app/cl.yaml

# Copyright 2025-2026 Thomas Hintz

# This file is part of Nassella.

# Nassella is free software: you can redistribute it and/or modify it under the
# terms of the GNU Affero General Public License as published by the Free
# Software Foundation, either version 3 of the License, or (at your option) any
# later version.

# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

# You should have received a copy of the GNU Affero General Public License
# along with Nassella. If not, see <https://www.gnu.org/licenses/>.

variant: flatcar
version: 1.1.0
passwd:
  users:
    - name: core
      ssh_authorized_keys_local:
        - config/ssh-keys
    - name: nextcloud
      uid: 1001
systemd:
  units:
    - name: nassella.mount
      enabled: true
      contents: |
        [Mount]
        What=/dev/disk/by-partlabel/appstorage
        Where=/nassella
        Type=ext4

        [Install]
        RequiredBy=local-fs.target
    - name: restic-restore.service
      enabled: true
      contents: |
        [Unit]
        Description=Run once on first boot, if needed, to restore a backup
        After=docker.service
        Requires=docker.service

        [Service]
        Type=oneshot
        EnvironmentFile=/restic-env
        ExecStart=/restic-restore.sh

        [Install]
        WantedBy=multi-user.target
    - name: app.service
      enabled: true
      contents_local: app/app.service
    - name: restic-snapshot.service
      enabled: true
      contents_local: app/restic-snapshot.service
    - name: restic-backup.service
      contents: |
        [Unit]
        Description=Backs up application data
        Conflicts=app.service

        [Service]
        Type=oneshot
        EnvironmentFile=/restic-env
        ExecStart=/restic-scheduled-snapshot.sh
        ExecStopPost=systemctl start app.service

    - name: restic-backup.timer
      enabled: true
      contents: |
        [Unit]
        Description=Run restic-backup.service at 3am PT

        [Timer]
        OnCalendar=*-*-* 10:00:00

        [Install]
        WantedBy=multi-user.target

    - name: unpack-app.service
      enabled: true
      contents: |
        [Unit]
        Description=Unpack /app
        Before=app.service
        [Service]
        Type=oneshot
        ExecStart=/unpack-app
        [Install]
        WantedBy=multi-user.target

    ### docker-compose sysext
    ### https://flatcar.github.io/sysext-bakery/docker_compose/
    - name: systemd-sysupdate.timer
      enabled: true
    - name: docker.service
      dropins:
        - name: 10-wait-docker.conf
          contents: |
            [Unit]
            After=nassella.mount
            Requires=nassella.mount
    - name: systemd-sysupdate.service
      dropins:
        - name: docker-compose.conf
          contents: |
            [Service]
            ExecStartPre=/usr/bin/sh -c "readlink --canonicalize /etc/extensions/docker-compose.raw > /tmp/docker-compose"
            ExecStartPre=/usr/lib/systemd/systemd-sysupdate -C docker-compose update
            ExecStartPost=/usr/bin/sh -c "readlink --canonicalize /etc/extensions/docker-compose.raw > /tmp/docker-compose-new"
            ExecStartPost=/usr/bin/sh -c "if ! cmp --silent /tmp/docker-compose /tmp/docker-compose-new; then touch /run/reboot-required; fi"

# device: /dev/disk/by-label/appstorage
storage:
  disks:
    # TODO I think this can be changed back to
    # device: /dev/disk/by-label/appstorage
    # I think it didn't work before becase the partition number was 0 (now correctly set to 1)
    - device: /dev/sda
#    - device: /dev/disk/by-label/appstorage
      wipe_table: false
      partitions:
        - label: appstorage
          number: 1
  filesystems:
    - device: /dev/disk/by-partlabel/appstorage
      format: ext4
      wipe_filesystem: false
  # trees:
  #   - path: /app
  #     local: app
  files:
    - path: /app.tar.gz
      mode: 0600
      contents:
        local: app.tar.gz
    - path: /restic-password
      contents:
        local: restic-password
    - path: /restic-env
      overwrite: true
      contents:
        local: restic-env
    - path: /restic-restore.sh
      mode: 0755
      contents:
        local: restic-restore.sh
    - path: /restic-snapshot.sh
      mode: 0755
      contents:
        local: restic-snapshot.sh
    - path: /restic-scheduled-snapshot.sh
      mode: 0755
      contents:
        local: restic-scheduled-snapshot.sh
    - path: /etc/ssh/sshd_config.d/custom.conf
      overwrite: true
      mode: 0600
      contents:
        inline: |
          PermitRootLogin no
          AllowUsers core
    - path: /unpack-app
      mode: 0755
      contents:
        inline: |
          #!/bin/sh
          set -e
          mkdir /app
          tar -xzf /app.tar.gz -C /
          rm /app.tar.gz
    ### docker-compose sysext
    ### https://flatcar.github.io/sysext-bakery/docker_compose/
    - path: /opt/extensions/docker-compose/docker-compose-5.1.4-x86-64.raw
      mode: 0644
      contents:
        source: https://extensions.flatcar.org/extensions/docker-compose-5.1.4-x86-64.raw
    - path: /etc/sysupdate.docker-compose.d/docker-compose.conf
      contents:
        source: https://extensions.flatcar.org/extensions/docker-compose.conf
    - path: /etc/sysupdate.d/noop.conf
      contents:
        source: https://extensions.flatcar.org/extensions/noop.conf
  links:
    - target: /opt/extensions/docker-compose/docker-compose-5.1.4-x86-64.raw
      path: /etc/extensions/docker-compose.raw
      hard: false