Initial RK1 media-center image project

2026-08-17 18:42:29 +00:00
commit 5fe41e79e9
81 changed files with 5725 additions and 0 deletions
@@ -0,0 +1,2 @@
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Unattended-Upgrade "1";
@@ -0,0 +1,17 @@
+#clear Unattended-Upgrade::Allowed-Origins;
+#clear Unattended-Upgrade::Origins-Pattern;
+Unattended-Upgrade::Origins-Pattern {
+        "origin=Debian,codename=${distro_codename}-security,label=Debian-Security";
+};
+Unattended-Upgrade::Package-Blacklist {
+        "^linux-image-.*$";
+        "^linux-dtb-.*$";
+        "^linux-u-boot-.*$";
+        "^armbian-bsp-.*$";
+        "^mesa-.*$";
+        "^kodi.*$";
+        "^rknn.*$";
+        "^rockchip.*$";
+};
+Unattended-Upgrade::Automatic-Reboot "false";
+Unattended-Upgrade::Remove-Unused-Kernel-Packages "false";
@@ -0,0 +1 @@
+rk1-media
@@ -0,0 +1,7 @@
+PermitRootLogin no
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+PubkeyAuthentication yes
+AuthenticationMethods publickey
+PermitEmptyPasswords no
+AllowUsers rkadmin
@@ -0,0 +1 @@
+../rk1-media-provision.service
@@ -0,0 +1,15 @@
+[Unit]
+Description=RK1 media appliance identity and SSH hardening
+DefaultDependencies=no
+After=local-fs.target systemd-remount-fs.service
+Before=ssh.service sshd.service getty.target serial-getty.target multi-user.target
+ConditionPathExists=!/var/lib/rk1-media/identity-ready
+
+[Service]
+Type=oneshot
+RuntimeDirectory=sshd
+RuntimeDirectoryMode=0755
+ExecStart=/usr/local/sbin/rk1-media-identity
+
+[Install]
+WantedBy=sysinit.target
@@ -0,0 +1,14 @@
+[Unit]
+Description=Install the offline RK1 media appliance payload
+After=local-fs.target systemd-udev-settle.service rk1-media-identity.service
+Before=apt-daily.service apt-daily-upgrade.service kodi-rk.service
+ConditionPathExists=!/var/lib/rk1-media/provisioned
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/rk1-media-provision
+RemainAfterExit=yes
+TimeoutStartSec=20min
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,3 @@
+[Unit]
+Requires=rk1-media-identity.service
+After=rk1-media-identity.service
@@ -0,0 +1 @@
+../../rk1-media-identity.service
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+install -d -m 0755 /var/lib/rk1-media
+hostnamectl set-hostname rk1-media 2>/dev/null || printf 'rk1-media\n' >/etc/hostname
+
+for group_name in audio video render input; do
+  getent group "$group_name" >/dev/null || groupadd --system "$group_name"
+done
+
+getent group rkadmin >/dev/null || groupadd rkadmin
+if ! id rkadmin >/dev/null 2>&1; then
+  useradd --create-home --gid rkadmin --shell /bin/bash --groups sudo,adm,systemd-journal,video,render,audio,input rkadmin
+fi
+usermod --password '!' rkadmin
+install -d -o rkadmin -g rkadmin -m 0700 /home/rkadmin/.ssh
+install -o rkadmin -g rkadmin -m 0600 /opt/rk1-seed/authorized_keys /home/rkadmin/.ssh/authorized_keys
+
+install -d -m 0755 /etc/sudoers.d
+printf 'rkadmin ALL=(ALL:ALL) NOPASSWD: ALL\n' >/etc/sudoers.d/90-rkadmin
+chmod 0440 /etc/sudoers.d/90-rkadmin
+visudo --check --file=/etc/sudoers.d/90-rkadmin >/dev/null
+
+usermod --password '!' root
+if grep -q '^127\.0\.1\.1[[:space:]]' /etc/hosts; then
+  sed -i 's/^127\.0\.1\.1[[:space:]].*/127.0.1.1\trk1-media/' /etc/hosts
+else
+  printf '127.0.1.1\trk1-media\n' >>/etc/hosts
+fi
+rm -f /root/.not_logged_in_yet /etc/ssh/ssh_host_*
+ssh-keygen -A
+# ssh.service normally creates this through RuntimeDirectory=sshd. This
+# validation runs before ssh.service, so it must provide the directory itself.
+install -d -o root -g root -m 0755 /run/sshd
+/usr/sbin/sshd -t
+touch /var/lib/rk1-media/identity-ready
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+exec > >(tee -a /var/log/rk1-media-provision.log) 2>&1
+export DEBIAN_FRONTEND=noninteractive
+
+install -d -m 0755 /var/lib/rk1-media
+seed_archives=/opt/rk1-seed/debs
+# APT's --no-download mode only accepts dependency archives from its configured
+# cache, even when every package is also named as an absolute local path.  Make
+# the immutable image seed that cache rather than copying it into /var/cache.
+install -d -o root -g root -m 0755 "$seed_archives"
+install -d -o _apt -g root -m 0700 "$seed_archives/partial"
+mapfile -d '' debs < <(find "$seed_archives" -maxdepth 1 -type f -name '*.deb' -print0 | sort -z)
+((${#debs[@]} > 0)) || { echo 'Offline package bundle is empty' >&2; exit 1; }
+
+apt-get \
+  -o Dir::Cache::archives="$seed_archives" \
+  -o APT::Keep-Downloaded-Packages=true \
+  --no-download --no-install-recommends --yes install "${debs[@]}"
+ldconfig
+udevadm control --reload-rules
+# MODE/GROUP assignments for device nodes are applied on add events.  The misc
+# trigger covers the vendor MPP, RGA, and RKNN control nodes.
+udevadm trigger --action=add --subsystem-match=drm || true
+udevadm trigger --action=add --subsystem-match=dma_heap || true
+udevadm trigger --action=add --subsystem-match=misc || true
+udevadm settle
+
+install -d -m 0755 /usr/share/rk1-media
+held_packages=()
+while IFS= read -r package_name; do
+  case "$package_name" in
+    linux-image-*|linux-dtb-*|linux-u-boot-*|armbian-bsp-*)
+      apt-mark hold "$package_name" >/dev/null
+      held_packages+=("$package_name")
+      ;;
+  esac
+done < <(dpkg-query --show --showformat='${binary:Package}\n')
+printf '%s\n' "${held_packages[@]}" | LC_ALL=C sort -u \
+  >/usr/share/rk1-media/held-packages.txt
+dpkg-query --show --showformat='${binary:Package}\t${Version}\t${Architecture}\n' \
+  | LC_ALL=C sort >/usr/share/rk1-media/package-manifest.tsv
+
+systemctl disable --now kodi-pulse.service pulseaudio.service 2>/dev/null || true
+systemctl daemon-reload
+systemctl enable avahi-daemon.service kodi-rk.service
+# kodi-rk is ordered after this oneshot.  Queue it without waiting so systemd
+# can start it as soon as provisioning exits instead of deadlocking here.
+systemctl --no-block start avahi-daemon.service kodi-rk.service
+touch /var/lib/rk1-media/provisioned