Split repo: remove generic Aimee OS

Splitting the Home Assistant Yellow configuration into its own
repository; the generic Aimee OS build system and configuration are now
tracked in a separate repository.

overlay/etc/aimee-os/writable-etc

@@ -0,0 +1,3 @@
+d burp
+d mosquitto
+d nginx/ssl

overlay/etc/containers/policy.json

@@ -0,0 +1,32 @@
+{
+    "default": [
+        {
+            "type": "insecureAcceptAnything"
+        }
+    ],
+    "transports": {
+        "docker": {
+	    "registry.access.redhat.com": [
+		{
+		    "type": "signedBy",
+		    "keyType": "GPGKeys",
+		    "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
+		}
+	    ],
+	    "registry.redhat.io": [
+		{
+		    "type": "signedBy",
+		    "keyType": "GPGKeys",
+		    "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
+		}
+	    ]
+	},
+        "docker-daemon": {
+	    "": [
+		{
+		    "type": "insecureAcceptAnything"
+		}
+	    ]
+	}
+    }
+}

overlay/etc/containers/registries.conf

@@ -0,0 +1 @@
+unqualified-search-registries = ['docker.io', 'quay.io', 'registry.fedoraproject.org']

overlay/etc/containers/systemd/home-assistant.container

@@ -0,0 +1,19 @@
+[Unit]
+After=network-online.target
+Wants=network-online.target
+
+[Container]
+Image=ghcr.io/home-assistant/yellow-homeassistant:stable
+Network=host
+Volume=/var/lib/homeassistant:/config:Z
+User=300
+Group=300
+ReadOnly=true
+VolatileTmp=yes
+
+[Service]
+TimeoutStartSec=5min
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target

overlay/etc/containers/systemd/mosquitto.container

@@ -0,0 +1,19 @@
+[Unit]
+After=network-online.target
+Wants=network-online.target
+
+[Container]
+Image=docker.io/library/eclipse-mosquitto:latest
+Network=host
+Volume=/etc/mosquitto:/mosquitto/config:Z
+Volume=/var/lib/mosquitto:/mosquitto/data:Z
+Volume=/var/log/mosquitto:/mosquitto/log:Z
+User=301
+Group=301
+ReadOnly=true
+
+[Service]
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target

overlay/etc/containers/systemd/nginx.container

@@ -0,0 +1,26 @@
+# vim: set ft=systemd :
+[Unit]
+After=network-online.target
+Wants=network-online.target
+Requires=gen-nginx-cert.service
+
+[Container]
+Image=docker.io/library/nginx
+Network=host
+Volume=/etc/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
+Volume=/etc/nginx/conf.d:/etc/nginx/conf.d:ro
+Volume=/etc/nginx/ssl:/etc/nginx/ssl:ro
+Volume=/dev/log:/dev/log
+User=82
+Group=82
+AddCapability=CAP_NET_BIND_SERVICE
+ReadOnly=true
+VolatileTmp=yes
+
+[Service]
+ProtectSystem=full
+UMask=0077
+ExecReload=/usr/bin/podman exec systemd-%N nginx -s reload
+
+[Install]
+WantedBy=multi-user.target

overlay/etc/containers/systemd/zigbee2mqtt.container

@@ -0,0 +1,19 @@
+[Unit]
+After=network-online.target
+Wants=network-online.target
+
+[Container]
+Image=docker.io/koenkk/zigbee2mqtt:latest
+Network=host
+Volume=/var/lib/zigbee2mqtt:/app/data:Z
+User=302
+Group=302
+ReadOnly=true
+
+[Service]
+TimeoutStartSec=5min
+ProtectSystem=full
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target

overlay/etc/containers/systemd/zwavejs2mqtt.container

@@ -0,0 +1,19 @@
+[Unit]
+After=network-online.target
+Wants=network-online.target
+
+[Container]
+Image=docker.io/zwavejs/zwavejs2mqtt:latest
+Network=host
+Volume=/var/lib/zwavejs:/usr/src/app/store:Z
+User=303
+Group=303
+ReadOnly=true
+
+[Service]
+TimeoutStartSec=5min
+ProtectSystem=full
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target

overlay/etc/fstab

@@ -1 +0,0 @@
-PARTLABEL=dch-data /var btrfs subvol=var,nosuid,noexec,nodev 0 2

overlay/etc/locale.conf

@@ -1 +0,0 @@
-LANG=en_US.UTF-8

overlay/etc/locale.gen

@@ -1 +0,0 @@
-en_US.UTF-8 UTF-8

overlay/etc/mosquitto/mosquitto.conf

@@ -0,0 +1,901 @@
+# Config file for mosquitto
+#
+# See mosquitto.conf(5) for more information.
+#
+# Default values are shown, uncomment to change.
+#
+# Use the # character to indicate a comment, but only if it is the
+# very first character on the line.
+
+# =================================================================
+# General configuration
+# =================================================================
+
+# Use per listener security settings.
+#
+# It is recommended this option be set before any other options.
+#
+# If this option is set to true, then all authentication and access control
+# options are controlled on a per listener basis. The following options are
+# affected:
+#
+# acl_file
+# allow_anonymous
+# allow_zero_length_clientid
+# auto_id_prefix
+# password_file
+# plugin
+# plugin_opt_*
+# psk_file
+#
+# Note that if set to true, then a durable client (i.e. with clean session set
+# to false) that has disconnected will use the ACL settings defined for the
+# listener that it was most recently connected to.
+#
+# The default behaviour is for this to be set to false, which maintains the
+# setting behaviour from previous versions of mosquitto.
+#per_listener_settings false
+
+
+# This option controls whether a client is allowed to connect with a zero
+# length client id or not. This option only affects clients using MQTT v3.1.1
+# and later. If set to false, clients connecting with a zero length client id
+# are disconnected. If set to true, clients will be allocated a client id by
+# the broker. This means it is only useful for clients with clean session set
+# to true.
+#allow_zero_length_clientid true
+
+# If allow_zero_length_clientid is true, this option allows you to set a prefix
+# to automatically generated client ids to aid visibility in logs.
+# Defaults to 'auto-'
+#auto_id_prefix auto-
+
+# This option affects the scenario when a client subscribes to a topic that has
+# retained messages. It is possible that the client that published the retained
+# message to the topic had access at the time they published, but that access
+# has been subsequently removed. If check_retain_source is set to true, the
+# default, the source of a retained message will be checked for access rights
+# before it is republished. When set to false, no check will be made and the
+# retained message will always be published. This affects all listeners.
+#check_retain_source true
+
+# QoS 1 and 2 messages will be allowed inflight per client until this limit
+# is exceeded.  Defaults to 0. (No maximum)
+# See also max_inflight_messages
+#max_inflight_bytes 0
+
+# The maximum number of QoS 1 and 2 messages currently inflight per
+# client.
+# This includes messages that are partway through handshakes and
+# those that are being retried. Defaults to 20. Set to 0 for no
+# maximum. Setting to 1 will guarantee in-order delivery of QoS 1
+# and 2 messages.
+#max_inflight_messages 20
+
+# For MQTT v5 clients, it is possible to have the server send a "server
+# keepalive" value that will override the keepalive value set by the client.
+# This is intended to be used as a mechanism to say that the server will
+# disconnect the client earlier than it anticipated, and that the client should
+# use the new keepalive value. The max_keepalive option allows you to specify
+# that clients may only connect with keepalive less than or equal to this
+# value, otherwise they will be sent a server keepalive telling them to use
+# max_keepalive. This only applies to MQTT v5 clients. The default, and maximum
+# value allowable, is 65535.
+#
+# Set to 0 to allow clients to set keepalive = 0, which means no keepalive
+# checks are made and the client will never be disconnected by the broker if no
+# messages are received. You should be very sure this is the behaviour that you
+# want.
+#
+# For MQTT v3.1.1 and v3.1 clients, there is no mechanism to tell the client
+# what keepalive value they should use. If an MQTT v3.1.1 or v3.1 client
+# specifies a keepalive time greater than max_keepalive they will be sent a
+# CONNACK message with the "identifier rejected" reason code, and disconnected.
+#
+#max_keepalive 65535
+
+# For MQTT v5 clients, it is possible to have the server send a "maximum packet
+# size" value that will instruct the client it will not accept MQTT packets
+# with size greater than max_packet_size bytes. This applies to the full MQTT
+# packet, not just the payload. Setting this option to a positive value will
+# set the maximum packet size to that number of bytes. If a client sends a
+# packet which is larger than this value, it will be disconnected. This applies
+# to all clients regardless of the protocol version they are using, but v3.1.1
+# and earlier clients will of course not have received the maximum packet size
+# information. Defaults to no limit. Setting below 20 bytes is forbidden
+# because it is likely to interfere with ordinary client operation, even with
+# very small payloads.
+#max_packet_size 0
+
+# QoS 1 and 2 messages above those currently in-flight will be queued per
+# client until this limit is exceeded.  Defaults to 0. (No maximum)
+# See also max_queued_messages.
+# If both max_queued_messages and max_queued_bytes are specified, packets will
+# be queued until the first limit is reached.
+#max_queued_bytes 0
+
+# Set the maximum QoS supported. Clients publishing at a QoS higher than
+# specified here will be disconnected.
+#max_qos 2
+
+# The maximum number of QoS 1 and 2 messages to hold in a queue per client
+# above those that are currently in-flight.  Defaults to 1000. Set
+# to 0 for no maximum (not recommended).
+# See also queue_qos0_messages.
+# See also max_queued_bytes.
+#max_queued_messages 1000
+#
+# This option sets the maximum number of heap memory bytes that the broker will
+# allocate, and hence sets a hard limit on memory use by the broker.  Memory
+# requests that exceed this value will be denied. The effect will vary
+# depending on what has been denied. If an incoming message is being processed,
+# then the message will be dropped and the publishing client will be
+# disconnected. If an outgoing message is being sent, then the individual
+# message will be dropped and the receiving client will be disconnected.
+# Defaults to no limit.
+#memory_limit 0
+
+# This option sets the maximum publish payload size that the broker will allow.
+# Received messages that exceed this size will not be accepted by the broker.
+# The default value is 0, which means that all valid MQTT messages are
+# accepted. MQTT imposes a maximum payload size of 268435455 bytes.
+#message_size_limit 0
+
+# This option allows persistent clients (those with clean session set to false)
+# to be removed if they do not reconnect within a certain time frame.
+#
+# This is a non-standard option in MQTT V3.1 but allowed in MQTT v3.1.1.
+#
+# Badly designed clients may set clean session to false whilst using a randomly
+# generated client id. This leads to persistent clients that will never
+# reconnect. This option allows these clients to be removed.
+#
+# The expiration period should be an integer followed by one of h d w m y for
+# hour, day, week, month and year respectively. For example
+#
+# persistent_client_expiration 2m
+# persistent_client_expiration 14d
+# persistent_client_expiration 1y
+#
+# The default if not set is to never expire persistent clients.
+#persistent_client_expiration
+
+# Write process id to a file. Default is a blank string which means
+# a pid file shouldn't be written.
+# This should be set to /var/run/mosquitto/mosquitto.pid if mosquitto is
+# being run automatically on boot with an init script and
+# start-stop-daemon or similar.
+#pid_file
+
+# Set to true to queue messages with QoS 0 when a persistent client is
+# disconnected. These messages are included in the limit imposed by
+# max_queued_messages and max_queued_bytes
+# Defaults to false.
+# This is a non-standard option for the MQTT v3.1 spec but is allowed in
+# v3.1.1.
+#queue_qos0_messages false
+
+# Set to false to disable retained message support. If a client publishes a
+# message with the retain bit set, it will be disconnected if this is set to
+# false.
+#retain_available true
+
+# Disable Nagle's algorithm on client sockets. This has the effect of reducing
+# latency of individual messages at the potential cost of increasing the number
+# of packets being sent.
+#set_tcp_nodelay false
+
+# Time in seconds between updates of the $SYS tree.
+# Set to 0 to disable the publishing of the $SYS tree.
+#sys_interval 10
+
+# The MQTT specification requires that the QoS of a message delivered to a
+# subscriber is never upgraded to match the QoS of the subscription. Enabling
+# this option changes this behaviour. If upgrade_outgoing_qos is set true,
+# messages sent to a subscriber will always match the QoS of its subscription.
+# This is a non-standard option explicitly disallowed by the spec.
+#upgrade_outgoing_qos false
+
+# When run as root, drop privileges to this user and its primary
+# group.
+# Set to root to stay as root, but this is not recommended.
+# If set to "mosquitto", or left unset, and the "mosquitto" user does not exist
+# then it will drop privileges to the "nobody" user instead.
+# If run as a non-root user, this setting has no effect.
+# Note that on Windows this has no effect and so mosquitto should be started by
+# the user you wish it to run as.
+#user mosquitto
+
+# =================================================================
+# Listeners
+# =================================================================
+
+# Listen on a port/ip address combination. By using this variable
+# multiple times, mosquitto can listen on more than one port. If
+# this variable is used and neither bind_address nor port given,
+# then the default listener will not be started.
+# The port number to listen on must be given. Optionally, an ip
+# address or host name may be supplied as a second argument. In
+# this case, mosquitto will attempt to bind the listener to that
+# address and so restrict access to the associated network and
+# interface. By default, mosquitto will listen on all interfaces.
+# Note that for a websockets listener it is not possible to bind to a host
+# name.
+#
+# On systems that support Unix Domain Sockets, it is also possible
+# to create a # Unix socket rather than opening a TCP socket. In
+# this case, the port number should be set to 0 and a unix socket
+# path must be provided, e.g.
+# listener 0 /tmp/mosquitto.sock
+#
+# listener port-number [ip address/host name/unix socket path]
+#listener
+
+# By default, a listener will attempt to listen on all supported IP protocol
+# versions. If you do not have an IPv4 or IPv6 interface you may wish to
+# disable support for either of those protocol versions. In particular, note
+# that due to the limitations of the websockets library, it will only ever
+# attempt to open IPv6 sockets if IPv6 support is compiled in, and so will fail
+# if IPv6 is not available.
+#
+# Set to `ipv4` to force the listener to only use IPv4, or set to `ipv6` to
+# force the listener to only use IPv6. If you want support for both IPv4 and
+# IPv6, then do not use the socket_domain option.
+#
+#socket_domain
+
+# Bind the listener to a specific interface. This is similar to
+# the [ip address/host name] part of the listener definition, but is useful
+# when an interface has multiple addresses or the address may change. If used
+# with the [ip address/host name] part of the listener definition, then the
+# bind_interface option will take priority.
+# Not available on Windows.
+#
+# Example: bind_interface eth0
+#bind_interface
+
+# When a listener is using the websockets protocol, it is possible to serve
+# http data as well. Set http_dir to a directory which contains the files you
+# wish to serve. If this option is not specified, then no normal http
+# connections will be possible.
+#http_dir
+
+# The maximum number of client connections to allow. This is
+# a per listener setting.
+# Default is -1, which means unlimited connections.
+# Note that other process limits mean that unlimited connections
+# are not really possible. Typically the default maximum number of
+# connections possible is around 1024.
+#max_connections -1
+
+# The listener can be restricted to operating within a topic hierarchy using
+# the mount_point option. This is achieved be prefixing the mount_point string
+# to all topics for any clients connected to this listener. This prefixing only
+# happens internally to the broker; the client will not see the prefix.
+#mount_point
+
+# Choose the protocol to use when listening.
+# This can be either mqtt or websockets.
+# Certificate based TLS may be used with websockets, except that only the
+# cafile, certfile, keyfile, ciphers, and ciphers_tls13 options are supported.
+#protocol mqtt
+
+# Set use_username_as_clientid to true to replace the clientid that a client
+# connected with with its username. This allows authentication to be tied to
+# the clientid, which means that it is possible to prevent one client
+# disconnecting another by using the same clientid.
+# If a client connects with no username it will be disconnected as not
+# authorised when this option is set to true.
+# Do not use in conjunction with clientid_prefixes.
+# See also use_identity_as_username.
+#use_username_as_clientid
+
+# Change the websockets headers size. This is a global option, it is not
+# possible to set per listener. This option sets the size of the buffer used in
+# the libwebsockets library when reading HTTP headers. If you are passing large
+# header data such as cookies then you may need to increase this value. If left
+# unset, or set to 0, then the default of 1024 bytes will be used.
+#websockets_headers_size
+
+# -----------------------------------------------------------------
+# Certificate based SSL/TLS support
+# -----------------------------------------------------------------
+# The following options can be used to enable certificate based SSL/TLS support
+# for this listener. Note that the recommended port for MQTT over TLS is 8883,
+# but this must be set manually.
+#
+# See also the mosquitto-tls man page and the "Pre-shared-key based SSL/TLS
+# support" section. Only one of certificate or PSK encryption support can be
+# enabled for any listener.
+
+# Both of certfile and keyfile must be defined to enable certificate based
+# TLS encryption.
+
+# Path to the PEM encoded server certificate.
+#certfile
+
+# Path to the PEM encoded keyfile.
+#keyfile
+
+# If you wish to control which encryption ciphers are used, use the ciphers
+# option. The list of available ciphers can be optained using the "openssl
+# ciphers" command and should be provided in the same format as the output of
+# that command. This applies to TLS 1.2 and earlier versions only. Use
+# ciphers_tls1.3 for TLS v1.3.
+#ciphers
+
+# Choose which TLS v1.3 ciphersuites are used for this listener.
+# Defaults to "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256"
+#ciphers_tls1.3
+
+# If you have require_certificate set to true, you can create a certificate
+# revocation list file to revoke access to particular client certificates. If
+# you have done this, use crlfile to point to the PEM encoded revocation file.
+#crlfile
+
+# To allow the use of ephemeral DH key exchange, which provides forward
+# security, the listener must load DH parameters. This can be specified with
+# the dhparamfile option. The dhparamfile can be generated with the command
+# e.g. "openssl dhparam -out dhparam.pem 2048"
+#dhparamfile
+
+# By default an TLS enabled listener will operate in a similar fashion to a
+# https enabled web server, in that the server has a certificate signed by a CA
+# and the client will verify that it is a trusted certificate. The overall aim
+# is encryption of the network traffic. By setting require_certificate to true,
+# the client must provide a valid certificate in order for the network
+# connection to proceed. This allows access to the broker to be controlled
+# outside of the mechanisms provided by MQTT.
+#require_certificate false
+
+# cafile and capath define methods of accessing the PEM encoded
+# Certificate Authority certificates that will be considered trusted when
+# checking incoming client certificates.
+# cafile defines the path to a file containing the CA certificates.
+# capath defines a directory that will be searched for files
+# containing the CA certificates. For capath to work correctly, the
+# certificate files must have ".crt" as the file ending and you must run
+# "openssl rehash <path to capath>" each time you add/remove a certificate.
+#cafile
+#capath
+
+
+# If require_certificate is true, you may set use_identity_as_username to true
+# to use the CN value from the client certificate as a username. If this is
+# true, the password_file option will not be used for this listener.
+#use_identity_as_username false
+
+# -----------------------------------------------------------------
+# Pre-shared-key based SSL/TLS support
+# -----------------------------------------------------------------
+# The following options can be used to enable PSK based SSL/TLS support for
+# this listener. Note that the recommended port for MQTT over TLS is 8883, but
+# this must be set manually.
+#
+# See also the mosquitto-tls man page and the "Certificate based SSL/TLS
+# support" section. Only one of certificate or PSK encryption support can be
+# enabled for any listener.
+
+# The psk_hint option enables pre-shared-key support for this listener and also
+# acts as an identifier for this listener. The hint is sent to clients and may
+# be used locally to aid authentication. The hint is a free form string that
+# doesn't have much meaning in itself, so feel free to be creative.
+# If this option is provided, see psk_file to define the pre-shared keys to be
+# used or create a security plugin to handle them.
+#psk_hint
+
+# When using PSK, the encryption ciphers used will be chosen from the list of
+# available PSK ciphers. If you want to control which ciphers are available,
+# use the "ciphers" option.  The list of available ciphers can be optained
+# using the "openssl ciphers" command and should be provided in the same format
+# as the output of that command.
+#ciphers
+
+# Set use_identity_as_username to have the psk identity sent by the client used
+# as its username. Authentication will be carried out using the PSK rather than
+# the MQTT username/password and so password_file will not be used for this
+# listener.
+#use_identity_as_username false
+
+
+# =================================================================
+# Persistence
+# =================================================================
+
+# If persistence is enabled, save the in-memory database to disk
+# every autosave_interval seconds. If set to 0, the persistence
+# database will only be written when mosquitto exits. See also
+# autosave_on_changes.
+# Note that writing of the persistence database can be forced by
+# sending mosquitto a SIGUSR1 signal.
+#autosave_interval 1800
+
+# If true, mosquitto will count the number of subscription changes, retained
+# messages received and queued messages and if the total exceeds
+# autosave_interval then the in-memory database will be saved to disk.
+# If false, mosquitto will save the in-memory database to disk by treating
+# autosave_interval as a time in seconds.
+#autosave_on_changes false
+
+# Save persistent message data to disk (true/false).
+# This saves information about all messages, including
+# subscriptions, currently in-flight messages and retained
+# messages.
+# retained_persistence is a synonym for this option.
+#persistence false
+
+# The filename to use for the persistent database, not including
+# the path.
+#persistence_file mosquitto.db
+
+# Location for persistent database.
+# Default is an empty string (current directory).
+# Set to e.g. /var/lib/mosquitto if running as a proper service on Linux or
+# similar.
+#persistence_location
+
+
+# =================================================================
+# Logging
+# =================================================================
+
+# Places to log to. Use multiple log_dest lines for multiple
+# logging destinations.
+# Possible destinations are: stdout stderr syslog topic file dlt
+#
+# stdout and stderr log to the console on the named output.
+#
+# syslog uses the userspace syslog facility which usually ends up
+# in /var/log/messages or similar.
+#
+# topic logs to the broker topic '$SYS/broker/log/<severity>',
+# where severity is one of D, E, W, N, I, M which are debug, error,
+# warning, notice, information and message. Message type severity is used by
+# the subscribe/unsubscribe log_types and publishes log messages to
+# $SYS/broker/log/M/susbcribe or $SYS/broker/log/M/unsubscribe.
+#
+# The file destination requires an additional parameter which is the file to be
+# logged to, e.g. "log_dest file /var/log/mosquitto.log". The file will be
+# closed and reopened when the broker receives a HUP signal. Only a single file
+# destination may be configured.
+#
+# The dlt destination is for the automotive `Diagnostic Log and Trace` tool.
+# This requires that Mosquitto has been compiled with DLT support.
+#
+# Note that if the broker is running as a Windows service it will default to
+# "log_dest none" and neither stdout nor stderr logging is available.
+# Use "log_dest none" if you wish to disable logging.
+#log_dest stderr
+
+# Types of messages to log. Use multiple log_type lines for logging
+# multiple types of messages.
+# Possible types are: debug, error, warning, notice, information,
+# none, subscribe, unsubscribe, websockets, all.
+# Note that debug type messages are for decoding the incoming/outgoing
+# network packets. They are not logged in "topics".
+#log_type error
+#log_type warning
+#log_type notice
+#log_type information
+
+
+# If set to true, client connection and disconnection messages will be included
+# in the log.
+#connection_messages true
+
+# If using syslog logging (not on Windows), messages will be logged to the
+# "daemon" facility by default. Use the log_facility option to choose which of
+# local0 to local7 to log to instead. The option value should be an integer
+# value, e.g. "log_facility 5" to use local5.
+#log_facility
+
+# If set to true, add a timestamp value to each log message.
+#log_timestamp true
+
+# Set the format of the log timestamp. If left unset, this is the number of
+# seconds since the Unix epoch.
+# This is a free text string which will be passed to the strftime function. To
+# get an ISO 8601 datetime, for example:
+# log_timestamp_format %Y-%m-%dT%H:%M:%S
+#log_timestamp_format
+
+# Change the websockets logging level. This is a global option, it is not
+# possible to set per listener. This is an integer that is interpreted by
+# libwebsockets as a bit mask for its lws_log_levels enum. See the
+# libwebsockets documentation for more details. "log_type websockets" must also
+# be enabled.
+#websockets_log_level 0
+
+
+# =================================================================
+# Security
+# =================================================================
+
+# If set, only clients that have a matching prefix on their
+# clientid will be allowed to connect to the broker. By default,
+# all clients may connect.
+# For example, setting "secure-" here would mean a client "secure-
+# client" could connect but another with clientid "mqtt" couldn't.
+#clientid_prefixes
+
+# Boolean value that determines whether clients that connect
+# without providing a username are allowed to connect. If set to
+# false then a password file should be created (see the
+# password_file option) to control authenticated client access.
+#
+# Defaults to false, unless there are no listeners defined in the configuration
+# file, in which case it is set to true, but connections are only allowed from
+# the local machine.
+#allow_anonymous false
+
+# -----------------------------------------------------------------
+# Default authentication and topic access control
+# -----------------------------------------------------------------
+
+# Control access to the broker using a password file. This file can be
+# generated using the mosquitto_passwd utility. If TLS support is not compiled
+# into mosquitto (it is recommended that TLS support should be included) then
+# plain text passwords are used, in which case the file should be a text file
+# with lines in the format:
+# username:password
+# The password (and colon) may be omitted if desired, although this
+# offers very little in the way of security.
+#
+# See the TLS client require_certificate and use_identity_as_username options
+# for alternative authentication options. If a plugin is used as well as
+# password_file, the plugin check will be made first.
+#password_file
+
+# Access may also be controlled using a pre-shared-key file. This requires
+# TLS-PSK support and a listener configured to use it. The file should be text
+# lines in the format:
+# identity:key
+# The key should be in hexadecimal format without a leading "0x".
+# If an plugin is used as well, the plugin check will be made first.
+#psk_file
+
+# Control access to topics on the broker using an access control list
+# file. If this parameter is defined then only the topics listed will
+# have access.
+# If the first character of a line of the ACL file is a # it is treated as a
+# comment.
+# Topic access is added with lines of the format:
+#
+# topic [read|write|readwrite|deny] <topic>
+#
+# The access type is controlled using "read", "write", "readwrite" or "deny".
+# This parameter is optional (unless <topic> contains a space character) - if
+# not given then the access is read/write.  <topic> can contain the + or #
+# wildcards as in subscriptions.
+#
+# The "deny" option can used to explicity deny access to a topic that would
+# otherwise be granted by a broader read/write/readwrite statement. Any "deny"
+# topics are handled before topics that grant read/write access.
+#
+# The first set of topics are applied to anonymous clients, assuming
+# allow_anonymous is true. User specific topic ACLs are added after a
+# user line as follows:
+#
+# user <username>
+#
+# The username referred to here is the same as in password_file. It is
+# not the clientid.
+#
+#
+# If is also possible to define ACLs based on pattern substitution within the
+# topic. The patterns available for substition are:
+#
+# %c to match the client id of the client
+# %u to match the username of the client
+#
+# The substitution pattern must be the only text for that level of hierarchy.
+#
+# The form is the same as for the topic keyword, but using pattern as the
+# keyword.
+# Pattern ACLs apply to all users even if the "user" keyword has previously
+# been given.
+#
+# If using bridges with usernames and ACLs, connection messages can be allowed
+# with the following pattern:
+# pattern write $SYS/broker/connection/%c/state
+#
+# pattern [read|write|readwrite] <topic>
+#
+# Example:
+#
+# pattern write sensor/%u/data
+#
+# If an plugin is used as well as acl_file, the plugin check will be
+# made first.
+#acl_file
+
+# -----------------------------------------------------------------
+# External authentication and topic access plugin options
+# -----------------------------------------------------------------
+
+# External authentication and access control can be supported with the
+# plugin option. This is a path to a loadable plugin. See also the
+# plugin_opt_* options described below.
+#
+# The plugin option can be specified multiple times to load multiple
+# plugins. The plugins will be processed in the order that they are specified
+# here. If the plugin option is specified alongside either of
+# password_file or acl_file then the plugin checks will be made first.
+#
+# If the per_listener_settings option is false, the plugin will be apply to all
+# listeners. If per_listener_settings is true, then the plugin will apply to
+# the current listener being defined only.
+#
+# This option is also available as `auth_plugin`, but this use is deprecated
+# and will be removed in the future.
+#
+#plugin
+
+# If the plugin option above is used, define options to pass to the
+# plugin here as described by the plugin instructions. All options named
+# using the format plugin_opt_* will be passed to the plugin, for example:
+#
+# This option is also available as `auth_opt_*`, but this use is deprecated
+# and will be removed in the future.
+#
+# plugin_opt_db_host
+# plugin_opt_db_port
+# plugin_opt_db_username
+# plugin_opt_db_password
+
+
+# =================================================================
+# Bridges
+# =================================================================
+
+# A bridge is a way of connecting multiple MQTT brokers together.
+# Create a new bridge using the "connection" option as described below. Set
+# options for the bridges using the remaining parameters. You must specify the
+# address and at least one topic to subscribe to.
+#
+# Each connection must have a unique name.
+#
+# The address line may have multiple host address and ports specified. See
+# below in the round_robin description for more details on bridge behaviour if
+# multiple addresses are used. Note that if you use an IPv6 address, then you
+# are required to specify a port.
+#
+# The direction that the topic will be shared can be chosen by
+# specifying out, in or both, where the default value is out.
+# The QoS level of the bridged communication can be specified with the next
+# topic option. The default QoS level is 0, to change the QoS the topic
+# direction must also be given.
+#
+# The local and remote prefix options allow a topic to be remapped when it is
+# bridged to/from the remote broker. This provides the ability to place a topic
+# tree in an appropriate location.
+#
+# For more details see the mosquitto.conf man page.
+#
+# Multiple topics can be specified per connection, but be careful
+# not to create any loops.
+#
+# If you are using bridges with cleansession set to false (the default), then
+# you may get unexpected behaviour from incoming topics if you change what
+# topics you are subscribing to. This is because the remote broker keeps the
+# subscription for the old topic. If you have this problem, connect your bridge
+# with cleansession set to true, then reconnect with cleansession set to false
+# as normal.
+#connection <name>
+#address <host>[:<port>] [<host>[:<port>]]
+#topic <topic> [[[out | in | both] qos-level] local-prefix remote-prefix]
+
+# If you need to have the bridge connect over a particular network interface,
+# use bridge_bind_address to tell the bridge which local IP address the socket
+# should bind to, e.g. `bridge_bind_address 192.168.1.10`
+#bridge_bind_address
+
+# If a bridge has topics that have "out" direction, the default behaviour is to
+# send an unsubscribe request to the remote broker on that topic. This means
+# that changing a topic direction from "in" to "out" will not keep receiving
+# incoming messages. Sending these unsubscribe requests is not always
+# desirable, setting bridge_attempt_unsubscribe to false will disable sending
+# the unsubscribe request.
+#bridge_attempt_unsubscribe true
+
+# Set the version of the MQTT protocol to use with for this bridge. Can be one
+# of mqttv50, mqttv311 or mqttv31. Defaults to mqttv311.
+#bridge_protocol_version mqttv311
+
+# Set the clean session variable for this bridge.
+# When set to true, when the bridge disconnects for any reason, all
+# messages and subscriptions will be cleaned up on the remote
+# broker. Note that with cleansession set to true, there may be a
+# significant amount of retained messages sent when the bridge
+# reconnects after losing its connection.
+# When set to false, the subscriptions and messages are kept on the
+# remote broker, and delivered when the bridge reconnects.
+#cleansession false
+
+# Set the amount of time a bridge using the lazy start type must be idle before
+# it will be stopped. Defaults to 60 seconds.
+#idle_timeout 60
+
+# Set the keepalive interval for this bridge connection, in
+# seconds.
+#keepalive_interval 60
+
+# Set the clientid to use on the local broker. If not defined, this defaults to
+# 'local.<clientid>'. If you are bridging a broker to itself, it is important
+# that local_clientid and clientid do not match.
+#local_clientid
+
+# If set to true, publish notification messages to the local and remote brokers
+# giving information about the state of the bridge connection. Retained
+# messages are published to the topic $SYS/broker/connection/<clientid>/state
+# unless the notification_topic option is used.
+# If the message is 1 then the connection is active, or 0 if the connection has
+# failed.
+# This uses the last will and testament feature.
+#notifications true
+
+# Choose the topic on which notification messages for this bridge are
+# published. If not set, messages are published on the topic
+# $SYS/broker/connection/<clientid>/state
+#notification_topic
+
+# Set the client id to use on the remote end of this bridge connection. If not
+# defined, this defaults to 'name.hostname' where name is the connection name
+# and hostname is the hostname of this computer.
+# This replaces the old "clientid" option to avoid confusion. "clientid"
+# remains valid for the time being.
+#remote_clientid
+
+# Set the password to use when connecting to a broker that requires
+# authentication. This option is only used if remote_username is also set.
+# This replaces the old "password" option to avoid confusion. "password"
+# remains valid for the time being.
+#remote_password
+
+# Set the username to use when connecting to a broker that requires
+# authentication.
+# This replaces the old "username" option to avoid confusion. "username"
+# remains valid for the time being.
+#remote_username
+
+# Set the amount of time a bridge using the automatic start type will wait
+# until attempting to reconnect.
+# This option can be configured to use a constant delay time in seconds, or to
+# use a backoff mechanism based on "Decorrelated Jitter", which adds a degree
+# of randomness to when the restart occurs.
+#
+# Set a constant timeout of 20 seconds:
+# restart_timeout 20
+#
+# Set backoff with a base (start value) of 10 seconds and a cap (upper limit) of
+# 60 seconds:
+# restart_timeout 10 30
+#
+# Defaults to jitter with a base of 5 and cap of 30
+#restart_timeout 5 30
+
+# If the bridge has more than one address given in the address/addresses
+# configuration, the round_robin option defines the behaviour of the bridge on
+# a failure of the bridge connection. If round_robin is false, the default
+# value, then the first address is treated as the main bridge connection. If
+# the connection fails, the other secondary addresses will be attempted in
+# turn. Whilst connected to a secondary bridge, the bridge will periodically
+# attempt to reconnect to the main bridge until successful.
+# If round_robin is true, then all addresses are treated as equals. If a
+# connection fails, the next address will be tried and if successful will
+# remain connected until it fails
+#round_robin false
+
+# Set the start type of the bridge. This controls how the bridge starts and
+# can be one of three types: automatic, lazy and once. Note that RSMB provides
+# a fourth start type "manual" which isn't currently supported by mosquitto.
+#
+# "automatic" is the default start type and means that the bridge connection
+# will be started automatically when the broker starts and also restarted
+# after a short delay (30 seconds) if the connection fails.
+#
+# Bridges using the "lazy" start type will be started automatically when the
+# number of queued messages exceeds the number set with the "threshold"
+# parameter. It will be stopped automatically after the time set by the
+# "idle_timeout" parameter. Use this start type if you wish the connection to
+# only be active when it is needed.
+#
+# A bridge using the "once" start type will be started automatically when the
+# broker starts but will not be restarted if the connection fails.
+#start_type automatic
+
+# Set the number of messages that need to be queued for a bridge with lazy
+# start type to be restarted. Defaults to 10 messages.
+# Must be less than max_queued_messages.
+#threshold 10
+
+# If try_private is set to true, the bridge will attempt to indicate to the
+# remote broker that it is a bridge not an ordinary client. If successful, this
+# means that loop detection will be more effective and that retained messages
+# will be propagated correctly. Not all brokers support this feature so it may
+# be necessary to set try_private to false if your bridge does not connect
+# properly.
+#try_private true
+
+# Some MQTT brokers do not allow retained messages. MQTT v5 gives a mechanism
+# for brokers to tell clients that they do not support retained messages, but
+# this is not possible for MQTT v3.1.1 or v3.1. If you need to bridge to a
+# v3.1.1 or v3.1 broker that does not support retained messages, set the
+# bridge_outgoing_retain option to false. This will remove the retain bit on
+# all outgoing messages to that bridge, regardless of any other setting.
+#bridge_outgoing_retain true
+
+# If you wish to restrict the size of messages sent to a remote bridge, use the
+# bridge_max_packet_size option. This sets the maximum number of bytes for
+# the total message, including headers and payload.
+# Note that MQTT v5 brokers may provide their own maximum-packet-size property.
+# In this case, the smaller of the two limits will be used.
+# Set to 0 for "unlimited".
+#bridge_max_packet_size 0
+
+
+# -----------------------------------------------------------------
+# Certificate based SSL/TLS support
+# -----------------------------------------------------------------
+# Either bridge_cafile or bridge_capath must be defined to enable TLS support
+# for this bridge.
+# bridge_cafile defines the path to a file containing the
+# Certificate Authority certificates that have signed the remote broker
+# certificate.
+# bridge_capath defines a directory that will be searched for files containing
+# the CA certificates. For bridge_capath to work correctly, the certificate
+# files must have ".crt" as the file ending and you must run "openssl rehash
+# <path to capath>" each time you add/remove a certificate.
+#bridge_cafile
+#bridge_capath
+
+
+# If the remote broker has more than one protocol available on its port, e.g.
+# MQTT and WebSockets, then use bridge_alpn to configure which protocol is
+# requested. Note that WebSockets support for bridges is not yet available.
+#bridge_alpn
+
+# When using certificate based encryption, bridge_insecure disables
+# verification of the server hostname in the server certificate. This can be
+# useful when testing initial server configurations, but makes it possible for
+# a malicious third party to impersonate your server through DNS spoofing, for
+# example. Use this option in testing only. If you need to resort to using this
+# option in a production environment, your setup is at fault and there is no
+# point using encryption.
+#bridge_insecure false
+
+# Path to the PEM encoded client certificate, if required by the remote broker.
+#bridge_certfile
+
+# Path to the PEM encoded client private key, if required by the remote broker.
+#bridge_keyfile
+
+# -----------------------------------------------------------------
+# PSK based SSL/TLS support
+# -----------------------------------------------------------------
+# Pre-shared-key encryption provides an alternative to certificate based
+# encryption. A bridge can be configured to use PSK with the bridge_identity
+# and bridge_psk options. These are the client PSK identity, and pre-shared-key
+# in hexadecimal format with no "0x". Only one of certificate and PSK based
+# encryption can be used on one
+# bridge at once.
+#bridge_identity
+#bridge_psk
+
+
+# =================================================================
+# External config files
+# =================================================================
+
+# External configuration files may be included by using the
+# include_dir option. This defines a directory that will be searched
+# for config files. All files that end in '.conf' will be loaded as
+# a configuration file. It is best to have this as the last option
+# in the main file. This option will only be processed from the main
+# configuration file. The directory specified must not contain the
+# main configuration file.
+# Files within include_dir will be loaded sorted in case-sensitive
+# alphabetical order, with capital letters ordered first. If this option is
+# given multiple times, all of the files from the first instance will be
+# processed before the next instance. See the man page for examples.
+#include_dir

overlay/etc/nginx/conf.d/default.conf

@@ -0,0 +1,70 @@
+# vim: set sw=4 ts=4 sts=4 et :
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
+
+server {
+    listen       80 default_server;
+    listen       [::]:80 default_server;
+    server_name  _;
+    root         /usr/share/nginx/html;
+
+    return 301 https://$host$request_uri;
+
+    error_page 500 502 503 504 /50x.html;
+
+    location = /50x.html { }
+}
+
+server {
+    listen       443 ssl http2 default_server;
+    listen       [::]:443 ssl http2 default_server;
+    server_name  _;
+    root         /usr/share/nginx/html;
+
+    ssl_certificate "/etc/nginx/ssl/server.crt";
+    ssl_certificate_key "/etc/nginx/ssl/server.key";
+    ssl_session_cache shared:SSL:1m;
+    ssl_prefer_server_ciphers on;
+
+    error_page 500 502 503 504 /50x.html;
+
+    add_header 
+        Strict-Transport-Security
+        "max-age=63072000; includeSubDomains"
+        always;
+
+    location = /50x.html { }
+
+    location = /zwave {
+        return 301 https://$host/zwave/;
+    }
+
+    location = /zigbee {
+        return 301 https://$host/zigbee/;
+    }
+
+    location /zwave/ {
+        proxy_pass http://127.0.0.1:8091/;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_set_header X-External-Path /zwave;
+    }
+
+    location /zigbee/ {
+        proxy_pass http://127.0.0.1:8080/;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_set_header X-External-Path /zigbee;
+    }
+
+    location / {
+        proxy_pass http://[::1]:8123/;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+    }
+}

overlay/etc/nginx/nginx.conf

@@ -0,0 +1,36 @@
+worker_processes  auto;
+
+error_log  stderr notice;
+pid        /tmp/nginx.pid;
+
+
+events {
+    worker_connections  1024;
+}
+
+
+http {
+    client_body_temp_path /tmp/client_temp;
+    proxy_temp_path       /tmp/proxy_temp;
+    fastcgi_temp_path     /tmp/fastcgi_temp;
+    uwsgi_temp_path       /tmp/uwsgi_temp;
+    scgi_temp_path        /tmp/scgi_temp;
+
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log  syslog:server=unix:/dev/log main;
+
+    sendfile        on;
+    #tcp_nopush     on;
+
+    keepalive_timeout  65;
+
+    #gzip  on;
+
+    include /etc/nginx/conf.d/*.conf;
+}

overlay/etc/resolv.conf

@@ -1 +0,0 @@
-../run/systemd/resolve/resolv.conf

overlay/etc/selinux/config

@@ -1,15 +0,0 @@
-# This file controls the state of SELinux on the system on boot.
-
-# SELINUX can take one of these three values:
-#	enforcing - SELinux security policy is enforced.
-#	permissive - SELinux prints warnings instead of enforcing.
-#	disabled - No SELinux policy is loaded.
-SELINUX=enforcing
-
-# SELINUXTYPE can take one of these four values:
-#	targeted - Only targeted network daemons are protected.
-#	strict   - Full SELinux protection.
-#	mls      - Full SELinux protection with Multi-Level Security
-#	mcs      - Full SELinux protection with Multi-Category Security 
-#	           (mls, but only one sensitivity level)
-SELINUXTYPE=mcs

overlay/etc/ssh/sshd_config

@@ -1,16 +0,0 @@
-PasswordAuthentication no
-
-UsePAM yes
-PrintMotd no
-PrintLastLog no
-
-Subsystem	sftp	/usr/lib64/misc/sftp-server
-
-AcceptEnv LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
-AcceptEnv COLORTERM
-
-HostKey /var/lib/ssh/ssh_host_rsa_key
-HostKey /var/lib/ssh/ssh_host_ecdsa_key
-HostKey /var/lib/ssh/ssh_host_ed25519_key
-
-Include /etc/ssh/sshd_config.d/*.conf

overlay/etc/ssh/sshd_config.d/authorized-keys-command.conf

@@ -1,2 +0,0 @@
-AuthorizedKeysCommand /usr/libexec/ssh-authorized-keys %u %t
-AuthorizedKeysCommandUser nobody

overlay/etc/systemd/network/90-default.network

@@ -1,5 +0,0 @@
-[Match]
-Type=ether
-
-[Network]
-DHCP=yes

overlay/etc/systemd/system/gen-nginx-cert.service

@@ -0,0 +1,40 @@
+# vim: set ft=systemd :
+[Unit]
+Description=Generate self-signed certificate for nginx
+Before=nginx.service
+ConditionPathExists=!/etc/nginx/ssl/server.crt
+
+[Service]
+Type=oneshot
+ExecStart=/usr/libexec/gen-nginx-cert
+User=root
+Group=nginx
+CapabilityBoundingSet=
+DeviceAllow=
+DevicePolicy=closed
+IPAddressDeny=any
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
+PrivateDevices=yes
+PrivateNetwork=yes
+PrivateTmp=yes
+PrivateUsers=yes
+ProcSubset=pid
+ProtectClock=yes
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectHostname=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectProc=invisible
+ProtectSystem=yes
+RestrictAddressFamilies=
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallFilter=~@privileged
+UMask=0027

overlay/etc/sysusers.d/homeassistant.conf

@@ -0,0 +1,2 @@
+u homeassistant 300 "Home Assistant" /var/lib/homeassistant /bin/sh
+g homeassistant 300

overlay/etc/sysusers.d/mosquitto.conf

@@ -0,0 +1,2 @@
+u mosquitto 301 "Eclipse Mosquitto MQTT Broker" /var/lib/mosquitto /sbin/nologin
+g mosquitto 301

overlay/etc/sysusers.d/zigbee2mqtt.conf

@@ -0,0 +1,2 @@
+u zigbee2mqtt 302 Zigbee2MQTT /var/lib/zigbee2mqtt /sbin/nologin
+g zigbee2mqtt 302

overlay/etc/sysusers.d/zwavejs2mqtt.conf

@@ -0,0 +1,3 @@
+u zwavejs 303 ZWaveJS /var/lib/zwavejs /sbin/nologin
+g zwavejs 303
+

overlay/etc/tmpfiles.d/homeassistant.conf

@@ -0,0 +1,8 @@
+v /var/lib/homeassistant 0700 homeassistant homeassistant - -
+C /var/lib/homeassistant/automations.yaml - - - -
+C /var/lib/homeassistant/configuration.yaml - - - -
+C /var/lib/homeassistant/groups.yaml - - - -
+C /var/lib/homeassistant/http.yaml - - - -
+C /var/lib/homeassistant/scenes.yaml - - - -
+C /var/lib/homeassistant/scripts.yaml - - - -
+C /var/lib/homeassistant/secrets.yaml - - - -

overlay/etc/tmpfiles.d/mosquitto.conf

@@ -0,0 +1,2 @@
+v /var/lib/mosquitto 0700 mosquitto mosquitto - -
+d /var/log/mosquitto 0755 mosquitto mosquitto - -

overlay/etc/tmpfiles.d/zigbee2mqtt.conf

@@ -0,0 +1 @@
+d /var/lib/zigbee2mqtt 0700 zigbee2mqtt zigbee2mqtt - -

overlay/etc/tmpfiles.d/zwavejs.conf

@@ -0,0 +1 @@
+d /var/lib/zwavejs 0700 zwavejs zwavejs - -

overlay/usr/bin/factory-reset

@@ -1,27 +0,0 @@
-#!/bin/sh
-# vim: set sw=4 ts=4 sts=4 et :
-
-. /lib/gentoo/functions.sh
-
-confirm() {
-    unset _confirm
-    printf '%s [y/N] ' "${1-Do you want to continue?}"
-    read _confirm
-    case "${_confirm}" in
-    [Yy]|[Yy][Ee][Ss])
-        return 0
-        ;;
-    *)
-        return 1
-        ;;
-    esac
-}
-
-printf "${WARN}"
-printf 'This operation will COMPLETELY ERASE all data and information '
-printf 'stored on this system!\n'
-printf "${NORMAL}"
-confirm || exit 9
-ewarn 'The system will now reboot and wipe all data.'
-systemctl enable --runtime factory-reset.service
-systemctl reboot

overlay/usr/bin/set-root-password

@@ -1,56 +0,0 @@
-#!/bin/sh
-# vim: set sw=4 ts=4 sts=4 et :
-
-if [ -z "${_UNSHARED}" ]; then
-    export _UNSHARED=1
-    exec unshare -m "$0" "$@"
-fi
-unset _UNSHARED
-
-cleanup() {
-    if is_mount -q /etc; then
-        umount -R /etc
-    fi
-    if [ -n "${tmpdir}" ] && [ "${tmpdir}" != / ]; then
-        if is_mount "${tmpdir}"; then
-            umount -R "${tmpdir}"
-        fi
-        rm -rf "${tmpdir}"
-    fi
-    unset tmpdir
-}
-
-is_mount() {
-    awk '
-        BEGIN { rc = 1 }
-        $5 == "'"${1}"'" { rc = 0 }
-        END { exit rc }
-    ' /proc/self/mountinfo
-}
-
-tmpdir=$(mktemp -d)
-trap 'cleanup' INT QUIT TERM EXIT
-mount \
-    -t tmpfs \
-    -o private,rootcontext=system_u:object_r:etc_t:s0 \
-    tmpfs \
-    "${tmpdir}" \
-    || exit
-
-mkdir -p \
-    "${tmpdir}"/etc \
-    "${tmpdir}"/etc/pam.d \
-    "${tmpdir}"/etc/security \
-    "${tmpdir}"/etc/selinux \
-    || exit
-cp -a /etc/passwd /etc/shadow "${tmpdir}"/etc || exit
-mount -o bind /etc/pam.d "${tmpdir}"/etc/pam.d || exit
-mount -o bind /etc/security "${tmpdir}"/etc/security || exit
-mount -o bind /etc/selinux "${tmpdir}"/etc/selinux || exit
-mount --rbind "${tmpdir}"/etc /etc || exit
-
-passwd || exit
-
-mv /etc/shadow "${tmpdir}"/shadow || exit
-umount -R /etc || exit
-cat "${tmpdir}"/shadow > /etc/shadow || exit

overlay/usr/bin/system-update

@@ -1,135 +0,0 @@
-#!/bin/sh
-# vim: set sw=4 ts=4 sts=4 et :
-
-cleanup() {
-    cd /
-    if [ -n "${workdir}" ] && [ "${workdir}" != / ]; then
-        rm -rf "${workdir}"
-    fi
-    unset workdir
-}
-
-die() {
-    rc=$?
-    if [ $rc -eq 0 ]; then
-        rc=1
-    fi
-    error "$@"
-    exit $rc
-}
-
-error() {
-    if [ $# -eq 1 ]; then
-        echo "$1" >&2
-    elif [ $# -gt 1 ]; then
-        printf "$@" >&2
-    fi
-}
-
-extract_update() {
-    zstd -dc update.tar.zstd | tar -x \
-        || die 'Could not extract update source'
-    sha256sum -c digests \
-        || die 'Invalid update source: checksum mismatch'
-}
-
-fetch_update() {
-    wget -O update.tar.zstd "$1"
-}
-
-get_root() {
-    set -- $(cat /proc/cmdline)
-    while [ $# -gt 0 ]; do
-        case "$1" in
-            root=*)
-                _root=${1#root=}
-                ;;
-        esac
-        shift
-    done
-    echo $(findfs "${_root}")
-}
-
-get_partlabel() {
-    blkid -o value -s PARTLABEL "$1"
-}
-
-help() {
-    usage
-}
-
-info() {
-    if [ $# -eq 1 ]; then
-        echo "$1" >&2
-    elif [ $# -gt 1 ]; then
-        printf "$@" >&2
-    fi
-}
-
-usage() {
-    printf 'usage: %s source_url\n' "${0##*/}"
-}
-
-while [ $# -gt 0 ]; do
-    case "$1" in
-    --help)
-        help
-        exit 0
-        ;;
-    *)
-        if [ -z "${source_url}" ]; then
-            source_url="$1"
-        else
-            usage >&2
-            exit 2
-        fi
-        ;;
-    esac
-    shift
-done
-
-if [ -z "${source_url}" ]; then
-    usage >&2
-    exit 2
-fi
-
-root=$(get_root)
-partlabel=$(get_partlabel "${root}")
-
-case "${partlabel}" in
-rootfs-a)
-    newpartlabel=rootfs-b
-    ;;
-rootfs-b)
-    newpartlabel=rootfs-a
-    ;;
-*)
-    die \
-        'Unsupported system configuration: invalid rootfs partition label: %s\n' \
-        "${partlabel}" >&2
-esac
-newroot=$(findfs PARTLABEL="${newpartlabel}")
-if [ -z "${newroot}" ]; then
-    die 'Could not find partition with label %s\n' "${partlabel}"
-fi
-info 'Current rootfs: %s (%s)\n' "${partlabel}" "${root}"
-info 'New rootfs: %s (%s)\n' "${newpartlabel}" "${newroot}"
-
-trap cleanup INT TERM QUIT EXIT
-workdir=$(mktemp -d)
-cd "${workdir}"
-
-fetch_update "${source_url}" || die 'Failed to fetch update source'
-extract_update || die 'Failed to extact update source'
-./install "${newroot}" || die 'Error installing system update'
-
-printf 'Do you want to reboot now? [y/N] '
-read confirm
-case "${confirm}" in
-[yY]|[yY][eE][sS])
-    systemctl reboot
-    ;;
-*)
-    info 'A reboot is required to complete the update'
-    ;;
-esac

overlay/usr/lib/firmware/brcm/brcmfmac43455-sdio.raspberrypi,4-compute-module-ha-yellow.bin.xz

@@ -1 +0,0 @@
-../cypress/cyfmac43455-sdio.bin.xz

overlay/usr/lib/firmware/brcm/brcmfmac43455-sdio.raspberrypi,4-compute-module-ha-yellow.txt.xz

@@ -1 +0,0 @@
-brcmfmac43455-sdio.raspberrypi,4-model-b.txt.xz

overlay/usr/lib/systemd/system-preset/80-local-default.preset

@@ -1,19 +0,0 @@
-enable auditd.service
-
-enable restorecon.service
-
-disable ldconfig.service
-
-disable systemd-userdbd.service
-disable systemd-userdbd.socket
-
-enable systemd-networkd-wait-online.service
-enable systemd-networkd.service
-enable systemd-networkd.socket
-
-#enable systemd-time-wait-sync.service
-
-disable getty@.service
-
-enable sshd.socket
-enable ssh-keygen.target

overlay/usr/lib/systemd/system/auditd.service.d/augenrules.conf

@@ -1,5 +0,0 @@
-[Service]
-# Do not run augenrules; read audit rules from the audit.rules file as
-# it exists already.  Audit rules are generated at build time.
-ExecStartPost=
-ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules

overlay/usr/lib/systemd/system/factory-reset.service

@@ -1,13 +0,0 @@
-[Unit]
-Description=Perform a factory reset
-DefaultDependencies=no
-After=umount.target
-Before=systemd-reboot.service
-
-[Service]
-Type=oneshot
-ExecStart=/usr/libexec/factory-reset
-StandardOutput=kmsg+console
-
-[Install]
-WantedBy=final.target

overlay/usr/lib/systemd/system/init-storage.service

@@ -1,15 +0,0 @@
-[Unit]
-Description=Initialize persistent data storage
-DefaultDependencies=no
-Before=local-fs-pre.target
-After=systemd-journald.service
-After=systemd-remount-fs.service
-After=systemd-sysctl.service
-After=systemd-udev-trigger.service
-
-[Service]
-Type=oneshot
-ExecStart=/usr/libexec/init-storage
-StandardInput=null
-StandardOutput=journal+console
-StandardError=journal+console

overlay/usr/lib/systemd/system/ssh-keygen.target

@@ -1,7 +0,0 @@
-[Unit]
-Wants=ssh-keygen@rsa.service
-Wants=ssh-keygen@ecdsa.service
-Wants=ssh-keygen@ed25519.service
-
-[Install]
-WantedBy=multi-user.target

overlay/usr/lib/systemd/system/ssh-keygen@.service

@@ -1,11 +0,0 @@
-[Unit]
-Description=Generate SSH %I host key
-ConditionPathExists=!%S/ssh/ssh_host_%I_key
-
-[Service]
-Type=oneshot
-StateDirectory=ssh
-ExecStart=/usr/bin/ssh-keygen -t %I -f %S/ssh/ssh_host_%I_key -N ''
-
-[Install]
-WantedBy=sshd-keygen.target

overlay/usr/lib/systemd/system/sysinit.target.wants/init-storage.service

@@ -1 +0,0 @@
-../init-storage.service

overlay/usr/lib/systemd/system/systemd-tmpfiles-setup.service.d/force-subvol.conf

@@ -1,2 +0,0 @@
-[Service]
-Environment=SYSTEMD_TMPFILES_FORCE_SUBVOL=1

overlay/usr/libexec/factory-reset

@@ -1,11 +0,0 @@
-#!/bin/sh
-# vim: set sw=4 ts=4 sts=4 et :
-
-DATAPART=$(awk '$2=="/var"{print $1}' /etc/fstab)
-
-dev=$(findfs "${DATAPART}")
-if [ -z "${dev}" ]; then
-    printf 'Could not find data partition (%s)\n' "${DATAPART}" >&2
-    exit 1
-fi
-wipefs -fa "${dev}"

overlay/usr/libexec/gen-nginx-cert

@@ -0,0 +1,38 @@
+#!/bin/sh
+# vim: set sw=4 ts=4 sts=4 et :
+
+DAYS=90
+SUBJ=/CN=localhost
+ALG=EC
+CURVE=secp384r1
+
+if [ -f /etc/default/gen-nginx-cert ]; then
+    . /etc/default/gen-nginx-cert
+fi
+
+set -- \
+    -out /etc/nginx/ssl/server.key \
+    -algorithm "${ALG}"
+
+case "${ALG}" in
+EC)
+    set -- "$@" \
+        -pkeyopt ec_paramgen_curve:${CURVE} \
+        -pkeyopt ec_param_enc:named_curve
+    ;;
+RSA)
+    set -- "$@" \
+        -pkeyopt rsa_keygen_bits:${BITS:+4096}
+    ;;
+esac
+
+rm -f /etc/nginx/ssl/server.crt /etc/nginx/ssl/server.key
+: > /etc/nginx/ssl/server.key
+openssl genpkey "$@"
+openssl \
+	req -x509 \
+	-subj "${SUBJ}" \
+	-key /etc/nginx/ssl/server.key \
+	-out /etc/nginx/ssl/server.crt \
+	-sha256 \
+	-days "${DAYS}"

overlay/usr/libexec/init-storage

@@ -1,180 +0,0 @@
-#!/bin/sh
-# vim: set sw=4 ts=4 sts=4 et :
-
-SUBVOLUMES='
-    /var
-    /var/log
-    /var/tmp
-    /etc
-'
-
-cleanup() {
-    if [ -n "${tmpdir}" ] && [ "${tmpdir}" != / ]; then
-        if mountpoint -q "${tmpdir}"; then
-            umount "${tmpdir}"
-        fi
-        rm -rf "${tmpdir}"
-        unset tmpdir
-    fi
-}
-
-copy_var() {
-    dev="$1"
-
-    echo 'Copying /var contents to data volume'
-    mount -o subvol=var "${dev}" "${tmpdir}" || exit
-    cp -acuv /var/. "${tmpdir}" || exit
-    umount "${tmpdir}"
-}
-
-format_dev() {
-    dev="$1"
-    partno=$(partition_number "${dev}")
-    if [ -n "${partno}" ]; then
-        disk="$(get_disk "${dev}")"
-        if [ -n "${disk}" ]; then
-            printf 'Resizing partition %d on disk %s\n' \
-                "${partno}" \
-                "${disk}" \
-                >&2
-            resize_partition "${disk}" "${partno}"
-        else
-            printf 'Could not find disk for device %s\n' \
-                "${dev}" \
-                >&2
-        fi
-    fi
-
-    printf 'Creating BTRFS filesystem on %s\n' "${dev}"
-    mkfs.btrfs "${dev}" || exit
-
-    mount "${dev}" "${tmpdir}" || exit
-    for vol in ${SUBVOLUMES}; do
-        mkdir -p "${tmpdir}${vol%/*}" || exit
-        btrfs subvolume create "${tmpdir}${vol}" || exit
-    done
-    relabel_all
-    umount "${dev}" || exit
-}
-
-get_disk() {
-    _syspath=/sys/class/block/${1##*/}
-    [ -d "${_syspath}" ] || return 1
-    if [ ! -f "${_syspath}"/partition ]; then
-        readlink -f "${1}"
-        return $?
-    fi
-    _disk=$(readlink -f "${_syspath}"/..)
-    if [ -n "${_disk}" ]; then
-        printf '/dev/%s\n' "${_disk##*/}"
-        return 0
-    fi
-    return 1
-}
-
-has_fs() {
-    dev="$1"
-    fstype=$(blkid -o value -s TYPE "${dev}")
-    [ -n "${fstype}" ]
-}
-
-last_partition() {
-    cat /sys/class/block/"${1##*/}"/*/partition \
-        | sort -n \
-        | tail -n1
-}
-
-partition_number() {
-    cat /sys/class/block/${1##*/}/partition
-}
-
-relabel_all() {
-    selinuxtype=$(. /etc/selinux/config && echo ${SELINUXTYPE})
-    find "${tmpdir}" | \
-    setfiles \
-        -v \
-        -F \
-        -m \
-        -r "${tmpdir}" \
-        -s \
-        /etc/selinux/${selinuxtype}/contexts/files/file_contexts
-}
-
-resize_partition() {
-    _disk="${1}"
-    _part="${2}"
-    _lastpart=$(last_partition "${_disk}")
-    if [ "${_part}" -ne "${_lastpart}" ]; then
-        printf 'Cannot resize %s, it is not the last partition on the disk\n' \
-            "${_dev}" \
-            >&2
-        return 1
-    fi
-    _uuid=$(sfdisk --part-uuid "${_disk}" "${_part}") || return $?
-    _type=$(sfdisk --part-type "${_disk}" "${_part}") || return $?
-    _label=$(sfdisk --part-label "${_disk}" "${_part}") || return $?
-    sfdisk --delete "${_disk}" "${_part}" || return $?
-    printf 'type=%s, uuid=%s, name="%s"\n' \
-        "${_type}" \
-        "${_uuid}" \
-        "${_label}" \
-        | sfdisk -N "${_part}" "${_disk}" --force \
-        || return $?
-    partx -u "${_disk}"
-}
-
-setup_etc() {
-    dev="$1"
-
-    echo 'Initializing writable paths in /etc'
-    mount -o subvol=etc "${dev}" "${tmpdir}" || exit
-    if [ ! -f "${tmpdir}"/shadow ]; then
-        cp -ca /etc/shadow "${tmpdir}"/shadow || exit
-    fi
-    mount -o bind "${tmpdir}"/shadow /etc/shadow || exit
-    if [ -f /etc/aimee-os/writable-etc ]; then
-        while read type path; do
-            if [ ! -e "${tmpdir}/${path}" ]; then
-                if [ -e /etc/"${path}" ]; then
-                    case "${path}" in
-                    */*)
-                        mkdir -p "${tmpdir}/${path%/*}"
-                        ;;
-                    esac
-                    cp -ca /etc/"${path}" "${tmpdir}/${path}"
-                elif [ "${type}" = d ]; then
-                    mkdir -p "${tmpdir}/${path}"
-                elif [ "${type}" = f ]; then
-                    : > "${tmpdir}/${path}"
-                else
-                    printf 'Invalid path type %s for %s\n' \
-                        "${type}" \
-                        "${path}" \
-                        >&2
-                    continue
-                fi
-            fi
-            mount -o bind "${tmpdir}/${path}" /etc/"${path}"
-        done < /etc/aimee-os/writable-etc
-    fi
-    umount "${tmpdir}"
-}
-
-datapart=$(findfs $(awk '$2=="/var"{print $1}' /etc/fstab))
-if [ -b "${datapart}" ]; then
-    printf 'Found data partition: %s\n' "${datapart}"
-else
-    echo 'Could not identify data partition' >&2
-    exit 1
-fi
-
-trap cleanup INT TERM QUIT EXIT
-tmpdir=/run/storinit
-mkdir -p "${tmpdir}"
-
-if ! has_fs "${datapart}"; then
-    format_dev "${datapart}"
-fi
-
-setup_etc "${datapart}"
-copy_var "${datapart}"

overlay/usr/libexec/ssh-authorized-keys

@@ -1,4 +0,0 @@
-#!/bin/sh
-# vim: set sw=4 ts=4 sts=4 et :
-
-exec wget -q -O - https://sshkeys.pyrocufflink.blue/"$1"/"$2".pub

overlay/usr/share/factory/var/lib/homeassistant/automations.yaml

@@ -0,0 +1 @@
+[]

overlay/usr/share/factory/var/lib/homeassistant/configuration.yaml

@@ -0,0 +1,14 @@
+
+# Configure a default setup of Home Assistant (frontend, api, etc)
+default_config:
+
+http: !include http.yaml
+
+# Text to speech
+tts:
+  - platform: google_translate
+
+group: !include groups.yaml
+automation: !include automations.yaml
+script: !include scripts.yaml
+scene: !include scenes.yaml

overlay/usr/share/factory/var/lib/homeassistant/http.yaml

@@ -0,0 +1,4 @@
+server_host: '::1'
+trusted_proxies:
+- '::1'
+use_x_forwarded_for: true

overlay/usr/share/factory/var/lib/homeassistant/secrets.yaml

@@ -0,0 +1 @@
+{}