Configuration¶

# ─── bootconf ────────────────────────────────────────────────────────────────
bootconf:
  enabled: true
  # Status files are written here after each run.
  directory: /var/lib/bootconf
  # Execution order for modules. Modules run sequentially in this order.
  # Omit to use the default order below.
  order:
    - system
    - users
    - wifi
    - ssh
    - services
    - files
    - templates
    - unitrun
    - shell

# ─── system ──────────────────────────────────────────────────────────────────
system:
  enabled: true
  hostname: myhost
  timezone: UTC

# ─── ssh ─────────────────────────────────────────────────────────────────────
ssh:
  enabled: true
  # Directory where host keys are written.
  directory: /etc/bootconf/ssh
  # Key type: ed25519 (default) or rsa
  keytype: ed25519
  # Generate a host key on first boot if one does not exist yet.
  generate_host_keys: true
  # Daemon: dropbear (default) or openssh
  daemon: dropbear

# ─── wifi ────────────────────────────────────────────────────────────────────
wifi:
  enabled: false
  directory: /etc/bootconf/wifi
  ssid: "MyNetwork"
  # Pre-computed WPA2 PSK hash (64 hex chars). Use: wpa_passphrase <ssid>
  # Do NOT use the plaintext password here.
  password_hash: "614b0b8c..."
  # ISO 3166-1 alpha-2 country code
  country: NL

# ─── services ────────────────────────────────────────────────────────────────
services:
  enabled: true
  # Sentinel files are written here.
  directory: /etc/bootconf/services
  services:
    - name: myservice
      # Systemd unit name for systemctl start and health checks.
      # Optional: defaults to name when not set.
      unit: myservice-daemon
      enabled: true
      # Write a sentinel file at <directory>/<name> when enabled.
      sentinel: true
      # Optionally copy a default config on first presence.
      default_config:
        copy: true
        source: /etc/myservice/myservice.conf
        destination: /data/config/myservice/myservice.conf

# ─── users ───────────────────────────────────────────────────────────────────
users:
  enabled: true
  # sysusers .conf files are written here.
  directory: /etc/bootconf/users
  # tmpfiles.d .conf files are written here. Each file contains a C directive
  # that copies /etc/skel into the home directory on first creation.
  tmpfiles_dir: /data/config/tmpfiles
  users:
    - name: admin
      enabled: true
      sudo: true
      # Defaults to /home/<name> if not set.
      home: /home/admin
      authorized_keys:
        - "ssh-ed25519 AAAA... admin@workstation"

# ─── files ───────────────────────────────────────────────────────────────────
files:
  enabled: true
  files:
    # Copy a file from source to destination.
    - source: /boot/firmware/config/app.conf
      destination: /etc/app/app.conf
      chmod: "640"
    # Write inline content to a file.
    - content: |
        [settings]
        key = value
      destination: /etc/app/settings.ini
      chmod: "640"

# ─── templates ───────────────────────────────────────────────────────────────
templates:
  enabled: true
  templates:
    - source: /boot/firmware/templates/app.conf.tpl
      destination: /etc/app/app.conf
      chmod: "640"
      variables:
        listen_address: "127.0.0.1"
        port: "8080"

# ─── shell ───────────────────────────────────────────────────────────────────
shell:
  enabled: true
  # Logs and firstboot sentinels are written here.
  directory: /var/lib/bootconf/shell
  # Prepend a directory to PATH for every command. Inherits environment PATH when empty.
  path: ""
  commands:
    - name: setup-db
      # If false (default), a non-zero exit stops the module.
      allow_fail: false
      # If true, runs only once — a sentinel prevents re-execution on subsequent boots.
      firstboot: true
      command: |
        /usr/local/bin/init-database.sh

# ─── unitrun ─────────────────────────────────────────────────────────────────
unitrun:
  enabled: true
  # If true, injects ConditionFirstBoot=yes into every generated unit.
  firstboot: false
  # Prepend a directory to PATH in every generated unit (e.g. /usr/lib/framework/bin).
  # Omitted when empty — no Environment=PATH line is written.
  path: ""
  # Shell scripts are written here.
  directory: /var/lib/bootconf/scripts
  units:
    - name: setup-overlay
      enabled: true
      # Lines written verbatim into the [Unit] section.
      dependencies:
        - After=local-fs.target
        - Before=network-pre.target
      command: |
        /usr/local/bin/setup-overlay.sh
        exit 0