ci: update packer definition

dev/packer/digitalocean.json

@@ -2,10 +2,9 @@
   "variables": {
     "do_api_token": "{{env `DIGITALOCEAN_API_TOKEN`}}",
     "image_name": "wikijs-snapshot-{{timestamp}}",
-    "apt_packages": "apt-transport-https ca-certificates curl jq linux-image-extra-virtual software-properties-common gnupg-agent openssl ",
+    "apt_packages": "software-properties-common",
     "application_name": "Wiki.js",
-    "application_version": "{{env `WIKI_APP_VERSION`}}",
-    "docker_compose_version": "1.29.2"
+    "application_version": "{{env `WIKI_APP_VERSION`}}"
   },
   "sensitive-variables": [
     "do_api_token"
@@ -14,7 +13,7 @@
     {
       "type": "digitalocean",
       "api_token": "{{user `do_api_token`}}",
-      "image": "ubuntu-20-04-x64",
+      "image": "ubuntu-24-04-x64",
       "region": "tor1",
       "size": "s-1vcpu-1gb",
       "ssh_username": "root",
@@ -73,11 +72,8 @@
       ],
       "scripts": [
         "scripts/010-docker.sh",
-        "scripts/011-docker-compose.sh",
-        "scripts/012-grub-opts.sh",
-        "scripts/013-docker-dns.sh",
-        "scripts/014-ufw-docker.sh",
-        "scripts/020-application-tag.sh",
+        "scripts/011-ufw-docker.sh",
+        "scripts/020-force-ssh-logout.sh",
         "scripts/900-cleanup.sh",
         "scripts/999-img-check.sh"
       ]

dev/packer/scripts/001-onboot.sh

@@ -1,15 +1,18 @@
 #!/bin/bash
 
-# Scripts in this directory will be executed by cloud-init on the first boot of droplets
-# created from your image.  Things ike generating passwords, configuration requiring IP address
-# or other items that will be unique to each instance should be done in scripts here.
-
+# Generate PostgreSQL password
 openssl rand -base64 32 > /etc/wiki/.db-secret
 
+# Start containers
 if [[ -z $DATABASE_URL ]]; then
   docker start db
 fi
 docker start wiki
 docker start wiki-update-companion
-# docker start nginx-proxy
-# docker start watchtower
+
+# Remove the ssh force logout command
+sed -e '/Match User root/d' \
+    -e '/.*ForceCommand.*droplet.*/d' \
+    -i /etc/ssh/sshd_config
+
+systemctl restart ssh

dev/packer/scripts/010-docker.sh

@@ -1,17 +1,33 @@
 #!/bin/bash
 
-curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
-sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"
-apt -qqy update
-apt -qqy -o Dpkg::Options::='--force-confdef' -o Dpkg::Options::='--force-confold' install docker-ce docker-ce-cli containerd.io
+# Add Docker's official GPG key:
+sudo install -m 0755 -d /etc/apt/keyrings
+sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
+sudo chmod a+r /etc/apt/keyrings/docker.asc
+
+# Add the repository to Apt sources:
+sudo tee /etc/apt/sources.list.d/docker.sources <<EOF
+Types: deb
+URIs: https://download.docker.com/linux/ubuntu
+Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
+Components: stable
+Signed-By: /etc/apt/keyrings/docker.asc
+EOF
+
+sudo apt update
+
+# Install Docker
+sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
 
 systemctl enable docker
 systemctl start docker
 
+# Setup containers
+
 mkdir -p /etc/wiki
 
 docker network create wikinet
 docker volume create pgdata
-docker create --name=db -e POSTGRES_DB=wiki -e POSTGRES_USER=wiki -e POSTGRES_PASSWORD_FILE=/etc/wiki/.db-secret -v /etc/wiki/.db-secret:/etc/wiki/.db-secret:ro -v pgdata:/var/lib/postgresql/data --restart=unless-stopped -h db --network=wikinet postgres:11
+docker create --name=db -e POSTGRES_DB=wiki -e POSTGRES_USER=wiki -e POSTGRES_PASSWORD_FILE=/etc/wiki/.db-secret -v /etc/wiki/.db-secret:/etc/wiki/.db-secret:ro -v pgdata:/var/lib/postgresql/data --restart=unless-stopped -h db --network=wikinet postgres:18
 docker create --name=wiki -e DB_TYPE=postgres -e DB_HOST=db -e DB_PORT=5432 -e DB_PASS_FILE=/etc/wiki/.db-secret -v /etc/wiki/.db-secret:/etc/wiki/.db-secret:ro -e DB_USER=wiki -e DB_NAME=wiki -e UPGRADE_COMPANION=1 --restart=unless-stopped -h wiki --network=wikinet -p 80:3000 -p 443:3443 ghcr.io/requarks/wiki:2
 docker create --name=wiki-update-companion -v /var/run/docker.sock:/var/run/docker.sock:ro --restart=unless-stopped -h wiki-update-companion --network=wikinet ghcr.io/requarks/wiki-update-companion:latest

dev/packer/scripts/011-docker-compose.sh

@@ -1,4 +0,0 @@
-#!/bin/sh
-
-sudo curl -L "https://github.com/docker/compose/releases/download/${docker_compose_version}/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose;
-chmod +x /usr/local/bin/docker-compose;

dev/packer/scripts/011-ufw-docker.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+ufw limit ssh
+ufw allow http
+ufw allow https
+
+ufw --force enable
+
+cat /dev/null > /var/log/ufw.log

dev/packer/scripts/012-grub-opts.sh

@@ -1,6 +0,0 @@
-#!/bin/sh
-
-sed -e 's|GRUB_CMDLINE_LINUX="|GRUB_CMDLINE_LINUX="cgroup_enable=memory swapaccount=1|g' \
-    -i /etc/default/grub
-
-update-grub

dev/packer/scripts/013-docker-dns.sh

@@ -1,4 +0,0 @@
-#!/bin/sh
-
-sed -e 's|#DOCKER_OPTS|DOCKER_OPTS|g' \
-    -i /etc/default/docker

dev/packer/scripts/014-ufw-docker.sh

@@ -1,9 +0,0 @@
-#!/bin/bash
-
-sudo ufw allow ssh
-sudo ufw allow http
-sudo ufw allow https
-
-sudo ufw --force enable
-
-cat /dev/null > /var/log/ufw.log

dev/packer/scripts/020-application-tag.sh

@@ -1,24 +0,0 @@
-#!/bin/sh
-
-################################
-## PART: Write the application tag
-##
-## vi: syntax=sh expandtab ts=4
-
-build_date=$(date +%Y-%m-%d)
-distro="$(lsb_release -s  -i)"
-distro_release="$(lsb_release -s  -r)"
-distro_codename="$(lsb_release -s -c)"
-distro_arch="$(uname -m)"
-
-mkdir -p /var/lib/digitalocean
-
-cat >> /var/lib/digitalocean/application.info <<EOM
-application_name="${application_name}"
-build_date="${build_date}"
-distro="${distro}"
-distro_release="${distro_release}"
-distro_codename="${distro_codename}"
-distro_arch="${distro_arch}"
-application_version="${application_version}"
-EOM

dev/packer/scripts/020-force-ssh-logout.sh

@@ -0,0 +1,6 @@
+#!/bin/sh
+
+cat >> /etc/ssh/sshd_config <<EOM
+Match User root
+        ForceCommand echo "Please wait while we get your droplet ready..."
+EOM

dev/packer/scripts/099-one-click

@@ -5,17 +5,20 @@
 myip=$(hostname -I | awk '{print$1}')
 cat <<EOF
 ********************************************************************************
+
 Welcome to Wiki.js's 1-Click DigitalOcean Droplet.
+
 To keep this Droplet secure, the UFW firewall is enabled.
 All ports are BLOCKED except 22 (SSH), 80 (Docker) and 443 (Docker).
+
 * The Wiki.js 1-Click DigitalOcean Quickstart guide is available at:
   https://docs.requarks.io/install/digitalocean
-* You can SSH to this Droplet in a terminal as root: ssh root@$myip
+
 * Docker is installed and configured per Docker's recommendations:
-  https://docs.docker.com/install/linux/docker-ce/ubuntu/
-* Docker Compose is installed and configured per Docker's recommendations:
-  https://docs.docker.com/compose/install/#install-compose
+  https://docs.docker.com/engine/install/ubuntu/
+
 For more information, visit https://docs.requarks.io/install/digitalocean
+
 ********************************************************************************
 To delete this message of the day: rm -rf $(readlink -f ${0})
 EOF

dev/packer/scripts/900-cleanup.sh

@@ -1,5 +1,11 @@
 #!/bin/bash
 
+# DigitalOcean Marketplace Image Validation Tool
+# © 2021 DigitalOcean LLC.
+# This code is licensed under Apache 2.0 license (see LICENSE.md for details)
+
+set -o errexit
+
 # Ensure /tmp exists and has the proper permissions before
 # checking for security updates
 # https://github.com/digitalocean/marketplace-partners/issues/94
@@ -8,13 +14,17 @@ if [[ ! -d /tmp ]]; then
 fi
 chmod 1777 /tmp
 
-export DEBIAN_FRONTEND=noninteractive
-apt-get -y update
-apt-get -o Dpkg::Options::="--force-confold" upgrade -q -y --force-yes
-apt-get purge droplet-agent
-rm -rf /opt/digitalocean
-apt-get -y autoremove
-apt-get -y autoclean
+if [ -n "$(command -v yum)" ]; then
+  yum update -y
+  yum clean all
+elif [ -n "$(command -v apt-get)" ]; then
+  export DEBIAN_FRONTEND=noninteractive
+  apt-get -y update
+  apt-get -o Dpkg::Options::="--force-confold" upgrade -q -y --force-yes
+  apt-get -y autoremove
+  apt-get -y autoclean
+fi
+
 rm -rf /tmp/* /var/tmp/*
 history -c
 cat /dev/null > /root/.bash_history
@@ -36,12 +46,4 @@ The secure erase will complete successfully when you see:${NC}
     dd: writing to '/zerofile': No space left on device\n
 Beginning secure erase now\n"
 
-dd if=/dev/zero of=/zerofile &
-  PID=$!
-  while [ -d /proc/$PID ]
-    do
-      printf "."
-      sleep 5
-    done
-sync; rm /zerofile; sync
-cat /dev/null > /var/log/lastlog; cat /dev/null > /var/log/wtmp
+dd if=/dev/zero of=/zerofile bs=4096 || rm /zerofile

dev/packer/scripts/999-img-check.sh

@@ -4,7 +4,7 @@
 # © 2021-2022 DigitalOcean LLC.
 # This code is licensed under Apache 2.0 license (see LICENSE.md for details)
 
-VERSION="v. 1.8"
+VERSION="v. 1.8.1"
 RUNDATE=$( date )
 
 # Script should be run with SUDO
@@ -75,7 +75,7 @@ function checkAgent {
      echo -en "\e[41m[FAIL]\e[0m DigitalOcean directory detected.\n"
             ((FAIL++))
             STATUS=2
-      if [[ $OS == "CentOS Linux" ]] || [[ $OS == "CentOS Stream" ]] || [[ $OS == "Rocky Linux" ]]; then
+      if [[ $OS == "CentOS Linux" ]] || [[ $OS == "CentOS Stream" ]] || [[ $OS == "Rocky Linux" ]] || [[ $OS == "AlmaLinux" ]] || [[ $OS == "CloudLinux" ]]; then
         echo "To uninstall the agent: 'sudo yum remove droplet-agent'"
         echo "To remove the DO directory: 'find /opt/digitalocean/ -type d -empty -delete'"
       elif [[ $OS == "Ubuntu" ]] || [[ $OS == "Debian" ]]; then
@@ -357,7 +357,7 @@ function checkFirewall {
         # shellcheck disable=SC2031
         ((WARN++))
       fi
-    elif [[ $OS == "CentOS Linux" ]] || [[ $OS == "CentOS Stream" ]] || [[ $OS == "Rocky Linux" ]]; then
+    elif [[ $OS == "CentOS Linux" ]] || [[ $OS == "CentOS Stream" ]] || [[ $OS == "Rocky Linux" ]] || [[ $OS == "AlmaLinux" ]] || [[ $OS == "CloudLinux" ]]; then
       if [ -f /usr/lib/systemd/system/csf.service ]; then
         fw="csf"
         if [[ $(systemctl status $fw >/dev/null 2>&1) ]]; then
@@ -456,7 +456,7 @@ function checkUpdates {
             echo -en "\e[32m[PASS]\e[0m There are no pending security updates for this image.\n\n"
             ((PASS++))
         fi
-    elif [[ $OS == "CentOS Linux" ]] || [[ $OS == "CentOS Stream" ]] || [[ $OS == "Rocky Linux" ]]; then
+    elif [[ $OS == "CentOS Linux" ]] || [[ $OS == "CentOS Stream" ]] || [[ $OS == "Rocky Linux" ]] || [[ $OS == "AlmaLinux" ]] || [[ $OS == "CloudLinux" ]]; then
         echo -en "\nChecking for available security updates, this may take a minute...\n\n"
 
         update_count=$(yum check-update --security --quiet | wc -l)
@@ -506,7 +506,7 @@ osv=0
 
 if [[ $OS == "Ubuntu" ]]; then
         ost=1
-    if [[ $VER == "22.04" ]] || [[ $VER == "20.04" ]] || [[ $VER == "18.04" ]] || [[ $VER == "16.04" ]]; then
+    if [[ $VER == "24.04" ]] || [[ $VER == "22.10" ]] || [[ $VER == "22.04" ]] || [[ $VER == "20.04" ]] || [[ $VER == "18.04" ]] || [[ $VER == "16.04" ]]; then
         osv=1
     fi
 
@@ -521,7 +521,13 @@ elif [[ "$OS" =~ Debian.* ]]; then
             ;;
         11)
             osv=1
-            ;;            
+            ;;
+        12)
+            osv=1
+            ;;
+        13)
+            osv=1
+            ;;
         *)
             osv=2
             ;;
@@ -542,12 +548,28 @@ elif [[ $OS == "CentOS Stream" ]]; then
         ost=1
     if [[ $VER == "8" ]]; then
         osv=1
+    elif [[ $VER == "9" ]]; then
+        osv=1
     else
         osv=2
     fi
 elif [[ $OS == "Rocky Linux" ]]; then
         ost=1
-    if [[ $VER =~ 8\. ]]; then
+    if [[ $VER =~ 8\. ]] || [[ $VER =~ 9\. ]]; then
+        osv=1
+    else
+        osv=2
+    fi
+elif [[ $OS == "AlmaLinux" ]]; then
+        ost=1
+    if [[ "$VER" =~ 8.* ]] || [[ "$VER" =~ 9.* ]]; then
+        osv=1
+    else
+        osv=2
+    fi
+elif [[ $OS == "CloudLinux" ]]; then
+        ost=1
+    if [[ "$VER" =~ 8.* ]] || [[ "$VER" =~ 9.* ]]; then
         osv=1
     else
         osv=2
@@ -599,6 +621,12 @@ checkRoot
 
 checkAgent
 
+# Source GPU compatibility check
+if [ -f "$(dirname "$0")/check_gpu_support.sh" ]; then
+    source "$(dirname "$0")/check_gpu_support.sh"
+else
+    echo "GPU check script not found. Skipping GPU compatibility checks."
+fi
 
 # Summary
 echo -en "\n\n---------------------------------------------------------------------------------------------------\n"
@@ -625,4 +653,4 @@ elif [[ $STATUS == 1 ]]; then
 else
     echo -en "Some critical tests failed.  These items must be resolved and this scan re-run before you submit your image to the DigitalOcean Marketplace.\n\n"
     exit 1
-fi
+fi