Initial commit

overlay/etc/fstab

@@ -0,0 +1,4 @@
+tmpfs /var/lib/rsyslog tmpfs defaults 0 0
+tmpfs /var/log tmpfs defaults 0 0
+tmpfs /var/lib/systemd tmpfs defaults 0 0
+tmpfs /var/lib/NetworkManager tmpfs defaults 0 0

overlay/etc/pam.d/xinit

@@ -0,0 +1,17 @@
+#%PAM-1.0
+auth       substack     system-auth
+auth       include      postlogin
+account    required     pam_nologin.so
+account    include      system-auth
+password   include      system-auth
+# pam_selinux.so close should be the first session rule
+session    required     pam_selinux.so close
+session    required     pam_loginuid.so
+# pam_selinux.so open should only be followed by sessions to be executed in the user context
+session    required     pam_selinux.so open
+session    required     pam_namespace.so
+session    optional     pam_keyinit.so force revoke
+session    include      system-auth
+session    required     pam_exec.so /usr/local/libexec/home-overlay.sh
+session    include      postlogin
+-session   optional     pam_ck_connector.so

overlay/etc/rsyslog.conf

@@ -0,0 +1,4 @@
+global(workDirectory="/var/lib/rsyslog")
+module(load="imjournal"
+       StateFile="imjournal.state")
+*.* @172.30.0.28

overlay/etc/systemd/system/xinit@.service

@@ -0,0 +1,21 @@
+[Unit]
+Description=Start X.org for user %I
+Wants=network-online.target
+After=network-online.target
+Wants=time-sync.target
+After=time-sync.target
+
+[Service]
+Type=simple
+User=%I
+WorkingDirectory=~
+PAMName=xinit
+TTYPath=/dev/tty7
+StandardInput=tty
+StandardOutput=journal
+StandardError=journal
+ExecStart=/usr/bin/startx
+Restart=always
+
+[Install]
+WantedBy=graphical.target

overlay/etc/systemd/user/firefox.service

@@ -0,0 +1,9 @@
+[Unit]
+Description=Firefox web browser
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/firefox
+Restart=always
+StandardInput=null
+StandardOutput=journal

overlay/etc/systemd/user/graphical.target

@@ -0,0 +1,4 @@
+[Unit]
+Description=Graphical Interface
+After=default.target
+AllowIsolate=yes

overlay/etc/systemd/user/graphical.target.wants/firefox.service

@@ -0,0 +1 @@
+../firefox.service

overlay/home/user/.xinitrc

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+xset s off
+xset -dpms
+systemctl --user import-environment DISPLAY
+systemctl --user start graphical.target
+exec matchbox-window-manager -use_titlebar no

overlay/root/.ssh/authorized_keys

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJsL5fSylmiJmBtW0DH/viAAmtU2E/2M17GPvysiyRs+ dustin@rosalina

overlay/usr/lib64/firefox/defaults/pref/autoconfig.js

@@ -0,0 +1,2 @@
+pref("general.config.filename", "firefox.cfg");
+pref("general.config.obscure_value", 0);

overlay/usr/lib64/firefox/distribution/policies.json

@@ -0,0 +1,10 @@
+{
+    "policies": {
+        "BlockAboutConfig": true,
+        "Extensions": {
+            "Install": [
+                "https://addons.mozilla.org/firefox/downloads/file/1105247/auto_fullscreen-1.0.0.2-fx.xpi"
+            ]
+        }
+    }
+}

overlay/usr/lib64/firefox/firefox.cfg

@@ -0,0 +1,2 @@
+// Load preferences from remote
+pref("autoadmin.global_config_url","http://rosalina.pyrocufflink.blue/~dustin/autoconfigfile.js");

overlay/usr/local/libexec/home-overlay.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+
+if mountpoint -q "${HOME}"; then
+    exit 0
+fi
+
+upperdir="${XDG_RUNTIME_DIR}"/home/rw
+workdir="${XDG_RUNTIME_DIR}"/home/.work
+
+mkdir -p "${upperdir}"
+mkdir -p "${workdir}"
+
+mount overlay \
+    -t overlay \
+    -o lowerdir="${HOME}",upperdir="${upperdir}",workdir="${workdir}" \
+    "${HOME}"
+chown "${PAM_USER}": "${HOME}"