other tank

Reviewed-on: #27

bundles/bootshorn/files/process

@@ -112,6 +112,11 @@ def process_recording(filename):
 
         sample_num += samples_per_block - overlapping_samples
 
+    # move to PROCESSED_RECORDINGS_DIR
+
+    os.makedirs(PROCESSED_RECORDINGS_DIR, exist_ok=True)
+    shutil.move(os.path.join(RECORDINGS_DIR, filename), os.path.join(PROCESSED_RECORDINGS_DIR, filename))
+
 
 # write a spectrogram using the sound from start to end of the event
 def write_event(current_event, soundfile, samplerate):

bundles/bootshorn/files/record

@@ -19,5 +19,7 @@ do
         -t "3600" \
         -c:a flac \
         -compression_level 12 \
-        "recordings/$DATE.flac"
+        "recordings/current/$DATE.flac"
+
+    mv "recordings/current/$DATE.flac" "recordings/$DATE.flac"
 done

bundles/bootshorn/files/temperature

@@ -8,7 +8,7 @@ urllib3.disable_warnings()
 import os
 
 
-HUE_IP = "10.0.0.134"  # replace with your bridge IP
+HUE_IP = "${hue_ip}"  # replace with your bridge IP
 HUE_APP_KEY = "${hue_app_key}" # local only
 HUE_DEVICE_ID = "31f58786-3242-4e88-b9ce-23f44ba27bbe"
 TEMPERATURE_LOG_DIR = "/opt/bootshorn/temperatures"

bundles/bootshorn/items.py

@@ -7,11 +7,15 @@ directories = {
         'owner': 'ckn',
         'group': 'ckn',
     },
+    '/opt/bootshorn/temperatures': {
+        'owner': 'ckn',
+        'group': 'ckn',
+    },
     '/opt/bootshorn/recordings': {
         'owner': 'ckn',
         'group': 'ckn',
     },
-    '/opt/bootshorn/temperatures': {
+    '/opt/bootshorn/recordings/current': {
         'owner': 'ckn',
         'group': 'ckn',
     },
@@ -34,6 +38,7 @@ files = {
     '/opt/bootshorn/temperature': {
         'content_type': 'mako',
         'context': {
+            'hue_ip': repo.get_node('home.hue').hostname,
             'hue_app_key': repo.vault.decrypt('encrypt$gAAAAABoc2WxZCLbxl-Z4IrSC97CdOeFgBplr9Fp5ujpd0WCCCPNBUY_WquHN86z8hKLq5Y04dwq8TdJW0PMSOSgTFbGgdp_P1q0jOBLEKaW9IIT1YM88h-JYwLf9QGDV_5oEfvnBCtO'),
         },
         'owner': 'ckn',

bundles/dovecot/files/dovecot-sql.conf

@@ -1,17 +0,0 @@
-connect = host=${host} dbname=${name} user=${user} password=${password}
-driver = pgsql
-default_pass_scheme = ARGON2ID
-
-user_query = SELECT '/var/vmail/%u' AS home, 'vmail' AS uid, 'vmail' AS gid
-
-iterate_query = SELECT CONCAT(users.name, '@', domains.name) AS user \
-  FROM users \
-  LEFT JOIN domains ON users.domain_id = domains.id \
-  WHERE redirect IS NULL
-
-password_query = SELECT CONCAT(users.name, '@', domains.name) AS user, password \
-  FROM users \
-  LEFT JOIN domains ON users.domain_id = domains.id \
-  WHERE redirect IS NULL \
-  AND users.name = SPLIT_PART('%u', '@', 1) \
-  AND domains.name = SPLIT_PART('%u', '@', 2)

bundles/dovecot/files/dovecot.conf

@@ -1,13 +1,17 @@
+dovecot_config_version = ${config_version}
+dovecot_storage_version = ${storage_version}
+
 protocols = imap lmtp sieve
 auth_mechanisms = plain login
-mail_privileged_group = mail
 ssl = required
-ssl_cert = </var/lib/dehydrated/certs/${node.metadata.get('mailserver/hostname')}/fullchain.pem
+ssl_server_cert_file = /var/lib/dehydrated/certs/${hostname}/fullchain.pem
-ssl_key = </var/lib/dehydrated/certs/${node.metadata.get('mailserver/hostname')}/privkey.pem
+ssl_server_key_file = /var/lib/dehydrated/certs/${hostname}/privkey.pem
-ssl_dh = </etc/dovecot/dhparam.pem
+ssl_server_dh_file = /etc/dovecot/dhparam.pem
 ssl_client_ca_dir = /etc/ssl/certs
-mail_location = maildir:${node.metadata.get('mailserver/maildir')}/%u:INDEX=${node.metadata.get('mailserver/maildir')}/index/%u
+mail_driver     = maildir
-mail_plugins = fts fts_xapian
+mail_path       = ${maildir}/%{user}
+mail_index_path = ${maildir}/index/%{user}
+mail_plugins = fts fts_flatcurve
 
 namespace inbox {
   inbox = yes
@@ -30,14 +34,46 @@ namespace inbox {
   }
 }
 
-passdb {
+# postgres passdb userdb
-  driver = sql
+
-  args = /etc/dovecot/dovecot-sql.conf
+sql_driver = pgsql
+
+pgsql main {
+  parameters {
+    host     = ${db_host}
+    dbname   = ${db_name}
+    user     = ${db_user}
+    password = ${db_password}
+  }
 }
-# use sql for userdb too, to enable iterate_query
+
-userdb {
+passdb sql {
-  driver = sql
+  passdb_default_password_scheme = ARGON2ID
-  args = /etc/dovecot/dovecot-sql.conf
+
+  query = SELECT \
+            CONCAT(users.name, '@', domains.name) AS "user", \
+            password \
+          FROM users \
+          LEFT JOIN domains ON users.domain_id = domains.id \
+          WHERE redirect IS NULL \
+            AND users.name   = SPLIT_PART('%{user}', '@', 1) \
+            AND domains.name = SPLIT_PART('%{user}', '@', 2)
+}
+
+mail_uid = vmail
+mail_gid = vmail
+
+userdb sql {
+  query = SELECT \
+            '/var/vmail/%{user}' AS home, \
+            'vmail'              AS uid, \
+            'vmail'              AS gid
+
+  iterate_query = SELECT \
+                    CONCAT(users.name, '@', domains.name) AS username \
+                  FROM users \
+                  LEFT JOIN domains ON users.domain_id = domains.id \
+                  WHERE redirect IS NULL
 }
 
 service auth {
@@ -67,10 +103,9 @@ service stats {
   }
 }
 service managesieve-login {
-  inet_listener sieve {
+  #inet_listener sieve {}
-  }
+  process_min_avail = 1
-  process_min_avail = 0
+  process_limit = 1
-  service_count = 1
   vsz_limit = 64 M
 }
 service managesieve {
@@ -78,31 +113,53 @@ service managesieve {
 }
 
 protocol imap {
-   mail_plugins = $mail_plugins imap_sieve
+  mail_plugins = fts fts_flatcurve imap_sieve
   mail_max_userip_connections = 50
   imap_idle_notify_interval = 29 mins
 }
 protocol lmtp {
-   mail_plugins = $mail_plugins sieve
+  mail_plugins = fts fts_flatcurve sieve
 }
-protocol sieve {
+
-  plugin {
+# Persönliches Skript (deine alte Datei /var/vmail/sieve/%u.sieve)
-    sieve = /var/vmail/sieve/%u.sieve
+sieve_script personal {
-    sieve_storage = /var/vmail/sieve/%u/
+  driver      = file
-  }
+  # Verzeichnis mit (evtl. mehreren) Sieve-Skripten des Users
+  path        = /var/vmail/sieve/%{user}/
+  # Aktives Skript (entspricht früher "sieve = /var/vmail/sieve/%u.sieve")
+  active_path = /var/vmail/sieve/%{user}.sieve
+}
+
+# Globales After-Skript (dein früheres "sieve_after = …")
+sieve_script after {
+  type   = after
+  driver = file
+  path   = /var/vmail/sieve/global/spam-to-folder.sieve
 }
 
 # fulltext search
-plugin {
+language en {
-    fts = xapian
-    fts_xapian = partial=3 full=20 verbose=0
-    fts_autoindex = yes
-    fts_enforced = yes
-    # Index attachements
-    fts_decoder = decode2text
 }
+language de {
+  default = yes
+}
+language_tokenizers =  generic email-address
+
+fts flatcurve {
+  substring_search = yes
+  # rotate_count     = 5000   # DB-Rotation nach X Mails
+  # rotate_time      = 5s     # oder zeitbasiert rotieren
+  # optimize_limit   = 10
+  # min_term_size    = 3
+}
+
+fts_autoindex = yes
+fts_decoder_driver = script
+fts_decoder_script_socket_path = decode2text
+
 service indexer-worker {
-    vsz_limit = ${indexer_ram}
+  process_limit = ${indexer_cores}
+  vsz_limit = ${indexer_ram}M
 }
 service decode2text {
     executable = script /usr/local/libexec/dovecot/decode2text.sh
@@ -112,24 +169,39 @@ service decode2text {
     }
 }
 
-# spam filter
+mailbox Junk {
-plugin {
+  sieve_script learn_spam {
-  sieve_plugins = sieve_imapsieve sieve_extprograms
+    driver = file
-  sieve_dir = /var/vmail/sieve/%u/
+    type   = before
-  sieve = /var/vmail/sieve/%u.sieve
+    cause  = copy
-  sieve_pipe_bin_dir = /var/vmail/sieve/bin
+    path   = /var/vmail/sieve/global/learn-spam.sieve
-  sieve_extensions = +vnd.dovecot.pipe
+  }
-
-  sieve_after = /var/vmail/sieve/global/spam-to-folder.sieve
-
-  # From elsewhere to Spam folder
-  imapsieve_mailbox1_name = Junk
-  imapsieve_mailbox1_causes = COPY
-  imapsieve_mailbox1_before = file:/var/vmail/sieve/global/learn-spam.sieve
-
-  # From Spam folder to elsewhere
-  imapsieve_mailbox2_name = *
-  imapsieve_mailbox2_from = Junk
-  imapsieve_mailbox2_causes = COPY
-  imapsieve_mailbox2_before = file:/var/vmail/sieve/global/learn-ham.sieve
 }
+
+imapsieve_from Junk {
+  sieve_script learn_ham {
+    driver = file
+    type   = before
+    cause  = copy
+    path   = /var/vmail/sieve/global/learn-ham.sieve
+  }
+}
+
+# Extprograms-Plugin einschalten
+sieve_plugins {
+  sieve_extprograms = yes
+}
+
+# Welche Sieve-Erweiterungen dürfen genutzt werden?
+# Empfehlung: nur global erlauben (nicht in User-Skripten):
+sieve_global_extensions {
+  vnd.dovecot.pipe = yes
+  # vnd.dovecot.filter = yes      # nur falls gebraucht
+  # vnd.dovecot.execute = yes     # nur falls gebraucht
+}
+
+# Verzeichnis mit deinen Skripten/Binaries für :pipe
+sieve_pipe_bin_dir = /var/vmail/sieve/bin
+# (optional, analog für :filter / :execute)
+# sieve_filter_bin_dir  = /var/vmail/sieve/filter
+# sieve_execute_bin_dir = /var/vmail/sieve/execute

bundles/dovecot/items.py

@@ -44,6 +44,16 @@ files = {
         'context': {
             'admin_email': node.metadata.get('mailserver/admin_email'),
             'indexer_ram': node.metadata.get('dovecot/indexer_ram'),
+            'config_version': node.metadata.get('dovecot/config_version'),
+            'storage_version': node.metadata.get('dovecot/storage_version'),
+            'maildir': node.metadata.get('mailserver/maildir'),
+            'hostname': node.metadata.get('mailserver/hostname'),
+            'db_host': node.metadata.get('mailserver/database/host'),
+            'db_name': node.metadata.get('mailserver/database/name'),
+            'db_user': node.metadata.get('mailserver/database/user'),
+            'db_password': node.metadata.get('mailserver/database/password'),
+            'indexer_cores': node.metadata.get('vm/cores'),
+            'indexer_ram': node.metadata.get('vm/ram')//2,
         },
         'needs': {
             'pkg_apt:'
@@ -52,29 +62,9 @@ files = {
             'svc_systemd:dovecot:restart',
         },
     },
-    '/etc/dovecot/dovecot-sql.conf': {
-        'content_type': 'mako',
-        'context': node.metadata.get('mailserver/database'),
-        'needs': {
-            'pkg_apt:'
-        },
-        'triggers': {
-            'svc_systemd:dovecot:restart',
-        },
-    },
     '/etc/dovecot/dhparam.pem': {
         'content_type': 'any',
     },
-    '/etc/dovecot/dovecot-sql.conf': {
-        'content_type': 'mako',
-        'context': node.metadata.get('mailserver/database'),
-        'needs': {
-            'pkg_apt:'
-        },
-        'triggers': {
-            'svc_systemd:dovecot:restart',
-        },
-    },
     '/var/vmail/sieve/global/spam-to-folder.sieve': {
         'owner': 'vmail',
         'group': 'vmail',
@@ -131,7 +121,6 @@ svc_systemd = {
             'action:letsencrypt_update_certificates',
             'action:dovecot_generate_dhparam',
             'file:/etc/dovecot/dovecot.conf',
-            'file:/etc/dovecot/dovecot-sql.conf',
         },
     },
 }

bundles/dovecot/metadata.py

@@ -8,7 +8,7 @@ defaults = {
             'dovecot-sieve':        {},
             'dovecot-managesieved': {},
             # fulltext search
-            'dovecot-fts-xapian':   {}, # buster-backports
+            'dovecot-flatcurve':    {}, # buster-backports
             'poppler-utils':        {}, # pdftotext
             'catdoc':               {}, # catdoc, catppt, xls2csv
         },

bundles/left4dead2/README.md

@@ -1,58 +1 @@
-https://developer.valvesoftware.com/wiki/List_of_L4D2_Cvars
+https://github.com/SirPlease/L4D2-Competitive-Rework/blob/master/Dedicated%20Server%20Install%20Guide/README.md
-
-Dead Center 	c1m1_hotel
-Dead Center 	c1m2_streets
-Dead Center 	c1m3_mall
-Dead Center 	c1m4_atrium
-Dark Carnival 	c2m1_highway
-Dark Carnival 	c2m2_fairgrounds
-Dark Carnival 	c2m3_coaster
-Dark Carnival 	c2m4_barns
-Dark Carnival 	c2m5_concert
-Swamp Fever 	c3m1_plankcountry
-Swamp Fever 	c3m2_swamp
-Swamp Fever 	c3m3_shantytown
-Swamp Fever 	c3m4_plantation
-Hard Rain 	c4m1_milltown_a
-Hard Rain 	c4m2_sugarmill_a
-Hard Rain 	c4m3_sugarmill_b
-Hard Rain 	c4m4_milltown_b
-Hard Rain 	c4m5_milltown_escape
-The Parish 	c5m1_waterfront_sndscape
-The Parish 	c5m1_waterfront
-The Parish 	c5m2_park
-The Parish 	c5m3_cemetery
-The Parish 	c5m4_quarter
-The Parish 	c5m5_bridge
-The Passing 	c6m1_riverbank
-The Passing 	c6m2_bedlam
-The Passing 	c6m3_port
-The Sacrifice 	c7m1_docks
-The Sacrifice 	c7m2_barge
-The Sacrifice 	c7m3_port
-No Mercy 	c8m1_apartment
-No Mercy 	c8m2_subway
-No Mercy 	c8m3_sewers
-No Mercy 	c8m4_interior
-No Mercy 	c8m5_rooftop
-Crash Course 	c9m1_alleys
-Crash Course 	c9m2_lots
-Death Toll 	c10m1_caves
-Death Toll 	c10m2_drainage
-Death Toll 	c10m3_ranchhouse
-Death Toll 	c10m4_mainstreet
-Death Toll 	c10m5_houseboat
-Dead Air 	c11m1_greenhouse
-Dead Air 	c11m2_offices
-Dead Air 	c11m3_garage
-Dead Air 	c11m4_terminal
-Dead Air 	c11m5_runway
-Blood Harvest 	c12m1_hilltop
-Blood Harvest 	c12m2_traintunnel
-Blood Harvest 	c12m3_bridge
-Blood Harvest 	c12m4_barn
-Blood Harvest 	c12m5_cornfield
-Cold Stream 	c13m1_alpinecreek
-Cold Stream 	c13m2_southpinestream
-Cold Stream 	c13m3_memorialbridge
-Cold Stream 	c13m4_cutthroatcreek

bundles/left4dead2/files/setup

@@ -0,0 +1,96 @@
+#!/bin/bash
+
+set -xeuo pipefail
+
+getent passwd steam >/dev/null || useradd -M -d /opt/l4d2 -s /bin/bash steam
+mkdir -p /opt/l4d2 /tmp/dumps
+chown steam:steam /opt/l4d2 /tmp/dumps
+dpkg --add-architecture i386
+apt update
+DEBIAN_FRONTEND=noninteractive apt install -y libc6:i386 lib32z1
+
+function steam() {
+    # für systemd, damit es den prozess beenden kann
+    setpriv --reuid=steam --regid=steam --init-groups "$@"
+    export HOME=/opt/l4d2/steam
+}
+
+# -- STEAM -- #
+
+steam mkdir -p /opt/l4d2/steam
+test -f /opt/l4d2/steam/steamcmd_linux.tar.gz || \
+  steam wget http://media.steampowered.com/installer/steamcmd_linux.tar.gz -P /opt/l4d2/steam
+test -f /opt/l4d2/steam/steamcmd.sh || \
+  steam tar -xvzf /opt/l4d2/steam/steamcmd_linux.tar.gz -C /opt/l4d2/steam
+
+# fix for: /opt/l4d2/.steam/sdk32/steamclient.so: cannot open shared object file: No such file or directory
+steam mkdir -p /opt/l4d2/steam/.steam # needs to be in steam users home dir
+readlink /opt/l4d2/steam/.steam/sdk32 | grep -q ^/opt/l4d2/steam/linux32$ || \
+  steam ln -sf /opt/l4d2/steam/linux32 /opt/l4d2/steam/.steam/sdk32
+readlink /opt/l4d2/steam/.steam/sdk64 | grep -q ^/opt/l4d2/steam/linux64$ || \
+  steam ln -sf /opt/l4d2/steam/linux64 /opt/l4d2/steam/.steam/sdk64
+
+# -- INSTALL -- #
+
+# erst die windows deps zu installieren scheint ein workaround für x64 zu sein?
+steam mkdir -p /opt/l4d2/installation
+steam /opt/l4d2/steam/steamcmd.sh \
+    +force_install_dir /opt/l4d2/installation \
+    +login anonymous \
+    +@sSteamCmdForcePlatformType windows \
+    +app_update 222860 validate \
+    +quit
+steam /opt/l4d2/steam/steamcmd.sh \
+    +force_install_dir /opt/l4d2/installation \
+    +login anonymous \
+    +@sSteamCmdForcePlatformType linux \
+    +app_update 222860 validate \
+    +quit
+
+# -- OVERLAYS -- #
+
+steam mkdir -p /opt/l4d2/overlays
+
+# workshop downloader
+test -f /opt/l4d2/steam-workshop-download || \
+    steam wget -4 https://git.sublimity.de/cronekorkn/steam-workshop-downloader/raw/branch/master/steam-workshop-download -P /opt/l4d2
+steam chmod +x /opt/l4d2/steam-workshop-download
+
+# -- OVERLAY PVE -- #
+
+steam mkdir -p /opt/l4d2/overlays/pve
+
+# server config
+steam mkdir -p /opt/l4d2/overlays/pve/left4dead2/cfg
+steam cat <<'EOF' > /opt/l4d2/overlays/pve/left4dead2/cfg/server.cfg
+motd_enabled 0
+
+sv_steamgroup "38347879"
+#sv_steamgroup_exclusive 0
+
+sv_minrate 60000
+sv_maxrate 0
+net_splitpacket_maxrate 60000
+
+#sv_cheats 1
+#sb_all_bot_game 1
+EOF
+
+# admin system
+steam mkdir -p /opt/l4d2/overlays/pve/left4dead2/addons
+test -f /opt/l4d2/overlays/pve/left4dead2/addons/2524204971.vpk || \
+    steam /opt/l4d2/steam-workshop-download 2524204971 --out /opt/l4d2/overlays/pve/left4dead2/addons
+steam mkdir -p "/opt/l4d2/overlays/pve/left4dead2/ems/admin system"
+steam echo "STEAM_1:0:12376499" > "/opt/l4d2/overlays/pve/left4dead2/ems/admin system/admins.txt"
+
+# ions vocalizer
+test -f /opt/l4d2/overlays/pve/left4dead2/addons/698857882.vpk || \
+    steam /opt/l4d2/steam-workshop-download 698857882 --out /opt/l4d2/overlays/pve/left4dead2/addons
+
+test -f /opt/l4d2/overlays/pve/left4dead2/addons/1575673903.vpk || \
+    steam /opt/l4d2/steam-workshop-download 1575673903 --out /opt/l4d2/overlays/pve/left4dead2/addons
+
+# -- SERVERS -- #
+
+#steam rm -rf /opt/l4d2/servers
+steam mkdir -p /opt/l4d2/servers

bundles/left4dead2/files/start

@@ -0,0 +1,28 @@
+#!/bin/bash
+
+set -xeuo pipefail
+
+name=$1
+overlay=$2
+port=$3
+
+function steam() {
+    # für systemd, damit es den prozess beenden kann
+    setpriv --reuid=steam --regid=steam --init-groups "$@"
+    export HOME=/opt/l4d2/steam
+}
+
+mountpoint -q "/opt/l4d2/servers/$name/merged" && umount "/opt/l4d2/servers/$name/merged"
+steam rm -rf "/opt/l4d2/servers/$name"
+
+steam mkdir -p \
+  "/opt/l4d2/servers/$name" \
+  "/opt/l4d2/servers/$name/work" \
+  "/opt/l4d2/servers/$name/upper" \
+  "/opt/l4d2/servers/$name/merged"
+
+mount -t overlay overlay \
+  -o "lowerdir=/opt/l4d2/overlays/$overlay:/opt/l4d2/installation,upperdir=/opt/l4d2/servers/$name/upper,workdir=/opt/l4d2/servers/$name/work" \
+  "/opt/l4d2/servers/$name/merged"
+
+steam "/opt/l4d2/servers/$name/merged/srcds_run" -norestart -pidfile "/opt/l4d2/servers/$name/pid" -game left4dead2 -ip 0.0.0.0 -port "$port" +hostname "Crone_$name" +map c1m1_hotel

bundles/left4dead2/items.py

@@ -1,122 +1,31 @@
-assert node.has_bundle('steam') and node.has_bundle('steam-workshop-download')
+files = {
-
+    '/opt/l4d2/setup': {
-directories = {
+        'mode': '755',
-    '/opt/steam/left4dead2-servers': {
-        'owner': 'steam',
-        'group': 'steam',
-        'mode': '0755',
-        'purge': True,
     },
-    # Current zfs doesnt support zfs upperdir. The support was added in October 2022. Move upperdir - unused anyway -
+    '/opt/l4d2/start': {
-    # to another dir. Also move workdir alongside it, as it has to be on same fs.
+        'mode': '755',
-    '/opt/steam-zfs-overlay-workarounds': {
-        'owner': 'steam',
-        'group': 'steam',
-        'mode': '0755',
-        'purge': True,
     },
 }
 
-# /opt/steam/steam/.steam/sdk32/steamclient.so: cannot open shared object file: No such file or directory
+svc_systemd = {
-symlinks = {
+    'left4dead2-initialize.service': {
-    '/opt/steam/steam/.steam/sdk32': {
+        'enabled': True,
-        'target': '/opt/steam/steam/linux32',
+        'running': None,
-        'owner': 'steam',
+        'needs': {
-        'group': 'steam',
+            'file:/usr/local/lib/systemd/system/left4dead2-initialize.service',
-    }
+        },
+    },
 }
 
-#
+for server_name in node.metadata.get('left4dead2').keys():
-# SERVERS
+    svc_systemd[f'left4dead2-{server_name}.service'] = {
-#
+        'enabled': True,
-
+        'running': True,
-for name, config in node.metadata.get('left4dead2/servers').items():
+        'tags': {
-
+            'left4dead2-servers',
-    #overlay
-    directories[f'/opt/steam/left4dead2-servers/{name}'] = {
-        'owner': 'steam',
-        'group': 'steam',
-    }
-    directories[f'/opt/steam-zfs-overlay-workarounds/{name}/upper'] = {
-        'owner': 'steam',
-        'group': 'steam',
-    }
-    directories[f'/opt/steam-zfs-overlay-workarounds/{name}/workdir'] = {
-        'owner': 'steam',
-        'group': 'steam',
-    }
-
-    # conf
-    files[f'/opt/steam/left4dead2-servers/{name}/left4dead2/cfg/server.cfg'] = {
-        'content_type': 'mako',
-        'source': 'server.cfg',
-        'context': {
-            'name': name,
-            'steamgroups': node.metadata.get('left4dead2/steamgroups'),
-            'rcon_password': config['rcon_password'],
         },
-        'owner': 'steam',
+        'needs': {
-        'group': 'steam',
+            'svc_systemd:left4dead2-initialize.service',
-        'triggers': [
+            f'file:/usr/local/lib/systemd/system/left4dead2-{server_name}.service',
-            f'svc_systemd:left4dead2-{name}.service:restart',
-        ],
         }
-
-    # service
-    svc_systemd[f'left4dead2-{name}.service'] = {
-        'needs': [
-            f'file:/opt/steam/left4dead2-servers/{name}/left4dead2/cfg/server.cfg',
-            f'file:/usr/local/lib/systemd/system/left4dead2-{name}.service',
-        ],
-    }
-
-    #
-    # ADDONS
-    #
-
-    # base
-    files[f'/opt/steam/left4dead2-servers/{name}/left4dead2/addons/readme.txt'] = {
-        'content_type': 'any',
-        'owner': 'steam',
-        'group': 'steam',
-    }
-    directories[f'/opt/steam/left4dead2-servers/{name}/left4dead2/addons'] = {
-        'owner': 'steam',
-        'group': 'steam',
-        'purge': True,
-        'triggers': [
-            f'svc_systemd:left4dead2-{name}.service:restart',
-        ],
-    }
-    for id in [
-        *config.get('workshop', []),
-        *node.metadata.get('left4dead2/workshop'),
-    ]:
-        files[f'/opt/steam/left4dead2-servers/{name}/left4dead2/addons/{id}.vpk'] = {
-            'content_type': 'any',
-            'owner': 'steam',
-            'group': 'steam',
-            'triggers': [
-                f'svc_systemd:left4dead2-{name}.service:restart',
-            ],
-        }
-
-    # admin system
-
-    directories[f'/opt/steam/left4dead2-servers/{name}/left4dead2/ems/admin system'] = {
-        'owner': 'steam',
-        'group': 'steam',
-        'mode': '0755',
-        'triggers': [
-            f'svc_systemd:left4dead2-{name}.service:restart',
-        ],
-    }
-    files[f'/opt/steam/left4dead2-servers/{name}/left4dead2/ems/admin system/admins.txt'] = {
-        'owner': 'steam',
-        'group': 'steam',
-        'mode': '0755',
-        'content': '\n'.join(sorted(node.metadata.get('left4dead2/admins'))),
-        'triggers': [
-            f'svc_systemd:left4dead2-{name}.service:restart',
-        ],
     }

bundles/left4dead2/metadata.py

@@ -1,102 +1,68 @@
-assert node.has_bundle('steam')
+from re import match
 
-from shlex import quote
 
 defaults = {
-    'steam': {
+    'apt': {
-        'games': {
+        'packages': {
-            'left4dead2': 222860,
+            'libc6_i386': {}, # installs libc6:i386
+            'lib32z1': {},
+            'unzip': {},
+        },
+    },
+    'left4dead2': {},
+    'nftables': {
+        'input': {
+            'udp dport { 27005, 27020 } accept',
+        },
+    },
+    'systemd': {
+        'units': {
+            'left4dead2-initialize.service': {
+                'Unit': {
+                    'Description': 'initialize left4dead2',
+                    'After': 'network-online.target',
+                },
+                'Service': {
+                    'Type': 'oneshot',
+                    'RemainAfterExit': 'yes',
+                    'ExecStart': '/opt/l4d2/setup',
+                    'StandardOutput': 'journal',
+                    'StandardError': 'journal',
+                },
+                'Install': {
+                    'WantedBy': {'multi-user.target'},
+                },
             },
         },
-    'left4dead2': {
-        'servers': {},
-        'admins': set(),
-        'workshop': set(),
     },
 }
 
 
 @metadata_reactor.provides(
-    'left4dead2/servers',
-)
-def rconn_password(metadata):
-    # only works from localhost!
-    return {
-        'left4dead2': {
-            'servers': {
-                server: {
-                    'rcon_password': repo.vault.password_for(f'{node.name} left4dead2 {server} rcon', length=24),
-                }
-                    for server in metadata.get('left4dead2/servers')
-            },
-        },
-    }
-
-
-@metadata_reactor.provides(
-    'steam-workshop-download',
     'systemd/units',
 )
 def server_units(metadata):
     units = {}
-    workshop = {}
 
-    for name, config in metadata.get('left4dead2/servers').items():
+    for name, config in metadata.get('left4dead2').items():
-        # mount overlay
+        assert match(r'^[A-z0-9-_-]+$', name)
-        mountpoint = f'/opt/steam/left4dead2-servers/{name}'
+        assert config["overlay"] in {'pve'}
-        mount_unit_name = mountpoint[1:].replace('-', '\\x2d').replace('/', '-') + '.mount'
+        assert 27000 <= config["port"] <= 27100
-        units[mount_unit_name] = {
-            'Unit': {
-                'Description': f"Mount left4dead2 server {name} overlay",
-                'Conflicts': {'umount.target'},
-                'Before': {'umount.target'},
-            },
-            'Mount': {
-                'What': 'overlay',
-                'Where': mountpoint,
-                'Type': 'overlay',
-                'Options': ','.join([
-                    'auto',
-                    'lowerdir=/opt/steam/left4dead2',
-                    f'upperdir=/opt/steam-zfs-overlay-workarounds/{name}/upper',
-                    f'workdir=/opt/steam-zfs-overlay-workarounds/{name}/workdir',
-                ]),
-            },
-            'Install': {
-                'RequiredBy': {
-                    f'left4dead2-{name}.service',
-                },
-            },
-        }
 
-        # individual workshop
-        workshop_ids = config.get('workshop', set()) | metadata.get('left4dead2/workshop', set())
-        if  workshop_ids:
-            workshop[f'left4dead2-{name}'] = {
-                'ids': workshop_ids,
-                'path': f'/opt/steam/left4dead2-servers/{name}/left4dead2/addons',
-                'user': 'steam',
-                'requires': {
-                    mount_unit_name,
-                },
-                'required_by': {
-                    f'left4dead2-{name}.service',
-                },
-            }
-
-        # left4dead2 server unit
         units[f'left4dead2-{name}.service'] = {
             'Unit': {
                 'Description': f'left4dead2 server {name}',
-                'After': {'steam-update.service'},
+                'After': {'left4dead2-initialize.service'},
-                'Requires': {'steam-update.service'},
+                'Requires': {'left4dead2-initialize.service'},
             },
             'Service': {
-                'User': 'steam',
+                'Type': 'simple',
-                'Group': 'steam',
+                'ExecStart': f'/opt/l4d2/start {name} {config["overlay"]} {config["port"]}',
-                'WorkingDirectory': f'/opt/steam/left4dead2-servers/{name}',
-                'ExecStart': f'/opt/steam/left4dead2-servers/{name}/srcds_run -port {config["port"]} +exec server.cfg',
                 'Restart': 'on-failure',
+                'Nice': -10,
+                'CPUWeight': 200,
+                'IOSchedulingClass': 'best-effort',
+                'IOSchedulingPriority': 0,
             },
             'Install': {
                 'WantedBy': {'multi-user.target'},
@@ -104,7 +70,6 @@ def server_units(metadata):
         }
 
     return {
-        'steam-workshop-download': workshop,
         'systemd': {
             'units': units,
         },
@@ -114,14 +79,13 @@ def server_units(metadata):
 @metadata_reactor.provides(
     'nftables/input',
 )
-def firewall(metadata):
+def nftables(metadata):
-    ports = set(str(server['port']) for server in metadata.get('left4dead2/servers').values())
+    ports = sorted(str(config["port"]) for config in metadata.get('left4dead2', {}).values())
 
     return {
         'nftables': {
             'input': {
-                f"tcp dport {{ {', '.join(sorted(ports))} }} accept",
+                f'ip protocol {{ tcp, udp }} th dport {{ {", ".join(ports)} }} accept'
-                f"udp dport {{ {', '.join(sorted(ports))} }} accept",
             },
         },
     }

bundles/left4dead2_old/README.md

@@ -0,0 +1,58 @@
+https://developer.valvesoftware.com/wiki/List_of_L4D2_Cvars
+
+Dead Center 	c1m1_hotel
+Dead Center 	c1m2_streets
+Dead Center 	c1m3_mall
+Dead Center 	c1m4_atrium
+Dark Carnival 	c2m1_highway
+Dark Carnival 	c2m2_fairgrounds
+Dark Carnival 	c2m3_coaster
+Dark Carnival 	c2m4_barns
+Dark Carnival 	c2m5_concert
+Swamp Fever 	c3m1_plankcountry
+Swamp Fever 	c3m2_swamp
+Swamp Fever 	c3m3_shantytown
+Swamp Fever 	c3m4_plantation
+Hard Rain 	c4m1_milltown_a
+Hard Rain 	c4m2_sugarmill_a
+Hard Rain 	c4m3_sugarmill_b
+Hard Rain 	c4m4_milltown_b
+Hard Rain 	c4m5_milltown_escape
+The Parish 	c5m1_waterfront_sndscape
+The Parish 	c5m1_waterfront
+The Parish 	c5m2_park
+The Parish 	c5m3_cemetery
+The Parish 	c5m4_quarter
+The Parish 	c5m5_bridge
+The Passing 	c6m1_riverbank
+The Passing 	c6m2_bedlam
+The Passing 	c6m3_port
+The Sacrifice 	c7m1_docks
+The Sacrifice 	c7m2_barge
+The Sacrifice 	c7m3_port
+No Mercy 	c8m1_apartment
+No Mercy 	c8m2_subway
+No Mercy 	c8m3_sewers
+No Mercy 	c8m4_interior
+No Mercy 	c8m5_rooftop
+Crash Course 	c9m1_alleys
+Crash Course 	c9m2_lots
+Death Toll 	c10m1_caves
+Death Toll 	c10m2_drainage
+Death Toll 	c10m3_ranchhouse
+Death Toll 	c10m4_mainstreet
+Death Toll 	c10m5_houseboat
+Dead Air 	c11m1_greenhouse
+Dead Air 	c11m2_offices
+Dead Air 	c11m3_garage
+Dead Air 	c11m4_terminal
+Dead Air 	c11m5_runway
+Blood Harvest 	c12m1_hilltop
+Blood Harvest 	c12m2_traintunnel
+Blood Harvest 	c12m3_bridge
+Blood Harvest 	c12m4_barn
+Blood Harvest 	c12m5_cornfield
+Cold Stream 	c13m1_alpinecreek
+Cold Stream 	c13m2_southpinestream
+Cold Stream 	c13m3_memorialbridge
+Cold Stream 	c13m4_cutthroatcreek

bundles/left4dead2_old/items.py

@@ -0,0 +1,122 @@
+assert node.has_bundle('steam') and node.has_bundle('steam-workshop-download')
+
+directories = {
+    '/opt/steam/left4dead2-servers': {
+        'owner': 'steam',
+        'group': 'steam',
+        'mode': '0755',
+        'purge': True,
+    },
+    # Current zfs doesnt support zfs upperdir. The support was added in October 2022. Move upperdir - unused anyway -
+    # to another dir. Also move workdir alongside it, as it has to be on same fs.
+    '/opt/steam-zfs-overlay-workarounds': {
+        'owner': 'steam',
+        'group': 'steam',
+        'mode': '0755',
+        'purge': True,
+    },
+}
+
+# /opt/steam/steam/.steam/sdk32/steamclient.so: cannot open shared object file: No such file or directory
+symlinks = {
+    '/opt/steam/steam/.steam/sdk32': {
+        'target': '/opt/steam/steam/linux32',
+        'owner': 'steam',
+        'group': 'steam',
+    }
+}
+
+#
+# SERVERS
+#
+
+for name, config in node.metadata.get('left4dead2/servers').items():
+
+    #overlay
+    directories[f'/opt/steam/left4dead2-servers/{name}'] = {
+        'owner': 'steam',
+        'group': 'steam',
+    }
+    directories[f'/opt/steam-zfs-overlay-workarounds/{name}/upper'] = {
+        'owner': 'steam',
+        'group': 'steam',
+    }
+    directories[f'/opt/steam-zfs-overlay-workarounds/{name}/workdir'] = {
+        'owner': 'steam',
+        'group': 'steam',
+    }
+
+    # conf
+    files[f'/opt/steam/left4dead2-servers/{name}/left4dead2/cfg/server.cfg'] = {
+        'content_type': 'mako',
+        'source': 'server.cfg',
+        'context': {
+            'name': name,
+            'steamgroups': node.metadata.get('left4dead2/steamgroups'),
+            'rcon_password': config['rcon_password'],
+        },
+        'owner': 'steam',
+        'group': 'steam',
+        'triggers': [
+            f'svc_systemd:left4dead2-{name}.service:restart',
+        ],
+    }
+
+    # service
+    svc_systemd[f'left4dead2-{name}.service'] = {
+        'needs': [
+            f'file:/opt/steam/left4dead2-servers/{name}/left4dead2/cfg/server.cfg',
+            f'file:/usr/local/lib/systemd/system/left4dead2-{name}.service',
+        ],
+    }
+
+    #
+    # ADDONS
+    #
+
+    # base
+    files[f'/opt/steam/left4dead2-servers/{name}/left4dead2/addons/readme.txt'] = {
+        'content_type': 'any',
+        'owner': 'steam',
+        'group': 'steam',
+    }
+    directories[f'/opt/steam/left4dead2-servers/{name}/left4dead2/addons'] = {
+        'owner': 'steam',
+        'group': 'steam',
+        'purge': True,
+        'triggers': [
+            f'svc_systemd:left4dead2-{name}.service:restart',
+        ],
+    }
+    for id in [
+        *config.get('workshop', []),
+        *node.metadata.get('left4dead2/workshop'),
+    ]:
+        files[f'/opt/steam/left4dead2-servers/{name}/left4dead2/addons/{id}.vpk'] = {
+            'content_type': 'any',
+            'owner': 'steam',
+            'group': 'steam',
+            'triggers': [
+                f'svc_systemd:left4dead2-{name}.service:restart',
+            ],
+        }
+
+    # admin system
+
+    directories[f'/opt/steam/left4dead2-servers/{name}/left4dead2/ems/admin system'] = {
+        'owner': 'steam',
+        'group': 'steam',
+        'mode': '0755',
+        'triggers': [
+            f'svc_systemd:left4dead2-{name}.service:restart',
+        ],
+    }
+    files[f'/opt/steam/left4dead2-servers/{name}/left4dead2/ems/admin system/admins.txt'] = {
+        'owner': 'steam',
+        'group': 'steam',
+        'mode': '0755',
+        'content': '\n'.join(sorted(node.metadata.get('left4dead2/admins'))),
+        'triggers': [
+            f'svc_systemd:left4dead2-{name}.service:restart',
+        ],
+    }

bundles/left4dead2_old/metadata.py

@@ -0,0 +1,127 @@
+assert node.has_bundle('steam')
+
+from shlex import quote
+
+defaults = {
+    'steam': {
+        'games': {
+            'left4dead2': 222860,
+        },
+    },
+    'left4dead2': {
+        'servers': {},
+        'admins': set(),
+        'workshop': set(),
+    },
+}
+
+
+@metadata_reactor.provides(
+    'left4dead2/servers',
+)
+def rconn_password(metadata):
+    # only works from localhost!
+    return {
+        'left4dead2': {
+            'servers': {
+                server: {
+                    'rcon_password': repo.vault.password_for(f'{node.name} left4dead2 {server} rcon', length=24),
+                }
+                    for server in metadata.get('left4dead2/servers')
+            },
+        },
+    }
+
+
+@metadata_reactor.provides(
+    'steam-workshop-download',
+    'systemd/units',
+)
+def server_units(metadata):
+    units = {}
+    workshop = {}
+
+    for name, config in metadata.get('left4dead2/servers').items():
+        # mount overlay
+        mountpoint = f'/opt/steam/left4dead2-servers/{name}'
+        mount_unit_name = mountpoint[1:].replace('-', '\\x2d').replace('/', '-') + '.mount'
+        units[mount_unit_name] = {
+            'Unit': {
+                'Description': f"Mount left4dead2 server {name} overlay",
+                'Conflicts': {'umount.target'},
+                'Before': {'umount.target'},
+            },
+            'Mount': {
+                'What': 'overlay',
+                'Where': mountpoint,
+                'Type': 'overlay',
+                'Options': ','.join([
+                    'auto',
+                    'lowerdir=/opt/steam/left4dead2',
+                    f'upperdir=/opt/steam-zfs-overlay-workarounds/{name}/upper',
+                    f'workdir=/opt/steam-zfs-overlay-workarounds/{name}/workdir',
+                ]),
+            },
+            'Install': {
+                'RequiredBy': {
+                    f'left4dead2-{name}.service',
+                },
+            },
+        }
+
+        # individual workshop
+        workshop_ids = config.get('workshop', set()) | metadata.get('left4dead2/workshop', set())
+        if  workshop_ids:
+            workshop[f'left4dead2-{name}'] = {
+                'ids': workshop_ids,
+                'path': f'/opt/steam/left4dead2-servers/{name}/left4dead2/addons',
+                'user': 'steam',
+                'requires': {
+                    mount_unit_name,
+                },
+                'required_by': {
+                    f'left4dead2-{name}.service',
+                },
+            }
+
+        # left4dead2 server unit
+        units[f'left4dead2-{name}.service'] = {
+            'Unit': {
+                'Description': f'left4dead2 server {name}',
+                'After': {'steam-update.service'},
+                'Requires': {'steam-update.service'},
+            },
+            'Service': {
+                'User': 'steam',
+                'Group': 'steam',
+                'WorkingDirectory': f'/opt/steam/left4dead2-servers/{name}',
+                'ExecStart': f'/opt/steam/left4dead2-servers/{name}/srcds_run -port {config["port"]} +exec server.cfg',
+                'Restart': 'on-failure',
+            },
+            'Install': {
+                'WantedBy': {'multi-user.target'},
+            },
+        }
+
+    return {
+        'steam-workshop-download': workshop,
+        'systemd': {
+            'units': units,
+        },
+    }
+
+
+@metadata_reactor.provides(
+    'nftables/input',
+)
+def firewall(metadata):
+    ports = set(str(server['port']) for server in metadata.get('left4dead2/servers').values())
+
+    return {
+        'nftables': {
+            'input': {
+                f"tcp dport {{ {', '.join(sorted(ports))} }} accept",
+                f"udp dport {{ {', '.join(sorted(ports))} }} accept",
+            },
+        },
+    }

bundles/left4dead2_old2/README.md

@@ -0,0 +1,97 @@
+# https://github.com/SirPlease/L4D2-Competitive-Rework/blob/master/Dedicated%20Server%20Install%20Guide/README.md
+
+getent passwd steam >/dev/null || useradd -M -d /opt/l4d2 -s /bin/bash steam
+mkdir -p /opt/l4d2 /tmp/dumps
+chown steam:steam /opt/l4d2 /tmp/dumps
+dpkg --add-architecture i386
+apt update
+DEBIAN_FRONTEND=noninteractive apt install -y libc6:i386 lib32z1
+
+function steam() { sudo -Hiu steam $* }
+
+# -- STEAM -- #
+
+steam mkdir -p /opt/l4d2/steam
+test -f /opt/l4d2/steam/steamcmd_linux.tar.gz || \
+  steam wget http://media.steampowered.com/installer/steamcmd_linux.tar.gz -P /opt/l4d2/steam
+test -f /opt/l4d2/steam/steamcmd.sh || \
+  steam tar -xvzf /opt/l4d2/steam/steamcmd_linux.tar.gz -C /opt/l4d2/steam
+
+# fix: /opt/l4d2/.steam/sdk32/steamclient.so: cannot open shared object file: No such file or directory
+steam mkdir -p /opt/l4d2/steam/.steam
+test -f /opt/l4d2/steam/.steam/sdk32/steamclient.so || \
+  steam ln -s /opt/l4d2/steam/linux32 /opt/l4d2/steam/.steam/sdk32
+
+# -- INSTALL -- #
+
+# erst die windows deps zu installieren scheint ein workaround für x64 zu sein?
+steam mkdir -p /opt/l4d2/installation
+steam /opt/l4d2/steam/steamcmd.sh \
+    +force_install_dir /opt/l4d2/installation \
+    +login anonymous \
+    +@sSteamCmdForcePlatformType windows \
+    +app_update 222860 validate \
+    +quit
+steam /opt/l4d2/steam/steamcmd.sh \
+    +force_install_dir /opt/l4d2/installation \
+    +login anonymous \
+    +@sSteamCmdForcePlatformType linux \
+    +app_update 222860 validate \
+    +quit
+
+# -- OVERLAYS -- #
+
+steam mkdir -p /opt/l4d2/overlays
+
+# workshop downloader
+steam wget -4 https://git.sublimity.de/cronekorkn/steam-workshop-downloader/raw/branch/master/steam-workshop-download -P /opt/l4d2
+steam chmod +x /opt/l4d2/steam-workshop-download
+
+# -- OVERLAY PVE -- #
+
+steam mkdir -p /opt/l4d2/overlays/pve
+
+# admin system
+steam mkdir -p /opt/l4d2/overlays/pve/left4dead2/addons
+steam /opt/l4d2/steam-workshop-download 2524204971 --out /opt/l4d2/overlays/pve/left4dead2/addons
+steam mkdir -p "/opt/l4d2/overlays/pve/left4dead2/ems/admin system"
+echo "STEAM_1:0:12376499" | steam tee "/opt/l4d2/overlays/pve/left4dead2/ems/admin system/admins.txt"
+
+# ions vocalizer
+steam /opt/l4d2/steam-workshop-download 698857882 --out /opt/l4d2/overlays/pve/left4dead2/addons
+
+# -- OVERLAY ZONEMOD -- #
+
+true
+
+# -- SERVERS -- #
+
+steam mkdir -p /opt/l4d2/servers
+
+# -- SERVER PVE1 -- #
+
+steam mkdir -p \
+  /opt/l4d2/servers/pve1 \
+  /opt/l4d2/servers/pve1/work \
+  /opt/l4d2/servers/pve1/upper \
+  /opt/l4d2/servers/pve1/merged
+
+mount -t overlay overlay \
+  -o lowerdir=/opt/l4d2/overlays/pve:/opt/l4d2/installation,upperdir=/opt/l4d2/servers/pve1/upper,workdir=/opt/l4d2/servers/pve1/work \
+  /opt/l4d2/servers/pve1/merged
+
+# run server
+steam cat <<'EOF' > /opt/l4d2/servers/pve1/merged/left4dead2/cfg/server.cfg
+hostname "CKNs Server"
+motd_enabled 0
+
+sv_steamgroup "38347879"
+#sv_steamgroup_exclusive 0
+
+sv_minrate 60000
+sv_maxrate 0
+net_splitpacket_maxrate 60000
+
+sv_hibernate_when_empty 0
+EOF
+steam /opt/l4d2/servers/pve1/merged/srcds_run -game left4dead2 -ip 0.0.0.0 -port 27015 +map c1m1_hotel

bundles/left4dead2_old2/items.py

@@ -0,0 +1,183 @@
+from shlex import quote
+
+
+def steam_run(cmd):
+    return f'su - steam -c {quote(cmd)}'
+
+
+users = {
+    'steam': {
+        'home': '/opt/steam',
+    },
+}
+
+directories = {
+    '/opt/steam': {
+        'owner': 'steam',
+        'group': 'steam',
+    },
+    '/opt/steam/.steam': {
+        'owner': 'steam',
+        'group': 'steam',
+    },
+    '/opt/left4dead2': {
+        'owner': 'steam',
+        'group': 'steam',
+    },
+    '/opt/left4dead2/left4dead2/ems/admin system': {
+        'owner': 'steam',
+        'group': 'steam',
+    },
+    '/opt/left4dead2/left4dead2/addons': {
+        'owner': 'steam',
+        'group': 'steam',
+    },
+    '/tmp/dumps': {
+        'owner': 'steam',
+        'group': 'steam',
+        'mode': '1770',
+    },
+}
+
+symlinks = {
+    '/opt/steam/.steam/sdk32': {
+        'target': '/opt/steam/linux32',
+        'owner': 'steam',
+        'group': 'steam',
+    },
+}
+
+files = {
+    '/opt/steam-workshop-download': {
+        'content_type': 'download',
+        'source': 'https://git.sublimity.de/cronekorkn/steam-workshop-downloader/raw/branch/master/steam-workshop-download',
+        'mode': '755',
+    },
+    '/opt/left4dead2/left4dead2/ems/admin system/admins.txt': {
+        'unless': 'test -f /opt/left4dead2/left4dead2/ems/admin system/admins.txt',
+        'content': 'STEAM_1:0:12376499',
+        'owner': 'steam',
+        'group': 'steam',
+    },
+}
+
+actions = {
+    'dpkg_add_architecture': {
+        'command': 'dpkg --add-architecture i386',
+        'unless': 'dpkg --print-foreign-architectures | grep -q i386',
+        'triggers': [
+            'action:apt_update',
+        ],
+        'needed_by': [
+            'pkg_apt:libc6_i386',
+        ],
+    },
+    'download_steam': {
+        'command': steam_run('wget http://media.steampowered.com/installer/steamcmd_linux.tar.gz -P /opt/steam'),
+        'unless':  steam_run('test -f /opt/steam/steamcmd_linux.tar.gz'),
+        'needs': {
+            'pkg_apt:libc6_i386',
+            'directory:/opt/steam',
+        }
+    },
+    'extract_steamcmd': {
+        'command': steam_run('tar -xvzf /opt/steam/steamcmd_linux.tar.gz -C /opt/steam'),
+        'unless': steam_run('test -f /opt/steam/steamcmd.sh'),
+        'needs': {
+            'action:download_steam',
+        }
+    },
+}
+
+for addon_id in [2524204971]:
+    actions[f'download-left4dead2-addon-{addon_id}'] = {
+        'command': steam_run(f'/opt/steam-workshop-download {addon_id} --out /opt/left4dead2/left4dead2/addons'),
+        'unless': steam_run(f'test -f /opt/left4dead2/left4dead2/addons/{addon_id}.vpk'),
+        'needs': {
+            'directory:/opt/left4dead2/left4dead2/addons',
+        },
+        'needed_by': {
+            'tag:left4dead2-servers',
+        },
+    }
+
+svc_systemd = {
+    'left4dead2-install.service': {
+        'enabled': True,
+        'running': False,
+        'needs': {
+            'file:/usr/local/lib/systemd/system/left4dead2-install.service',
+        },
+    },
+}
+
+for server_name, server_config in node.metadata.get('left4dead2/servers', {}).items():
+    svc_systemd[f'left4dead2-{server_name}.service'] = {
+        'enabled': True,
+        'running': True,
+        'tags': {
+            'left4dead2-servers',
+        },
+        'needs': {
+            'svc_systemd:left4dead2-install.service',
+            f'file:/usr/local/lib/systemd/system/left4dead2-{server_name}.service',
+        }
+    }
+
+
+
+# # https://github.com/SirPlease/L4D2-Competitive-Rework/blob/master/Dedicated%20Server%20Install%20Guide/README.md
+
+# mkdir /opt/steam /tmp/dumps
+# useradd -M -d /opt/steam -s /bin/bash steam
+# chown steam:steam /opt/steam /tmp/dumps
+# dpkg --add-architecture i386
+# apt update
+# apt install libc6:i386 lib32z1
+# sudo su - steam -s /bin/bash
+
+# #--------
+
+# wget http://media.steampowered.com/installer/steamcmd_linux.tar.gz
+# tar -xvzf steamcmd_linux.tar.gz
+
+# # fix: /opt/steam/.steam/sdk32/steamclient.so: cannot open shared object file: No such file or directory
+# mkdir /opt/steam/.steam && ln -s /opt/steam/linux32 /opt/steam/.steam/sdk32
+
+# # erst die windows deps zu installieren scheint ein workaround für x64 zu sein?
+# ./steamcmd.sh \
+#     +force_install_dir /opt/steam/left4dead2 \
+#     +login anonymous \
+#     +@sSteamCmdForcePlatformType windows \
+#     +app_update 222860 validate \
+#     +quit
+# ./steamcmd.sh \
+#     +force_install_dir /opt/steam/left4dead2 \
+#     +login anonymous \
+#     +@sSteamCmdForcePlatformType linux \
+#     +app_update 222860 validate \
+#     +quit
+
+# # download admin system
+# wget -4 https://git.sublimity.de/cronekorkn/steam-workshop-downloader/raw/branch/master/steam-workshop-download
+# chmod +x steam-workshop-download
+# ./steam-workshop-download 2524204971 --out /opt/steam/left4dead2/left4dead2/addons
+# mkdir -p "/opt/steam/left4dead2/left4dead2/ems/admin system"
+# echo "STEAM_1:0:12376499" > "/opt/steam/left4dead2/left4dead2/ems/admin system/admins.txt"
+
+# /opt/steam/left4dead2/srcds_run -game left4dead2 -ip 0.0.0.0 -port 27015 +map c1m1_hotel
+
+
+# cat <<'EOF' > /opt/steam/left4dead2/left4dead2/cfg/server.cfg
+# hostname "CKNs Server"
+# motd_enabled 0
+
+# sv_steamgroup "38347879"
+# #sv_steamgroup_exclusive 0
+
+# sv_minrate 60000
+# sv_maxrate 0
+# net_splitpacket_maxrate 60000
+
+# sv_hibernate_when_empty 0
+# EOF

bundles/left4dead2_old2/metadata.py

@@ -0,0 +1,107 @@
+from re import match
+
+defaults = {
+    'apt': {
+        'packages': {
+            'libc6_i386': {}, # installs libc6:i386
+            'lib32z1': {},
+            'unzip': {},
+        },
+    },
+    'left4dead2': {
+        'servers': {},
+    },
+    'nftables': {
+        'input': {
+            'udp dport { 27005, 27020 } accept',
+        },
+    },
+}
+
+
+@metadata_reactor.provides(
+    'nftables/input',
+)
+def nftables(metadata):
+    ports = sorted(str(config["port"]) for config in metadata.get('left4dead2/servers', {}).values())
+
+    return {
+        'nftables': {
+            'input': {
+                f'ip protocol {{ tcp, udp }} th dport {{ {", ".join(ports)} }} accept'
+            },
+        },
+    }
+
+
+@metadata_reactor.provides(
+    'systemd/units',
+)
+def initial_unit(metadata):
+    install_command = (
+        '/opt/steam/steamcmd.sh '
+        '+force_install_dir /opt/left4dead2 '
+        '+login anonymous '
+        '+@sSteamCmdForcePlatformType {platform} '
+        '+app_update 222860 validate '
+        '+quit '
+    )
+
+    return {
+        'systemd': {
+            'units': {
+                'left4dead2-install.service': {
+                    'Unit': {
+                        'Description': 'install or update left4dead2',
+                        'After': 'network-online.target',
+                    },
+                    'Service': {
+                        'Type': 'oneshot',
+                        'RemainAfterExit': 'yes',
+                        'User': 'steam',
+                        'Group': 'steam',
+                        'WorkingDirectory': '/opt/steam',
+                        'ExecStartPre': install_command.format(platform='windows'),
+                        'ExecStart': install_command.format(platform='linux'),
+                    },
+                    'Install': {
+                        'WantedBy': {'multi-user.target'},
+                    },
+                },
+            },
+        },
+    }
+
+
+@metadata_reactor.provides(
+    'systemd/units',
+)
+def server_units(metadata):
+    units = {}
+
+    for name, config in metadata.get('left4dead2/servers').items():
+        assert match(r'^[A-z0-9-_-]+$', name)
+
+        units[f'left4dead2-{name}.service'] = {
+            'Unit': {
+                'Description': f'left4dead2 server {name}',
+                'After': {'left4dead2-install.service'},
+                'Requires': {'left4dead2-install.service'},
+            },
+            'Service': {
+                'User': 'steam',
+                'Group': 'steam',
+                'WorkingDirectory': '/opt/left4dead2',
+                'ExecStart': f'/opt/left4dead2/srcds_run -port {config["port"]} +exec server_{name}.cfg',
+                'Restart': 'on-failure',
+            },
+            'Install': {
+                'WantedBy': {'multi-user.target'},
+            },
+        }
+
+    return {
+        'systemd': {
+            'units': units,
+        },
+    }

bundles/mailserver/metadata.py

@@ -32,10 +32,14 @@ defaults = {
             'tank/vmail': {
                 'mountpoint': '/var/vmail',
                 'compression': 'on',
+                'atime': 'off',
+                'recordsize': '16384',
             },
             'tank/vmail/index': {
                 'mountpoint': '/var/vmail/index',
                 'compression': 'on',
+                'atime': 'off',
+                'recordsize': '4096',
                 'com.sun:auto-snapshot': 'false',
                 'backup': False,
             },

bundles/redis/items.py

@@ -9,6 +9,7 @@ directories = {
     },
     '/var/lib/redis': {
         'owner': 'redis',
+        'group': 'redis',
         'mode': '0750',
         'needs': [
             'pkg_apt:redis-server',

bundles/roundcube/files/config.inc.php

@@ -7,18 +7,16 @@ $config['enable_installer'] = true;
 /* Local configuration for Roundcube Webmail */
 
 $config['db_dsnw'] = '${database['provider']}://${database['user']}:${database['password']}@${database['host']}/${database['name']}';
-$config['imap_host'] = 'localhost';
+$config['imap_host'] = 'ssl://${imap_host}';
+$config['imap_port'] = 993;
 $config['smtp_host'] = 'tls://localhost';
+$config['smtp_port'] = 587;
 $config['smtp_user'] = '%u';
 $config['smtp_pass'] = '%p';
+#$config['imap_debug'] = true;
+#$config['smtp_debug'] = true;
 $config['support_url'] = '';
 $config['des_key'] = '${des_key}';
 $config['product_name'] = '${product_name}';
 $config['plugins'] = array(${', '.join(f'"{plugin}"' for plugin in plugins)});
 $config['language'] = 'de_DE';
-$config['smtp_conn_options'] = array(
-   'ssl' => array(
-   'verify_peer' => false,
-   'verify_peer_name' => false,
-  ),
-);

bundles/roundcube/items.py

@@ -61,6 +61,7 @@ files['/opt/roundcube/config/config.inc.php'] = {
         'des_key': node.metadata.get('roundcube/des_key'),
         'database': node.metadata.get('roundcube/database'),
         'plugins': node.metadata.get('roundcube/plugins'),
+        'imap_host': node.metadata.get('mailserver/hostname'),
     },
     'needs': [
         'action:chown_roundcube',

bundles/steam/README.md

@@ -1,55 +0,0 @@
-# https://github.com/SirPlease/L4D2-Competitive-Rework/blob/master/Dedicated%20Server%20Install%20Guide/README.md
-
-mkdir /opt/steam /tmp/dumps
-useradd -M -d /opt/steam -s /bin/bash steam
-chown steam:steam /opt/steam /tmp/dumps
-dpkg --add-architecture i386
-apt update
-apt install libc6:i386 lib32z1
-sudo su - steam -s /bin/bash
-
-#--------
-
-wget http://media.steampowered.com/installer/steamcmd_linux.tar.gz
-tar -xvzf steamcmd_linux.tar.gz
-
-# fix: /opt/steam/.steam/sdk32/steamclient.so: cannot open shared object file: No such file or directory
-mkdir /opt/steam/.steam && ln -s /opt/steam/linux32 /opt/steam/.steam/sdk32
-
-# erst die windows deps zu installieren scheint ein workaround für x64 zu sein?
-./steamcmd.sh \
-    +force_install_dir /opt/steam/left4dead2 \
-    +login anonymous \
-    +@sSteamCmdForcePlatformType windows \
-    +app_update 222860 validate \
-    +quit
-./steamcmd.sh \
-    +force_install_dir /opt/steam/left4dead2 \
-    +login anonymous \
-    +@sSteamCmdForcePlatformType linux \
-    +app_update 222860 validate \
-    +quit
-
-# download admin system
-wget -4 https://git.sublimity.de/cronekorkn/steam-workshop-downloader/raw/branch/master/steam-workshop-download
-chmod +x steam-workshop-download
-./steam-workshop-download 2524204971 --out /opt/steam/left4dead2/left4dead2/addons
-mkdir -p "/opt/steam/left4dead2/left4dead2/ems/admin system"
-echo "STEAM_1:0:12376499" > "/opt/steam/left4dead2/left4dead2/ems/admin system/admins.txt"
-
-/opt/steam/left4dead2/srcds_run -game left4dead2 -ip 0.0.0.0 -port 27015 +map c1m1_hotel
-
-
-cat <<'EOF' > /opt/steam/left4dead2/left4dead2/cfg/server.cfg
-hostname "CKNs Server"
-motd_enabled 0
-
-sv_steamgroup "38347879"
-#sv_steamgroup_exclusive 0
-
-sv_minrate 60000
-sv_maxrate 0
-net_splitpacket_maxrate 60000
-
-sv_hibernate_when_empty 0
-EOF

bundles/systemd-swap/metadata.py

@@ -1,5 +1,5 @@
 defaults = {
-    'systemd-swap': 2*10**9,
+    'systemd-swap': 2*(2**30), # 2GiB
     'systemd': {
         'units': {
             'swapfile.swap': {

hass_get_temp.py

@@ -0,0 +1,30 @@
+#! /usr/bin/env python3
+
+import requests
+from datetime import datetime, timedelta, timezone
+
+BASE = "https://homeassistant.ckn.li"
+TOKEN = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiI1YjY0ZWE5N2FiMzM0NTQ0OGMyNjhmZTIxYzAxZTE1MSIsImlhdCI6MTc1NjAzOTAxNCwiZXhwIjoyMDcxMzk5MDE0fQ.X-sQli-NTpCjeXpn19zf-maPRDldkSeTuhKZua1k8uM"
+ENTITY = "sensor.hue_outdoor_motion_sensor_2_temperature"
+
+HEADERS = {
+    "Authorization": f"Bearer {TOKEN}",
+    "Content-Type": "application/json",
+}
+
+begin = datetime(2025, 7, 1, 0, 0, 0, tzinfo=timezone.utc)
+current = begin
+now = datetime.now(timezone.utc)
+
+while current < now:
+    current += timedelta(hours=1)
+    resp = requests.get(
+        f"{BASE}/api/history/period/{current.isoformat()}",
+        params={
+            "end_time": current.isoformat(),
+            "filter_entity_id": ENTITY
+        },
+        headers=HEADERS,
+        timeout=15,
+    )
+    print(current, resp.json())

nodes/home.bootshorn-laptop.py

@@ -1,5 +1,5 @@
 {
-    'hostname': '10.0.0.162',
+    'hostname': '10.0.0.150',
     'bundles': [
         'bootshorn',
         'systemd',
@@ -7,5 +7,13 @@
     ],
     'metadata': {
         'id': '25c6f3fd-0d32-42c3-aeb3-0147bc3937c7',
+        'network': {
+            'internal': {
+                'ipv4': '10.0.0.150/24',
+                'mac': 'd6:d8:61:33:f2:05',
+            },
+        },
     },
 }
+
+# rsync -avh --progress -e 'ssh -o "StrictHostKeyChecking no"' 10.0.0.150:/opt/bootshorn/recordings /hdd/bootshorn

nodes/home.homeassistant.py

@@ -33,6 +33,9 @@
 #     ssh-ed25519
 #     AAAAC3NzaC1lZDI1NTE5AAAAIJT9Spe+BYue7iiutl3rSf6PlU6dthHizyK+ZWnLodrA
 #     root@home.server
+#   - >-
+#     ssh-ed25519
+#     AAAAC3NzaC1lZDI1NTE5AAAAILMVroYmswD4tLk6iH+2tvQiyaMe42yfONDsPDIdFv6I ckn
 # sftp: true
 # compatibility_mode: false
 # allow_agent_forwarding: false

nodes/home.hue.py

@@ -1,6 +1,6 @@
 {
     'dummy': True,
-    'hostname': '10.0.2.100',
+    'hostname': '10.0.0.143',
     'groups': [
         'home',
     ],
@@ -8,13 +8,13 @@
         'id': '87879bc1-130f-4fca-a8d2-e1d93a794df4',
         'network': {
             'internal': {
-                'ipv4': '10.0.2.100/24',
+                'ipv4': '10.0.0.143/24',
                 'mac': '00:17:88:67:e7:f2',
             },
         },
         'dns': {
             'hue.ckn.li': {
-                'A': {'10.0.2.100'},
+                'A': {'10.0.0.143'},
             },
         },
     },

nodes/htz.mails.py

@@ -2,7 +2,7 @@
     'hostname': '49.12.184.229',
     'groups': [
         'backup',
-        'debian-12',
+        'debian-13',
         'hetzner-cloud',
         'mailserver',
         'monitored',
@@ -18,6 +18,7 @@
         #'nginx-rtmps',
         'wireguard',
         'zfs',
+        'systemd-swap',
     ],
     'metadata': {
         'id': 'ea29bdf0-0b47-4bf4-8346-67d60c9dc4ae',
@@ -34,6 +35,7 @@
                 'gateway6': 'fe80::1',
             }
         },
+        'systemd-swap': 4*2**30, # clamav alleine braucht 1,3G
         'bind': {
             'hostname': 'resolver.name',
             'acme_zone': 'acme.sublimity.de',
@@ -108,6 +110,10 @@
                 'elimu-kwanza.de',
             },
         },
+        'dovecot': {
+            'config_version': '2.4.1',
+            'storage_version': '2.4.1',
+        },
         'rspamd': {
             'hostname': 'rspamd.sublimity.de',
         },
@@ -162,9 +168,31 @@
         },
         'roundcube': {
             'product_name': 'Sublimity Mail',
-            'version': '1.6.7',
+            'version': '1.6.11',
             'installer': False,
         },
+        'sysctl': {
+            'net': {
+                'ipv4': {
+                    'ip_forward': 1,
+                    'conf': {
+                        'default': {
+                            'forwarding': 1,
+                        },
+                    },
+                },
+                'ipv6': {
+                    'conf': {
+                        'all': {
+                            'forwarding': 1,
+                        },
+                        'default': {
+                            'forwarding': 1,
+                        },
+                    },
+                },
+            },
+        },
         'vm': {
             'cores': 2,
             'ram': 4096,

nodes/ovh.secondary.py

@@ -7,6 +7,7 @@
     ],
     'bundles': [
         'wireguard',
+        'left4dead2',
     ],
     'metadata': {
         'id': 'd5080b1a-b310-48be-bd5a-02cfcecf0c90',
@@ -25,6 +26,20 @@
                 },
             },
         },
+        'left4dead2': {
+            'server1': {
+                'overlay': 'pve',
+                'port': 27015,
+            },
+            'server2': {
+                'overlay': 'pve',
+                'port': 27016,
+            },
+            'server3': {
+                'overlay': 'pve',
+                'port': 27017,
+            },
+        },
         'bind': {
             'master_node': 'htz.mails',
             'hostname': 'secondary.resolver.name',
@@ -46,11 +61,5 @@
                 },
             },
         },
-        'nftables': {
-            'input': {
-                'tcp dport 27015 accept',
-                'udp dport { 27005, 27015, 27020 } accept',
-            },
-        },
     },
 }