diff options
| -rw-r--r-- | prompts/skills/f3s/SKILL.md | 6 | ||||
| -rw-r--r-- | prompts/skills/f3s/references/bootstrap-netbsd-pi.md | 4 | ||||
| -rw-r--r-- | prompts/skills/f3s/references/dtail.md | 6 | ||||
| -rw-r--r-- | prompts/skills/pkgrepo/SKILL.md | 9 | ||||
| -rw-r--r-- | prompts/skills/pkgrepo/references/client-setup.md | 18 | ||||
| -rw-r--r-- | prompts/skills/pkgrepo/references/dtail-package.md | 63 | ||||
| -rw-r--r-- | prompts/skills/pkgrepo/references/packaging-workflow.md | 25 | ||||
| -rw-r--r-- | prompts/skills/pkgrepo/references/repo-architecture.md | 11 |
8 files changed, 125 insertions, 17 deletions
diff --git a/prompts/skills/f3s/SKILL.md b/prompts/skills/f3s/SKILL.md index 9c5e07e..a9ec1a5 100644 --- a/prompts/skills/f3s/SKILL.md +++ b/prompts/skills/f3s/SKILL.md @@ -24,7 +24,7 @@ Detailed reference documentation is in the `references/` subfolder: - [Rocky Linux VMs](references/rocky-linux-vms.md) — Bhyve, vm-bhyve, VM config, NVMe disk fix; FreeBSD VM on f3 (migrated from f0) - [f3 Rocky VM](references/f3-rocky-vm.md) — Plain Rocky Linux 9 VM on f3 (`rocky`, `192.168.1.123`), autostart policy, root SSH - [Bootstrap Rocky bhyve VM](references/bootstrap-rocky-bhyve.md) — Runbook for creating a new plain Rocky Linux bhyve guest with unattended kickstart -- [NetBSD Pi Setup](references/bootstrap-netbsd-pi.md) — How services are installed on `pi0`/`pi1` (NetBSD): doas/pkgin bootstrap, WireGuard via userspace `wireguard-go` (no native `wg(4)` on this platform), bozohttpd (`-X` for dir-listing parity, vhost symlinks for every real routed hostname), uptimed built from source, npf firewall, content-sync setup. +- [NetBSD Pi Setup](references/bootstrap-netbsd-pi.md) — How services are installed on `pi0`/`pi1` (NetBSD): doas/pkgin bootstrap, WireGuard via userspace `wireguard-go` (no native `wg(4)` on this platform), bozohttpd (`-X` for dir-listing parity, vhost symlinks for every real routed hostname), uptimed built from source, npf firewall, content-sync setup. dserver (DTail) is installed from the custom pkgrepo — see the `pkgrepo` skill's `dtail-package.md`. - [WireGuard Mesh](references/wireguard.md) — Mesh topology, IP assignments, peer configs - [Storage](references/storage.md) — index into `references/storage/`: ZFS (zdata), zrepl, CARP, NFS over stunnel, nfs-mount-monitor, troubleshooting (incl. thermal), backups & local-path - [r-node Deploy (Rex)](references/r-node-deploy.md) — reusable Rex rollout to **r0/r1/r2** (`f3s/r-nodes/Rexfile`, task `nfs_mount_monitor`): root SSH, `parallelism 3`, idempotent `file`/`on_change` reload, verify with `systemctl`/`journalctl` @@ -83,7 +83,7 @@ The plain Rocky Linux VM on f3 (`rocky`, `192.168.1.123`) is documented in the s Current role split: -- `pi0` and `pi1` serve static `f3s.buetow.org`/`snonux.foo` content behind OpenBSD `relayd` over WireGuard. WireGuard peers are `blowfish`, `fishfinger`, **and `rocky`** (not gateway-only to just the two frontends, despite older docs here). All rc.d services (`wireguard`, `bozohttpd`, `uptimed`, `npf`) and both crontabs are enabled via `rc.conf` and come back automatically on reboot. +- `pi0` and `pi1` serve static `f3s.buetow.org`/`snonux.foo` content behind OpenBSD `relayd` over WireGuard. WireGuard peers are `blowfish`, `fishfinger`, **and `rocky`** (not gateway-only to just the two frontends, despite older docs here). All rc.d services (`wireguard`, `bozohttpd`, `uptimed`, `npf`, `dserver`) and both crontabs are enabled via `rc.conf` and come back automatically on reboot. - `pi2` and `pi3` run **Pi-hole** in Docker (`network_mode: host`, `~/pihole` on each host). Tracked dnsmasq LAN wildcard: **`f3s/pihole/docker-pi/`** in the conf repo; details in [references/pihole-pi.md](references/pihole-pi.md). ### Webserver Configuration @@ -110,7 +110,7 @@ $HTTP["host"] =~ "^(www\.)?snonux\.foo$" { ## DTail (dserver) -Distributed log access over SSH on port **2222** (not sshd’s 22). **pi2–pi3**: cross-build **linux/arm64** + `DTAIL_NO_ZSTD=yes`. **pi0**/**pi1** (NetBSD) do **not** run DTail — deliberately deferred on both; would need an untested `GOOS=netbsd GOARCH=arm64` cross-build and an `rc.d` script in place of the systemd unit. **r0–r2** (k3s Rocky VMs): **linux/amd64** only; install as **root** over SSH; **`dtail.json` must list `root` in `Server.Permissions.Users`**; mirror **`/root/.ssh/authorized_keys`** → `/var/run/dserver/cache/root.authorized_keys` because the key-cache script only walks `/home/*`. **firewalld**: open **2222/tcp**. Rebuild clients from current **dtail** `master` if the “trust these hosts” prompt still hangs (stdout pause bug fixed upstream). +Distributed log access over SSH on port **2222** (not sshd’s 22). **pi2–pi3**: cross-build **linux/arm64** + `DTAIL_NO_ZSTD=yes`. **pi0**/**pi1** (NetBSD): run dserver since 2026-07-09 from the custom pkgrepo (`GOOS=netbsd GOARCH=arm64 CGO_ENABLED=0 -tags nozstd` cross-build, NetBSD `rc.d` script, npf port **2222** rule; see the `pkgrepo` skill's `dtail-package.md`). **r0–r2** (k3s Rocky VMs): **linux/amd64** only; install as **root** over SSH; **`dtail.json` must list `root` in `Server.Permissions.Users`**; mirror **`/root/.ssh/authorized_keys`** → `/var/run/dserver/cache/root.authorized_keys` because the key-cache script only walks `/home/*`. **firewalld**: open **2222/tcp**. Rebuild clients from current **dtail** `master` if the “trust these hosts” prompt still hangs (stdout pause bug fixed upstream). Details: [references/dtail.md](references/dtail.md) (section **dserver on r0, r1, r2**). diff --git a/prompts/skills/f3s/references/bootstrap-netbsd-pi.md b/prompts/skills/f3s/references/bootstrap-netbsd-pi.md index 673c2c9..e16e86f 100644 --- a/prompts/skills/f3s/references/bootstrap-netbsd-pi.md +++ b/prompts/skills/f3s/references/bootstrap-netbsd-pi.md @@ -248,6 +248,7 @@ group "external" on $ext_if { pass stateful out final all pass stateful in final family inet4 proto tcp to $ext_if port 22 pass stateful in final family inet4 proto tcp to $ext_if port 80 + pass stateful in final family inet4 proto tcp to $ext_if port 2222 pass stateful in final family inet4 proto icmp all } @@ -263,6 +264,9 @@ group default { } ``` +Port 2222 is dserver (DTail) — see the `pkgrepo` skill's `dtail-package.md` +for the install steps. + `family inet4`/`inet6` must be explicit on multi-family interfaces or `npfctl validate` fails with "address family mismatch". `proto <name>` must be followed by `all` or a `from`/`to` clause, or it's a syntax error — e.g. diff --git a/prompts/skills/f3s/references/dtail.md b/prompts/skills/f3s/references/dtail.md index 9e77f0b..c7963a5 100644 --- a/prompts/skills/f3s/references/dtail.md +++ b/prompts/skills/f3s/references/dtail.md @@ -8,15 +8,17 @@ Upstream install and examples live in the repo: `doc/installation.md`, `examples | Hosts | OS / arch | dserver binary | Typical SSH user | |-------|-----------|----------------|------------------| +| **pi0–pi1** | NetBSD 10.1 **aarch64** (Raspberry Pi 3, see `bootstrap-netbsd-pi.md`) | Cross-build **netbsd/arm64**, `nozstd`; installed via `pkg_add` from the custom pkgrepo | `paul@piN.lan.buetow.org` | | **pi2–pi3** | Rocky Linux 9 **aarch64** (Raspberry Pi 3) | Cross-build **linux/arm64**, `nozstd` | `paul@piN.lan.buetow.org` | | **r0–r2** | Rocky Linux 9 **x86_64** (bhyve VMs, k3s nodes) | Cross-build **linux/amd64**, `nozstd` | Often `root@rN.lan.buetow.org` (see [Rocky Linux VMs](rocky-linux-vms.md)); add `root` (and `paul` if present) to **Server.Permissions.Users** in `dtail.json` | | **blowfish, fishfinger** | OpenBSD 7.8 **amd64** | Native OpenBSD package build | `rex@blowfish.buetow.org`, `rex@fishfinger.buetow.org` | -`pi0`/`pi1` run **NetBSD** (see `bootstrap-netbsd-pi.md`) and do **not** run DTail — would need an untested `GOOS=netbsd GOARCH=arm64` cross-build and an `rc.d` script. +`pi0`/`pi1` (NetBSD) run dserver since 2026-07-09 from the `dtail` package in the custom pkgrepo — build pipeline (`make dtail-netbsd`), install steps, rc.d/npf details, and gotchas live in the `pkgrepo` skill's `dtail-package.md`. **Key cache filenames matter:** `examples/update_key_cache.sh.example` only scans `/home/*` and writes `/var/run/dserver/cache/USER.authorized_keys`. In this lab, DTail auth worked only after writing the exact cache filename for the login user: - **r0–r2**: `root.authorized_keys` +- **pi0–pi1**: `paul.authorized_keys` (NetBSD rc.d `start_precmd` repopulates it on every start — `/var/run` is volatile) - **pi2–pi3**: `paul.authorized_keys` - **blowfish, fishfinger**: `rex.authorized_keys` @@ -158,7 +160,7 @@ CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -tags nozstd -o dserver-linux-amd ## Installation checklist (each server) -Do this on **each** target (pi2–pi3 and/or r0–r2 — not pi0/pi1, which are NetBSD and don't run DTail). Adjust **user** if you are not using `paul` on the node. +Do this on **each** Linux target (pi2–pi3 and/or r0–r2). pi0/pi1 are NetBSD and install the `dtail` package from the custom pkgrepo instead — see the `pkgrepo` skill's `dtail-package.md`. Adjust **user** if you are not using `paul` on the node. 1. **Binary**: `/usr/local/bin/dserver`, mode `0755`, owned by root. 2. **OS user**: `dserver` system account (`useradd -r -d /var/lib/dserver -s /sbin/nologin -U dserver`). diff --git a/prompts/skills/pkgrepo/SKILL.md b/prompts/skills/pkgrepo/SKILL.md index aea0294..5d3732b 100644 --- a/prompts/skills/pkgrepo/SKILL.md +++ b/prompts/skills/pkgrepo/SKILL.md @@ -1,6 +1,6 @@ --- name: pkgrepo -description: Reference skill for the homelab package repositories behind pkgrepo.f3s.buetow.org. Covers FreeBSD pkg, OpenBSD pkg_add, Rocky Linux dnf repos, PV layout, nginx/ArgoCD wiring, DTail package publishing, and client repo configuration. Use when publishing packages, troubleshooting repository access or metadata, or deciding how packages should be installed from the custom repo. +description: Reference skill for the homelab package repositories behind pkgrepo.f3s.buetow.org. Covers FreeBSD pkg, OpenBSD pkg_add, NetBSD pkg_add, Rocky Linux dnf repos, PV layout, nginx/ArgoCD wiring, DTail package publishing, and client repo configuration. Use when publishing packages, troubleshooting repository access or metadata, or deciding how packages should be installed from the custom repo. --- # Package Repo Reference @@ -11,13 +11,13 @@ Use this skill when the task is specifically about the custom package repositori - Publishing or updating packages in `pkgrepo.f3s.buetow.org` - Troubleshooting repo layout, metadata, or HTTP exposure -- Configuring FreeBSD, OpenBSD, or Rocky Linux clients to install from the custom repo +- Configuring FreeBSD, OpenBSD, NetBSD, or Rocky Linux clients to install from the custom repo - Working on DTail package publishing and installation through the repo ## Reference Files - [Repo Architecture](references/repo-architecture.md) — nginx/k3s setup, PV directory structure, SSH access, stale NFS handle fix, per-OS repo notes -- [Client Setup](references/client-setup.md) — per-OS client repo configuration (FreeBSD, OpenBSD, Rocky Linux), new-host setup, package signing +- [Client Setup](references/client-setup.md) — per-OS client repo configuration (FreeBSD, OpenBSD, NetBSD, Rocky Linux), new-host setup, package signing - [Packaging Workflow](references/packaging-workflow.md) — Makefile workflow for single-binary Go packages, CGo packages, manual packaging reference - [DTail Package](references/dtail-package.md) — multi-binary DTail package for all platforms, install/update steps, gotchas, client usage, verification - [OpenBSD Build VM](references/openbsd-build-vm.md) — QEMU/KVM build VM for native CGo compilation, day-to-day use, installer notes @@ -31,6 +31,7 @@ Use `f3s` alongside this skill when the task depends on broader host-role or clu - `f0` as the FreeBSD NFS/PV host for `/data/nfs/k3svolumes/pkgrepo/` - `fishfinger` and `blowfish` as the OpenBSD frontend hosts - `r0-r2` as Rocky Linux x86_64 bhyve VMs -- `pi2-pi3` as Rocky Linux aarch64 Raspberry Pi nodes (`pi0`/`pi1` run NetBSD — see the `f3s` skill's `bootstrap-netbsd-pi.md` — and are not Rocky package-repo clients) +- `pi2-pi3` as Rocky Linux aarch64 Raspberry Pi nodes +- `pi0`/`pi1` as NetBSD aarch64 Raspberry Pi nodes (see the `f3s` skill's `bootstrap-netbsd-pi.md`) — NetBSD repo clients and the native NetBSD package build host (`pi0`) - `earth` as the Fedora laptop used for package publication and verification - `f0-f3` as FreeBSD hosts diff --git a/prompts/skills/pkgrepo/references/client-setup.md b/prompts/skills/pkgrepo/references/client-setup.md index 1a56512..2b06e66 100644 --- a/prompts/skills/pkgrepo/references/client-setup.md +++ b/prompts/skills/pkgrepo/references/client-setup.md @@ -83,9 +83,25 @@ OpenBSD packages are signed with `signify(1)` via `pkg_sign`: - Signing happens automatically during `make pkg-openbsd` / `make pkg` - `pkg_add` verifies the signature — no `-D unsigned` needed +## NetBSD (pi0, pi1) + +No persistent repo config needed — install/update straight from the package URL (repo is unsigned): + +```sh +export PATH=/usr/sbin:$PATH # pkg_* live in /usr/sbin, not in the default non-interactive PATH +doas pkg_add https://pkgrepo.f3s.buetow.org/netbsd/10.1/packages/aarch64/dtail-4.3.2ng.tgz # first install +doas pkg_add -u https://pkgrepo.f3s.buetow.org/netbsd/10.1/packages/aarch64/dtail-4.3.2ng.tgz # update to newer version +``` + +Notes: +- Same-version reinstall: `pkg_add -u` skips it — `doas pkg_delete dtail` first, then `pkg_add` again +- `pkg_summary.gz` is published alongside the packages, so the repo URL could also be added to `/usr/pkg/etc/pkgin/repositories.conf` for pkgin; today plain `pkg_add` is used +- Version in the URL path must match the host OS release (currently 10.1) and the arch is `aarch64` (`uname -p`) +- pkgsrc packages from cdn.netbsd.org still install normally via pkgin — the custom repo lives under a different prefix (`/` with files in `/usr/local`, `/etc`) and doesn't conflict + ## Rocky Linux (r0–r2, pi2–pi3) -`pi0`/`pi1` run NetBSD (see `f3s` skill's `bootstrap-netbsd-pi.md`) and are not Rocky clients of this repo. +`pi0`/`pi1` run NetBSD (see above and the `f3s` skill's `bootstrap-netbsd-pi.md`) and are not Rocky clients of this repo. Architecture-specific repo URLs: - `https://pkgrepo.f3s.buetow.org/rockylinux/9/x86_64/` (r0–r2) diff --git a/prompts/skills/pkgrepo/references/dtail-package.md b/prompts/skills/pkgrepo/references/dtail-package.md index 468724d..c17d425 100644 --- a/prompts/skills/pkgrepo/references/dtail-package.md +++ b/prompts/skills/pkgrepo/references/dtail-package.md @@ -8,6 +8,7 @@ DTail is a multi-binary package (6 binaries + config + service script). There ar cd ~/git/conf/packages make dtail-openbsd # OpenBSD: native build on QEMU/KVM VM (CGo/zstd supported) make dtail-freebsd # FreeBSD: cross-compiled on Linux (CGO_ENABLED=0, nozstd — .zst logs unsupported) +make dtail-netbsd # NetBSD/aarch64: cross-compiled on Linux (CGO_ENABLED=0, nozstd), packaged natively on pi0 make dtail-rocky # Rocky Linux: x86_64 + aarch64 RPMs + repodata ``` @@ -31,11 +32,26 @@ make dtail-rocky # Rocky Linux: x86_64 + aarch64 RPMs + repodata | `/usr/local/etc/rc.d/dserver` | `frontends/etc/rc.d/dserver-freebsd.tpl` | | `/usr/local/bin/dserver-update-key-cache.sh` | `frontends/scripts/dserver-update-key-cache-freebsd.sh.tpl` (sh) | -**FreeBSD config note:** `dtail-freebsd.json.tpl` uses **absolute paths** for `CacheDir` and `HostKeyFile` (`/var/run/dserver/cache/...`). FreeBSD's `daemon(8)` resets CWD to `/`, so the relative `"cache"` in the standard template resolves to `/cache` — silently breaking key lookup. +**FreeBSD config note:** `dtail-freebsd.json.tpl` uses **absolute paths** for `CacheDir` and `HostKeyFile` (`/var/run/dserver/cache/...`). FreeBSD's `daemon(8)` resets CWD to `/`, so the relative `"cache"` in the standard template resolves to `/cache` — silently breaking key lookup. (Since dtail commit `fec2f9d`, absolute `CacheDir` paths also resolve independently of the CWD dserver was started from — before that fix, a manual service restart from a home directory broke public key auth.) -### Rocky Linux (r0–r2 amd64, pi2–pi3 aarch64) +### NetBSD (pi0, pi1 — aarch64) + +Package name is `dtail-4.3.2ng` — NetBSD versions must not contain dashes, so `-ng` becomes `ng`. + +| File | Source template | +|------|----------------| +| `/usr/local/bin/dserver`, `dcat`, `dgrep`, `dmap`, `dtail`, `dtailhealth` | cross-compiled `GOOS=netbsd GOARCH=arm64 CGO_ENABLED=0 -tags nozstd` | +| `/etc/dserver/dtail.json` | `frontends/etc/dserver/dtail-netbsd.json.tpl` (absolute `CacheDir`/`HostKeyFile` paths, like FreeBSD) | +| `/etc/rc.d/dserver` | `frontends/etc/rc.d/dserver-netbsd.tpl` | +| `/usr/local/bin/dserver-update-key-cache.sh` | `frontends/scripts/dserver-update-key-cache-netbsd.sh.tpl` (sh) | -`pi0`/`pi1` run NetBSD (see `f3s` skill's `bootstrap-netbsd-pi.md`) and do **not** run DTail — see the NetBSD client note below. +NetBSD notes: +- `pkg_create` runs natively on pi0 (Makefile ships binaries + templates there via SSH and runs `packages/scripts/pkg-dtail-netbsd.sh`); `pkg_summary.gz` for pkgin is generated and uploaded alongside +- NetBSD has no `daemon(8)` and dserver doesn't daemonize — the rc.d script backgrounds it via `command_args="... &"` and runs it as user `dserver` (`dserver_user`) +- `/var/run` is volatile — the rc.d `start_precmd` recreates `/var/run/dserver/cache` and re-runs the key-cache helper on every start; a daily root cron entry (`dserver-update-key-cache.sh`) keeps it fresh +- npf firewall needs `pass stateful in final family inet4 proto tcp to $ext_if port 2222` in the `"external"` group of `/etc/npf.conf` + +### Rocky Linux (r0–r2 amd64, pi2–pi3 aarch64) | File | |------| @@ -91,6 +107,37 @@ doas chmod 755 /usr/local/etc/periodic/daily/200.dserver-update-key-cache - `pkg install -fy` replaces `/usr/local/etc/dserver/dtail.json` with the package version; local customisations are lost - Avoid inline one-liners with `||`, `!`, or multi-quote strings over SSH to FreeBSD (csh) — pipe a script to `doas /bin/sh` instead or use separate SSH commands +### NetBSD (manual, pi0–pi1) + +```sh +# All as root via doas; pkg_* tools live in /usr/sbin (not in non-interactive SSH PATH) +export PATH=/usr/sbin:$PATH + +# Service group + user (once per host) +doas groupadd dserver +doas useradd -g dserver -d /var/run/dserver -s /sbin/nologin -c "DTail server" dserver + +# Install / update from the custom repo +doas pkg_add https://pkgrepo.f3s.buetow.org/netbsd/10.1/packages/aarch64/dtail-4.3.2ng.tgz +doas pkg_add -u https://pkgrepo.f3s.buetow.org/netbsd/10.1/packages/aarch64/dtail-4.3.2ng.tgz # newer version +# Same-version reinstall: pkg_delete dtail first, then pkg_add + +# Enable and start (rc.d script ships in the package) +doas sh -c 'echo dserver=YES >> /etc/rc.conf' # once per host +doas /etc/rc.d/dserver start + +# Open port 2222 (once per host): add to the "external" group in /etc/npf.conf: +# pass stateful in final family inet4 proto tcp to $ext_if port 2222 +# then: doas npfctl validate && doas npfctl reload + +# Daily key-cache refresh (once per host; rc.d start also refreshes it) +# root crontab entry: 30 4 * * * /usr/local/bin/dserver-update-key-cache.sh >/dev/null 2>&1 +``` + +**NetBSD gotchas:** +- The key cache lives in volatile `/var/run` but the rc.d `start_precmd` recreates and repopulates it on every start — no manual re-run needed after restart or reboot +- `dserver -version` panics when run as root (`Not allowed to run as UID 0`) — check with `su -m dserver -c '/usr/local/bin/dserver -version'` or as a normal user + ### Rocky Linux (dnf) ```sh @@ -126,10 +173,15 @@ dcat --plain --noColor --trustAllHosts --user paul \ dcat --plain --noColor --trustAllHosts --user root \ --servers r0.lan.buetow.org,r1.lan.buetow.org,r2.lan.buetow.org --files /etc/fstab -# Raspberry Pis (pi2–pi3, user paul) -- pi0/pi1 run NetBSD and don't run DTail +# Raspberry Pis Rocky (pi2–pi3, user paul) dcat --plain --noColor --trustAllHosts --user paul \ --servers pi2.lan.buetow.org,pi3.lan.buetow.org \ --files /etc/fstab + +# Raspberry Pis NetBSD (pi0–pi1, user paul) +dcat --plain --noColor --trustAllHosts --user paul \ + --servers pi0.lan.buetow.org,pi1.lan.buetow.org \ + --files /etc/fstab ``` ## Verification State @@ -139,4 +191,5 @@ dcat --plain --noColor --trustAllHosts --user paul \ | 2026-04-19 | FreeBSD f0–f3 | `dtail-4.3.2-ng` installed, dserver running under `daemon(8)`, `dcat /etc/fstab` ✓ (`--user paul`) | | 2026-04-19 | OpenBSD blowfish, fishfinger | `dtail-4.3.2-ng` current, `dcat /etc/fstab` ✓ (`--user rex`) | | 2026-04-19 | Rocky r0–r2 | `dtail-4.3.2-ng` current, dserver running, `dcat /etc/fstab` ✓ (`--user root`) | -| 2026-04-19 | Rocky pi0–pi3 | `dtail-4.3.2-ng` current, dserver running, `dcat /etc/fstab` ✓ (`--user paul`) | +| 2026-04-19 | Rocky pi0–pi3 | `dtail-4.3.2-ng` current, dserver running, `dcat /etc/fstab` ✓ (`--user paul`) — pi0/pi1 since re-imaged to NetBSD | +| 2026-07-09 | NetBSD pi0–pi1 | `dtail-4.3.2ng` installed (first NetBSD deployment), dserver running as `dserver` on 2222, `dcat /etc/fstab` ✓ (`--user paul`) | diff --git a/prompts/skills/pkgrepo/references/packaging-workflow.md b/prompts/skills/pkgrepo/references/packaging-workflow.md index 9c7a262..d2b7388 100644 --- a/prompts/skills/pkgrepo/references/packaging-workflow.md +++ b/prompts/skills/pkgrepo/references/packaging-workflow.md @@ -57,6 +57,7 @@ Cross-compilation from Linux fails for CGo (e.g. packages with DataDog/zstd). Us - **OpenBSD**: native build on the local QEMU/KVM build VM (see [openbsd-build-vm.md](openbsd-build-vm.md)) - **FreeBSD**: cross-compile with `CGO_ENABLED=0 -tags nozstd` — disables zstd support but allows static cross-compile +- **NetBSD**: cross-compile with `CGO_ENABLED=0 GOOS=netbsd GOARCH=arm64 -tags nozstd`; packaging (`pkg_create`) runs natively on pi0 because `+BUILD_INFO` must match the target host - **Rocky Linux**: built locally on earth (x86_64) and on pi2 (aarch64 via rpmbuild) ## Manual Packaging Reference @@ -84,6 +85,30 @@ scp package.tgz f0.lan.buetow.org:/tmp/ ssh -p 22 f0.lan.buetow.org "doas cp /tmp/package.tgz /data/nfs/k3svolumes/pkgrepo/openbsd/7.8/packages/amd64/" ``` +### NetBSD (on pi0) + +```sh +# pkg_* tools are in /usr/sbin (not in the non-interactive SSH PATH) +# Files staged under stagedir (-p), installed relative to / (-I); +# @owner root / @group wheel in the packing list keeps installed files root-owned. +/usr/sbin/pkg_create \ + -B build-info \ + -c commentfile \ + -d descfile \ + -f packing-list \ + -I / \ + -p stagedir \ + output/package-name-1.0.tgz +# pkg_summary.gz enables pkgin (pkg_add alone doesn't need it) +/usr/sbin/pkg_info -X output/*.tgz | gzip -9 > output/pkg_summary.gz +# Copy to PV via f0 +scp -P 22 output/* f0.lan.buetow.org:/tmp/ +ssh -p 22 f0.lan.buetow.org "doas cp /tmp/package-name-1.0.tgz /tmp/pkg_summary.gz /data/nfs/k3svolumes/pkgrepo/netbsd/10.1/packages/aarch64/" +``` + +NetBSD package versions must not contain dashes (the last dash separates the +package name from the version), so DTail's `4.3.2-ng` becomes `4.3.2ng`. + ## Install/Update on Frontends via Rex ```sh diff --git a/prompts/skills/pkgrepo/references/repo-architecture.md b/prompts/skills/pkgrepo/references/repo-architecture.md index 0d36fa6..ae42e1f 100644 --- a/prompts/skills/pkgrepo/references/repo-architecture.md +++ b/prompts/skills/pkgrepo/references/repo-architecture.md @@ -1,12 +1,12 @@ # Repo Architecture -Custom FreeBSD, OpenBSD, and Rocky Linux package repository served from k3s. +Custom FreeBSD, OpenBSD, NetBSD, and Rocky Linux package repository served from k3s. ## Overview - **nginx pod** in k3s `infra` namespace serves static files from a PV - URL: `https://pkgrepo.f3s.buetow.org` -- Path prefixes: `/freebsd/`, `/openbsd/`, `/rockylinux/` +- Path prefixes: `/freebsd/`, `/openbsd/`, `/netbsd/`, `/rockylinux/` - TLS terminated by OpenBSD relayd on the internet gateways (not in the pod) - DNS, ACME certs, httpd fallback, and relayd routing auto-generated from `@f3s_hosts` in `frontends/Rexfile` - HTTP always redirected to HTTPS by the OpenBSD gateways — client URLs must use `https://` @@ -26,6 +26,10 @@ Custom FreeBSD, OpenBSD, and Rocky Linux package repository served from k3s. 7.8/ packages/ amd64/ # .tgz files (signify-signed) + netbsd/ + 10.1/ + packages/ + aarch64/ # .tgz files (unsigned) + pkg_summary.gz for pkgin rockylinux/ 9/ x86_64/ # .rpm files + repodata/ @@ -46,6 +50,7 @@ Custom FreeBSD, OpenBSD, and Rocky Linux package repository served from k3s. | `packages/scripts/pkg-openbsd.sh` | Runs on fishfinger via SSH: `pkg_create` + signify signing | | `packages/scripts/pkg-dtail-openbsd.sh` | DTail multi-binary OpenBSD packaging | | `packages/scripts/pkg-dtail-freebsd.sh` | DTail multi-binary FreeBSD packaging | +| `packages/scripts/pkg-dtail-netbsd.sh` | DTail multi-binary NetBSD packaging (runs on pi0 via SSH: `pkg_create` + `pkg_summary.gz`) | | `packages/scripts/pkg-dtail-rpm.sh` | Builds DTail RPMs from prebuilt or locally built payloads | ## SSH Access for Package Tasks @@ -55,6 +60,7 @@ Custom FreeBSD, OpenBSD, and Rocky Linux package repository served from k3s. | f0 (FreeBSD, NFS) | `ssh -p 22 f0.lan.buetow.org` | `doas` | PV is local; default shell is **csh** | | fishfinger (OpenBSD) | `ssh rex@fishfinger.buetow.org` | `doas` | OpenBSD packages built here, then copied to f0 PV | | blowfish (OpenBSD) | `ssh rex@blowfish.buetow.org` | `doas` | Same setup as fishfinger | +| pi0 (NetBSD) | `ssh -p 22 paul@pi0.lan.buetow.org` | `doas` | NetBSD packages assembled here (`pkg_create`), then copied to f0 PV; non-interactive SSH PATH lacks `/usr/sbin` (`pkg_*` live there) | ## Nginx Pod Gotcha — Stale NFS Handle @@ -69,5 +75,6 @@ kubectl -n infra rollout status deployment/pkgrepo - **FreeBSD**: version follows ABI naming (`FreeBSD:15:amd64`); packages unsigned (`signature_type: "NONE"`); always regenerate metadata with `pkg repo` after adding/removing packages - **OpenBSD**: no repo index needed — `pkg_add` fetches by name; packages signed with signify; version in path must match host OS (currently 7.8) +- **NetBSD**: packages unsigned; `pkg_add` works with a direct package URL, `pkg_summary.gz` alongside the packages enables pkgin; package versions must not contain dashes (`4.3.2-ng` → `4.3.2ng`); `+BUILD_INFO` (`MACHINE_ARCH`/`OS_VERSION`) is checked by `pkg_add` on install, which is why packages are assembled natively on pi0 - **Rocky Linux**: standard DNF layout; unsigned repo (`gpgcheck=0`); architecture-specific paths (`x86_64` / `aarch64`) - **FreeBSD csh**: default shell is csh — avoid inline one-liners with `||`, `&&`, `!`, or multi-line quoting over SSH; use piped `/bin/sh` or separate SSH invocations |