| 1 |
# apkovl source tree |
| 2 |
|
| 3 |
Declarative source for Mountaineer's apkovl. The builder |
| 4 |
(`tools/build-apkovl.sh`) reads this directory plus `manifest.toml` and emits |
| 5 |
a reproducible `mountaineer-<profile>-<version>.apkovl.tar.gz`. |
| 6 |
|
| 7 |
Layout: |
| 8 |
|
| 9 |
- `common/` — files included in every Mountaineer apkovl. Paths under |
| 10 |
`common/` mirror the paths-as-they-appear-in-`/` on the installed system. |
| 11 |
- `server/` — Server-profile additions. (MVP: empty — Server config lives |
| 12 |
in `common/` because Server is the only MVP profile.) |
| 13 |
- `sysadmin/` — Sysadmin-profile additions (graphical layer). Not yet |
| 14 |
populated; landed when the graphical track opens. |
| 15 |
- `manifest.toml` — per-profile world file pointers, version metadata, any |
| 16 |
build-time substitutions. |
| 17 |
|
| 18 |
## What lives here vs. what is generated |
| 19 |
|
| 20 |
In the apkovl (this directory): identical-across-hosts material. Hardened |
| 21 |
sshd config, nftables baseline, unbound and chrony configs, s6-rc service |
| 22 |
tree, Caddy and unbound drop-in directory shapes, the canonical package |
| 23 |
world. |
| 24 |
|
| 25 |
**Not** in the apkovl, generated at install or first-boot time: SSH host |
| 26 |
keys, machine-id, hostname, network configuration, operator |
| 27 |
`authorized_keys`, the `zfs_arc_max` value (a placeholder file lives here; |
| 28 |
the installer rewrites it), Nebula host certs, age host keys. |
| 29 |
|
| 30 |
See `INSTALL.md` in the spec repo for the full split. |
| 31 |
|
| 32 |
## Verifying changes |
| 33 |
|
| 34 |
The builder is reproducible-best-effort: same source tree + same builder |
| 35 |
version → same tarball bytes. To verify after editing: |
| 36 |
|
| 37 |
```sh |
| 38 |
./tools/build-apkovl.sh server > /tmp/a.apkovl.tar.gz |
| 39 |
./tools/build-apkovl.sh server > /tmp/b.apkovl.tar.gz |
| 40 |
sha256sum /tmp/[ab].apkovl.tar.gz |
| 41 |
``` |
| 42 |
|
| 43 |
The two checksums should match. If they don't, the builder is leaking |
| 44 |
non-determinism (timestamps, file ordering, uid/gid) and that is a bug. |
| 45 |
|