Remove cockpit

.github/workflows/build.yml

@@ -1,135 +0,0 @@
-name: Build
-on:
-  schedule:
-    - cron: "21 21 * * *"
-  push:
-    branches: ["main"]
-  workflow_dispatch:
-
-env:
-  REGISTRY: ghcr.io
-  SERVER_IMAGE_NAME: "supermicro-x10drh"
-  WORKSTATION_BASE_IMAGE_NAME: "workstation-nvidia-base"
-  LENOVO_IMAGE_NAME: "lenovo-16arh7h"
-  ASROCK_IMAGE_NAME: "asrock-x570"
-  IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
-  REGISTRY_USER: ${{ github.actor }}
-  REGISTRY_PASSWORD: ${{ github.token }}
-
-
-jobs:
-  supermicro-x10drh:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v3
-
-      - name: Build container image
-        uses: redhat-actions/buildah-build@v2.12
-        with:
-          containerfiles: Containerfile-${{ env.SERVER_IMAGE_NAME }}
-          image: ${{ env.SERVER_IMAGE_NAME }}
-          layers: false
-          oci: true
-
-      - name: Push to ghcr.io
-        uses: redhat-actions/push-to-registry@v2.7
-        with:
-          image: ${{ env.SERVER_IMAGE_NAME }}
-          tags: "latest"
-          registry: ${{ env.IMAGE_REGISTRY }}
-          username: ${{ env.REGISTRY_USER }}
-          password: ${{ env.REGISTRY_PASSWORD }}
-          extra-args: |
-            --disable-content-trust
-  workstation-nvidia-base:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Free Disk Space (Ubuntu)
-        uses: jlumbroso/free-disk-space@main
-        with:
-          # this might remove tools that are actually needed,
-          # if set to "true" but frees about 6 GB
-          tool-cache: false
-
-          # all of these default to true, but feel free to set to
-          # "false" if necessary for your workflow
-          android: true
-          dotnet: true
-          haskell: true
-          large-packages: true
-          docker-images: false
-          swap-storage: true
-
-      - name: Checkout repo
-        uses: actions/checkout@v3
-
-      - name: Build container image
-        uses: redhat-actions/buildah-build@v2.12
-        with:
-          containerfiles: Containerfile-${{ env.WORKSTATION_BASE_IMAGE_NAME }}
-          image: ${{ env.WORKSTATION_BASE_IMAGE_NAME }}
-          layers: false
-          oci: true
-
-      - name: Push to ghcr.io
-        uses: redhat-actions/push-to-registry@v2.7
-        with:
-          image: ${{ env.WORKSTATION_BASE_IMAGE_NAME }}
-          tags: "latest"
-          registry: ${{ env.IMAGE_REGISTRY }}
-          username: ${{ env.REGISTRY_USER }}
-          password: ${{ env.REGISTRY_PASSWORD }}
-          extra-args: |
-            --disable-content-trust
-  asrock-x570:
-    needs: workstation-nvidia-base
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v3
-
-      - name: Build container image
-        uses: redhat-actions/buildah-build@v2.12
-        with:
-          containerfiles: Containerfile-${{ env.ASROCK_IMAGE_NAME }}
-          image: ${{ env.ASROCK_IMAGE_NAME }}
-          layers: false
-          oci: true
-
-      - name: Push to ghcr.io
-        uses: redhat-actions/push-to-registry@v2.7
-        with:
-          image: ${{ env.ASROCK_IMAGE_NAME }}
-          tags: "latest"
-          registry: ${{ env.IMAGE_REGISTRY }}
-          username: ${{ env.REGISTRY_USER }}
-          password: ${{ env.REGISTRY_PASSWORD }}
-          extra-args: |
-            --disable-content-trust
-  lenovo-16arh7h:
-    needs: workstation-nvidia-base
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v3
-
-      - name: Build container image
-        uses: redhat-actions/buildah-build@v2.12
-        with:
-          containerfiles: Containerfile-${{ env.LENOVO_IMAGE_NAME }}
-          image: ${{ env.LENOVO_IMAGE_NAME }}
-          layers: false
-          oci: true
-
-      - name: Push to ghcr.io
-        uses: redhat-actions/push-to-registry@v2.7
-        with:
-          image: ${{ env.LENOVO_IMAGE_NAME }}
-          tags: "latest"
-          registry: ${{ env.IMAGE_REGISTRY }}
-          username: ${{ env.REGISTRY_USER }}
-          password: ${{ env.REGISTRY_PASSWORD }}
-          extra-args: |
-            --disable-content-trust
-

Containerfile-asrock-x570

@@ -1,4 +1,4 @@
-FROM ghcr.io/benradey/workstation-nvidia-base:latest
+FROM git.radey.org/ben/workstation-nvidia-base:latest
 
 RUN dnf5 install -y \
       inotify-tools && \
@@ -10,11 +10,12 @@ RUN echo "%_without_kmod_nvidia_detect 1" > /etc/rpm/macros.nvidia-kmod && \
     chmod 777 /var/tmp && \
     /usr/sbin/akmods --force --kernels "$(rpm -qa kernel --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
 
-# The first check makes sure that we have exactly 4 gpg pubkeys trusted in the rpmdb (the ones from the base image).
+# The first check makes sure that we have exactly 10 gpg pubkeys trusted in the rpmdb (the ones manually imported above) (Brave adds 6, apparently?).
 # Any more than that means that dnf automatically added a new one, which is shady!
 # Then: cleanup image for linting
 # Finally: verify image is good
 # FIXME - remove the `--skip nonempty-run-tmp` when it's no longer needed
-RUN [[ 4 -eq $(rpm -qa gpg-pubkey* | wc -l) ]] && \
+RUN [[ 11 -eq $(rpm -qa gpg-pubkey* | wc -l) ]] && \
     rm -rf /var /boot && mkdir /var /boot && \
     bootc container lint --fatal-warnings --skip nonempty-run-tmp
+

Containerfile-asus-ga402r

@@ -0,0 +1,62 @@
+FROM quay.io/fedora/fedora-silverblue:44
+
+COPY gpg-keys/* /keys/
+
+RUN wget -O /etc/udev/rules.d/42-logitech-unify-permissions.rules https://raw.githubusercontent.com/pwr-Solaar/Solaar/refs/heads/master/rules.d-uinput/42-logitech-unify-permissions.rules && \
+    rpm --import \
+      /keys/RPM-GPG-KEY-rpmfusion-free-fedora-2020 \
+      /keys/RPM-GPG-KEY-rpmfusion-nonfree-fedora-2020 \
+      /keys/brave-core.asc \
+      /keys/terra.asc \
+      /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-44-x86_64 && \
+    rm -rf /keys && \
+    dnf5 install -y https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm \
+      https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm && \
+    curl -fsSLo /etc/yum.repos.d/brave-browser.repo https://brave-browser-rpm-release.s3.brave.com/brave-browser.repo && \
+    curl -fsSLo /etc/yum.repos.d/terra.repo https://github.com/terrapkg/subatomic-repos/raw/main/terra.repo && \
+    mkdir /var/opt /usr/brave.com && \
+    ln -s /usr/brave.com /var/opt/brave.com && \
+    echo "L /var/opt/brave.com - - - - /usr/brave.com" >> /usr/lib/tmpfiles.d/brave.conf && \
+    dnf5 install -y \
+      asusctl \
+      asusctl-rog-gui \
+      brave-browser \
+      distrobox \
+      fuse-sshfs \
+      geany \
+      gnome-extensions-app \
+      gnome-shell-extension-dash-to-panel \
+      gnome-tweaks \
+      htop \
+      iftop \
+      iotop \
+      libavcodec-freeworld \
+      libva-utils \
+      lm_sensors \
+      mesa-va-drivers-freeworld \
+      steam \
+      syncthing \
+      terra-release \
+      vdpauinfo \
+      vim \
+      vulkan-tools && \
+    dnf5 swap -y ffmpeg-free ffmpeg --allowerasing && \
+    dnf5 swap -y mesa-vulkan-drivers mesa-vulkan-drivers-freeworld --allowerasing && \
+    dnf5 swap -y tuned-ppd power-profiles-daemon --allowerasing && \
+    dnf5 clean all && \
+    sed -i '/^PrefersNonDefaultGPU=/d' /usr/share/applications/steam.desktop && \
+    sed -i '/^X-KDE-RunOnDiscreteGpu=/d' /usr/share/applications/steam.desktop
+
+# The first check makes sure that we have exactly 10 gpg pubkeys trusted in the rpmdb (the ones manually imported above) (Brave adds 6, apparently?).
+# Any more than that means that dnf automatically added a new one, which is shady!
+# Then: cleanup image for linting
+# Finally: verify image is good
+# FIXME - remove the `--skip nonempty-run-tmp` when it's no longer needed
+RUN echo "" && \
+    echo "Expecting 10 keys to follow this line!" && \
+    rpm -qa gpg-pubkey* && \
+    echo "" && \
+    [[ 10 -eq $(rpm -qa gpg-pubkey* | wc -l) ]] && \
+    rm -rf /var /boot && mkdir /var /boot && \
+    bootc container lint --fatal-warnings --skip nonempty-run-tmp
+

Containerfile-lenovo-15igl05

@@ -0,0 +1,39 @@
+FROM quay.io/fedora/fedora-silverblue:44
+
+COPY gpg-keys/* /keys/
+
+RUN wget -O /etc/udev/rules.d/42-logitech-unify-permissions.rules https://raw.githubusercontent.com/pwr-Solaar/Solaar/refs/heads/master/rules.d-uinput/42-logitech-unify-permissions.rules
+
+RUN rpm --import \
+      /keys/RPM-GPG-KEY-rpmfusion-free-fedora-2020 \
+      /keys/RPM-GPG-KEY-rpmfusion-nonfree-fedora-2020 \
+      /keys/brave-core.asc \
+      /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-44-x86_64 && \
+    rm -rf /keys && \
+    dnf5 install -y https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm \
+      https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm  && \
+    curl -fsSLo /etc/yum.repos.d/brave-browser.repo https://brave-browser-rpm-release.s3.brave.com/brave-browser.repo && \
+    mkdir /var/opt /usr/brave.com && \
+    ln -s /usr/brave.com /var/opt/brave.com && \
+    echo "L /var/opt/brave.com - - - - /usr/brave.com" >> /usr/lib/tmpfiles.d/brave.conf && \
+    dnf5 install -y \
+      brave-browser \
+      geany \
+      gnome-extensions-app \
+      gnome-shell-extension-dash-to-panel \
+      gnome-terminal \
+      gnome-tweaks \
+      lm_sensors \
+      vim && \
+    dnf5 swap -y ffmpeg-free ffmpeg --allowerasing && \
+    dnf5 clean all
+
+# The first check makes sure that we have exactly 9 gpg pubkeys trusted in the rpmdb (the ones manually imported above) (Brave adds 6, apparently?).
+# Any more than that means that dnf automatically added a new one, which is shady!
+# Then: cleanup image for linting
+# Finally: verify image is good
+# FIXME - remove the `--skip nonempty-run-tmp` when it's no longer needed
+RUN rpm -qa gpg-pubkey*
+RUN [[ 9 -eq $(rpm -qa gpg-pubkey* | wc -l) ]] && \
+    rm -rf /var /boot && mkdir /var /boot && \
+    bootc container lint --fatal-warnings --skip nonempty-run-tmp

Containerfile-lenovo-16arh7h

@@ -1,4 +1,4 @@
-FROM ghcr.io/benradey/workstation-nvidia-base:latest
+FROM git.radey.org/ben/workstation-nvidia-base:latest
 
 # Build nvidia akmod with no special arguments - defaults to open kernel driver for newer hardware
 RUN mkdir -p /var/log/akmods /var/cache/akmods/nvidia /var/tmp && \
@@ -24,11 +24,12 @@ RUN git clone https://github.com/johnfanv2/LenovoLegionLinux.git && \
     echo legion-laptop > /etc/modules-load.d/legion_laptop.conf && \
     rm -rf LenovoLegionLinux
 
-# The first check makes sure that we have exactly 4 gpg pubkeys trusted in the rpmdb (the ones from the base image).
+# The first check makes sure that we have exactly 10 gpg pubkeys trusted in the rpmdb (the ones manually imported above) (Brave adds 6, apparently?).
 # Any more than that means that dnf automatically added a new one, which is shady!
 # Then: cleanup image for linting
 # Finally: verify image is good
 # FIXME - remove the `--skip nonempty-run-tmp` when it's no longer needed
-RUN [[ 4 -eq $(rpm -qa gpg-pubkey* | wc -l) ]] && \
+RUN [[ 11 -eq $(rpm -qa gpg-pubkey* | wc -l) ]] && \
     rm -rf /var /boot && mkdir /var /boot && \
     bootc container lint --fatal-warnings --skip nonempty-run-tmp
+

Containerfile-supermicro-x10drh

@@ -1,18 +1,4 @@
-# ====== Stage 1: Builder image ======
+FROM quay.io/fedora/fedora-silverblue:44
-FROM fedora:latest AS builder
-
-RUN dnf5 update -y && dnf install -y git golang
-
-RUN git clone https://github.com/rfjakob/gocryptfs.git
-
-WORKDIR /gocryptfs
-
-RUN ./build-without-openssl.bash
-
-# ====== Stage 2: Server image ======
-FROM quay.io/fedora/fedora-silverblue:43
-
-COPY --from=builder /gocryptfs/gocryptfs /usr/bin/gocryptfs
 
 COPY gpg-keys/* /keys/
 
@@ -24,9 +10,9 @@ RUN rpm --import \
       /keys/zrepl-rpm-pkgs \
       /keys/RPM-GPG-KEY-rpmfusion-free-fedora-2020 \
       /keys/RPM-GPG-KEY-rpmfusion-nonfree-fedora-2020 \
-      /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-43-x86_64 && \
+      /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-44-x86_64 && \
     rm -rf /keys && \
-    dnf5 install -y https://github.com/zfsonlinux/zfsonlinux.github.com/raw/master/fedora/zfs-release-3-0$(rpm --eval "%{dist}").noarch.rpm \
+    dnf5 install -y https://github.com/zfsonlinux/zfsonlinux.github.com/raw/master/fedora/zfs-release-3-1$(rpm --eval "%{dist}").noarch.rpm \
       https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm \
       https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm && \
     dnf5 install -y \
@@ -43,12 +29,11 @@ RUN dnf5 install -y \
       ansible \
       borgbackup \
       certbot \
-      cockpit \
-      cockpit-podman \
       distrobox \
       fail2ban \
       fuse-encfs \
       fuse-sshfs \
+      gocryptfs \
       hddtemp \
       htop \
       iftop \
@@ -106,3 +91,4 @@ RUN test -f /usr/lib/sysusers.d/libvirt.conf || echo -e 'g libvirt 963' > /usr/l
 RUN [[ 7 -eq $(rpm -qa gpg-pubkey* | wc -l) ]] && \
     rm -rf /var /boot && mkdir /var /boot && \
     bootc container lint --fatal-warnings --skip nonempty-run-tmp
+

Containerfile-workstation-nvidia-base

@@ -1,4 +1,4 @@
-FROM quay.io/fedora/fedora-silverblue:43
+FROM quay.io/fedora/fedora-silverblue:44
 
 COPY gpg-keys/* /keys/
 
@@ -9,7 +9,7 @@ RUN rpm --import \
       /keys/RPM-GPG-KEY-rpmfusion-free-fedora-2020 \
       /keys/RPM-GPG-KEY-rpmfusion-nonfree-fedora-2020 \
       /keys/brave-core.asc \
-      /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-43-x86_64 && \
+      /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-44-x86_64 && \
     rm -rf /keys && \
     dnf5 install -y https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm \
       https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm \
@@ -23,7 +23,6 @@ RUN rpm --import \
       android-tools \
       ansible \
       brave-browser \
-      cinnamon \
       distrobox \
       fuse-sshfs \
       geany \
@@ -31,13 +30,13 @@ RUN rpm --import \
       gnome-extensions-app \
       gnome-shell-extension-dash-to-panel \
       gnome-terminal \
-      gnome-themes-extra \
       gnome-tweaks \
       htop \
       iftop \
       iotop \
       libva-nvidia-driver \
       libva-utils \
+      lm_sensors \
       nvtop \
       qpdf \
       steam \
@@ -47,26 +46,30 @@ RUN rpm --import \
       virt-manager \
       vulkan-tools && \
     dnf5 swap -y ffmpeg-free ffmpeg --allowerasing && \
-    dnf5 swap -y mesa-va-drivers mesa-va-drivers-freeworld && \
-    dnf5 swap -y mesa-vdpau-drivers mesa-vdpau-drivers-freeworld && \
     dnf5 clean all
 
 # TODO: Remove this `|| true` hack once post scriptlets no longer make dnf exit with non-zero
+# FIXME: Sticking with the 580 driver because 595 does way too much thermal throttling on the Legion. Try the next major version (>595) when it's available to see if it's better.
 RUN dnf5 install -y \
-      akmod-nvidia \
+      akmod-nvidia-580xx \
-      xorg-x11-drv-nvidia-cuda \
+      xorg-x11-drv-nvidia-580xx-cuda \
       proton-vpn-gnome-desktop || true && \
       dnf5 clean all
 # TODO: Remove these unnecessary checks to make sure the packages above actually got installed. rpm exits non-zero if the package is not installed and aborts the Containerfile build
-RUN rpm -q akmod-nvidia && \
+RUN rpm -q akmod-nvidia-580xx && \
-    rpm -q xorg-x11-drv-nvidia-cuda && \
+    rpm -q xorg-x11-drv-nvidia-580xx-cuda && \
     rpm -q proton-vpn-gnome-desktop
 
-# The first check makes sure that we have exactly 10 gpg pubkeys trusted in the rpmdb (the ones manually imported above) (Brave adds 6, apparently?).
+# The first check makes sure that we have exactly 11 gpg pubkeys trusted in the rpmdb (the ones manually imported above) (Brave adds 6, apparently?).
 # Any more than that means that dnf automatically added a new one, which is shady!
 # Then: cleanup image for linting
 # Finally: verify image is good
 # FIXME - remove the `--skip nonempty-run-tmp` when it's no longer needed
-RUN [[ 10 -eq $(rpm -qa gpg-pubkey* | wc -l) ]] && \
+RUN echo "" && \
+    echo "Expecting 11 keys to follow this line!" && \
+    rpm -qa gpg-pubkey* && \
+    echo "" && \
+    [[ 11 -eq $(rpm -qa gpg-pubkey* | wc -l) ]] && \
     rm -rf /var /boot && mkdir /var /boot && \
     bootc container lint --fatal-warnings --skip nonempty-run-tmp
+

gpg-keys/terra.asc

@@ -0,0 +1,17 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GopenPGP 2.8.1
+Comment: https://gopenpgp.org
+
+xjMEaYpzVxYJKwYBBAHaRw8BAQdAb3DsTkfuyHxBUTJh9KY5K9Zmd3HHNlr3nr7j
+DqIfJHbNIFRlcnJhIDQ0IDxzZWN1cml0eUBmeXJhbGFicy5jb20+wr8EExYIAHEF
+gmmKc1cDCwkHCZAAzatD3iJtbzUUAAAAAAAcABBzYWx0QG5vdGF0aW9ucy5vcGVu
+cGdwanMub3Jn6H9BnkxjSlvFTWI4j1lWagIVCAMWAAICGQECmwMCHgEWIQSuCRV6
+TeiLSX6h1dMAzatD3iJtbwAAkxUA/AhjnPTnXX4U50jtWrE8/33CXkR/kMvp8y2m
+jR9jrEzPAQCEA1Jx8eBbBo7RySbF1D8AoYGGvdy5Igmsz7/FCq4DAM44BGmKc1cS
+CisGAQQBl1UBBQEBB0BKc0gRkEY9/IuABq32DNPxZN0AQo41geDGywcbV47JSQMB
+CgnCrgQYFggAYAWCaYpzVwmQAM2rQ94ibW81FAAAAAAAHAAQc2FsdEBub3RhdGlv
+bnMub3BlbnBncGpzLm9yZ8nm3oDFHJ/SnE3gwb0ZR04CmwwWIQSuCRV6TeiLSX6h
+1dMAzatD3iJtbwAAjYoA/2P25j8wdGP/TdF4mhNiN/6cBNL08/wmqDTJooYy2GP+
+AQCJp+Vj5nfTYUO7+6WvES4cFaaZJhY8CsjJwx6k8xhsCA==
+=KXwo
+-----END PGP PUBLIC KEY BLOCK-----

supermicro-x10drh/nvidia-container-toolkit.repo

@@ -5,8 +5,6 @@ repo_gpgcheck=1
 gpgcheck=0
 enabled=1
 gpgkey=https://nvidia.github.io/libnvidia-container/gpgkey
-sslverify=1
-sslcacert=/etc/pki/tls/certs/ca-bundle.crt
 
 [nvidia-container-toolkit-experimental]
 name=nvidia-container-toolkit-experimental
@@ -15,5 +13,4 @@ repo_gpgcheck=1
 gpgcheck=0
 enabled=0
 gpgkey=https://nvidia.github.io/libnvidia-container/gpgkey
-sslverify=1
+
-sslcacert=/etc/pki/tls/certs/ca-bundle.crt