feat: first fully successful run e2e on straper

55 files changed, 3112 insertions, 0 deletions

diff --git a/straper/db/public/boot/cryptsetup-initramfs/conf-hook b/straper/db/public/boot/cryptsetup-initramfs/conf-hook
new file mode 100644
index 0000000..0b4389f
--- /dev/null
+++ b/straper/db/public/boot/cryptsetup-initramfs/conf-hook
@@ -0,0 +1,44 @@
+#
+# Configuration file for the cryptroot initramfs hook.
+#
+
+#
+# KEYFILE_PATTERN: ...
+#
+# The value of this variable is interpreted as a shell pattern.
+# Matching key files from the crypttab(5) are included in the initramfs
+# image.  The associated devices can then be unlocked without manual
+# intervention.  (For instance if /etc/crypttab lists two key files
+# /etc/keys/{root,swap}.key, you can set KEYFILE_PATTERN="/etc/keys/*.key"
+# to add them to the initrd.)
+#
+# If KEYFILE_PATTERN if null or unset (default) then no key file is
+# copied to the initramfs image.
+#
+# Note that the glob(7) is not expanded for crypttab(5) entries with a
+# 'keyscript=' option.  In that case, the field is not treated as a file
+# name but given as argument to the keyscript.
+#
+# WARNING:
+# * If the initramfs image is to include private key material, you'll
+#   want to create it with a restrictive umask in order to keep
+#   non-privileged users at bay.  For instance, set UMASK=0077 in
+#   /etc/initramfs-tools/initramfs.conf
+# * If you use cryptsetup-suspend, private key material inside the
+#   initramfs will be in memory during suspend period, defeating the
+#   purpose of cryptsetup-suspend.
+#
+
+#KEYFILE_PATTERN=
+
+#
+# ASKPASS: [ y | n ]
+#
+# Whether to include the askpass binary to the initramfs image.  askpass
+# is required for interactive passphrase prompts, and ASKPASS=y (the
+# default) is implied when the hook detects that same device needs to be
+# unlocked interactively (i.e., not via keyfile nor keyscript) at
+# initramfs stage.  Setting ASKPASS=n also skips `cryptroot-unlock`
+# inclusion as it requires the askpass executable.
+
+#ASKPASS=y
diff --git a/straper/db/public/boot/etc-default/alloy b/straper/db/public/boot/etc-default/alloy
new file mode 100644
index 0000000..57a4350
--- /dev/null
+++ b/straper/db/public/boot/etc-default/alloy
@@ -0,0 +1,16 @@
+## Path:
+## Description: Grafana Alloy settings
+## Type:        string
+## Default:     ""
+## ServiceRestart: alloy
+#
+# Command line options for Alloy.
+#
+# The configuration file holding the Alloy config.
+CONFIG_FILE="/etc/alloy/config.alloy"
+
+# User-defined arguments to pass to the run command.
+CUSTOM_ARGS=""
+
+# Restart on system upgrade. Defaults to true.
+RESTART_ON_UPGRADE=true
diff --git a/straper/db/public/boot/etc-default/anacron b/straper/db/public/boot/etc-default/anacron
new file mode 100644
index 0000000..bf6e0ba
--- /dev/null
+++ b/straper/db/public/boot/etc-default/anacron
@@ -0,0 +1,25 @@
+# Environment File for anacron
+
+# ANACRON_RUN_ON_BATTERY_POWER
+#
+# NOTE:
+#       For ANACRON_RUN_ON_BATTERY_POWER, settings here only works
+#       when you are not using systemd.
+#       Please read /usr/share/doc/anacron/README.Debian
+#       to see how to adjust program behaviour on AC power.
+#
+# If set to "yes", start anacron even when on battery power.  By
+# default, the /etc/init.d/anacron script tries to avoid running
+# anacron unless on AC power, so as to avoid running down the battery.
+# (Things like the locate updatedb cause a lot of I/O.)
+
+ANACRON_RUN_ON_BATTERY_POWER=no
+
+# ANACRON_ARGS
+#
+# Arguments/options to pass to anacron.
+# By default, "-s" is used to ensure serialised job arrangements.
+# If you want tasks to execute in parallel when the jobs are due to
+# start, do not pass "-s" here.
+
+ANACRON_ARGS=-s
diff --git a/straper/db/public/boot/etc-default/bluetooth b/straper/db/public/boot/etc-default/bluetooth
new file mode 100644
index 0000000..2c310b9
--- /dev/null
+++ b/straper/db/public/boot/etc-default/bluetooth
@@ -0,0 +1,20 @@
+# Defaults for bluez
+
+# start bluetooth on boot?
+# compatibility note: if this variable is _not_ found bluetooth will start
+BLUETOOTH_ENABLED=1
+
+# This setting used to switch HID devices (e.g mouse/keyboard) to HCI mode, that
+# is you will have bluetooth functionality from your dongle instead of only
+# HID. This is accomplished for supported devices by udev in
+# /lib/udev/rules.d/62-bluez-hid2hci.rules by invoking hid2hci with correct
+# parameters.
+# See /usr/share/doc/bluez/NEWS.Debian.gz for further information.
+
+# Older daemons like pand dund and hidd can be found in bluez-compat package as
+# they are deprecated and provided for backward compatibility only.
+
+# Note that not every bluetooth dongle is capable of switching back to HID mode,
+# see http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=355497
+HID2HCI_ENABLED=0
+HID2HCI_UNDO=0
diff --git a/straper/db/public/boot/etc-default/console-setup b/straper/db/public/boot/etc-default/console-setup
new file mode 100644
index 0000000..dc3ea7f
--- /dev/null
+++ b/straper/db/public/boot/etc-default/console-setup
@@ -0,0 +1,16 @@
+# CONFIGURATION FILE FOR SETUPCON
+
+# Consult the console-setup(5) manual page.
+
+ACTIVE_CONSOLES="/dev/tty[1-6]"
+
+CHARMAP="UTF-8"
+
+CODESET="Lat15"
+FONTFACE="Fixed"
+FONTSIZE="8x16"
+
+VIDEOMODE=
+
+# The following is an example how to use a braille font
+# FONT='lat9w-08.psf.gz brl-8x8.psf'
diff --git a/straper/db/public/boot/etc-default/cron b/straper/db/public/boot/etc-default/cron
new file mode 100644
index 0000000..1d8b7ed
--- /dev/null
+++ b/straper/db/public/boot/etc-default/cron
@@ -0,0 +1,28 @@
+# Cron configuration options
+
+# Whether to read the system's default environment files (if present)
+# If set to "yes", cron will set a proper mail charset from the
+# locale information. If set to something other than 'yes', the default
+# charset 'C' (canonical name: ANSI_X3.4-1968) will be used.
+#
+# This has no effect on tasks running under cron; their environment can
+# only be changed via PAM or from within the crontab; see crontab(5).
+READ_ENV="yes"
+
+# Extra options for cron, see cron(8)
+#
+# For example, to enable LSB name support in /etc/cron.d/, use
+# EXTRA_OPTS='-l'  
+#
+# Or, to log standard messages, plus jobs with exit status != 0:
+# EXTRA_OPTS='-L 5'
+#
+# For quick reference, the currently available log levels are:
+#   0   no logging (errors are logged regardless)
+#   1   log start of jobs
+#   2   log end of jobs
+#   4   log jobs with exit status != 0
+#   8   log the process identifier of child process (in all logs)
+#
+EXTRA_OPTS=""
+
diff --git a/straper/db/public/boot/etc-default/cryptdisks b/straper/db/public/boot/etc-default/cryptdisks
new file mode 100644
index 0000000..c1f837c
--- /dev/null
+++ b/straper/db/public/boot/etc-default/cryptdisks
@@ -0,0 +1,12 @@
+# Run cryptdisks initscripts at startup? Default is Yes.
+CRYPTDISKS_ENABLE=Yes
+
+# Mountpoints to mount, before cryptsetup is invoked at initscripts. Takes
+# mountpoins which are configured in /etc/fstab as arguments. Separate
+# mountpoints by space.
+# This is useful for keyfiles on removable media. Default is unset.
+CRYPTDISKS_MOUNT=""
+
+# Default check script. Takes effect, if the 'check' option is set in crypttab
+# without a value.
+CRYPTDISKS_CHECK=blkid
diff --git a/straper/db/public/boot/etc-default/dbus b/straper/db/public/boot/etc-default/dbus
new file mode 100644
index 0000000..4bc8e1b
--- /dev/null
+++ b/straper/db/public/boot/etc-default/dbus
@@ -0,0 +1,7 @@
+# This is a configuration file for /etc/init.d/dbus; it allows you to
+# perform common modifications to the behavior of the dbus daemon
+# startup without editing the init script (and thus getting prompted
+# by dpkg on upgrades).  We all love dpkg prompts.
+
+# Parameters to pass to dbus.
+PARAMS=""
diff --git a/straper/db/public/boot/etc-default/dnsmasq b/straper/db/public/boot/etc-default/dnsmasq
new file mode 100644
index 0000000..daa4201
--- /dev/null
+++ b/straper/db/public/boot/etc-default/dnsmasq
@@ -0,0 +1,42 @@
+# This file has six functions:
+# 1) to completely disable starting this dnsmasq instance
+# 2) to set DOMAIN_SUFFIX by running `dnsdomainname`
+# 3) to select an alternative config file
+#    by setting DNSMASQ_OPTS to --conf-file=<file>
+# 4) to tell dnsmasq to read the files in /etc/dnsmasq.d for
+#    more configuration variables.
+# 5) to stop the resolvconf package from controlling dnsmasq's
+#    idea of which upstream nameservers to use.
+# 6) to avoid using this dnsmasq instance as the system's default resolver
+#    by setting DNSMASQ_EXCEPT="lo"
+# For upgraders from very old versions, all the shell variables set
+# here in previous versions are still honored by the init script
+# so if you just keep your old version of this file nothing will break.
+
+#DOMAIN_SUFFIX=`dnsdomainname`
+#DNSMASQ_OPTS="--conf-file=/etc/dnsmasq.alt"
+
+# The dnsmasq daemon is run by default conforming to the Debian Policy.
+# To disable the service,
+# for SYSV init, use "update-rc.d dnsmasq disable",
+# for systemd, use "systemctl disable dnsmasq".
+
+# By default search this drop directory for configuration options.
+# Libvirt leaves a file here to make the system dnsmasq play nice.
+# Comment out this line if you don't want this. The dpkg-* are file
+# endings which cause dnsmasq to skip that file. This avoids pulling
+# in backups made by dpkg.
+CONFIG_DIR=/etc/dnsmasq.d,.dpkg-dist,.dpkg-old,.dpkg-new
+
+# If the resolvconf package is installed, dnsmasq will use its output
+# rather than the contents of /etc/resolv.conf to find upstream
+# nameservers. Uncommenting this line inhibits this behaviour.
+# Note that including a "resolv-file=<filename>" line in
+# /etc/dnsmasq.conf is not enough to override resolvconf if it is
+# installed: the line below must be uncommented.
+#IGNORE_RESOLVCONF=yes
+
+# If the resolvconf package is installed, dnsmasq will tell resolvconf
+# to use dnsmasq under 127.0.0.1 as the system's default resolver.
+# Uncommenting this line inhibits this behaviour.
+#DNSMASQ_EXCEPT="lo"
diff --git a/straper/db/public/boot/etc-default/docker b/straper/db/public/boot/etc-default/docker
new file mode 100644
index 0000000..60136c0
--- /dev/null
+++ b/straper/db/public/boot/etc-default/docker
@@ -0,0 +1,20 @@
+# Docker SysVinit configuration file
+
+#
+# THIS FILE DOES NOT APPLY TO SYSTEMD
+#
+#   Please see the documentation for "systemd drop-ins":
+#   https://docs.docker.com/engine/admin/systemd/
+#
+
+# Customize location of Docker binary (especially for development testing).
+#DOCKERD="/usr/local/bin/dockerd"
+
+# Use DOCKER_OPTS to modify the daemon startup options.
+#DOCKER_OPTS="--dns 8.8.8.8 --dns 8.8.4.4"
+
+# If you need Docker to use an HTTP proxy, it can also be specified here.
+#export http_proxy="http://127.0.0.1:3128/"
+
+# This is also a handy place to tweak where Docker's temporary files go.
+#export DOCKER_TMPDIR="/mnt/bigdrive/docker-tmp"
diff --git a/straper/db/public/boot/etc-default/fail2ban b/straper/db/public/boot/etc-default/fail2ban
new file mode 100644
index 0000000..35bb377
--- /dev/null
+++ b/straper/db/public/boot/etc-default/fail2ban
@@ -0,0 +1,39 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+#
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+# Command line options for Fail2Ban. Refer to "fail2ban-client -h" for
+# valid options.
+FAIL2BAN_OPTS=""
+
+# Run fail2ban as a different user. If not set, fail2ban
+# will run as root.
+#
+# The user is not created automatically.
+# The user can be created e.g. with
+#    useradd --system --no-create-home --home-dir / --groups adm fail2ban
+# Log files are readable by group adm by default. Adding the fail2ban
+# user to this group allows it to read the logfiles.
+#
+# Another manual step that needs to be taken is to allow write access
+# for fail2ban user to fail2ban log files. The /etc/init.d/fail2ban
+# script will change the ownership when starting fail2ban. Logrotate
+# needs to be configured separately, see /etc/logrotate.d/fail2ban.
+#
+# FAIL2BAN_USER="fail2ban"
diff --git a/straper/db/public/boot/etc-default/grafana-server b/straper/db/public/boot/etc-default/grafana-server
new file mode 100644
index 0000000..cd0580a
--- /dev/null
+++ b/straper/db/public/boot/etc-default/grafana-server
@@ -0,0 +1,24 @@
+GRAFANA_USER=grafana
+
+GRAFANA_GROUP=grafana
+
+GRAFANA_HOME=/usr/share/grafana
+
+LOG_DIR=/var/log/grafana
+
+DATA_DIR=/var/lib/grafana
+
+MAX_OPEN_FILES=10000
+
+CONF_DIR=/etc/grafana
+
+CONF_FILE=/etc/grafana/grafana.ini
+
+RESTART_ON_UPGRADE=true
+
+PLUGINS_DIR=/var/lib/grafana/plugins
+
+PROVISIONING_CFG_DIR=/etc/grafana/provisioning
+
+# Only used on systemd systems
+PID_FILE_DIR=/run/grafana
diff --git a/straper/db/public/boot/etc-default/grub b/straper/db/public/boot/etc-default/grub
new file mode 100644
index 0000000..88eb3dd
--- /dev/null
+++ b/straper/db/public/boot/etc-default/grub
@@ -0,0 +1,39 @@
+# If you change this file or any /etc/default/grub.d/*.cfg file,
+# run 'update-grub' afterwards to update /boot/grub/grub.cfg.
+# For full documentation of the options in these files, see:
+#   info -f grub -n 'Simple configuration'
+
+GRUB_DEFAULT=0
+GRUB_TIMEOUT=5
+GRUB_DISTRIBUTOR=`( . /etc/os-release && echo ${NAME} )`
+GRUB_CMDLINE_LINUX_DEFAULT="quiet pcie_aspm=off"
+GRUB_CMDLINE_LINUX=""
+
+# If your computer has multiple operating systems installed, then you
+# probably want to run os-prober. However, if your computer is a host
+# for guest OSes installed via LVM or raw disk devices, running
+# os-prober can cause damage to those guest OSes as it mounts
+# filesystems to look for things.
+#GRUB_DISABLE_OS_PROBER=false
+
+# Uncomment to enable BadRAM filtering, modify to suit your needs
+# This works with Linux (no patch required) and with any kernel that obtains
+# the memory map information from GRUB (GNU Mach, kernel of FreeBSD ...)
+#GRUB_BADRAM="0x01234567,0xfefefefe,0x89abcdef,0xefefefef"
+
+# Uncomment to disable graphical terminal
+#GRUB_TERMINAL=console
+
+# The resolution used on graphical terminal
+# note that you can use only modes which your graphic card supports via VBE/GOP/UGA
+# you can see them in real GRUB with the command `videoinfo'
+#GRUB_GFXMODE=640x480
+
+# Uncomment if you don't want GRUB to pass "root=UUID=xxx" parameter to Linux
+#GRUB_DISABLE_LINUX_UUID=true
+
+# Uncomment to disable generation of recovery mode menu entries
+#GRUB_DISABLE_RECOVERY="true"
+
+# Uncomment to get a beep at grub start
+#GRUB_INIT_TUNE="480 440 1"
diff --git a/straper/db/public/boot/etc-default/grub.ucf-dist b/straper/db/public/boot/etc-default/grub.ucf-dist
new file mode 100644
index 0000000..88eb3dd
--- /dev/null
+++ b/straper/db/public/boot/etc-default/grub.ucf-dist
@@ -0,0 +1,39 @@
+# If you change this file or any /etc/default/grub.d/*.cfg file,
+# run 'update-grub' afterwards to update /boot/grub/grub.cfg.
+# For full documentation of the options in these files, see:
+#   info -f grub -n 'Simple configuration'
+
+GRUB_DEFAULT=0
+GRUB_TIMEOUT=5
+GRUB_DISTRIBUTOR=`( . /etc/os-release && echo ${NAME} )`
+GRUB_CMDLINE_LINUX_DEFAULT="quiet pcie_aspm=off"
+GRUB_CMDLINE_LINUX=""
+
+# If your computer has multiple operating systems installed, then you
+# probably want to run os-prober. However, if your computer is a host
+# for guest OSes installed via LVM or raw disk devices, running
+# os-prober can cause damage to those guest OSes as it mounts
+# filesystems to look for things.
+#GRUB_DISABLE_OS_PROBER=false
+
+# Uncomment to enable BadRAM filtering, modify to suit your needs
+# This works with Linux (no patch required) and with any kernel that obtains
+# the memory map information from GRUB (GNU Mach, kernel of FreeBSD ...)
+#GRUB_BADRAM="0x01234567,0xfefefefe,0x89abcdef,0xefefefef"
+
+# Uncomment to disable graphical terminal
+#GRUB_TERMINAL=console
+
+# The resolution used on graphical terminal
+# note that you can use only modes which your graphic card supports via VBE/GOP/UGA
+# you can see them in real GRUB with the command `videoinfo'
+#GRUB_GFXMODE=640x480
+
+# Uncomment if you don't want GRUB to pass "root=UUID=xxx" parameter to Linux
+#GRUB_DISABLE_LINUX_UUID=true
+
+# Uncomment to disable generation of recovery mode menu entries
+#GRUB_DISABLE_RECOVERY="true"
+
+# Uncomment to get a beep at grub start
+#GRUB_INIT_TUNE="480 440 1"
diff --git a/straper/db/public/boot/etc-default/i2pd b/straper/db/public/boot/etc-default/i2pd
new file mode 100644
index 0000000..f229584
--- /dev/null
+++ b/straper/db/public/boot/etc-default/i2pd
@@ -0,0 +1,6 @@
+# Additional options that are passed to the Daemon.
+# see possible switches in /usr/share/doc/i2pd/configuration.md.gz
+#DAEMON_OPTS="--conf=/etc/i2pd/i2pd.conf --tunconf=/etc/i2pd/tunnels.conf --tunnelsdir=/etc/i2pd/tunnels.conf.d --pidfile=/run/i2pd/i2pd.pid --logfile=/var/log/i2pd/i2pd.log --daemon --service"
+
+# If you have problems with hunging i2pd, you can try increase this
+ulimit -n 4096
diff --git a/straper/db/public/boot/etc-default/intel-microcode b/straper/db/public/boot/etc-default/intel-microcode
new file mode 100644
index 0000000..b958464
--- /dev/null
+++ b/straper/db/public/boot/etc-default/intel-microcode
@@ -0,0 +1,26 @@
+# Configuration script for intel-microcode version 3
+
+#
+# initramfs helper
+#
+
+# Set this to "no" to disable automatic microcode updates on boot;
+# Set this to "auto" to use early initramfs mode automatically (default);
+# Set this to "early" to always attempt to create an early initramfs;
+#IUCODE_TOOL_INITRAMFS=auto
+
+# Set this to "yes" (default) to use "iucode_tool --scan-system" to reduce
+# the initramfs size bloat, by detecting which Intel processors are active
+# in this system, and installing only their microcodes.
+#
+# Set this to "no" to either include all microcodes, or only the microcodes
+# selected through the use of IUCODE_TOOL_EXTRA_OPTIONS below.
+#
+# WARNING: including all microcodes will increase initramfs size greatly.
+# This can cause boot issues if the initramfs is already large.
+#IUCODE_TOOL_SCANCPUS=yes
+
+# Extra options to pass to iucode_tool, useful to forbid or to
+# force the inclusion of microcode for specific processor signatures.
+# See iucode_tool(8) for details.
+#IUCODE_TOOL_EXTRA_OPTIONS=""
diff --git a/straper/db/public/boot/etc-default/keyboard b/straper/db/public/boot/etc-default/keyboard
new file mode 100644
index 0000000..3fecbcc
--- /dev/null
+++ b/straper/db/public/boot/etc-default/keyboard
@@ -0,0 +1,10 @@
+# KEYBOARD CONFIGURATION FILE
+
+# Consult the keyboard(5) manual page.
+
+XKBMODEL="pc105"
+XKBLAYOUT="us"
+XKBVARIANT=""
+XKBOPTIONS=""
+
+BACKSPACE="guess"
diff --git a/straper/db/public/boot/etc-default/networking b/straper/db/public/boot/etc-default/networking
new file mode 100644
index 0000000..9655359
--- /dev/null
+++ b/straper/db/public/boot/etc-default/networking
@@ -0,0 +1,31 @@
+# Configuration for networking init script being run during
+# the boot sequence
+
+# Set to 'no' to skip interfaces configuration on boot
+#CONFIGURE_INTERFACES=yes
+
+# Don't configure these interfaces. Shell wildcards supported/
+#EXCLUDE_INTERFACES=
+
+# Set to 'yes' to enable additional verbosity
+#VERBOSE=no
+
+# Method to wait for the network to become online,
+# for services that depend on a working network:
+# - ifup: wait for ifup to have configured an interface.
+# - route: wait for a route to a given address to appear.
+# - ping/ping6: wait for a host to respond to ping packets.
+# - none: don't wait.
+#WAIT_ONLINE_METHOD=ifup
+
+# Which interface to wait for.
+# If none given, wait for all auto interfaces, or if there are none,
+# wait for at least one hotplug interface.
+#WAIT_ONLINE_IFACE=
+
+# Which address to wait for for route, ping and ping6 methods.
+# If none is given for route, it waits for a default gateway.
+#WAIT_ONLINE_ADDRESS=
+
+# Timeout in seconds for waiting for the network to come online.
+#WAIT_ONLINE_TIMEOUT=300
diff --git a/straper/db/public/boot/etc-default/nginx b/straper/db/public/boot/etc-default/nginx
new file mode 100644
index 0000000..09b8fd0
--- /dev/null
+++ b/straper/db/public/boot/etc-default/nginx
@@ -0,0 +1,10 @@
+# Note: You may want to look at the following page before setting the ULIMIT.
+#  http://wiki.nginx.org/CoreModule#worker_rlimit_nofile
+# Set the ulimit variable if you need defaults to change.
+#  Example: ULIMIT="-n 4096"
+#ULIMIT="-n 4096"
+
+# Define the stop schedule for nginx
+# see the start-stop-daemon --retry documentation for more information
+#
+#STOP_SCHEDULE="QUIT/5/TERM/5/KILL/5"
diff --git a/straper/db/public/boot/etc-default/nss b/straper/db/public/boot/etc-default/nss
new file mode 100644
index 0000000..c43e88b
--- /dev/null
+++ b/straper/db/public/boot/etc-default/nss
@@ -0,0 +1,37 @@
+# /etc/default/nss
+# This file can theoretically contain a bunch of customization variables
+# for Name Service Switch in the GNU C library.  For now there are only
+# four variables:
+#
+# NETID_AUTHORITATIVE
+#   If set to TRUE, the initgroups() function will accept the information
+#   from the netid.byname NIS map as authoritative.  This can speed up the
+#   function significantly if the group.byname map is large.  The content
+#   of the netid.byname map is used AS IS.  The system administrator has
+#   to make sure it is correctly generated.
+#NETID_AUTHORITATIVE=TRUE
+#
+# SERVICES_AUTHORITATIVE
+#   If set to TRUE, the getservbyname{,_r}() function will assume
+#   services.byservicename NIS map exists and is authoritative, particularly
+#   that it contains both keys with /proto and without /proto for both
+#   primary service names and service aliases.  The system administrator
+#   has to make sure it is correctly generated.
+#SERVICES_AUTHORITATIVE=TRUE
+#
+# SETENT_BATCH_READ
+#  If set to TRUE, various setXXent() functions will read the entire
+#  database at once and then hand out the requests one by one from
+#  memory with every getXXent() call.  Otherwise each getXXent() call
+#  might result into a network communication with the server to get
+#  the next entry.
+#SETENT_BATCH_READ=TRUE
+#
+# ADJUNCT_AS_SHADOW
+#  If set to TRUE, the passwd routines in the NIS NSS module will not
+#  use the passwd.adjunct.byname tables to fill in the password data
+#  in the passwd structure.  This is a security problem if the NIS
+#  server cannot be trusted to send the passwd.adjuct table only to
+#  privileged clients.  Instead the passwd.adjunct.byname table is
+#  used to synthesize the shadow.byname table if it does not exist.
+ADJUNCT_AS_SHADOW=TRUE
diff --git a/straper/db/public/boot/etc-default/openipmi b/straper/db/public/boot/etc-default/openipmi
new file mode 100644
index 0000000..715c6e4
--- /dev/null
+++ b/straper/db/public/boot/etc-default/openipmi
@@ -0,0 +1,68 @@
+## Path:        Hardware/IPMI
+## Description: Enable standard hardware interfaces (KCS, BT, SMIC)
+## Type:        yesno
+## Default:     "yes"
+## Config:      ipmi
+# Enable standard hardware interfaces (KCS, BT, SMIC)
+# You probably want this enabled.
+IPMI_SI=yes
+
+## Path:        Hardware/IPMI
+## Description: Enable /dev/ipmi0 interface, used by ipmitool, ipmicmd,
+## Type:        yesno
+## Default:     "yes"
+## Config:      ipmi
+# Enable /dev/ipmi0 interface, used by ipmitool, ipmicmd,
+# and other userspace IPMI-using applications.
+# You probably want this enabled.
+DEV_IPMI=yes
+
+## Path:        Hardware/IPMI
+## Description: Enable IPMI_WATCHDOG if you want the IPMI watchdog
+## Type:        yesno
+## Default:     "no"
+## Config:      ipmi
+# Enable IPMI_WATCHDOG if you want the IPMI watchdog
+# to reboot the system if it hangs
+IPMI_WATCHDOG=no
+
+## Path:        Hardware/IPMI
+## Description: Watchdog options - modinfo ipmi_watchdog for details
+## Type:        string
+## Default:     "timeout=60"
+## Config:      ipmi
+# Watchdog options - modinfo ipmi_watchdog for details
+# watchdog timeout value in seconds
+# as there is no userspace ping application that runs during shutdown,
+# be sure to give it enough time for any device drivers to
+# do their cleanup (e.g. megaraid cache flushes)
+# without the watchdog triggering prematurely
+IPMI_WATCHDOG_OPTIONS="timeout=60"
+
+## Path:        Hardware/IPMI
+## Description: Enable IPMI_POWEROFF if you want the IPMI poweroff module to be loaded.
+## Type:        yesno
+## Default:     "no"
+## Config:      ipmi
+# Enable IPMI_POWEROFF if you want the IPMI
+# poweroff module to be loaded.
+IPMI_POWEROFF=no
+
+## Path:        Hardware/IPMI
+## Description: Enable IPMI_POWERCYCLE if you want the system to be power-cycled on reboot
+## Type:        yesno
+## Default:     "no"
+## Config:      ipmi
+# Enable IPMI_POWERCYCLE if you want the system to be power-cycled (power
+# down, delay briefly, power on) rather than power off, on systems
+# that support such.  IPMI_POWEROFF=yes is also required.
+IPMI_POWERCYCLE=no
+
+## Path:        Hardware/IPMI
+## Description: Enable "legacy" interfaces for applications
+## Type:        yesno
+## Default:     "no"
+## Config:      ipmi
+# Enable "legacy" interfaces for applications
+# Intel IMB driver interface
+IPMI_IMB=no
diff --git a/straper/db/public/boot/etc-default/prometheus b/straper/db/public/boot/etc-default/prometheus
new file mode 100644
index 0000000..5f2b5f7
--- /dev/null
+++ b/straper/db/public/boot/etc-default/prometheus
@@ -0,0 +1,5 @@
+# Set the command-line arguments to pass to the server.
+# Due to shell escaping, to pass backslashes for regexes, you need to double
+# them (\\d for \d). If running under systemd, you need to double them again
+# (\\\\d to mean \d), and escape newlines too.
+ARGS=""
diff --git a/straper/db/public/boot/etc-default/prometheus-node-exporter b/straper/db/public/boot/etc-default/prometheus-node-exporter
new file mode 100644
index 0000000..4b1b736
--- /dev/null
+++ b/straper/db/public/boot/etc-default/prometheus-node-exporter
@@ -0,0 +1,6 @@
+# Set the command-line arguments to pass to the server.
+# Due to shell escaping, to pass backslashes for regexes, you need to double
+# them (\\d for \d). If running under systemd, you need to double them again
+# (\\\\d to mean \d), and escape newlines too.
+ARGS="--web.listen-address=127.0.0.1:9100 --collector.textfile.directory=/var/lib/prometheus/node-exporter"
+
diff --git a/straper/db/public/boot/etc-default/rsync b/straper/db/public/boot/etc-default/rsync
new file mode 100644
index 0000000..424b1c0
--- /dev/null
+++ b/straper/db/public/boot/etc-default/rsync
@@ -0,0 +1,47 @@
+# defaults file for rsync daemon mode
+#
+# This file is only used for init.d based systems!
+# If this system uses systemd, you can specify options etc. for rsync
+# in daemon mode by copying /lib/systemd/system/rsync.service to
+# /etc/systemd/system/rsync.service and modifying the copy; add required
+# options to the ExecStart line.
+
+# start rsync in daemon mode from init.d script?
+#  only allowed values are "true", "false", and "inetd"
+#  Use "inetd" if you want to start the rsyncd from inetd,
+#  all this does is prevent the init.d script from printing a message
+#  about not starting rsyncd (you still need to modify inetd's config yourself).
+RSYNC_ENABLE=false
+
+# which file should be used as the configuration file for rsync.
+# This file is used instead of the default /etc/rsyncd.conf
+# Warning: This option has no effect if the daemon is accessed
+#          using a remote shell. When using a different file for
+#          rsync you might want to symlink /etc/rsyncd.conf to
+#          that file.
+# RSYNC_CONFIG_FILE=
+
+# what extra options to give rsync --daemon?
+#  that excludes the --daemon; that's always done in the init.d script
+#  Possibilities are:
+#   --address=123.45.67.89		(bind to a specific IP address)
+#   --port=8730				(bind to specified port; default 873)
+RSYNC_OPTS=''
+
+# run rsyncd at a nice level?
+#  the rsync daemon can impact performance due to much I/O and CPU usage,
+#  so you may want to run it at a nicer priority than the default priority.
+#  Allowed values are 0 - 19 inclusive; 10 is a reasonable value.
+RSYNC_NICE=''
+
+# run rsyncd with ionice?
+#  "ionice" does for IO load what "nice" does for CPU load.
+#  As rsync is often used for backups which aren't all that time-critical,
+#  reducing the rsync IO priority will benefit the rest of the system.
+#  See the manpage for ionice for allowed options.
+#  -c3 is recommended, this will run rsync IO at "idle" priority. Uncomment
+#  the next line to activate this.
+# RSYNC_IONICE='-c3'
+
+# Don't forget to create an appropriate config file,
+# else the daemon will not start.
diff --git a/straper/db/public/boot/etc-default/smartmontools b/straper/db/public/boot/etc-default/smartmontools
new file mode 100644
index 0000000..6a8a6e2
--- /dev/null
+++ b/straper/db/public/boot/etc-default/smartmontools
@@ -0,0 +1,9 @@
+# Defaults for smartmontools initscript (/etc/init.d/smartmontools)
+# This is a POSIX shell fragment
+
+# List of devices you want to explicitly enable S.M.A.R.T. for
+# Not needed (and not recommended) if the device is monitored by smartd
+#enable_smart="/dev/hda /dev/hdb"
+
+# uncomment to pass additional options to smartd on startup
+#smartd_opts="--interval=1800"
diff --git a/straper/db/public/boot/etc-default/ssh b/straper/db/public/boot/etc-default/ssh
new file mode 100644
index 0000000..3040422
--- /dev/null
+++ b/straper/db/public/boot/etc-default/ssh
@@ -0,0 +1,5 @@
+# Default settings for openssh-server. This file is sourced by /bin/sh from
+# /etc/init.d/ssh.
+
+# Options to pass to sshd
+SSHD_OPTS=
diff --git a/straper/db/public/boot/etc-default/tor b/straper/db/public/boot/etc-default/tor
new file mode 100644
index 0000000..7a1b832
--- /dev/null
+++ b/straper/db/public/boot/etc-default/tor
@@ -0,0 +1,75 @@
+# Defaults for tor initscript
+# sourced by /etc/init.d/tor
+# installed at /etc/default/tor by the maintainer scripts
+#
+# Note that this file is not being used for controlling Tor-startup
+# when Tor is launched by systemd.
+#
+
+#
+# This is a bash shell fragment
+#
+RUN_DAEMON="yes"
+
+#
+# Servers sometimes may need more than the default 1024 file descriptors
+# if they are very busy and have many clients connected to them.  The top
+# servers as of early 2008 regularly have more than 10000 connected
+# clients.
+#  (ulimit -n)
+#
+# (the default varies as it depends on the number of available system-wide file
+#  descriptors.  See the init script in /etc/init.d/tor for details.)
+#
+# MAX_FILEDESCRIPTORS=
+
+#
+# If tor is seriously hogging your CPU, taking away too much cycles from
+# other system resources, then you can renice tor.  See nice(1) for a
+# bit more information.  Another way to limit the CPU usage of an Onion
+# Router is to set a lower BandwidthRate, as CPU usage is mostly a function
+# of the amount of traffic flowing through your node.  Consult the torrc(5)
+# manual page for more information on setting BandwidthRate.
+#
+# NICE="--nicelevel 5"
+
+# Additional arguments to pass on tor's command line.
+#
+# ARGS="$ARGS "
+
+#
+# Uncomment the ulimit call below, and set "DisableDebuggerAttachment 0"
+# in /etc/tor/torrc, if you want tor to produce coredumps on segfaults
+# and assert errors.
+#
+# Keeping coredumps around is some sort of security issue since they
+# may leak session keys, sensitive client data and more, should such
+# files fall into the wrong hands.  Therefore coredumps are not enabled
+# by default.
+#
+# ulimit -c unlimited
+
+#
+# Config option for the weekly cron file: Whether or not to remove old
+# coredumps in /var/lib/tor.  Coredumps can hold sensitive data, as such
+# they probably should not be kept lying around if nobody will ever look
+# at them.  This option makes /etc/cron.weekly/tor clean out files older
+# then three weeks.
+#
+CLEANUP_OLD_COREFILES=y
+
+#
+# By default the tor init script will launch Tor using apparmor iff
+# /usr/sbin/aa-status exists and is executable and calling it with --enabled
+# returns true, /usr/sbin/aa-exec is executable, there is a
+# /etc/apparmor.d/system_tor policy, and USE_AA_EXEC is set to 'yes'.
+#
+# USE_AA_EXEC="yes"  # default
+# USE_AA_EXEC="no"
+
+# Let the vidalia package override some of our settings.
+# People who have vidalia installed might not want to run Tor as a system
+# service. The vidalia .deb can ask them that and then set run-daemon to no.
+if [ -e /etc/default/tor.vidalia ] && [ -x /usr/bin/vidalia ]; then
+	. /etc/default/tor.vidalia
+fi
diff --git a/straper/db/public/boot/etc-default/useradd b/straper/db/public/boot/etc-default/useradd
new file mode 100644
index 0000000..2cb8167
--- /dev/null
+++ b/straper/db/public/boot/etc-default/useradd
@@ -0,0 +1,37 @@
+# Default values for useradd(8)
+#
+# The SHELL variable specifies the default login shell on your
+# system.
+# Similar to DSHELL in adduser. However, we use "sh" here because
+# useradd is a low level utility and should be as general
+# as possible
+SHELL=/bin/sh
+#
+# The default group for users
+# 100=users on Debian systems
+# Same as USERS_GID in adduser
+# This argument is used when the -n flag is specified.
+# The default behavior (when -n and -g are not specified) is to create a
+# primary user group with the same name as the user being added to the
+# system.
+# GROUP=100
+#
+# The default home directory. Same as DHOME for adduser
+# HOME=/home
+#
+# The number of days after a password expires until the account 
+# is permanently disabled
+# INACTIVE=-1
+#
+# The default expire date
+# EXPIRE=
+#
+# The SKEL variable specifies the directory containing "skeletal" user
+# files; in other words, files such as a sample .profile that will be
+# copied to the new user's home directory when it is created.
+# SKEL=/etc/skel
+#
+# Defines whether the mail spool should be created while
+# creating the account
+# CREATE_MAIL_SPOOL=no
+
diff --git a/straper/db/public/boot/etc-default/zfs b/straper/db/public/boot/etc-default/zfs
new file mode 100644
index 0000000..e5ca5ba
--- /dev/null
+++ b/straper/db/public/boot/etc-default/zfs
@@ -0,0 +1,111 @@
+# OpenZFS userland configuration.
+# shellcheck disable=SC2154
+
+# NOTE: This file is intended for sysv init and initramfs.
+# Changing some of these settings may not make any difference on
+# systemd-based setup, e.g. setting ZFS_MOUNT=no will not prevent systemd
+# from launching zfs-mount.service during boot.
+# See: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901436
+
+# To enable a boolean setting, set it to yes, on, true, or 1.
+# Anything else will be interpreted as unset.
+# shellcheck disable=SC2034
+
+# Run `zfs load-key` during system start?
+ZFS_LOAD_KEY='yes'
+
+# Run `zfs unload-key` during system stop?
+ZFS_UNLOAD_KEY='no'
+
+# Run `zfs mount -a` during system start?
+ZFS_MOUNT='yes'
+
+# Run `zfs unmount -a` during system stop?
+ZFS_UNMOUNT='yes'
+
+# Run `zfs share -a` during system start?
+# nb: The shareiscsi, sharenfs, and sharesmb dataset properties.
+ZFS_SHARE='yes'
+
+# Run `zfs unshare -a` during system stop?
+ZFS_UNSHARE='yes'
+
+# By default, a verbatim import of all pools is performed at boot based on the
+# contents of the default zpool cache file.  The contents of the cache are
+# managed automatically by the 'zpool import' and 'zpool export' commands.
+#
+# By setting this to 'yes', the system will instead search all devices for
+# pools and attempt to import them all at boot, even those that have been
+# exported.  Under this mode, the search path can be controlled by the
+# ZPOOL_IMPORT_PATH variable and a list of pools that should not be imported
+# can be listed in the ZFS_POOL_EXCEPTIONS variable.
+#
+# Note that importing all visible pools may include pools that you don't
+# expect, such as those on removable devices and SANs, and those pools may
+# proceed to mount themselves in places you do not want them to.  The results
+# can be unpredictable and possibly dangerous.  Only enable this option if you
+# understand this risk and have complete physical control over your system and
+# SAN to prevent the insertion of malicious pools.
+ZPOOL_IMPORT_ALL_VISIBLE='no'
+
+# Specify specific path(s) to look for device nodes and/or links for the
+# pool import(s). See zpool(8) for more information about this variable.
+# It supersedes the old USE_DISK_BY_ID which indicated that it would only
+# try '/dev/disk/by-id'.
+# The old variable will still work in the code, but is deprecated.
+#ZPOOL_IMPORT_PATH="/dev/disk/by-vdev:/dev/disk/by-id"
+
+# List of pools that should NOT be imported at boot
+# when ZPOOL_IMPORT_ALL_VISIBLE is 'yes'.
+# This is a space separated list.
+#ZFS_POOL_EXCEPTIONS="test2"
+
+# Should the datasets be mounted verbosely?
+# A mount counter will be used when mounting if set to 'yes'.
+VERBOSE_MOUNT='no'
+
+# Should we allow overlay mounts?
+# This is standard in Linux, but not ZFS which comes from Solaris where this
+# is not allowed).
+DO_OVERLAY_MOUNTS='no'
+
+# Any additional option to the 'zfs import' commandline?
+# Include '-o' for each option wanted.
+# You don't need to put '-f' in here, unless you want it ALL the time.
+# Using the option 'zfsforce=1' on the grub/kernel command line will
+# do the same, but on a case-to-case basis.
+ZPOOL_IMPORT_OPTS=""
+
+# Full path to the ZFS cache file?
+# See "cachefile" in zpool(8).
+# The default is "/etc/zfs/zpool.cache".
+#ZPOOL_CACHE="/etc/zfs/zpool.cache"
+#
+# Setting ZPOOL_CACHE to an empty string ('') AND setting ZPOOL_IMPORT_OPTS to
+# "-c /etc/zfs/zpool.cache" will _enforce_ the use of a cache file.
+# This is needed in some cases (extreme amounts of VDEVs, multipath etc).
+# Generally, the use of a cache file is usually not recommended on Linux
+# because it sometimes is more trouble than it's worth (laptops with external
+# devices or when/if device nodes changes names).
+#ZPOOL_IMPORT_OPTS="-c /etc/zfs/zpool.cache"
+#ZPOOL_CACHE=""
+
+# Any additional option to the 'zfs mount' command line?
+# Include '-o' for each option wanted.
+MOUNT_EXTRA_OPTIONS=""
+
+# Build kernel modules with the --enable-debug switch?
+# Only applicable for Debian GNU/Linux {dkms,initramfs}.
+ZFS_DKMS_ENABLE_DEBUG='no'
+
+# Build kernel modules with the --enable-debuginfo switch?
+# Only applicable for Debian GNU/Linux {dkms,initramfs}.
+ZFS_DKMS_ENABLE_DEBUGINFO='no'
+
+# Keep debugging symbols in kernel modules?
+# Only applicable for Debian GNU/Linux {dkms,initramfs}.
+ZFS_DKMS_DISABLE_STRIP='no'
+
+# Optional arguments for the ZFS Event Daemon (ZED).
+# See zed(8) for more information on available options.
+#ZED_ARGS="-M"
diff --git a/straper/db/public/boot/etc-kernel/header_postinst.d/dkms b/straper/db/public/boot/etc-kernel/header_postinst.d/dkms
new file mode 100755
index 0000000..8dd7b89
--- /dev/null
+++ b/straper/db/public/boot/etc-kernel/header_postinst.d/dkms
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+# We're passed the version of the kernel being installed
+inst_kern=$1
+
+if [ -x /usr/lib/dkms/dkms_autoinstaller ]; then
+    exec /usr/lib/dkms/dkms_autoinstaller start "$inst_kern"
+fi
diff --git a/straper/db/public/boot/etc-kernel/postinst.d/dkms b/straper/db/public/boot/etc-kernel/postinst.d/dkms
new file mode 100755
index 0000000..8dd7b89
--- /dev/null
+++ b/straper/db/public/boot/etc-kernel/postinst.d/dkms
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+# We're passed the version of the kernel being installed
+inst_kern=$1
+
+if [ -x /usr/lib/dkms/dkms_autoinstaller ]; then
+    exec /usr/lib/dkms/dkms_autoinstaller start "$inst_kern"
+fi
diff --git a/straper/db/public/boot/etc-kernel/postinst.d/initramfs-tools b/straper/db/public/boot/etc-kernel/postinst.d/initramfs-tools
new file mode 100755
index 0000000..589803a
--- /dev/null
+++ b/straper/db/public/boot/etc-kernel/postinst.d/initramfs-tools
@@ -0,0 +1,39 @@
+#!/bin/sh
+set -e
+
+version="$1"
+bootopt=""
+
+command -v update-initramfs >/dev/null 2>&1 || exit 0
+
+test "$(update-initramfs --version | cut -d ' ' -f 1)" = initramfs-tools || exit 0
+
+# passing the kernel version is required
+if [ -z "${version}" ]; then
+	echo >&2 "W: initramfs-tools: ${DPKG_MAINTSCRIPT_PACKAGE:-kernel package} did not pass a version number"
+	exit 2
+fi
+
+# exit if kernel does not need an initramfs
+if [ "$INITRD" = 'No' ]; then
+	exit 0
+fi
+
+# absolute file name of kernel image may be passed as a second argument;
+# create the initrd in the same directory
+if [ -n "$2" ]; then
+	bootdir=$(dirname "$2")
+	bootopt="-b ${bootdir}"
+fi
+
+# avoid running multiple times
+if [ -n "$DEB_MAINT_PARAMS" ]; then
+	eval set -- "$DEB_MAINT_PARAMS"
+	if [ -z "$1" ] || [ "$1" != "configure" ]; then
+		exit 0
+	fi
+fi
+
+# we're good - create initramfs.  update runs do_bootloader
+# shellcheck disable=SC2086
+update-initramfs -c -k "${version}" ${bootopt} >&2
diff --git a/straper/db/public/boot/etc-kernel/postinst.d/unattended-upgrades b/straper/db/public/boot/etc-kernel/postinst.d/unattended-upgrades
new file mode 100755
index 0000000..3f54dea
--- /dev/null
+++ b/straper/db/public/boot/etc-kernel/postinst.d/unattended-upgrades
@@ -0,0 +1,13 @@
+#!/bin/sh
+
+case "$DPKG_MAINTSCRIPT_PACKAGE::$DPKG_MAINTSCRIPT_NAME" in
+   linux-image-extra*::postrm)
+      exit 0;;
+esac
+
+if [ -d /var/run ]; then
+    touch /var/run/reboot-required
+    if ! grep -q "^$DPKG_MAINTSCRIPT_PACKAGE$" /var/run/reboot-required.pkgs 2> /dev/null ; then
+        echo "$DPKG_MAINTSCRIPT_PACKAGE" >> /var/run/reboot-required.pkgs
+    fi
+fi
diff --git a/straper/db/public/boot/etc-kernel/postinst.d/zz-update-grub b/straper/db/public/boot/etc-kernel/postinst.d/zz-update-grub
new file mode 100755
index 0000000..9521057
--- /dev/null
+++ b/straper/db/public/boot/etc-kernel/postinst.d/zz-update-grub
@@ -0,0 +1,26 @@
+#! /bin/sh
+set -e
+
+command -v update-grub >/dev/null || exit 0
+
+if type systemd-detect-virt >/dev/null 2>&1 &&
+   systemd-detect-virt --quiet --container; then
+	exit 0
+fi
+
+set -- $DEB_MAINT_PARAMS
+mode="${1#\'}"
+mode="${mode%\'}"
+case $0:$mode in
+    # Only run on postinst configure and postrm remove, to avoid wasting
+    # time by calling update-grub multiple times on upgrade and removal.
+    # Also run if we have no DEB_MAINT_PARAMS, in order to work with old
+    # kernel packages.
+    */postinst.d/*:|*/postinst.d/*:configure|*/postrm.d/*:|*/postrm.d/*:remove)
+	if [ -e /boot/grub/grub.cfg ]; then
+		exec update-grub
+	fi
+	;;
+esac
+
+exit 0
diff --git a/straper/db/public/boot/etc-kernel/postrm.d/initramfs-tools b/straper/db/public/boot/etc-kernel/postrm.d/initramfs-tools
new file mode 100755
index 0000000..a019ce5
--- /dev/null
+++ b/straper/db/public/boot/etc-kernel/postrm.d/initramfs-tools
@@ -0,0 +1,37 @@
+#!/bin/sh
+set -e
+
+version="$1"
+bootopt=""
+
+[ -x /usr/sbin/update-initramfs ] || exit 0
+
+# passing the kernel version is required
+if [ -z "${version}" ]; then
+	echo >&2 "W: initramfs-tools: ${DPKG_MAINTSCRIPT_PACKAGE:-kernel package} did not pass a version number"
+	exit 0
+fi
+
+# exit if custom kernel does not need an initramfs
+if [ "$INITRD" = 'No' ]; then
+	exit 0
+fi
+
+# absolute file name of kernel image may be passed as a second argument;
+# create the initrd in the same directory
+if [ -n "$2" ]; then
+	bootdir=$(dirname "$2")
+	bootopt="-b ${bootdir}"
+fi
+
+# avoid running multiple times
+if [ -n "$DEB_MAINT_PARAMS" ]; then
+	eval set -- "$DEB_MAINT_PARAMS"
+	if [ -z "$1" ] || [ "$1" != "remove" ]; then
+		exit 0
+	fi
+fi
+
+# delete initramfs
+# shellcheck disable=SC2086
+update-initramfs -d -k "${version}" ${bootopt} >&2
diff --git a/straper/db/public/boot/etc-kernel/postrm.d/zz-update-grub b/straper/db/public/boot/etc-kernel/postrm.d/zz-update-grub
new file mode 100755
index 0000000..9521057
--- /dev/null
+++ b/straper/db/public/boot/etc-kernel/postrm.d/zz-update-grub
@@ -0,0 +1,26 @@
+#! /bin/sh
+set -e
+
+command -v update-grub >/dev/null || exit 0
+
+if type systemd-detect-virt >/dev/null 2>&1 &&
+   systemd-detect-virt --quiet --container; then
+	exit 0
+fi
+
+set -- $DEB_MAINT_PARAMS
+mode="${1#\'}"
+mode="${mode%\'}"
+case $0:$mode in
+    # Only run on postinst configure and postrm remove, to avoid wasting
+    # time by calling update-grub multiple times on upgrade and removal.
+    # Also run if we have no DEB_MAINT_PARAMS, in order to work with old
+    # kernel packages.
+    */postinst.d/*:|*/postinst.d/*:configure|*/postrm.d/*:|*/postrm.d/*:remove)
+	if [ -e /boot/grub/grub.cfg ]; then
+		exec update-grub
+	fi
+	;;
+esac
+
+exit 0
diff --git a/straper/db/public/boot/etc-kernel/preinst.d/dkms b/straper/db/public/boot/etc-kernel/preinst.d/dkms
new file mode 100755
index 0000000..bfc175d
--- /dev/null
+++ b/straper/db/public/boot/etc-kernel/preinst.d/dkms
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+# This script is triggered when the kernel (linux-image) package is being
+# installed/upgraded.  We're passed the version of the kernel being installed.
+inst_kern=$1
+
+if command -v dkms > /dev/null; then
+    dkms kernel_preinst -k "$inst_kern"
+fi
+
+exit 0
diff --git a/straper/db/public/boot/etc-kernel/preinst.d/intel-microcode b/straper/db/public/boot/etc-kernel/preinst.d/intel-microcode
new file mode 100755
index 0000000..d98b40c
--- /dev/null
+++ b/straper/db/public/boot/etc-kernel/preinst.d/intel-microcode
@@ -0,0 +1,17 @@
+#!/bin/sh
+#
+# /etc/kernel/preinst.d script for intel-microcode version 3
+# Copyright (C) 2014 Henrique de Moraes Holschuh <hmh@debian.org>
+# Released under the GPL v2 or later license
+#
+# This script makes sure the cpuid module is loaded, before the
+# kernel image has a chance to replace it with a new one that
+# might not be compatible with the current kernel.
+#
+# We need the cpuid module for iucode_tool --scan-system,
+# which is used by the initramfs hook.
+#
+
+grep -q cpu/cpuid /proc/devices || modprobe -q cpuid || true
+
+:
diff --git a/straper/db/public/boot/etc-kernel/prerm.d/dkms b/straper/db/public/boot/etc-kernel/prerm.d/dkms
new file mode 100755
index 0000000..038f68f
--- /dev/null
+++ b/straper/db/public/boot/etc-kernel/prerm.d/dkms
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+# This script is triggered when the kernel (linux-image) package is being
+# removed.  We're passed the version of the kernel being removed.
+inst_kern=$1
+
+if command -v dkms > /dev/null; then
+    dkms kernel_prerm -k "$inst_kern"
+fi
+
+exit 0
diff --git a/straper/db/public/boot/grub-default b/straper/db/public/boot/grub-default
new file mode 100644
index 0000000..88eb3dd
--- /dev/null
+++ b/straper/db/public/boot/grub-default
@@ -0,0 +1,39 @@
+# If you change this file or any /etc/default/grub.d/*.cfg file,
+# run 'update-grub' afterwards to update /boot/grub/grub.cfg.
+# For full documentation of the options in these files, see:
+#   info -f grub -n 'Simple configuration'
+
+GRUB_DEFAULT=0
+GRUB_TIMEOUT=5
+GRUB_DISTRIBUTOR=`( . /etc/os-release && echo ${NAME} )`
+GRUB_CMDLINE_LINUX_DEFAULT="quiet pcie_aspm=off"
+GRUB_CMDLINE_LINUX=""
+
+# If your computer has multiple operating systems installed, then you
+# probably want to run os-prober. However, if your computer is a host
+# for guest OSes installed via LVM or raw disk devices, running
+# os-prober can cause damage to those guest OSes as it mounts
+# filesystems to look for things.
+#GRUB_DISABLE_OS_PROBER=false
+
+# Uncomment to enable BadRAM filtering, modify to suit your needs
+# This works with Linux (no patch required) and with any kernel that obtains
+# the memory map information from GRUB (GNU Mach, kernel of FreeBSD ...)
+#GRUB_BADRAM="0x01234567,0xfefefefe,0x89abcdef,0xefefefef"
+
+# Uncomment to disable graphical terminal
+#GRUB_TERMINAL=console
+
+# The resolution used on graphical terminal
+# note that you can use only modes which your graphic card supports via VBE/GOP/UGA
+# you can see them in real GRUB with the command `videoinfo'
+#GRUB_GFXMODE=640x480
+
+# Uncomment if you don't want GRUB to pass "root=UUID=xxx" parameter to Linux
+#GRUB_DISABLE_LINUX_UUID=true
+
+# Uncomment to disable generation of recovery mode menu entries
+#GRUB_DISABLE_RECOVERY="true"
+
+# Uncomment to get a beep at grub start
+#GRUB_INIT_TUNE="480 440 1"
diff --git a/straper/db/public/boot/grub.d/00_header b/straper/db/public/boot/grub.d/00_header
new file mode 100755
index 0000000..62f6468
--- /dev/null
+++ b/straper/db/public/boot/grub.d/00_header
@@ -0,0 +1,421 @@
+#! /bin/sh
+set -e
+
+# grub-mkconfig helper script.
+# Copyright (C) 2006,2007,2008,2009,2010  Free Software Foundation, Inc.
+#
+# GRUB is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# GRUB is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
+
+prefix="/usr"
+exec_prefix="/usr"
+datarootdir="/usr/share"
+grub_lang=`echo $LANG | cut -d . -f 1`
+grubdir="`echo "/boot/grub" | sed 's,//*,/,g'`"
+quick_boot="0"
+
+export TEXTDOMAIN=grub
+export TEXTDOMAINDIR="${datarootdir}/locale"
+
+. "$pkgdatadir/grub-mkconfig_lib"
+
+# Do this as early as possible, since other commands might depend on it.
+# (e.g. the `loadfont' command might need lvm or raid modules)
+for i in ${GRUB_PRELOAD_MODULES} ; do
+  echo "insmod $i"
+done
+
+if [ "x${GRUB_DEFAULT}" = "x" ] ; then GRUB_DEFAULT=0 ; fi
+if [ "x${GRUB_DEFAULT}" = "xsaved" ] ; then GRUB_DEFAULT='${saved_entry}' ; fi
+if [ "x${GRUB_TIMEOUT}" = "x" ] ; then GRUB_TIMEOUT=5 ; fi
+if [ "x${GRUB_GFXMODE}" = "x" ] ; then GRUB_GFXMODE=auto ; fi
+
+if [ "x${GRUB_DEFAULT_BUTTON}" = "x" ] ; then GRUB_DEFAULT_BUTTON="$GRUB_DEFAULT" ; fi
+if [ "x${GRUB_DEFAULT_BUTTON}" = "xsaved" ] ; then GRUB_DEFAULT_BUTTON='${saved_entry}' ; fi
+if [ "x${GRUB_TIMEOUT_BUTTON}" = "x" ] ; then GRUB_TIMEOUT_BUTTON="$GRUB_TIMEOUT" ; fi
+
+cat << EOF
+if [ -s \$prefix/grubenv ]; then
+  set have_grubenv=true
+  load_env
+fi
+EOF
+if [ "x$GRUB_BUTTON_CMOS_ADDRESS" != "x" ]; then
+    cat <<EOF
+if cmostest $GRUB_BUTTON_CMOS_ADDRESS ; then
+   set default="${GRUB_DEFAULT_BUTTON}"
+elif [ "\${next_entry}" ] ; then
+   set default="\${next_entry}"
+   set next_entry=
+   save_env next_entry
+   set boot_once=true
+else
+   set default="${GRUB_DEFAULT}"
+fi
+EOF
+else
+    cat <<EOF
+if [ "\${next_entry}" ] ; then
+   set default="\${next_entry}"
+   set next_entry=
+   save_env next_entry
+   set boot_once=true
+else
+   set default="${GRUB_DEFAULT}"
+fi
+EOF
+fi
+cat <<EOF
+
+if [ x"\${feature_menuentry_id}" = xy ]; then
+  menuentry_id_option="--id"
+else
+  menuentry_id_option=""
+fi
+
+export menuentry_id_option
+
+if [ "\${prev_saved_entry}" ]; then
+  set saved_entry="\${prev_saved_entry}"
+  save_env saved_entry
+  set prev_saved_entry=
+  save_env prev_saved_entry
+  set boot_once=true
+fi
+
+function savedefault {
+  if [ -z "\${boot_once}" ]; then
+    saved_entry="\${chosen}"
+    save_env saved_entry
+  fi
+}
+EOF
+
+if [ "$quick_boot" = 1 ]; then
+    cat <<EOF
+function recordfail {
+  set recordfail=1
+EOF
+
+  check_writable () {
+    abstractions="$(grub-probe --target=abstraction "${grubdir}")"
+    for abstraction in $abstractions; do
+      case "$abstraction" in
+        diskfilter | lvm)
+          cat <<EOF
+  # GRUB lacks write support for $abstraction, so recordfail support is disabled.
+EOF
+          return 1
+          ;;
+      esac
+    done
+
+    FS="$(grub-probe --target=fs "${grubdir}")"
+    case "$FS" in
+      btrfs | cpiofs | newc | odc | romfs | squash4 | tarfs | zfs)
+	cat <<EOF
+  # GRUB lacks write support for $FS, so recordfail support is disabled.
+EOF
+	return 1
+	;;
+    esac
+
+    cat <<EOF
+  if [ -n "\${have_grubenv}" ]; then if [ -z "\${boot_once}" ]; then save_env recordfail; fi; fi
+EOF
+  }
+
+  if ! check_writable; then
+    recordfail_broken=1
+  fi
+
+  cat <<EOF
+}
+EOF
+fi
+
+cat <<EOF
+function load_video {
+EOF
+if [ -n "${GRUB_VIDEO_BACKEND}" ]; then
+    cat <<EOF
+  insmod ${GRUB_VIDEO_BACKEND}
+EOF
+else
+# If all_video.mod isn't available load all modules available
+# with versions prior to introduction of all_video.mod
+cat <<EOF
+  if [ x\$feature_all_video_module = xy ]; then
+    insmod all_video
+  else
+    insmod efi_gop
+    insmod efi_uga
+    insmod ieee1275_fb
+    insmod vbe
+    insmod vga
+    insmod video_bochs
+    insmod video_cirrus
+  fi
+EOF
+fi
+cat <<EOF
+}
+
+EOF
+
+serial=0;
+gfxterm=0;
+for x in ${GRUB_TERMINAL_INPUT} ${GRUB_TERMINAL_OUTPUT}; do
+    if [ xserial = "x$x" ]; then
+	serial=1;
+    fi
+    if [ xgfxterm = "x$x" ]; then
+	gfxterm=1;
+    fi
+done
+
+if [ "x$serial" = x1 ]; then
+    if [ "x${GRUB_SERIAL_COMMAND}" = "x" ] ; then
+	grub_warn "$(gettext "Requested serial terminal but GRUB_SERIAL_COMMAND is unspecified. Default parameters will be used.")"
+	GRUB_SERIAL_COMMAND=serial
+    fi
+    echo "${GRUB_SERIAL_COMMAND}"
+fi
+
+if [ "x$gfxterm" = x1 ]; then
+    if [ -n "$GRUB_FONT" ] ; then
+       # Make the font accessible
+       prepare_grub_to_access_device `${grub_probe} --target=device "${GRUB_FONT}"`
+    cat << EOF
+if loadfont `make_system_path_relative_to_its_root "${GRUB_FONT}"` ; then
+EOF
+    else
+	for dir in "${pkgdatadir}" "`echo '/boot/grub' | sed "s,//*,/,g"`" /usr/share/grub ; do
+	    for basename in unicode unifont ascii; do
+		path="${dir}/${basename}.pf2"
+		if is_path_readable_by_grub "${path}" > /dev/null ; then
+		    font_path="${path}"
+		else
+		    continue
+		fi
+		break 2
+	    done
+	done
+	if [ -n "${font_path}" ] ; then
+    cat << EOF
+if [ x\$feature_default_font_path = xy ] ; then
+   font=unicode
+else
+EOF
+                # Make the font accessible
+		prepare_grub_to_access_device `${grub_probe} --target=device "${font_path}"`
+    cat << EOF
+    font="`make_system_path_relative_to_its_root "${font_path}"`"
+fi
+
+if loadfont \$font ; then
+EOF
+	    else
+    cat << EOF
+if loadfont unicode ; then
+EOF
+	    fi
+	fi
+
+    cat << EOF
+  set gfxmode=${GRUB_GFXMODE}
+  load_video
+  insmod gfxterm
+EOF
+
+# Gettext variables and module
+if [ "x${grub_lang}" != "xC" ] && [ "x${LANG}" != "xPOSIX" ] && [ "x${LANG}" != "x" ]; then
+  cat << EOF
+  set locale_dir=\$prefix/locale
+  set lang=${grub_lang}
+  insmod gettext
+EOF
+fi
+
+cat <<EOF
+fi
+EOF
+fi
+
+case x${GRUB_TERMINAL_INPUT} in
+  x)
+    # Just use the native terminal
+  ;;
+  x*)
+    cat << EOF
+terminal_input ${GRUB_TERMINAL_INPUT}
+EOF
+  ;;
+esac
+
+case x${GRUB_TERMINAL_OUTPUT} in
+  x)
+    # Just use the native terminal
+  ;;
+  x*)
+    cat << EOF
+terminal_output ${GRUB_TERMINAL_OUTPUT}
+EOF
+  ;;
+esac
+
+if [ "x$gfxterm" = x1 ]; then
+    if [ "x$GRUB_THEME" != x ] && [ -f "$GRUB_THEME" ] \
+	&& is_path_readable_by_grub "$GRUB_THEME"; then
+	gettext_printf "Found theme: %s\n" "$GRUB_THEME" >&2
+
+	prepare_grub_to_access_device `${grub_probe} --target=device "$GRUB_THEME"`
+	cat << EOF
+insmod gfxmenu
+EOF
+	themedir="`dirname "$GRUB_THEME"`"
+	for x in "$themedir"/*.pf2 "$themedir"/f/*.pf2; do
+	    if [ -f "$x" ]; then
+		cat << EOF
+loadfont (\$root)`make_system_path_relative_to_its_root $x`
+EOF
+	    fi
+	done
+	if [ x"`echo "$themedir"/*.jpg`" != x"$themedir/*.jpg" ] || [ x"`echo "$themedir"/*.jpeg`" != x"$themedir/*.jpeg" ]; then
+	    cat << EOF
+insmod jpeg
+EOF
+	fi
+	if [ x"`echo "$themedir"/*.png`" != x"$themedir/*.png" ]; then
+	    cat << EOF
+insmod png
+EOF
+	fi
+	if [ x"`echo "$themedir"/*.tga`" != x"$themedir/*.tga" ]; then
+	    cat << EOF
+insmod tga
+EOF
+	fi
+	    
+	cat << EOF
+set theme=(\$root)`make_system_path_relative_to_its_root $GRUB_THEME`
+export theme
+EOF
+    elif [ "x$GRUB_BACKGROUND" != x ] && [ -f "$GRUB_BACKGROUND" ] \
+	    && is_path_readable_by_grub "$GRUB_BACKGROUND"; then
+	gettext_printf "Found background: %s\n" "$GRUB_BACKGROUND" >&2
+	case "$GRUB_BACKGROUND" in 
+	    *.png)         reader=png ;;
+	    *.tga)         reader=tga ;;
+	    *.jpg|*.jpeg)  reader=jpeg ;;
+	    *)             gettext "Unsupported image format" >&2; echo >&2; exit 1 ;;
+	esac
+	prepare_grub_to_access_device `${grub_probe} --target=device "$GRUB_BACKGROUND"`
+	cat << EOF
+insmod $reader
+background_image -m stretch `make_system_path_relative_to_its_root "$GRUB_BACKGROUND"`
+EOF
+    fi
+fi
+
+make_timeout ()
+{
+    cat << EOF
+if [ "\${recordfail}" = 1 ] ; then
+  set timeout=${GRUB_RECORDFAIL_TIMEOUT:-30}
+else
+EOF
+    if [ "x${3}" != "x" ] ; then
+	timeout="${2}"
+	style="${3}"
+    elif [ "x${1}" != "x" ] && \
+	 ([ "$quick_boot" = 1 ] || [ "x${1}" != "x0" ]) ; then
+	# Handle the deprecated GRUB_HIDDEN_TIMEOUT scheme.
+	timeout="${1}"
+	if [ "x${2}" != "x0" ] ; then
+	    grub_warn "$(gettext "Setting GRUB_TIMEOUT to a non-zero value when GRUB_HIDDEN_TIMEOUT is set is no longer supported.")"
+	fi
+	if [ "x${GRUB_HIDDEN_TIMEOUT_QUIET}" = "xtrue" ] ; then
+	    style="hidden"
+	    verbose=
+	else
+	    style="countdown"
+	    verbose=" --verbose"
+	fi
+    else
+	# No hidden timeout, so treat as GRUB_TIMEOUT_STYLE=menu
+	timeout="${2}"
+	style="menu"
+    fi
+    cat << EOF
+  if [ x\$feature_timeout_style = xy ] ; then
+    set timeout_style=${style}
+    set timeout=${timeout}
+EOF
+    if [ "x${style}" = "xmenu" ] ; then
+	cat << EOF
+  # Fallback normal timeout code in case the timeout_style feature is
+  # unavailable.
+  else
+    set timeout=${timeout}
+EOF
+    else
+	cat << EOF
+  # Fallback hidden-timeout code in case the timeout_style feature is
+  # unavailable.
+  elif sleep${verbose} --interruptible ${timeout} ; then
+    set timeout=0
+EOF
+    fi
+    cat << EOF
+  fi
+fi
+EOF
+if [ "$recordfail_broken" = 1 ]; then
+  cat << EOF
+if [ \$grub_platform = efi ]; then
+  set timeout=${GRUB_RECORDFAIL_TIMEOUT:-30}
+  if [ x\$feature_timeout_style = xy ] ; then
+    set timeout_style=menu
+  fi
+fi
+EOF
+fi
+}
+
+if [ "x$GRUB_BUTTON_CMOS_ADDRESS" != "x" ]; then
+    cat <<EOF
+if cmostest $GRUB_BUTTON_CMOS_ADDRESS ; then
+EOF
+make_timeout "${GRUB_HIDDEN_TIMEOUT_BUTTON}" "${GRUB_TIMEOUT_BUTTON}" "${GRUB_TIMEOUT_STYLE_BUTTON}"
+echo else
+make_timeout "${GRUB_HIDDEN_TIMEOUT}" "${GRUB_TIMEOUT}" "${GRUB_TIMEOUT_STYLE}"
+echo fi
+else
+make_timeout "${GRUB_HIDDEN_TIMEOUT}" "${GRUB_TIMEOUT}" "${GRUB_TIMEOUT_STYLE}"
+fi
+
+if [ "x$GRUB_BUTTON_CMOS_ADDRESS" != "x" ] && [ "x$GRUB_BUTTON_CMOS_CLEAN" = "xyes" ]; then
+    cat <<EOF
+cmosclean $GRUB_BUTTON_CMOS_ADDRESS
+EOF
+fi
+
+# Play an initial tune
+if [ "x${GRUB_INIT_TUNE}" != "x" ] ; then
+  echo "play ${GRUB_INIT_TUNE}"
+fi
+
+if [ "x${GRUB_BADRAM}" != "x" ] ; then
+  echo "badram ${GRUB_BADRAM}"
+fi
diff --git a/straper/db/public/boot/grub.d/05_debian_theme b/straper/db/public/boot/grub.d/05_debian_theme
new file mode 100755
index 0000000..c2dee25
--- /dev/null
+++ b/straper/db/public/boot/grub.d/05_debian_theme
@@ -0,0 +1,199 @@
+#!/bin/sh
+set -e
+
+# grub-mkconfig helper script.
+# Copyright (C) 2010  Alexander Kurtz <kurtz.alex@googlemail.com>
+#
+# GRUB is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# GRUB is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
+
+# Include the GRUB helper library for grub-mkconfig.
+. /usr/share/grub/grub-mkconfig_lib
+
+# We want to work in /boot/grub/ only.
+test -d /boot/grub; cd /boot/grub
+
+# Set the location of a possibly necessary cache file for the background image.
+# NOTE: This MUST BE A DOTFILE to avoid confusing it with user-defined images.
+BACKGROUND_CACHE=".background_cache"
+
+set_default_theme(){
+	case $GRUB_DISTRIBUTOR in
+		Tanglu|Ubuntu|Kubuntu)
+			# Set a monochromatic theme for Tanglu/Ubuntu.
+			echo "${1}set menu_color_normal=white/black"
+			echo "${1}set menu_color_highlight=black/light-gray"
+
+			if [ -e /usr/share/plymouth/themes/default.grub ]; then
+				sed "s/^/${1}/" /usr/share/plymouth/themes/default.grub
+			fi
+			# For plymouth backward compatibility. Can be removed
+			# after xenial.
+			if [ -e /lib/plymouth/themes/default.grub ]; then
+				sed "s/^/${1}/" /lib/plymouth/themes/default.grub
+			fi
+			;;
+		*)
+			# Set the traditional Debian blue theme.
+			echo "${1}set menu_color_normal=cyan/blue"
+			echo "${1}set menu_color_highlight=white/blue"
+			;;
+	esac
+}
+
+module_available(){
+	local module
+	for module in "${1}.mod" */"${1}.mod"; do
+		if [ -f "${module}" ]; then
+			return 0
+		fi
+	done
+	return 1
+}
+
+set_background_image(){
+	# Step #1: Search all available output modes ...
+	local output
+	for output in ${GRUB_TERMINAL_OUTPUT}; do
+		if [ "x$output" = "xgfxterm" ]; then
+			break
+		fi
+	done
+
+	# ... and check if we are able to display a background image at all.
+	if ! [ "x${output}" = "xgfxterm" ]; then
+		return 1
+	fi
+
+	# Step #2: Check if the specified background image exists.
+	if ! [ -f "${1}" ]; then
+		return 2
+	fi
+
+	# Step #3: Search the correct GRUB module for our background image.
+	local reader
+	case "${1}" in
+		*.jpg|*.JPG|*.jpeg|*.JPEG) reader="jpeg";;
+		*.png|*.PNG) reader="png";;
+		*.tga|*.TGA) reader="tga";;
+		*) return 3;; # Unknown image type.
+	esac
+
+	# Step #4: Check if the necessary GRUB module is available.
+	if ! module_available "${reader}"; then
+		return 4
+	fi
+
+	# Step #5: Check if GRUB can read the background image directly and
+	# it is in the same filesystem as /boot/grub.
+	# If so, we can remove the cache file (if any). Otherwise the background
+	# image needs to be cached under /boot/grub/.
+	if is_path_readable_by_grub "${1}" &&
+	   [ "`${grub_probe} --target=device "${1}"`" = "`${grub_probe} --target=device .`" ]; then
+		rm --force "${BACKGROUND_CACHE}.jpeg" \
+			"${BACKGROUND_CACHE}.png" "${BACKGROUND_CACHE}.tga"
+	elif cp "${1}" "${BACKGROUND_CACHE}.${reader}"; then
+		set -- "${BACKGROUND_CACHE}.${reader}" "${2}" "${3}"
+	else
+		return 5
+	fi
+
+	# Step #6: Prepare GRUB to read the background image.
+	if ! prepare_grub_to_access_device "`${grub_probe} --target=device "${1}"`"; then
+		return 6
+	fi
+
+	# Step #7: Everything went fine, print out a message to stderr ...
+	echo "Found background image: ${1}" >&2
+
+	# ... and write our configuration snippet to stdout. Use the colors
+	# desktop-base specified. If we're using a user-defined background, use
+	# the default colors since we've got no idea how the image looks like.
+	# If loading the background image fails, use the default theme.
+	echo "insmod ${reader}"
+	echo "if background_image `make_system_path_relative_to_its_root "${1}"`; then"
+	if [ -n "${2}" ]; then
+		echo "  set color_normal=${2}"
+	fi
+	if [ -n "${3}" ]; then
+		echo "  set color_highlight=${3}"
+	fi
+	if [ -z "${2}" ] && [ -z "${3}" ]; then
+		echo "  true"
+	fi
+	echo "else"
+	set_default_theme "  "
+	echo "fi"
+}
+
+# Earlier versions of grub-pc copied the default background image to /boot/grub
+# during postinst. Remove those obsolete images if they haven't been touched by
+# the user. They are still available under /usr/share/images/desktop-base/ if
+# desktop-base is installed.
+while read checksum background; do
+	if [ -f "${background}" ] && [ "x`sha1sum "${background}"`" = "x${checksum}  ${background}" ]; then
+		echo "Removing old background image: ${background}" >&2
+		rm "${background}"
+	fi
+done <<EOF
+648ee65dd0c157a69b019a5372cbcfea4fc754a5  debian-blueish-wallpaper-640x480.png
+0431e97a6c661084c59676c4baeeb8c2f602edb8  debian-blueish-wallpaper-640x480.png
+968ecf6696c5638cfe80e8e70aba239526270864  debian-blueish-wallpaper-640x480.tga
+11143e8c92a073401de0b0fd42d0c052af4ccd9b  moreblue-orbit-grub.png
+d00d5e505ab63f2d53fa880bfac447e2d3bb197c  moreblue-orbit-grub.png
+f5b12c1009ec0a3b029185f6b66cd0d7e5611019  moreblue-orbit-grub.png
+EOF
+
+# Include the configuration of desktop-base if available.
+if [ -f "/usr/share/desktop-base/grub_background.sh" ]; then
+	. "/usr/share/desktop-base/grub_background.sh"
+fi
+
+# First check whether the user has specified a background image explicitly.
+# If so, try to use it. Don't try the other possibilities in that case
+# (#608263).
+if [ -n "${GRUB_BACKGROUND+x}" ]; then
+	set_background_image "${GRUB_BACKGROUND}" || set_default_theme
+	exit 0
+fi
+
+# Next search for pictures the user put into /boot/grub/ and use the first one.
+for background in *.jpg *.JPG *.jpeg *.JPEG *.png *.PNG *.tga *.TGA; do
+	if set_background_image "${background}"; then
+		exit 0
+	fi
+done
+
+# Next try to use the background image and colors specified by desktop-base.
+if set_background_image "${WALLPAPER}" "${COLOR_NORMAL}" "${COLOR_HIGHLIGHT}"; then
+	exit 0
+fi
+
+# If we haven't found a background image yet, use the default from desktop-base.
+case $GRUB_DISTRIBUTOR in
+	Ubuntu|Kubuntu)
+		;;
+	Tanglu)
+		if set_background_image "/usr/share/images/grub/grub.png"; then
+			exit 0
+		fi
+		;;
+	*)
+		if set_background_image "/usr/share/images/desktop-base/desktop-grub.png"; then
+			exit 0
+		fi
+		;;
+esac
+
+# Finally, if all of the above fails, use the default theme.
+set_default_theme
diff --git a/straper/db/public/boot/grub.d/10_linux b/straper/db/public/boot/grub.d/10_linux
new file mode 100755
index 0000000..42bffb1
--- /dev/null
+++ b/straper/db/public/boot/grub.d/10_linux
@@ -0,0 +1,410 @@
+#! /bin/sh
+set -e
+
+# grub-mkconfig helper script.
+# Copyright (C) 2006,2007,2008,2009,2010  Free Software Foundation, Inc.
+#
+# GRUB is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# GRUB is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
+
+prefix="/usr"
+exec_prefix="/usr"
+datarootdir="/usr/share"
+ubuntu_recovery="0"
+quiet_boot="0"
+quick_boot="0"
+gfxpayload_dynamic="0"
+vt_handoff="0"
+
+. "$pkgdatadir/grub-mkconfig_lib"
+
+export TEXTDOMAIN=grub
+export TEXTDOMAINDIR="${datarootdir}/locale"
+
+CLASS="--class gnu-linux --class gnu --class os"
+
+if [ "x${GRUB_DISTRIBUTOR}" = "x" ] ; then
+  OS=GNU/Linux
+else
+  case ${GRUB_DISTRIBUTOR} in
+    Ubuntu|Kubuntu|*GNU/Linux)
+      OS="${GRUB_DISTRIBUTOR}"
+      ;;
+    *)
+      OS="${GRUB_DISTRIBUTOR} GNU/Linux"
+      ;;
+  esac
+  CLASS="--class $(echo ${GRUB_DISTRIBUTOR} | tr 'A-Z' 'a-z' | cut -d' ' -f1|LC_ALL=C sed 's,[^[:alnum:]_],_,g') ${CLASS}"
+fi
+
+# loop-AES arranges things so that /dev/loop/X can be our root device, but
+# the initrds that Linux uses don't like that.
+case ${GRUB_DEVICE} in
+  /dev/loop/*|/dev/loop[0-9])
+    GRUB_DEVICE=`losetup ${GRUB_DEVICE} | sed -e "s/^[^(]*(\([^)]\+\)).*/\1/"`
+    # We can't cope with devices loop-mounted from files here.
+    case ${GRUB_DEVICE} in
+      /dev/*) ;;
+      *) exit 0 ;;
+    esac
+  ;;
+esac
+
+if [ -x /lib/recovery-mode/recovery-menu ]; then
+    : ${GRUB_CMDLINE_LINUX_RECOVERY:=recovery}
+else
+    : ${GRUB_CMDLINE_LINUX_RECOVERY:=single}
+fi
+
+# Default to disabling partition uuid support to maintian compatibility with
+# older kernels.
+: ${GRUB_DISABLE_LINUX_PARTUUID=true}
+
+# btrfs may reside on multiple devices. We cannot pass them as value of root= parameter
+# and mounting btrfs requires user space scanning, so force UUID in this case.
+if ( [ "x${GRUB_DEVICE_UUID}" = "x" ] && [ "x${GRUB_DEVICE_PARTUUID}" = "x" ] ) \
+    || ( [ "x${GRUB_DISABLE_LINUX_UUID}" = "xtrue" ] \
+	&& [ "x${GRUB_DISABLE_LINUX_PARTUUID}" = "xtrue" ] ) \
+    || ( ! test -e "/dev/disk/by-uuid/${GRUB_DEVICE_UUID}" \
+	&& ! test -e "/dev/disk/by-partuuid/${GRUB_DEVICE_PARTUUID}" ) \
+    || ( test -e "${GRUB_DEVICE}" && uses_abstraction "${GRUB_DEVICE}" lvm ); then
+  LINUX_ROOT_DEVICE=${GRUB_DEVICE}
+elif [ "x${GRUB_DEVICE_UUID}" = "x" ] \
+    || [ "x${GRUB_DISABLE_LINUX_UUID}" = "xtrue" ]; then
+  LINUX_ROOT_DEVICE=PARTUUID=${GRUB_DEVICE_PARTUUID}
+else
+  LINUX_ROOT_DEVICE=UUID=${GRUB_DEVICE_UUID}
+fi
+
+case x"$GRUB_FS" in
+    xbtrfs)
+	rootsubvol="`make_system_path_relative_to_its_root /`"
+	rootsubvol="${rootsubvol#/}"
+	if [ "x${rootsubvol}" != x ]; then
+	    GRUB_CMDLINE_LINUX="rootflags=subvol=${rootsubvol} ${GRUB_CMDLINE_LINUX}"
+	fi;;
+    xzfs)
+	rpool=`${grub_probe} --device ${GRUB_DEVICE} --target=fs_label 2>/dev/null || zdb -l ${GRUB_DEVICE} | awk -F \' '/ name/ { print $2 }'`
+	bootfs="`make_system_path_relative_to_its_root / | sed -e "s,@$,,"`"
+	LINUX_ROOT_DEVICE="ZFS=${rpool}${bootfs%/}"
+	;;
+esac
+
+title_correction_code=
+
+if [ "$ubuntu_recovery" = 1 ]; then
+    GRUB_CMDLINE_LINUX_RECOVERY="$GRUB_CMDLINE_LINUX_RECOVERY nomodeset"
+fi
+
+if [ "$vt_handoff" = 1 ]; then
+  for word in $GRUB_CMDLINE_LINUX_DEFAULT; do
+    if [ "$word" = splash ]; then
+      GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT \$vt_handoff"
+    fi
+  done
+fi
+
+linux_entry ()
+{
+  os="$1"
+  version="$2"
+  type="$3"
+  args="$4"
+
+  if [ -z "$boot_device_id" ]; then
+      boot_device_id="$(grub_get_device_id "${GRUB_DEVICE}")"
+  fi
+  if [ x$type != xsimple ] ; then
+      case $type in
+	  recovery)
+	      title="$(gettext_printf "%s, with Linux %s (%s)" "${os}" "${version}" "$(gettext "${GRUB_RECOVERY_TITLE}")")" ;;
+	  *)
+	      title="$(gettext_printf "%s, with Linux %s" "${os}" "${version}")" ;;
+      esac
+      if [ x"$title" = x"$GRUB_ACTUAL_DEFAULT" ] || [ x"Previous Linux versions>$title" = x"$GRUB_ACTUAL_DEFAULT" ]; then
+	  replacement_title="$(echo "Advanced options for ${OS}" | sed 's,>,>>,g')>$(echo "$title" | sed 's,>,>>,g')"
+	  quoted="$(echo "$GRUB_ACTUAL_DEFAULT" | grub_quote)"
+	  title_correction_code="${title_correction_code}if [ \"x\$default\" = '$quoted' ]; then default='$(echo "$replacement_title" | grub_quote)'; fi;"
+	  grub_warn "$(gettext_printf "Please don't use old title \`%s' for GRUB_DEFAULT, use \`%s' (for versions before 2.00) or \`%s' (for 2.00 or later)" "$GRUB_ACTUAL_DEFAULT" "$replacement_title" "gnulinux-advanced-$boot_device_id>gnulinux-$version-$type-$boot_device_id")"
+      fi
+      echo "menuentry '$(echo "$title" | grub_quote)' ${CLASS} \$menuentry_id_option 'gnulinux-$version-$type-$boot_device_id' {" | sed "s/^/$submenu_indentation/"
+  else
+      echo "menuentry '$(echo "$os" | grub_quote)' ${CLASS} \$menuentry_id_option 'gnulinux-simple-$boot_device_id' {" | sed "s/^/$submenu_indentation/"
+  fi      
+  if [ "$quick_boot" = 1 ]; then
+      echo "	recordfail" | sed "s/^/$submenu_indentation/"
+  fi
+  if [ x$type != xrecovery ] ; then
+      save_default_entry | grub_add_tab
+  fi
+
+  # Use ELILO's generic "efifb" when it's known to be available.
+  # FIXME: We need an interface to select vesafb in case efifb can't be used.
+  if [ "x$GRUB_GFXPAYLOAD_LINUX" = x ]; then
+      echo "	load_video" | sed "s/^/$submenu_indentation/"
+  else
+      if [ "x$GRUB_GFXPAYLOAD_LINUX" != xtext ]; then
+	  echo "	load_video" | sed "s/^/$submenu_indentation/"
+      fi
+  fi
+  if ([ "$ubuntu_recovery" = 0 ] || [ x$type != xrecovery ]) && \
+     ([ "x$GRUB_GFXPAYLOAD_LINUX" != x ] || [ "$gfxpayload_dynamic" = 1 ]); then
+      echo "	gfxmode \$linux_gfx_mode" | sed "s/^/$submenu_indentation/"
+  fi
+
+  echo "	insmod gzio" | sed "s/^/$submenu_indentation/"
+  echo "	if [ x\$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi" | sed "s/^/$submenu_indentation/"
+
+  if [ x$dirname = x/ ]; then
+    if [ -z "${prepare_root_cache}" ]; then
+      prepare_root_cache="$(prepare_grub_to_access_device ${GRUB_DEVICE} | grub_add_tab)"
+    fi
+    printf '%s\n' "${prepare_root_cache}" | sed "s/^/$submenu_indentation/"
+  else
+    if [ -z "${prepare_boot_cache}" ]; then
+      prepare_boot_cache="$(prepare_grub_to_access_device ${GRUB_DEVICE_BOOT} | grub_add_tab)"
+    fi
+    printf '%s\n' "${prepare_boot_cache}" | sed "s/^/$submenu_indentation/"
+  fi
+  if [ x"$quiet_boot" = x0 ] || [ x"$type" != xsimple ]; then
+    message="$(gettext_printf "Loading Linux %s ..." ${version})"
+    sed "s/^/$submenu_indentation/" << EOF
+	echo	'$(echo "$message" | grub_quote)'
+EOF
+  fi
+  sed "s/^/$submenu_indentation/" << EOF
+	linux	${rel_dirname}/${basename} root=${linux_root_device_thisversion} ro ${args}
+EOF
+  if test -n "${initrd}" ; then
+    # TRANSLATORS: ramdisk isn't identifier. Should be translated.
+    if [ x"$quiet_boot" = x0 ] || [ x"$type" != xsimple ]; then
+      message="$(gettext_printf "Loading initial ramdisk ...")"
+      sed "s/^/$submenu_indentation/" << EOF
+	echo	'$(echo "$message" | grub_quote)'
+EOF
+    fi
+    initrd_path=
+    for i in ${initrd}; do
+      initrd_path="${initrd_path} ${rel_dirname}/${i}"
+    done
+    sed "s/^/$submenu_indentation/" << EOF
+	initrd	$(echo $initrd_path)
+EOF
+  fi
+  sed "s/^/$submenu_indentation/" << EOF
+}
+EOF
+}
+
+machine=`uname -m`
+case "x$machine" in
+    xi?86 | xx86_64)
+	list=
+	for i in /boot/vmlinuz-* /vmlinuz-* /boot/kernel-* ; do
+	    if grub_file_is_not_garbage "$i" ; then list="$list $i" ; fi
+	done ;;
+    *) 
+	list=
+	for i in /boot/vmlinuz-* /boot/vmlinux-* /vmlinuz-* /vmlinux-* /boot/kernel-* ; do
+                  if grub_file_is_not_garbage "$i" ; then list="$list $i" ; fi
+	done ;;
+esac
+
+case "$machine" in
+    i?86) GENKERNEL_ARCH="x86" ;;
+    mips|mips64) GENKERNEL_ARCH="mips" ;;
+    mipsel|mips64el) GENKERNEL_ARCH="mipsel" ;;
+    arm*) GENKERNEL_ARCH="arm" ;;
+    *) GENKERNEL_ARCH="$machine" ;;
+esac
+
+case "$GENKERNEL_ARCH" in
+  x86*) GRUB_CMDLINE_LINUX_RECOVERY="$GRUB_CMDLINE_LINUX_RECOVERY dis_ucode_ldr";;
+esac
+
+prepare_boot_cache=
+prepare_root_cache=
+boot_device_id=
+title_correction_code=
+
+cat << 'EOF'
+function gfxmode {
+	set gfxpayload="${1}"
+EOF
+if [ "$vt_handoff" = 1 ]; then
+  cat << 'EOF'
+	if [ "${1}" = "keep" ]; then
+		set vt_handoff=vt.handoff=7
+	else
+		set vt_handoff=
+	fi
+EOF
+fi
+cat << EOF
+}
+EOF
+
+# Use ELILO's generic "efifb" when it's known to be available.
+# FIXME: We need an interface to select vesafb in case efifb can't be used.
+if [ "x$GRUB_GFXPAYLOAD_LINUX" != x ] || [ "$gfxpayload_dynamic" = 0 ]; then
+  echo "set linux_gfx_mode=$GRUB_GFXPAYLOAD_LINUX"
+else
+  cat << EOF
+if [ "\${recordfail}" != 1 ]; then
+  if [ -e \${prefix}/gfxblacklist.txt ]; then
+    if [ \${grub_platform} != pc ]; then
+      set linux_gfx_mode=keep
+    elif hwmatch \${prefix}/gfxblacklist.txt 3; then
+      if [ \${match} = 0 ]; then
+        set linux_gfx_mode=keep
+      else
+        set linux_gfx_mode=text
+      fi
+    else
+      set linux_gfx_mode=text
+    fi
+  else
+    set linux_gfx_mode=keep
+  fi
+else
+  set linux_gfx_mode=text
+fi
+EOF
+fi
+cat << EOF
+export linux_gfx_mode
+EOF
+
+# Extra indentation to add to menu entries in a submenu. We're not in a submenu
+# yet, so it's empty. In a submenu it will be equal to '\t' (one tab).
+submenu_indentation=""
+
+# Perform a reverse version sort on the entire list.
+# Temporarily replace the '.old' suffix by ' 1' and append ' 2' for all
+# other files to order the '.old' files after their non-old counterpart
+# in reverse-sorted order.
+
+reverse_sorted_list=$(echo $list | tr ' ' '\n' | sed -e 's/\.old$/ 1/; / 1$/! s/$/ 2/' | version_sort -r | sed -e 's/ 1$/.old/; s/ 2$//')
+
+if [ "x$GRUB_TOP_LEVEL" != x ]; then
+  reverse_sorted_list=$(grub_move_to_front "$GRUB_TOP_LEVEL" ${reverse_sorted_list})
+fi
+
+is_top_level=true
+for linux in ${reverse_sorted_list}; do
+  gettext_printf "Found linux image: %s\n" "$linux" >&2
+  basename=`basename $linux`
+  dirname=`dirname $linux`
+  rel_dirname=`make_system_path_relative_to_its_root $dirname`
+  version=`echo $basename | sed -e "s,^[^0-9]*-,,g"`
+  alt_version=`echo $version | sed -e "s,\.old$,,g"`
+  linux_root_device_thisversion="${LINUX_ROOT_DEVICE}"
+
+  initrd_early=
+  for i in ${GRUB_EARLY_INITRD_LINUX_STOCK} \
+	   ${GRUB_EARLY_INITRD_LINUX_CUSTOM}; do
+    if test -e "${dirname}/${i}" ; then
+      initrd_early="${initrd_early} ${i}"
+    fi
+  done
+
+  initrd_real=
+  for i in "initrd.img-${version}" "initrd-${version}.img" \
+	   "initrd-${alt_version}.img.old" "initrd-${version}.gz" \
+	   "initrd-${alt_version}.gz.old" "initrd-${version}" \
+	   "initramfs-${version}.img" "initramfs-${alt_version}.img.old" \
+	   "initrd.img-${alt_version}" "initrd-${alt_version}.img" \
+	   "initrd-${alt_version}" "initramfs-${alt_version}.img" \
+	   "initramfs-genkernel-${version}" \
+	   "initramfs-genkernel-${alt_version}" \
+	   "initramfs-genkernel-${GENKERNEL_ARCH}-${version}" \
+	   "initramfs-genkernel-${GENKERNEL_ARCH}-${alt_version}"; do
+    if test -e "${dirname}/${i}" ; then
+      initrd_real="${i}"
+      break
+    fi
+  done
+
+  initrd=
+  if test -n "${initrd_early}" || test -n "${initrd_real}"; then
+    initrd="${initrd_early} ${initrd_real}"
+
+    initrd_display=
+    for i in ${initrd}; do
+      initrd_display="${initrd_display} ${dirname}/${i}"
+    done
+    gettext_printf "Found initrd image: %s\n" "$(echo $initrd_display)" >&2
+  fi
+
+  config=
+  for i in "${dirname}/config-${version}" "${dirname}/config-${alt_version}" "/etc/kernels/kernel-config-${version}" ; do
+    if test -e "${i}" ; then
+      config="${i}"
+      break
+    fi
+  done
+
+  initramfs=
+  if test -n "${config}" ; then
+      initramfs=`grep CONFIG_INITRAMFS_SOURCE= "${config}" | cut -f2 -d= | tr -d \"`
+  fi
+
+  if test -z "${initramfs}" && test -z "${initrd_real}" ; then
+    # "UUID=" and "ZFS=" magic is parsed by initrd or initramfs.  Since there's
+    # no initrd or builtin initramfs, it can't work here.
+    if [ "x${GRUB_DEVICE_PARTUUID}" = "x" ] \
+	|| [ "x${GRUB_DISABLE_LINUX_PARTUUID}" = "xtrue" ]; then
+
+	linux_root_device_thisversion=${GRUB_DEVICE}
+    else
+	linux_root_device_thisversion=PARTUUID=${GRUB_DEVICE_PARTUUID}
+    fi
+  fi
+
+  # The GRUB_DISABLE_SUBMENU option used to be different than others since it was
+  # mentioned in the documentation that has to be set to 'y' instead of 'true' to
+  # enable it. This caused a lot of confusion to users that set the option to 'y',
+  # 'yes' or 'true'. This was fixed but all of these values must be supported now.
+  if [ "x${GRUB_DISABLE_SUBMENU}" = xyes ] || [ "x${GRUB_DISABLE_SUBMENU}" = xy ]; then
+    GRUB_DISABLE_SUBMENU="true"
+  fi
+
+  if [ "x$is_top_level" = xtrue ] && [ "x${GRUB_DISABLE_SUBMENU}" != xtrue ]; then
+    linux_entry "${OS}" "${version}" simple \
+    "${GRUB_CMDLINE_LINUX} ${GRUB_CMDLINE_LINUX_DEFAULT}"
+
+    submenu_indentation="$grub_tab"
+    
+    if [ -z "$boot_device_id" ]; then
+	boot_device_id="$(grub_get_device_id "${GRUB_DEVICE}")"
+    fi
+    # TRANSLATORS: %s is replaced with an OS name
+    echo "submenu '$(gettext_printf "Advanced options for %s" "${OS}" | grub_quote)' \$menuentry_id_option 'gnulinux-advanced-$boot_device_id' {"
+    is_top_level=false
+  fi
+
+  linux_entry "${OS}" "${version}" advanced \
+              "${GRUB_CMDLINE_LINUX} ${GRUB_CMDLINE_LINUX_DEFAULT}"
+  if [ "x${GRUB_DISABLE_RECOVERY}" != "xtrue" ]; then
+    linux_entry "${OS}" "${version}" recovery \
+                "${GRUB_CMDLINE_LINUX_RECOVERY} ${GRUB_CMDLINE_LINUX}"
+  fi
+done
+
+# If at least one kernel was found, then we need to
+# add a closing '}' for the submenu command.
+if [ x"$is_top_level" != xtrue ]; then
+  echo '}'
+fi
+
+echo "$title_correction_code"
diff --git a/straper/db/public/boot/grub.d/20_linux_xen b/straper/db/public/boot/grub.d/20_linux_xen
new file mode 100755
index 0000000..8887f44
--- /dev/null
+++ b/straper/db/public/boot/grub.d/20_linux_xen
@@ -0,0 +1,385 @@
+#! /bin/sh
+set -e
+
+# grub-mkconfig helper script.
+# Copyright (C) 2006,2007,2008,2009,2010  Free Software Foundation, Inc.
+#
+# GRUB is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# GRUB is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
+
+prefix="/usr"
+exec_prefix="/usr"
+datarootdir="/usr/share"
+
+. "$pkgdatadir/grub-mkconfig_lib"
+
+export TEXTDOMAIN=grub
+export TEXTDOMAINDIR="${datarootdir}/locale"
+
+CLASS="--class gnu-linux --class gnu --class os --class xen"
+
+if [ "x${GRUB_DISTRIBUTOR}" = "x" ] ; then
+  OS=GNU/Linux
+else
+  OS="${GRUB_DISTRIBUTOR} GNU/Linux"
+  CLASS="--class $(echo ${GRUB_DISTRIBUTOR} | tr 'A-Z' 'a-z' | cut -d' ' -f1|LC_ALL=C sed 's,[^[:alnum:]_],_,g') ${CLASS}"
+fi
+
+# loop-AES arranges things so that /dev/loop/X can be our root device, but
+# the initrds that Linux uses don't like that.
+case ${GRUB_DEVICE} in
+  /dev/loop/*|/dev/loop[0-9])
+    GRUB_DEVICE=`losetup ${GRUB_DEVICE} | sed -e "s/^[^(]*(\([^)]\+\)).*/\1/"`
+    # We can't cope with devices loop-mounted from files here.
+    case ${GRUB_DEVICE} in
+      /dev/*) ;;
+      *) exit 0 ;;
+    esac
+  ;;
+esac
+
+: ${GRUB_CMDLINE_LINUX_RECOVERY:=single}
+
+# Default to disabling partition uuid support to maintian compatibility with
+# older kernels.
+: ${GRUB_DISABLE_LINUX_PARTUUID=true}
+
+# btrfs may reside on multiple devices. We cannot pass them as value of root= parameter
+# and mounting btrfs requires user space scanning, so force UUID in this case.
+if ( [ "x${GRUB_DEVICE_UUID}" = "x" ] && [ "x${GRUB_DEVICE_PARTUUID}" = "x" ] ) \
+    || ( [ "x${GRUB_DISABLE_LINUX_UUID}" = "xtrue" ] \
+	&& [ "x${GRUB_DISABLE_LINUX_PARTUUID}" = "xtrue" ] ) \
+    || ( ! test -e "/dev/disk/by-uuid/${GRUB_DEVICE_UUID}" \
+	&& ! test -e "/dev/disk/by-partuuid/${GRUB_DEVICE_PARTUUID}" ) \
+    || ( test -e "${GRUB_DEVICE}" && uses_abstraction "${GRUB_DEVICE}" lvm ); then
+  LINUX_ROOT_DEVICE=${GRUB_DEVICE}
+elif [ "x${GRUB_DEVICE_UUID}" = "x" ] \
+    || [ "x${GRUB_DISABLE_LINUX_UUID}" = "xtrue" ]; then
+  LINUX_ROOT_DEVICE=PARTUUID=${GRUB_DEVICE_PARTUUID}
+else
+  LINUX_ROOT_DEVICE=UUID=${GRUB_DEVICE_UUID}
+fi
+
+# Allow overriding GRUB_CMDLINE_LINUX and GRUB_CMDLINE_LINUX_DEFAULT.
+if [ "${GRUB_CMDLINE_LINUX_XEN_REPLACE}" ]; then
+  GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX_XEN_REPLACE}"
+fi
+if [ "${GRUB_CMDLINE_LINUX_XEN_REPLACE_DEFAULT}" ]; then
+  GRUB_CMDLINE_LINUX_DEFAULT="${GRUB_CMDLINE_LINUX_XEN_REPLACE_DEFAULT}"
+fi
+
+case x"$GRUB_FS" in
+    xbtrfs)
+	rootsubvol="`make_system_path_relative_to_its_root /`"
+	rootsubvol="${rootsubvol#/}"
+	if [ "x${rootsubvol}" != x ]; then
+	    GRUB_CMDLINE_LINUX="rootflags=subvol=${rootsubvol} ${GRUB_CMDLINE_LINUX}"
+	fi;;
+    xzfs)
+	rpool=`${grub_probe} --device ${GRUB_DEVICE} --target=fs_label 2>/dev/null || zdb -l ${GRUB_DEVICE} | awk -F \' '/ name/ { print $2 }'`
+	bootfs="`make_system_path_relative_to_its_root / | sed -e "s,@$,,"`"
+	LINUX_ROOT_DEVICE="ZFS=${rpool}${bootfs%/}"
+	;;
+esac
+
+title_correction_code=
+
+linux_entry ()
+{
+  linux_entry_xsm "$@" false
+  linux_entry_xsm "$@" true
+}
+linux_entry_xsm ()
+{
+  os="$1"
+  version="$2"
+  entry_xen_version="$3"
+  type="$4"
+  args="$5"
+  xen_args="$6"
+  xsm="$7"
+  # If user wants to enable XSM support, make sure there's
+  # corresponding policy file.
+  xenpolicy=
+  if ${xsm} ; then
+      xenpolicy="xenpolicy-$entry_xen_version"
+      if test ! -e "${xen_dirname}/${xenpolicy}" ; then
+	  return
+      fi
+      xen_args="$xen_args flask=enforcing"
+      entry_xen_version="$(gettext_printf "%s (XSM enabled)" "$entry_xen_version")"
+      # entry_xen_version is used for messages only; actual file is xen_basename
+  fi
+  if [ -z "$boot_device_id" ]; then
+      boot_device_id="$(grub_get_device_id "${GRUB_DEVICE}")"
+  fi
+  if [ x$type != xsimple ] ; then
+      if [ x$type = xrecovery ] ; then
+	  title="$(gettext_printf "%s, with Xen %s and Linux %s (%s)" "${os}" "${entry_xen_version}" "${version}" "$(gettext "${GRUB_RECOVERY_TITLE}")")"
+      else
+	  title="$(gettext_printf "%s, with Xen %s and Linux %s" "${os}" "${entry_xen_version}" "${version}")"
+      fi
+      replacement_title="$(echo "Advanced options for ${OS}" | sed 's,>,>>,g')>$(echo "$title" | sed 's,>,>>,g')"
+      if [ x"Xen ${entry_xen_version}>$title" = x"$GRUB_ACTUAL_DEFAULT" ]; then
+         quoted="$(echo "$GRUB_ACTUAL_DEFAULT" | grub_quote)"
+         title_correction_code="${title_correction_code}if [ \"x\$default\" = '$quoted' ]; then default='$(echo "$replacement_title" | grub_quote)'; fi;"
+         grub_warn "$(gettext_printf "Please don't use old title \`%s' for GRUB_DEFAULT, use \`%s' (for versions before 2.00) or \`%s' (for 2.00 or later)" "$GRUB_ACTUAL_DEFAULT" "$replacement_title" "gnulinux-advanced-$boot_device_id>gnulinux-$version-$type-$boot_device_id")"
+      fi
+      echo "menuentry '$(echo "$title" | grub_quote)' ${CLASS} \$menuentry_id_option 'xen-gnulinux-$version-$type-$boot_device_id' {" | sed "s/^/$submenu_indentation/"
+  else
+      title="$(gettext_printf "%s, with Xen hypervisor" "${os}")"
+      echo "menuentry '$(echo "$title" | grub_quote)' ${CLASS} \$menuentry_id_option 'xen-gnulinux-simple-$boot_device_id' {" | sed "s/^/$submenu_indentation/"
+  fi
+  if [ x$type != xrecovery ] ; then
+      save_default_entry | grub_add_tab | sed "s/^/$submenu_indentation/"
+  fi
+
+  if [ -z "${prepare_boot_cache}" ]; then
+    prepare_boot_cache="$(prepare_grub_to_access_device ${GRUB_DEVICE_BOOT} | grub_add_tab)"
+  fi
+  printf '%s\n' "${prepare_boot_cache}" | sed "s/^/$submenu_indentation/"
+  xmessage="$(gettext_printf "Loading Xen %s ..." ${entry_xen_version})"
+  lmessage="$(gettext_printf "Loading Linux %s ..." ${version})"
+  sed "s/^/$submenu_indentation/" << EOF
+	echo	'$(echo "$xmessage" | grub_quote)'
+        if [ "\$grub_platform" = "pc" -o "\$grub_platform" = "" ]; then
+            xen_rm_opts=
+        else
+            xen_rm_opts="no-real-mode edd=off"
+        fi
+	${xen_loader}	${rel_xen_dirname}/${xen_basename} placeholder ${xen_args} \${xen_rm_opts}
+	echo	'$(echo "$lmessage" | grub_quote)'
+	${module_loader}	${rel_dirname}/${basename} placeholder root=${linux_root_device_thisversion} ro ${args}
+EOF
+  if test -n "${initrd}" ; then
+    # TRANSLATORS: ramdisk isn't identifier. Should be translated.
+    message="$(gettext_printf "Loading initial ramdisk ...")"
+    initrd_path=
+    for i in ${initrd}; do
+       initrd_path="${rel_dirname}/${i}"
+       sed "s/^/$submenu_indentation/" << EOF
+	echo	'$(echo "$message" | grub_quote)'
+	${module_loader}	--nounzip   $(echo $initrd_path)
+EOF
+    done
+  fi
+  if ${xsm} && test -n "${xenpolicy}" ; then
+    message="$(gettext_printf "Loading XSM policy ...")"
+    sed "s/^/$submenu_indentation/" << EOF
+	echo	'$(echo "$message" | grub_quote)'
+	${module_loader}     ${rel_dirname}/${xenpolicy}
+EOF
+  fi
+  sed "s/^/$submenu_indentation/" << EOF
+}
+EOF
+}
+
+linux_list=
+for i in /boot/vmlinu[xz]-* /vmlinu[xz]-* /boot/kernel-*; do
+    if grub_file_is_not_garbage "$i"; then
+    	basename=$(basename $i)
+	version=$(echo $basename | sed -e "s,^[^0-9]*-,,g")
+	dirname=$(dirname $i)
+	config=
+	for j in "${dirname}/config-${version}" "${dirname}/config-${alt_version}" "/etc/kernels/kernel-config-${version}" ; do
+	    if test -e "${j}" ; then
+		config="${j}"
+		break
+	    fi
+	done
+        if (grep -qx "CONFIG_XEN_DOM0=y" "${config}" 2> /dev/null || grep -qx "CONFIG_XEN_PRIVILEGED_GUEST=y" "${config}" 2> /dev/null); then linux_list="$linux_list $i" ; fi
+    fi
+done
+if [ "x${linux_list}" = "x" ] ; then
+    exit 0
+fi
+
+file_is_not_xen_garbage () {
+    case "$1" in
+	*/xen-syms-*)
+	    return 1;;
+	*/xenpolicy-*)
+	    return 1;;
+	*/*.config)
+	    return 1;;
+	*)
+	    return 0;;
+    esac
+}
+
+xen_list=
+for i in /boot/xen*; do
+    if grub_file_is_not_garbage "$i" && file_is_not_xen_garbage "$i" ; then xen_list="$xen_list $i" ; fi
+done
+prepare_boot_cache=
+boot_device_id=
+
+title_correction_code=
+
+machine=`uname -m`
+
+case "$machine" in
+    i?86) GENKERNEL_ARCH="x86" ;;
+    mips|mips64) GENKERNEL_ARCH="mips" ;;
+    mipsel|mips64el) GENKERNEL_ARCH="mipsel" ;;
+    arm*) GENKERNEL_ARCH="arm" ;;
+    *) GENKERNEL_ARCH="$machine" ;;
+esac
+
+# Extra indentation to add to menu entries in a submenu. We're not in a submenu
+# yet, so it's empty. In a submenu it will be equal to '\t' (one tab).
+submenu_indentation=""
+
+# Perform a reverse version sort on the entire xen_list and linux_list.
+# Temporarily replace the '.old' suffix by ' 1' and append ' 2' for all
+# other files to order the '.old' files after their non-old counterpart
+# in reverse-sorted order.
+
+reverse_sorted_xen_list=$(echo ${xen_list} | tr ' ' '\n' | sed -e 's/\.old$/ 1/; / 1$/! s/$/ 2/' | version_sort -r | sed -e 's/ 1$/.old/; s/ 2$//')
+reverse_sorted_linux_list=$(echo ${linux_list} | tr ' ' '\n' | sed -e 's/\.old$/ 1/; / 1$/! s/$/ 2/' | version_sort -r | sed -e 's/ 1$/.old/; s/ 2$//')
+
+if [ "x$GRUB_TOP_LEVEL_XEN" != x ]; then
+  reverse_sorted_xen_list=$(grub_move_to_front "$GRUB_TOP_LEVEL_XEN" ${reverse_sorted_xen_list})
+fi
+if [ "x$GRUB_TOP_LEVEL" != x ]; then
+  reverse_sorted_linux_list=$(grub_move_to_front "$GRUB_TOP_LEVEL" ${reverse_sorted_linux_list})
+fi
+
+is_top_level=true
+
+for current_xen in ${reverse_sorted_xen_list}; do
+    xen_basename=`basename ${current_xen}`
+    xen_dirname=`dirname ${current_xen}`
+    rel_xen_dirname=`make_system_path_relative_to_its_root $xen_dirname`
+    xen_version=`echo $xen_basename | sed -e "s,.gz$,,g;s,^xen-,,g"`
+    if [ -z "$boot_device_id" ]; then
+	boot_device_id="$(grub_get_device_id "${GRUB_DEVICE}")"
+    fi
+    if [ "x$is_top_level" != xtrue ]; then
+	echo "	submenu '$(gettext_printf "Xen hypervisor, version %s" "${xen_version}" | grub_quote)' \$menuentry_id_option 'xen-hypervisor-$xen_version-$boot_device_id' {"
+    fi
+    if ($grub_file --is-arm64-efi $current_xen); then
+	xen_loader="xen_hypervisor"
+	module_loader="xen_module"
+    else
+	if ($grub_file --is-x86-multiboot2 $current_xen); then
+	    xen_loader="multiboot2"
+	    module_loader="module2"
+	else
+	    xen_loader="multiboot"
+	    module_loader="module"
+        fi
+    fi
+
+    initrd_early=
+    for i in ${GRUB_EARLY_INITRD_LINUX_STOCK} \
+             ${GRUB_EARLY_INITRD_LINUX_CUSTOM}; do
+       if test -e "${xen_dirname}/${i}" ; then
+          initrd_early="${initrd_early} ${i}"
+       fi
+    done
+
+    for linux in ${reverse_sorted_linux_list}; do
+	gettext_printf "Found linux image: %s\n" "$linux" >&2
+	basename=`basename $linux`
+	dirname=`dirname $linux`
+	rel_dirname=`make_system_path_relative_to_its_root $dirname`
+	version=`echo $basename | sed -e "s,^[^0-9]*-,,g"`
+	alt_version=`echo $version | sed -e "s,\.old$,,g"`
+	linux_root_device_thisversion="${LINUX_ROOT_DEVICE}"
+
+	initrd_real=
+	for i in "initrd.img-${version}" "initrd-${version}.img" \
+	   "initrd-${alt_version}.img.old" "initrd-${version}.gz" \
+	   "initrd-${alt_version}.gz.old" "initrd-${version}" \
+	   "initramfs-${version}.img" "initramfs-${alt_version}.img.old" \
+	   "initrd.img-${alt_version}" "initrd-${alt_version}.img" \
+	   "initrd-${alt_version}" "initramfs-${alt_version}.img" \
+	   "initramfs-genkernel-${version}" \
+	   "initramfs-genkernel-${alt_version}" \
+	   "initramfs-genkernel-${GENKERNEL_ARCH}-${version}" \
+	   "initramfs-genkernel-${GENKERNEL_ARCH}-${alt_version}" ; do
+	    if test -e "${dirname}/${i}" ; then
+		initrd_real="$i"
+		break
+	    fi
+	done
+
+	initrd=
+	if test -n "${initrd_early}" || test -n "${initrd_real}"; then
+	    # Xen assumes the real initrd is the first module after the kernel.
+	    # Additional (later) initrds can also be used for microcode update,
+	    # with Xen option 'ucode=<scan|module number> (non-default anyway).
+	    initrd="${initrd_real} ${initrd_early}"
+
+	    initrd_display=
+	    for i in ${initrd}; do
+		initrd_display="${initrd_display} ${dirname}/${i}"
+	    done
+	    gettext_printf "Found initrd image: %s\n" "$(echo $initrd_display)" >&2
+	fi
+
+	if test -z "${initrd_real}"; then
+    # "UUID=" magic is parsed by initrds.  Since there's no initrd, it can't work here.
+	    if [ "x${GRUB_DEVICE_PARTUUID}" = "x" ] \
+		|| [ "x${GRUB_DISABLE_LINUX_PARTUUID}" = "xtrue" ]; then
+
+		linux_root_device_thisversion=${GRUB_DEVICE}
+	    else
+		linux_root_device_thisversion=PARTUUID=${GRUB_DEVICE_PARTUUID}
+	    fi
+	fi
+
+	# The GRUB_DISABLE_SUBMENU option used to be different than others since it was
+	# mentioned in the documentation that has to be set to 'y' instead of 'true' to
+	# enable it. This caused a lot of confusion to users that set the option to 'y',
+	# 'yes' or 'true'. This was fixed but all of these values must be supported now.
+	if [ "x${GRUB_DISABLE_SUBMENU}" = xyes ] || [ "x${GRUB_DISABLE_SUBMENU}" = xy ]; then
+	    GRUB_DISABLE_SUBMENU="true"
+	fi
+
+	if [ "x$is_top_level" = xtrue ] && [ "x${GRUB_DISABLE_SUBMENU}" != xtrue ]; then
+	    linux_entry "${OS}" "${version}" "${xen_version}" simple \
+		"${GRUB_CMDLINE_LINUX} ${GRUB_CMDLINE_LINUX_DEFAULT}" "${GRUB_CMDLINE_XEN} ${GRUB_CMDLINE_XEN_DEFAULT}"
+
+	    submenu_indentation="$grub_tab$grub_tab"
+    
+	    if [ -z "$boot_device_id" ]; then
+		boot_device_id="$(grub_get_device_id "${GRUB_DEVICE}")"
+	    fi
+            # TRANSLATORS: %s is replaced with an OS name
+	    echo "submenu '$(gettext_printf "Advanced options for %s (with Xen hypervisor)" "${OS}" | grub_quote)' \$menuentry_id_option 'gnulinux-advanced-$boot_device_id' {"
+	echo "	submenu '$(gettext_printf "Xen hypervisor, version %s" "${xen_version}" | grub_quote)' \$menuentry_id_option 'xen-hypervisor-$xen_version-$boot_device_id' {"
+	   is_top_level=false
+	fi
+
+	linux_entry "${OS}" "${version}" "${xen_version}" advanced \
+	    "${GRUB_CMDLINE_LINUX} ${GRUB_CMDLINE_LINUX_DEFAULT}" "${GRUB_CMDLINE_XEN} ${GRUB_CMDLINE_XEN_DEFAULT}"
+	if [ "x${GRUB_DISABLE_RECOVERY}" != "xtrue" ]; then
+	    linux_entry "${OS}" "${version}" "${xen_version}" recovery \
+		"${GRUB_CMDLINE_LINUX_RECOVERY} ${GRUB_CMDLINE_LINUX}" "${GRUB_CMDLINE_XEN}"
+	fi
+    done
+    if [ x"$is_top_level" != xtrue ]; then
+	echo '	}'
+    fi
+done
+
+# If at least one kernel was found, then we need to
+# add a closing '}' for the submenu command.
+if [ x"$is_top_level" != xtrue ]; then
+  echo '}'
+fi
+
+echo "$title_correction_code"
diff --git a/straper/db/public/boot/grub.d/25_bli b/straper/db/public/boot/grub.d/25_bli
new file mode 100755
index 0000000..26e27a0
--- /dev/null
+++ b/straper/db/public/boot/grub.d/25_bli
@@ -0,0 +1,24 @@
+#! /bin/sh
+set -e
+
+# grub-mkconfig helper script.
+# Copyright (C) 2023  Free Software Foundation, Inc.
+#
+# GRUB is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# GRUB is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
+
+cat << EOF
+if [ "\$grub_platform" = "efi" ]; then
+  insmod bli
+fi
+EOF
diff --git a/straper/db/public/boot/grub.d/30_os-prober b/straper/db/public/boot/grub.d/30_os-prober
new file mode 100755
index 0000000..c984f7d
--- /dev/null
+++ b/straper/db/public/boot/grub.d/30_os-prober
@@ -0,0 +1,371 @@
+#! /bin/sh
+set -e
+
+# grub-mkconfig helper script.
+# Copyright (C) 2006,2007,2008,2009  Free Software Foundation, Inc.
+#
+# GRUB is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# GRUB is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
+
+prefix="/usr"
+exec_prefix="/usr"
+datarootdir="/usr/share"
+quick_boot="0"
+
+export TEXTDOMAIN=grub
+export TEXTDOMAINDIR="${datarootdir}/locale"
+
+. "$pkgdatadir/grub-mkconfig_lib"
+
+found_other_os=
+
+adjust_timeout () {
+  if [ "$quick_boot" = 1 ] && [ "x${found_other_os}" != "x" ]; then
+    cat << EOF
+set timeout_style=menu
+if [ "\${timeout}" = 0 ]; then
+  set timeout=10
+fi
+EOF
+  fi
+}
+
+if ! command -v os-prober > /dev/null || ! command -v linux-boot-prober > /dev/null ; then
+  # missing os-prober and/or linux-boot-prober
+  exit 0
+fi
+
+if [ "x${GRUB_DISABLE_OS_PROBER}" = "xtrue" ]; then
+  grub_warn "$(gettext_printf "os-prober will not be executed to detect other bootable partitions.\nSystems on them will not be added to the GRUB boot configuration.\nCheck GRUB_DISABLE_OS_PROBER documentation entry.")"
+  exit 0
+fi
+
+grub_warn "$(gettext_printf "os-prober will be executed to detect other bootable partitions.\nIts output will be used to detect bootable binaries on them and create new boot entries.")"
+
+OSPROBED="`os-prober | tr ' ' '^' | paste -s -d ' '`"
+if [ -z "${OSPROBED}" ] ; then
+  # empty os-prober output, nothing doing
+  exit 0
+fi
+
+osx_entry() {
+    found_other_os=1
+    if [ x$2 = x32 ]; then
+        # TRANSLATORS: it refers to kernel architecture (32-bit)
+	bitstr="$(gettext "(32-bit)")"
+    else
+        # TRANSLATORS: it refers to kernel architecture (64-bit)
+	bitstr="$(gettext "(64-bit)")"
+    fi
+    # TRANSLATORS: it refers on the OS residing on device %s
+    onstr="$(gettext_printf "(on %s)" "${DEVICE}")"
+        cat << EOF
+menuentry '$(echo "${LONGNAME} $bitstr $onstr" | grub_quote)' --class osx --class darwin --class os \$menuentry_id_option 'osprober-xnu-$2-$(grub_get_device_id "${DEVICE}")'  {
+EOF
+	save_default_entry | grub_add_tab
+	prepare_grub_to_access_device ${DEVICE} | grub_add_tab
+	cat << EOF
+        load_video
+        set do_resume=0
+        if [ /var/vm/sleepimage -nt10 / ]; then
+           if xnu_resume /var/vm/sleepimage; then
+             set do_resume=1
+           fi
+        fi
+        if [ \$do_resume = 0 ]; then
+           xnu_uuid ${OSXUUID} uuid
+           if [ -f /Extra/DSDT.aml ]; then
+              acpi -e /Extra/DSDT.aml
+           fi
+           if [ /kernelcache -nt /System/Library/Extensions ]; then
+              $1 /kernelcache boot-uuid=\${uuid} rd=*uuid
+           elif [ -f /System/Library/Kernels/kernel ]; then
+              $1 /System/Library/Kernels/kernel boot-uuid=\${uuid} rd=*uuid
+              xnu_kextdir /System/Library/Extensions
+           else
+              $1 /mach_kernel boot-uuid=\${uuid} rd=*uuid
+              if [ /System/Library/Extensions.mkext -nt /System/Library/Extensions ]; then
+                xnu_mkext /System/Library/Extensions.mkext
+              else
+                xnu_kextdir /System/Library/Extensions
+              fi
+           fi
+           if [ -f /Extra/Extensions.mkext ]; then
+              xnu_mkext /Extra/Extensions.mkext
+           fi
+           if [ -d /Extra/Extensions ]; then
+              xnu_kextdir /Extra/Extensions
+           fi
+           if [ -f /Extra/devprop.bin ]; then
+              xnu_devprop_load /Extra/devprop.bin
+           fi
+           if [ -f /Extra/splash.jpg ]; then
+              insmod jpeg
+              xnu_splash /Extra/splash.jpg
+           fi
+           if [ -f /Extra/splash.png ]; then
+              insmod png
+              xnu_splash /Extra/splash.png
+           fi
+           if [ -f /Extra/splash.tga ]; then
+              insmod tga
+              xnu_splash /Extra/splash.tga
+           fi
+        fi
+}
+EOF
+}
+
+used_osprober_linux_ids=
+
+if [ "x$GRUB_TOP_LEVEL_OS_PROBER" != x ]; then
+  OSPROBED=$(grub_move_to_front "$GRUB_TOP_LEVEL_OS_PROBER" ${OSPROBED})
+fi
+
+for OS in ${OSPROBED} ; do
+  DEVICE="`echo ${OS} | cut -d ':' -f 1`"
+  LONGNAME="`echo ${OS} | cut -d ':' -f 2 | tr '^' ' '`"
+  LABEL="`echo ${OS} | cut -d ':' -f 3 | tr '^' ' '`"
+  BOOT="`echo ${OS} | cut -d ':' -f 4`"
+  if UUID="`${grub_probe} --target=fs_uuid --device ${DEVICE%@*}`"; then
+    EXPUUID="$UUID"
+
+    if [ x"${DEVICE#*@}" != x ] ; then
+      EXPUUID="${EXPUUID}@${DEVICE#*@}"
+    fi
+
+    if [ "x${GRUB_OS_PROBER_SKIP_LIST}" != "x" ] && [ "x`echo ${GRUB_OS_PROBER_SKIP_LIST} | grep -i -e '\b'${EXPUUID}'\b'`" != "x" ] ; then
+      echo "Skipped ${LONGNAME} on ${DEVICE} by user request." >&2
+      continue
+    fi
+  fi
+
+  BTRFS="`echo ${OS} | cut -d ':' -f 5`"
+  if [ "x$BTRFS" = "xbtrfs" ]; then
+	BTRFSuuid="`echo ${OS} | cut -d ':' -f 6`"
+	BTRFSsubvol="`echo ${OS} | cut -d ':' -f 7`"
+  fi
+
+  if [ -z "${LONGNAME}" ] ; then
+    LONGNAME="${LABEL}"
+  fi
+
+  # os-prober returns text string followed by optional counter
+  CLASS="--class $(echo "${LABEL}" | LC_ALL=C sed 's,[[:digit:]]*$,,' | cut -d' ' -f1 | tr 'A-Z' 'a-z' | LC_ALL=C sed 's,[^[:alnum:]_],_,g')"
+
+  gettext_printf "Found %s on %s\n" "${LONGNAME}" "${DEVICE}" >&2
+
+  case ${BOOT} in
+    chain)
+
+	  onstr="$(gettext_printf "(on %s)" "${DEVICE}")"
+      cat << EOF
+menuentry '$(echo "${LONGNAME} $onstr" | grub_quote)' $CLASS --class os \$menuentry_id_option 'osprober-chain-$(grub_get_device_id "${DEVICE}")' {
+EOF
+      save_default_entry | grub_add_tab
+      prepare_grub_to_access_device ${DEVICE} | grub_add_tab
+
+      if [ x"`${grub_probe} --device ${DEVICE} --target=partmap`" = xmsdos ]; then
+	  cat << EOF
+	parttool \${root} hidden-
+EOF
+      fi
+
+      case ${LONGNAME} in
+	Windows\ Vista*|Windows\ 7*|Windows\ Server\ 2008*)
+	;;
+	*)
+	  cat << EOF
+	drivemap -s (hd0) \${root}
+EOF
+	;;
+      esac
+
+      cat <<EOF
+	chainloader +1
+}
+EOF
+    ;;
+    efi)
+
+	found_other_os=1
+	EFIPATH=${DEVICE#*@}
+	DEVICE=${DEVICE%@*}
+	onstr="$(gettext_printf "(on %s)" "${DEVICE}")"
+      cat << EOF
+menuentry '$(echo "${LONGNAME} $onstr" | grub_quote)' $CLASS --class os \$menuentry_id_option 'osprober-efi-$(grub_get_device_id "${DEVICE}")' {
+EOF
+      save_default_entry | sed -e "s/^/\t/"
+      prepare_grub_to_access_device ${DEVICE} | sed -e "s/^/\t/"
+
+      cat <<EOF
+	chainloader ${EFIPATH}
+}
+EOF
+    ;;
+    linux)
+      if [ "x$BTRFS" = "xbtrfs" ]; then
+         LINUXPROBED="`linux-boot-prober btrfs ${BTRFSuuid} ${BTRFSsubvol}  2> /dev/null | tr ' ' '^' | paste -s -d ' '`"
+      else
+         LINUXPROBED="`linux-boot-prober ${DEVICE} 2> /dev/null | tr ' ' '^' | paste -s -d ' '`"
+      fi
+      prepare_boot_cache=
+      boot_device_id=
+      is_top_level=true
+      title_correction_code=
+      OS="${LONGNAME}"
+
+      for LINUX in ${LINUXPROBED} ; do
+        LROOT="`echo ${LINUX} | cut -d ':' -f 1`"
+        LBOOT="`echo ${LINUX} | cut -d ':' -f 2`"
+        LLABEL="`echo ${LINUX} | cut -d ':' -f 3 | tr '^' ' '`"
+        LKERNEL="`echo ${LINUX} | cut -d ':' -f 4`"
+        LINITRD="`echo ${LINUX} | cut -d ':' -f 5 | tr '^' ' '`"
+        LPARAMS="`echo ${LINUX} | cut -d ':' -f 6- | tr '^' ' '`"
+
+        if [ -z "${LLABEL}" ] ; then
+          LLABEL="${LONGNAME}"
+        fi
+
+	if [ "${LROOT}" != "${LBOOT}" ]; then
+	  LKERNEL="${LKERNEL#/boot}"
+	  LINITRD="${LINITRD#/boot}"
+	fi
+
+	if [ -z "${prepare_boot_cache}" ]; then
+	  prepare_boot_cache="$(prepare_grub_to_access_device ${LBOOT} | grub_add_tab)"
+	  [ "${prepare_boot_cache}" ] || continue
+	fi
+
+	found_other_os=1
+	onstr="$(gettext_printf "(on %s)" "${DEVICE}")"
+	recovery_params="$(echo "${LPARAMS}" | grep 'single\|recovery')" || true
+	counter=1
+	while echo "$used_osprober_linux_ids" | grep 'osprober-gnulinux-$LKERNEL-${recovery_params}-$counter-$boot_device_id' > /dev/null; do
+	    counter=$((counter+1));
+	done
+	if [ -z "$boot_device_id" ]; then
+	    boot_device_id="$(grub_get_device_id "${DEVICE}")"
+	fi
+	used_osprober_linux_ids="$used_osprober_linux_ids 'osprober-gnulinux-$LKERNEL-${recovery_params}-$counter-$boot_device_id'"
+
+	# The GRUB_DISABLE_SUBMENU option used to be different than others since it was
+	# mentioned in the documentation that has to be set to 'y' instead of 'true' to
+	# enable it. This caused a lot of confusion to users that set the option to 'y',
+	# 'yes' or 'true'. This was fixed but all of these values must be supported now.
+	if [ "x${GRUB_DISABLE_SUBMENU}" = xyes ] || [ "x${GRUB_DISABLE_SUBMENU}" = xy ]; then
+	    GRUB_DISABLE_SUBMENU="true"
+	fi
+
+	if [ "x$is_top_level" = xtrue ] && [ "x${GRUB_DISABLE_SUBMENU}" != xtrue ]; then
+            cat << EOF
+menuentry '$(echo "$OS $onstr" | grub_quote)' $CLASS --class gnu-linux --class gnu --class os \$menuentry_id_option 'osprober-gnulinux-simple-$boot_device_id' {
+EOF
+	    save_default_entry | grub_add_tab
+	    printf '%s\n' "${prepare_boot_cache}"
+	    cat <<  EOF
+	linux ${LKERNEL} ${LPARAMS}
+EOF
+            if [ -n "${LINITRD}" ] ; then
+          cat << EOF
+	initrd ${LINITRD}
+EOF
+            fi
+        cat << EOF
+}
+EOF
+	    echo "submenu '$(gettext_printf "Advanced options for %s" "${OS} $onstr" | grub_quote)' \$menuentry_id_option 'osprober-gnulinux-advanced-$boot_device_id' {"
+	    is_top_level=false
+	fi
+	title="${LLABEL} $onstr"
+        cat << EOF
+	menuentry '$(echo "$title" | grub_quote)' --class gnu-linux --class gnu --class os \$menuentry_id_option 'osprober-gnulinux-$LKERNEL-${recovery_params}-$boot_device_id' {
+EOF
+	save_default_entry | sed -e "s/^/$grub_tab$grub_tab/"
+	printf '%s\n' "${prepare_boot_cache}" | grub_add_tab
+	cat <<  EOF
+		linux ${LKERNEL} ${LPARAMS}
+EOF
+        if [ -n "${LINITRD}" ] ; then
+            cat << EOF
+		initrd ${LINITRD}
+EOF
+        fi
+        cat << EOF
+	}
+EOF
+	if [ x"$title" = x"$GRUB_ACTUAL_DEFAULT" ] || [ x"Previous Linux versions>$title" = x"$GRUB_ACTUAL_DEFAULT" ]; then
+	    replacement_title="$(echo "Advanced options for ${OS} $onstr" | sed 's,>,>>,g')>$(echo "$title" | sed 's,>,>>,g')"
+	    quoted="$(echo "$GRUB_ACTUAL_DEFAULT" | grub_quote)"
+	    title_correction_code="${title_correction_code}if [ \"x\$default\" = '$quoted' ]; then default='$(echo "$replacement_title" | grub_quote)'; fi;"
+	    grub_warn "$(gettext_printf "Please don't use old title \`%s' for GRUB_DEFAULT, use \`%s' (for versions before 2.00) or \`%s' (for 2.00 or later)" "$GRUB_ACTUAL_DEFAULT" "$replacement_title" "gnulinux-advanced-$boot_device_id>gnulinux-$version-$type-$boot_device_id")"
+	fi
+      done
+      if [ x"$is_top_level" != xtrue ]; then
+	  echo '}'
+      fi
+      echo "$title_correction_code"
+    ;;
+    macosx)
+      if [ "${UUID}" ]; then
+	OSXUUID="${UUID}"
+	osx_entry xnu_kernel 32
+	osx_entry xnu_kernel64 64
+      fi
+    ;;
+    hurd)
+      found_other_os=1
+      onstr="$(gettext_printf "(on %s)" "${DEVICE}")"
+      cat << EOF
+menuentry '$(echo "${LONGNAME} $onstr" | grub_quote)' --class hurd --class gnu --class os \$menuentry_id_option 'osprober-gnuhurd-/boot/gnumach.gz-false-$(grub_get_device_id "${DEVICE}")' {
+EOF
+      save_default_entry | grub_add_tab
+      prepare_grub_to_access_device ${DEVICE} | grub_add_tab
+      grub_device="`${grub_probe} --device ${DEVICE} --target=drive`"
+      mach_device="`echo "${grub_device}" | sed -e 's/(\(hd.*\),msdos\(.*\))/\1s\2/'`"
+      grub_fs="`${grub_probe} --device ${DEVICE} --target=fs`"
+      case "${grub_fs}" in
+	*fs)	hurd_fs="${grub_fs}" ;;
+	*)	hurd_fs="${grub_fs}fs" ;;
+      esac
+      cat << EOF
+	multiboot /boot/gnumach.gz root=device:${mach_device}
+	module /hurd/${hurd_fs}.static ${hurd_fs} --readonly \\
+			--multiboot-command-line='\${kernel-command-line}' \\
+			--host-priv-port='\${host-port}' \\
+			--device-master-port='\${device-port}' \\
+			--exec-server-task='\${exec-task}' -T typed '\${root}' \\
+			'\$(task-create)' '\$(task-resume)'
+	module /lib/ld.so.1 exec /hurd/exec '\$(exec-task=task-create)'
+}
+EOF
+    ;;
+    minix)
+	  cat << EOF
+menuentry "${LONGNAME} (on ${DEVICE}, Multiboot)" {
+EOF
+         save_default_entry | sed -e "s/^/\t/"
+         prepare_grub_to_access_device ${DEVICE} | sed -e "s/^/\t/"
+	 cat << EOF
+	multiboot /boot/image_latest
+}
+EOF
+    ;;
+    *)
+      # TRANSLATORS: %s is replaced by OS name.
+      gettext_printf "%s is not yet supported by grub-mkconfig.\n" "  ${LONGNAME}" >&2
+    ;;
+  esac
+done
+
+adjust_timeout
diff --git a/straper/db/public/boot/grub.d/30_uefi-firmware b/straper/db/public/boot/grub.d/30_uefi-firmware
new file mode 100755
index 0000000..377913d
--- /dev/null
+++ b/straper/db/public/boot/grub.d/30_uefi-firmware
@@ -0,0 +1,42 @@
+#! /bin/sh
+set -e
+
+# grub-mkconfig helper script.
+# Copyright (C) 2020  Free Software Foundation, Inc.
+#
+# GRUB is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# GRUB is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
+
+prefix="/usr"
+exec_prefix="/usr"
+datarootdir="/usr/share"
+
+export TEXTDOMAIN=grub
+export TEXTDOMAINDIR="${datarootdir}/locale"
+
+. "$pkgdatadir/grub-mkconfig_lib"
+
+LABEL="UEFI Firmware Settings"
+
+gettext_printf "Adding boot menu entry for UEFI Firmware Settings ...\n" >&2
+
+cat << EOF
+if [ "\$grub_platform" = "efi" ]; then
+	fwsetup --is-supported
+	if [ "\$?" = 0 ]; then
+		menuentry '$LABEL' \$menuentry_id_option 'uefi-firmware' {
+			fwsetup
+		}
+	fi
+fi
+EOF
diff --git a/straper/db/public/boot/grub.d/35_fwupd b/straper/db/public/boot/grub.d/35_fwupd
new file mode 100755
index 0000000..ea46bcf
--- /dev/null
+++ b/straper/db/public/boot/grub.d/35_fwupd
@@ -0,0 +1,24 @@
+#! /bin/sh
+# SPDX-License-Identifier: LGPL-2.1-or-later
+set -e
+
+[ -d ${pkgdatadir:?} ]
+# shellcheck source=/dev/null
+. "$pkgdatadir/grub-mkconfig_lib"
+
+if [ -f /var/lib/fwupd/uefi_capsule.conf ] &&
+   ls /sys/firmware/efi/efivars/fwupd-*-0abba7dc-e516-4167-bbf5-4d9d1c739416 1>/dev/null 2>&1; then
+      . /var/lib/fwupd/uefi_capsule.conf
+      if [ "${EFI_PATH}" != "" ] && [ "${ESP}" != "" ]; then
+      echo "Adding Linux Firmware Updater entry" >&2
+cat << EOF
+menuentry 'Linux Firmware Updater' \$menuentry_id_option 'fwupd' {
+EOF
+      ${grub_probe:?} --version > /dev/null
+      prepare_grub_to_access_device "$(${grub_probe} --target=device ${ESP})" | sed -e "s/^/\t/"
+cat << EOF
+	chainloader ${EFI_PATH}
+}
+EOF
+      fi
+fi
diff --git a/straper/db/public/boot/grub.d/40_custom b/straper/db/public/boot/grub.d/40_custom
new file mode 100755
index 0000000..48068de
--- /dev/null
+++ b/straper/db/public/boot/grub.d/40_custom
@@ -0,0 +1,5 @@
+#!/bin/sh
+exec tail -n +3 $0
+# This file provides an easy way to add custom menu entries.  Simply type the
+# menu entries you want to add after this comment.  Be careful not to change
+# the 'exec tail' line above.
diff --git a/straper/db/public/boot/grub.d/41_custom b/straper/db/public/boot/grub.d/41_custom
new file mode 100755
index 0000000..a08363d
--- /dev/null
+++ b/straper/db/public/boot/grub.d/41_custom
@@ -0,0 +1,9 @@
+#!/bin/sh
+cat <<EOF
+if [ -f  \${config_directory}/custom.cfg ]; then
+  source \${config_directory}/custom.cfg
+elif [ -z "\${config_directory}" -a -f  \$prefix/custom.cfg ]; then
+  source \$prefix/custom.cfg
+fi
+EOF
+
diff --git a/straper/db/public/boot/grub.d/README b/straper/db/public/boot/grub.d/README
new file mode 100644
index 0000000..3ea109d
--- /dev/null
+++ b/straper/db/public/boot/grub.d/README
@@ -0,0 +1,11 @@
+
+All executable files in this directory are processed in shell expansion order.
+
+  00_*: Reserved for 00_header.
+  10_*: Native boot entries.
+  20_*: Third party apps (e.g. memtest86+).
+
+The number namespace in-between is configurable by system installer and/or
+administrator.  For example, you can add an entry to boot another OS as
+01_otheros, 11_otheros, etc, depending on the position you want it to occupy in
+the menu; and then adjust the default setting via /etc/default/grub.
diff --git a/straper/db/public/boot/initramfs-tools/conf.d/resume b/straper/db/public/boot/initramfs-tools/conf.d/resume
new file mode 100644
index 0000000..213a0e2
--- /dev/null
+++ b/straper/db/public/boot/initramfs-tools/conf.d/resume
@@ -0,0 +1 @@
+RESUME=none
diff --git a/straper/db/public/boot/initramfs-tools/initramfs.conf b/straper/db/public/boot/initramfs-tools/initramfs.conf
new file mode 100644
index 0000000..aa561bd
--- /dev/null
+++ b/straper/db/public/boot/initramfs-tools/initramfs.conf
@@ -0,0 +1,90 @@
+#
+# initramfs.conf
+# Configuration file for mkinitramfs(8). See initramfs.conf(5).
+#
+# Note that configuration options from this file can be overridden
+# by config files in the /etc/initramfs-tools/conf.d directory.
+
+#
+# MODULES: [ most | netboot | dep | list ]
+#
+# most - Add most filesystem and all harddrive drivers.
+#
+# dep - Try and guess which modules to load.
+#
+# netboot - Add the base modules, network modules, but skip block devices.
+#
+# list - Only include modules from the 'additional modules' list
+#
+
+MODULES=most
+
+#
+# BUSYBOX: [ y | n | auto ]
+#
+# Use busybox shell and utilities.  If set to n, klibc utilities will be used.
+# If set to auto (or unset), busybox will be used if installed and klibc will
+# be used otherwise.
+#
+
+BUSYBOX=auto
+
+#
+# KEYMAP: [ y | n ]
+#
+# Load a keymap during the initramfs stage.
+#
+
+KEYMAP=n
+
+#
+# COMPRESS: [ gzip | bzip2 | lz4 | lzma | lzop | xz | zstd ]
+#
+
+COMPRESS=zstd
+
+#
+# COMPRESSLEVEL: ...
+#
+# Set a compression level for the compressor.
+# Defaults vary by compressor.
+#
+# Valid values are:
+# 1 -  9 for gzip|bzip2|lzma|lzop
+# 0 -  9 for  lz4|xz
+# 0 - 19 for zstd
+#
+# COMPRESSLEVEL=3
+
+#
+# DEVICE: ...
+#
+# Specify a specific network interface, like eth0
+# Overridden by optional ip= or BOOTIF= bootarg
+#
+
+DEVICE=
+
+#
+# NFSROOT: [ auto | HOST:MOUNT ]
+#
+
+NFSROOT=auto
+
+#
+# RUNSIZE: ...
+#
+# The size of the /run tmpfs mount point, like 256M or 10%
+# Overridden by optional initramfs.runsize= bootarg
+#
+
+RUNSIZE=10%
+
+#
+# FSTYPE: ...
+#
+# The filesystem type(s) to support, or "auto" to use the current root
+# filesystem type
+#
+
+FSTYPE=auto
diff --git a/straper/db/public/boot/initramfs-tools/modules b/straper/db/public/boot/initramfs-tools/modules
new file mode 100644
index 0000000..dd9dc54
--- /dev/null
+++ b/straper/db/public/boot/initramfs-tools/modules
@@ -0,0 +1,11 @@
+# List of modules that you want to include in your initramfs.
+# They will be loaded at boot time in the order below.
+#
+# Syntax:  module_name [args ...]
+#
+# You must run update-initramfs(8) to effect this change.
+#
+# Examples:
+#
+# raid1
+# sd_mod
diff --git a/straper/db/public/boot/initramfs-tools/update-initramfs.conf b/straper/db/public/boot/initramfs-tools/update-initramfs.conf
new file mode 100644
index 0000000..31823e2
--- /dev/null
+++ b/straper/db/public/boot/initramfs-tools/update-initramfs.conf
@@ -0,0 +1,20 @@
+#
+# Configuration file for update-initramfs(8)
+#
+
+#
+# update_initramfs [ yes | all | no ]
+#
+# Default is yes
+# If set to all update-initramfs will update all initramfs
+# If set to no disables any update to initramfs beside kernel upgrade
+
+update_initramfs=yes
+
+#
+# backup_initramfs [ yes | no ]
+#
+# Default is no
+# If set to no leaves no .bak backup files.
+
+backup_initramfs=no