ECS-Public-Infra/Create-Templates
Watch
2
0
Fork
You've already forked Create-Templates
 0
Code Issues 6 Pull requests 2 Projects Releases 20 Packages 2 Wiki Activity Actions
20 releases 20 tags
  • v1.6.4 23d2f0c560

    templates 1.6.4 Stable

    hclaude released this 2026-09-18 13:29:09 +00:00 | 9 commits to master since this release

    templates 1.6.4

    Artifacts (Forgejo generic registry):

    • debian-13-trixie-ECS01_13-1.6.4_amd64.tar.zst (169 MB)
    • devuan-6-excalibur-ECS01_6-1.6.4_amd64.tar.zst (163 MB)
    • devuan-6-excalibur_6-1.6.4_amd64.tar.zst (89 MB)
    • ubuntu-24.04-noble-ECS01_24.04-1.6.4_amd64.tar.zst (140 MB)

    Changes

    1.6.4 (network policy + first-boot finaliser fix following 1.6.3.
    Policy (user, 2026-09-17): every image ALWAYS does IPv6 SLAAC
    with an EUI-64 address and takes DNS from the RA (RDNSS); IPv4
    is mostly static, DHCPv4 the exception; a static IPv6 address
    is additional, never instead of SLAAC.
    SLAAC-1 (all templates + VM images):
    - /etc/sysctl.d/60-ecs-ipv6-slaac.conf pins accept_ra/autoconf
    on, addr_gen_mode=0 (EUI-64), use_tempaddr=0.
    - dhcpcd.conf ipv4only: on every DHCPv4 instance dhcpcd took
    over IPv6 and replaced the kernel's EUI-64 SLAAC with RFC 7217
    stable-private addresses (link-local included).
    - /etc/network/if-up.d/ecs-slaac (src/ecs-slaac-hook): ifupdown's
    "inet6 static" disables RA/autoconf by default, so a static
    IPv6 address silently killed SLAAC. The hook re-enables them,
    keeps the static address as outbound source (default route
    prefsrc, RA route demoted to metric 2048) and sends an RS via
    rdisc6 (ndisc6) so the EUI-64 address appears at once.
    DNS-1 (ECS01 templates + VM images):
    - rdnssd + ndisc6 join ECS01_PACKAGES. Debian/Devuan add
    resolvconf (ECS01_RESOLVCONF) as arbiter: order 000.rdnssd
    (RDNSS) -> lo.pve / lo.inet (PVE nameservers) -> DHCP records
    -> Quad9 from resolv.conf.d/tail. Previously RDNSS only
    reached resolv.conf by accident (dhcpcd) and PVE/cloud-init
    dns-nameservers were silently ignored (no resolvconf).
    - src/ecs-resolvconf-pve (boot, before resolvconf/networking):
    PVE rewrites /etc/resolv.conf as a plain file on every
    container start (rename-over, kills the symlink); the
    importer registers that content as record lo.pve and
    restores the symlink. Wired OpenRC boot / systemd sysinit.
    - Ubuntu noble ships no resolvconf/openresolv (systemd-resolved
    only): rdnssd's built-in merge (RDNSS ahead of the IPv4
    fallback) and no arbiter — PVE nameservers stay ignored there.
    - resolvconf is debconf-preseeded (linkify=false) so it never
    touches /etc/resolv.conf inside the build chroot; the symlink
    is made by finalize_resolvconf after the last chroot apt.
    hvisage SSH keys + default .zshrc moved to src/hvisage-authorized_keys
    and src/hvisage-zshrc (shared with the VM builder; content unchanged).
    test-devuan-template.sh: sections K2 (SLAAC-1), S (HOME-1), T (DNS-1).
    HOME-1: src/ecs-firstboot (shared by every ECS01 LXC template
    and VM image) now defaults HOME=/root. systemd units, OpenRC
    services and cloud-init runcmd all run without $HOME, so
    git config --global died "fatal: $HOME not set", set -e
    aborted the script, ecs-firstboot.service ended up FAILED and
    etckeeper was not initialised at first boot on any instance
    with a real hostname (masked by the apt Pre-Invoke self-heal,
    which initialises it at the first apt run). No other LXC
    recipe change. test-devuan-template.sh gains section S
    (finaliser ran clean, /etc under etckeeper).
    VM builder goes 0.2.3 -> 0.2.4 with SLAAC-1, DNS-1, HOME-1 plus:
    NET-1: dropped the "auto eth0 / iface eth0 inet dhcp" stanza
    from /etc/network/interfaces. ifupdown merged it with the
    eth0 stanza cloud-init renders from PVE's network-config, so a
    VM with a STATIC address also ran a DHCP client on that NIC;
    without a cloud-init drive it failed networking.service.
    NET-2 (standalone VMs): net.ifnames=0 (eth0 on every distro);
    the default "DHCPv4 + inet6 auto" stanza ships AS the file
    cloud-init's eni renderer overwrites (interfaces.d/50-cloud-init,
    .cfg on Ubuntu) so it can never coexist with a real config; the
    hvisage user (sudo NOPASSWD, SSH keys, zsh) is baked in like the
    LXC ECS01 bundle — a VM without a cloud-init drive is reachable
    on its EUI-64 address and can be logged into. root stays locked.
    VSOCK-1: mask systemd-ssh-generator (systemd >= 256, Debian
    13) — it logged "Failed to query local AF_VSOCK CID" on every
    boot and daemon-reload (no vsock device on PVE).
    Refs: #46

    SHA256SUMS

    edf2957dfe55a34b55507fdf7ece4f5e31512668e85d20e91cf4c3ac71d2d4a6  debian-13-trixie-ECS01_13-1.6.4_amd64.tar.zst
6e3def7475ed31505da349c565814c00910f5c7ee772ad8c1e5f2db11560348a  debian-13-trixie-ECS01_13-1.6.4_amd64.manifest.txt
8a1deba2babf462e2f09fb741519328b96667a6012c4781922f4d84622371dc4  devuan-6-excalibur-ECS01_6-1.6.4_amd64.tar.zst
a5066caaee31cad175152a6563496f103329112d1bb51e72c1bc71fc79accf28  devuan-6-excalibur-ECS01_6-1.6.4_amd64.manifest.txt
60c32285414b70ce9e783aac9c9781555e16884d2a289af9aa1b50993004de44  devuan-6-excalibur_6-1.6.4_amd64.tar.zst
894f1e81112b919c1214f12061c6e3a2f282aa1e00a2da5a2a6eca756ee36390  devuan-6-excalibur_6-1.6.4_amd64.manifest.txt
c25f2be11e94f286000258951ef173ae6ec1398de325373e4395774a4fa4c8a4  ubuntu-24.04-noble-ECS01_24.04-1.6.4_amd64.tar.zst
4a82f386a9bd0300dd0f901eccac7f7c38c7b86e366bb4bf03120a550f7a727b  ubuntu-24.04-noble-ECS01_24.04-1.6.4_amd64.manifest.txt

    Pull

    forgejo-curl -sLO https://git.cloudoffice.co.za/api/packages/ECS-Public-Infra/generic/lxc-templates/1.6.4/<file>     # or .../latest/<file>
    Downloads