dubo-dubon-duponey / docker-images Goto Github PK

Also get rid of debuerreotype.

Need to revive shell project

Needed:

• init #23
• how does that work for non root user? defer entirely to operator to use the appropriate uid?
• prepared folders from the current debian build stage, copied --from?

• Lynis
• https://github.com/emirozer/nixarmor/blob/master/debian_harden.sh
• https://github.com/OpenSCAP/openscap

Project does not look maintained anymore and cross-platform support is hit and miss.
Maybe evaluate moving to pulse altogether?
https://github.com/jfreymuth/pulse

git config --global url."http://127.0.0.1:1081/github".insteadOf https://github.com

Embrace regander.
Generalize so that it can handle more than the current set.
Allow passing curl options for specific servers (eg: for tlsv1.2 overrides).
Use proxy caching.

https://github.com/CharlesBlonde/libpurecoollink

Samba / vfs_fruit https://www.reddit.com/r/homelab/comments/83vkaz/howto_make_time_machine_backups_on_a_samba/

Most of the build system is in cue already: https://github.com/dubo-dubon-duponey/docker-images/tree/master/template/cue.mod/pkg/duponey.cloud

and could likely be reused as-is.

Integration point for dagger would be as a drop-in replacement for our current buildctl wrapper:

https://github.com/dubo-dubon-duponey/docker-images/blob/master/template/cue.mod/pkg/duponey.cloud/buildkit/buildctl/buildctl.cue

https://blog.phusion.nl/2015/01/20/docker-and-the-pid-1-zombie-reaping-problem/

• tini (or docker --init) seems interesting, although any complex entrypoint script cannot be used without bash
• still interesting to be able to go "FROM scratch"

pki: https://caddyserver.com/docs/caddyfile/directives/tls

Possibly reuse gablebee.

• https://gist.github.com/ChloeTigre/4c2022c0d1a281deedba6f7539a2e3ae
• https://wiki.samba.org/index.php/Configure_Samba_to_Work_Better_with_Mac_OS_X
• https://developer.apple.com/forums/thread/666293
• https://github.com/dperson/samba/blob/master/_etc_avahi_services_samba.service

moby/libnetwork#1729

Right now, this is preventing coreDNS from running on a bridge.

Running on macvlan requires some gymnastic on the host:

sudo ip link del dubo-shim 2>/dev/null
sudo ip link add dubo-shim link eno1 type macvlan mode bridge
sudo ip addr add 10.0.4.96/24 dev dubo-shim
sudo ip link set dubo-shim up
sudo ip route add 10.0.4.96/27 dev dubo-shim

Should rebuild every time there is a changed dependency and notify dependent images.

shairport-sync for eg supports mqtt and piping metadata (including cover art)

Task list:

• shairport
• librespot
• roon?
• review snapcast

More generally, make it more flexible.

Additionally, perform sanity debsums / debsecan et al

s390x and arm/v7 do not build.
Probably arm/v6 is bust as well
qemu core dumps on libcbin dpkg post install

May, or may not be due to outdated kernel on the build node.

This may be linked with the installation of crossbuild packages.

Review https://wiki.debian.org/Hardening and possibly embrace rebuilding from source instead of pulling in.

Allow for tlsv1.3 and proto '=https'

Embrace tmpfs for everything that is not supposed to be permanent.

Downside: everytime the logger restart, log entries might be duplicated

XDG_CONFIG_HOME et al

Task list:

• alac / shairport
• coredns / unbound

Find a way to force logs to stdout for recalcitrant services:

• Roon
• Plex

It's not clear what's going on with qemu.

• ability to have no cache
• multi-cache