Upgrade to latest working Alpine Linux version

I can no longer format SD card in Gnome with lowercase name (dont know why) hence the change to uppercase. Silenced error produced by clean target when trying to remove non-existent Docker image

.env

@@ -7,7 +7,7 @@ CACHE_DIR=<%= $(pwd) %>/cache
 ALPINE_MIRROR=https://dl-cdn.alpinelinux.org/alpine
 ALPINE_ARCH=aarch64
 ALPINE_VER_MAJOR=3
-ALPINE_VER_MINOR=20
+ALPINE_VER_MINOR=21
 ALPINE_VER_PATCH=3
 REQUIREMENTS_FILE=required-apks.txt
 eth0=eth0

Makefile

@@ -22,9 +22,8 @@ init:
 	@echo "### Init..."
 	@./require ${DOT_ENV_FILE} alpine_source
 	@./require ${DOT_ENV_FILE} tailspin_bin
-	@./require ${DOT_ENV_FILE} age_bin
 	@echo "### Init done"
-	-@make vault/decrypt
+	@make vault/decrypt
 
 build: repository
 	@echo "### Assembling..."
@@ -41,21 +40,20 @@ build: repository
 	@./src/esh -o ${DIST_DIR}/hotspot.conf src/hotspot.conf ${DOT_ENV_PAIRS}
 	@./src/esh -o ${DIST_DIR}/wg0.conf src/wg0.conf ${DOT_ENV_PAIRS}
 	@cp secrets/*.psk ${DIST_DIR}
-	@cp src/authorized_keys ${DIST_DIR}
+	@cp secrets/authorized_keys ${DIST_DIR}
 	@cp src/config.toml ${DIST_DIR}
 	@cp src/logpattern.conf ${DIST_DIR}
 	@cp src/main.conf ${DIST_DIR}
 	@cp src/rsyslog.conf ${DIST_DIR}
 	@cp src/usercfg.txt ${DIST_DIR}
 	@cp src/watchdog.sh ${DIST_DIR}
-	@cp src/repository-builder/packager.rsa.pub ${DIST_DIR}
+	@cp secrets/packager.rsa.pub ${DIST_DIR}
 	@cp src/repository-builder/${REQUIREMENTS_FILE} ${DIST_DIR}
 	@echo "### Assembling done"
-	@make vault/encrypt
 
 card: clean build
 	@echo "### Copying to sdcard..."
-	@rsync -chavz --delete ${DIST_DIR}/ /media/$(shell whoami)/entropi
+	@rsync -chavz --delete ${DIST_DIR}/ /media/$(shell whoami)/ENTROPI
 	@echo "### Copying to sdcard done"
 	-@make clean
 
@@ -64,7 +62,7 @@ clean:
 	-@rm -rf ${DIST_DIR}
 	-@rm -rf tmp*
 	-@rm -f ${CACHE_DIR}/aport/${RELEASE_VERSION}/main/${ALPINE_ARCH}/APKINDEX.tar.gz
-	-@docker rmi ${BUILDER_DOCKER_IMAGE} 1> /dev/null
+	-@docker rmi ${BUILDER_DOCKER_IMAGE} >/dev/null 2>&1
 	@echo "### Cleaning done"
 
 mrproper: clean
@@ -96,8 +94,8 @@ repository: repository-builder
 		-e BUILDER_KEY_BASENAME=${BUILDER_KEY_BASENAME} \
 		-e BUILDER_UID=${BUILDER_UID} \
 		-e BUILDER_GID=${BUILDER_GID} \
-		-v $(PWD)/src/repository-builder/packager.rsa:/root/.abuild/packager.rsa \
-		-v $(PWD)/src/repository-builder/packager.rsa.pub:/root/.abuild/packager.rsa.pub \
+		-v $(PWD)/secrets/packager.rsa:/root/.abuild/packager.rsa \
+		-v $(PWD)/secrets/packager.rsa.pub:/root/.abuild/packager.rsa.pub \
 		-v $(PWD)/src/repository-builder/abuild.conf:/root/.abuild/abuild.conf \
 		-v ${CACHE_DIR}/aport:/mirror \
 		${BUILDER_DOCKER_IMAGE} build-repository \

README.md

@@ -36,3 +36,7 @@ AutoConnect=true
 ```
 
 All the files will be automatically picked up by the wifi daemon after the RaspberryPi finishes boot process
+
+### Troubleshooting
+
+Alpine 3.22.0 produces a lot of "Clock skew detected" errors during boot and fails to execute the `headless.start` script. Version 3.21.3 works fine.

require

@@ -1,41 +1,59 @@
 #!/bin/sh
 set -e
 
-# First argument is preprocessed .env file supposed to be in tmp.build.XXXXXXXXXX directory
-# Let's load it up
-. $1
+# If number of arguments not equal to two
+if [ $# -ne 2 ] ; then
+  echo "invalid argument"
+  exit 1
+fi
+
+DOT_ENV_FILE="$1"
+FUNCTION_TO_CALL="$2"
 
 alpine_source() {
-  find ${CACHE_DIR} -type f -name ${RELEASE_BASENAME}.tar.gz | grep -q ${RELEASE_BASENAME} || \
-  curl -sSL ${ALPINE_MIRROR}/${RELEASE_VERSION}/releases/${ALPINE_ARCH}/${RELEASE_BASENAME}.tar.gz -o ${CACHE_DIR}/${RELEASE_BASENAME}.tar.gz
+  find "$CACHE_DIR" -name "$RELEASE_BASENAME.tar.gz" -type f | grep -q . || \
+  wget "$ALPINE_MIRROR/$RELEASE_VERSION/releases/$ALPINE_ARCH/$RELEASE_BASENAME.tar.gz" -O "$CACHE_DIR/$RELEASE_BASENAME.tar.gz"
 
-  mkdir -p ${CACHE_DIR}/${RELEASE_BASENAME}
+  mkdir -p "$CACHE_DIR/$RELEASE_BASENAME"
 
-  find ${CACHE_DIR}/${RELEASE_BASENAME} -type d -empty -exec tar xfz ${CACHE_DIR}/${RELEASE_BASENAME}.tar.gz -C ${CACHE_DIR}/${RELEASE_BASENAME} \;
+  find "$CACHE_DIR" -name "$RELEASE_BASENAME" -type d -empty -exec \
+  tar --directory "$CACHE_DIR/$RELEASE_BASENAME" --extract --gzip --same-permissions --strip 1 --file="$CACHE_DIR/$RELEASE_BASENAME.tar.gz" \;
 }
 
 tailspin_bin() {
-  find ${CACHE_DIR} -type f -name tailspin.tar.gz | grep -q tailspin || \
-  curl -sSL https://github.com/bensadeh/tailspin/releases/download/4.0.0/tailspin-x86_64-unknown-linux-musl.tar.gz -o ${CACHE_DIR}/tailspin.tar.gz
+  find "$CACHE_DIR" -name tailspin.tar.gz -type f | grep -q . || \
+  wget https://github.com/bensadeh/tailspin/releases/download/4.0.0/tailspin-aarch64-unknown-linux-musl.tar.gz -O "$CACHE_DIR/tailspin.tar.gz"
 
-  mkdir -p ${CACHE_DIR}/tailspin
+  mkdir -p "$CACHE_DIR/tailspin"
 
-  find ${CACHE_DIR}/tailspin -type d -empty -exec tar xfz ${CACHE_DIR}/tailspin.tar.gz -C ${CACHE_DIR}/tailspin \;
+  find "$CACHE_DIR/tailspin" -type d -empty -exec tar xz -f "$CACHE_DIR/tailspin.tar.gz" -C "$CACHE_DIR/tailspin" \;
 }
 
-age_bin() {
-  find ${CACHE_DIR} -type d -name age-src | grep -q age-src || \
-  git clone https://github.com/wj/age.git ${CACHE_DIR}/age-src
-
-  mkdir -p ${CACHE_DIR}/age
-
-  find ${CACHE_DIR}/age -type d -empty -exec docker run --rm -v ${CACHE_DIR}/age:/usr/local/bin -e GOBIN=/usr/local/bin/ -v ${CACHE_DIR}/age-src:/usr/src/age -w /usr/src/age golang:1.22-alpine go install ./cmd/age \;
-}
+# Private function names start with underscore
+_init() {
+  . "$DOT_ENV_FILE"
 
+  mkdir -p "$CACHE_DIR/aport"
+  mkdir -p "$CACHE_DIR/extras"
   mkdir -p secrets
-mkdir -p ${CACHE_DIR}/aport
-mkdir -p ${CACHE_DIR}/extras
+}
 
-# Second argument is supposed to be name of the functions decalred above
-# Let's call it
-$2
+# Second argument is supposed to be name of one of the functions declared above
+# functions starting with underscore are ignored (considered private)
+FUNCTIONS=$(cat "$0" | awk '/\(\) {/ {print $1}' | rev | cut -c3- | rev | grep "^[^_]")
+FOUND_FN=0
+for FN in $FUNCTIONS; do
+  if [ "$FN" = "$FUNCTION_TO_CALL" ]; then
+    FOUND_FN=1
+  fi
+done
+
+if [ $FOUND_FN -eq 1 ]; then
+  _init
+
+  echo "Calling $FUNCTION_TO_CALL"
+  $FUNCTION_TO_CALL
+else
+  echo "invalid argument"
+  exit 1
+fi

src/headless.start

@@ -162,8 +162,10 @@ __setup_wireless_client() {
 	mkdir -p /var/lib/iwd/ap/
 
 	copyfile root:root 0644 ${SDCARD_MEDIA}/main.conf /etc/iwd/main.conf
-	copyfile root:root 0644 ${SDCARD_MEDIA}/NUMERI_AC11.psk /var/lib/iwd/NUMERI_AC11.psk
-	copyfile root:root 0644 ${SDCARD_MEDIA}/robusta_nomap.psk /var/lib/iwd/robusta_nomap.psk
+
+	for file in $(find ${SDCARD_MEDIA} -type f -name *.psk -exec basename {} \;); do
+		copyfile root:root 0644 ${SDCARD_MEDIA}/${file} /var/lib/iwd/${file}
+	done
 
 	copyfile root:root 0644 ${SDCARD_MEDIA}/hotspot.conf /var/lib/iwd/ap/<%= $ssid %>.ap
 	copyfile root:root 0700 ${SDCARD_MEDIA}/watchdog.sh /etc/wireguard/watchdog.sh
@@ -173,8 +175,8 @@ __setup_wireless_client() {
 	rc-service iwd start
 }
 
-/sbin/setup-hostname <%= $hostname %>
-/sbin/setup-timezone -z <%= $ROUTER_TIMEZONE %>
+setup-hostname <%= $hostname %>
+setup-timezone -z <%= $ROUTER_TIMEZONE %>
 
 __setup_local_repositories
 
@@ -198,7 +200,6 @@ mkdir -p /etc/wireguard
 copyfile root:root 0600 ${SDCARD_MEDIA}/wg0.conf /etc/wireguard/wg0.conf
 
 ln -s /etc/init.d/wg-quick /etc/init.d/wg-quick.wg0
-# rc-service wg-quick.wg0 start
 
 __setup_time
 

src/hotspot.conf

@@ -2,7 +2,7 @@
 DisableHT=true
 
 [Security]
-Passphrase=<% cat src/wifi-password.txt %>
+Passphrase=<% cat secrets/wifi-password.txt %>
 
 [IPv4]
 Address=<%= $wlan0_address %>

src/repository-builder/repository.Dockerfile

@@ -1,4 +1,3 @@
-# syntax = docker/dockerfile:1
 ARG ALPINE_DOCKER_IMAGE
 FROM $ALPINE_DOCKER_IMAGE
 

src/wg0.conf

@@ -1,12 +1,12 @@
 [Interface]
 ListenPort = <%= $wg_port %>
-PrivateKey = <%= $(cat src/wireguard.private.key) %>
+PrivateKey = <%= $(cat secrets/wireguard.private.key) %>
 Address = <%= $wg0_address %>
 DNS = <%= $wg0_gateway %>
 MTU = 1280
 
 [Peer]
-PublicKey = <%= $(cat src/wireguard.public.key) %>
+PublicKey = <%= $(cat secrets/wireguard.public.key) %>
 Endpoint = <%= $wg_server %>:<%= $wg_port %>
 AllowedIPs = 0.0.0.0/0
 PersistentKeepalive = 25

vault

@@ -1,38 +1,38 @@
 #!/bin/sh
 set -e
 
-FILES_IN_VAULT='./src/wifi-password.txt
-./src/repository-builder/packager.rsa
-./src/repository-builder/packager.rsa.pub
-./src/wireguard.private.key
-./src/wireguard.public.key
-./src/authorized_keys'
+FILES_IN_VAULT=$(find . -name *.age)
 
 age_encrypt() {
-  local input="$1"
-  local output="$1.tmp"
-  local AGE_PASSPHRASE=`cat ./.vault_password_file`
+  if [ $# -ne 1 ] ; then
+    echo "invalid argument"
+    exit 1
+  fi
 
-  ./cache/age/age --encrypt --passphrase --armor --output $output $input && rm $input && mv $output $input
+  AGE_PASSPHRASE=$(cat ./.vault_password_file) age --encrypt --passphrase --armor --output "$2" "$1"
 }
 
 age_decrypt() {
-  local input="$1"
-  local output="$1.tmp"
-  local AGE_PASSPHRASE=`cat ./.vault_password_file`
+  if [ $# -ne 1 ] ; then
+    echo "invalid argument"
+    exit 1
+  fi
 
-  ./cache/age/age --decrypt --output $output $input && rm $input && mv $output $input
+  BASENAME=$(basename $1 .age)
+
+  AGE_PASSPHRASE=$(cat ./.vault_password_file) age --decrypt --output "secrets/$BASENAME" "$1"
 }
 
+
 encrypt() {
   for FILE in $FILES_IN_VAULT; do
-    age_encrypt $FILE
+    age_encrypt "$FILE"
   done
 }
 
 decrypt() {
   for FILE in $FILES_IN_VAULT; do
-    age_decrypt $FILE
+    age_decrypt "$FILE"
   done
 }