Initial RK1 media-center image project

2026-08-17 18:42:29 +00:00
commit 5fe41e79e9
81 changed files with 5725 additions and 0 deletions
@@ -0,0 +1,2 @@
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Unattended-Upgrade "1";
@@ -0,0 +1,17 @@
+#clear Unattended-Upgrade::Allowed-Origins;
+#clear Unattended-Upgrade::Origins-Pattern;
+Unattended-Upgrade::Origins-Pattern {
+        "origin=Debian,codename=${distro_codename}-security,label=Debian-Security";
+};
+Unattended-Upgrade::Package-Blacklist {
+        "^linux-image-.*$";
+        "^linux-dtb-.*$";
+        "^linux-u-boot-.*$";
+        "^armbian-bsp-.*$";
+        "^mesa-.*$";
+        "^kodi.*$";
+        "^rknn.*$";
+        "^rockchip.*$";
+};
+Unattended-Upgrade::Automatic-Reboot "false";
+Unattended-Upgrade::Remove-Unused-Kernel-Packages "false";
@@ -0,0 +1 @@
+rk1-media
@@ -0,0 +1,7 @@
+PermitRootLogin no
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+PubkeyAuthentication yes
+AuthenticationMethods publickey
+PermitEmptyPasswords no
+AllowUsers rkadmin
@@ -0,0 +1 @@
+../rk1-media-provision.service
@@ -0,0 +1,15 @@
+[Unit]
+Description=RK1 media appliance identity and SSH hardening
+DefaultDependencies=no
+After=local-fs.target systemd-remount-fs.service
+Before=ssh.service sshd.service getty.target serial-getty.target multi-user.target
+ConditionPathExists=!/var/lib/rk1-media/identity-ready
+
+[Service]
+Type=oneshot
+RuntimeDirectory=sshd
+RuntimeDirectoryMode=0755
+ExecStart=/usr/local/sbin/rk1-media-identity
+
+[Install]
+WantedBy=sysinit.target
@@ -0,0 +1,14 @@
+[Unit]
+Description=Install the offline RK1 media appliance payload
+After=local-fs.target systemd-udev-settle.service rk1-media-identity.service
+Before=apt-daily.service apt-daily-upgrade.service kodi-rk.service
+ConditionPathExists=!/var/lib/rk1-media/provisioned
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/rk1-media-provision
+RemainAfterExit=yes
+TimeoutStartSec=20min
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,3 @@
+[Unit]
+Requires=rk1-media-identity.service
+After=rk1-media-identity.service
@@ -0,0 +1 @@
+../../rk1-media-identity.service