Initial RK1 media-center image project

2026-08-17 18:42:29 +00:00
commit 5fe41e79e9
81 changed files with 5725 additions and 0 deletions
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+install -d -m 0755 /var/lib/rk1-media
+hostnamectl set-hostname rk1-media 2>/dev/null || printf 'rk1-media\n' >/etc/hostname
+
+for group_name in audio video render input; do
+  getent group "$group_name" >/dev/null || groupadd --system "$group_name"
+done
+
+getent group rkadmin >/dev/null || groupadd rkadmin
+if ! id rkadmin >/dev/null 2>&1; then
+  useradd --create-home --gid rkadmin --shell /bin/bash --groups sudo,adm,systemd-journal,video,render,audio,input rkadmin
+fi
+usermod --password '!' rkadmin
+install -d -o rkadmin -g rkadmin -m 0700 /home/rkadmin/.ssh
+install -o rkadmin -g rkadmin -m 0600 /opt/rk1-seed/authorized_keys /home/rkadmin/.ssh/authorized_keys
+
+install -d -m 0755 /etc/sudoers.d
+printf 'rkadmin ALL=(ALL:ALL) NOPASSWD: ALL\n' >/etc/sudoers.d/90-rkadmin
+chmod 0440 /etc/sudoers.d/90-rkadmin
+visudo --check --file=/etc/sudoers.d/90-rkadmin >/dev/null
+
+usermod --password '!' root
+if grep -q '^127\.0\.1\.1[[:space:]]' /etc/hosts; then
+  sed -i 's/^127\.0\.1\.1[[:space:]].*/127.0.1.1\trk1-media/' /etc/hosts
+else
+  printf '127.0.1.1\trk1-media\n' >>/etc/hosts
+fi
+rm -f /root/.not_logged_in_yet /etc/ssh/ssh_host_*
+ssh-keygen -A
+# ssh.service normally creates this through RuntimeDirectory=sshd. This
+# validation runs before ssh.service, so it must provide the directory itself.
+install -d -o root -g root -m 0755 /run/sshd
+/usr/sbin/sshd -t
+touch /var/lib/rk1-media/identity-ready
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+exec > >(tee -a /var/log/rk1-media-provision.log) 2>&1
+export DEBIAN_FRONTEND=noninteractive
+
+install -d -m 0755 /var/lib/rk1-media
+seed_archives=/opt/rk1-seed/debs
+# APT's --no-download mode only accepts dependency archives from its configured
+# cache, even when every package is also named as an absolute local path.  Make
+# the immutable image seed that cache rather than copying it into /var/cache.
+install -d -o root -g root -m 0755 "$seed_archives"
+install -d -o _apt -g root -m 0700 "$seed_archives/partial"
+mapfile -d '' debs < <(find "$seed_archives" -maxdepth 1 -type f -name '*.deb' -print0 | sort -z)
+((${#debs[@]} > 0)) || { echo 'Offline package bundle is empty' >&2; exit 1; }
+
+apt-get \
+  -o Dir::Cache::archives="$seed_archives" \
+  -o APT::Keep-Downloaded-Packages=true \
+  --no-download --no-install-recommends --yes install "${debs[@]}"
+ldconfig
+udevadm control --reload-rules
+# MODE/GROUP assignments for device nodes are applied on add events.  The misc
+# trigger covers the vendor MPP, RGA, and RKNN control nodes.
+udevadm trigger --action=add --subsystem-match=drm || true
+udevadm trigger --action=add --subsystem-match=dma_heap || true
+udevadm trigger --action=add --subsystem-match=misc || true
+udevadm settle
+
+install -d -m 0755 /usr/share/rk1-media
+held_packages=()
+while IFS= read -r package_name; do
+  case "$package_name" in
+    linux-image-*|linux-dtb-*|linux-u-boot-*|armbian-bsp-*)
+      apt-mark hold "$package_name" >/dev/null
+      held_packages+=("$package_name")
+      ;;
+  esac
+done < <(dpkg-query --show --showformat='${binary:Package}\n')
+printf '%s\n' "${held_packages[@]}" | LC_ALL=C sort -u \
+  >/usr/share/rk1-media/held-packages.txt
+dpkg-query --show --showformat='${binary:Package}\t${Version}\t${Architecture}\n' \
+  | LC_ALL=C sort >/usr/share/rk1-media/package-manifest.tsv
+
+systemctl disable --now kodi-pulse.service pulseaudio.service 2>/dev/null || true
+systemctl daemon-reload
+systemctl enable avahi-daemon.service kodi-rk.service
+# kodi-rk is ordered after this oneshot.  Queue it without waiting so systemd
+# can start it as soon as provisioning exits instead of deadlocking here.
+systemctl --no-block start avahi-daemon.service kodi-rk.service
+touch /var/lib/rk1-media/provisioned