# Example image-build config for a base-type image.

# Global image-build options for this image
options:
  # Build a "normal" layer (as opposed to an Ansible-type layer)
  layer_type: 'base'

  # Name and tag for this image, used in publishing to OCI registries
  # and S3 for identification.
  name: 'rocky-base'
  # One or more tags to publish image with. If one, value is a string.
  # If multiple, the value is a YAML array of strings.
  publish_tags: '8.10'

  # Distribution flavor of image.
  pkg_manager: 'dnf'

  # Starting filesystem of image. 'scratch' means to start with a blank
  # filesystem. Currently, only OCI images can be used as parents. In
  # this example, the image is pushed to:
  #
  #  registry.mysite.tld/openchami/rocky-base:8.10
  #
  # This value can be used as the value to 'parent' if one wished to use
  # the 'rocky-base:8.10' image as a parent.
  parent: 'scratch'

  # Publish OCI image to local podman registry. Note that if running
  # the image-build container, this option will not be a benefit if
  # the container is removed after running, since the container gets
  # deleted after the build process exits.
  #publish_local: true

  # Publish OCI image to container registry. This image can be used
  # as a parent for child images. Use this when this image should
  # be used as a parent for subsequent images.
  #
  # The below config, combined with 'name' and 'publish_tags', will
  # publish this OCI image to:
  #
  #  registry.mysite.tld/openchami/rocky-base:8.10
  #
  publish_registry: 'registry.mysite.tld/openchami'
  registry_opts_push:
    - '--tls-verify=false'

  # Publish to S3 instance. This image be used for booting. Use this
  # if an image is to be used for booting.
  #
  # The below config, combined with 'name' and 'publish_tags', will
  # publish this SquashFS image to:
  #
  #  http://s3.mysite.tld/boot-images/compute/base/rocky8.10-rocky-base-8.10
  #
  publish_s3: 'http://s3.mysite.tld'
  s3_prefix: 'compute/base/'
  s3_bucket: 'boot-images'

  # Flags available pertaining to OpenSCAP
  # Install openscap-utils scap-security-guide bzip2 to image
  #install_scap: true
  # Run a SCAP scan using the xccdf option. Use this if a SCAP scan is desired.
  # (Required if using)
  # - the file path to xccdf xml - specify with the
  #   benchmark_path key
  # - profile selection - depends on xml specify with profile key
  #scap_benchmark: true
  # Run an OVAL evaluation
  # (Required if using)
  # - Link of URL to latest OVAL available for Linux distribution - specify
  #   with oval_url key 
  #oval_eval: true

# Package repositories to add. This example uses YUM/DNF repositories.
repos:
  - alias: 'rocky-baseos'
    url: 'http://dl.rockylinux.org/pub/rocky/8/BaseOS/x86_64/os'
  - alias: 'rock_appstream'
    url: 'http://dl.rockylinux.org/pub/rocky/8/AppStream/x86_64/os'
  - alias: 'rock_powertools'
    url: 'http://dl.rockylinux.org/pub/rocky/8/PowerTools/x86_64/os'
  - alias: 'epel'
    url: 'http://dl.fedoraproject.org/pub/epel/8/Everything/x86_64/'

# Package groups to install, in this example YUM/DNF package groups.
package_groups:
  - 'Minimal Install'
  - 'Development Tools'

# List of packages to install after repos get added. These names get passed
# straight to the package manager.
packages:
  - kernel
  - wget

# List of commands to run after package management steps get run. Each
# command gets passed to the shell, so redirection can be used. Besides
# 'cmd', an optional 'loglevel` can be passed (e.g. 'INFO', 'DEBUG') to
# control command verbosity. By default, it is 'INFO'.
cmds:
  - cmd: 'echo hello'
# 'cmd' also supports 'buildah_extra_args' that are passed to 'buildah run'
  - cmd: 'id user'
    buildah_extra_args: ['--volume', '/var/lib/sss:/var/lib/sss:z']

# OpenSCAP options to use with scap_benchmark or oval_eval. Each OpenSCAP 
# command gets passed to the shell. By default, the results from OpenSCAP will be saved 
# /root/ inside of the container built.
# 
# The xccdf or Extensible Configuration Checklist Description Format, is a 
# language used to describe security checklists and benchmarks. The xml for 
# SCAP benchmarks is specific to each Linux distribution, and it is 
# typically, available via scap-security-guide package. Each xml will have profiles 
# associated with it. Available profiles can be checked with 'oscap info <path to xml> 
# Not every Linux distro is going to provide a out of box ready xccdf xml it may need to 
# be customized
# 
# The OVAL or Open Vulnerability Assessment Language is a language used to 
# standardize the representation of information about system security states. In 
# short it gives info on if packages on the image have CVEs (Common Vulnerabilities and 
# Exposures) associated with them. Not every Linux distro is going to have a OVAL 
# available for download 
#openscap:
#  - profile: "xccdf_org.ssgproject.content_profile_stig"
#  - benchmark_path: "/usr/share/xml/scap/ssg/content/ssg-rl9-ds.xml"
#  - oval_url: "<Rocky Linux OVAL .bz2 URL>"

# An Ansible-type layer only needs the global options block.
options:
  # Layer type us 'ansible' instead of 'base'
  layer_type: 'ansible'

  # Ansible-specific options.
  #
  # 'groups' defines the Ansible groups in the passed inventory to run the
  # playbook(s) on.
  groups:
    - 'img_ochami_compute'
    - 'img_ochami'
  #
  # The playbook(s) to run against the image.
  playbooks: 'playbooks/images/compute.yaml'
  #
  # The Ansible inventory to pass corresponding with the playbook(s).
  inventory: 'inventory/'
  #
  # The numerical Ansible verbosity level:
  #   0 (default): Displays only critical information.
  #   1 (-v): Shows basic information like task names and results.
  #   2 (-vv): Includes more detailed output, such as variable values.
  #   3 (-vvv): Displays additional debugging data, such as task-level operations.
  #   4 (-vvvv): Enables connection debugging, providing a deep dive into network communication.
  ansible_verbosity: '3'

  # Everything else is the same format as base layer.
  name: 'ansible-layer'
  publish_tags: '8.10'
  parent: 'registry.mysite.tld/openchami/rocky-base:8.10'
  publish_registry: 'registry.mysite.tld/openchami'
  registry_opts_push:
    - '--tls-verify=false'
  publish_s3: 'http://s3.mysite.tld'
  s3_prefix: 'compute/ansible/'
  s3_bucket: 'boot-images'

options:
  layer_type: 'base'
  name: 'rocky8-base'
  publish_tags: '8.9'
  pkg_manager: 'dnf'
  parent: 'scratch'
  publish_registry: 'registry.mysite.tld/openchami'
  
  # Custom labels
  labels:
    maintainer: 'Your Name <[email protected]>'
    version: '1.0.0'
    description: 'Base Rocky Linux 8 image'
    org.opencontainers.image.source: 'https://github.com/your-org/your-repo'