feat: first fully successful run e2e on straper

18 files changed, 402 insertions, 0 deletions

diff --git a/straper/db/public/services/custom-units/agate.service b/straper/db/public/services/custom-units/agate.service
new file mode 100644
index 0000000..a8858b7
--- /dev/null
+++ b/straper/db/public/services/custom-units/agate.service
@@ -0,0 +1,15 @@
+[Unit]
+Description=Agate Gemini Server
+After=network.target
+
+[Service]
+User=lukasz
+WorkingDirectory=/srv/gemini-capsule
+ExecStart=/home/lukasz/apps/agate/agate \
+  --content /srv/gemini-capsule \
+  --hostname gmi.labunix.xyz \
+  --addr 0.0.0.0:1965
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target
diff --git a/straper/db/public/services/custom-units/battery-limit.service b/straper/db/public/services/custom-units/battery-limit.service
new file mode 100644
index 0000000..be72fd7
--- /dev/null
+++ b/straper/db/public/services/custom-units/battery-limit.service
@@ -0,0 +1,10 @@
+[Unit]
+Description=Battery Charge Limit
+After=multi-user.target
+
+[Service]
+Type=oneshot
+ExecStart=/bin/sh -c 'echo 55 > /sys/class/power_supply/BAT0/charge_control_end_threshold'
+
+[Install]
+WantedBy=multi-user.target
diff --git a/straper/db/public/services/custom-units/dbus-fi.w1.wpa_supplicant1.service b/straper/db/public/services/custom-units/dbus-fi.w1.wpa_supplicant1.service
new file mode 100644
index 0000000..5f26b21
--- /dev/null
+++ b/straper/db/public/services/custom-units/dbus-fi.w1.wpa_supplicant1.service
@@ -0,0 +1,19 @@
+[Unit]
+Description=WPA supplicant
+Before=network.target
+After=dbus.service
+Wants=network.target
+IgnoreOnIsolate=true
+
+[Service]
+Type=dbus
+BusName=fi.w1.wpa_supplicant1
+ExecStart=/usr/sbin/wpa_supplicant -u -s -O "DIR=/run/wpa_supplicant GROUP=netdev"
+ExecReload=/bin/kill -HUP $MAINPID
+Group=netdev
+RuntimeDirectory=wpa_supplicant
+RuntimeDirectoryMode=0750
+
+[Install]
+WantedBy=multi-user.target
+Alias=dbus-fi.w1.wpa_supplicant1.service
diff --git a/straper/db/public/services/custom-units/dbus-org.freedesktop.network1.service b/straper/db/public/services/custom-units/dbus-org.freedesktop.network1.service
new file mode 100644
index 0000000..51d5f51
--- /dev/null
+++ b/straper/db/public/services/custom-units/dbus-org.freedesktop.network1.service
@@ -0,0 +1,69 @@
+#  SPDX-License-Identifier: LGPL-2.1-or-later
+#
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+[Unit]
+Description=Network Configuration
+Documentation=man:systemd-networkd.service(8)
+Documentation=man:org.freedesktop.network1(5)
+ConditionCapability=CAP_NET_ADMIN
+DefaultDependencies=no
+# systemd-udevd.service can be dropped once tuntap is moved to netlink
+After=systemd-networkd.socket systemd-udevd.service network-pre.target systemd-sysusers.service systemd-sysctl.service
+Before=network.target multi-user.target shutdown.target initrd-switch-root.target
+Conflicts=shutdown.target initrd-switch-root.target
+Wants=systemd-networkd.socket network.target systemd-networkd-persistent-storage.service
+
+[Service]
+AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_BPF CAP_SYS_ADMIN
+BusName=org.freedesktop.network1
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_BPF CAP_SYS_ADMIN
+DeviceAllow=char-* rw
+ExecStart=!!/usr/lib/systemd/systemd-networkd
+FileDescriptorStoreMax=512
+ImportCredential=network.wireguard.*
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
+ProtectProc=invisible
+ProtectClock=yes
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectSystem=strict
+Restart=on-failure
+RestartKillSignal=SIGUSR2
+RestartSec=0
+RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 AF_PACKET
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+RuntimeDirectory=systemd/netif
+RuntimeDirectoryPreserve=yes
+SystemCallArchitectures=native
+SystemCallErrorNumber=EPERM
+SystemCallFilter=@system-service bpf
+Type=notify-reload
+User=systemd-network
+WatchdogSec=3min
+
+[Install]
+WantedBy=multi-user.target
+Also=systemd-networkd.socket
+Alias=dbus-org.freedesktop.network1.service
+
+# The output from this generator is used by udevd and networkd. Enable it by
+# default when enabling systemd-networkd.service.
+Also=systemd-network-generator.service
+
+# We want to enable systemd-networkd-wait-online.service whenever this service
+# is enabled. systemd-networkd-wait-online.service has
+# WantedBy=network-online.target, so enabling it only has an effect if
+# network-online.target itself is enabled or pulled in by some other unit.
+Also=systemd-networkd-wait-online.service
diff --git a/straper/db/public/services/custom-units/dbus-org.freedesktop.resolve1.service b/straper/db/public/services/custom-units/dbus-org.freedesktop.resolve1.service
new file mode 100644
index 0000000..d100f70
--- /dev/null
+++ b/straper/db/public/services/custom-units/dbus-org.freedesktop.resolve1.service
@@ -0,0 +1,59 @@
+#  SPDX-License-Identifier: LGPL-2.1-or-later
+#
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+[Unit]
+Description=Network Name Resolution
+Documentation=man:systemd-resolved.service(8)
+Documentation=man:org.freedesktop.resolve1(5)
+Documentation=https://systemd.io/WRITING_NETWORK_CONFIGURATION_MANAGERS
+Documentation=https://systemd.io/WRITING_RESOLVER_CLIENTS
+
+DefaultDependencies=no
+After=systemd-sysctl.service systemd-sysusers.service
+Before=sysinit.target network.target nss-lookup.target shutdown.target initrd-switch-root.target
+Conflicts=shutdown.target initrd-switch-root.target
+Wants=nss-lookup.target
+
+[Service]
+AmbientCapabilities=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE
+BusName=org.freedesktop.resolve1
+CapabilityBoundingSet=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE
+ExecStart=!!/usr/lib/systemd/systemd-resolved
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
+PrivateDevices=yes
+PrivateTmp=disconnected
+ProtectClock=yes
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectSystem=strict
+Restart=always
+RestartSec=0
+RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+RuntimeDirectory=systemd/resolve
+RuntimeDirectoryPreserve=yes
+SystemCallArchitectures=native
+SystemCallErrorNumber=EPERM
+SystemCallFilter=@system-service
+Type=notify-reload
+User=systemd-resolve
+ImportCredential=network.dns
+ImportCredential=network.search_domains
+WatchdogSec=3min
+
+[Install]
+WantedBy=sysinit.target
+Alias=dbus-org.freedesktop.resolve1.service
diff --git a/straper/db/public/services/custom-units/dbus-org.freedesktop.timesync1.service b/straper/db/public/services/custom-units/dbus-org.freedesktop.timesync1.service
new file mode 100644
index 0000000..47445bc
--- /dev/null
+++ b/straper/db/public/services/custom-units/dbus-org.freedesktop.timesync1.service
@@ -0,0 +1,60 @@
+#  SPDX-License-Identifier: LGPL-2.1-or-later
+#
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+[Unit]
+Description=Network Time Synchronization
+Documentation=man:systemd-timesyncd.service(8)
+ConditionCapability=CAP_SYS_TIME
+ConditionVirtualization=!container
+DefaultDependencies=no
+After=systemd-sysusers.service
+Before=time-set.target sysinit.target shutdown.target
+Conflicts=shutdown.target
+Wants=time-set.target
+
+[Service]
+AmbientCapabilities=CAP_SYS_TIME
+BusName=org.freedesktop.timesync1
+CapabilityBoundingSet=CAP_SYS_TIME
+# Turn off DNSSEC validation for hostname look-ups, since those need the
+# correct time to work, but we likely won't acquire that without NTP. Let's
+# break this chicken-and-egg cycle here.
+Environment=SYSTEMD_NSS_RESOLVE_VALIDATE=0
+ExecStart=!!/usr/lib/systemd/systemd-timesyncd
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
+PrivateDevices=yes
+PrivateTmp=disconnected
+ProtectProc=invisible
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectHostname=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectSystem=strict
+Restart=always
+RestartSec=0
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+RuntimeDirectory=systemd/timesync
+StateDirectory=systemd/timesync
+SystemCallArchitectures=native
+SystemCallErrorNumber=EPERM
+SystemCallFilter=@system-service @clock
+Type=notify
+User=systemd-timesync
+WatchdogSec=3min
+
+[Install]
+WantedBy=sysinit.target
+Alias=dbus-org.freedesktop.timesync1.service
diff --git a/straper/db/public/services/custom-units/dnsmasq.service b/straper/db/public/services/custom-units/dnsmasq.service
new file mode 100644
index 0000000..a7be6d9
--- /dev/null
+++ b/straper/db/public/services/custom-units/dnsmasq.service
@@ -0,0 +1,18 @@
+[Unit]
+Description=dnsmasq (local DNS forwarder)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=/usr/sbin/dnsmasq -k \
+  --no-resolv \
+  --resolv-file=/dev/null \
+  --server=127.0.0.1#5353 \
+  --conf-file=/etc/dnsmasq.conf \
+  --conf-dir=/etc/dnsmasq.d,*.conf
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target
diff --git a/straper/db/public/services/custom-units/docker.service.d/override.conf b/straper/db/public/services/custom-units/docker.service.d/override.conf
new file mode 100644
index 0000000..614a548
--- /dev/null
+++ b/straper/db/public/services/custom-units/docker.service.d/override.conf
@@ -0,0 +1,3 @@
+[Unit]
+After=nftables.service
+Wants=nftables.service
diff --git a/straper/db/public/services/custom-units/loki.service b/straper/db/public/services/custom-units/loki.service
new file mode 100644
index 0000000..2885fac
--- /dev/null
+++ b/straper/db/public/services/custom-units/loki.service
@@ -0,0 +1,16 @@
+[Unit]
+Description=Loki service
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=loki
+ExecStart=/usr/bin/loki -config.file /etc/loki/config.yml
+# Give a reasonable amount of time for the server to start up/shut down
+TimeoutSec = 120
+Restart = on-failure
+RestartSec = 2
+
+[Install]
+WantedBy=multi-user.target
diff --git a/straper/db/public/services/custom-units/lufi.service b/straper/db/public/services/custom-units/lufi.service
new file mode 100644
index 0000000..0d6c415
--- /dev/null
+++ b/straper/db/public/services/custom-units/lufi.service
@@ -0,0 +1,19 @@
+[Unit]
+Description=Lufi (Mojolicious)
+After=network.target
+
+[Service]
+Type=forking
+User=lufi
+Group=lufi
+WorkingDirectory=/srv/lufi
+Environment=MOJO_MODE=production
+ExecStart=/bin/bash -lc 'cd /srv/lufi && /usr/local/bin/carton exec hypnotoad script/lufi'
+ExecStop=/bin/bash -lc 'cd /srv/lufi && /usr/local/bin/carton exec hypnotoad -s script/lufi'
+PIDFile=/srv/lufi/hypnotoad.pid
+Restart=on-failure
+RestartSec=2
+
+[Install]
+WantedBy=multi-user.target
+
diff --git a/straper/db/public/services/custom-units/nftables.service.d/override.conf b/straper/db/public/services/custom-units/nftables.service.d/override.conf
new file mode 100644
index 0000000..fa12217
--- /dev/null
+++ b/straper/db/public/services/custom-units/nftables.service.d/override.conf
@@ -0,0 +1,2 @@
+[Unit]
+After=docker.service
diff --git a/straper/db/public/services/custom-units/paperless.service b/straper/db/public/services/custom-units/paperless.service
new file mode 100644
index 0000000..c95bc63
--- /dev/null
+++ b/straper/db/public/services/custom-units/paperless.service
@@ -0,0 +1,28 @@
+[Unit]
+Description=Paperless-ngx
+Requires=docker.service
+Wants=network-online.target
+After=docker.service network-online.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+WorkingDirectory=/srv/paperless
+
+# Wait until Docker actually answers
+ExecStartPre=/usr/bin/docker info
+
+# Retry startup in case of transient dbus / cgroup failure
+ExecStart=/bin/sh -c 'for i in 1 2 3 4 5; do /usr/bin/docker compose up -d && exit 0; sleep 10; done; exit 1'
+
+ExecStop=/usr/bin/docker compose down
+
+Restart=on-failure
+RestartSec=10
+StartLimitIntervalSec=0
+
+TimeoutStartSec=0
+
+[Install]
+WantedBy=multi-user.target
+
diff --git a/straper/db/public/services/custom-units/promtail.service b/straper/db/public/services/custom-units/promtail.service
new file mode 100644
index 0000000..258e40a
--- /dev/null
+++ b/straper/db/public/services/custom-units/promtail.service
@@ -0,0 +1,16 @@
+[Unit]
+Description=Promtail service
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=promtail
+ExecStart=/usr/bin/promtail -config.file /etc/promtail/config.yml
+# Give a reasonable amount of time for promtail to start up/shut down
+TimeoutSec = 60
+Restart = on-failure
+RestartSec = 2
+
+[Install]
+WantedBy=multi-user.target
diff --git a/straper/db/public/services/custom-units/smartd.service b/straper/db/public/services/custom-units/smartd.service
new file mode 100644
index 0000000..f2f175c
--- /dev/null
+++ b/straper/db/public/services/custom-units/smartd.service
@@ -0,0 +1,17 @@
+[Unit]
+Description=Self Monitoring and Reporting Technology (SMART) Daemon
+Documentation=man:smartd(8) man:smartd.conf(5)
+
+# Typically physical storage devices are managed by the host physical machine
+# Override it if you are using PCI/USB passthrough
+ConditionVirtualization=no
+
+[Service]
+Type=notify
+EnvironmentFile=-/etc/default/smartmontools
+ExecStart=/usr/sbin/smartd -n $smartd_opts
+ExecReload=/bin/kill -HUP $MAINPID
+
+[Install]
+WantedBy=multi-user.target
+Alias=smartd.service
diff --git a/straper/db/public/services/custom-units/speedtest-exporter.service b/straper/db/public/services/custom-units/speedtest-exporter.service
new file mode 100644
index 0000000..275b8e2
--- /dev/null
+++ b/straper/db/public/services/custom-units/speedtest-exporter.service
@@ -0,0 +1,13 @@
+[Unit]
+Description=Prometheus Speedtest Exporter
+After=network.target
+
+[Service]
+Type=simple
+User=lukasz
+ExecStart=/usr/bin/python3 -m prometheus_speedtest.prometheus_speedtest
+Environment=PYTHONPATH=/home/lukasz/.local/lib/python3.13/site-packages
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target
diff --git a/straper/db/public/services/custom-units/sshd.service b/straper/db/public/services/custom-units/sshd.service
new file mode 100644
index 0000000..0eb0d67
--- /dev/null
+++ b/straper/db/public/services/custom-units/sshd.service
@@ -0,0 +1,22 @@
+[Unit]
+Description=OpenBSD Secure Shell server
+Documentation=man:sshd(8) man:sshd_config(5)
+After=network.target nss-user-lookup.target auditd.service
+ConditionPathExists=!/etc/ssh/sshd_not_to_be_run
+
+[Service]
+EnvironmentFile=-/etc/default/ssh
+ExecStartPre=/usr/sbin/sshd -t
+ExecStart=/usr/sbin/sshd -D $SSHD_OPTS
+ExecReload=/usr/sbin/sshd -t
+ExecReload=/bin/kill -HUP $MAINPID
+KillMode=process
+Restart=on-failure
+RestartPreventExitStatus=255
+Type=notify
+RuntimeDirectory=sshd
+RuntimeDirectoryMode=0755
+
+[Install]
+WantedBy=multi-user.target
+Alias=sshd.service
diff --git a/straper/db/public/services/custom-units/zed.service b/straper/db/public/services/custom-units/zed.service
new file mode 100644
index 0000000..acc1230
--- /dev/null
+++ b/straper/db/public/services/custom-units/zed.service
@@ -0,0 +1,13 @@
+[Unit]
+Description=ZFS Event Daemon (zed)
+Documentation=man:zed(8)
+ConditionPathIsDirectory=/sys/module/zfs
+
+[Service]
+EnvironmentFile=-/etc/default/zfs
+ExecStart=/usr/sbin/zed -F
+Restart=always
+
+[Install]
+Alias=zed.service
+WantedBy=zfs.target
diff --git a/straper/db/public/services/custom-units/zfs-import-scan.service.d/override.conf b/straper/db/public/services/custom-units/zfs-import-scan.service.d/override.conf
new file mode 100644
index 0000000..83069c5
--- /dev/null
+++ b/straper/db/public/services/custom-units/zfs-import-scan.service.d/override.conf
@@ -0,0 +1,3 @@
+[Unit]
+After=cryptsetup.target lvm2-monitor.service
+Requires=cryptsetup.target lvm2-monitor.service