initial commit

Signed-off-by: Robert Günzler <r@gnzler.io>

12 files changed, 60 insertions, 0 deletions

diff --git a/bundles/containers/files/etc/containers/containers.conf.d/10-firewall-driver.conf b/bundles/containers/files/etc/containers/containers.conf.d/10-firewall-driver.conf
new file mode 100644
index 0000000..be33d99
--- /dev/null
+++ b/bundles/containers/files/etc/containers/containers.conf.d/10-firewall-driver.conf
@@ -0,0 +1,2 @@
+[network]
+firewall_driver = "nftables"
diff --git a/bundles/containers/files/etc/init.d/podman-healthcheck b/bundles/containers/files/etc/init.d/podman-healthcheck
new file mode 100644
index 0000000..8e12fa4
--- /dev/null
+++ b/bundles/containers/files/etc/init.d/podman-healthcheck
@@ -0,0 +1,11 @@
+#!/sbin/openrc-run
+
+description="Run podman healthchecks when containers start."
+
+supervisor=supervise-daemon
+command="/bin/podman-healthcheckd"
+
+depend()
+{
+        need localmount
+}
diff --git a/bundles/containers/files/etc/periodic/15min/podman-healthcheck b/bundles/containers/files/etc/periodic/15min/podman-healthcheck
new file mode 100755
index 0000000..7aa6d41
--- /dev/null
+++ b/bundles/containers/files/etc/periodic/15min/podman-healthcheck
@@ -0,0 +1,4 @@
+#!/bin/sh
+set -eu
+/bin/podman-healthcheck >/dev/null 2>&1
+exit 0
diff --git a/bundles/containers/files/etc/periodic/weekly/podman-prune b/bundles/containers/files/etc/periodic/weekly/podman-prune
new file mode 100755
index 0000000..5715b95
--- /dev/null
+++ b/bundles/containers/files/etc/periodic/weekly/podman-prune
@@ -0,0 +1,4 @@
+#!/bin/sh
+set -eu
+/usr/bin/podman system prune --force --all --volumes >/dev/null 2>&1
+exit 0
diff --git a/bundles/containers/files/etc/s6-rc/templates/container/+service-log/consumer-for b/bundles/containers/files/etc/s6-rc/templates/container/+service-log/consumer-for
new file mode 100644
index 0000000..83c1762
--- /dev/null
+++ b/bundles/containers/files/etc/s6-rc/templates/container/+service-log/consumer-for
@@ -0,0 +1 @@
++service-srv
diff --git a/bundles/containers/files/etc/s6-rc/templates/container/+service-log/notification-fd b/bundles/containers/files/etc/s6-rc/templates/container/+service-log/notification-fd
new file mode 100644
index 0000000..00750ed
--- /dev/null
+++ b/bundles/containers/files/etc/s6-rc/templates/container/+service-log/notification-fd
@@ -0,0 +1 @@
+3
diff --git a/bundles/containers/files/etc/s6-rc/templates/container/+service-log/pipeline-name b/bundles/containers/files/etc/s6-rc/templates/container/+service-log/pipeline-name
new file mode 100644
index 0000000..0db7d83
--- /dev/null
+++ b/bundles/containers/files/etc/s6-rc/templates/container/+service-log/pipeline-name
@@ -0,0 +1 @@
++service
diff --git a/bundles/containers/files/etc/s6-rc/templates/container/+service-log/run b/bundles/containers/files/etc/s6-rc/templates/container/+service-log/run
new file mode 100644
index 0000000..d558f3c
--- /dev/null
+++ b/bundles/containers/files/etc/s6-rc/templates/container/+service-log/run
@@ -0,0 +1,10 @@
+#!/bin/execlineb -P
+
+envfile -I /etc/s6-rc/system.conf
+importas -sCuD "/run/log" s6_log_dir s6_log_dir
+
+envfile -I /etc/s6-rc/+service.conf
+importas -sCuD "n3 s2000000 T" s6_log_directives s6_log_directives
+
+foreground { install -d ${s6_log_dir}/+service }
+exec -c s6-log -d3 -b -- ${s6_log_directives} ${s6_log_dir}/+service
diff --git a/bundles/containers/files/etc/s6-rc/templates/container/+service-log/type b/bundles/containers/files/etc/s6-rc/templates/container/+service-log/type
new file mode 100644
index 0000000..5883cff
--- /dev/null
+++ b/bundles/containers/files/etc/s6-rc/templates/container/+service-log/type
@@ -0,0 +1 @@
+longrun
diff --git a/bundles/containers/files/etc/s6-rc/templates/container/+service-srv/producer-for b/bundles/containers/files/etc/s6-rc/templates/container/+service-srv/producer-for
new file mode 100644
index 0000000..cba6eea
--- /dev/null
+++ b/bundles/containers/files/etc/s6-rc/templates/container/+service-srv/producer-for
@@ -0,0 +1 @@
++service-log
diff --git a/bundles/containers/files/etc/s6-rc/templates/container/+service-srv/run b/bundles/containers/files/etc/s6-rc/templates/container/+service-srv/run
new file mode 100755
index 0000000..3ca06e2
--- /dev/null
+++ b/bundles/containers/files/etc/s6-rc/templates/container/+service-srv/run
@@ -0,0 +1,23 @@
+#!/bin/execlineb -P
+
+# load location of deployments from system config
+envfile /etc/s6-rc/system.conf
+importas -iu deployments_dir deployments_dir
+
+# route all logs to stdout
+fdmove -c 2 1
+
+ifthenelse { eltest -e ${deployments_dir}/+service/secret.yaml }
+{
+	foreground { podman secret rm -i +service }
+	foreground { podman secret create +service ${deployments_dir}/+service/secret.yaml }
+}
+{
+	# noop
+}
+
+exec podman play kube \
+	--log-driver=passthrough \
+	--replace \
+	--wait \
+	${deployments_dir}/+service/kube.yaml
diff --git a/bundles/containers/files/etc/s6-rc/templates/container/+service-srv/type b/bundles/containers/files/etc/s6-rc/templates/container/+service-srv/type
new file mode 100644
index 0000000..5883cff
--- /dev/null
+++ b/bundles/containers/files/etc/s6-rc/templates/container/+service-srv/type
@@ -0,0 +1 @@
+longrun