os: Manage OS scripts and config files using Forklift about planktoscope HOT 5 CLOSED

Following up on comments from #133:

• It would be worth investigating whether we can use chezmoi as a library to manage both homefiles and etcfiles (from #133 (comment)) - and maybe even also for managing binaries
• For software which only needs to run as a systemd service, it would be worth investigating whether we can get systemd portable services (provided by the systemd-container apt package) working, and whether we could manage them using Forklift (perhaps using https://github.com/coreos/go-systemd?). One key question is whether a portable service can modify files outside its root filesystem.
• For software which also need to be made available as a binary to run (which is maybe just docker), it would be worth investigating whether we can use systemd-sysext and systemd-confext (#133 (comment) and #133 (comment)), at least after we upgrade from Raspberry Pi OS bullseye to Raspberry Pi OS bookworm (#322)

from planktoscope.

Apparently systemd-confext makes /etc read-only until after the extension is unmounted (because the config extensions are mounted over /etc). I think we really should try to keep /etc mutable for tinkering, so this rules out systemd-confext as something that might be useful for us. Any config files should instead be added using systemd-sysext to a directory inside /usr.

from planktoscope.

One potential simple yet flexible approach for putting arbitrary files in arbitrary locations on the filesystem in an atomic way could be to use bind mounts (maybe with systemd, e.g. as in https://utcc.utoronto.ca/~cks/space/blog/linux/SystemdBindMountUnits) and/or OverlayFS (maybe with systemd, e.g. as in https://bootlin.com/blog/systemd-read-only-rootfs-and-overlay-file-system-over-etc/, which discusses being able to add/modify systemd services using the OverlayFS)

from planktoscope.

Oops, I still need to make a PR to actually use the updated version of Forklift from PlanktoScope/forklift#195 to manage the machine-name binary!

from planktoscope.

This PR was closed by #411, but I had forgotten to link that PR to this issue when I merged #411.

from planktoscope.