marvin
50b215f759
Arch image with turnstone (venv), dev toolkit, rootless podman; boots via boco (virtiofs shares, direct UID mapping for nested virtiofs). sshd ops channel + turnstone-server as guest marvin; state (SQLite db, config, work) on host shares; LLM via the TensorX OpenAI-compatible gateway (https://api.tensorx.ai/v1), reachable from the guest through both slirp layers with no relay.
49 lines
2.0 KiB
Bash
Executable File
49 lines
2.0 KiB
Bash
Executable File
#!/bin/bash
|
|
# VM entrypoint, exec'd as PID 1 by /boco/init (image runs as root).
|
|
# Starts sshd for ops access, prepares virtiofs share ownership, then
|
|
# drops to the marvin user and execs turnstone-server.
|
|
set -euo pipefail
|
|
|
|
export HOME=/home/marvin
|
|
|
|
# sshd: host keys baked per-boot, ops channel on guest port 22
|
|
ssh-keygen -A
|
|
mkdir -p /run/sshd
|
|
/usr/sbin/sshd
|
|
|
|
# virtiofs shares appear root-owned (host dir is owned by the host user,
|
|
# which maps to guest root) — hand them to marvin so the server and
|
|
# agent tools can write. Also ensure ~/.config stays marvin-owned:
|
|
# boco-init creates mount-point dirs as root, and rootless podman
|
|
# refuses to run when $HOME/.config is not owned by the user.
|
|
mkdir -p /var/lib/turnstone /home/marvin/.config
|
|
chown marvin:marvin /var/lib/turnstone /home/marvin/.config || true
|
|
chown -R marvin:marvin /home/marvin/work || true
|
|
|
|
# Rootless container networking (pasta/slirp4netns) needs TUN access;
|
|
# the guest has no udev, so devtmpfs leaves it root-only.
|
|
if [ ! -e /dev/net/tun ]; then
|
|
mkdir -p /dev/net
|
|
[ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200
|
|
fi
|
|
chmod 666 /dev/net/tun || true
|
|
|
|
# Seed the admin account (no-op when the user already exists — password
|
|
# is ignored on promotion). Runs as marvin so DB files it creates are
|
|
# marvin-owned. Override via image env or boot cmd:
|
|
# boco boot ... --cmd 'ADMIN_PASSWORD=... start-turnstone.sh'
|
|
ADMIN_USER="${ADMIN_USER:-marvin}"
|
|
ADMIN_PASSWORD="${ADMIN_PASSWORD:-marvin-turnstone}"
|
|
if [ "$ADMIN_PASSWORD" = "marvin-turnstone" ]; then
|
|
echo "start-turnstone: WARNING — default admin password in use; set ADMIN_PASSWORD to change it"
|
|
fi
|
|
setpriv --reuid=marvin --regid=marvin --init-groups \
|
|
/usr/local/bin/turnstone-admin create-admin \
|
|
--username "$ADMIN_USER" \
|
|
--password "$ADMIN_PASSWORD" \
|
|
|| echo "start-turnstone: admin seeding failed (continuing)"
|
|
|
|
# NOTE: turnstone reads $HOME/.config/turnstone/config.toml as marvin
|
|
exec setpriv --reuid=marvin --regid=marvin --init-groups \
|
|
/usr/local/bin/turnstone-server --host 0.0.0.0 --port 8080
|