image:
  distribution: centos

simplestream:
  distro_name: CentOS

source:
  downloader: centos-http
  url: https://mirror.math.princeton.edu/pub/centos/
  keys:
  # RPM-GPG-KEY-CentOS-SIG-AltArch-Arm32
  - |-
    -----BEGIN PGP PUBLIC KEY BLOCK-----

    mQENBFZYUi8BCADtrzJRu2Q3WGb5ExbmAB8CGWDAbVOTLZBA0bSj+i63LsUDdHkU
    sKpOGEaRPhagB27lkVUMOkcOIodYAbQZDbF788KDxeF4BopORbGXdo14OMEmoVq6
    rWPDoYs7Zv7G8blQa0IBE/BqdjYxyXZ0CSt+OLQ8r3G8ZB//SbZSTWWJcp2aN5oE
    79yB+tEfYznGzETZY8gzBOcKIk/ifYVNHHS65ldgOd3KQK7/vjWVc9LDOLcFcwXj
    YABSaUTsc3SkYKQ71SuxLssBWxSGaiZWBdN7s0FZFMDagWtKW1jQDlIhoRSULfpL
    m5Y306pEqNOdiNgAnipXPL4NzWv0zFVHoWaFABEBAAG0bUNlbnRPUyBBbHRBcmNo
    IFNJRyAtIEFybTMyIChodHRwczovL3dpa2kuY2VudG9zLm9yZy9TcGVjaWFsSW50
    ZXJlc3RHcm91cC9BbHRBcmNoL0FybTMyKSA8c2VjdXJpdHlAY2VudG9zLm9yZz6J
    ATkEEwECACMFAlZYUi8CGwMHCwkIBwMCAQYVCAIJCgsEFgIDAQIeAQIXgAAKCRDK
    /vEbYlBf5qvhB/9R8GXKz71u66U1VTvlDEh4tz7LzKNUBAtEH9fvox1Y8Mh1+VKK
    h7WtAWXsAkBvy7HeJ/GCUgvbgBjc7qpVjq/dipUTt+c51TLkoSa0msv4aJnA5azU
    7+9qD/qvnjEZVgstFGyTQ+m5v9N3KdAWyw2Xi1V820bmmj+vlVzGFbQo2UPps+7d
    bXZ9xI9Lmme/KD4tctjg9lnoCXmFIHGZfMVCoCyk42+p5EHlSZhYIRyIIhjpELlL
    gllMZz1Bdp+V51zndIm7Fe1d6jcSEjpPjRecIxfr5PBLAu3j/VbjBK90u8AKSKY9
    q5eFcyxxA1r2IdmItGVwz73gSz8WkJoh8QeN
    =72OZ
    -----END PGP PUBLIC KEY BLOCK-----

  # RPM-GPG-KEY-CentOS-SIG-AltArch-7-ppc64
  - |-
    -----BEGIN PGP PUBLIC KEY BLOCK-----

    mQENBFZYUWkBCADomwJs4B6eBhhHmkBxaTQBNg2SicdZZWfb9+VArLqZ+Qyez3YQ
    V1Bq2dBaDv2HIpTI8AHyT/KL/VuF1cdmGK8Q+uhqVxbFIP3giuaNHdV+DLx7suid
    aKP0MA/1fs5x4RDvRmHVm0bPRwUWK84aWyh2Ux1D9I8HWsmDamAVKUinocnWWG0K
    sNsV2uTuHeXYrJB0lex1nD1ColEa4CjmRxHMFYhoaFfw+mUUJ6rrN+zPdettxzbe
    HPBVhNWpfOcQdEIrPWwhMCJJYOnPQ7OpZBZ7088Bc7JVA4RHMo54MuuU2t1Th71H
    l7hcF9ueIKXqnsoAWFoG+p4UOy+OHU11THp3ABEBAAG0aUNlbnRPUyBBbHRBcmNo
    IFNJRyAtIFBvd2VyUEMgKGh0dHBzOi8vd2lraS5jZW50b3Mub3JnL1NwZWNpYWxJ
    bnRlcmVzdEdyb3VwL0FsdEFyY2gpIDxzZWN1cml0eUBjZW50b3Mub3JnPokBOQQT
    AQIAIwUCVlhRaQIbAwcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheAAAoJEKlju9v1
    M/T6HPsH/jLoRihPGZrdNjnVRSx/7hzQ+csdpgwRYSgJOeLTJAmemXYxiAQ0Wh+Z
    AiDA6hdUu973Y/aTZbOoX+trb6SaEquGLLxhFgC21whVYfRznxE3FQv02a/hjp/3
    a+i0GDT4ExSNuMxAqEewnWTymHS8bAsPGKuEMk9zElMZgeM6RrZUT+RL/ybjw5Mi
    H8mP/tEcR1jAsm30BSoWV0nKHMXLpuOVTQS2V3ngzMWoA/l/9t7CafhkpV7IGfnB
    HwQChc3L9fyZ/LwCo0WR1mHbzoPq+K4fwOnjdFEbgUSvfQ3+QiXXrfWt7C9IYAmA
    /6cxo9vG1NH6sQ3BJiEyJNaWj3q2c5U=
    =E+yp
    -----END PGP PUBLIC KEY BLOCK-----

  # RPM-GPG-KEY-CentOS-Official
  - |-
    -----BEGIN PGP PUBLIC KEY BLOCK-----

    mQINBFzMWxkBEADHrskpBgN9OphmhRkc7P/YrsAGSvvl7kfu+e9KAaU6f5MeAVyn
    rIoM43syyGkgFyWgjZM8/rur7EMPY2yt+2q/1ZfLVCRn9856JqTIq0XRpDUe4nKQ
    8BlA7wDVZoSDxUZkSuTIyExbDf0cpw89Tcf62Mxmi8jh74vRlPy1PgjWL5494b3X
    5fxDidH4bqPZyxTBqPrUFuo+EfUVEqiGF94Ppq6ZUvrBGOVo1V1+Ifm9CGEK597c
    aevcGc1RFlgxIgN84UpuDjPR9/zSndwJ7XsXYvZ6HXcKGagRKsfYDWGPkA5cOL/e
    f+yObOnC43yPUvpggQ4KaNJ6+SMTZOKikM8yciyBwLqwrjo8FlJgkv8Vfag/2UR7
    JINbyqHHoLUhQ2m6HXSwK4YjtwidF9EUkaBZWrrskYR3IRZLXlWqeOi/+ezYOW0m
    vufrkcvsh+TKlVVnuwmEPjJ8mwUSpsLdfPJo1DHsd8FS03SCKPaXFdD7ePfEjiYk
    nHpQaKE01aWVSLUiygn7F7rYemGqV9Vt7tBw5pz0vqSC72a5E3zFzIIuHx6aANry
    Gat3aqU3qtBXOrA/dPkX9cWE+UR5wo/A2UdKJZLlGhM2WRJ3ltmGT48V9CeS6N9Y
    m4CKdzvg7EWjlTlFrd/8WJ2KoqOE9leDPeXRPncubJfJ6LLIHyG09h9kKQARAQAB
    tDpDZW50T1MgKENlbnRPUyBPZmZpY2lhbCBTaWduaW5nIEtleSkgPHNlY3VyaXR5
    QGNlbnRvcy5vcmc+iQI3BBMBAgAhBQJczFsZAhsDBgsJCAcDAgYVCAIJCgsDFgIB
    Ah4BAheAAAoJEAW1VbOEg8ZdjOsP/2ygSxH9jqffOU9SKyJDlraL2gIutqZ3B8pl
    Gy/Qnb9QD1EJVb4ZxOEhcY2W9VJfIpnf3yBuAto7zvKe/G1nxH4Bt6WTJQCkUjcs
    N3qPWsx1VslsAEz7bXGiHym6Ay4xF28bQ9XYIokIQXd0T2rD3/lNGxNtORZ2bKjD
    vOzYzvh2idUIY1DgGWJ11gtHFIA9CvHcW+SMPEhkcKZJAO51ayFBqTSSpiorVwTq
    a0cB+cgmCQOI4/MY+kIvzoexfG7xhkUqe0wxmph9RQQxlTbNQDCdaxSgwbF2T+gw
    byaDvkS4xtR6Soj7BKjKAmcnf5fn4C5Or0KLUqMzBtDMbfQQihn62iZJN6ZZ/4dg
    q4HTqyVpyuzMXsFpJ9L/FqH2DJ4exGGpBv00ba/Zauy7GsqOc5PnNBsYaHCply0X
    407DRx51t9YwYI/ttValuehq9+gRJpOTTKp6AjZn/a5Yt3h6jDgpNfM/EyLFIY9z
    V6CXqQQ/8JRvaik/JsGCf+eeLZOw4koIjZGEAg04iuyNTjhx0e/QHEVcYAqNLhXG
    rCTTbCn3NSUO9qxEXC+K/1m1kaXoCGA0UWlVGZ1JSifbbMx0yxq/brpEZPUYm+32
    o8XfbocBWljFUJ+6aljTvZ3LQLKTSPW7TFO+GXycAOmCGhlXh2tlc6iTc41PACqy
    yy+mHmSv
    =kkH7
    -----END PGP PUBLIC KEY BLOCK-----

  variant: minimal

targets:
  lxc:
    create_message: |
      You just created a {{ image.description }} container.
    config:
    - type: all
      before: 5
      content: |-
        lxc.include = LXC_TEMPLATE_CONFIG/centos.common.conf

    - type: user
      before: 5
      content: |-
        lxc.include = LXC_TEMPLATE_CONFIG/centos.userns.conf

    - type: all
      after: 4
      content: |-
        lxc.include = LXC_TEMPLATE_CONFIG/common.conf

    - type: user
      after: 4
      content: |-
        lxc.include = LXC_TEMPLATE_CONFIG/userns.conf

    - type: all
      content: |-
        lxc.arch = {{ image.architecture_kernel }}

files:
- name: hostname
  path: /etc/hostname
  generator: hostname

- name: hosts
  path: /etc/hosts
  generator: hosts

- path: /etc/machine-id
  generator: dump

- path: /etc/fstab
  generator: dump

- path: /var/lib/dbus/machine-id
  generator: remove

- path: /etc/default/grub
  generator: dump
  content: |-
    # Set the recordfail timeout
    GRUB_RECORDFAIL_TIMEOUT=0
    # Do not wait on grub prompt
    GRUB_TIMEOUT=0
    # Set the default commandline
    GRUB_CMDLINE_LINUX_DEFAULT="${GRUB_CMDLINE_LINUX_DEFAULT} console=tty1 console=ttyS0"
    # Set the grub console type
    GRUB_TERMINAL=console
    # Disable os-prober
    GRUB_DISABLE_OS_PROBER=true
  types:
  - vm

- path: /etc/dracut.conf.d/lxd.conf
  generator: dump
  content: |-
    add_drivers+=" virtio_scsi virtio_console sd_mod virtio_blk "
  types:
  - vm
  releases:
  - 9-Stream

- generator: fstab
  types:
  - vm

- name: 86-nm-unmanaged.rules
  path: /etc/udev/rules.d/86-nm-unmanaged.rules
  generator: dump
  content: |-
    ENV{ID_NET_DRIVER}=="veth", ENV{NM_UNMANAGED}="0"
  releases:
  - 9-Stream

- name: network
  path: /etc/sysconfig/network
  generator: dump
  templated: true
  content: |-
    NETWORKING=yes
    HOSTNAME=LXC_NAME

- name: network.lxd
  path: /etc/sysconfig/network
  generator: template
  content: |-
    NETWORKING=yes
    HOSTNAME={{ container.name }}

- name: meta-data
  generator: cloud-init
  variants:
  - cloud

- name: network-config
  generator: cloud-init
  variants:
  - cloud
  releases:
  - 9-Stream

- name: user-data
  generator: cloud-init
  variants:
  - cloud

- name: vendor-data
  generator: cloud-init
  variants:
  - cloud

- generator: lxd-agent
  types:
  - vm

packages:
  manager: dnf
  update: true
  cleanup: true
  sets:
  - packages:
    - cronie
    - curl
    - dhclient
    - glibc-langpack-en
    - hostname
    - initscripts
    - openssh-clients
    - passwd
    - policycoreutils
    - rootfiles
    - sudo
    - rsyslog
    - vim-minimal
    action: install

  - packages:
    - cronie-anacron
    - NetworkManager
    action: install
    releases:
    - 9-Stream

  - packages:
    - glibc-locale-source
    architectures:
    - aarch64
    - i386
    - ppc64le
    - x86_64
    action: install

  - packages:
    - NetworkManager
    action: install
    types:
    - vm
    variants:
    - default

  - packages:
    - cloud-init
    - openssh-server
    - NetworkManager
    action: install
    variants:
    - cloud

  - packages:
    - cloud-utils-growpart
    - gdisk
    action: install
    types:
    - vm
    variants:
    - cloud

  - packages:
    - shim
    action: install
    types:
    - vm
    releases:
    - 9-Stream

  - packages:
    - kernel
    action: install
    types:
    - vm
    releases:
    - 9-Stream

  - packages:
    - grub2-efi-x64
    action: install
    types:
    - vm
    releases:
    - 9-Stream
    architectures:
    - x86_64

  - packages:
    - grub2-efi-aarch64
    action: install
    types:
    - vm
    architectures:
    - aarch64

actions:
- trigger: post-unpack
  action: |-
    #!/bin/sh
    set -eux

    # Note: This will be reverted at the end of the build

    # Disable fastestmirror plugin
    if [ -f /etc/yum/pluginconf.d/fastestmirror.conf ]; then
      sed -ri 's/enabled=1/enabled=0/g' /etc/yum/pluginconf.d/fastestmirror.conf
    fi

- trigger: post-unpack
  action: |-
    #!/bin/sh
    set -eux

    # Note: This will be reverted at the end of the build

    for repo in $(ls /etc/yum.repos.d/*.repo); do
      cp "${repo}" "${repo}.bak"
    done

    cat << "EOF" > /etc/yum.repos.d/centos.repo
    [baseos]
    name=CentOS Stream $releasever - BaseOS
    baseurl=https://mirror1.hs-esslingen.de/pub/Mirrors/centos-stream/$stream/BaseOS/$basearch/os/
    gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
    gpgcheck=1
    repo_gpgcheck=0
    metadata_expire=6h
    countme=1
    enabled=1

    [appstream]
    name=CentOS Stream $releasever - AppStream
    baseurl=https://mirror1.hs-esslingen.de/pub/Mirrors/centos-stream/$stream/AppStream/$basearch/os/
    metalink=https://mirrors.centos.org/metalink?repo=centos-appstream-$stream&arch=$basearch&protocol=https,http
    gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
    gpgcheck=1
    repo_gpgcheck=0
    metadata_expire=6h
    countme=1
    enabled=1
    EOF

    cat << "EOF" > /etc/yum.repos.d/centos-addons.repo
    [extras-common]
    name=CentOS Stream $releasever - Extras packages
    baseurl=https://mirror1.hs-esslingen.de/pub/Mirrors/centos-stream/SIGs/$stream/extras/$basearch/extras-common
    gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-Extras-SHA512
    gpgcheck=1
    repo_gpgcheck=0
    metadata_expire=6h
    countme=1
    enabled=1
    EOF
  releases:
  - 9-Stream

- trigger: post-unpack
  action: |-
    #!/bin/sh
    # Generate machine-id in order for the kernel stuff to be configured properly
    systemd-machine-id-setup
  types:
  - vm
  releases:
  - 9-Stream

- trigger: post-unpack
  action: |-
    #!/bin/sh
    # Remove security.selinux xattr.
    find / -xdev -exec setfattr -x security.selinux {} 2>/dev/null \;
  types:
  - container
  releases:
  - 9-Stream

- trigger: post-packages
  action: |-
    #!/bin/sh
    set -eux

    # Disable SELinux
    mkdir -p /selinux
    echo 0 > /selinux/enforce

    # Disable loginuid in PAM stack
    sed -i '/^session.*pam_loginuid.so/s/^session/# session/' /etc/pam.d/*

- trigger: post-packages
  architectures:
  - aarch64
  - i386
  - ppc64le
  - x86_64
  action: |-
    #!/bin/sh
    set -eux

    # Set default locale
    localedef -i en_US -f UTF-8 en_US.UTF-8
    echo 'LANG=en_US.utf8' > /etc/locale.conf

- trigger: post-files
  action: |-
    #!/bin/sh
    set -eux
    kver=$(ls /boot/initramfs-*.img | sed -r 's#.*initramfs-(.+)\.img#\1#')
    target=/boot/efi/EFI/centos/grub.cfg

    # Create grub.cfg file
    grub2-mkconfig -o "${target}"
    sed -i "s#root=[^ ]*#root=${LXD_IMAGEBUILDER_ROOT_UUID}#g" "${target}"

    # Update files in /boot/loader/entries/. `grubby` needs to be run after
    # `grub2-mkconfig` as the latter overwrites files in /boot/loader/entries/.
    grubby --update-kernel=/boot/vmlinuz-${kver} --args="root=${LXD_IMAGEBUILDER_ROOT_UUID} ro"

    # Regenerate initramfs
    dracut --kver "${kver}" -f
  types:
  - vm
  releases:
  - 9-Stream

- trigger: post-files
  action: |-
    #!/bin/sh
    set -eux

    systemctl enable NetworkManager.service
  types:
  - vm
  variants:
  - default

- trigger: post-files
  action: |-
    #!/bin/sh
    set -eux

    mkdir -p /etc/NetworkManager/conf.d/
    printf "[main]\ndhcp=dhclient" > /etc/NetworkManager/conf.d/dhcp-client.conf

    systemctl enable NetworkManager.service
  releases:
  - 9-Stream

- trigger: post-files
  action: |-
    #!/bin/sh
    set -eux

    # Restore repos
    for repo in $(ls /etc/yum.repos.d/*.bak); do
      mv "${repo}" ${repo%.*}
    done

    # Enable fastestmirror plugin
    if [ -f /etc/yum/pluginconf.d/fastestmirror.conf ]; then
      sed -ri 's/enabled=0/enabled=1/g' /etc/yum/pluginconf.d/fastestmirror.conf
    fi
