# vim: set syntax=yaml:

variant: fcos
version: 1.7.0
ignition:
  security:
    tls:
      certificate_authorities:
        - inline: |
            -----BEGIN CERTIFICATE-----
            MIIE6DCCA9CgAwIBAgIJANu+mC2Jt3uTMA0GCSqGSIb3DQEBCwUAMIGhMQswCQYD
            VQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTERMA8GA1UEBxMIU2FuIEpvc2Ux
            FTATBgNVBAoTDFpzY2FsZXIgSW5jLjEVMBMGA1UECxMMWnNjYWxlciBJbmMuMRgw
            FgYDVQQDEw9ac2NhbGVyIFJvb3QgQ0ExIjAgBgkqhkiG9w0BCQEWE3N1cHBvcnRA
            enNjYWxlci5jb20wIBcNMjUwMjAyMTYzODIwWhgPMjA1MjA2MjAxNjM4MjBaMIGh
            MQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTERMA8GA1UEBxMIU2Fu
            IEpvc2UxFTATBgNVBAoTDFpzY2FsZXIgSW5jLjEVMBMGA1UECxMMWnNjYWxlciBJ
            bmMuMRgwFgYDVQQDEw9ac2NhbGVyIFJvb3QgQ0ExIjAgBgkqhkiG9w0BCQEWE3N1
            cHBvcnRAenNjYWxlci5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
            AQCpPtJNLFlFOAQUV/p2gdqNJzW+TmObOYzoFa46jTjgSxpNz15URX8eMf/UNbNm
            1yt9OP6eLbTlqkxOUoFbdRhH6XIsdD0WhmINdhcrymgpJXn5ObRWWz/kpvyaSFVW
            q/suBgSa8Rjsc9j6LWcQZkJrjplcI6iEnSYES0H0lWWkMg76c3SFQwBhh1nUplYI
            w1/kn9pNmJKGyis3YDfyJI6F136ZxEziI0veCwu731eEqdGoqgd4fzeVV1+7VcF6
            hDPPlXqADeRtG+EPCgiVMF4xrmXjJF0kB92mRsXOqLBKA12FvFMedhiisPMp+vas
            QUx2wxTQMd14Bl/vXX7UK6e5AgMBAAGjggEdMIIBGTAdBgNVHQ4EFgQUubfdSs3D
            DgyGnV3f7BwEacVOmN8wDwYDVR0TAQH/BAUwAwEB/zCB1gYDVR0jBIHOMIHLgBS5
            t91KzcMODIadXd/sHARpxU6Y36GBp6SBpDCBoTELMAkGA1UEBhMCVVMxEzARBgNV
            BAgTCkNhbGlmb3JuaWExETAPBgNVBAcTCFNhbiBKb3NlMRUwEwYDVQQKEwxac2Nh
            bGVyIEluYy4xFTATBgNVBAsTDFpzY2FsZXIgSW5jLjEYMBYGA1UEAxMPWnNjYWxl
            ciBSb290IENBMSIwIAYJKoZIhvcNAQkBFhNzdXBwb3J0QHpzY2FsZXIuY29tggkA
            276YLYm3e5MwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4IBAQBZ257u
            6xcDnfq33Dhdi0h/g+5kz5wto+0w1U/y2V3bAfwOzvSiKfrOGEssYNVdv17qSOUC
            jFs/kvCmZnS2ZAr/iAxeD8qkC6Zb5552LRCiV4XHBaeN6Cd+YTJMgVKmBxFrsxlE
            PmauxO1aIwTf3eQmD+n5Yn7MkKClIedkfrwHq4s3ZvyvyplAwjSwyesmEz/5Gdk9
            XdhsfrIlWq8DyJijNGysBOceYOB6jmCijtwFG02ubAfiIMZ/BRC8+O7wjzDgRALz
            OC2+mQytSkKo8K6MskfEdjQGZctKaPISG344PQY/y4zKBf1JNpSfsTBzaI9lj7PK
            m7q2TzMp8s5DuGbK
            -----END CERTIFICATE-----
storage:
  directories:
    - path: /var/home/core/acme-dns
      user:
        name: core
      group:
        name: core
      mode: 0755
    - path: /var/home/core/acme-dns/conf
      user:
        name: core
      group:
        name: core
      mode: 0755
  files:
    - path: /etc/pki/ca-trust/source/anchors/ZscalerRootCertificate-2048-SHA256.crt
      mode: 0644
      contents:
        inline: |
          -----BEGIN CERTIFICATE-----
          MIIE6DCCA9CgAwIBAgIJANu+mC2Jt3uTMA0GCSqGSIb3DQEBCwUAMIGhMQswCQYD
          VQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTERMA8GA1UEBxMIU2FuIEpvc2Ux
          FTATBgNVBAoTDFpzY2FsZXIgSW5jLjEVMBMGA1UECxMMWnNjYWxlciBJbmMuMRgw
          FgYDVQQDEw9ac2NhbGVyIFJvb3QgQ0ExIjAgBgkqhkiG9w0BCQEWE3N1cHBvcnRA
          enNjYWxlci5jb20wIBcNMjUwMjAyMTYzODIwWhgPMjA1MjA2MjAxNjM4MjBaMIGh
          MQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTERMA8GA1UEBxMIU2Fu
          IEpvc2UxFTATBgNVBAoTDFpzY2FsZXIgSW5jLjEVMBMGA1UECxMMWnNjYWxlciBJ
          bmMuMRgwFgYDVQQDEw9ac2NhbGVyIFJvb3QgQ0ExIjAgBgkqhkiG9w0BCQEWE3N1
          cHBvcnRAenNjYWxlci5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
          AQCpPtJNLFlFOAQUV/p2gdqNJzW+TmObOYzoFa46jTjgSxpNz15URX8eMf/UNbNm
          1yt9OP6eLbTlqkxOUoFbdRhH6XIsdD0WhmINdhcrymgpJXn5ObRWWz/kpvyaSFVW
          q/suBgSa8Rjsc9j6LWcQZkJrjplcI6iEnSYES0H0lWWkMg76c3SFQwBhh1nUplYI
          w1/kn9pNmJKGyis3YDfyJI6F136ZxEziI0veCwu731eEqdGoqgd4fzeVV1+7VcF6
          hDPPlXqADeRtG+EPCgiVMF4xrmXjJF0kB92mRsXOqLBKA12FvFMedhiisPMp+vas
          QUx2wxTQMd14Bl/vXX7UK6e5AgMBAAGjggEdMIIBGTAdBgNVHQ4EFgQUubfdSs3D
          DgyGnV3f7BwEacVOmN8wDwYDVR0TAQH/BAUwAwEB/zCB1gYDVR0jBIHOMIHLgBS5
          t91KzcMODIadXd/sHARpxU6Y36GBp6SBpDCBoTELMAkGA1UEBhMCVVMxEzARBgNV
          BAgTCkNhbGlmb3JuaWExETAPBgNVBAcTCFNhbiBKb3NlMRUwEwYDVQQKEwxac2Nh
          bGVyIEluYy4xFTATBgNVBAsTDFpzY2FsZXIgSW5jLjEYMBYGA1UEAxMPWnNjYWxl
          ciBSb290IENBMSIwIAYJKoZIhvcNAQkBFhNzdXBwb3J0QHpzY2FsZXIuY29tggkA
          276YLYm3e5MwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4IBAQBZ257u
          6xcDnfq33Dhdi0h/g+5kz5wto+0w1U/y2V3bAfwOzvSiKfrOGEssYNVdv17qSOUC
          jFs/kvCmZnS2ZAr/iAxeD8qkC6Zb5552LRCiV4XHBaeN6Cd+YTJMgVKmBxFrsxlE
          PmauxO1aIwTf3eQmD+n5Yn7MkKClIedkfrwHq4s3ZvyvyplAwjSwyesmEz/5Gdk9
          XdhsfrIlWq8DyJijNGysBOceYOB6jmCijtwFG02ubAfiIMZ/BRC8+O7wjzDgRALz
          OC2+mQytSkKo8K6MskfEdjQGZctKaPISG344PQY/y4zKBf1JNpSfsTBzaI9lj7PK
          m7q2TzMp8s5DuGbK
          -----END CERTIFICATE-----
    - path: /etc/sysctl.d/99-rootless-ports.conf
      mode: 0644
      contents:
        inline: |
          # Allow rootless users to bind to ports 53 and above
          net.ipv4.ip_unprivileged_port_start=53
    - path: /etc/systemd/resolved.conf.d/disable-stub.conf
      mode: 0644
      contents:
        inline: |
          [Resolve]
          DNSStubListener=no
    - path: /var/lib/systemd/linger/core
      mode: 0644
    - path: /etc/systemd/system/user@1000.service.d/wait-for-network.conf
      mode: 0644
      contents:
        inline: |
          [Unit]
          After=network-online.target
          Wants=network-online.target
    - path: /var/home/core/acme-dns/conf/config.cfg
      mode: 0644
      contents:
        inline: |
          [general]
          # DNS interface. Note that systemd-resolved may reserve port 53 on 127.0.0.53
          # In this case acme-dns will error out and you will need to define the listening interface
          # for example: listen = "127.0.0.1:53"
          listen = "0.0.0.0:53"
          # protocol, "both", "both4", "both6", "udp", "udp4", "udp6" or "tcp", "tcp4", "tcp6"
          protocol = "both"
          # domain name to serve the requests off of
          domain = "auth.example.org"
          # zone name server
          nsname = "auth.example.org"
          # admin email address, where @ is substituted with .
          nsadmin = "admin.example.org"
          # predefined records served in addition to the TXT
          records = [
              # domain pointing to the public IP of your acme-dns server 
              "auth.example.org. A 198.51.100.1",
              # specify that auth.example.org will resolve any *.auth.example.org records
              "auth.example.org. NS auth.example.org.",
          ]
          # debug messages from CORS etc
          debug = false

          [database]
          # Database engine to use, sqlite or postgres
          engine = "postgres"
          # Connection string, filename for sqlite3 and postgres://$username:$password@$host/$db_name for postgres
          # Please note that the default Docker image uses path /var/lib/acme-dns/acme-dns.db for sqlite3
          #connection = "acme-dns.db"
          connection = "postgres://acmedns:CHANGE_ME@localhost/acmedns_db?sslmode=disable"

          [api]
          # listen ip eg. 127.0.0.1
          ip = "0.0.0.0"
          # disable registration endpoint
          disable_registration = false
          # listen port, eg. 443 for default HTTPS
          port = "80"
          # possible values: "letsencrypt", "letsencryptstaging", "cert", "none"
          tls = "none"
          # only used if tls = "cert"
          tls_cert_privkey = "/etc/tls/example.org/privkey.pem"
          tls_cert_fullchain = "/etc/tls/example.org/fullchain.pem"
          # only used if tls = "letsencrypt"
          acme_cache_dir = "api-certs"
          # optional e-mail address to which Let's Encrypt will send expiration notices for the API's cert
          notification_email = ""
          # CORS AllowOrigins, wildcards can be used
          corsorigins = [
              "*"
          ]
          # use HTTP header to get the client ip
          use_header = false
          # header name to pull the ip address / list of ip addresses from
          header_name = "X-Forwarded-For"

          [logconfig]
          # logging level: "error", "warning", "info" or "debug"
          loglevel = "info"
          # possible values: stdout, file
          logtype = "stdout"
          # file path for logfile
          logfile = "./acme-dns.log"
          # format, either "json" or "text"
          logformat = "json"
      user:
        name: core
      group:
        name: core
    - path: /etc/containers/systemd/users/1000/acme-dns.pod
      mode: 0644
      contents:
        inline: |
          [Unit]
          Description=Acme-DNS Pod

          [Pod]
          HostName=acme-dns
          PodName=acme-dns
          PublishPort=80:80
          PublishPort=443:443
          PublishPort=53:53
          PublishPort=53:53/udp

          [Service]
          Restart=always

          [Install]
          WantedBy=default.target
    - path: /etc/containers/systemd/users/1000/acme-dns-app.container
      mode: 0644
      contents:
        inline: |
          [Unit]
          Description=Acme-DNS Application
          Requires=acme-dns-db.service
          After=acme-dns-db.service

          [Container]
          Image=docker.io/joohoi/acme-dns:latest
          ContainerName=acme-dns-app
          Pod=acme-dns.pod
          Volume=/var/home/core/acme-dns/conf:/etc/acme-dns:ro,Z,U
          AutoUpdate=registry

          [Service]
          Restart=always
          SuccessExitStatus=0 2 143

          [Install]
          WantedBy=default.target
    - path: /etc/containers/systemd/users/1000/postgres-data.volume
      mode: 0644
      contents:
        inline: |
          [Unit]
          Description=PostgreSQL Data Volume for Acme-DNS

          [Volume]
    - path: /etc/containers/systemd/users/1000/acme-dns-db.container
      mode: 0644
      contents:
        inline: |
          [Unit]
          Description=Acme-DNS Database

          [Container]
          Image=docker.io/library/postgres:18-alpine
          ContainerName=acme-dns-db
          Environment=POSTGRES_PASSWORD="CHANGE_ME"
          Environment=POSTGRES_USER=acmedns
          Environment=POSTGRES_DB=acmedns_db
          Environment=PGDATA="/var/lib/postgresql/18/docker"
          HealthCmd=pg_isready -U $POSTGRES_USER -d $POSTGRES_DB || exit 1
          HealthInterval=10s
          HealthRetries=5
          HealthTimeout=5s
          Notify=healthy
          Pod=acme-dns.pod
          ShmSize=128mb
          Volume=postgres-data.volume:/var/lib/postgresql:U
          AutoUpdate=registry

          [Service]
          Restart=always

          [Install]
          WantedBy=default.target
  links:
    - path: /etc/resolv.conf
      target: /run/systemd/resolve/resolv.conf
      overwrite: true
    - path: /var/home/core/.config/systemd/user/default.target.wants/podman-auto-update.timer
      target: /usr/lib/systemd/user/podman-auto-update.timer
      user:
        name: core
      group:
        name: core
passwd:
  users:
    - name: core
      groups:
        - wheel
      password_hash: $y$j9T$HJvTSDNo7eu3J2QNS6uWl0$ksuJFKcExOT59VGdRIM.4pvkzLgm4tN.Ht4BgMIFFVD
      ssh_authorized_keys:
        - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHt5t46RUmxq0X1h+9G1b7vmwrEMgSFQapqOF18P3QYn