
 		channel, requests, err := newChannel.Accept()
 		if err != nil {
 			log.Error().Err(err).Msg("ssh: failed to accept channel")
 			continue
 		}
 		go sshHandleChannel(remoteAddr, channel, requests)
 	}
 }
 func sshHandleChannel(remoteAddr string, channel ssh.Channel, requests <-chan *ssh.Request) {
 	var (
 		ptyF, ttyF *os.File
 		termEnv    string
 	)
 	defer func() {
 		if ptyF != nil {
 			ptyF.Close()
 		}
 		if ttyF != nil {
 			ttyF.Close()
 		}
 	}()
 	var once sync.Once
 	closeCh := func() {
 		channel.Close()
 	}
 	for req := range requests {
 		switch req.Type {
 		case "exec":
 			command := string(req.Payload[4 : req.Payload[3]+4])
 			switch command {
 			case "init":
 				if ptyF == nil {
 					go func() {
 						channel.Stderr().Write([]byte("\033[5m\033[31;1m\n\nWARNING: no TTY requested, passwords will be echoed!\n\n\033[0m"))
 						time.Sleep(3 * time.Second)
 						io.Copy(channel, stdout.NewReader())
 						once.Do(closeCh)
 					}()
 					go func() {
 						io.Copy(stdinPipe, channel)
 						once.Do(closeCh)
 					}()
 				} else {
 					stdinTTY := newTTY(ptyF.Fd())
 					if askingSecret.Load() {
 						stdinTTY.EchoOff()
 					}
 					registerInput(stdinTTY)
 					defer unregiterInput(stdinTTY)
 					go func() {
 						io.Copy(ttyF, stdout.NewReader())
 						once.Do(closeCh)
 					}()
 					go func() {
 						io.Copy(stdinPipe, ttyF)
 						once.Do(closeCh)
 					}()
 				}
 				req.Reply(true, nil)
 			case "bootstrap":
 				// extract a new bootstrap package
 				os.MkdirAll("/bootstrap/current", 0750)
 				cmd := exec.Command("/bin/tar", "xv", "-C", "/bootstrap/current")
 				cmd.Stdin = channel
 				cmd.Stdout = channel
 				cmd.Stderr = channel.Stderr()
 				go func() {
 					cmd.Run()
 					closeCh()
 				}()
 				req.Reply(true, nil)
 			default:
 				req.Reply(false, nil)
 			}
 		case "shell":
 			cmd := exec.Command("/bin/ash")
 			cmd.Env = []string{"TERM=" + termEnv}
 			cmd.Stdin = ttyF
 			cmd.Stdout = ttyF
 			cmd.Stderr = ttyF
 			cmd.SysProcAttr = &syscall.SysProcAttr{
 				Setctty:   true,
 				Setsid:    true,
 				Pdeathsig: syscall.SIGKILL,
 			}
 			cmd.Start()
 			go func() {
 				cmd.Wait()
 				ptyF.Close()
 				ptyF = nil
 				ttyF.Close()
 				ttyF = nil
 			}()
 			req.Reply(true, nil)
 		case "pty-req":
 			if ptyF != nil || ttyF != nil {
 				req.Reply(false, nil)
 				continue
 			}
 			var err error
 			ptyF, ttyF, err = pty.Open()
 			if err != nil {
 				log.Error().Err(err).Msg("ssh: PTY open failed")
 				req.Reply(false, nil)
 				continue
 			}
 			termLen := req.Payload[3]
 			termEnv = string(req.Payload[4 : termLen+4])
 			w, h := sshParseDims(req.Payload[termLen+4:])
 			sshSetWinsize(ptyF.Fd(), w, h)
 			req.Reply(true, nil)
 			go func() {
 				io.Copy(channel, ptyF)
 				once.Do(closeCh)
 			}()
 			go func() {
 				io.Copy(ptyF, channel)
 				once.Do(closeCh)
 			}()
 		case "window-change":
 			w, h := sshParseDims(req.Payload)
 			sshSetWinsize(ptyF.Fd(), w, h)
 			// no response
 		default:
 			req.Reply(false, nil)
 		}
 	}
 }
 func sshParseDims(b []byte) (uint32, uint32) {
 	w := binary.BigEndian.Uint32(b)
 	h := binary.BigEndian.Uint32(b[4:])
 	return w, h
 }
 // SetWinsize sets the size of the given pty.
 func sshSetWinsize(fd uintptr, w, h uint32) {
 	// Winsize stores the Height and Width of a terminal.
 	type Winsize struct {
 		Height uint16
 		Width  uint16
 		x      uint16 // unused
 		y      uint16 // unused
 	}
 	ws := &Winsize{Width: uint16(w), Height: uint16(h)}
 	syscall.Syscall(syscall.SYS_IOCTL, fd, uintptr(syscall.TIOCSWINSZ), uintptr(unsafe.Pointer(ws)))
 }
--- a/test-initrd/config.yaml
+++ b/test-initrd/config.yaml
@ -4,18 +4,6 @@ anti_phishing_code: "direktil<3"
 modules: /modules.sqfs
 vpns:
  wgprov: |-
    [Interface]
    PrivateKey = GGM/MwPYrN9HZHsWrEv0RtX/aHXcXzkrZnZWiMgNrEg=
    ListenPort = 54321
    Address = 10.9.8.7/24
    [Peer] # admin1
    PresharedKey = oH1OhMWGPg+Qvq3w5mmp6paIi/1bMKl48r0Su2P1F3g=
    PublicKey = /j/uawB3nM+36fOxWgI/kK412TvHlYU3T8qxr38hpAs=
    AllowedIPs = 10.9.8.1/24
 auths:
  - name:     novit
    sshKey:   ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICkpbU6sf4t0f6XAv9DuW3XH5iLM0AI5rc8PT2jwea1N
--- a/test-initrd/id_ecdsa
+++ b/test-initrd/id_ecdsa
@ -1,9 +0,0 @@
 -----BEGIN OPENSSH PRIVATE KEY-----
 b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS
 1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQSlevO48OA0/yB8zTP1naijVU3wsB0c
 4s6Jc/8y7YwNq51/SlieeGeRFcCSke5Z67rNX2JFiv+tsGQB6TczZm/6AAAAqDU5b2c1OW
 9nAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKV687jw4DT/IHzN
 M/WdqKNVTfCwHRzizolz/zLtjA2rnX9KWJ54Z5EVwJKR7lnrus1fYkWK/62wZAHpNzNmb/
 oAAAAhANenGXlP1ZPgcyb/+O57MbpGDOZS4e7UNiyvkD8I3hNnAAAACW53cmtAbndyawEC
 AwQFBg==
 -----END OPENSSH PRIVATE KEY-----
--- a/test-initrd/id_ed25519
+++ b/test-initrd/id_ed25519
@ -1,7 +0,0 @@
 -----BEGIN OPENSSH PRIVATE KEY-----
 b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
 QyNTUxOQAAACCCMX0zm3Fi7vXWevHuJvzU30l5F06NAC2qloUewVSoDQAAAJDnq/y456v8
 uAAAAAtzc2gtZWQyNTUxOQAAACCCMX0zm3Fi7vXWevHuJvzU30l5F06NAC2qloUewVSoDQ
 AAAEDXYq507MsjSN34Qw87guf3d5D4Dt2IrF788CeBcYSNe4IxfTObcWLu9dZ68e4m/NTf
 SXkXTo0ALaqWhR7BVKgNAAAACW53cmtAbndyawECAwQ=
 -----END OPENSSH PRIVATE KEY-----
--- a/test-initrd/id_rsa.pub
+++ b/test-initrd/id_rsa.pub
@ -0,0 +1 @@
 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDLo+mv+0GJViwFiK14bAw8j4HYFIGf4I/fpmIqzHohf70TT+cYqAKSHBYV+uYjNLYQib6Ii/thPexeypw73pq7Z7CHvubnFQUiuqJ7lzXeV4146f5eHL76/TvTmKthS4FVFta6SlCOE6unR6q8HM52VSijavtoX3musxugCwhaHmBNOdUJcNIRCIey8QaOztPK05dDrOZhMQJgSST/BRaNrtY0/xRmJo+5TbQeyjyDuQdK2EoS51QMWzsT/LH6drQBgKd8RRHqjEhscfaV2CmdfuVO/liEdW82epMgFCGYtMetP/rs3bPkC90ULxPZSytaz7d5ux1dvSgrPHzX4306k/GP3d6EvOedy4IKAB53J7lebvrRI5pTVPZvd/RsSGGxUIwjf2Y8TF5nbC2d2D5Oauqfevn29veIRh8mq+AsJMnkvUFwVRN+6WDsZ+F82+AGaCKJFNQLYbRKtXW0zzi+wTsnLJNwlpevRf61SCxehSqeVfnc4TDsAGyRa9nSbR8= test@novit.io
--- a/test-initrd/init
+++ b/test-initrd/init
@ -0,0 +1 @@
 ../dist/init
--- a/test-initrd/modules.sqfs
+++ b/test-initrd/modules.sqfs
--- a/BIN
+++ b/BIN
--- a/tools/cpiocat/main.go
+++ b/tools/cpiocat/main.go
@ -0,0 +1,19 @@
 package main
 import (
 	"flag"
 	"fmt"
 	"os"
 	"novit.tech/direktil/pkg/cpiocat"
 )
 func main() {
 	flag.Parse()
 	err := cpiocat.Append(os.Stdout, os.Stdin, flag.Args())
 	if err != nil {
 		fmt.Fprintln(os.Stderr, err.Error())
 		os.Exit(1)
 	}
 }
--- a/tools/testconf/main.go
+++ b/tools/testconf/main.go
@ -0,0 +1,37 @@
 package main
 import (
 	"bytes"
 	"flag"
 	"fmt"
 	"os"
 	"gopkg.in/yaml.v3"
 	config "novit.tech/direktil/pkg/bootstrapconfig"
 )
 func main() {
 	flag.Parse()
 	for _, arg := range flag.Args() {
 		fmt.Println("testing", arg)
 		cfgBytes, err := os.ReadFile(arg)
 		fail(err)
 		cfg := config.Config{}
 		dec := yaml.NewDecoder(bytes.NewBuffer(cfgBytes))
 		dec.KnownFields(true)
 		err = dec.Decode(&cfg)
 		fail(err)
 	}
 }
 func fail(err error) {
 	if err != nil {
 		fmt.Fprintln(os.Stderr, err.Error())
 		os.Exit(1)
 	}
 }
--- a/tty.go
+++ b/tty.go
@ -0,0 +1,35 @@
 package main
 import (
 	"golang.org/x/sys/unix"
 )
 type tty struct {
 	fd      int
 	termios *unix.Termios
 }
 func newTTY(fd uintptr) *tty {
 	termios, _ := unix.IoctlGetTermios(int(fd), unix.TCGETS)
 	return &tty{int(fd), termios}
 }
 func (t *tty) EchoOff() {
 	if t.termios == nil {
 		return
 	}
 	newState := *t.termios
 	newState.Lflag &^= unix.ECHO
 	newState.Lflag |= unix.ICANON | unix.ISIG
 	newState.Iflag |= unix.ICRNL
 	unix.IoctlSetTermios(t.fd, unix.TCSETS, &newState)
 }
 func (t *tty) Restore() {
 	if t.termios == nil {
 		return
 	}
 	unix.IoctlSetTermios(t.fd, unix.TCSETS, t.termios)
 }
--- a/uname.go
+++ b/uname.go
@ -0,0 +1,20 @@
 package main
 import "syscall"
 func unameRelease() string {
 	uname := &syscall.Utsname{}
 	if err := syscall.Uname(uname); err != nil {
 		fatalf("failed to get kernel version: %v", err)
 	}
 	ba := make([]byte, 0, len(uname.Release))
 	for _, c := range uname.Release {
 		if c == 0 {
 			break
 		}
 		ba = append(ba, byte(c))
 	}
 	return string(ba)
 }
--- a/vpn.go
+++ b/vpn.go
@ -0,0 +1,137 @@
 package main
 import (
 	"net"
 	"os"
 	"path/filepath"
 	"github.com/rs/zerolog/log"
 	"golang.zx2c4.com/wireguard/wgctrl"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"novit.tech/direktil/pkg/config"
 )
 func setupVPN(vpn config.VPNDef, localGenDir string) {
 	log := log.With().Str("vpn", vpn.Name).Logger()
 	log.Info().Msg("VPN: setting up")
 	vpnDir := filepath.Join(localGenDir, vpn.Name)
 	os.MkdirAll(vpnDir, 0750)
 	logMsg := log.Info()
 	if vpn.ListenPort != nil {
 		logMsg.Int("ListenPort", *vpn.ListenPort)
 	}
 	// public/private key
 	keyFile := filepath.Join(vpnDir, "key")
 	keyBytes, err := os.ReadFile(keyFile)
 	if os.IsNotExist(err) {
 		key, err := wgtypes.GeneratePrivateKey()
 		if err != nil {
 			fatalf("failed to generate VPN key: %v", err)
 		}
 		keyBytes = []byte(key.String())
 		os.WriteFile(keyFile, keyBytes, 0600)
 	} else if err != nil {
 		fatalf("failed to read VPN key: %v", err)
 	}
 	key, err := wgtypes.ParseKey(string(keyBytes))
 	if err != nil {
 		fatalf("bad VPN key: %v", err)
 	}
 	logMsg.Stringer("PublicKey", key.PublicKey())
 	// pre-shared key
 	pskeyFile := filepath.Join(vpnDir, "pskey")
 	pskeyBytes, err := os.ReadFile(pskeyFile)
 	if os.IsNotExist(err) {
 		key, err := wgtypes.GenerateKey()
 		if err != nil {
 			fatalf("failed to generate VPN pre-shared key: %v", err)
 		}
 		pskeyBytes = []byte(key.String())
 		os.WriteFile(pskeyFile, pskeyBytes, 0600)
 	} else if err != nil {
 		fatalf("failed to read VPN pre-shared key: %v", err)
 	}
 	pskey, err := wgtypes.ParseKey(string(pskeyBytes))
 	if err != nil {
 		fatalf("bad VPN pre-shared key: %v", err)
 	}
 	{
 		keyStr := key.String()
 		logMsg.Str("PresharedKey", keyStr[0:4]+"..."+keyStr[len(keyStr)-4:])
 	}
 	// setup interface
 	cfg := wgtypes.Config{
 		PrivateKey: &key,
 		ListenPort: vpn.ListenPort,
 		Peers:      make([]wgtypes.PeerConfig, 0, len(vpn.Peers)),
 	}
 	for idx, vpnPeer := range vpn.Peers {
 		vpnPeer := vpnPeer
 		wgPeer := wgtypes.PeerConfig{
 			Endpoint:   vpnPeer.Endpoint,
 			AllowedIPs: make([]net.IPNet, 0, len(vpnPeer.AllowedIPs)),
 			PersistentKeepaliveInterval: &vpnPeer.KeepAlive,
 		}
 		if vpnPeer.WithPreSharedKey {
 			wgPeer.PresharedKey = &pskey
 		}
 		pubkey, err := wgtypes.ParseKey(vpnPeer.PublicKey)
 		if err != nil {
 			fatalf("bad VPN peer[%d] public key: %v", idx, err)
 		}
 		wgPeer.PublicKey = pubkey
 		for _, ipnetStr := range vpnPeer.AllowedIPs {
 			_, ipnet, err := net.ParseCIDR(ipnetStr)
 			if err != nil {
 				fatalf("bad IP/net: %q: %v", ipnetStr, err)
 			}
 			wgPeer.AllowedIPs = append(wgPeer.AllowedIPs, *ipnet)
 		}
 		cfg.Peers = append(cfg.Peers, wgPeer)
 	}
 	wg, err := wgctrl.New()
 	if err != nil {
 		fatalf("failed to setup WireGuard client: %v", err)
 	}
 	defer wg.Close()
 	log.Info().Strs("ips", vpn.IPs).Msg("VPN: creating interface")
 	run("ip", "link", "add", vpn.Name, "type", "wireguard")
 	for _, ip := range vpn.IPs {
 		run("ip", "addr", "add", ip, "dev", vpn.Name)
 	}
 	logMsg.Msg("VPN: configuring interface")
 	err = wg.ConfigureDevice(vpn.Name, cfg)
 	if err != nil {
 		fatalf("failed to setup VPN %s: %v", vpn.Name, err)
 	}
 	run("ip", "link", "set", vpn.Name, "up")
 }
Author	SHA1	Message	Date
Mikaël Cluseau	5b033bf5ab	wip	2024-06-28 21:54:17 +02:00
Mikaël Cluseau	57064a39b6	no real benefit vs go for now	2024-05-15 09:59:57 +11:00
Mikaël Cluseau	7c85855281	introduce rust	2024-04-29 12:54:25 +02:00
		`@ -0,0 +1 @@`
							ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDLo+mv+0GJViwFiK14bAw8j4HYFIGf4I/fpmIqzHohf70TT+cYqAKSHBYV+uYjNLYQib6Ii/thPexeypw73pq7Z7CHvubnFQUiuqJ7lzXeV4146f5eHL76/TvTmKthS4FVFta6SlCOE6unR6q8HM52VSijavtoX3musxugCwhaHmBNOdUJcNIRCIey8QaOztPK05dDrOZhMQJgSST/BRaNrtY0/xRmJo+5TbQeyjyDuQdK2EoS51QMWzsT/LH6drQBgKd8RRHqjEhscfaV2CmdfuVO/liEdW82epMgFCGYtMetP/rs3bPkC90ULxPZSytaz7d5ux1dvSgrPHzX4306k/GP3d6EvOedy4IKAB53J7lebvrRI5pTVPZvd/RsSGGxUIwjf2Y8TF5nbC2d2D5Oauqfevn29veIRh8mq+AsJMnkvUFwVRN+6WDsZ+F82+AGaCKJFNQLYbRKtXW0zzi+wTsnLJNwlpevRf61SCxehSqeVfnc4TDsAGyRa9nSbR8= test@novit.io