wip: iroh

* refactor: fix multiple comments

* styling changes, add documentation to sidebar

* translations for dns page

* refactor: subtle colors

* rearrange service page

---------

Co-authored-by: Matt Hill <mattnine@protonmail.com>

.github/workflows/start-cli.yaml

@@ -1,118 +0,0 @@
-name: start-cli
-
-on:
-  workflow_call:
-  workflow_dispatch:
-    inputs:
-      environment:
-        type: choice
-        description: Environment
-        options:
-          - NONE
-          - dev
-          - unstable
-          - dev-unstable
-      runner:
-        type: choice
-        description: Runner
-        options:
-          - standard
-          - fast
-      arch:
-        type: choice
-        description: Architecture
-        options:
-          - ALL
-          - x86_64
-          - x86_64-apple
-          - aarch64
-          - aarch64-apple
-          - riscv64
-  push:
-    branches:
-      - master
-      - next/*
-  pull_request:
-    branches:
-      - master
-      - next/*
-
-env:
-  NODEJS_VERSION: "24.11.0"
-  ENVIRONMENT: '${{ fromJson(format(''["{0}", ""]'', github.event.inputs.environment || ''dev''))[github.event.inputs.environment == ''NONE''] }}'
-
-jobs:
-  compile:
-    name: Build Debian Package
-    strategy:
-      fail-fast: true
-      matrix:
-        triple: >-
-          ${{
-            fromJson('{
-              "x86_64": ["x86_64-unknown-linux-musl"],
-              "x86_64-apple": ["x86_64-apple-darwin"],
-              "aarch64": ["aarch64-unknown-linux-musl"],
-              "x86_64-apple": ["aarch64-apple-darwin"],
-              "riscv64": ["riscv64gc-unknown-linux-musl"],
-              "ALL": ["x86_64-unknown-linux-musl", "x86_64-apple-darwin", "aarch64-unknown-linux-musl", "aarch64-apple-darwin", "riscv64gc-unknown-linux-musl"]
-            }')[github.event.inputs.platform || 'ALL']
-          }}
-    runs-on: ${{ fromJson('["ubuntu-latest", "buildjet-32vcpu-ubuntu-2204"]')[github.event.inputs.runner == 'fast'] }}
-    steps:
-      - name: Cleaning up unnecessary files
-        run: |
-          sudo apt-get remove --purge -y mono-* \
-            ghc* cabal-install* \
-            dotnet* \
-            php* \
-            ruby* \
-            mysql-* \
-            postgresql-* \
-            azure-cli \
-            powershell \
-            google-cloud-sdk \
-            msodbcsql* mssql-tools* \
-            imagemagick* \
-            libgl1-mesa-dri \
-            google-chrome-stable \
-            firefox
-          sudo apt-get autoremove -y
-          sudo apt-get clean
-
-      - run: |
-          sudo mount -t tmpfs tmpfs .
-        if: ${{ github.event.inputs.runner == 'fast' }}
-
-      - uses: actions/checkout@v4
-        with:
-          submodules: recursive
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODEJS_VERSION }}
-
-      - name: Set up docker QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Configure sccache
-        uses: actions/github-script@v7
-        with:
-          script: |
-            core.exportVariable('ACTIONS_RESULTS_URL', process.env.ACTIONS_RESULTS_URL || '');
-            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
-
-      - name: Make
-        run: TARGET=${{ matrix.triple }} make cli
-        env:
-          PLATFORM: ${{ matrix.arch }}
-          SCCACHE_GHA_ENABLED: on
-          SCCACHE_GHA_VERSION: 0
-
-      - uses: actions/upload-artifact@v4
-        with:
-          name: start-cli_${{ matrix.triple }}
-          path: core/target/${{ matrix.triple }}/release/start-cli

.github/workflows/start-registry.yaml

@@ -1,203 +0,0 @@
-name: Start-Registry
-
-on:
-  workflow_call:
-  workflow_dispatch:
-    inputs:
-      environment:
-        type: choice
-        description: Environment
-        options:
-          - NONE
-          - dev
-          - unstable
-          - dev-unstable
-      runner:
-        type: choice
-        description: Runner
-        options:
-          - standard
-          - fast
-      arch:
-        type: choice
-        description: Architecture
-        options:
-          - ALL
-          - x86_64
-          - aarch64
-          - riscv64
-  push:
-    branches:
-      - master
-      - next/*
-  pull_request:
-    branches:
-      - master
-      - next/*
-
-env:
-  NODEJS_VERSION: "24.11.0"
-  ENVIRONMENT: '${{ fromJson(format(''["{0}", ""]'', github.event.inputs.environment || ''dev''))[github.event.inputs.environment == ''NONE''] }}'
-
-jobs:
-  compile:
-    name: Build Debian Package
-    strategy:
-      fail-fast: true
-      matrix:
-        arch: >-
-          ${{
-            fromJson('{
-              "x86_64": ["x86_64"],
-              "aarch64": ["aarch64"],
-              "riscv64": ["riscv64"],
-              "ALL": ["x86_64", "aarch64", "riscv64"]
-            }')[github.event.inputs.platform || 'ALL']
-          }}
-    runs-on: ${{ fromJson('["ubuntu-latest", "buildjet-32vcpu-ubuntu-2204"]')[github.event.inputs.runner == 'fast'] }}
-    steps:
-      - name: Cleaning up unnecessary files
-        run: |
-          sudo apt-get remove --purge -y mono-* \
-            ghc* cabal-install* \
-            dotnet* \
-            php* \
-            ruby* \
-            mysql-* \
-            postgresql-* \
-            azure-cli \
-            powershell \
-            google-cloud-sdk \
-            msodbcsql* mssql-tools* \
-            imagemagick* \
-            libgl1-mesa-dri \
-            google-chrome-stable \
-            firefox
-          sudo apt-get autoremove -y
-          sudo apt-get clean
-
-      - run: |
-          sudo mount -t tmpfs tmpfs .
-        if: ${{ github.event.inputs.runner == 'fast' }}
-
-      - uses: actions/checkout@v4
-        with:
-          submodules: recursive
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODEJS_VERSION }}
-
-      - name: Set up docker QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Configure sccache
-        uses: actions/github-script@v7
-        with:
-          script: |
-            core.exportVariable('ACTIONS_RESULTS_URL', process.env.ACTIONS_RESULTS_URL || '');
-            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
-
-      - name: Make
-        run: make registry-deb
-        env:
-          PLATFORM: ${{ matrix.arch }}
-          SCCACHE_GHA_ENABLED: on
-          SCCACHE_GHA_VERSION: 0
-
-      - uses: actions/upload-artifact@v4
-        with:
-          name: start-registry_${{ matrix.arch }}.deb
-          path: results/start-registry-*_${{ matrix.arch }}.deb
-
-  create-image:
-    name: Create Docker Image
-    needs: [compile]
-    permissions:
-      contents: read
-      packages: write
-    runs-on: ${{ fromJson('["ubuntu-latest", "buildjet-32vcpu-ubuntu-2204"]')[github.event.inputs.runner == 'fast'] }}
-    steps:
-      - name: Cleaning up unnecessary files
-        run: |
-          sudo apt-get remove --purge -y google-chrome-stable firefox mono-devel
-          sudo apt-get autoremove -y
-          sudo apt-get clean
-
-      - run: |
-          sudo mount -t tmpfs tmpfs .
-        if: ${{ github.event.inputs.runner == 'fast' }}
-
-      - name: Set up docker QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: "Login to GitHub Container Registry"
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{github.actor}}
-          password: ${{secrets.GITHUB_TOKEN}}
-
-      - name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ghcr.io/Start9Labs/startos-registry
-          tags: |
-            type=raw,value=${{ github.ref_name }}
-
-      - name: Download debian package
-        uses: actions/download-artifact@v4
-        with:
-          pattern: start-registry_*.deb
-
-      - name: Map matrix.arch to docker platform
-        run: |
-          platforms=""
-          for deb in *.deb; do
-            filename=$(basename "$deb" .deb)
-            arch="${filename#*_}"
-            case "$arch" in
-              x86_64)
-                platform="linux/amd64"
-                ;;
-              aarch64)
-                platform="linux/arm64"
-                ;;
-              riscv64)
-                platform="linux/riscv64"
-                ;;
-              *)
-                echo "Unknown architecture: $arch" >&2
-                exit 1
-                ;;
-            esac
-            if [ -z "$platforms" ]; then
-              platforms="$platform"
-            else
-              platforms="$platforms,$platform"
-            fi
-          done
-          echo "DOCKER_PLATFORM=$platforms" >> "$GITHUB_ENV"
-
-      - run: |
-          cat | docker buildx build --platform "$DOCKER_PLATFORM" --push -t ${{ steps.meta.outputs.tags }} -f - . << 'EOF'
-          FROM debian:trixie
-
-          ADD *.deb .
-
-          RUN apt-get install -y ./*_$(uname -m).deb && rm *.deb
-
-          VOLUME /var/lib/startos
-
-          ENV RUST_LOG=startos=debug
-
-          ENTRYPOINT ["start-registryd"]
-
-          EOF

.github/workflows/start-tunnel.yaml

@@ -1,114 +0,0 @@
-name: Start-Tunnel
-
-on:
-  workflow_call:
-  workflow_dispatch:
-    inputs:
-      environment:
-        type: choice
-        description: Environment
-        options:
-          - NONE
-          - dev
-          - unstable
-          - dev-unstable
-      runner:
-        type: choice
-        description: Runner
-        options:
-          - standard
-          - fast
-      arch:
-        type: choice
-        description: Architecture
-        options:
-          - ALL
-          - x86_64
-          - aarch64
-          - riscv64
-  push:
-    branches:
-      - master
-      - next/*
-  pull_request:
-    branches:
-      - master
-      - next/*
-
-env:
-  NODEJS_VERSION: "24.11.0"
-  ENVIRONMENT: '${{ fromJson(format(''["{0}", ""]'', github.event.inputs.environment || ''dev''))[github.event.inputs.environment == ''NONE''] }}'
-
-jobs:
-  compile:
-    name: Build Debian Package
-    strategy:
-      fail-fast: true
-      matrix:
-        arch: >-
-          ${{
-            fromJson('{
-              "x86_64": ["x86_64"],
-              "aarch64": ["aarch64"],
-              "riscv64": ["riscv64"],
-              "ALL": ["x86_64", "aarch64", "riscv64"]
-            }')[github.event.inputs.platform || 'ALL']
-          }}
-    runs-on: ${{ fromJson('["ubuntu-latest", "buildjet-32vcpu-ubuntu-2204"]')[github.event.inputs.runner == 'fast'] }}
-    steps:
-      - name: Cleaning up unnecessary files
-        run: |
-          sudo apt-get remove --purge -y mono-* \
-            ghc* cabal-install* \
-            dotnet* \
-            php* \
-            ruby* \
-            mysql-* \
-            postgresql-* \
-            azure-cli \
-            powershell \
-            google-cloud-sdk \
-            msodbcsql* mssql-tools* \
-            imagemagick* \
-            libgl1-mesa-dri \
-            google-chrome-stable \
-            firefox
-          sudo apt-get autoremove -y
-          sudo apt-get clean
-
-      - run: |
-          sudo mount -t tmpfs tmpfs .
-        if: ${{ github.event.inputs.runner == 'fast' }}
-
-      - uses: actions/checkout@v4
-        with:
-          submodules: recursive
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODEJS_VERSION }}
-
-      - name: Set up docker QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Configure sccache
-        uses: actions/github-script@v7
-        with:
-          script: |
-            core.exportVariable('ACTIONS_RESULTS_URL', process.env.ACTIONS_RESULTS_URL || '');
-            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
-
-      - name: Make
-        run: make tunnel-deb
-        env:
-          PLATFORM: ${{ matrix.arch }}
-          SCCACHE_GHA_ENABLED: on
-          SCCACHE_GHA_VERSION: 0
-
-      - uses: actions/upload-artifact@v4
-        with:
-          name: start-tunnel_${{ matrix.arch }}.deb
-          path: results/start-tunnel-*_${{ matrix.arch }}.deb

.github/workflows/startos-iso.yaml

@@ -28,7 +28,6 @@ on:
           - aarch64
           - aarch64-nonfree
           - raspberrypi
-          - riscv64
       deploy:
         type: choice
         description: Deploy
@@ -46,7 +45,7 @@ on:
       - next/*
 
 env:
-  NODEJS_VERSION: "24.11.0"
+  NODEJS_VERSION: "22.17.1"
   ENVIRONMENT: '${{ fromJson(format(''["{0}", ""]'', github.event.inputs.environment || ''dev''))[github.event.inputs.environment == ''NONE''] }}'
 
 jobs:
@@ -63,48 +62,11 @@ jobs:
               "aarch64": ["aarch64"],
               "aarch64-nonfree": ["aarch64"],
               "raspberrypi": ["aarch64"],
-              "riscv64": ["riscv64"],
-              "ALL": ["x86_64", "aarch64", "riscv64"]
+              "ALL": ["x86_64", "aarch64"]
             }')[github.event.inputs.platform || 'ALL']
           }}
-    runs-on: >-
-      ${{
-        fromJson(
-          format(
-            '["{0}", "{1}"]',
-            fromJson('{
-              "x86_64": "ubuntu-latest",
-              "aarch64": "ubuntu-24.04-arm",
-              "riscv64": "ubuntu-latest"
-            }')[matrix.arch],
-            fromJson('{
-              "x86_64": "buildjet-32vcpu-ubuntu-2204",
-              "aarch64": "buildjet-32vcpu-ubuntu-2204-arm",
-              "riscv64": "buildjet-32vcpu-ubuntu-2204"
-            }')[matrix.arch]
-          )
-        )[github.event.inputs.runner == 'fast']
-      }}
+    runs-on: ${{ fromJson('["ubuntu-22.04", "buildjet-32vcpu-ubuntu-2204"]')[github.event.inputs.runner == 'fast'] }}
     steps:
-      - name: Cleaning up unnecessary files
-        run: |
-          sudo apt-get remove --purge -y azure-cli || true
-          sudo apt-get remove --purge -y firefox || true
-          sudo apt-get remove --purge -y ghc-* || true
-          sudo apt-get remove --purge -y google-cloud-sdk || true
-          sudo apt-get remove --purge -y google-chrome-stable || true
-          sudo apt-get remove --purge -y powershell || true
-          sudo apt-get remove --purge -y php* || true
-          sudo apt-get remove --purge -y ruby* || true
-          sudo apt-get remove --purge -y mono-* || true
-          sudo apt-get autoremove -y
-          sudo apt-get clean
-          sudo rm -rf /usr/lib/jvm               # All JDKs
-          sudo rm -rf /usr/local/.ghcup          # Haskell toolchain
-          sudo rm -rf /usr/local/lib/android     # Android SDK/NDK, emulator
-          sudo rm -rf /usr/share/dotnet          # .NET SDKs
-          sudo rm -rf /usr/share/swift           # Swift toolchain (if present)
-          sudo rm -rf "$AGENT_TOOLSDIRECTORY"    # Pre-cached tool cache (Go, Node, etc.)
       - run: |
           sudo mount -t tmpfs tmpfs .
         if: ${{ github.event.inputs.runner == 'fast' }}
@@ -125,6 +87,9 @@ jobs:
       - name: Set up docker QEMU
         uses: docker/setup-qemu-action@v3
 
+      - name: Set up system dependencies
+        run: sudo apt-get update && sudo apt-get install -y qemu-user-static systemd-container squashfuse
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -157,7 +122,7 @@ jobs:
               format(
                 '[
                   ["{0}"],
-                  ["x86_64", "x86_64-nonfree", "aarch64", "aarch64-nonfree", "riscv64", "raspberrypi"]
+                  ["x86_64", "x86_64-nonfree", "aarch64", "aarch64-nonfree", "raspberrypi"]
                 ]',
                 github.event.inputs.platform || 'ALL'
               )
@@ -167,22 +132,13 @@ jobs:
       ${{
         fromJson(
           format(
-            '["{0}", "{1}"]',
-            fromJson('{
-              "x86_64": "ubuntu-latest",
-              "x86_64-nonfree": "ubuntu-latest",
-              "aarch64": "ubuntu-24.04-arm",
-              "aarch64-nonfree": "ubuntu-24.04-arm",
-              "raspberrypi": "ubuntu-24.04-arm",
-              "riscv64": "ubuntu-24.04-arm",
-            }')[matrix.platform],
+            '["ubuntu-22.04", "{0}"]',
             fromJson('{
               "x86_64": "buildjet-8vcpu-ubuntu-2204",
               "x86_64-nonfree": "buildjet-8vcpu-ubuntu-2204",
               "aarch64": "buildjet-8vcpu-ubuntu-2204-arm",
               "aarch64-nonfree": "buildjet-8vcpu-ubuntu-2204-arm",
               "raspberrypi": "buildjet-8vcpu-ubuntu-2204-arm",
-              "riscv64": "buildjet-8vcpu-ubuntu-2204",
             }')[matrix.platform]
           )
         )[github.event.inputs.runner == 'fast']
@@ -196,38 +152,39 @@ jobs:
             "aarch64": "aarch64",
             "aarch64-nonfree": "aarch64",
             "raspberrypi": "aarch64",
-            "riscv64": "riscv64",
           }')[matrix.platform]
         }}
     steps:
       - name: Free space
-        run: |
-          sudo apt-get remove --purge -y azure-cli || true
-          sudo apt-get remove --purge -y firefox || true
-          sudo apt-get remove --purge -y ghc-* || true
-          sudo apt-get remove --purge -y google-cloud-sdk || true
-          sudo apt-get remove --purge -y google-chrome-stable || true
-          sudo apt-get remove --purge -y powershell || true
-          sudo apt-get remove --purge -y php* || true
-          sudo apt-get remove --purge -y ruby* || true
-          sudo apt-get remove --purge -y mono-* || true
-          sudo apt-get autoremove -y
-          sudo apt-get clean
-          sudo rm -rf /usr/lib/jvm               # All JDKs
-          sudo rm -rf /usr/local/.ghcup          # Haskell toolchain
-          sudo rm -rf /usr/local/lib/android     # Android SDK/NDK, emulator
-          sudo rm -rf /usr/share/dotnet          # .NET SDKs
-          sudo rm -rf /usr/share/swift           # Swift toolchain (if present)
-          sudo rm -rf "$AGENT_TOOLSDIRECTORY"    # Pre-cached tool cache (Go, Node, etc.)
+        run: rm -rf /opt/hostedtoolcache*
         if: ${{ github.event.inputs.runner != 'fast' }}
 
-      - name: Set up docker QEMU
-        uses: docker/setup-qemu-action@v3
-
       - uses: actions/checkout@v4
         with:
           submodules: recursive
 
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.x"
+
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y qemu-user-static
+          wget https://deb.debian.org/debian/pool/main/d/debspawn/debspawn_0.6.2-1_all.deb
+          sha256sum ./debspawn_0.6.2-1_all.deb | grep 37ef27458cb1e35e8bce4d4f639b06b4b3866fc0b9191ec6b9bd157afd06a817
+          sudo apt-get install -y ./debspawn_0.6.2-1_all.deb
+
+      - name: Configure debspawn
+        run: |
+          sudo mkdir -p /etc/debspawn/
+          echo "AllowUnsafePermissions=true" | sudo tee /etc/debspawn/global.toml
+          sudo mkdir -p /var/tmp/debspawn
+
+      - run: sudo mount -t tmpfs tmpfs /var/tmp/debspawn
+        if: ${{ github.event.inputs.runner == 'fast' && (matrix.platform == 'x86_64' || matrix.platform == 'x86_64-nonfree') }}
+
       - name: Download compiled artifacts
         uses: actions/download-artifact@v4
         with:
@@ -240,11 +197,12 @@ jobs:
         run: |
           mkdir -p web/node_modules
           mkdir -p web/dist/raw
-          mkdir -p core/bindings
+          mkdir -p core/startos/bindings
           mkdir -p sdk/base/lib/osBindings
           mkdir -p container-runtime/node_modules
           mkdir -p container-runtime/dist
           mkdir -p container-runtime/dist/node_modules
+          mkdir -p core/startos/bindings
           mkdir -p sdk/dist
           mkdir -p sdk/baseDist
           mkdir -p patch-db/client/node_modules
@@ -284,3 +242,40 @@ jobs:
           name: ${{ matrix.platform }}.img
           path: results/*.img
         if: ${{ matrix.platform == 'raspberrypi' }}
+
+      - name: Upload OTA to registry
+        run: >-
+          PLATFORM=${{ matrix.platform }} make upload-ota TARGET="${{
+            fromJson('{
+              "alpha": "alpha-registry-x.start9.com",
+              "beta": "beta-registry.start9.com",
+            }')[github.event.inputs.deploy]
+          }}" KEY="${{
+            fromJson(
+              format('{{
+                "alpha": "{0}",
+                "beta": "{1}",
+              }}', secrets.ALPHA_INDEX_KEY, secrets.BETA_INDEX_KEY)
+            )[github.event.inputs.deploy]
+          }}"
+        if: ${{ github.event.inputs.deploy != '' && github.event.inputs.deploy != 'NONE' }}
+
+  index:
+    if: ${{ github.event.inputs.deploy != '' && github.event.inputs.deploy != 'NONE' }}
+    needs: [image]
+    runs-on: ubuntu-22.04
+    steps:
+      - run: >-
+          curl "https://${{
+            fromJson('{
+              "alpha": "alpha-registry-x.start9.com",
+              "beta": "beta-registry.start9.com",
+            }')[github.event.inputs.deploy]
+          }}:8443/resync.cgi?key=${{
+            fromJson(
+              format('{{
+                "alpha": "{0}",
+                "beta": "{1}",
+              }}', secrets.ALPHA_INDEX_KEY, secrets.BETA_INDEX_KEY)
+            )[github.event.inputs.deploy]
+          }}"

.github/workflows/test.yaml

@@ -11,13 +11,13 @@ on:
       - next/*
 
 env:
-  NODEJS_VERSION: "24.11.0"
+  NODEJS_VERSION: "22.17.1"
   ENVIRONMENT: dev-unstable
 
 jobs:
   test:
     name: Run Automated Tests
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
         with:

.gitignore

@@ -1,22 +1,28 @@
 .DS_Store
 .idea
-*.img
-*.img.gz
-*.img.xz
-*.zip
+/*.img
+/*.img.gz
+/*.img.xz
+/*-raspios-bullseye-arm64-lite.img
+/*-raspios-bullseye-arm64-lite.zip
 /product_key.txt
 /*_product_key.txt
 .vscode/settings.json
 deploy_web.sh
+deploy_web.sh
 secrets.db
 .vscode/
-/build/env/*.txt
-*.deb
+/cargo-deps/**/*
+/PLATFORM.txt
+/ENVIRONMENT.txt
+/GIT_HASH.txt
+/VERSION.txt
+/*.deb
 /target
-*.squashfs
+/*.squashfs
 /results
 /dpkg-workdir
 /compiled.tar
 /compiled-*.tar
-/build/lib/firmware
-tmp
+/firmware
+/tmp

DEVELOPMENT.md

@@ -25,9 +25,9 @@ docker buildx create --use
 curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh # proceed with default installation
 curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/master/install.sh | bash
 source ~/.bashrc
-nvm install 24
-nvm use 24
-nvm alias default 24 # this prevents your machine from reverting back to another version
+nvm install 22
+nvm use 22
+nvm alias default 22 # this prevents your machine from reverting back to another version
 ```
 
 ## Cloning the repository

Makefile

@@ -1,45 +1,39 @@
 ls-files = $(shell git ls-files --cached --others --exclude-standard $1) 
 PROFILE = release
 
-PLATFORM_FILE := $(shell ./build/env/check-platform.sh)
-ENVIRONMENT_FILE := $(shell ./build/env/check-environment.sh)
-GIT_HASH_FILE := $(shell ./build/env/check-git-hash.sh)
-VERSION_FILE := $(shell ./build/env/check-version.sh)
-BASENAME := $(shell PROJECT=startos ./build/env/basename.sh)
-PLATFORM := $(shell if [ -f $(PLATFORM_FILE) ]; then cat $(PLATFORM_FILE); else echo unknown; fi)
+PLATFORM_FILE := $(shell ./check-platform.sh)
+ENVIRONMENT_FILE := $(shell ./check-environment.sh)
+GIT_HASH_FILE := $(shell ./check-git-hash.sh)
+VERSION_FILE := $(shell ./check-version.sh)
+BASENAME := $(shell ./basename.sh)
+PLATFORM := $(shell if [ -f ./PLATFORM.txt ]; then cat ./PLATFORM.txt; else echo unknown; fi)
 ARCH := $(shell if [ "$(PLATFORM)" = "raspberrypi" ]; then echo aarch64; else echo $(PLATFORM) | sed 's/-nonfree$$//g'; fi)
-RUST_ARCH := $(shell if [ "$(ARCH)" = "riscv64" ]; then echo riscv64gc; else echo $(ARCH); fi)
-REGISTRY_BASENAME := $(shell PROJECT=start-registry PLATFORM=$(ARCH) ./build/env/basename.sh)
-TUNNEL_BASENAME := $(shell PROJECT=start-tunnel PLATFORM=$(ARCH) ./build/env/basename.sh)
 IMAGE_TYPE=$(shell if [ "$(PLATFORM)" = raspberrypi ]; then echo img; else echo iso; fi)
 WEB_UIS := web/dist/raw/ui/index.html web/dist/raw/setup-wizard/index.html web/dist/raw/install-wizard/index.html
 COMPRESSED_WEB_UIS := web/dist/static/ui/index.html web/dist/static/setup-wizard/index.html web/dist/static/install-wizard/index.html
-FIRMWARE_ROMS := build/lib/firmware/$(PLATFORM) $(shell jq --raw-output '.[] | select(.platform[] | contains("$(PLATFORM)")) | "./build/lib/firmware/$(PLATFORM)/" + .id + ".rom.gz"' build/lib/firmware.json)
-BUILD_SRC := $(call ls-files, build/lib) build/lib/depends build/lib/conflicts $(FIRMWARE_ROMS)
-IMAGE_RECIPE_SRC := $(call ls-files, build/image-recipe/)
-STARTD_SRC := core/startd.service $(BUILD_SRC)
+FIRMWARE_ROMS := ./firmware/$(PLATFORM) $(shell jq --raw-output '.[] | select(.platform[] | contains("$(PLATFORM)")) | "./firmware/$(PLATFORM)/" + .id + ".rom.gz"' build/lib/firmware.json)
+BUILD_SRC := $(call ls-files, build) build/lib/depends build/lib/conflicts $(FIRMWARE_ROMS)
+DEBIAN_SRC := $(call ls-files, debian/)
+IMAGE_RECIPE_SRC := $(call ls-files, image-recipe/)
+STARTD_SRC := core/startos/startd.service $(BUILD_SRC)
 CORE_SRC := $(call ls-files, core) $(shell git ls-files --recurse-submodules patch-db) $(GIT_HASH_FILE)
 WEB_SHARED_SRC := $(call ls-files, web/projects/shared) $(call ls-files, web/projects/marketplace) $(shell ls -p web/ | grep -v / | sed 's/^/web\//g') web/node_modules/.package-lock.json web/config.json patch-db/client/dist/index.js sdk/baseDist/package.json web/patchdb-ui-seed.json sdk/dist/package.json
 WEB_UI_SRC := $(call ls-files, web/projects/ui)
 WEB_SETUP_WIZARD_SRC := $(call ls-files, web/projects/setup-wizard)
 WEB_INSTALL_WIZARD_SRC := $(call ls-files, web/projects/install-wizard)
-WEB_START_TUNNEL_SRC := $(call ls-files, web/projects/start-tunnel)
 PATCH_DB_CLIENT_SRC := $(shell git ls-files --recurse-submodules patch-db/client)
 GZIP_BIN := $(shell which pigz || which gzip)
 TAR_BIN := $(shell which gtar || which tar)
-COMPILED_TARGETS := core/target/$(RUST_ARCH)-unknown-linux-musl/$(PROFILE)/startbox core/target/$(RUST_ARCH)-unknown-linux-musl/release/start-container container-runtime/rootfs.$(ARCH).squashfs
-STARTOS_TARGETS := $(STARTD_SRC) $(ENVIRONMENT_FILE) $(GIT_HASH_FILE) $(VERSION_FILE) $(COMPILED_TARGETS) target/$(RUST_ARCH)-unknown-linux-musl/release/startos-backup-fs $(PLATFORM_FILE) \
+COMPILED_TARGETS := core/target/$(ARCH)-unknown-linux-musl/$(PROFILE)/startbox core/target/$(ARCH)-unknown-linux-musl/release/containerbox container-runtime/rootfs.$(ARCH).squashfs
+ALL_TARGETS := $(STARTD_SRC) $(ENVIRONMENT_FILE) $(GIT_HASH_FILE) $(VERSION_FILE) $(COMPILED_TARGETS) cargo-deps/$(ARCH)-unknown-linux-musl/release/startos-backup-fs $(PLATFORM_FILE) \
 	$(shell if [ "$(PLATFORM)" = "raspberrypi" ]; then \
-		echo target/aarch64-unknown-linux-musl/release/pi-beep; \
+		echo cargo-deps/aarch64-unknown-linux-musl/release/pi-beep; \
 	fi) \
 	$(shell /bin/bash -c 'if [[ "${ENVIRONMENT}" =~ (^|-)unstable($$|-) ]]; then \
-		echo target/$(RUST_ARCH)-unknown-linux-musl/release/flamegraph; \
-	fi') \
-	$(shell /bin/bash -c 'if [[ "${ENVIRONMENT}" =~ (^|-)console($$|-) ]]; then \
-		echo target/$(RUST_ARCH)-unknown-linux-musl/release/tokio-console; \
+		echo cargo-deps/$(ARCH)-unknown-linux-musl/release/tokio-console; \
+		echo cargo-deps/$(ARCH)-unknown-linux-musl/release/flamegraph; \
 	fi')
-REGISTRY_TARGETS := core/target/$(RUST_ARCH)-unknown-linux-musl/$(PROFILE)/registrybox core/start-registryd.service
-TUNNEL_TARGETS := core/target/$(RUST_ARCH)-unknown-linux-musl/$(PROFILE)/tunnelbox core/start-tunneld.service
+REBUILD_TYPES = 1
 
 ifeq ($(REMOTE),)
 	mkdir = mkdir -p $1
@@ -62,18 +56,18 @@ endif
 
 .DELETE_ON_ERROR:
 
-.PHONY: all metadata install clean format install-cli cli uis ui reflash deb $(IMAGE_TYPE) squashfs wormhole wormhole-deb test test-core test-sdk test-container-runtime registry install-registry tunnel install-tunnel ts-bindings
+.PHONY: all metadata install clean format cli uis ui reflash deb $(IMAGE_TYPE) squashfs wormhole wormhole-deb test test-core test-sdk test-container-runtime registry
 
-all: $(STARTOS_TARGETS)
+all: $(ALL_TARGETS)
 
 touch:
-	touch $(STARTOS_TARGETS)
+	touch $(ALL_TARGETS)
 
 metadata: $(VERSION_FILE) $(PLATFORM_FILE) $(ENVIRONMENT_FILE) $(GIT_HASH_FILE)
 
 clean:
 	rm -rf core/target
-	rm -rf core/bindings
+	rm -rf core/startos/bindings
 	rm -rf web/.angular
 	rm -f web/config.json
 	rm -rf web/node_modules
@@ -81,7 +75,7 @@ clean:
 	rm -rf patch-db/client/node_modules
 	rm -rf patch-db/client/dist
 	rm -rf patch-db/target
-	rm -rf target
+	rm -rf cargo-deps
 	rm -rf dpkg-workdir
 	rm -rf image-recipe/deb
 	rm -rf results
@@ -89,8 +83,14 @@ clean:
 	rm -rf container-runtime/dist
 	rm -rf container-runtime/node_modules
 	rm -f container-runtime/*.squashfs
+	if [ -d container-runtime/tmp/combined ] && mountpoint container-runtime/tmp/combined; then sudo umount container-runtime/tmp/combined; fi
+	if [ -d container-runtime/tmp/lower ] && mountpoint container-runtime/tmp/lower; then sudo umount container-runtime/tmp/lower; fi
+	rm -rf container-runtime/tmp
 	(cd sdk && make clean)
-	rm -f env/*.txt
+	rm -f ENVIRONMENT.txt
+	rm -f PLATFORM.txt
+	rm -f GIT_HASH.txt
+	rm -f VERSION.txt
 
 format:
 	cd core && cargo +nightly fmt
@@ -106,84 +106,47 @@ test-sdk: $(call ls-files, sdk) sdk/base/lib/osBindings/index.ts
 test-container-runtime: container-runtime/node_modules/.package-lock.json $(call ls-files, container-runtime/src) container-runtime/package.json container-runtime/tsconfig.json 
 	cd container-runtime && npm test
 
-install-cli: $(GIT_HASH_FILE)
-	./core/build/build-cli.sh --install
+cli:
+	./core/install-cli.sh
 
-cli: $(GIT_HASH_FILE)
-	./core/build/build-cli.sh
+registry:
+	./core/build-registrybox.sh
 
-registry: core/target/$(RUST_ARCH)-unknown-linux-musl/$(PROFILE)/registrybox
-
-install-registry: $(REGISTRY_TARGETS)
-	$(call mkdir,$(DESTDIR)/usr/bin)
-	$(call cp,core/target/$(RUST_ARCH)-unknown-linux-musl/$(PROFILE)/registrybox,$(DESTDIR)/usr/bin/start-registrybox)
-	$(call ln,/usr/bin/start-registrybox,$(DESTDIR)/usr/bin/start-registryd)
-	$(call ln,/usr/bin/start-registrybox,$(DESTDIR)/usr/bin/start-registry)
-
-	$(call mkdir,$(DESTDIR)/lib/systemd/system)
-	$(call cp,core/start-registryd.service,$(DESTDIR)/lib/systemd/system/start-registryd.service)
-
-core/target/$(RUST_ARCH)-unknown-linux-musl/$(PROFILE)/registrybox: $(CORE_SRC) $(ENVIRONMENT_FILE)
-	ARCH=$(ARCH) PROFILE=$(PROFILE) ./core/build/build-registrybox.sh
-
-tunnel: core/target/$(RUST_ARCH)-unknown-linux-musl/$(PROFILE)/tunnelbox
-
-install-tunnel: core/target/$(RUST_ARCH)-unknown-linux-musl/$(PROFILE)/tunnelbox core/start-tunneld.service
-	$(call mkdir,$(DESTDIR)/usr/bin)
-	$(call cp,core/target/$(RUST_ARCH)-unknown-linux-musl/$(PROFILE)/tunnelbox,$(DESTDIR)/usr/bin/start-tunnelbox)
-	$(call ln,/usr/bin/start-tunnelbox,$(DESTDIR)/usr/bin/start-tunneld)
-	$(call ln,/usr/bin/start-tunnelbox,$(DESTDIR)/usr/bin/start-tunnel)
-
-	$(call mkdir,$(DESTDIR)/lib/systemd/system)
-	$(call cp,core/start-tunneld.service,$(DESTDIR)/lib/systemd/system/start-tunneld.service)
-
-	$(call mkdir,$(DESTDIR)/usr/lib/startos/scripts)
-	$(call cp,build/lib/scripts/forward-port,$(DESTDIR)/usr/lib/startos/scripts/forward-port)
-
-core/target/$(RUST_ARCH)-unknown-linux-musl/$(PROFILE)/tunnelbox: $(CORE_SRC) $(ENVIRONMENT_FILE) $(GIT_HASH_FILE) web/dist/static/start-tunnel/index.html
-	ARCH=$(ARCH) PROFILE=$(PROFILE) ./core/build/build-tunnelbox.sh
+tunnel:
+	./core/build-tunnelbox.sh
 
 deb: results/$(BASENAME).deb
 
-results/$(BASENAME).deb: debian/dpkg-build.sh $(call ls-files,debian/startos) $(STARTOS_TARGETS)
-	PLATFORM=$(PLATFORM) REQUIRES=debian ./build/os-compat/run-compat.sh ./debian/dpkg-build.sh
+debian/control: build/lib/depends build/lib/conflicts
+	./debuild/control.sh
 
-registry-deb: results/$(REGISTRY_BASENAME).deb
-
-results/$(REGISTRY_BASENAME).deb: debian/dpkg-build.sh $(call ls-files,debian/start-registry) $(REGISTRY_TARGETS)
-	PROJECT=start-registry PLATFORM=$(ARCH) REQUIRES=debian ./build/os-compat/run-compat.sh ./debian/dpkg-build.sh
-
-tunnel-deb: results/$(TUNNEL_BASENAME).deb
-
-results/$(TUNNEL_BASENAME).deb: debian/dpkg-build.sh $(call ls-files,debian/start-tunnel) $(TUNNEL_TARGETS) build/lib/scripts/forward-port
-	PROJECT=start-tunnel PLATFORM=$(ARCH) REQUIRES=debian DEPENDS=wireguard-tools,iptables,conntrack ./build/os-compat/run-compat.sh ./debian/dpkg-build.sh
+results/$(BASENAME).deb: dpkg-build.sh $(DEBIAN_SRC) $(ALL_TARGETS)
+	PLATFORM=$(PLATFORM) REQUIRES=debian ./build/os-compat/run-compat.sh ./dpkg-build.sh
 
 $(IMAGE_TYPE): results/$(BASENAME).$(IMAGE_TYPE)
 
 squashfs: results/$(BASENAME).squashfs
 
 results/$(BASENAME).$(IMAGE_TYPE) results/$(BASENAME).squashfs: $(IMAGE_RECIPE_SRC) results/$(BASENAME).deb
-	ARCH=$(ARCH) ./build/image-recipe/run-local-build.sh "results/$(BASENAME).deb"
+	REQUIRES=debian ./build/os-compat/run-compat.sh ./image-recipe/run-local-build.sh "results/$(BASENAME).deb"
 
 # For creating os images. DO NOT USE
-install: $(STARTOS_TARGETS)
+install: $(ALL_TARGETS) 
 	$(call mkdir,$(DESTDIR)/usr/bin)
 	$(call mkdir,$(DESTDIR)/usr/sbin)
-	$(call cp,core/target/$(RUST_ARCH)-unknown-linux-musl/$(PROFILE)/startbox,$(DESTDIR)/usr/bin/startbox)
+	$(call cp,core/target/$(ARCH)-unknown-linux-musl/$(PROFILE)/startbox,$(DESTDIR)/usr/bin/startbox)
 	$(call ln,/usr/bin/startbox,$(DESTDIR)/usr/bin/startd)
 	$(call ln,/usr/bin/startbox,$(DESTDIR)/usr/bin/start-cli)
-	if [ "$(PLATFORM)" = "raspberrypi" ]; then $(call cp,target/aarch64-unknown-linux-musl/release/pi-beep,$(DESTDIR)/usr/bin/pi-beep); fi
+	if [ "$(PLATFORM)" = "raspberrypi" ]; then $(call cp,cargo-deps/aarch64-unknown-linux-musl/release/pi-beep,$(DESTDIR)/usr/bin/pi-beep); fi
 	if /bin/bash -c '[[ "${ENVIRONMENT}" =~ (^|-)unstable($$|-) ]]'; then \
-		$(call cp,target/$(RUST_ARCH)-unknown-linux-musl/release/flamegraph,$(DESTDIR)/usr/bin/flamegraph); \
+		$(call cp,cargo-deps/$(ARCH)-unknown-linux-musl/release/tokio-console,$(DESTDIR)/usr/bin/tokio-console); \
+		$(call cp,cargo-deps/$(ARCH)-unknown-linux-musl/release/flamegraph,$(DESTDIR)/usr/bin/flamegraph); \
 	fi
-	if /bin/bash -c '[[ "${ENVIRONMENT}" =~ (^|-)console($$|-) ]]'; then \
-		$(call cp,target/$(RUST_ARCH)-unknown-linux-musl/release/tokio-console,$(DESTDIR)/usr/bin/tokio-console); \
-	fi
-	$(call cp,target/$(RUST_ARCH)-unknown-linux-musl/release/startos-backup-fs,$(DESTDIR)/usr/bin/startos-backup-fs)
+	$(call cp,cargo-deps/$(ARCH)-unknown-linux-musl/release/startos-backup-fs,$(DESTDIR)/usr/bin/startos-backup-fs)
 	$(call ln,/usr/bin/startos-backup-fs,$(DESTDIR)/usr/sbin/mount.backup-fs)
 	
 	$(call mkdir,$(DESTDIR)/lib/systemd/system)
-	$(call cp,core/startd.service,$(DESTDIR)/lib/systemd/system/startd.service)
+	$(call cp,core/startos/startd.service,$(DESTDIR)/lib/systemd/system/startd.service)
 
 	$(call mkdir,$(DESTDIR)/usr/lib)
 	$(call rm,$(DESTDIR)/usr/lib/startos)
@@ -191,24 +154,26 @@ install: $(STARTOS_TARGETS)
 	$(call mkdir,$(DESTDIR)/usr/lib/startos/container-runtime)
 	$(call cp,container-runtime/rootfs.$(ARCH).squashfs,$(DESTDIR)/usr/lib/startos/container-runtime/rootfs.squashfs)
 
-	$(call cp,build/env/PLATFORM.txt,$(DESTDIR)/usr/lib/startos/PLATFORM.txt)
-	$(call cp,build/env/ENVIRONMENT.txt,$(DESTDIR)/usr/lib/startos/ENVIRONMENT.txt)
-	$(call cp,build/env/GIT_HASH.txt,$(DESTDIR)/usr/lib/startos/GIT_HASH.txt)
-	$(call cp,build/env/VERSION.txt,$(DESTDIR)/usr/lib/startos/VERSION.txt)
+	$(call cp,PLATFORM.txt,$(DESTDIR)/usr/lib/startos/PLATFORM.txt)
+	$(call cp,ENVIRONMENT.txt,$(DESTDIR)/usr/lib/startos/ENVIRONMENT.txt)
+	$(call cp,GIT_HASH.txt,$(DESTDIR)/usr/lib/startos/GIT_HASH.txt)
+	$(call cp,VERSION.txt,$(DESTDIR)/usr/lib/startos/VERSION.txt)
 
-update-overlay: $(STARTOS_TARGETS)
+	$(call cp,firmware/$(PLATFORM),$(DESTDIR)/usr/lib/startos/firmware)
+
+update-overlay: $(ALL_TARGETS)
 	@echo "\033[33m!!! THIS WILL ONLY REFLASH YOUR DEVICE IN MEMORY !!!\033[0m"
 	@echo "\033[33mALL CHANGES WILL BE REVERTED IF YOU RESTART THE DEVICE\033[0m"
 	@if [ -z "$(REMOTE)" ]; then >&2 echo "Must specify REMOTE" && false; fi
-	@if [ "`ssh $(REMOTE) 'cat /usr/lib/startos/VERSION.txt'`" != "`cat $(VERSION_FILE)`" ]; then >&2 echo "StartOS requires migrations: update-overlay is unavailable." && false; fi
+	@if [ "`ssh $(REMOTE) 'cat /usr/lib/startos/VERSION.txt'`" != "`cat ./VERSION.txt`" ]; then >&2 echo "StartOS requires migrations: update-overlay is unavailable." && false; fi
 	$(call ssh,"sudo systemctl stop startd")
 	$(MAKE) install REMOTE=$(REMOTE) SSHPASS=$(SSHPASS) PLATFORM=$(PLATFORM)
 	$(call ssh,"sudo systemctl start startd")
 
-wormhole: core/target/$(RUST_ARCH)-unknown-linux-musl/$(PROFILE)/startbox
+wormhole: core/target/$(ARCH)-unknown-linux-musl/$(PROFILE)/startbox
 	@echo "Paste the following command into the shell of your StartOS server:"
 	@echo
-	@wormhole send core/target/$(RUST_ARCH)-unknown-linux-musl/$(PROFILE)/startbox 2>&1 | awk -Winteractive '/wormhole receive/ { printf "sudo /usr/lib/startos/scripts/chroot-and-upgrade \"cd /usr/bin && rm startbox && wormhole receive --accept-file %s && chmod +x startbox\"\n", $$3 }'
+	@wormhole send core/target/$(ARCH)-unknown-linux-musl/$(PROFILE)/startbox 2>&1 | awk -Winteractive '/wormhole receive/ { printf "sudo /usr/lib/startos/scripts/chroot-and-upgrade \"cd /usr/bin && rm startbox && wormhole receive --accept-file %s && chmod +x startbox\"\n", $$3 }'
 
 wormhole-deb: results/$(BASENAME).deb
 	@echo "Paste the following command into the shell of your StartOS server:"
@@ -220,18 +185,18 @@ wormhole-squashfs: results/$(BASENAME).squashfs
 	$(eval SQFS_SIZE := $(shell du -s --bytes results/$(BASENAME).squashfs | awk '{print $$1}'))
 	@echo "Paste the following command into the shell of your StartOS server:"
 	@echo
-	@wormhole send results/$(BASENAME).squashfs 2>&1 | awk -Winteractive '/wormhole receive/ { printf "sudo sh -c '"'"'/usr/lib/startos/scripts/prune-images $(SQFS_SIZE) && /usr/lib/startos/scripts/prune-boot && cd /media/startos/images && wormhole receive --accept-file %s && CHECKSUM=$(SQFS_SUM) /usr/lib/startos/scripts/upgrade ./$(BASENAME).squashfs'"'"'\n", $$3 }'
+	@wormhole send results/$(BASENAME).squashfs 2>&1 | awk -Winteractive '/wormhole receive/ { printf "sudo sh -c '"'"'/usr/lib/startos/scripts/prune-images $(SQFS_SIZE) && /usr/lib/startos/scripts/prune-boot && cd /media/startos/images && wormhole receive --accept-file %s && CHECKSUM=$(SQFS_SUM) /usr/lib/startos/scripts/use-img ./$(BASENAME).squashfs'"'"'\n", $$3 }'
 
-update: $(STARTOS_TARGETS)
+update: $(ALL_TARGETS)
 	@if [ -z "$(REMOTE)" ]; then >&2 echo "Must specify REMOTE" && false; fi
 	$(call ssh,'sudo /usr/lib/startos/scripts/chroot-and-upgrade --create')
 	$(MAKE) install REMOTE=$(REMOTE) SSHPASS=$(SSHPASS) DESTDIR=/media/startos/next PLATFORM=$(PLATFORM)
 	$(call ssh,'sudo /media/startos/next/usr/lib/startos/scripts/chroot-and-upgrade --no-sync "apt-get install -y $(shell cat ./build/lib/depends)"')
 
-update-startbox: core/target/$(RUST_ARCH)-unknown-linux-musl/$(PROFILE)/startbox # only update binary (faster than full update)
+update-startbox: core/target/$(ARCH)-unknown-linux-musl/$(PROFILE)/startbox # only update binary (faster than full update)
 	@if [ -z "$(REMOTE)" ]; then >&2 echo "Must specify REMOTE" && false; fi
 	$(call ssh,'sudo /usr/lib/startos/scripts/chroot-and-upgrade --create')
-	$(call cp,core/target/$(RUST_ARCH)-unknown-linux-musl/$(PROFILE)/startbox,/media/startos/next/usr/bin/startbox)
+	$(call cp,core/target/$(ARCH)-unknown-linux-musl/$(PROFILE)/startbox,/media/startos/next/usr/bin/startbox)
 	$(call ssh,'sudo /media/startos/next/usr/lib/startos/scripts/chroot-and-upgrade --no-sync true')
 
 update-deb: results/$(BASENAME).deb # better than update, but only available from debian
@@ -248,9 +213,9 @@ update-squashfs: results/$(BASENAME).squashfs
 	$(call ssh,'/usr/lib/startos/scripts/prune-images $(SQFS_SIZE)')
 	$(call ssh,'/usr/lib/startos/scripts/prune-boot')
 	$(call cp,results/$(BASENAME).squashfs,/media/startos/images/next.rootfs)
-	$(call ssh,'sudo CHECKSUM=$(SQFS_SUM) /usr/lib/startos/scripts/upgrade /media/startos/images/next.rootfs')
+	$(call ssh,'sudo CHECKSUM=$(SQFS_SUM) /usr/lib/startos/scripts/use-img /media/startos/images/next.rootfs')
 
-emulate-reflash: $(STARTOS_TARGETS)
+emulate-reflash: $(ALL_TARGETS)
 	@if [ -z "$(REMOTE)" ]; then >&2 echo "Must specify REMOTE" && false; fi
 	$(call ssh,'sudo /usr/lib/startos/scripts/chroot-and-upgrade --create')
 	$(MAKE) install REMOTE=$(REMOTE) SSHPASS=$(SSHPASS) DESTDIR=/media/startos/next PLATFORM=$(PLATFORM)
@@ -258,7 +223,7 @@ emulate-reflash: $(STARTOS_TARGETS)
 	$(call ssh,'sudo /media/startos/next/usr/lib/startos/scripts/chroot-and-upgrade --no-sync "apt-get install -y $(shell cat ./build/lib/depends)"')
 
 upload-ota: results/$(BASENAME).squashfs
-	TARGET=$(TARGET) KEY=$(KEY) ./build/upload-ota.sh
+	TARGET=$(TARGET) KEY=$(KEY) ./upload-ota.sh
 
 container-runtime/debian.$(ARCH).squashfs: ./container-runtime/download-base-image.sh
 	ARCH=$(ARCH) ./container-runtime/download-base-image.sh
@@ -271,16 +236,17 @@ container-runtime/node_modules/.package-lock.json: container-runtime/package-loc
 	npm --prefix container-runtime ci
 	touch container-runtime/node_modules/.package-lock.json
 
-ts-bindings: core/bindings/index.ts
+sdk/base/lib/osBindings/index.ts: $(shell if [ "$(REBUILD_TYPES)" -ne 0 ]; then echo core/startos/bindings/index.ts; fi)
 	mkdir -p sdk/base/lib/osBindings
-	rsync -ac --delete core/bindings/ sdk/base/lib/osBindings/
+	rsync -ac --delete core/startos/bindings/ sdk/base/lib/osBindings/
+	touch sdk/base/lib/osBindings/index.ts
 
-core/bindings/index.ts: $(call ls-files, core) $(ENVIRONMENT_FILE)
-	rm -rf core/bindings
-	./core/build/build-ts.sh
-	ls core/bindings/*.ts | sed 's/core\/startos\/bindings\/\([^.]*\)\.ts/export { \1 } from ".\/\1";/g' | grep -v '"./index"' | tee core/bindings/index.ts
-	npm --prefix sdk exec -- prettier --config ./sdk/base/package.json -w ./core/bindings/*.ts
-	touch core/bindings/index.ts
+core/startos/bindings/index.ts: $(call ls-files, core) $(ENVIRONMENT_FILE)
+	rm -rf core/startos/bindings
+	./core/build-ts.sh
+	ls core/startos/bindings/*.ts | sed 's/core\/startos\/bindings\/\([^.]*\)\.ts/export { \1 } from ".\/\1";/g' | grep -v '"./index"' | tee core/startos/bindings/index.ts
+	npm --prefix sdk exec -- prettier --config ./sdk/base/package.json -w ./core/startos/bindings/*.ts
+	touch core/startos/bindings/index.ts
 
 sdk/dist/package.json sdk/baseDist/package.json: $(call ls-files, sdk) sdk/base/lib/osBindings/index.ts
 	(cd sdk && make bundle)
@@ -295,22 +261,22 @@ container-runtime/dist/node_modules/.package-lock.json container-runtime/dist/pa
 	./container-runtime/install-dist-deps.sh
 	touch container-runtime/dist/node_modules/.package-lock.json
 
-container-runtime/rootfs.$(ARCH).squashfs: container-runtime/debian.$(ARCH).squashfs container-runtime/container-runtime.service container-runtime/update-image.sh container-runtime/update-image-local.sh container-runtime/deb-install.sh container-runtime/dist/index.js container-runtime/dist/node_modules/.package-lock.json core/target/$(RUST_ARCH)-unknown-linux-musl/release/start-container
-	ARCH=$(ARCH) ./container-runtime/update-image-local.sh
+container-runtime/rootfs.$(ARCH).squashfs: container-runtime/debian.$(ARCH).squashfs container-runtime/container-runtime.service container-runtime/update-image.sh container-runtime/deb-install.sh container-runtime/dist/index.js container-runtime/dist/node_modules/.package-lock.json core/target/$(ARCH)-unknown-linux-musl/release/containerbox
+	ARCH=$(ARCH) REQUIRES=linux ./build/os-compat/run-compat.sh ./container-runtime/update-image.sh
 
-build/lib/depends build/lib/conflicts: $(ENVIRONMENT_FILE) $(PLATFORM_FILE) $(shell ls build/dpkg-deps/*)
-	PLATFORM=$(PLATFORM) ARCH=$(ARCH) build/dpkg-deps/generate.sh
+build/lib/depends build/lib/conflicts: build/dpkg-deps/*
+	build/dpkg-deps/generate.sh
 
-$(FIRMWARE_ROMS): build/lib/firmware.json ./build/download-firmware.sh $(PLATFORM_FILE)
-	./build/download-firmware.sh $(PLATFORM)
+$(FIRMWARE_ROMS): build/lib/firmware.json download-firmware.sh $(PLATFORM_FILE)
+	./download-firmware.sh $(PLATFORM)
 
-core/target/$(RUST_ARCH)-unknown-linux-musl/$(PROFILE)/startbox: $(CORE_SRC) $(COMPRESSED_WEB_UIS) web/patchdb-ui-seed.json $(ENVIRONMENT_FILE)
-	ARCH=$(ARCH) PROFILE=$(PROFILE) ./core/build/build-startbox.sh
-	touch core/target/$(RUST_ARCH)-unknown-linux-musl/$(PROFILE)/startbox
+core/target/$(ARCH)-unknown-linux-musl/$(PROFILE)/startbox: $(CORE_SRC) $(COMPRESSED_WEB_UIS) web/patchdb-ui-seed.json $(ENVIRONMENT_FILE)
+	ARCH=$(ARCH) PROFILE=$(PROFILE) ./core/build-startbox.sh
+	touch core/target/$(ARCH)-unknown-linux-musl/$(PROFILE)/startbox
 
-core/target/$(RUST_ARCH)-unknown-linux-musl/release/start-container: $(CORE_SRC) $(ENVIRONMENT_FILE)
-	ARCH=$(ARCH) ./core/build/build-start-container.sh
-	touch core/target/$(RUST_ARCH)-unknown-linux-musl/release/start-container
+core/target/$(ARCH)-unknown-linux-musl/release/containerbox: $(CORE_SRC) $(ENVIRONMENT_FILE)
+	ARCH=$(ARCH) ./core/build-containerbox.sh
+	touch core/target/$(ARCH)-unknown-linux-musl/release/containerbox
 
 web/package-lock.json: web/package.json sdk/baseDist/package.json
 	npm --prefix web i
@@ -337,15 +303,11 @@ web/dist/raw/install-wizard/index.html: $(WEB_INSTALL_WIZARD_SRC) $(WEB_SHARED_S
 	npm --prefix web run build:install
 	touch web/dist/raw/install-wizard/index.html
 
-web/dist/raw/start-tunnel/index.html: $(WEB_START_TUNNEL_SRC) $(WEB_SHARED_SRC) web/.angular/.updated
-	npm --prefix web run build:tunnel
-	touch web/dist/raw/start-tunnel/index.html
+$(COMPRESSED_WEB_UIS): $(WEB_UIS) $(ENVIRONMENT_FILE)
+	./compress-uis.sh
 
-web/dist/static/%/index.html: web/dist/raw/%/index.html
-	./web/compress-uis.sh $*
-
-web/config.json: $(GIT_HASH_FILE) $(ENVIRONMENT_FILE) web/config-sample.json web/update-config.sh
-	./web/update-config.sh	
+web/config.json: $(GIT_HASH_FILE) web/config-sample.json
+	jq '.useMocks = false' web/config-sample.json | jq '.gitHash = "$(shell cat GIT_HASH.txt)"' > web/config.json
 
 patch-db/client/node_modules/.package-lock.json: patch-db/client/package.json
 	npm --prefix patch-db/client ci
@@ -366,17 +328,14 @@ uis: $(WEB_UIS)
 # this is a convenience step to build the UI
 ui: web/dist/raw/ui
 
-target/aarch64-unknown-linux-musl/release/pi-beep: ./build/build-cargo-dep.sh
-	ARCH=aarch64 ./build/build-cargo-dep.sh pi-beep
+cargo-deps/aarch64-unknown-linux-musl/release/pi-beep:
+	ARCH=aarch64 ./build-cargo-dep.sh pi-beep
 
-target/$(RUST_ARCH)-unknown-linux-musl/release/tokio-console: ./build/build-cargo-dep.sh
-	ARCH=$(ARCH) ./build/build-cargo-dep.sh tokio-console
-	touch $@
+cargo-deps/$(ARCH)-unknown-linux-musl/release/tokio-console:
+	ARCH=$(ARCH) PREINSTALL="apk add musl-dev pkgconfig" ./build-cargo-dep.sh tokio-console
 
-target/$(RUST_ARCH)-unknown-linux-musl/release/startos-backup-fs: ./build/build-cargo-dep.sh
-	ARCH=$(ARCH) ./build/build-cargo-dep.sh --git https://github.com/Start9Labs/start-fs.git startos-backup-fs
-	touch $@
+cargo-deps/$(ARCH)-unknown-linux-musl/release/startos-backup-fs:
+	ARCH=$(ARCH) PREINSTALL="apk add fuse3 fuse3-dev fuse3-static musl-dev pkgconfig" ./build-cargo-dep.sh --git https://github.com/Start9Labs/start-fs.git startos-backup-fs
 
-target/$(RUST_ARCH)-unknown-linux-musl/release/flamegraph: ./build/build-cargo-dep.sh
-	ARCH=$(ARCH) ./build/build-cargo-dep.sh flamegraph
-	touch $@
+cargo-deps/$(ARCH)-unknown-linux-musl/release/flamegraph:
+	ARCH=$(ARCH) PREINSTALL="apk add musl-dev pkgconfig" ./build-cargo-dep.sh flamegraph

START-TUNNEL.md

@@ -1,95 +0,0 @@
-# StartTunnel
-
-A self-hosted WireGuard VPN optimized for creating VLANs and reverse tunneling to personal servers.
-
-You can think of StartTunnel as "virtual router in the cloud".
-
-Use it for private remote access to self-hosted services running on a personal server, or to expose self-hosted services to the public Internet without revealing the host server's IP address.
-
-## Features
-
-- **Create Subnets**: Each subnet creates a private, virtual local area network (VLAN), similar to the LAN created by a home router.
-
-- **Add Devices**: When you add a device (server, phone, laptop) to a subnet, it receives a LAN IP address on that subnet as well as a unique WireGuard config that must be copied, downloaded, or scanned into the device.
-
-- **Forward Ports**: Forwarding a port creates a "reverse tunnel", exposing a specific port on a specific device to the public Internet.
-
-## Installation
-
-1.  Rent a low cost VPS. For most use cases, the cheapest option should be enough.
-
-    - It must have a dedicated public IP address.
-    - For compute (CPU), memory (RAM), and storage (disk), choose the minimum spec.
-    - For transfer (bandwidth), it depends on (1) your use case and (2) your home Internet's _upload_ speed. Even if you intend to serve large files or stream content from your server, there is no reason to pay for speeds that exceed your home Internet's upload speed.
-
-1.  Provision the VPS with the latest version of Debian.
-
-1.  Access the VPS via SSH.
-
-1.  Run the StartTunnel install script:
-
-        curl -fsSL https://start9labs.github.io/start-tunnel | sh
-
-1.  [Initialize the web interface](#web-interface) (recommended)
-
-## Updating
-
-Simply re-run the install command:
-
-```sh
-curl -fsSL https://start9labs.github.io/start-tunnel | sh
-```
-
-## CLI
-
-By default, StartTunnel is managed via the `start-tunnel` command line interface, which is self-documented.
-
-```
-start-tunnel --help
-```
-
-## Web Interface
-
-Enable the web interface (recommended in most cases) to access your StartTunnel from the browser or via API.
-
-1.  Initialize the web interface.
-
-        start-tunnel web init
-
-1.  If your VPS has multiple public IP addresses, you will be prompted to select the IP address at which to host the web interface.
-
-1.  When prompted, enter the port at which to host the web interface. The default is 8443, and we recommend using it. If you change the default, choose an uncommon port to avoid future conflicts.
-
-1.  To access your StartTunnel web interface securely over HTTPS, you need an SSL certificate. When prompted, select whether to autogenerate a certificate or provide your own. _This is only for accessing your StartTunnel web interface_.
-
-1.  You will receive a success message with 3 pieces of information:
-
-    - **<https://IP:port>**: the URL where you can reach your personal web interface.
-    - **Password**: an autogenerated password for your interface. If you lose/forget it, you can reset it using the start-tunnel CLI.
-    - **Root Certificate Authority**: the Root CA of your StartTunnel instance.
-
-1.  If you autogenerated your SSL certificate, visiting the `https://IP:port` URL in the browser will warn you that the website is insecure. This is expected. You have two options for getting past this warning:
-    - option 1 (recommended): [Trust your StartTunnel Root CA on your connecting device](#trusting-your-starttunnel-root-ca).
-    - Option 2: bypass the warning in the browser, creating a one-time security exception.
-
-### Trusting your StartTunnel Root CA
-
-1. Copy the contents of your Root CA (starting with -----BEGIN CERTIFICATE----- and ending with -----END CERTIFICATE-----).
-
-2. Open a text editor:
-
-   - Linux: gedit, nano, or any editor
-   - Mac: TextEdit
-   - Windows: Notepad
-
-3. Paste the contents of your Root CA.
-
-4. Save the file with a `.crt` extension (e.g. `start-tunnel.crt`) (make sure it saves as plain text, not rich text).
-
-5. Trust the Root CA on your client device(s):
-
-   - [Linux](https://staging.docs.start9.com/device-guides/linux/ca.html)
-   - [Mac](https://staging.docs.start9.com/device-guides/mac/ca.html)
-   - [Windows](https://staging.docs.start9.com/device-guides/windows/ca.html)
-   - [Android/Graphene](https://staging.docs.start9.com/device-guides/android/ca.html)
-   - [iOS](https://staging.docs.start9.com/device-guides/ios/ca.html)

agents/VERSION_BUMP.md

@@ -1,201 +0,0 @@
-# StartOS Version Bump Guide
-
-This document explains how to bump the StartOS version across the entire codebase.
-
-## Overview
-
-When bumping from version `X.Y.Z-alpha.N` to `X.Y.Z-alpha.N+1`, you need to update files in multiple locations across the repository. The `// VERSION_BUMP` comment markers indicate where changes are needed.
-
-## Files to Update
-
-### 1. Core Rust Crate Version
-
-**File: `core/Cargo.toml`**
-
-Update the version string (line ~18):
-
-```toml
-version = "0.4.0-alpha.15" # VERSION_BUMP
-```
-
-**File: `core/Cargo.lock`**
-
-This file is auto-generated. After updating `Cargo.toml`, run:
-
-```bash
-cd core
-cargo check
-```
-
-This will update the version in `Cargo.lock` automatically.
-
-### 2. Create New Version Migration Module
-
-**File: `core/src/version/vX_Y_Z_alpha_N+1.rs`**
-
-Create a new version file by copying the previous version and updating:
-
-```rust
-use exver::{PreReleaseSegment, VersionRange};
-
-use super::v0_3_5::V0_3_0_COMPAT;
-use super::{VersionT, v0_4_0_alpha_14};  // Update to previous version
-use crate::prelude::*;
-
-lazy_static::lazy_static! {
-    static ref V0_4_0_alpha_15: exver::Version = exver::Version::new(
-        [0, 4, 0],
-        [PreReleaseSegment::String("alpha".into()), 15.into()]  // Update number
-    );
-}
-
-#[derive(Clone, Copy, Debug, Default)]
-pub struct Version;
-
-impl VersionT for Version {
-    type Previous = v0_4_0_alpha_14::Version;  // Update to previous version
-    type PreUpRes = ();
-
-    async fn pre_up(self) -> Result<Self::PreUpRes, Error> {
-        Ok(())
-    }
-    fn semver(self) -> exver::Version {
-        V0_4_0_alpha_15.clone()  // Update version name
-    }
-    fn compat(self) -> &'static VersionRange {
-        &V0_3_0_COMPAT
-    }
-    #[instrument(skip_all)]
-    fn up(self, _db: &mut Value, _: Self::PreUpRes) -> Result<Value, Error> {
-        // Add migration logic here if needed
-        Ok(Value::Null)
-    }
-    fn down(self, _db: &mut Value) -> Result<(), Error> {
-        // Add rollback logic here if needed
-        Ok(())
-    }
-}
-```
-
-### 3. Update Version Module Registry
-
-**File: `core/src/version/mod.rs`**
-
-Make changes in **5 locations**:
-
-#### Location 1: Module Declaration (~line 57)
-
-Add the new module after the previous version:
-
-```rust
-mod v0_4_0_alpha_14;
-mod v0_4_0_alpha_15;  // Add this
-```
-
-#### Location 2: Current Type Alias (~line 59)
-
-Update the `Current` type and move the `// VERSION_BUMP` comment:
-
-```rust
-pub type Current = v0_4_0_alpha_15::Version; // VERSION_BUMP
-```
-
-#### Location 3: Version Enum (~line 175)
-
-Remove `// VERSION_BUMP` from the previous version, add new variant, add comment:
-
-```rust
-    V0_4_0_alpha_14(Wrapper<v0_4_0_alpha_14::Version>),
-    V0_4_0_alpha_15(Wrapper<v0_4_0_alpha_15::Version>), // VERSION_BUMP
-    Other(exver::Version),
-```
-
-#### Location 4: as_version_t() Match (~line 233)
-
-Remove `// VERSION_BUMP`, add new match arm, add comment:
-
-```rust
-            Self::V0_4_0_alpha_14(v) => DynVersion(Box::new(v.0)),
-            Self::V0_4_0_alpha_15(v) => DynVersion(Box::new(v.0)), // VERSION_BUMP
-            Self::Other(v) => {
-```
-
-#### Location 5: as_exver() Match (~line 284, inside #[cfg(test)])
-
-Remove `// VERSION_BUMP`, add new match arm, add comment:
-
-```rust
-            Version::V0_4_0_alpha_14(Wrapper(x)) => x.semver(),
-            Version::V0_4_0_alpha_15(Wrapper(x)) => x.semver(), // VERSION_BUMP
-            Version::Other(x) => x.clone(),
-```
-
-### 4. SDK TypeScript Version
-
-**File: `sdk/package/lib/StartSdk.ts`**
-
-Update the OSVersion constant (~line 64):
-
-```typescript
-export const OSVersion = testTypeVersion("0.4.0-alpha.15");
-```
-
-### 5. Web UI Package Version
-
-**File: `web/package.json`**
-
-Update the version field:
-
-```json
-{
-  "name": "startos-ui",
-  "version": "0.4.0-alpha.15",
-  ...
-}
-```
-
-**File: `web/package-lock.json`**
-
-This file is auto-generated, but it's faster to update manually. Find all instances of "startos-ui" and update the version field.
-
-## Verification Step
-
-```
-make
-```
-
-## VERSION_BUMP Comment Pattern
-
-The `// VERSION_BUMP` comment serves as a marker for where to make changes next time:
-
-- Always **remove** it from the old location
-- **Add** the new version entry
-- **Move** the comment to mark the new location
-
-This pattern helps you quickly find all the places that need updating in the next version bump.
-
-## Summary Checklist
-
-- [ ] Update `core/Cargo.toml` version
-- [ ] Create new `core/src/version/vX_Y_Z_alpha_N+1.rs` file
-- [ ] Update `core/src/version/mod.rs` in 5 locations
-- [ ] Run `cargo check` to update `core/Cargo.lock`
-- [ ] Update `sdk/package/lib/StartSdk.ts` OSVersion
-- [ ] Update `web/package.json` and `web/package-lock.json` version
-- [ ] Verify all changes compile/build successfully
-
-## Migration Logic
-
-The `up()` and `down()` methods in the version file handle database migrations:
-
-- **up()**: Migrates the database from the previous version to this version
-- **down()**: Rolls back from this version to the previous version
-- **pre_up()**: Runs before migration, useful for pre-migration checks or data gathering
-
-If no migration is needed, return `Ok(Value::Null)` for `up()` and `Ok(())` for `down()`.
-
-For complex migrations, you may need to:
-
-1. Update `type PreUpRes` to pass data between `pre_up()` and `up()`
-2. Implement database transformations in the `up()` method
-3. Implement reverse transformations in `down()` for rollback support

basename.sh

@@ -1,7 +1,5 @@
 #!/bin/bash
 
-PROJECT=${PROJECT:-"startos"}
-
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
 PLATFORM="$(if [ -f ./PLATFORM.txt ]; then cat ./PLATFORM.txt; else echo unknown; fi)"
@@ -18,4 +16,4 @@ if [ -n "$STARTOS_ENV" ]; then
   VERSION_FULL="$VERSION_FULL~${STARTOS_ENV}"
 fi
 
-echo -n "${PROJECT}-${VERSION_FULL}_${PLATFORM}"
+echo -n "startos-${VERSION_FULL}_${PLATFORM}"

build-cargo-dep.sh

@@ -0,0 +1,34 @@
+#!/bin/bash
+
+set -e
+shopt -s expand_aliases
+
+if [ "$0" != "./build-cargo-dep.sh" ]; then
+	>&2 echo "Must be run from start-os directory"
+	exit 1
+fi
+
+USE_TTY=
+if tty -s; then
+	USE_TTY="-it"
+fi
+
+if [ -z "$ARCH" ]; then
+	ARCH=$(uname -m)
+fi
+
+DOCKER_PLATFORM="linux/${ARCH}"
+if [ "$ARCH" = aarch64 ] || [ "$ARCH" = arm64 ]; then
+	DOCKER_PLATFORM="linux/arm64"
+elif [ "$ARCH" = x86_64 ]; then
+	DOCKER_PLATFORM="linux/amd64"
+fi
+
+mkdir -p cargo-deps
+alias 'rust-musl-builder'='docker run $USE_TTY --platform=${DOCKER_PLATFORM} --rm -e "RUSTFLAGS=$RUSTFLAGS" -v "$HOME/.cargo/registry":/root/.cargo/registry -v "$(pwd)"/cargo-deps:/home/rust/src -w /home/rust/src -P rust:alpine'
+
+PREINSTALL=${PREINSTALL:-true}
+
+rust-musl-builder sh -c "$PREINSTALL && cargo install $* --target-dir /home/rust/src --target=$ARCH-unknown-linux-musl"
+sudo chown -R $USER cargo-deps
+sudo chown -R $USER ~/.cargo

build/build-cargo-dep.sh

@@ -1,26 +0,0 @@
-#!/bin/bash
-
-cd "$(dirname "${BASH_SOURCE[0]}")/.."
-
-set -e
-shopt -s expand_aliases
-
-if [ -z "$ARCH" ]; then
-	ARCH=$(uname -m)
-fi
-
-RUST_ARCH="$ARCH"
-if [ "$ARCH" = "riscv64" ]; then
-  RUST_ARCH="riscv64gc"
-fi
-
-mkdir -p target
-
-source core/build/builder-alias.sh
-
-RUSTFLAGS="-C target-feature=+crt-static"
-
-rust-zig-builder cargo-zigbuild install $* --target-dir /workdir/target/ --target=$RUST_ARCH-unknown-linux-musl
-if [ "$(ls -nd "target/$RUST_ARCH-unknown-linux-musl/release/${!#}" | awk '{ print $3 }')" != "$UID" ]; then
-  rust-zig-builder sh -c "chown -R $UID:$UID target && chown -R $UID:$UID  /usr/local/cargo"
-fi

build/dpkg-deps/depends

@@ -7,9 +7,9 @@ bmon
 btrfs-progs
 ca-certificates
 cifs-utils
-conntrack
 cryptsetup
 curl
+dnsutils
 dmidecode
 dnsutils
 dosfstools
@@ -19,7 +19,6 @@ exfatprogs
 flashrom
 fuse3
 grub-common
-grub-efi
 htop
 httpdirfs
 iotop
@@ -42,6 +41,7 @@ nvme-cli
 nyx
 openssh-server
 podman
+postgresql
 psmisc
 qemu-guest-agent
 rfkill

build/dpkg-deps/generate.sh

@@ -5,15 +5,11 @@ set -e
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
 IFS="-" read -ra FEATURES <<< "$ENVIRONMENT"
-FEATURES+=("${ARCH}")
-if [ "$ARCH" != "$PLATFORM" ]; then
-    FEATURES+=("${PLATFORM}")
-fi
 
 feature_file_checker='
 /^#/ { next }
-/^\+ [a-z0-9.-]+$/ { next }
-/^- [a-z0-9.-]+$/ { next }
+/^\+ [a-z0-9-]+$/ { next }
+/^- [a-z0-9-]+$/ { next }
 { exit 1 }
 '
 
@@ -34,8 +30,8 @@ for type in conflicts depends; do
         for feature in ${FEATURES[@]}; do
             file="$feature.$type"
             if [ -f $file ]; then
-                if grep "^- $pkg$" $file > /dev/null; then
-                    SKIP=yes
+                if grep "^- $pkg$" $file; then
+                    SKIP=1
                 fi
             fi
         done

build/dpkg-deps/raspberrypi.depends

@@ -1,10 +0,0 @@
-- grub-efi
-+ parted
-+ raspberrypi-net-mods
-+ raspberrypi-sys-mods
-+ raspi-config
-+ raspi-firmware
-+ raspi-utils
-+ rpi-eeprom
-+ rpi-update
-+ rpi.gpio-common

build/dpkg-deps/x86_64.depends

@@ -1 +0,0 @@
-+ grub-pc-bin

build/image-recipe/Dockerfile

@@ -1,35 +0,0 @@
-ARG SUITE=trixie
-
-FROM debian:${SUITE}
-
-ENV DEBIAN_FRONTEND=noninteractive
-RUN apt-get update && \
-    apt-get install -yq \
-    live-build \
-    procps \
-    binfmt-support \
-    qemu-utils \
-    qemu-user-static \
-    xorriso \
-    isolinux \
-    ca-certificates \
-    curl \
-    wget \
-    gpg \
-    git \
-    fdisk \
-    dosfstools \
-    e2fsprogs \
-    squashfs-tools \
-    rsync \
-    b3sum \
-    dpkg-dev
-
-
-COPY binary_grub-efi.patch /root/binary_grub-efi.patch
-RUN patch /usr/lib/live/build/binary_grub-efi < /root/binary_grub-efi.patch && rm /root/binary_grub-efi.patch
-
-RUN echo 'retry_connrefused = on' > /etc/wgetrc && \
-    echo 'tries = 100' >> /etc/wgetrc
-
-WORKDIR /root

build/image-recipe/binary_grub-efi.patch

@@ -1,47 +0,0 @@
---- /usr/lib/live/build/binary_grub-efi	2024-05-25 05:22:52.000000000 -0600
-+++ binary_grub-efi	2025-10-16 13:04:32.338740922 -0600
-@@ -54,6 +54,8 @@
- 	armhf)
- 		Check_package chroot /usr/lib/grub/arm-efi/configfile.mod grub-efi-arm-bin
- 		;;
-+	riscv64)
-+		Check_package chroot /usr/lib/grub/riscv64-efi/configfile.mod grub-efi-riscv64-bin
- esac
- Check_package chroot /usr/bin/grub-mkimage grub-common
- Check_package chroot /usr/bin/mcopy mtools
-@@ -136,7 +138,7 @@
- esac
- 
- # Cleanup files that we generate
--rm -rf binary/boot/efi.img binary/boot/grub/i386-efi/ binary/boot/grub/x86_64-efi binary/boot/grub/arm64-efi binary/boot/grub/arm-efi
-+rm -rf binary/boot/efi.img binary/boot/grub/i386-efi/ binary/boot/grub/x86_64-efi binary/boot/grub/arm64-efi binary/boot/grub/arm-efi binary/boot/grub/riscv64-efi
- 
- # This is workaround till both efi-image and grub-cpmodules are put into a binary package
- case "${LB_BUILD_WITH_CHROOT}" in
-@@ -243,6 +245,10 @@
- 		gen_efi_boot_img "arm-efi" "arm" "debian-live/arm"
- 		PATH="\${PRE_EFI_IMAGE_PATH}"
- 		;;
-+	riscv64)
-+		gen_efi_boot_img "riscv64-efi" "riscv64" "debian-live/riscv64"
-+		PATH="\${PRE_EFI_IMAGE_PATH}"
-+		;;
- esac
- 
- 
-@@ -324,6 +330,7 @@
- rm -f chroot/grub-efi-temp/bootnetx64.efi
- rm -f chroot/grub-efi-temp/bootnetaa64.efi
- rm -f chroot/grub-efi-temp/bootnetarm.efi
-+rm -f chroot/grub-efi-temp/bootnetriscv64.efi
- 
- mkdir -p binary
- cp -a chroot/grub-efi-temp/* binary/
-@@ -331,6 +338,7 @@
- rm -rf chroot/grub-efi-temp-i386-efi
- rm -rf chroot/grub-efi-temp-arm64-efi
- rm -rf chroot/grub-efi-temp-arm-efi
-+rm -rf chroot/grub-efi-temp-riscv64-efi
- rm -rf chroot/grub-efi-temp-cfg
- rm -rf chroot/grub-efi-temp
- 

build/image-recipe/raspberrypi/squashfs/boot/config.sh

@@ -1,46 +0,0 @@
-#!/bin/sh
-
-cat << EOF
-
-# Enable audio (loads snd_bcm2835)
-dtparam=audio=on
-
-# Automatically load overlays for detected cameras
-camera_auto_detect=1
-
-# Automatically load overlays for detected DSI displays
-display_auto_detect=1
-
-# Enable DRM VC4 V3D driver
-dtoverlay=vc4-kms-v3d
-max_framebuffers=2
-
-# Run in 64-bit mode
-arm_64bit=1
-
-# Disable compensation for displays with overscan
-disable_overscan=1
-
-[cm4]
-# Enable host mode on the 2711 built-in XHCI USB controller.
-# This line should be removed if the legacy DWC2 controller is required
-# (e.g. for USB device mode) or if USB support is not required.
-otg_mode=1
-
-[all]
-
-[pi4]
-# Run as fast as firmware / board allows
-arm_boost=1
-kernel=vmlinuz-${KERNEL_VERSION}-rpi-v8
-initramfs initrd.img-${KERNEL_VERSION}-rpi-v8 followkernel
-
-[pi5]
-kernel=vmlinuz-${KERNEL_VERSION}-rpi-2712
-initramfs initrd.img-${KERNEL_VERSION}-rpi-2712 followkernel
-
-[all]
-gpu_mem=16
-dtoverlay=pwm-2chan,disable-bt
-
-EOF

build/image-recipe/run-local-build.sh

@@ -1,35 +0,0 @@
-#!/bin/bash
-set -e
-
-cd "$(dirname "${BASH_SOURCE[0]}")/../.."
-
-BASEDIR="$(pwd -P)"
-
-SUITE=trixie
-
-USE_TTY=
-if tty -s; then
-  USE_TTY="-it"
-fi
-
-dockerfile_hash=$(sha256sum ${BASEDIR}/build/image-recipe/Dockerfile | head -c 7)
-
-docker_img_name="start9/build-iso:${SUITE}-${dockerfile_hash}"
-
-platform=linux/${ARCH}
-case $ARCH in
-	x86_64)
-		platform=linux/amd64;;
-	aarch64)
-		platform=linux/arm64;;
-esac
-
-if ! docker run --rm --platform=$platform "${docker_img_name}" true 2> /dev/null; then
-	docker buildx build --load --platform=$platform --build-arg=SUITE=${SUITE} -t "${docker_img_name}" ./build/image-recipe
-fi
-
-docker run $USE_TTY --rm --platform=$platform --privileged -v "$(pwd)/build/image-recipe:/root/image-recipe" -v "$(pwd)/results:/root/results" \
-	-e IB_SUITE="$SUITE" \
-	-e IB_UID="$UID" \
-	-e IB_INCLUDE \
-	"${docker_img_name}" /root/image-recipe/build.sh $@

build/lib/motd

@@ -1,123 +1,34 @@
 #!/bin/sh
+printf "\n"
+printf "Welcome to\n"
+cat << "ASCII"
 
-parse_essential_db_info() {
-    DB_DUMP="/tmp/startos_db.json"
+           ███████        
+         █    █    █      
+       █     █ █     █    
+      █     █   █     █   
+      █    █     █    █   
+       █  █       █  █    
+         █         █      
+           ███████        
 
-    if command -v start-cli >/dev/null 2>&1; then
-        start-cli db dump > "$DB_DUMP" 2>/dev/null || return 1
-    else
-        return 1
-    fi
-
-    if command -v jq >/dev/null 2>&1 && [ -f "$DB_DUMP" ]; then
-        HOSTNAME=$(jq -r '.value.serverInfo.hostname // "unknown"' "$DB_DUMP" 2>/dev/null)
-        VERSION=$(jq -r '.value.serverInfo.version // "unknown"' "$DB_DUMP" 2>/dev/null)
-        RAM_BYTES=$(jq -r '.value.serverInfo.ram // 0' "$DB_DUMP" 2>/dev/null)
-        WAN_IP=$(jq -r '.value.serverInfo.network.gateways[].ipInfo.wanIp // "unknown"' "$DB_DUMP" 2>/dev/null | head -1)
-        NTP_SYNCED=$(jq -r '.value.serverInfo.ntpSynced // false' "$DB_DUMP" 2>/dev/null)
-
-        if [ "$RAM_BYTES" != "0" ] && [ "$RAM_BYTES" != "null" ]; then
-            RAM_GB=$(echo "scale=1; $RAM_BYTES / 1073741824" | bc 2>/dev/null || echo "unknown")
-        else
-            RAM_GB="unknown"
-        fi
-
-        RUNNING_SERVICES=$(jq -r '[.value.packageData[] | select(.statusInfo.started != null)] | length' "$DB_DUMP" 2>/dev/null)
-        TOTAL_SERVICES=$(jq -r '.value.packageData | length' "$DB_DUMP" 2>/dev/null)
-
-        rm -f "$DB_DUMP"
-        return 0
-    else
-        rm -f "$DB_DUMP" 2>/dev/null
-        return 1
-    fi
-}
-
-DB_INFO_AVAILABLE=0
-if parse_essential_db_info; then
-    DB_INFO_AVAILABLE=1
-fi
-
-if [ "$DB_INFO_AVAILABLE" -eq 1 ] && [ "$VERSION" != "unknown" ]; then
-    version_display="v$VERSION"
+    _____     __ ___  __  __
+   (_  |  /\ |__) |  /  \(_
+   __) | /  \|  \ |  \__/__)
+ASCII
+printf "                            v$(cat /usr/lib/startos/VERSION.txt)\n\n"
+printf "   %s (%s %s)\n" "$(uname -o)" "$(uname -r)" "$(uname -m)"
+printf "   Git Hash: $(cat /usr/lib/startos/GIT_HASH.txt)"
+if [ -n "$(cat /usr/lib/startos/ENVIRONMENT.txt)" ]; then
+    printf " ~ $(cat /usr/lib/startos/ENVIRONMENT.txt)\n"
 else
-    version_display="v$(cat /usr/lib/startos/VERSION.txt 2>/dev/null || echo 'unknown')"
+    printf "\n"
 fi
 
-printf "\n\033[1;37m    ▄▄▀▀▀▀▀▄▄\033[0m\n"
-printf "\033[1;37m  ▄▀    ▄    ▀▄      ▄▄▄▄▄  ▄▄▄▄▄▄▄    ▄      ▄▄▄▄▄   ▄▄▄▄▄▄▄ \033[1;31m▄██████▄ ▄██████\033[0m\n"
-printf "\033[1;37m █     █ █     █    █          █      █ █     █    ▀▄    █    \033[1;31m██    ██ ██     \033[0m\n"
-printf "\033[1;37m█     █   █     █   ▀▄▄▄▄      █     █   █    █ ▄▄▄▀     █    \033[1;31m██    ██ ▀█████▄\033[0m\n"
-printf "\033[1;37m█    █     █    █        █     █    █     █   █  ▀▄      █    \033[1;31m██    ██      ██\033[0m\n"
-printf "\033[1;37m █  █       █  █    ▄▄▄▄▄▀     █   █       █  █    ▀▄    █    \033[1;31m▀██████▀ ██████▀\033[0m\n"
-printf "\033[1;37m   █         █\033[0m\n"
-printf "\033[1;37m     ▀▀▄▄▄▀▀                                                  $version_display\033[0m\n\n"
-
-uptime_str=$(uptime | awk -F'up ' '{print $2}' | awk -F',' '{print $1}' | sed 's/^ *//')
-
-if [ "$DB_INFO_AVAILABLE" -eq 1 ] && [ "$RAM_GB" != "unknown" ]; then
-    memory_used=$(free -m | awk 'NR==2{printf "%.0fMB", $3}')
-    memory_display="$memory_used / ${RAM_GB}GB"
-else
-    memory_display=$(free -m | awk 'NR==2{printf "%.0fMB / %.0fMB", $3, $2}')
-fi
-
-root_usage=$(df -h / | awk 'NR==2{printf "%s (%s free)", $5, $4}')
-
-if [ -d "/media/startos/data/package-data" ]; then
-    data_usage=$(df -h /media/startos/data/package-data | awk 'NR==2{printf "%s (%s free)", $5, $4}')
-else
-    data_usage="N/A"
-fi
-
-if [ "$DB_INFO_AVAILABLE" -eq 1 ]; then
-    services_text="$RUNNING_SERVICES/$TOTAL_SERVICES running"
-else
-    services_text="Unknown"
-fi
-
-local_ip=$(ip route get 1.1.1.1 2>/dev/null | awk '{for(i=1;i<=NF;i++) if($i=="src") print $(i+1)}' | head -1)
-if [ -z "$local_ip" ]; then local_ip="N/A"; fi
-
-if [ "$DB_INFO_AVAILABLE" -eq 1 ] && [ "$WAN_IP" != "unknown" ]; then
-    wan_ip="$WAN_IP"
-else
-    wan_ip="N/A"
-fi
-
-printf "    \033[1;37m┌─ SYSTEM STATUS ───────────────────────────────────────────────────┐\033[0m\n"
-printf "    \033[1;37m│\033[0m %-8s  \033[0;33m%-22s\033[0m %-8s \033[0;33m%-23s\033[0m \033[1;37m│\033[0m\n" "Uptime:" "$uptime_str" "Memory:" "$memory_display"
-printf "    \033[1;37m│\033[0m %-8s  \033[0;33m%-22s\033[0m %-8s \033[0;33m%-23s\033[0m \033[1;37m│\033[0m\n" "Root:" "$root_usage" "Data:" "$data_usage"
-
-if [ "$DB_INFO_AVAILABLE" -eq 1 ]; then
-    if [ "$RUNNING_SERVICES" -eq "$TOTAL_SERVICES" ] && [ "$TOTAL_SERVICES" -gt 0 ]; then
-        printf "    \033[1;37m│\033[0m %-8s \033[0;32m%-22s\033[0m %-8s \033[0;33m%-23s\033[0m \033[1;37m│\033[0m\n" "Services:" "$services_text" "WAN:" "$wan_ip"
-    elif [ "$RUNNING_SERVICES" -gt 0 ]; then
-        printf "    \033[1;37m│\033[0m %-8s \033[0;33m%-22s\033[0m %-8s \033[0;33m%-23s\033[0m \033[1;37m│\033[0m\n" "Services:" "$services_text" "WAN:" "$wan_ip"
-    else
-        printf "    \033[1;37m│\033[0m %-8s \033[0;31m%-22s\033[0m %-8s \033[0;33m%-23s\033[0m \033[1;37m│\033[0m\n" "Services:" "$services_text" "WAN:" "$wan_ip"
-    fi
-else
-    printf "    \033[1;37m│\033[0m %-8s \033[0;37m%-22s\033[0m %-8s \033[0;33m%-23s\033[0m \033[1;37m│\033[0m\n" "Services:" "$services_text" "WAN:" "$wan_ip"
-fi
-
-if [ "$DB_INFO_AVAILABLE" -eq 1 ] && [ "$NTP_SYNCED" = "true" ]; then
-    printf "    \033[1;37m│\033[0m %-8s  \033[0;33m%-22s\033[0m %-8s \033[0;32m%-23s\033[0m \033[1;37m│\033[0m\n" "Local:" "$local_ip" "NTP:" "Synced"
-elif [ "$DB_INFO_AVAILABLE" -eq 1 ] && [ "$NTP_SYNCED" = "false" ]; then
-    printf "    \033[1;37m│\033[0m %-8s  \033[0;33m%-22s\033[0m %-8s \033[0;31m%-23s\033[0m \033[1;37m│\033[0m\n" "Local:" "$local_ip" "NTP:" "Not Synced"
-else
-    printf "    \033[1;37m│\033[0m %-8s  \033[0;33m%-22s\033[0m %-8s \033[0;37m%-23s\033[0m \033[1;37m│\033[0m\n" "Local:" "$local_ip" "NTP:" "Unknown"
-fi
-
-printf "    \033[1;37m└───────────────────────────────────────────────────────────────────┘\033[0m"
-
-if [ "$DB_INFO_AVAILABLE" -eq 1 ] && [ "$HOSTNAME" != "unknown" ]; then
-    web_url="https://$HOSTNAME.local"
-else
-    web_url="https://$(hostname).local"
-fi
-printf "\n    \033[1;37m┌──────────────────────────────────────────────────── QUICK ACCESS ─┐\033[0m\n"
-printf "    \033[1;37m│\033[0m Web Interface: \033[0;36m%-50s\033[0m \033[1;37m│\033[0m\n" "$web_url"
-printf "    \033[1;37m│\033[0m Documentation: \033[0;36m%-50s\033[0m \033[1;37m│\033[0m\n" "https://staging.docs.start9.com"
-printf "    \033[1;37m│\033[0m Support:       \033[0;36m%-50s\033[0m \033[1;37m│\033[0m\n" "https://start9.com/contact"
-printf "    \033[1;37m└───────────────────────────────────────────────────────────────────┘\033[0m\n\n"
+printf "\n"
+printf " * Documentation:  https://docs.start9.com\n"
+printf " * Management:     https://%s.local\n" "$(hostname)"
+printf " * Support:        https://start9.com/contact\n"
+printf " * Source Code:    https://github.com/Start9Labs/start-os\n"
+printf " * License:        MIT\n"
+printf "\n"

build/lib/scripts/chroot-and-upgrade

@@ -10,24 +10,24 @@ fi
 POSITIONAL_ARGS=()
 
 while [[ $# -gt 0 ]]; do
-    case $1 in
-      --no-sync)
-          NO_SYNC=1
-          shift
-          ;;
-      --create)
-          ONLY_CREATE=1
-          shift
-          ;;
-      -*|--*)
-          echo "Unknown option $1"
-          exit 1
-          ;;
-      *)
-          POSITIONAL_ARGS+=("$1") # save positional arg
-          shift # past argument
-          ;;
-    esac
+  case $1 in
+    --no-sync)
+      NO_SYNC=1
+      shift
+      ;;
+    --create)
+      ONLY_CREATE=1
+      shift
+      ;;
+    -*|--*)
+      echo "Unknown option $1"
+      exit 1
+      ;;
+    *)
+      POSITIONAL_ARGS+=("$1") # save positional arg
+      shift # past argument
+      ;;
+  esac
 done
 
 set -- "${POSITIONAL_ARGS[@]}" # restore positional parameters
@@ -35,7 +35,7 @@ set -- "${POSITIONAL_ARGS[@]}" # restore positional parameters
 if [ -z "$NO_SYNC" ]; then
     echo 'Syncing...'
     umount -R /media/startos/next 2> /dev/null
-    umount /media/startos/upper 2> /dev/null
+    umount -R /media/startos/upper 2> /dev/null
     rm -rf /media/startos/upper /media/startos/next
     mkdir /media/startos/upper
     mount -t tmpfs tmpfs /media/startos/upper
@@ -43,6 +43,8 @@ if [ -z "$NO_SYNC" ]; then
     mount -t overlay \
 		  -olowerdir=/media/startos/current,upperdir=/media/startos/upper/data,workdir=/media/startos/upper/work \
 		  overlay /media/startos/next
+    mkdir -p /media/startos/next/media/startos/root
+    mount --bind /media/startos/root /media/startos/next/media/startos/root
 fi
 
 if [ -n "$ONLY_CREATE" ]; then
@@ -54,18 +56,12 @@ mkdir -p /media/startos/next/dev
 mkdir -p /media/startos/next/sys
 mkdir -p /media/startos/next/proc
 mkdir -p /media/startos/next/boot
-mkdir -p /media/startos/next/media/startos/root
 mount --bind /run /media/startos/next/run
 mount --bind /tmp /media/startos/next/tmp
 mount --bind /dev /media/startos/next/dev
 mount --bind /sys /media/startos/next/sys
 mount --bind /proc /media/startos/next/proc
 mount --bind /boot /media/startos/next/boot
-mount --bind /media/startos/root /media/startos/next/media/startos/root
-
-if mountpoint /sys/firmware/efi/efivars 2> /dev/null; then
-  mount --bind /sys/firmware/efi/efivars /media/startos/next/sys/firmware/efi/efivars
-fi
 
 if [ -z "$*" ]; then
     chroot /media/startos/next
@@ -75,10 +71,6 @@ else
     CHROOT_RES=$?
 fi
 
-if mountpoint /media/startos/next/sys/firmware/efi/efivars 2> /dev/null; then
-  umount /media/startos/next/sys/firmware/efi/efivars 
-fi
-
 umount /media/startos/next/run
 umount /media/startos/next/tmp
 umount /media/startos/next/dev
@@ -95,12 +87,11 @@ if [ "$CHROOT_RES" -eq 0 ]; then
 
     echo 'Upgrading...'
 
-    rm -f /media/startos/images/next.squashfs
     if ! time mksquashfs /media/startos/next /media/startos/images/next.squashfs -b 4096 -comp gzip; then
-        umount -l /media/startos/next
-        umount -l /media/startos/upper
-        rm -rf /media/startos/upper /media/startos/next
-        exit 1
+      umount -R /media/startos/next
+      umount -R /media/startos/upper
+      rm -rf /media/startos/upper /media/startos/next
+      exit 1
     fi
     hash=$(b3sum /media/startos/images/next.squashfs | head -c 32)
     mv /media/startos/images/next.squashfs /media/startos/images/${hash}.rootfs
@@ -112,5 +103,5 @@ if [ "$CHROOT_RES" -eq 0 ]; then
 fi
 
 umount -R /media/startos/next
-umount /media/startos/upper
+umount -R /media/startos/upper
 rm -rf /media/startos/upper /media/startos/next

build/lib/scripts/enable-kiosk

@@ -64,11 +64,9 @@ user_pref("messaging-system.rsexperimentloader.enabled", false);
 user_pref("network.allow-experiments", false);
 user_pref("network.captive-portal-service.enabled", false);
 user_pref("network.connectivity-service.enabled", false);
-user_pref("network.proxy.socks", "10.0.3.1");
-user_pref("network.proxy.socks_port", 9050);
-user_pref("network.proxy.socks_version", 5);
+user_pref("network.proxy.autoconfig_url", "file:///usr/lib/startos/proxy.pac");
 user_pref("network.proxy.socks_remote_dns", true);
-user_pref("network.proxy.type", 1);
+user_pref("network.proxy.type", 2);
 user_pref("privacy.resistFingerprinting", true);
 //Enable letterboxing if we want the window size sent to the server to snap to common resolutions:
 //user_pref("privacy.resistFingerprinting.letterboxing", true);

build/lib/scripts/forward-port

@@ -1,51 +1,26 @@
 #!/bin/bash
 
-if [ -z "$sip" ] || [ -z "$dip" ] || [ -z "$dprefix" ] || [ -z "$sport" ] || [ -z "$dport" ]; then
+if [ -z "$iiface" ] || [ -z "$oiface" ] || [ -z "$sip" ] || [ -z "$dip" ] || [ -z "$sport" ] || [ -z "$dport" ]; then
     >&2 echo 'missing required env var'
     exit 1
 fi
 
-NAME="F$(echo "$sip:$sport -> $dip/$dprefix:$dport" | sha256sum | head -c 15)"
+kind="-A"
 
-for kind in INPUT FORWARD ACCEPT; do
-    if ! iptables -C $kind -j "${NAME}_${kind}" 2> /dev/null; then
-        iptables -N "${NAME}_${kind}" 2> /dev/null
-        iptables -A $kind -j "${NAME}_${kind}"
-    fi
-done
-for kind in PREROUTING INPUT OUTPUT POSTROUTING; do
-    if ! iptables -t nat -C $kind -j "${NAME}_${kind}" 2> /dev/null; then
-        iptables -t nat -N "${NAME}_${kind}" 2> /dev/null
-        iptables -t nat -A $kind -j "${NAME}_${kind}"
-    fi
-done
-
-err=0
-trap 'err=1' ERR
-
-for kind in INPUT FORWARD ACCEPT; do
-    iptables -F "${NAME}_${kind}" 2> /dev/null
-done
-for kind in PREROUTING INPUT OUTPUT POSTROUTING; do
-    iptables -t nat -F "${NAME}_${kind}" 2> /dev/null
-done
 if [ "$UNDO" = 1 ]; then
-    conntrack -D -p tcp -d $sip --dport $sport || true # conntrack returns exit 1 if no connections are active
-    conntrack -D -p udp -d $sip --dport $sport || true # conntrack returns exit 1 if no connections are active
-    exit $err
+    kind="-D"
 fi
 
-iptables -t nat -A ${NAME}_PREROUTING -d "$sip" -p tcp --dport "$sport" -j DNAT --to-destination "$dip:$dport"
-iptables -t nat -A ${NAME}_PREROUTING -d "$sip" -p udp --dport "$sport" -j DNAT --to-destination "$dip:$dport"
-iptables -t nat -A ${NAME}_OUTPUT -d "$sip" -p tcp --dport "$sport" -j DNAT --to-destination "$dip:$dport"
-iptables -t nat -A ${NAME}_OUTPUT -d "$sip" -p udp --dport "$sport" -j DNAT --to-destination "$dip:$dport"
+iptables -t nat "$kind" POSTROUTING -o $iiface -j MASQUERADE
+iptables -t nat "$kind" PREROUTING -i $iiface -p tcp --dport $sport -j DNAT --to-destination $dip:$dport
+iptables -t nat "$kind" PREROUTING -i $iiface -p udp --dport $sport -j DNAT --to-destination $dip:$dport
+iptables -t nat "$kind" PREROUTING -i $oiface -s $dip/24 -d $sip -p tcp --dport $sport -j DNAT --to-destination $dip:$dport
+iptables -t nat "$kind" PREROUTING -i $oiface -s $dip/24 -d $sip -p udp --dport $sport -j DNAT --to-destination $dip:$dport
+iptables -t nat "$kind" POSTROUTING -o $oiface -s $dip/24 -d $dip/32 -p tcp --dport $dport -j SNAT --to-source $sip:$sport
+iptables -t nat "$kind" POSTROUTING -o $oiface -s $dip/24 -d $dip/32 -p udp --dport $dport -j SNAT --to-source $sip:$sport
 
-iptables -t nat -A ${NAME}_PREROUTING -s "$dip/$dprefix" -d "$sip" -p tcp --dport "$sport" -j DNAT --to-destination "$dip:$dport"
-iptables -t nat -A ${NAME}_PREROUTING -s "$dip/$dprefix" -d "$sip" -p udp --dport "$sport" -j DNAT --to-destination "$dip:$dport"
-iptables -t nat -A ${NAME}_POSTROUTING -s "$dip/$dprefix" -d "$dip" -p tcp --dport "$dport" -j MASQUERADE
-iptables -t nat -A ${NAME}_POSTROUTING -s "$dip/$dprefix" -d "$dip" -p udp --dport "$dport" -j MASQUERADE
 
-iptables -A ${NAME}_FORWARD -d $dip -p tcp --dport $dport -m state --state NEW -j ACCEPT
-iptables -A ${NAME}_FORWARD -d $dip -p udp --dport $dport -m state --state NEW -j ACCEPT
-
-exit $err
+iptables -t nat "$kind" PREROUTING -i $iiface -s $sip/32 -d $sip -p tcp --dport $sport -j DNAT --to-destination $dip:$dport
+iptables -t nat "$kind" PREROUTING -i $iiface -s $sip/32 -d $sip -p udp --dport $sport -j DNAT --to-destination $dip:$dport
+iptables -t nat "$kind" POSTROUTING -o $oiface -s $sip/32 -d $dip/32 -p tcp --dport $dport -j SNAT --to-source $sip:$sport
+iptables -t nat "$kind" POSTROUTING -o $oiface -s $sip/32 -d $dip/32 -p udp --dport $dport -j SNAT --to-source $sip:$sport

build/lib/scripts/startos-initramfs-module

@@ -83,7 +83,6 @@ local_mount_root()
 	if [ -d "$image" ]; then
 		mount -r --bind $image /lower
 	elif [ -f "$image" ]; then
-		modprobe loop
 		modprobe squashfs
 		mount -r $image /lower
 	else

build/lib/scripts/tor-check

@@ -1,64 +1,36 @@
 #!/bin/bash
 
-# --- Config ---
-# Colors (using printf to ensure compatibility)
-GRAY=$(printf '\033[90m')
-GREEN=$(printf '\033[32m')
-RED=$(printf '\033[31m')
-NC=$(printf '\033[0m') # No Color
+fail=$(printf " [\033[31m fail \033[0m]")
+pass=$(printf " [\033[32m pass \033[0m]")
 
-# Proxies to test
-proxies=(
-    "Host Tor|127.0.1.1:9050"
-    "Startd Tor|10.0.3.1:9050"
-)
-
-# Default URLs
 onion_list=(
-    "The Tor Project|http://2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion"
     "Start9|http://privacy34kn4ez3y3nijweec6w4g54i3g54sdv7r5mr6soma3w4begyd.onion"
     "Mempool|http://mempoolhqx4isw62xs7abwphsq7ldayuidyx2v2oethdhhj6mlo2r6ad.onion"
     "DuckDuckGo|https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion"
     "Brave Search|https://search.brave4u7jddbv7cyviptqjc7jusxh72uik7zt6adtckl5f4nwy2v72qd.onion"
 )
 
-# Load custom list
-[ -f ~/.startos/tor-check.list ] && readarray -t custom_list < <(grep -v '^#' ~/.startos/tor-check.list) && onion_list+=("${custom_list[@]}")
-
-# --- Functions ---
-print_line() { printf "${GRAY}────────────────────────────────────────${NC}\n"; }
-
-# --- Main ---
-echo "Testing Onion Connections..."
-
-for proxy_info in "${proxies[@]}"; do
-    proxy_name="${proxy_info%%|*}"
-    proxy_addr="${proxy_info#*|}"
-    
-    print_line
-    printf "${GRAY}Proxy: %s (%s)${NC}\n" "$proxy_name" "$proxy_addr"
-    
-    for data in "${onion_list[@]}"; do
-        name="${data%%|*}"
-        url="${data#*|}"
-        
-        # Capture verbose output + http code.
-        # --no-progress-meter: Suppresses the "0 0 0" stats but keeps -v output
-        output=$(curl -v --no-progress-meter --max-time 15 --socks5-hostname "$proxy_addr" "$url" 2>&1)
-        exit_code=$?
-        
-        if [ $exit_code -eq 0 ]; then
-            printf "  ${GREEN}[pass]${NC} %s (%s)\n" "$name" "$url"
-        else
-            printf "  ${RED}[fail]${NC} %s (%s)\n" "$name" "$url"
-            printf "         ${RED}↳ Curl Error %s${NC}\n" "$exit_code"
-            
-            # Print the last 4 lines of verbose log to show the specific handshake error
-            # We look for lines starting with '*' or '>' or '<' to filter out junk if any remains
-            echo "$output" | tail -n 4 | sed "s/^/         ${GRAY}/"
+# Check if ~/.startos/tor-check.list exists and read its contents if available
+if [ -f ~/.startos/tor-check.list ]; then
+    while IFS= read -r line; do
+        # Check if the line starts with a #
+        if [[ ! "$line" =~ ^# ]]; then
+            onion_list+=("$line")
         fi
-    done
+    done < ~/.startos/tor-check.list
+fi
+
+echo "Testing connection to Onion Pages ..."
+
+for data in "${onion_list[@]}"; do
+    name="${data%%|*}"
+    url="${data#*|}"
+    if curl --socks5-hostname localhost:9050 "$url" > /dev/null 2>&1; then
+        echo " ${pass}: $name ($url) "
+    else
+        echo " ${fail}: $name ($url) "
+    fi
 done
-print_line
-# Reset color just in case
-printf "${NC}"
+
+echo
+echo "Done."

build/lib/scripts/upgrade

@@ -1,82 +0,0 @@
-#!/bin/bash
-
-set -e
-
-SOURCE_DIR="$(dirname $(realpath "${BASH_SOURCE[0]}"))"
-
-if [ "$UID" -ne 0 ]; then
-    >&2 echo 'Must be run as root'
-    exit 1
-fi
-
-if ! [ -f "$1" ]; then
-    >&2 echo "usage: $0 <SQUASHFS>"
-    exit 1
-fi
-
-echo 'Upgrading...'
-
-hash=$(b3sum $1 | head -c 32)
-if [ -n "$2" ] && [ "$hash" != "$CHECKSUM" ]; then
-    >&2 echo 'Checksum mismatch'
-    exit 2
-fi
-
-unsquashfs -f -d / $1 boot
-
-umount -R /media/startos/next 2> /dev/null || true
-umount /media/startos/upper 2> /dev/null || true
-umount /media/startos/lower 2> /dev/null || true
-
-mkdir -p /media/startos/upper
-mount -t tmpfs tmpfs /media/startos/upper
-mkdir -p /media/startos/lower /media/startos/upper/data /media/startos/upper/work /media/startos/next
-mount $1 /media/startos/lower
-mount -t overlay \
-      -olowerdir=/media/startos/lower,upperdir=/media/startos/upper/data,workdir=/media/startos/upper/work \
-	    overlay /media/startos/next
-
-mkdir -p /media/startos/next/run
-mkdir -p /media/startos/next/dev
-mkdir -p /media/startos/next/sys
-mkdir -p /media/startos/next/proc
-mkdir -p /media/startos/next/boot
-mkdir -p /media/startos/next/media/startos/root
-mount --bind /run /media/startos/next/run
-mount --bind /tmp /media/startos/next/tmp
-mount --bind /dev /media/startos/next/dev
-mount --bind /sys /media/startos/next/sys
-mount --bind /proc /media/startos/next/proc
-mount --bind /boot /media/startos/next/boot
-mount --bind /media/startos/root /media/startos/next/media/startos/root
-
-if mountpoint /boot/efi 2> /dev/null; then
-    mkdir -p /media/startos/next/boot/efi
-    mount --bind /boot/efi /media/startos/next/boot/efi
-fi
-
-if mountpoint /sys/firmware/efi/efivars 2> /dev/null; then
-    mount --bind /sys/firmware/efi/efivars /media/startos/next/sys/firmware/efi/efivars
-fi
-
-chroot /media/startos/next bash -e << "EOF"
-
-if [ -f /boot/grub/grub.cfg ]; then
-    grub-install /dev/$(eval $(lsblk -o MOUNTPOINT,PKNAME -P | grep 'MOUNTPOINT="/media/startos/root"') && echo $PKNAME)
-    update-grub
-fi
-
-EOF
-
-sync
-
-umount -Rl /media/startos/next
-umount /media/startos/upper
-umount /media/startos/lower
-
-mv $1 /media/startos/images/${hash}.rootfs
-ln -rsf /media/startos/images/${hash}.rootfs /media/startos/config/current.rootfs
-
-sync
-
-echo 'System upgrade complete. Reboot to apply changes...'

build/lib/scripts/use-img

@@ -0,0 +1,61 @@
+#!/bin/bash
+
+set -e
+
+if [ "$UID" -ne 0 ]; then
+    >&2 echo 'Must be run as root'
+    exit 1
+fi
+
+if [ -z "$1" ]; then
+    >&2 echo "usage: $0 <SQUASHFS>"
+    exit 1
+fi
+
+VERSION=$(unsquashfs -cat $1 /usr/lib/startos/VERSION.txt)
+GIT_HASH=$(unsquashfs -cat $1 /usr/lib/startos/GIT_HASH.txt)
+B3SUM=$(b3sum $1 | head -c 32)
+
+if [ -n "$CHECKSUM" ] && [ "$CHECKSUM" != "$B3SUM" ]; then
+    >&2 echo "CHECKSUM MISMATCH"
+    exit 2
+fi
+
+mv $1 /media/startos/images/${B3SUM}.rootfs
+ln -rsf /media/startos/images/${B3SUM}.rootfs /media/startos/config/current.rootfs
+
+unsquashfs -n -f -d / /media/startos/images/${B3SUM}.rootfs boot
+
+umount -R /media/startos/next 2> /dev/null || true
+umount -R /media/startos/lower 2> /dev/null || true
+umount -R /media/startos/upper 2> /dev/null || true
+
+rm -rf /media/startos/lower /media/startos/upper /media/startos/next
+mkdir /media/startos/upper
+mount -t tmpfs tmpfs /media/startos/upper
+mkdir -p /media/startos/lower /media/startos/upper/data /media/startos/upper/work /media/startos/next
+mount /media/startos/images/${B3SUM}.rootfs /media/startos/lower
+mount -t overlay \
+  -olowerdir=/media/startos/lower,upperdir=/media/startos/upper/data,workdir=/media/startos/upper/work \
+  overlay /media/startos/next
+mkdir -p /media/startos/next/media/startos/root
+mount --bind /media/startos/root /media/startos/next/media/startos/root
+mkdir -p /media/startos/next/dev
+mkdir -p /media/startos/next/sys
+mkdir -p /media/startos/next/proc
+mkdir -p /media/startos/next/boot
+mount --bind /dev /media/startos/next/dev
+mount --bind /sys /media/startos/next/sys
+mount --bind /proc /media/startos/next/proc
+mount --bind /boot /media/startos/next/boot
+
+chroot /media/startos/next update-grub2
+
+umount -R /media/startos/next
+umount -R /media/startos/upper
+umount -R /media/startos/lower
+rm -rf /media/startos/lower /media/startos/upper /media/startos/next
+
+sync
+
+reboot

build/os-compat/buildenv.Dockerfile

@@ -1,4 +1,4 @@
-FROM debian:trixie
+FROM debian:bookworm
 
 RUN apt-get update && \
     apt-get install -y \
@@ -12,14 +12,45 @@ RUN apt-get update && \
     jq \
     gzip \
     brotli \
+    qemu-user-static \
+    binfmt-support \
     squashfs-tools \
     git \
+    debspawn \
     rsync \
     b3sum \
+    fuse-overlayfs \
     sudo \
-    nodejs
+    systemd \
+    systemd-container \
+    systemd-sysv \
+    dbus \
+    dbus-user-session
+
+RUN systemctl mask \
+    systemd-firstboot.service \
+    systemd-udevd.service \
+    getty@tty1.service \
+    console-getty.service
 
 RUN git config --global --add safe.directory /root/start-os
 
+RUN mkdir -p /etc/debspawn && \
+    echo "AllowUnsafePermissions=true" > /etc/debspawn/global.toml
+
+ENV NVM_DIR=~/.nvm
+ENV NODE_VERSION=22
+RUN mkdir -p $NVM_DIR && \
+    curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/master/install.sh | bash && \
+    . $NVM_DIR/nvm.sh \
+    nvm install $NODE_VERSION && \
+    nvm use $NODE_VERSION && \
+    nvm alias default $NODE_VERSION && \
+    ln -s $(which node) /usr/bin/node && \
+    ln -s $(which npm) /usr/bin/npm
+
 RUN mkdir -p /root/start-os
 WORKDIR /root/start-os
+
+COPY docker-entrypoint.sh /docker-entrypoint.sh
+ENTRYPOINT [ "/docker-entrypoint.sh" ]

build/os-compat/docker-entrypoint.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+
+exec /lib/systemd/systemd --unit=multi-user.target --show-status=false --log-target=journal

build/os-compat/run-compat.sh

@@ -1,30 +1,27 @@
 #!/bin/bash
 
-pwd=$(pwd)
-
-cd "$(dirname "${BASH_SOURCE[0]}")/../.."
-
-set -e
-
-rel_pwd="${pwd#"$(pwd)"}"
-
-COMPAT_ARCH=$(uname -m)
-
-platform=linux/$COMPAT_ARCH
-
-case $COMPAT_ARCH in
-    x86_64)
-        platform=linux/amd64;;
-    aarch64)
-        platform=linux/arm64;;
-esac
-
 if [ "$FORCE_COMPAT" = 1 ] || ( [ "$REQUIRES" = "linux" ] && [ "$(uname -s)" != "Linux" ] ) || ( [ "$REQUIRES" = "debian" ] && ! which dpkg > /dev/null ); then
+    project_pwd="$(cd "$(dirname "${BASH_SOURCE[0]}")"/../.. && pwd)/"
+    pwd="$(pwd)/"
+    if ! [[ "$pwd" = "$project_pwd"* ]]; then
+        >&2 echo "Must be run from start-os project dir"
+        exit 1
+    fi
+    rel_pwd="${pwd#"$project_pwd"}"
+
+    SYSTEMD_TTY="-P"
+    USE_TTY=
     if tty -s; then
         USE_TTY="-it"
+        SYSTEMD_TTY="-t"
     fi
 
-    docker run $USE_TTY --platform=$platform -eARCH -eENVIRONMENT -ePLATFORM -eGIT_BRANCH_AS_HASH -ePROJECT -eDEPENDS -eCONFLICTS -w "/root/start-os${rel_pwd}" --rm -v "$(pwd):/root/start-os" start9/build-env $@
+    docker run -d --rm --name os-compat --privileged --security-opt apparmor=unconfined -v "${project_pwd}:/root/start-os" -v /lib/modules:/lib/modules:ro start9/build-env
+    while ! docker exec os-compat systemctl is-active --quiet multi-user.target 2> /dev/null; do sleep .5; done
+    docker exec -eARCH -eENVIRONMENT -ePLATFORM -eGIT_BRANCH_AS_HASH $USE_TTY -w "/root/start-os${rel_pwd}" os-compat $@
+    code=$?
+    docker stop os-compat
+    exit $code
 else 
     exec $@
-fi
+fi

build/upload-ota.sh

@@ -1,143 +0,0 @@
-#!/bin/bash
-
-if [ -z "$VERSION" ]; then
-    >&2 echo '$VERSION required'
-    exit 2
-fi
-
-if [ -z "$RUN_ID" ]; then
-    >&2 echo '$RUN_ID required'
-    exit 2
-fi
-
-set -e
-
-if [ "$SKIP_DL" != "1" ]; then
-    rm -rf ~/Downloads/v$VERSION
-    mkdir ~/Downloads/v$VERSION
-    cd ~/Downloads/v$VERSION
-
-    for arch in aarch64 aarch64-nonfree riscv64 x86_64 x86_64-nonfree raspberrypi; do
-        while ! gh run download -R Start9Labs/start-os $RUN_ID -n $arch.squashfs -D $(pwd); do sleep 1; done
-    done
-    for arch in aarch64 aarch64-nonfree riscv64 x86_64 x86_64-nonfree; do
-        while ! gh run download -R Start9Labs/start-os $RUN_ID -n $arch.iso -D $(pwd); do sleep 1; done
-    done
-    while ! gh run download -R Start9Labs/start-os $RUN_ID -n raspberrypi.img -D $(pwd); do sleep 1; done
-
-    if [ -n "$ST_RUN_ID" ]; then
-        for arch in aarch64 riscv64 x86_64; do
-            while ! gh run download -R Start9Labs/start-os $ST_RUN_ID -n start-tunnel_$arch.deb -D $(pwd); do sleep 1; done
-    done
-    fi
-
-    if [ -n "$CLI_RUN_ID" ]; then
-        for arch in aarch64 riscv64 x86_64; do
-            for os in linux macos; do
-                pair=${arch}-${os}
-                if [ "${pair}" = "riscv64-linux" ]; then
-                    target=riscv64gc-unknown-linux-musl
-                elif [ "${pair}" = "riscv64-macos" ]; then
-                    continue
-                elif [ "${os}" = "linux" ]; then
-                    target="${arch}-unknown-linux-musl"
-                elif [ "${os}" = "macos" ]; then
-                    target="${arch}-apple-darwin"
-                fi
-                while ! gh run download -R Start9Labs/start-os $CLI_RUN_ID -n start-cli_$target -D $(pwd); do sleep 1; done
-                mv start-cli "start-cli_${pair}"
-            done
-        done
-    fi
-else
-    cd ~/Downloads/v$VERSION
-fi
-
-start-cli --registry=https://alpha-registry-x.start9.com registry os version add $VERSION "v$VERSION" '' ">=0.3.5 <=$VERSION"
-
-if [ "$SKIP_UL" = "2" ]; then
-    exit 2
-elif [ "$SKIP_UL" != "1" ]; then
-    for file in *.squashfs *.iso *.deb start-cli_*; do
-        gh release upload -R Start9Labs/start-os v$VERSION $file
-    done
-    for file in *.img; do
-        if ! [ -f $file.gz ]; then
-            cat $file | pigz > $file.gz
-        fi
-        gh release upload -R Start9Labs/start-os v$VERSION $file.gz
-    done
-fi
-
-if [ "$SKIP_INDEX" != "1" ]; then
-    for arch in aarch64 aarch64-nonfree x86_64 x86_64-nonfree; do
-        for file in *_$arch.squashfs *_$arch.iso; do
-            start-cli --registry=https://alpha-registry-x.start9.com registry os asset add --platform=$arch --version=$VERSION $file https://github.com/Start9Labs/start-os/releases/download/v$VERSION/$(echo -n "$file" | sed 's/~/./g')
-        done
-    done
-    for arch in raspberrypi; do
-        for file in *_$arch.squashfs; do
-            start-cli --registry=https://alpha-registry-x.start9.com registry os asset add --platform=$arch --version=$VERSION $file https://github.com/Start9Labs/start-os/releases/download/v$VERSION/$(echo -n "$file" | sed 's/~/./g')
-        done
-    done
-fi
-
-for file in *.iso *.img *.img.gz *.squashfs *.deb start-cli_*; do
-    gpg -u 7CFFDA41CA66056A --detach-sign --armor -o "${file}.asc" "$file"
-done
-
-gpg --export -a 7CFFDA41CA66056A > dr-bonez.key.asc
-tar -czvf signatures.tar.gz *.asc
-
-gh release upload -R Start9Labs/start-os v$VERSION signatures.tar.gz
-
-cat << 'EOF'
-# StartOS Checksums
-
-## SHA-256
-```
-EOF
-sha256sum *.iso *.img *img.gz *.squashfs
-cat << 'EOF'
-```
-
-## BLAKE-3
-```
-EOF
-b3sum *.iso *.img *.img.gz *.squashfs
-cat << 'EOF'
-```
-
-# Start-Tunnel Checksums
-
-## SHA-256
-```
-EOF
-sha256sum start-tunnel*.deb
-cat << 'EOF'
-```
-
-## BLAKE-3
-```
-EOF
-b3sum start-tunnel*.deb
-cat << 'EOF'
-```
-
-# start-cli Checksums
-
-## SHA-256
-```
-EOF
-sha256sum start-cli_*
-cat << 'EOF'
-```
-
-## BLAKE-3
-```
-EOF
-b3sum start-cli_*
-cat << 'EOF'
-```
-EOF
-

check-environment.sh

@@ -1,10 +1,8 @@
 #!/bin/bash
 
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
 if ! [ -f ./ENVIRONMENT.txt ] || [ "$(cat ./ENVIRONMENT.txt)" != "$ENVIRONMENT" ]; then
     >&2 echo "Updating ENVIRONMENT.txt to \"$ENVIRONMENT\""
     echo -n "$ENVIRONMENT" > ./ENVIRONMENT.txt
 fi
 
-echo -n ./build/env/ENVIRONMENT.txt
+echo -n ./ENVIRONMENT.txt

check-git-hash.sh

@@ -1,7 +1,5 @@
 #!/bin/bash
 
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
 if [ "$GIT_BRANCH_AS_HASH" != 1 ]; then
     GIT_HASH="$(git rev-parse HEAD)$(if ! git diff-index --quiet HEAD --; then echo '-modified'; fi)"
 else
@@ -13,4 +11,4 @@ if ! [ -f ./GIT_HASH.txt ] || [ "$(cat ./GIT_HASH.txt)" != "$GIT_HASH" ]; then
     echo -n "$GIT_HASH" > ./GIT_HASH.txt
 fi
 
-echo -n ./build/env/GIT_HASH.txt
+echo -n ./GIT_HASH.txt

check-platform.sh

@@ -1,10 +1,8 @@
 #!/bin/bash
 
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
 if ! [ -f ./PLATFORM.txt ] || [ "$(cat ./PLATFORM.txt)" != "$PLATFORM" ] && [ -n "$PLATFORM" ]; then
     >&2 echo "Updating PLATFORM.txt to \"$PLATFORM\""
     echo -n "$PLATFORM" > ./PLATFORM.txt
 fi
 
-echo -n ./build/env/PLATFORM.txt
+echo -n ./PLATFORM.txt

check-version.sh

@@ -1,8 +1,6 @@
 #!/bin/bash
 
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
-FE_VERSION="$(cat ../../web/package.json | grep '"version"' | sed 's/[ \t]*"version":[ \t]*"\([^"]*\)",/\1/')"
+FE_VERSION="$(cat web/package.json | grep '"version"' | sed 's/[ \t]*"version":[ \t]*"\([^"]*\)",/\1/')"
 
 # TODO: Validate other version sources - backend/Cargo.toml, backend/src/version/mod.rs
 
@@ -12,4 +10,4 @@ if ! [ -f ./VERSION.txt ] || [ "$(cat ./VERSION.txt)" != "$VERSION" ]; then
     echo -n "$VERSION" > ./VERSION.txt
 fi
 
-echo -n ./build/env/VERSION.txt
+echo -n ./VERSION.txt

compress-uis.sh

@@ -4,17 +4,13 @@ cd "$(dirname "${BASH_SOURCE[0]}")"
 
 set -e
 
-STATIC_DIR=dist/static/$1
-RAW_DIR=dist/raw/$1
-
-mkdir -p $STATIC_DIR
-rm -rf $STATIC_DIR
+rm -rf web/dist/static
 
 if ! [[ "$ENVIRONMENT" =~ (^|-)dev($|-) ]]; then
-    find $RAW_DIR -type f -not -name '*.gz' -and -not -name '*.br' | xargs -n 1 -P 0 gzip -kf
-    find $RAW_DIR -type f -not -name '*.gz' -and -not -name '*.br' | xargs -n 1 -P 0 brotli -kf
+    find web/dist/raw -type f -not -name '*.gz' -and -not -name '*.br' | xargs -n 1 -P 0 gzip -kf
+    find web/dist/raw -type f -not -name '*.gz' -and -not -name '*.br' | xargs -n 1 -P 0 brotli -kf
 
-    for file in $(find $RAW_DIR -type f -not -name '*.gz' -and -not -name '*.br'); do
+    for file in $(find web/dist/raw -type f -not -name '*.gz' -and -not -name '*.br'); do
         raw_size=$(du  $file | awk '{print $1 * 512}')
         gz_size=$(du  $file.gz | awk '{print $1 * 512}')
         br_size=$(du  $file.br | awk '{print $1 * 512}')
@@ -27,5 +23,4 @@ if ! [[ "$ENVIRONMENT" =~ (^|-)dev($|-) ]]; then
     done
 fi
 
-
-cp -r $RAW_DIR $STATIC_DIR
+cp -r web/dist/raw web/dist/static

container-runtime/container-runtime.service

@@ -4,7 +4,6 @@ OnFailure=container-runtime-failure.service
 
 [Service]
 Type=simple
-Environment=RUST_LOG=startos=debug
 ExecStart=/usr/bin/node --experimental-detect-module --trace-warnings --unhandled-rejections=warn /usr/lib/startos/init/index.js
 Restart=no
 

container-runtime/deb-install.sh

@@ -2,10 +2,17 @@
 
 set -e
 
-apt-get update
-apt-get install -y curl rsync qemu-user-static nodejs
+mkdir -p /run/systemd/resolve
+echo "nameserver 8.8.8.8" > /run/systemd/resolve/stub-resolv.conf
+
+apt-get update
+apt-get install -y curl rsync qemu-user-static
+
+curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash
+source ~/.bashrc
+nvm install 22
+ln -s $(which node) /usr/bin/node
 
-sed -i '/\(^\|#\)DNSStubListener=/c\DNSStubListener=no' /etc/systemd/resolved.conf
 sed -i '/\(^\|#\)Storage=/c\Storage=persistent' /etc/systemd/journald.conf
 sed -i '/\(^\|#\)Compress=/c\Compress=yes' /etc/systemd/journald.conf
 sed -i '/\(^\|#\)SystemMaxUse=/c\SystemMaxUse=1G' /etc/systemd/journald.conf
@@ -13,4 +20,4 @@ sed -i '/\(^\|#\)ForwardToSyslog=/c\ForwardToSyslog=no' /etc/systemd/journald.co
 
 systemctl enable container-runtime.service
 
-echo "nameserver 10.0.3.1" > /etc/resolv.conf
+rm -rf /run/systemd

container-runtime/download-base-image.sh

@@ -3,7 +3,7 @@ cd "$(dirname "${BASH_SOURCE[0]}")"
 set -e
 
 DISTRO=debian
-VERSION=trixie
+VERSION=bookworm
 ARCH=${ARCH:-$(uname -m)}
 FLAVOR=default
 

container-runtime/mkcontainer.sh

@@ -0,0 +1,28 @@
+#!/bin/bash
+
+set -e
+
+IMAGE=$1
+
+if [ -z "$IMAGE" ]; then
+    >&2 echo "usage: $0 <image id>"
+    exit 1
+fi
+
+if ! [ -d "/media/images/$IMAGE" ]; then
+    >&2 echo "image does not exist"
+    exit 1
+fi
+
+container=$(mktemp -d)
+mkdir -p $container/rootfs $container/upper $container/work
+mount -t overlay -olowerdir=/media/images/$IMAGE,upperdir=$container/upper,workdir=$container/work overlay $container/rootfs
+
+rootfs=$container/rootfs
+
+for special in dev sys proc run; do
+    mkdir -p $rootfs/$special
+    mount --bind /$special $rootfs/$special
+done
+
+echo $rootfs

container-runtime/package-lock.json

@@ -38,7 +38,7 @@
     },
     "../sdk/dist": {
       "name": "@start9labs/start-sdk",
-      "version": "0.4.0-beta.45",
+      "version": "0.4.0-beta.36",
       "license": "MIT",
       "dependencies": {
         "@iarna/toml": "^3.0.0",
@@ -110,7 +110,6 @@
       "integrity": "sha512-l+lkXCHS6tQEc5oUpK28xBOZ6+HwaH7YwoYQbLFiYb4nS2/l1tKnZEtEWkD0GuiYdvArf9qBS0XlQGXzPMsNqQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@ampproject/remapping": "^2.2.0",
         "@babel/code-frame": "^7.26.2",
@@ -1201,7 +1200,6 @@
       "dev": true,
       "hasInstallScript": true,
       "license": "Apache-2.0",
-      "peer": true,
       "dependencies": {
         "@swc/counter": "^0.1.3",
         "@swc/types": "^0.1.17"
@@ -2145,7 +2143,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "caniuse-lite": "^1.0.30001688",
         "electron-to-chromium": "^1.5.73",
@@ -3993,7 +3990,6 @@
       "integrity": "sha512-NIy3oAFp9shda19hy4HK0HRTWKtPJmGdnvywu01nOqNC2vZg+Z+fvJDxpMQA88eb2I9EcafcdjYgsDthnYTvGw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/core": "^29.7.0",
         "@jest/types": "^29.6.3",
@@ -6560,7 +6556,6 @@
       "integrity": "sha512-84MVSjMEHP+FQRPy3pX9sTVV/INIex71s9TL2Gm5FG/WG1SqXeKyZ0k7/blY/4FdOzI12CBy1vGc4og/eus0fw==",
       "dev": true,
       "license": "Apache-2.0",
-      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"

container-runtime/rmcontainer.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+set -e
+
+rootfs=$1
+if [ -z "$rootfs" ]; then
+    >&2 echo "usage: $0 <container rootfs path>"
+    exit 1
+fi
+
+umount --recursive $rootfs
+rm -rf $rootfs/..

container-runtime/src/Adapters/EffectCreator.ts

@@ -289,7 +289,6 @@ export function makeEffects(context: EffectContext): Effects {
     getStatus(...[o]: Parameters<T.Effects["getStatus"]>) {
       return rpcRound("get-status", o) as ReturnType<T.Effects["getStatus"]>
     },
-    /// DEPRECATED
     setMainStatus(o: { status: "running" | "stopped" }): Promise<null> {
       return rpcRound("set-main-status", o) as ReturnType<
         T.Effects["setHealth"]

container-runtime/src/Adapters/RpcListener.ts

@@ -146,7 +146,6 @@ const handleRpc = (id: IdType, result: Promise<RpcResult>) =>
 
 const hasId = object({ id: idType }).test
 export class RpcListener {
-  shouldExit = false
   unixSocketServer = net.createServer(async (server) => {})
   private _system: System | undefined
   private callbacks: CallbackHolder | undefined
@@ -159,8 +158,6 @@ export class RpcListener {
 
     this.unixSocketServer.listen(SOCKET_PATH)
 
-    console.log("Listening on %s", SOCKET_PATH)
-
     this.unixSocketServer.on("connection", (s) => {
       let id: IdType = null
       const captureId = <X>(x: X) => {
@@ -211,11 +208,6 @@ export class RpcListener {
                   .catch(mapError)
                   .then(logData("response"))
                   .then(writeDataToSocket)
-                  .then((_) => {
-                    if (this.shouldExit) {
-                      process.exit(0)
-                    }
-                  })
                   .catch((e) => {
                     console.error(`Major error in socket handling: ${e}`)
                     console.debug(`Data in: ${a.toString()}`)
@@ -292,13 +284,10 @@ export class RpcListener {
         )
       })
       .when(stopType, async ({ id }) => {
+        this.callbacks?.removeChild("main")
         return handleRpc(
           id,
-          this.system.stop().then((result) => {
-            this.callbacks?.removeChild("main")
-
-            return { result }
-          }),
+          this.system.stop().then((result) => ({ result })),
         )
       })
       .when(exitType, async ({ id, params }) => {
@@ -319,7 +308,6 @@ export class RpcListener {
                 }),
                 target,
               )
-              this.shouldExit = true
             }
           })().then((result) => ({ result })),
         )

container-runtime/src/Adapters/Systems/SystemForEmbassy/DockerProcedureContainer.ts

@@ -118,7 +118,7 @@ export class DockerProcedureContainer extends Drop {
               subpath: volumeMount.path,
               readonly: volumeMount.readonly,
               volumeId: volumeMount["volume-id"],
-              idmap: [],
+              filetype: "directory",
             },
           })
         } else if (volumeMount.type === "backup") {

container-runtime/src/Adapters/Systems/SystemForEmbassy/MainLoop.ts

@@ -120,7 +120,6 @@ export class MainLoop {
             ? {
                 preferredExternalPort: lanConf.external,
                 alpn: { specified: ["http/1.1"] },
-                addXForwardedHeaders: false,
               }
             : null,
         })
@@ -134,7 +133,7 @@ export class MainLoop {
     delete this.mainEvent
     delete this.healthLoops
     await main?.daemon
-      .term()
+      .stop()
       .catch((e: unknown) => console.error(`Main loop error`, utils.asError(e)))
     this.effects.setMainStatus({ status: "stopped" })
     if (healthLoops) healthLoops.forEach((x) => clearInterval(x.interval))

container-runtime/src/Adapters/Systems/SystemForEmbassy/index.ts

@@ -287,6 +287,7 @@ function convertProperties(
   }
 }
 
+const DEFAULT_REGISTRY = "https://registry.start9.com"
 export class SystemForEmbassy implements System {
   private version: ExtendedVersion
   currentRunning: MainLoop | undefined
@@ -455,7 +456,6 @@ export class SystemForEmbassy implements System {
           addSsl = {
             preferredExternalPort: lanPortNum,
             alpn: { specified: [] },
-            addXForwardedHeaders: false,
           }
         }
         return [
@@ -888,6 +888,7 @@ export class SystemForEmbassy implements System {
     effects: Effects,
     timeoutMs: number | null,
   ): Promise<PropertiesReturn> {
+    // TODO BLU-J set the properties ever so often
     const setConfigValue = this.manifest.properties
     if (!setConfigValue) throw new Error("There is no properties")
     if (setConfigValue.type === "docker") {
@@ -1042,7 +1043,7 @@ export class SystemForEmbassy implements System {
         volumeId: "embassy",
         subpath: null,
         readonly: true,
-        idmap: [],
+        filetype: "directory",
       },
     })
     configFile
@@ -1190,7 +1191,7 @@ async function updateConfig(
             volumeId: "embassy",
             subpath: null,
             readonly: true,
-            idmap: [],
+            filetype: "directory",
           },
         })
         const remoteConfig = configFile
@@ -1240,11 +1241,11 @@ async function updateConfig(
             : catchFn(
                 () =>
                   (specValue.target === "lan-address"
-                    ? filled.addressInfo!.filter({ kind: "mdns" }) ||
-                      filled.addressInfo!.onion
-                    : filled.addressInfo!.onion ||
-                      filled.addressInfo!.filter({ kind: "mdns" })
-                  ).hostnames[0].hostname.value,
+                    ? filled.addressInfo!.localHostnames[0] ||
+                      filled.addressInfo!.onionHostnames[0]
+                    : filled.addressInfo!.onionHostnames[0] ||
+                      filled.addressInfo!.localHostnames[0]
+                  ).hostname.value,
               ) || ""
         mutConfigValue[key] = url
       }

container-runtime/src/Adapters/Systems/SystemForStartOs.ts

@@ -68,18 +68,22 @@ export class SystemForStartOs implements System {
     try {
       if (this.runningMain || this.starting) return
       this.starting = true
-      effects.constRetry = utils.once(() => {
-        console.debug(".const() triggered")
-        effects.restart()
-      })
+      effects.constRetry = utils.once(() => effects.restart())
       let mainOnTerm: () => Promise<void> | undefined
+      const started = async (onTerm: () => Promise<void>) => {
+        await effects.setMainStatus({ status: "running" })
+        mainOnTerm = onTerm
+        return null
+      }
       const daemons = await (
         await this.abi.main({
           effects,
+          started,
         })
       ).build()
       this.runningMain = {
         stop: async () => {
+          if (mainOnTerm) await mainOnTerm()
           await daemons.term()
         },
       }

container-runtime/src/index.ts

@@ -7,12 +7,6 @@ const getDependencies: AllGetDependencies = {
   system: getSystem,
 }
 
-for (let s of ["SIGTERM", "SIGINT", "SIGHUP"]) {
-  process.on(s, (s) => {
-    console.log(`Caught ${s}`)
-  })
-}
-
 new RpcListener(getDependencies)
 
 /**

container-runtime/update-image-local.sh

@@ -1,18 +0,0 @@
-#!/bin/bash
-
-cd "$(dirname "${BASH_SOURCE[0]}")/.."
-
-USE_TTY=
-if tty -s; then
-  USE_TTY="-it"
-fi
-
-DOCKER_PLATFORM=linux/${ARCH}
-case $ARCH in
-    x86_64)
-        DOCKER_PLATFORM=linux/amd64;;
-    aarch64)
-        DOCKER_PLATFORM=linux/arm64;;
-esac
-
-docker run --rm $USE_TTY --platform=$DOCKER_PLATFORM -eARCH --privileged -v "$(pwd):/root/start-os" start9/build-env /root/start-os/container-runtime/update-image.sh

container-runtime/update-image.sh

@@ -4,39 +4,56 @@ cd "$(dirname "${BASH_SOURCE[0]}")"
 
 set -e
 
-RUST_ARCH="$ARCH"
-if [ "$ARCH" = "riscv64" ]; then
-  RUST_ARCH="riscv64gc"
+if mountpoint -q tmp/combined; then sudo umount -R tmp/combined; fi
+if mountpoint -q tmp/lower; then sudo umount tmp/lower; fi
+sudo rm -rf tmp
+mkdir -p tmp/lower tmp/upper tmp/work tmp/combined
+if which squashfuse > /dev/null; then
+    sudo squashfuse debian.${ARCH}.squashfs tmp/lower
+else
+    sudo mount debian.${ARCH}.squashfs tmp/lower
+fi
+if which fuse-overlayfs > /dev/null; then
+    sudo fuse-overlayfs -olowerdir=tmp/lower,upperdir=tmp/upper,workdir=tmp/work overlay tmp/combined
+else
+    sudo mount -t overlay -olowerdir=tmp/lower,upperdir=tmp/upper,workdir=tmp/work overlay tmp/combined
 fi
 
-mount -t tmpfs tmpfs /tmp
-mkdir -p /tmp/lower /tmp/upper /tmp/work /tmp/combined
-mount -o loop debian.${ARCH}.squashfs /tmp/lower
-mount -t overlay -olowerdir=/tmp/lower,upperdir=/tmp/upper,workdir=/tmp/work overlay /tmp/combined
+QEMU=
+if [ "$ARCH" != "$(uname -m)" ]; then
+    QEMU=/usr/bin/qemu-${ARCH}-static
+    if ! which qemu-$ARCH-static > /dev/null; then
+        >&2 echo qemu-user-static is required for cross-platform builds
+        sudo umount tmp/combined
+        sudo umount tmp/lower
+        sudo rm -rf tmp
+        exit 1
+    fi
+    sudo cp $(which qemu-$ARCH-static) tmp/combined${QEMU}
+fi
 
-mkdir -p /tmp/combined/usr/lib/startos/
-rsync -a --copy-unsafe-links --info=progress2 dist/ /tmp/combined/usr/lib/startos/init/
-chown -R 0:0 /tmp/combined/usr/lib/startos/
-cp container-runtime.service /tmp/combined/lib/systemd/system/container-runtime.service
-chown 0:0 /tmp/combined/lib/systemd/system/container-runtime.service
-cp container-runtime-failure.service /tmp/combined/lib/systemd/system/container-runtime-failure.service
-chown 0:0 /tmp/combined/lib/systemd/system/container-runtime-failure.service
-cp ../core/target/${RUST_ARCH}-unknown-linux-musl/release/start-container /tmp/combined/usr/bin/start-container
-echo -e '#!/bin/bash\nexec start-container "$@"' > /tmp/combined/usr/bin/start-cli # TODO: remove
-chmod +x /tmp/combined/usr/bin/start-cli
-chown 0:0 /tmp/combined/usr/bin/start-container
-echo container-runtime | sha256sum | head -c 32 | cat - <(echo) > /tmp/combined/etc/machine-id
-rm -f /tmp/combined/etc/resolv.conf
-cp /etc/resolv.conf /tmp/combined/etc/resolv.conf
-for fs in proc sys dev; do
-    mount --bind /$fs /tmp/combined/$fs
-done
-cat deb-install.sh | chroot /tmp/combined /bin/bash
-for fs in proc sys dev; do
-    umount /tmp/combined/$fs
-done
-truncate -s 0 /tmp/combined/etc/machine-id
+sudo mkdir -p tmp/combined/usr/lib/startos/
+sudo rsync -a --copy-unsafe-links dist/ tmp/combined/usr/lib/startos/init/
+sudo chown -R 0:0 tmp/combined/usr/lib/startos/
+sudo cp container-runtime.service tmp/combined/lib/systemd/system/container-runtime.service
+sudo chown 0:0 tmp/combined/lib/systemd/system/container-runtime.service
+sudo cp container-runtime-failure.service tmp/combined/lib/systemd/system/container-runtime-failure.service
+sudo chown 0:0 tmp/combined/lib/systemd/system/container-runtime-failure.service
+sudo cp ../core/target/$ARCH-unknown-linux-musl/release/containerbox tmp/combined/usr/bin/start-container
+echo -e '#!/bin/bash\nexec start-container $@' | sudo tee tmp/combined/usr/bin/start-cli # TODO: remove
+sudo chmod +x tmp/combined/usr/bin/start-cli
+sudo chown 0:0 tmp/combined/usr/bin/start-container
+echo container-runtime | sha256sum | head -c 32 | cat - <(echo) | sudo tee tmp/combined/etc/machine-id
+cat deb-install.sh | sudo systemd-nspawn --console=pipe -D tmp/combined $QEMU /bin/bash
+sudo truncate -s 0 tmp/combined/etc/machine-id
+
+if [ -n "$QEMU" ]; then
+    sudo rm tmp/combined${QEMU}
+fi
 
 rm -f rootfs.${ARCH}.squashfs
 mkdir -p ../build/lib/container-runtime
-mksquashfs /tmp/combined rootfs.${ARCH}.squashfs
+sudo mksquashfs tmp/combined rootfs.${ARCH}.squashfs
+sudo umount tmp/combined
+sudo umount tmp/lower
+sudo rm -rf tmp

core/Cargo.toml

@@ -1,290 +1,3 @@
-[package]
-authors = ["Aiden McClelland <me@drbonez.dev>"]
-description = "The core of StartOS"
-documentation = "https://docs.rs/start-os"
-edition = "2024"
-keywords = [
-  "bitcoin",
-  "full-node",
-  "lightning",
-  "privacy",
-  "raspberry-pi",
-  "self-hosted",
-]
-license = "MIT"
-name = "start-os"
-readme = "README.md"
-repository = "https://github.com/Start9Labs/start-os"
-version = "0.4.0-alpha.16" # VERSION_BUMP
+[workspace]
 
-[lib]
-name = "startos"
-path = "src/lib.rs"
-
-[[bin]]
-name = "startbox"
-path = "src/main/startbox.rs"
-
-[[bin]]
-name = "start-cli"
-path = "src/main/start-cli.rs"
-
-[[bin]]
-name = "start-container"
-path = "src/main/start-container.rs"
-
-[[bin]]
-name = "registrybox"
-path = "src/main/registrybox.rs"
-
-[[bin]]
-name = "tunnelbox"
-path = "src/main/tunnelbox.rs"
-
-[features]
-arti = [
-  "arti-client",
-  "safelog",
-  "tor-cell",
-  "tor-hscrypto",
-  "tor-hsservice",
-  "tor-keymgr",
-  "tor-llcrypto",
-  "tor-proto",
-  "tor-rtcompat",
-]
-beta = []
-console = ["console-subscriber", "tokio/tracing"]
-default = []
-dev = []
-test = []
-unstable = ["backtrace-on-stack-overflow"]
-
-[dependencies]
-aes = { version = "0.7.5", features = ["ctr"] }
-arti-client = { version = "0.33", features = [
-  "compression",
-  "ephemeral-keystore",
-  "experimental-api",
-  "onion-service-client",
-  "onion-service-service",
-  "rustls",
-  "static",
-  "tokio",
-], default-features = false, git = "https://github.com/Start9Labs/arti.git", branch = "patch/disable-exit", optional = true }
-async-acme = { version = "0.6.0", git = "https://github.com/dr-bonez/async-acme.git", features = [
-  "use_rustls",
-  "use_tokio",
-] }
-async-compression = { version = "0.4.32", features = [
-  "brotli",
-  "gzip",
-  "tokio",
-  "zstd",
-] }
-async-stream = "0.3.5"
-async-trait = "0.1.74"
-axum = { version = "0.8.4", features = ["ws", "http2"] }
-backtrace-on-stack-overflow = { version = "0.3.0", optional = true }
-base32 = "0.5.0"
-base64 = "0.22.1"
-base64ct = "1.6.0"
-basic-cookies = "0.1.4"
-blake3 = { version = "1.5.0", features = ["mmap", "rayon"] }
-bytes = "1"
-chrono = { version = "0.4.31", features = ["serde"] }
-clap = { version = "4.4.12", features = ["string"] }
-color-eyre = "0.6.2"
-console = "0.16.2"
-console-subscriber = { version = "0.5.0", optional = true }
-const_format = "0.2.34"
-cookie = "0.18.0"
-cookie_store = "0.22.0"
-curve25519-dalek = "4.1.3"
-der = { version = "0.7.9", features = ["derive", "pem"] }
-digest = "0.10.7"
-divrem = "1.0.0"
-dns-lookup = "3.0.1"
-ed25519 = { version = "2.2.3", features = ["alloc", "pem", "pkcs8"] }
-ed25519-dalek = { version = "2.2.0", features = [
-  "digest",
-  "hazmat",
-  "pkcs8",
-  "rand_core",
-  "serde",
-  "zeroize",
-] }
-ed25519-dalek-v1 = { package = "ed25519-dalek", version = "1" }
-exver = { version = "0.2.0", git = "https://github.com/Start9Labs/exver-rs.git", features = [
-  "serde",
-] }
-fd-lock-rs = "0.1.4"
-form_urlencoded = "1.2.1"
-futures = "0.3.28"
-gpt = "4.1.0"
-hex = "0.4.3"
-hickory-server = { version = "0.25.2", features = ["resolver"] }
-hmac = "0.12.1"
-http = "1.0.0"
-http-body-util = "0.1"
-hyper = { version = "1.5", features = ["http1", "http2", "server"] }
-hyper-util = { version = "0.1.10", features = [
-  "http1",
-  "http2",
-  "server",
-  "server-auto",
-  "server-graceful",
-  "service",
-  "tokio",
-] }
-id-pool = { version = "0.2.2", default-features = false, features = [
-  "serde",
-  "u16",
-] }
-iddqd = "0.3.14"
-imbl = { version = "6", features = ["serde", "small-chunks"] }
-imbl-value = { version = "0.4.3", features = ["ts-rs"] }
-include_dir = { version = "0.7.3", features = ["metadata"] }
-indexmap = { version = "2.0.2", features = ["serde"] }
-indicatif = { version = "0.18.3", features = ["tokio"] }
-inotify = "0.11.0"
-integer-encoding = { version = "4.0.0", features = ["tokio_async"] }
-ipnet = { version = "2.8.0", features = ["serde"] }
-isocountry = "0.3.2"
-itertools = "0.14.0"
-jaq-core = "0.10.1"
-jaq-std = "0.10.0"
-josekit = "0.10.3"
-jsonpath_lib = { git = "https://github.com/Start9Labs/jsonpath.git" }
-lazy_async_pool = "0.3.3"
-lazy_format = "2.0"
-lazy_static = "1.4.0"
-lettre = { version = "0.11.18", default-features = false, features = [
-  "aws-lc-rs",
-  "builder",
-  "hostname",
-  "pool",
-  "rustls-platform-verifier",
-  "smtp-transport",
-  "tokio1-rustls",
-] }
-libc = "0.2.149"
-log = "0.4.20"
-mbrman = "0.6.0"
-miette = { version = "7.6.0", features = ["fancy"] }
-mio = "1"
-new_mime_guess = "4"
-nix = { version = "0.30.1", features = [
-  "fs",
-  "mount",
-  "net",
-  "process",
-  "sched",
-  "signal",
-  "user",
-] }
-nom = "8.0.0"
-num = "0.4.1"
-num_cpus = "1.16.0"
-num_enum = "0.7.0"
-once_cell = "1.19.0"
-openssh-keys = "0.6.2"
-openssl = { version = "0.10.57", features = ["vendored"] }
-p256 = { version = "0.13.2", features = ["pem"] }
-patch-db = { version = "*", path = "../patch-db/patch-db", features = [
-  "trace",
-] }
-pbkdf2 = "0.12.2"
-pin-project = "1.1.3"
-pkcs8 = { version = "0.10.2", features = ["std"] }
-prettytable-rs = "0.10.0"
-proptest = "1.3.1"
-proptest-derive = "0.7.0"
-qrcode = "0.14.1"
-r3bl_tui = "0.7.6"
-rand = "0.9.2"
-regex = "1.10.2"
-reqwest = { version = "0.12.25", features = [
-  "json",
-  "socks",
-  "stream",
-  "http2",
-] }
-reqwest_cookie_store = "0.9.0"
-rpassword = "7.2.0"
-rust-argon2 = "3.0.0"
-rpc-toolkit = { git = "https://github.com/Start9Labs/rpc-toolkit.git" }
-safelog = { version = "0.4.8", git = "https://github.com/Start9Labs/arti.git", branch = "patch/disable-exit", optional = true }
-semver = { version = "1.0.20", features = ["serde"] }
-serde = { version = "1.0", features = ["derive", "rc"] }
-serde_cbor = { package = "ciborium", version = "0.2.1" }
-serde_json = "1.0"
-serde_toml = { package = "toml", version = "0.9.9+spec-1.0.0" }
-serde_yaml = { package = "serde_yml", version = "0.0.12" }
-sha-crypt = "0.5.0"
-sha2 = "0.10.2"
-signal-hook = "0.3.17"
-socket2 = { version = "0.6.0", features = ["all"] }
-socks5-impl = { version = "0.7.2", features = ["client", "server"] }
-sqlx = { version = "0.8.6", features = [
-  "postgres",
-  "runtime-tokio-rustls",
-], default-features = false }
-sscanf = "0.4.1"
-ssh-key = { version = "0.6.2", features = ["ed25519"] }
-tar = "0.4.40"
-termion = "4.0.5"
-textwrap = "0.16.1"
-thiserror = "2.0.12"
-tokio = { version = "1.38.1", features = ["full"] }
-tokio-rustls = "0.26.4"
-tokio-stream = { version = "0.1.14", features = ["io-util", "net", "sync"] }
-tokio-tar = { git = "https://github.com/dr-bonez/tokio-tar.git" }
-tokio-tungstenite = { version = "0.26.2", features = ["native-tls", "url"] }
-tokio-util = { version = "0.7.9", features = ["io"] }
-tor-cell = { version = "0.33", git = "https://github.com/Start9Labs/arti.git", branch = "patch/disable-exit", optional = true }
-tor-hscrypto = { version = "0.33", features = [
-  "full",
-], git = "https://github.com/Start9Labs/arti.git", branch = "patch/disable-exit", optional = true }
-tor-hsservice = { version = "0.33", git = "https://github.com/Start9Labs/arti.git", branch = "patch/disable-exit", optional = true }
-tor-keymgr = { version = "0.33", features = [
-  "ephemeral-keystore",
-], git = "https://github.com/Start9Labs/arti.git", branch = "patch/disable-exit", optional = true }
-tor-llcrypto = { version = "0.33", features = [
-  "full",
-], git = "https://github.com/Start9Labs/arti.git", branch = "patch/disable-exit", optional = true }
-tor-proto = { version = "0.33", git = "https://github.com/Start9Labs/arti.git", branch = "patch/disable-exit", optional = true }
-tor-rtcompat = { version = "0.33", features = [
-  "rustls",
-  "tokio",
-], git = "https://github.com/Start9Labs/arti.git", branch = "patch/disable-exit", optional = true }
-torut = "0.2.1"
-tower-service = "0.3.3"
-tracing = "0.1.39"
-tracing-error = "0.2.0"
-tracing-journald = "0.3.0"
-tracing-subscriber = { version = "0.3.17", features = ["env-filter"] }
-ts-rs = "9.0.1"
-typed-builder = "0.23.2"
-url = { version = "2.4.1", features = ["serde"] }
-uuid = { version = "1.4.1", features = ["v4"] }
-visit-rs = "0.1.1"
-x25519-dalek = { version = "2.0.1", features = ["static_secrets"] }
-zbus = "5.1.1"
-hashing-serializer = "0.1.1"
-
-[target.'cfg(target_os = "linux")'.dependencies]
-procfs = "0.18.0"
-pty-process = "0.5.1"
-
-[profile.test]
-opt-level = 3
-
-[profile.dev]
-opt-level = 3
-
-[profile.dev.package.backtrace]
-opt-level = 3
-
-[profile.dev.package.sqlx-macros]
-opt-level = 3
+members = ["helpers", "models", "startos"]

core/Cross.toml

@@ -1,2 +0,0 @@
-[build]
-pre-build = ["apt-get update && apt-get install -y rsync"]

core/build-cli.sh

@@ -0,0 +1,54 @@
+#!/bin/bash
+
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+set -ea
+shopt -s expand_aliases
+
+if [ -z "$ARCH" ]; then
+	ARCH=$(uname -m)
+fi
+if [ "$ARCH" = "arm64" ]; then
+  ARCH="aarch64"
+fi
+
+if [ -z "$KERNEL_NAME" ]; then
+	KERNEL_NAME=$(uname -s)
+fi
+
+if [ -z "$TARGET" ]; then
+	if [ "$KERNEL_NAME" = "Linux" ]; then
+		TARGET="$ARCH-unknown-linux-musl"
+	elif [ "$KERNEL_NAME" = "Darwin" ]; then
+		TARGET="$ARCH-apple-darwin"
+	else
+		>&2 echo "unknown kernel $KERNEL_NAME"
+		exit 1
+	fi
+fi
+
+USE_TTY=
+if tty -s; then
+	USE_TTY="-it"
+fi
+
+cd ..
+FEATURES="$(echo $ENVIRONMENT | sed 's/-/,/g')"
+RUSTFLAGS=""
+
+if [[ "${ENVIRONMENT}" =~ (^|-)unstable($|-) ]]; then
+	RUSTFLAGS="--cfg tokio_unstable"
+fi
+
+if which zig > /dev/null && [ "$ENFORCE_USE_DOCKER" != 1 ]; do
+	echo "FEATURES=\"$FEATURES\""
+	echo "RUSTFLAGS=\"$RUSTFLAGS\""
+	RUSTFLAGS=$RUSTFLAGS sh -c "cd core && cargo zigbuild --release --no-default-features --features cli,$FEATURES --locked --bin start-cli --target=$TARGET"
+else
+	alias 'rust-zig-builder'='docker run $USE_TTY --rm -e "RUSTFLAGS=$RUSTFLAGS" -v "$HOME/.cargo/registry":/root/.cargo/registry -v "$HOME/.cargo/git":/root/.cargo/git -v "$(pwd)":/home/rust/src -w /home/rust/src -P messense/cargo-zigbuild'
+	RUSTFLAGS=$RUSTFLAGS rust-zig-builder sh -c "cd core && cargo zigbuild --release --no-default-features --features cli,$FEATURES --locked --bin start-cli --target=$TARGET"
+
+	if [ "$(ls -nd core/target/$TARGET/release/start-cli | awk '{ print $3 }')" != "$UID" ]; then
+		rust-zig-builder sh -c "cd core && chown -R $UID:$UID target && chown -R $UID:$UID /root/.cargo"
+	fi
+fi

core/build-containerbox.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+set -ea
+shopt -s expand_aliases
+
+if [ -z "$ARCH" ]; then
+	ARCH=$(uname -m)
+fi
+
+if [ "$ARCH" = "arm64" ]; then
+  ARCH="aarch64"
+fi
+
+USE_TTY=
+if tty -s; then
+	USE_TTY="-it"
+fi
+
+cd ..
+FEATURES="$(echo $ENVIRONMENT | sed 's/-/,/g')"
+RUSTFLAGS=""
+
+if [[ "${ENVIRONMENT}" =~ (^|-)unstable($|-) ]]; then
+	RUSTFLAGS="--cfg tokio_unstable"
+fi
+
+source ./core/builder-alias.sh
+
+echo "FEATURES=\"$FEATURES\""
+echo "RUSTFLAGS=\"$RUSTFLAGS\""
+rust-musl-builder sh -c "cd core && cargo build --release --no-default-features --features cli-container,$FEATURES --locked --bin containerbox --target=$ARCH-unknown-linux-musl"
+if [ "$(ls -nd core/target/$ARCH-unknown-linux-musl/release/containerbox | awk '{ print $3 }')" != "$UID" ]; then
+	rust-musl-builder sh -c "cd core && chown -R $UID:$UID target && chown -R $UID:$UID /root/.cargo"
+fi

core/build-registrybox.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+set -ea
+shopt -s expand_aliases
+
+if [ -z "$ARCH" ]; then
+	ARCH=$(uname -m)
+fi
+
+if [ "$ARCH" = "arm64" ]; then
+  ARCH="aarch64"
+fi
+
+USE_TTY=
+if tty -s; then
+	USE_TTY="-it"
+fi
+
+cd ..
+FEATURES="$(echo $ENVIRONMENT | sed 's/-/,/g')"
+RUSTFLAGS=""
+
+if [[ "${ENVIRONMENT}" =~ (^|-)unstable($|-) ]]; then
+	RUSTFLAGS="--cfg tokio_unstable"
+fi
+
+source ./core/builder-alias.sh
+
+echo "FEATURES=\"$FEATURES\""
+echo "RUSTFLAGS=\"$RUSTFLAGS\""
+rust-musl-builder sh -c "cd core && cargo build --release --no-default-features --features cli-registry,registry,$FEATURES --locked --bin registrybox --target=$ARCH-unknown-linux-musl"
+if [ "$(ls -nd core/target/$ARCH-unknown-linux-musl/release/registrybox | awk '{ print $3 }')" != "$UID" ]; then
+	rust-musl-builder sh -c "cd core && chown -R $UID:$UID target && chown -R $UID:$UID /root/.cargo"
+fi

core/build-startbox.sh

@@ -0,0 +1,41 @@
+#!/bin/bash
+
+PROFILE=${PROFILE:-release}
+if [ "${PROFILE}" = "release" ]; then
+	BUILD_FLAGS="--release"
+fi
+
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+set -ea
+shopt -s expand_aliases
+
+if [ -z "$ARCH" ]; then
+	ARCH=$(uname -m)
+fi
+
+if [ "$ARCH" = "arm64" ]; then
+  ARCH="aarch64"
+fi
+
+USE_TTY=
+if tty -s; then
+	USE_TTY="-it"
+fi
+
+cd ..
+FEATURES="$(echo $ENVIRONMENT | sed 's/-/,/g')"
+RUSTFLAGS=""
+
+if [[ "${ENVIRONMENT}" =~ (^|-)unstable($|-) ]]; then
+	RUSTFLAGS="--cfg tokio_unstable"
+fi
+
+source ./core/builder-alias.sh
+
+echo "FEATURES=\"$FEATURES\""
+echo "RUSTFLAGS=\"$RUSTFLAGS\""
+rust-musl-builder sh -c "cd core && cargo build $BUILD_FLAGS --no-default-features --features cli,startd,$FEATURES --locked --bin startbox --target=$ARCH-unknown-linux-musl"
+if [ "$(ls -nd core/target/$ARCH-unknown-linux-musl/${PROFILE}/startbox | awk '{ print $3 }')" != "$UID" ]; then
+	rust-musl-builder sh -c "cd core && chown -R $UID:$UID target && chown -R $UID:$UID /root/.cargo"
+fi

core/build-ts.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+set -ea
+shopt -s expand_aliases
+
+if [ -z "$ARCH" ]; then
+	ARCH=$(uname -m)
+fi
+
+if [ "$ARCH" = "arm64" ]; then
+  ARCH="aarch64"
+fi
+
+USE_TTY=
+if tty -s; then
+	USE_TTY="-it"
+fi
+
+cd ..
+FEATURES="$(echo $ENVIRONMENT | sed 's/-/,/g')"
+RUSTFLAGS=""
+
+if [[ "${ENVIRONMENT}" =~ (^|-)unstable($|-) ]]; then
+	RUSTFLAGS="--cfg tokio_unstable"
+fi
+
+source ./core/builder-alias.sh
+
+echo "FEATURES=\"$FEATURES\""
+echo "RUSTFLAGS=\"$RUSTFLAGS\""
+rust-musl-builder sh -c "cd core && cargo test --release --features=test,$FEATURES 'export_bindings_' && chown \$UID:\$UID startos/bindings"
+if [ "$(ls -nd core/startos/bindings | awk '{ print $3 }')" != "$UID" ]; then
+	rust-musl-builder sh -c "cd core && chown -R $UID:$UID startos/bindings && chown -R $UID:$UID target && chown -R $UID:$UID /root/.cargo"
+fi

core/build-tunnelbox.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+set -ea
+shopt -s expand_aliases
+
+if [ -z "$ARCH" ]; then
+	ARCH=$(uname -m)
+fi
+
+if [ "$ARCH" = "arm64" ]; then
+  ARCH="aarch64"
+fi
+
+USE_TTY=
+if tty -s; then
+	USE_TTY="-it"
+fi
+
+cd ..
+FEATURES="$(echo $ENVIRONMENT | sed 's/-/,/g')"
+RUSTFLAGS=""
+
+if [[ "${ENVIRONMENT}" =~ (^|-)unstable($|-) ]]; then
+	RUSTFLAGS="--cfg tokio_unstable"
+fi
+
+source ./core/builder-alias.sh
+
+echo "FEATURES=\"$FEATURES\""
+echo "RUSTFLAGS=\"$RUSTFLAGS\""
+rust-musl-builder sh -c "cd core && cargo build --release --no-default-features --features cli-tunnel,tunnel,$FEATURES --locked --bin tunnelbox --target=$ARCH-unknown-linux-musl"
+if [ "$(ls -nd core/target/$ARCH-unknown-linux-musl/release/tunnelbox | awk '{ print $3 }')" != "$UID" ]; then
+	rust-musl-builder sh -c "cd core && chown -R $UID:$UID target && chown -R $UID:$UID /root/.cargo"
+fi

core/build/build-cli.sh

@@ -1,79 +0,0 @@
-#!/bin/bash
-
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
-source ./builder-alias.sh
-
-set -ea
-
-INSTALL=false
-while [[ $# -gt 0 ]]; do
-  case $1 in
-    --install)
-      INSTALL=true
-      shift
-      ;;
-    *)
-      >&2 echo "Unknown option: $1"
-      exit 1
-      ;;
-  esac
-done
-
-shopt -s expand_aliases
-
-PROFILE=${PROFILE:-release}
-if [ "${PROFILE}" = "release" ]; then
-	BUILD_FLAGS="--release"
-else
-  if [ "$PROFILE" != "debug"]; then
-    >&2 echo "Unknown profile $PROFILE: falling back to debug..."
-    PROFILE=debug
-  fi
-fi
-
-if [ -z "${ARCH:-}" ]; then
-  ARCH=$(uname -m)
-fi
-
-if [ "$ARCH" = "arm64" ]; then
-  ARCH="aarch64"
-fi
-
-RUST_ARCH="$ARCH"
-if [ "$ARCH" = "riscv64" ]; then
-  RUST_ARCH="riscv64gc"
-fi
-
-if [ -z "${KERNEL_NAME:-}" ]; then
-  KERNEL_NAME=$(uname -s)
-fi
-
-if [ -z "${TARGET:-}" ]; then
-  if [ "$KERNEL_NAME" = "Linux" ]; then
-    TARGET="$RUST_ARCH-unknown-linux-musl"
-  elif [ "$KERNEL_NAME" = "Darwin" ]; then
-    TARGET="$RUST_ARCH-apple-darwin"
-  else
-    >&2 echo "unknown kernel $KERNEL_NAME"
-    exit 1
-  fi
-fi
-
-cd ../..
-FEATURES="$(echo "${ENVIRONMENT:-}" | sed 's/-/,/g')"
-RUSTFLAGS=""
-if [[ "${ENVIRONMENT:-}" =~ (^|-)console($|-) ]]; then
-  RUSTFLAGS="--cfg tokio_unstable"
-fi
-
-echo "FEATURES=\"$FEATURES\""
-echo "RUSTFLAGS=\"$RUSTFLAGS\""
-rust-zig-builder cargo zigbuild --manifest-path=./core/Cargo.toml $BUILD_FLAGS --features=$FEATURES --locked --bin start-cli --target=$TARGET
-if [ "$(ls -nd "core/target/$TARGET/$PROFILE/start-cli" | awk '{ print $3 }')" != "$UID" ]; then
-  rust-zig-builder sh -c "cd core && chown -R $UID:$UID target && chown -R $UID:$UID  /usr/local/cargo"
-fi
-
-if [ "$INSTALL" = "true" ]; then
-  cp "core/target/$TARGET/$PROFILE/start-cli" ~/.cargo/bin/start-cli
-fi

core/build/build-registrybox.sh

@@ -1,46 +0,0 @@
-#!/bin/bash
-
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
-source ./builder-alias.sh
-
-set -ea
-shopt -s expand_aliases
-
-PROFILE=${PROFILE:-release}
-if [ "${PROFILE}" = "release" ]; then
-	BUILD_FLAGS="--release"
-else
-  if [ "$PROFILE" != "debug"]; then
-    >&2 echo "Unknown profile $PROFILE: falling back to debug..."
-    PROFILE=debug
-  fi
-fi
-
-if [ -z "$ARCH" ]; then
-	ARCH=$(uname -m)
-fi
-
-if [ "$ARCH" = "arm64" ]; then
-  ARCH="aarch64"
-fi
-
-RUST_ARCH="$ARCH"
-if [ "$ARCH" = "riscv64" ]; then
-  RUST_ARCH="riscv64gc"
-fi
-
-cd ../..
-FEATURES="$(echo $ENVIRONMENT | sed 's/-/,/g')"
-RUSTFLAGS=""
-
-if [[ "${ENVIRONMENT}" =~ (^|-)console($|-) ]]; then
-	RUSTFLAGS="--cfg tokio_unstable"
-fi
-
-echo "FEATURES=\"$FEATURES\""
-echo "RUSTFLAGS=\"$RUSTFLAGS\""
-rust-zig-builder cargo zigbuild --manifest-path=./core/Cargo.toml $BUILD_FLAGS --features=$FEATURES --locked --bin registrybox --target=$RUST_ARCH-unknown-linux-musl
-if [ "$(ls -nd "core/target/$RUST_ARCH-unknown-linux-musl/$PROFILE/registrybox" | awk '{ print $3 }')" != "$UID" ]; then
-  rust-zig-builder sh -c "chown -R $UID:$UID core/target && chown -R $UID:$UID  /usr/local/cargo"
-fi

core/build/build-start-container.sh

@@ -1,46 +0,0 @@
-#!/bin/bash
-
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
-source ./builder-alias.sh
-
-set -ea
-shopt -s expand_aliases
-
-PROFILE=${PROFILE:-release}
-if [ "${PROFILE}" = "release" ]; then
-	BUILD_FLAGS="--release"
-else
-  if [ "$PROFILE" != "debug"]; then
-    >&2 echo "Unknown profile $PROFILE: falling back to debug..."
-    PROFILE=debug
-  fi
-fi
-
-if [ -z "$ARCH" ]; then
-	ARCH=$(uname -m)
-fi
-
-if [ "$ARCH" = "arm64" ]; then
-  ARCH="aarch64"
-fi
-
-RUST_ARCH="$ARCH"
-if [ "$ARCH" = "riscv64" ]; then
-  RUST_ARCH="riscv64gc"
-fi
-
-cd ../..
-FEATURES="$(echo $ENVIRONMENT | sed 's/-/,/g')"
-RUSTFLAGS=""
-
-if [[ "${ENVIRONMENT}" =~ (^|-)console($|-) ]]; then
-	RUSTFLAGS="--cfg tokio_unstable"
-fi
-
-echo "FEATURES=\"$FEATURES\""
-echo "RUSTFLAGS=\"$RUSTFLAGS\""
-rust-zig-builder cargo zigbuild --manifest-path=./core/Cargo.toml $BUILD_FLAGS --features=$FEATURES --locked --bin start-container --target=$RUST_ARCH-unknown-linux-musl
-if [ "$(ls -nd "core/target/$RUST_ARCH-unknown-linux-musl/$PROFILE/start-container" | awk '{ print $3 }')" != "$UID" ]; then
-  rust-zig-builder sh -c "chown -R $UID:$UID core/target && chown -R $UID:$UID /usr/local/cargo"
-fi

core/build/build-startbox.sh

@@ -1,46 +0,0 @@
-#!/bin/bash
-
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
-source ./builder-alias.sh
-
-set -ea
-shopt -s expand_aliases
-
-PROFILE=${PROFILE:-release}
-if [ "${PROFILE}" = "release" ]; then
-	BUILD_FLAGS="--release"
-else
-  if [ "$PROFILE" != "debug"]; then
-    >&2 echo "Unknown profile $PROFILE: falling back to debug..."
-    PROFILE=debug
-  fi
-fi
-
-if [ -z "$ARCH" ]; then
-	ARCH=$(uname -m)
-fi
-
-if [ "$ARCH" = "arm64" ]; then
-  ARCH="aarch64"
-fi
-
-RUST_ARCH="$ARCH"
-if [ "$ARCH" = "riscv64" ]; then
-  RUST_ARCH="riscv64gc"
-fi
-
-cd ../..
-FEATURES="$(echo $ENVIRONMENT | sed 's/-/,/g')"
-RUSTFLAGS=""
-
-if [[ "${ENVIRONMENT}" =~ (^|-)console($|-) ]]; then
-	RUSTFLAGS="--cfg tokio_unstable"
-fi
-
-echo "FEATURES=\"$FEATURES\""
-echo "RUSTFLAGS=\"$RUSTFLAGS\""
-rust-zig-builder cargo zigbuild --manifest-path=./core/Cargo.toml $BUILD_FLAGS --features=$FEATURES --locked --bin startbox --target=$RUST_ARCH-unknown-linux-musl
-if [ "$(ls -nd "core/target/$RUST_ARCH-unknown-linux-musl/$PROFILE/startbox" | awk '{ print $3 }')" != "$UID" ]; then
-  rust-zig-builder sh -c "chown -R $UID:$UID core/target && chown -R $UID:$UID  /usr/local/cargo"
-fi

core/build/build-ts.sh

@@ -1,44 +0,0 @@
-#!/bin/bash
-
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
-source ./builder-alias.sh
-
-set -ea
-shopt -s expand_aliases
-
-PROFILE=${PROFILE:-release}
-if [ "${PROFILE}" = "release" ]; then
-	BUILD_FLAGS="--release"
-else
-  if [ "$PROFILE" != "debug"]; then
-    >&2 echo "Unknown profile $PROFILE: falling back to debug..."
-    PROFILE=debug
-  fi
-fi
-
-if [ -z "$ARCH" ]; then
-	ARCH=$(uname -m)
-fi
-
-if [ "$ARCH" = "arm64" ]; then
-	ARCH="aarch64"
-fi
-
-RUST_ARCH="$ARCH"
-if [ "$ARCH" = "riscv64" ]; then
-	RUST_ARCH="riscv64gc"
-fi
-
-cd ../..
-FEATURES="$(echo $ENVIRONMENT | sed 's/-/,/g')"
-RUSTFLAGS=""
-if [[ "${ENVIRONMENT}" =~ (^|-)console($|-) ]]; then
-	RUSTFLAGS="--cfg tokio_unstable"
-fi
-echo "FEATURES=\"$FEATURES\""
-echo "RUSTFLAGS=\"$RUSTFLAGS\""
-rust-zig-builder cargo test --manifest-path=./core/Cargo.toml $BUILD_FLAGS --features test,$FEATURES --locked 'export_bindings_'
-if [ "$(ls -nd "core/bindings" | awk '{ print $3 }')" != "$UID" ]; then
-  rust-zig-builder sh -c "chown -R $UID:$UID core/target && chown -R $UID:$UID core/bindings && chown -R $UID:$UID  /usr/local/cargo"
-fi

core/build/build-tunnelbox.sh

@@ -1,46 +0,0 @@
-#!/bin/bash
-
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
-source ./builder-alias.sh
-
-set -ea
-shopt -s expand_aliases
-
-PROFILE=${PROFILE:-release}
-if [ "${PROFILE}" = "release" ]; then
-	BUILD_FLAGS="--release"
-else
-  if [ "$PROFILE" != "debug"]; then
-    >&2 echo "Unknown profile $PROFILE: falling back to debug..."
-    PROFILE=debug
-  fi
-fi
-
-if [ -z "$ARCH" ]; then
-	ARCH=$(uname -m)
-fi
-
-if [ "$ARCH" = "arm64" ]; then
-  ARCH="aarch64"
-fi
-
-RUST_ARCH="$ARCH"
-if [ "$ARCH" = "riscv64" ]; then
-  RUST_ARCH="riscv64gc"
-fi
-
-cd ../..
-FEATURES="$(echo $ENVIRONMENT | sed 's/-/,/g')"
-RUSTFLAGS=""
-
-if [[ "${ENVIRONMENT}" =~ (^|-)console($|-) ]]; then
-	RUSTFLAGS="--cfg tokio_unstable"
-fi
-
-echo "FEATURES=\"$FEATURES\""
-echo "RUSTFLAGS=\"$RUSTFLAGS\""
-rust-zig-builder cargo zigbuild --manifest-path=./core/Cargo.toml $BUILD_FLAGS --features=$FEATURES --locked --bin tunnelbox --target=$RUST_ARCH-unknown-linux-musl
-if [ "$(ls -nd "core/target/$RUST_ARCH-unknown-linux-musl/$PROFILE/tunnelbox" | awk '{ print $3 }')" != "$UID" ]; then
-  rust-zig-builder sh -c "chown -R $UID:$UID core/target && chown -R $UID:$UID  /usr/local/cargo"
-fi

core/build/builder-alias.sh

@@ -1,8 +0,0 @@
-#!/bin/bash
-
-USE_TTY=
-if tty -s; then
-  USE_TTY="-it"
-fi
-
-alias 'rust-zig-builder'='docker run '"$USE_TTY"' --rm -e "RUSTFLAGS=$RUSTFLAGS" -e "PKG_CONFIG_SYSROOT_DIR=/opt/sysroot/$ARCH" -e PKG_CONFIG_PATH="" -e PKG_CONFIG_LIBDIR="/opt/sysroot/$ARCH/usr/lib/pkgconfig" -e "AWS_LC_SYS_CMAKE_TOOLCHAIN_FILE_riscv64gc_unknown_linux_musl=/root/cmake-overrides/toolchain-riscv64-musl-clang.cmake" -e SCCACHE_GHA_ENABLED -e SCCACHE_GHA_VERSION -e ACTIONS_RESULTS_URL -e ACTIONS_RUNTIME_TOKEN -v "$HOME/.cargo/registry":/usr/local/cargo/registry -v "$HOME/.cargo/git":/usr/local/cargo/git -v "$HOME/.cache/sccache":/root/.cache/sccache -v "$HOME/.cache/cargo-zigbuild:/root/.cache/cargo-zigbuild" -v "$(pwd)":/workdir -w /workdir start9/cargo-zigbuild'

core/builder-alias.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+
+alias 'rust-musl-builder'='docker run $USE_TTY --rm -e "RUSTFLAGS=$RUSTFLAGS" -e SCCACHE_GHA_ENABLED -e SCCACHE_GHA_VERSION -e ACTIONS_RESULTS_URL -e ACTIONS_RUNTIME_TOKEN -v "$HOME/.cargo/registry":/root/.cargo/registry -v "$HOME/.cargo/git":/root/.cargo/git -v "$HOME/.cache/sccache":/root/.cache/sccache -v "$(pwd)":/home/rust/src -w /home/rust/src -P start9/rust-musl-cross:$ARCH-musl'

core/helpers/Cargo.toml

@@ -0,0 +1,19 @@
+[package]
+name = "helpers"
+version = "0.1.0"
+edition = "2021"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+color-eyre = "0.6.2"
+futures = "0.3.28"
+lazy_async_pool = "0.3.3"
+models = { path = "../models" }
+pin-project = "1.1.3"
+rpc-toolkit = { git = "https://github.com/Start9Labs/rpc-toolkit.git", branch = "master" }
+serde = { version = "1.0", features = ["derive", "rc"] }
+serde_json = "1.0"
+tokio = { version = "1", features = ["full"] }
+tokio-stream = { version = "0.1.14", features = ["io-util", "sync"] }
+tracing = "0.1.39"

core/helpers/src/byte_replacement_reader.rs

@@ -0,0 +1,31 @@
+use std::task::Poll;
+
+use tokio::io::{AsyncRead, ReadBuf};
+
+#[pin_project::pin_project]
+pub struct ByteReplacementReader<R> {
+    pub replace: u8,
+    pub with: u8,
+    #[pin]
+    pub inner: R,
+}
+impl<R: AsyncRead> AsyncRead for ByteReplacementReader<R> {
+    fn poll_read(
+        self: std::pin::Pin<&mut Self>,
+        cx: &mut std::task::Context<'_>,
+        buf: &mut ReadBuf<'_>,
+    ) -> std::task::Poll<std::io::Result<()>> {
+        let this = self.project();
+        match this.inner.poll_read(cx, buf) {
+            Poll::Ready(Ok(())) => {
+                for idx in 0..buf.filled().len() {
+                    if buf.filled()[idx] == *this.replace {
+                        buf.filled_mut()[idx] = *this.with;
+                    }
+                }
+                Poll::Ready(Ok(()))
+            }
+            a => a,
+        }
+    }
+}

core/helpers/src/lib.rs

@@ -0,0 +1,262 @@
+use std::future::Future;
+use std::ops::{Deref, DerefMut};
+use std::path::{Path, PathBuf};
+use std::time::Duration;
+
+use color_eyre::eyre::{eyre, Context, Error};
+use futures::future::BoxFuture;
+use futures::FutureExt;
+use models::ResultExt;
+use tokio::fs::File;
+use tokio::sync::oneshot;
+use tokio::task::{JoinError, JoinHandle, LocalSet};
+
+mod byte_replacement_reader;
+mod rsync;
+mod script_dir;
+pub use byte_replacement_reader::*;
+pub use rsync::*;
+pub use script_dir::*;
+
+pub fn const_true() -> bool {
+    true
+}
+
+pub fn to_tmp_path(path: impl AsRef<Path>) -> Result<PathBuf, Error> {
+    let path = path.as_ref();
+    if let (Some(parent), Some(file_name)) =
+        (path.parent(), path.file_name().and_then(|f| f.to_str()))
+    {
+        Ok(parent.join(format!(".{}.tmp", file_name)))
+    } else {
+        Err(eyre!("invalid path: {}", path.display()))
+    }
+}
+
+pub async fn canonicalize(
+    path: impl AsRef<Path> + Send + Sync,
+    create_parent: bool,
+) -> Result<PathBuf, Error> {
+    fn create_canonical_folder<'a>(
+        path: impl AsRef<Path> + Send + Sync + 'a,
+    ) -> BoxFuture<'a, Result<PathBuf, Error>> {
+        async move {
+            let path = canonicalize(path, true).await?;
+            tokio::fs::create_dir(&path)
+                .await
+                .with_context(|| path.display().to_string())?;
+            Ok(path)
+        }
+        .boxed()
+    }
+    let path = path.as_ref();
+    if tokio::fs::metadata(path).await.is_err() {
+        let parent = path.parent().unwrap_or(Path::new("."));
+        if let Some(file_name) = path.file_name() {
+            if create_parent && tokio::fs::metadata(parent).await.is_err() {
+                return Ok(create_canonical_folder(parent).await?.join(file_name));
+            } else {
+                return Ok(tokio::fs::canonicalize(parent)
+                    .await
+                    .with_context(|| parent.display().to_string())?
+                    .join(file_name));
+            }
+        }
+    }
+    tokio::fs::canonicalize(&path)
+        .await
+        .with_context(|| path.display().to_string())
+}
+
+#[pin_project::pin_project(PinnedDrop)]
+pub struct NonDetachingJoinHandle<T>(#[pin] JoinHandle<T>);
+impl<T> NonDetachingJoinHandle<T> {
+    pub async fn wait_for_abort(self) -> Result<T, JoinError> {
+        self.abort();
+        self.await
+    }
+}
+impl<T> From<JoinHandle<T>> for NonDetachingJoinHandle<T> {
+    fn from(t: JoinHandle<T>) -> Self {
+        NonDetachingJoinHandle(t)
+    }
+}
+
+impl<T> Deref for NonDetachingJoinHandle<T> {
+    type Target = JoinHandle<T>;
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+impl<T> DerefMut for NonDetachingJoinHandle<T> {
+    fn deref_mut(&mut self) -> &mut Self::Target {
+        &mut self.0
+    }
+}
+#[pin_project::pinned_drop]
+impl<T> PinnedDrop for NonDetachingJoinHandle<T> {
+    fn drop(self: std::pin::Pin<&mut Self>) {
+        let this = self.project();
+        this.0.into_ref().get_ref().abort()
+    }
+}
+impl<T> Future for NonDetachingJoinHandle<T> {
+    type Output = Result<T, JoinError>;
+    fn poll(
+        self: std::pin::Pin<&mut Self>,
+        cx: &mut std::task::Context<'_>,
+    ) -> std::task::Poll<Self::Output> {
+        let this = self.project();
+        this.0.poll(cx)
+    }
+}
+
+pub struct AtomicFile {
+    tmp_path: PathBuf,
+    path: PathBuf,
+    file: Option<File>,
+}
+impl AtomicFile {
+    pub async fn new(
+        path: impl AsRef<Path> + Send + Sync,
+        tmp_path: Option<impl AsRef<Path> + Send + Sync>,
+    ) -> Result<Self, Error> {
+        let path = canonicalize(&path, true).await?;
+        let tmp_path = if let Some(tmp_path) = tmp_path {
+            canonicalize(&tmp_path, true).await?
+        } else {
+            to_tmp_path(&path)?
+        };
+        let file = File::create(&tmp_path)
+            .await
+            .with_context(|| tmp_path.display().to_string())?;
+        Ok(Self {
+            tmp_path,
+            path,
+            file: Some(file),
+        })
+    }
+
+    pub async fn rollback(mut self) -> Result<(), Error> {
+        drop(self.file.take());
+        tokio::fs::remove_file(&self.tmp_path)
+            .await
+            .with_context(|| format!("rm {}", self.tmp_path.display()))?;
+        Ok(())
+    }
+
+    pub async fn save(mut self) -> Result<(), Error> {
+        use tokio::io::AsyncWriteExt;
+        if let Some(file) = self.file.as_mut() {
+            file.flush().await?;
+            file.shutdown().await?;
+            file.sync_all().await?;
+        }
+        drop(self.file.take());
+        tokio::fs::rename(&self.tmp_path, &self.path)
+            .await
+            .with_context(|| {
+                format!("mv {} -> {}", self.tmp_path.display(), self.path.display())
+            })?;
+        Ok(())
+    }
+}
+impl std::ops::Deref for AtomicFile {
+    type Target = File;
+    fn deref(&self) -> &Self::Target {
+        self.file.as_ref().unwrap()
+    }
+}
+impl std::ops::DerefMut for AtomicFile {
+    fn deref_mut(&mut self) -> &mut Self::Target {
+        self.file.as_mut().unwrap()
+    }
+}
+impl Drop for AtomicFile {
+    fn drop(&mut self) {
+        if let Some(file) = self.file.take() {
+            drop(file);
+            let path = std::mem::take(&mut self.tmp_path);
+            tokio::spawn(async move { tokio::fs::remove_file(path).await.log_err() });
+        }
+    }
+}
+
+pub struct TimedResource<T: 'static + Send> {
+    handle: NonDetachingJoinHandle<Option<T>>,
+    ready: oneshot::Sender<()>,
+}
+impl<T: 'static + Send> TimedResource<T> {
+    pub fn new(resource: T, timer: Duration) -> Self {
+        let (send, recv) = oneshot::channel();
+        let handle = tokio::spawn(async move {
+            tokio::select! {
+                _ = tokio::time::sleep(timer) => {
+                    drop(resource);
+                    None
+                },
+                _ = recv => Some(resource),
+            }
+        });
+        Self {
+            handle: handle.into(),
+            ready: send,
+        }
+    }
+
+    pub fn new_with_destructor<
+        Fn: FnOnce(T) -> Fut + Send + 'static,
+        Fut: Future<Output = ()> + Send,
+    >(
+        resource: T,
+        timer: Duration,
+        destructor: Fn,
+    ) -> Self {
+        let (send, recv) = oneshot::channel();
+        let handle = tokio::spawn(async move {
+            tokio::select! {
+                _ = tokio::time::sleep(timer) => {
+                    destructor(resource).await;
+                    None
+                },
+                _ = recv => Some(resource),
+            }
+        });
+        Self {
+            handle: handle.into(),
+            ready: send,
+        }
+    }
+
+    pub async fn get(self) -> Option<T> {
+        let _ = self.ready.send(());
+        self.handle.await.unwrap()
+    }
+
+    pub fn is_timed_out(&self) -> bool {
+        self.ready.is_closed()
+    }
+}
+
+pub async fn spawn_local<
+    T: 'static + Send,
+    F: FnOnce() -> Fut + Send + 'static,
+    Fut: Future<Output = T> + 'static,
+>(
+    fut: F,
+) -> NonDetachingJoinHandle<T> {
+    let (send, recv) = tokio::sync::oneshot::channel();
+    std::thread::spawn(move || {
+        tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .unwrap()
+            .block_on(async move {
+                let set = LocalSet::new();
+                send.send(set.spawn_local(fut()).into())
+                    .unwrap_or_else(|_| unreachable!());
+                set.await
+            })
+    });
+    recv.await.unwrap()
+}

core/helpers/src/os_api.rs

@@ -0,0 +1,82 @@
+use std::sync::Arc;
+
+use color_eyre::Report;
+use models::InterfaceId;
+use models::PackageId;
+use serde_json::Value;
+use tokio::sync::mpsc;
+
+pub struct RuntimeDropped;
+
+pub struct Callback {
+    id: Arc<String>,
+    sender: mpsc::UnboundedSender<(Arc<String>, Vec<Value>)>,
+}
+impl Callback {
+    pub fn new(id: String, sender: mpsc::UnboundedSender<(Arc<String>, Vec<Value>)>) -> Self {
+        Self {
+            id: Arc::new(id),
+            sender,
+        }
+    }
+    pub fn is_listening(&self) -> bool {
+        self.sender.is_closed()
+    }
+    pub fn call(&self, args: Vec<Value>) -> Result<(), RuntimeDropped> {
+        self.sender
+            .send((self.id.clone(), args))
+            .map_err(|_| RuntimeDropped)
+    }
+}
+
+#[derive(serde::Deserialize, serde::Serialize, Debug, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct AddressSchemaOnion {
+    pub id: InterfaceId,
+    pub external_port: u16,
+}
+#[derive(serde::Deserialize, serde::Serialize, Debug, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct AddressSchemaLocal {
+    pub id: InterfaceId,
+    pub external_port: u16,
+}
+
+#[derive(serde::Deserialize, serde::Serialize, Debug, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct Address(pub String);
+#[derive(serde::Deserialize, serde::Serialize, Debug, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct Domain;
+#[derive(serde::Deserialize, serde::Serialize, Debug, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct Name;
+
+#[async_trait::async_trait]
+#[allow(unused_variables)]
+pub trait OsApi: Send + Sync + 'static {
+    async fn get_service_config(
+        &self,
+        id: PackageId,
+        path: &str,
+        callback: Option<Callback>,
+    ) -> Result<Vec<Value>, Report>;
+
+    async fn bind_local(
+        &self,
+        internal_port: u16,
+        address_schema: AddressSchemaLocal,
+    ) -> Result<Address, Report>;
+    async fn bind_onion(
+        &self,
+        internal_port: u16,
+        address_schema: AddressSchemaOnion,
+    ) -> Result<Address, Report>;
+
+    async fn unbind_local(&self, id: InterfaceId, external: u16) -> Result<(), Report>;
+    async fn unbind_onion(&self, id: InterfaceId, external: u16) -> Result<(), Report>;
+    fn set_started(&self) -> Result<(), Report>;
+    async fn restart(&self) -> Result<(), Report>;
+    async fn start(&self) -> Result<(), Report>;
+    async fn stop(&self) -> Result<(), Report>;
+}

core/helpers/src/rsync.rs

@@ -2,15 +2,13 @@ use std::path::Path;
 
 use color_eyre::eyre::eyre;
 use futures::StreamExt;
+use models::{Error, ErrorKind};
 use tokio::io::{AsyncBufReadExt, AsyncReadExt, BufReader};
 use tokio::process::{Child, Command};
 use tokio::sync::watch;
 use tokio_stream::wrappers::WatchStream;
 
-use crate::util::future::NonDetachingJoinHandle;
-use crate::util::io::ByteReplacementReader;
-use crate::util::serde::const_true;
-use crate::{Error, ErrorKind};
+use crate::{const_true, ByteReplacementReader, NonDetachingJoinHandle};
 
 #[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
 #[serde(rename_all = "camelCase")]
@@ -87,7 +85,7 @@ impl Rsync {
                 return Err(Error::new(
                     eyre!("rsync command stdout is none"),
                     ErrorKind::Filesystem,
-                ));
+                ))
             }
             Some(a) => a,
         };
@@ -96,7 +94,7 @@ impl Rsync {
                 return Err(Error::new(
                     eyre!("rsync command stderr is none"),
                     ErrorKind::Filesystem,
-                ));
+                ))
             }
             Some(a) => a,
         };
@@ -145,7 +143,7 @@ impl Rsync {
                 return Err(Error::new(
                     eyre!("rsync stderr error: {}", err),
                     ErrorKind::Filesystem,
-                ));
+                ))
             }
             Ok(a) => a?,
         };

core/helpers/src/script_dir.rs

@@ -0,0 +1,17 @@
+use std::path::{Path, PathBuf};
+
+use models::{PackageId, VersionString};
+
+pub const PKG_SCRIPT_DIR: &str = "package-data/scripts";
+
+pub fn script_dir<P: AsRef<Path>>(
+    datadir: P,
+    pkg_id: &PackageId,
+    version: &VersionString,
+) -> PathBuf {
+    datadir
+        .as_ref()
+        .join(&*PKG_SCRIPT_DIR)
+        .join(pkg_id)
+        .join(version.as_str())
+}

core/install-cli.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+set -ea
+shopt -s expand_aliases
+
+web="../web/dist/static"
+[ -d "$web" ] || mkdir -p "$web"
+
+if [ -z "$PLATFORM" ]; then
+  PLATFORM=$(uname -m)
+fi
+
+if [ "$PLATFORM" = "arm64" ]; then
+  PLATFORM="aarch64"
+fi
+
+cargo install --path=./startos --no-default-features --features=cli,docker --bin start-cli --locked

core/models/Cargo.toml

@@ -0,0 +1,40 @@
+[package]
+name = "models"
+version = "0.1.0"
+edition = "2021"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+arti-client = { version = "0.33", default-features = false, git = "https://github.com/Start9Labs/arti.git", branch = "patch/disable-exit" }
+axum = "0.8.4"
+base64 = "0.22.1"
+color-eyre = "0.6.2"
+ed25519-dalek = { version = "2.0.0", features = ["serde"] }
+gpt = "4.1.0"
+lazy_static = "1.4"
+lettre = { version = "0.11", default-features = false }
+mbrman = "0.6.0"
+exver = { version = "0.2.0", git = "https://github.com/Start9Labs/exver-rs.git", features = [
+  "serde",
+] }
+ipnet = "2.8.0"
+num_enum = "0.7.1"
+openssl = { version = "0.10.57", features = ["vendored"] }
+patch-db = { version = "*", path = "../../patch-db/patch-db", features = [
+  "trace",
+] }
+rand = "0.9.1"
+regex = "1.10.2"
+reqwest = "0.12"
+rpc-toolkit = { git = "https://github.com/Start9Labs/rpc-toolkit.git", branch = "master" }
+rustls = "0.23"
+serde = { version = "1.0", features = ["derive", "rc"] }
+serde_json = "1.0"
+ssh-key = "0.6.2"
+ts-rs = "9"
+thiserror = "2.0"
+tokio = { version = "1", features = ["full"] }
+tracing = "0.1.39"
+yasi = { version = "0.1.6", features = ["serde", "ts-rs"] }
+zbus = "5"

core/models/bindings/ServiceInterfaceId.ts

@@ -1,3 +1,3 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 
-export type Pem = string
+export type ServiceInterfaceId = string;

core/models/src/data_url.rs

@@ -1,41 +1,41 @@
 use std::borrow::Cow;
 use std::path::Path;
-use std::str::FromStr;
 
 use base64::Engine;
 use color_eyre::eyre::eyre;
-use imbl_value::InternedString;
 use reqwest::header::CONTENT_TYPE;
 use serde::{Deserialize, Serialize};
 use tokio::io::{AsyncRead, AsyncReadExt};
 use ts_rs::TS;
+use yasi::InternedString;
 
-use crate::util::mime::{mime, unmime};
-use crate::{Error, ErrorKind, ResultExt};
+use crate::{mime, Error, ErrorKind, ResultExt};
 
 #[derive(Clone, TS)]
 #[ts(type = "string")]
 pub struct DataUrl<'a> {
-    pub mime: InternedString,
-    pub data: Cow<'a, [u8]>,
+    mime: InternedString,
+    data: Cow<'a, [u8]>,
 }
 impl<'a> DataUrl<'a> {
     pub const DEFAULT_MIME: &'static str = "application/octet-stream";
     pub const MAX_SIZE: u64 = 100 * 1024;
 
-    fn to_string(&self) -> String {
+    // data:{mime};base64,{data}
+    pub fn to_string(&self) -> String {
         use std::fmt::Write;
-        let mut res = String::with_capacity(self.len());
-        write!(&mut res, "{self}").unwrap();
+        let mut res = String::with_capacity(self.data_url_len_without_mime() + self.mime.len());
+        let _ = write!(res, "data:{};base64,", self.mime);
+        base64::engine::general_purpose::STANDARD.encode_string(&self.data, &mut res);
         res
     }
 
-    fn len_without_mime(&self) -> usize {
+    fn data_url_len_without_mime(&self) -> usize {
         5 + 8 + (4 * self.data.len() / 3) + 3
     }
 
-    pub fn len(&self) -> usize {
-        self.len_without_mime() + self.mime.len()
+    pub fn data_url_len(&self) -> usize {
+        self.data_url_len_without_mime() + self.mime.len()
     }
 
     pub fn from_slice(mime: &str, data: &'a [u8]) -> Self {
@@ -44,10 +44,6 @@ impl<'a> DataUrl<'a> {
             data: Cow::Borrowed(data),
         }
     }
-
-    pub fn canonical_ext(&self) -> Option<&'static str> {
-        unmime(&self.mime)
-    }
 }
 impl DataUrl<'static> {
     pub async fn from_reader(
@@ -113,57 +109,12 @@ impl DataUrl<'static> {
     }
 }
 
-impl<'a> std::fmt::Display for DataUrl<'a> {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(
-            f,
-            "data:{};base64,{}",
-            self.mime,
-            base64::display::Base64Display::new(
-                &*self.data,
-                &base64::engine::general_purpose::STANDARD
-            )
-        )
-    }
-}
 impl<'a> std::fmt::Debug for DataUrl<'a> {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        std::fmt::Display::fmt(self, f)
+        f.write_str(&self.to_string())
     }
 }
 
-#[derive(Debug)]
-pub struct DataUrlParseError;
-impl std::fmt::Display for DataUrlParseError {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "invalid base64 url")
-    }
-}
-impl std::error::Error for DataUrlParseError {}
-impl From<DataUrlParseError> for Error {
-    fn from(e: DataUrlParseError) -> Self {
-        Error::new(e, ErrorKind::ParseUrl)
-    }
-}
-
-impl FromStr for DataUrl<'static> {
-    type Err = DataUrlParseError;
-    fn from_str(s: &str) -> Result<Self, Self::Err> {
-        s.strip_prefix("data:")
-            .and_then(|v| v.split_once(";base64,"))
-            .and_then(|(mime, data)| {
-                Some(DataUrl {
-                    mime: InternedString::intern(mime),
-                    data: Cow::Owned(
-                        base64::engine::general_purpose::STANDARD
-                            .decode(data)
-                            .ok()?,
-                    ),
-                })
-            })
-            .ok_or(DataUrlParseError)
-    }
-}
 impl<'de> Deserialize<'de> for DataUrl<'static> {
     fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
     where
@@ -179,9 +130,21 @@ impl<'de> Deserialize<'de> for DataUrl<'static> {
             where
                 E: serde::de::Error,
             {
-                v.parse().map_err(|_| {
-                    E::invalid_value(serde::de::Unexpected::Str(v), &"a valid base64 data url")
-                })
+                v.strip_prefix("data:")
+                    .and_then(|v| v.split_once(";base64,"))
+                    .and_then(|(mime, data)| {
+                        Some(DataUrl {
+                            mime: InternedString::intern(mime),
+                            data: Cow::Owned(
+                                base64::engine::general_purpose::STANDARD
+                                    .decode(data)
+                                    .ok()?,
+                            ),
+                        })
+                    })
+                    .ok_or_else(|| {
+                        E::invalid_value(serde::de::Unexpected::Str(v), &"a valid base64 data url")
+                    })
             }
         }
         deserializer.deserialize_any(Visitor)
@@ -205,6 +168,6 @@ fn doesnt_reallocate() {
             mime: InternedString::intern("png"),
             data: Cow::Borrowed(&random[..i]),
         };
-        assert_eq!(icon.to_string().capacity(), icon.len());
+        assert_eq!(icon.to_string().capacity(), icon.data_url_len());
     }
 }

core/models/src/errors.rs

@@ -1,18 +1,16 @@
 use std::fmt::{Debug, Display};
 
-use axum::http::StatusCode;
 use axum::http::uri::InvalidUri;
+use axum::http::StatusCode;
 use color_eyre::eyre::eyre;
 use num_enum::TryFromPrimitive;
 use patch_db::Revision;
 use rpc_toolkit::reqwest;
 use rpc_toolkit::yajrc::{
-    INVALID_PARAMS_ERROR, INVALID_REQUEST_ERROR, METHOD_NOT_FOUND_ERROR, PARSE_ERROR, RpcError,
+    RpcError, INVALID_PARAMS_ERROR, INVALID_REQUEST_ERROR, METHOD_NOT_FOUND_ERROR, PARSE_ERROR,
 };
 use serde::{Deserialize, Serialize};
 use tokio::task::JoinHandle;
-use tokio_rustls::rustls;
-use ts_rs::TS;
 
 use crate::InvalidId;
 
@@ -189,9 +187,9 @@ impl Display for ErrorKind {
     }
 }
 
+#[derive(Debug)]
 pub struct Error {
     pub source: color_eyre::eyre::Error,
-    pub debug: Option<color_eyre::eyre::Error>,
     pub kind: ErrorKind,
     pub revision: Option<Revision>,
     pub task: Option<JoinHandle<()>>,
@@ -199,30 +197,13 @@ pub struct Error {
 
 impl Display for Error {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "{}: {:#}", self.kind.as_str(), self.source)
-    }
-}
-impl Debug for Error {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(
-            f,
-            "{}: {:?}",
-            self.kind.as_str(),
-            self.debug.as_ref().unwrap_or(&self.source)
-        )
+        write!(f, "{}: {}", self.kind.as_str(), self.source)
     }
 }
 impl Error {
-    pub fn new<E: Into<color_eyre::eyre::Error> + std::fmt::Debug + 'static>(
-        source: E,
-        kind: ErrorKind,
-    ) -> Self {
-        let debug = (std::any::TypeId::of::<E>()
-            == std::any::TypeId::of::<color_eyre::eyre::Error>())
-        .then(|| eyre!("{source:?}"));
+    pub fn new<E: Into<color_eyre::eyre::Error>>(source: E, kind: ErrorKind) -> Self {
         Error {
             source: source.into(),
-            debug,
             kind,
             revision: None,
             task: None,
@@ -230,8 +211,11 @@ impl Error {
     }
     pub fn clone_output(&self) -> Self {
         Error {
-            source: eyre!("{}", self.source),
-            debug: self.debug.as_ref().map(|e| eyre!("{e}")),
+            source: ErrorData {
+                details: format!("{}", self.source),
+                debug: format!("{:?}", self.source),
+            }
+            .into(),
             kind: self.kind,
             revision: self.revision.clone(),
             task: None,
@@ -361,17 +345,11 @@ impl From<reqwest::Error> for Error {
         Error::new(e, kind)
     }
 }
-#[cfg(feature = "arti")]
 impl From<arti_client::Error> for Error {
     fn from(e: arti_client::Error) -> Self {
         Error::new(e, ErrorKind::Tor)
     }
 }
-impl From<torut::control::ConnError> for Error {
-    fn from(e: torut::control::ConnError) -> Self {
-        Error::new(e, ErrorKind::Tor)
-    }
-}
 impl From<zbus::Error> for Error {
     fn from(e: zbus::Error) -> Self {
         Error::new(e, ErrorKind::DBus)
@@ -382,6 +360,18 @@ impl From<rustls::Error> for Error {
         Error::new(e, ErrorKind::OpenSsl)
     }
 }
+impl From<patch_db::value::Error> for Error {
+    fn from(value: patch_db::value::Error) -> Self {
+        match value.kind {
+            patch_db::value::ErrorKind::Serialization => {
+                Error::new(value.source, ErrorKind::Serialization)
+            }
+            patch_db::value::ErrorKind::Deserialization => {
+                Error::new(value.source, ErrorKind::Deserialization)
+            }
+        }
+    }
+}
 impl From<lettre::error::Error> for Error {
     fn from(e: lettre::error::Error) -> Self {
         Error::new(e, ErrorKind::Smtp)
@@ -397,25 +387,8 @@ impl From<lettre::address::AddressError> for Error {
         Error::new(e, ErrorKind::Smtp)
     }
 }
-impl From<hyper::Error> for Error {
-    fn from(e: hyper::Error) -> Self {
-        Error::new(e, ErrorKind::Network)
-    }
-}
-impl From<patch_db::value::Error> for Error {
-    fn from(value: patch_db::value::Error) -> Self {
-        match value.kind {
-            patch_db::value::ErrorKind::Serialization => {
-                Error::new(value.source, ErrorKind::Serialization)
-            }
-            patch_db::value::ErrorKind::Deserialization => {
-                Error::new(value.source, ErrorKind::Deserialization)
-            }
-        }
-    }
-}
 
-#[derive(Clone, Deserialize, Serialize, TS)]
+#[derive(Clone, Deserialize, Serialize)]
 pub struct ErrorData {
     pub details: String,
     pub debug: String,
@@ -583,25 +556,25 @@ where
 impl<T, E> ResultExt<T, E> for Result<T, E>
 where
     color_eyre::eyre::Error: From<E>,
-    E: std::fmt::Debug + 'static,
 {
     fn with_kind(self, kind: ErrorKind) -> Result<T, Error> {
-        self.map_err(|e| Error::new(e, kind))
+        self.map_err(|e| Error {
+            source: e.into(),
+            kind,
+            revision: None,
+            task: None,
+        })
     }
 
     fn with_ctx<F: FnOnce(&E) -> (ErrorKind, D), D: Display>(self, f: F) -> Result<T, Error> {
         self.map_err(|e| {
             let (kind, ctx) = f(&e);
-            let debug = (std::any::TypeId::of::<E>()
-                == std::any::TypeId::of::<color_eyre::eyre::Error>())
-            .then(|| eyre!("{ctx}: {e:?}"));
             let source = color_eyre::eyre::Error::from(e);
-            let with_ctx = format!("{ctx}: {source}");
-            let source = source.wrap_err(with_ctx);
+            let ctx = format!("{}: {}", ctx, source);
+            let source = source.wrap_err(ctx);
             Error {
                 kind,
                 source,
-                debug,
                 revision: None,
                 task: None,
             }
@@ -622,24 +595,25 @@ where
 }
 impl<T> ResultExt<T, Error> for Result<T, Error> {
     fn with_kind(self, kind: ErrorKind) -> Result<T, Error> {
-        self.map_err(|e| Error { kind, ..e })
+        self.map_err(|e| Error {
+            source: e.source,
+            kind,
+            revision: e.revision,
+            task: e.task,
+        })
     }
 
     fn with_ctx<F: FnOnce(&Error) -> (ErrorKind, D), D: Display>(self, f: F) -> Result<T, Error> {
         self.map_err(|e| {
             let (kind, ctx) = f(&e);
             let source = e.source;
-            let with_ctx = format!("{ctx}: {source}");
-            let source = source.wrap_err(with_ctx);
-            let debug = e.debug.map(|e| {
-                let with_ctx = format!("{ctx}: {e}");
-                e.wrap_err(with_ctx)
-            });
+            let ctx = format!("{}: {}", ctx, source);
+            let source = source.wrap_err(ctx);
             Error {
                 kind,
                 source,
-                debug,
-                ..e
+                revision: e.revision,
+                task: e.task,
             }
         })
     }

core/models/src/id/gateway.rs

@@ -2,9 +2,9 @@ use std::convert::Infallible;
 use std::path::Path;
 use std::str::FromStr;
 
-use imbl_value::InternedString;
 use serde::{Deserialize, Serialize};
 use ts_rs::TS;
+use yasi::InternedString;
 
 #[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, TS)]
 #[ts(type = "string")]
@@ -14,14 +14,12 @@ impl GatewayId {
         &*self.0
     }
 }
-impl From<InternedString> for GatewayId {
-    fn from(value: InternedString) -> Self {
-        Self(value)
-    }
-}
-impl From<GatewayId> for InternedString {
-    fn from(value: GatewayId) -> Self {
-        value.0
+impl<T> From<T> for GatewayId
+where
+    T: Into<InternedString>,
+{
+    fn from(value: T) -> Self {
+        Self(value.into())
     }
 }
 impl FromStr for GatewayId {

core/models/src/id/host.rs

@@ -1,9 +1,9 @@
 use std::path::Path;
 use std::str::FromStr;
 
-use imbl_value::InternedString;
 use serde::{Deserialize, Deserializer, Serialize};
 use ts_rs::TS;
+use yasi::InternedString;
 
 use crate::{Id, InvalidId};
 

core/models/src/id/image.rs

@@ -5,8 +5,7 @@ use std::str::FromStr;
 use serde::{Deserialize, Deserializer, Serialize};
 use ts_rs::TS;
 
-use crate::util::VersionString;
-use crate::{Id, InvalidId, PackageId};
+use crate::{Id, InvalidId, PackageId, VersionString};
 
 #[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, TS)]
 #[ts(type = "string")]

core/models/src/id/invalid_id.rs

@@ -1,4 +1,4 @@
-use imbl_value::InternedString;
+use yasi::InternedString;
 
 #[derive(Debug, thiserror::Error)]
 #[error("Invalid ID: {0}")]

core/models/src/id/mod.rs

@@ -1,9 +1,9 @@
 use std::borrow::Borrow;
 use std::str::FromStr;
 
-use imbl_value::InternedString;
 use regex::Regex;
 use serde::{Deserialize, Deserializer, Serialize, Serializer};
+use yasi::InternedString;
 
 mod action;
 mod gateway;

core/models/src/id/package.rs

@@ -2,9 +2,9 @@ use std::borrow::Borrow;
 use std::path::Path;
 use std::str::FromStr;
 
-use imbl_value::InternedString;
 use serde::{Deserialize, Serialize, Serializer};
 use ts_rs::TS;
+use yasi::InternedString;
 
 use crate::{Id, InvalidId, SYSTEM_ID};
 

core/models/src/id/replay.rs

@@ -2,9 +2,9 @@ use std::convert::Infallible;
 use std::path::Path;
 use std::str::FromStr;
 
-use imbl_value::InternedString;
 use serde::{Deserialize, Serialize};
 use ts_rs::TS;
+use yasi::InternedString;
 
 #[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, TS)]
 #[ts(type = "string")]

core/models/src/id/service_interface.rs

@@ -5,8 +5,7 @@ use rpc_toolkit::clap::builder::ValueParserFactory;
 use serde::{Deserialize, Deserializer, Serialize};
 use ts_rs::TS;
 
-use crate::Id;
-use crate::util::FromStrParser;
+use crate::{FromStrParser, Id};
 
 #[derive(Clone, Debug, Default, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, TS)]
 #[ts(export, type = "string")]

core/models/src/lib.rs

@@ -0,0 +1,15 @@
+mod clap;
+mod data_url;
+mod errors;
+mod id;
+mod mime;
+mod procedure_name;
+mod version;
+
+pub use clap::*;
+pub use data_url::*;
+pub use errors::*;
+pub use id::*;
+pub use mime::*;
+pub use procedure_name::*;
+pub use version::*;

core/run-tests.sh

@@ -2,21 +2,9 @@
 
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
-source ./build/builder-alias.sh
-
 set -ea
 shopt -s expand_aliases
 
-PROFILE=${PROFILE:-release}
-if [ "${PROFILE}" = "release" ]; then
-	BUILD_FLAGS="--release"
-else
-  if [ "$PROFILE" != "debug"]; then
-    >&2 echo "Unknown profile $PROFILE: falling back to debug..."
-    PROFILE=debug
-  fi
-fi
-
 if [ -z "$ARCH" ]; then
 	ARCH=$(uname -m)
 fi
@@ -34,12 +22,15 @@ cd ..
 FEATURES="$(echo $ENVIRONMENT | sed 's/-/,/g')"
 RUSTFLAGS=""
 
-if [[ "${ENVIRONMENT}" =~ (^|-)console($|-) ]]; then
+if [[ "${ENVIRONMENT}" =~ (^|-)unstable($|-) ]]; then
 	RUSTFLAGS="--cfg tokio_unstable"
 fi
 
+alias 'rust-musl-builder'='docker run $USE_TTY --rm -e "RUSTFLAGS=$RUSTFLAGS" -v "$HOME/.cargo/registry":/root/.cargo/registry -v "$HOME/.cargo/git":/root/.cargo/git -v "$(pwd)":/home/rust/src -w /home/rust/src -P messense/rust-musl-cross:$ARCH-musl'
 
 echo "FEATURES=\"$FEATURES\""
 echo "RUSTFLAGS=\"$RUSTFLAGS\""
-rust-zig-builder cargo test --manifest-path=./core/Cargo.toml $BUILD_FLAGS --features=test,$FEATURES --workspace --locked --lib -- --skip export_bindings_
-rust-zig-builder sh -c "chown -R $UID:$UID core/target && chown -R $UID:$UID /usr/local/cargo"
+rust-musl-builder sh -c "apt-get update && apt-get install -y rsync && cd core && cargo test --release --features=test,$FEATURES --workspace --locked --target=$ARCH-unknown-linux-musl -- --skip export_bindings_ && chown \$UID:\$UID target"
+if [ "$(ls -nd core/target | awk '{ print $3 }')" != "$UID" ]; then
+	rust-musl-builder sh -c "cd core && chown -R $UID:$UID target && chown -R $UID:$UID /root/.cargo"
+fi

core/src/bins/mod.rs

@@ -1,85 +0,0 @@
-use std::collections::{BTreeMap, VecDeque};
-use std::ffi::OsString;
-use std::path::Path;
-
-pub mod container_cli;
-pub mod deprecated;
-pub mod registry;
-pub mod start_cli;
-pub mod start_init;
-pub mod startd;
-pub mod tunnel;
-
-#[derive(Default)]
-pub struct MultiExecutable(BTreeMap<&'static str, fn(VecDeque<OsString>)>);
-impl MultiExecutable {
-    pub fn enable_startd(&mut self) -> &mut Self {
-        self.0.insert("startd", startd::main);
-        self.0
-            .insert("embassyd", |_| deprecated::renamed("embassyd", "startd"));
-        self.0
-            .insert("embassy-init", |_| deprecated::removed("embassy-init"));
-        self
-    }
-    pub fn enable_start_cli(&mut self) -> &mut Self {
-        self.0.insert("start-cli", start_cli::main);
-        self.0.insert("embassy-cli", |_| {
-            deprecated::renamed("embassy-cli", "start-cli")
-        });
-        self.0
-            .insert("embassy-sdk", |_| deprecated::removed("embassy-sdk"));
-        self
-    }
-    pub fn enable_start_container(&mut self) -> &mut Self {
-        self.0.insert("start-container", container_cli::main);
-        self
-    }
-    pub fn enable_start_registryd(&mut self) -> &mut Self {
-        self.0.insert("start-registryd", registry::main);
-        self
-    }
-    pub fn enable_start_registry(&mut self) -> &mut Self {
-        self.0.insert("start-registry", registry::cli);
-        self
-    }
-    pub fn enable_start_tunneld(&mut self) -> &mut Self {
-        self.0.insert("start-tunneld", tunnel::main);
-        self
-    }
-    pub fn enable_start_tunnel(&mut self) -> &mut Self {
-        self.0.insert("start-tunnel", tunnel::cli);
-        self
-    }
-
-    fn select_executable(&self, name: &str) -> Option<fn(VecDeque<OsString>)> {
-        self.0.get(&name).copied()
-    }
-
-    pub fn execute(&self) {
-        let mut args = std::env::args_os().collect::<VecDeque<_>>();
-        for _ in 0..2 {
-            if let Some(s) = args.pop_front() {
-                if let Some(name) = Path::new(&*s).file_name().and_then(|s| s.to_str()) {
-                    if name == "--contents" {
-                        for name in self.0.keys() {
-                            println!("{name}");
-                        }
-                    }
-                    if let Some(x) = self.select_executable(&name) {
-                        args.push_front(s);
-                        return x(args);
-                    }
-                }
-            }
-        }
-        let args = std::env::args().collect::<VecDeque<_>>();
-        eprintln!(
-            "unknown executable: {}",
-            args.get(1)
-                .or_else(|| args.get(0))
-                .map(|s| s.as_str())
-                .unwrap_or("N/A")
-        );
-        std::process::exit(1);
-    }
-}

core/src/bins/tunnel.rs

@@ -1,200 +0,0 @@
-use std::ffi::OsString;
-use std::net::SocketAddr;
-use std::sync::Arc;
-use std::time::Duration;
-
-use clap::Parser;
-use futures::FutureExt;
-use rpc_toolkit::CliApp;
-use tokio::signal::unix::signal;
-use tracing::instrument;
-use visit_rs::Visit;
-
-use crate::context::CliContext;
-use crate::context::config::ClientConfig;
-use crate::net::gateway::{Bind, BindTcp};
-use crate::net::tls::TlsListener;
-use crate::net::web_server::{Accept, Acceptor, MetadataVisitor, WebServer};
-use crate::prelude::*;
-use crate::tunnel::context::{TunnelConfig, TunnelContext};
-use crate::tunnel::tunnel_router;
-use crate::tunnel::web::TunnelCertHandler;
-use crate::util::future::NonDetachingJoinHandle;
-use crate::util::logger::LOGGER;
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
-enum WebserverListener {
-    Http,
-    Https(SocketAddr),
-}
-impl<V: MetadataVisitor> Visit<V> for WebserverListener {
-    fn visit(&self, visitor: &mut V) -> <V as visit_rs::Visitor>::Result {
-        visitor.visit(self)
-    }
-}
-
-#[instrument(skip_all)]
-async fn inner_main(config: &TunnelConfig) -> Result<(), Error> {
-    let server = async {
-        let ctx = TunnelContext::init(config).await?;
-        let listen = ctx.listen;
-        let server = WebServer::new(
-            Acceptor::bind_map_dyn([(WebserverListener::Http, listen)]).await?,
-            tunnel_router(ctx.clone()),
-        );
-        let acceptor_setter = server.acceptor_setter();
-        let https_db = ctx.db.clone();
-        let https_thread: NonDetachingJoinHandle<()> = tokio::spawn(async move {
-            let mut sub = https_db.subscribe("/webserver".parse().unwrap()).await;
-            while {
-                while let Err(e) = async {
-                    let webserver = https_db.peek().await.into_webserver();
-                    if webserver.as_enabled().de()? {
-                        let addr = webserver.as_listen().de()?.or_not_found("listen address")?;
-                        acceptor_setter.send_if_modified(|a| {
-                            let key = WebserverListener::Https(addr);
-                            if !a.contains_key(&key) {
-                                match (|| {
-                                    Ok::<_, Error>(TlsListener::new(
-                                        BindTcp.bind(addr)?,
-                                        TunnelCertHandler {
-                                            db: https_db.clone(),
-                                            crypto_provider: Arc::new(tokio_rustls::rustls::crypto::ring::default_provider()),
-                                        },
-                                    ))
-                                })() {
-                                    Ok(l) => {
-                                        a.retain(|k, _| *k == WebserverListener::Http);
-                                        a.insert(key, l.into_dyn());
-
-                                        true
-                                    }
-                                    Err(e) => {
-                                        tracing::error!("error adding ssl listener: {e}");
-                                        tracing::debug!("{e:?}");
-
-                                        false
-                                    }
-                                }
-                            } else {
-                                false
-                            }
-                        });
-                    } else {
-                        acceptor_setter.send_if_modified(|a| {
-                            let before = a.len();
-                            a.retain(|k, _| *k == WebserverListener::Http);
-                            a.len() != before
-                        });
-                    }
-
-                    Ok::<_, Error>(())
-                }
-                .await
-                {
-                    tracing::error!("error updating webserver bind: {e}");
-                    tracing::debug!("{e:?}");
-                    tokio::time::sleep(Duration::from_secs(5)).await;
-                }
-                sub.recv().await.is_some()
-            } {}
-        })
-        .into();
-
-        let mut shutdown_recv = ctx.shutdown.subscribe();
-
-        let sig_handler_ctx = ctx;
-        let sig_handler: NonDetachingJoinHandle<()> = tokio::spawn(async move {
-            use tokio::signal::unix::SignalKind;
-            futures::future::select_all(
-                [
-                    SignalKind::interrupt(),
-                    SignalKind::quit(),
-                    SignalKind::terminate(),
-                ]
-                .iter()
-                .map(|s| {
-                    async move {
-                        signal(*s)
-                            .unwrap_or_else(|_| panic!("register {:?} handler", s))
-                            .recv()
-                            .await
-                    }
-                    .boxed()
-                }),
-            )
-            .await;
-            sig_handler_ctx
-                .shutdown
-                .send(())
-                .map_err(|_| ())
-                .expect("send shutdown signal");
-        })
-        .into();
-
-        shutdown_recv
-            .recv()
-            .await
-            .with_kind(crate::ErrorKind::Unknown)?;
-
-        sig_handler.wait_for_abort().await.with_kind(ErrorKind::Unknown)?;
-        https_thread.wait_for_abort().await.with_kind(ErrorKind::Unknown)?;
-
-        Ok::<_, Error>(server)
-    }
-    .await?;
-    server.shutdown().await;
-
-    Ok(())
-}
-
-pub fn main(args: impl IntoIterator<Item = OsString>) {
-    LOGGER.enable();
-
-    let config = TunnelConfig::parse_from(args).load().unwrap();
-
-    let res = {
-        let rt = tokio::runtime::Builder::new_multi_thread()
-            .enable_all()
-            .build()
-            .expect("failed to initialize runtime");
-        rt.block_on(inner_main(&config))
-    };
-
-    match res {
-        Ok(()) => (),
-        Err(e) => {
-            eprintln!("{}", e.source);
-            tracing::debug!("{:?}", e.source);
-            drop(e.source);
-            std::process::exit(e.kind as i32)
-        }
-    }
-}
-
-pub fn cli(args: impl IntoIterator<Item = OsString>) {
-    LOGGER.enable();
-
-    if let Err(e) = CliApp::new(
-        |cfg: ClientConfig| Ok(CliContext::init(cfg.load()?)?),
-        crate::tunnel::api::tunnel_api(),
-    )
-    .run(args)
-    {
-        match e.data {
-            Some(serde_json::Value::String(s)) => eprintln!("{}: {}", e.message, s),
-            Some(serde_json::Value::Object(o)) => {
-                if let Some(serde_json::Value::String(s)) = o.get("details") {
-                    eprintln!("{}: {}", e.message, s);
-                    if let Some(serde_json::Value::String(s)) = o.get("debug") {
-                        tracing::debug!("{}", s)
-                    }
-                }
-            }
-            Some(a) => eprintln!("{}: {}", e.message, a),
-            None => eprintln!("{}", e.message),
-        }
-
-        std::process::exit(e.code);
-    }
-}