# apkovl source tree

Declarative source for Mountaineer's apkovl. The builder
(`tools/build-apkovl.sh`) reads this directory plus `manifest.toml` and emits
a reproducible `mountaineer-<profile>-<version>.apkovl.tar.gz`.

Layout:

- `common/` — files included in every Mountaineer apkovl. Paths under
  `common/` mirror the paths-as-they-appear-in-`/` on the installed system.
- `server/` — Server-profile additions. (MVP: empty — Server config lives
  in `common/` because Server is the only MVP profile.)
- `sysadmin/` — Sysadmin-profile additions (graphical layer). Not yet
  populated; landed when the graphical track opens.
- `manifest.toml` — per-profile world file pointers, version metadata, any
  build-time substitutions.

## What lives here vs. what is generated

In the apkovl (this directory): identical-across-hosts material. Hardened
sshd config, nftables baseline, unbound and chrony configs, s6-rc service
tree, Caddy and unbound drop-in directory shapes, the canonical package
world.

**Not** in the apkovl, generated at install or first-boot time: SSH host
keys, machine-id, hostname, network configuration, operator
`authorized_keys`, the `zfs_arc_max` value (a placeholder file lives here;
the installer rewrites it), Nebula host certs, age host keys.

See `INSTALL.md` in the spec repo for the full split.

## Verifying changes

The builder is reproducible-best-effort: same source tree + same builder
version → same tarball bytes. To verify after editing:

```sh
./tools/build-apkovl.sh server > /tmp/a.apkovl.tar.gz
./tools/build-apkovl.sh server > /tmp/b.apkovl.tar.gz
sha256sum /tmp/[ab].apkovl.tar.gz
```

The two checksums should match. If they don't, the builder is leaking
non-determinism (timestamps, file ordering, uid/gid) and that is a bug.