#cloud-config
# BuildKit runner golden image — Debian 13 (Trixie) arm64. Bakes binaries only; runtime config injected at spawn time.
# Versions: update here for weekly golden image rebuild cadence (ADR-039 constraint golden-image-rebuild-cadence)
# SSH key: injected at server creation by hcloud --ssh-key; cloud-init only hardens sshd policy.
# buildkitd runs as root system service — avoids D-Bus/linger issues during cloud-init setup.

packages:
  - uidmap
  - fuse-overlayfs
  - slirp4netns
  - wget
  - ca-certificates
  - just

write_files:
  - path: /etc/ssh/sshd_config.d/10-hardening.conf
    permissions: "0644"
    content: |
      PasswordAuthentication no
      PubkeyAuthentication yes
      PermitRootLogin prohibit-password
      ChallengeResponseAuthentication no
      KbdInteractiveAuthentication no

  - path: /etc/systemd/system/buildkitd.service
    permissions: "0644"
    content: |
      [Unit]
      Description=BuildKit daemon
      After=network.target

      [Service]
      Type=notify
      ExecStart=/usr/local/bin/buildkitd --addr unix:///run/buildkit/buildkitd.sock
      Restart=on-failure
      RestartSec=5s
      RuntimeDirectory=buildkit
      RuntimeDirectoryMode=0711

      [Install]
      WantedBy=multi-user.target

runcmd:
  - |
    set -eu
    BUILDKIT_VERSION="v0.29.0"
    wget -q "https://github.com/moby/buildkit/releases/download/${BUILDKIT_VERSION}/buildkit-${BUILDKIT_VERSION}.linux-arm64.tar.gz" \
      -O /tmp/buildkit.tar.gz
    tar -xzf /tmp/buildkit.tar.gz -C /usr/local/
    rm /tmp/buildkit.tar.gz
    buildctl --version

  - |
    set -eu
    SCCACHE_VERSION="v0.9.1"
    SCCACHE_ARCHIVE="sccache-${SCCACHE_VERSION}-aarch64-unknown-linux-musl"
    wget -q "https://github.com/mozilla/sccache/releases/download/${SCCACHE_VERSION}/${SCCACHE_ARCHIVE}.tar.gz" \
      -O /tmp/sccache.tar.gz
    tar -xzf /tmp/sccache.tar.gz --strip-components=1 -C /usr/local/bin/ "${SCCACHE_ARCHIVE}/sccache"
    chmod +x /usr/local/bin/sccache
    rm /tmp/sccache.tar.gz
    sccache --version

  - |
    set -eu
    NU_VERSION="0.112.2"
    NU_ARCHIVE="nu-${NU_VERSION}-aarch64-unknown-linux-gnu"
    wget -q "https://github.com/nushell/nushell/releases/download/${NU_VERSION}/${NU_ARCHIVE}.tar.gz" \
      -O /tmp/nu.tar.gz
    tar -xzf /tmp/nu.tar.gz --strip-components=1 -C /usr/local/bin/ "${NU_ARCHIVE}/nu"
    chmod +x /usr/local/bin/nu
    rm /tmp/nu.tar.gz
    nu --version

  - systemctl daemon-reload
  - systemctl enable buildkitd
  - systemctl start buildkitd
  - systemctl status buildkitd