# greasewood-node-alpine.yaml — the leaner variant: Alpine + OpenRC.
#   limactl start greasewood-node-alpine.yaml     # build + provision (once)
#   limactl shell greasewood-node-alpine          # then join, see message below
#
# vs the Debian recipe (greasewood-node.yaml): ~0.8 GB less disk, a guest that
# idles ~100 MB instead of ~250 MB, and a 512MiB ceiling (vs 1GiB) bounding
# what the VM can ever pin on the host.
# The trade: OpenRC can't apply the systemd exec sandbox, so the daemon runs as
# unconfined root. See docs/macos.md.
vmType: "vz"

images:
  # Official Alpine cloud images, as pinned by Lima's own alpine template
  # (Lima ≥2.0 uses these, not the old alpine-lima ISOs). Alpine point-releases
  # move over time; refresh the block from Lima's current pin with:
  #   limactl template copy template:_images/alpine-3.23 -
- location: "https://dl-cdn.alpinelinux.org/alpine/v3.23/releases/cloud/nocloud_alpine-3.23.4-x86_64-uefi-cloudinit-r0.qcow2"
  arch: "x86_64"
  digest: "sha512:849196e26640b33fb1f106d46cebdf341c715f7f49363564eacece8097464b6af7041618e94c4eb1a006394663252a86c0fb3158fee5d0ffb094899730679a71"
- location: "https://dl-cdn.alpinelinux.org/alpine/v3.23/releases/cloud/nocloud_alpine-3.23.4-aarch64-uefi-cloudinit-r0.qcow2"
  arch: "aarch64"
  digest: "sha512:737b0eb365944ffcf6da477c059c105bbde222942fd5a8380c07db088365b18dbc60a0f2824ea9a3904d57e194e0d05a7074302c3ebc104d0aecb6ddc6ffd91c"

cpus: 1
memory: "256MiB"             # enough: the daemon idles ~85 MB, and the swapfile below
                             # (created before anything hungry runs) absorbs pip's
                             # install-time bursts without pinning host RAM for them
disk: "2GiB"                 # Alpine + Python + cryptography ~500 MB + the 512 MB swapfile

mounts: []                   # sealed node — the Mac's files are not exposed to a root daemon
containerd:
  system: false
  user: false
networks:                    # NAT is right (laptop dials out, keepalive=25 holds it) — but vzNAT, not
- vzNAT: true                # Lima's default user-mode net: the default has no IPv6, and v6-only peer
                             # endpoints would be undialable (symptom: "no handshake", nothing else wrong)

provision:
- mode: system
  script: |
    #!/bin/sh
    set -eu
    command -v gw >/dev/null 2>&1 && exit 0     # idempotent: skip on every reboot after the first
    # Swap FIRST: pip installing cryptography is the one memory-hungry moment
    # this VM ever has; 256 MiB RAM + this file covers it (and every upgrade).
    if [ ! -f /swapfile ]; then
        dd if=/dev/zero of=/swapfile bs=1M count=512 2>/dev/null
        chmod 600 /swapfile && mkswap /swapfile
        echo "/swapfile none swap sw 0 0" >> /etc/fstab
        rc-update -q add swap boot 2>/dev/null || true
        swapon -a
    fi
    apk add --no-cache wireguard-tools iproute2 nftables pipx
    # /usr/local/bin so `gw` is on PATH for interactive use. The OpenRC service
    # launches the daemon by its absolute interpreter path, so it needs no PATH.
    PIPX_HOME=/opt/pipx PIPX_BIN_DIR=/usr/local/bin pipx install greasewood
    # If pipx can't find a cryptography wheel (very old pip), add build deps:
    #   apk add gcc musl-dev python3-dev libffi-dev openssl-dev cargo

probes:
- description: "gw installed"
  script: |
    #!/bin/sh
    command -v gw >/dev/null 2>&1 || exit 1
  hint: "greasewood didn't install — limactl shell greasewood-node-alpine cat /var/log/messages"

message: |
  greasewood is installed; this node hasn't joined a mesh yet.
    on your anchor:  sudo gw invite --hostname {{.Name}}
    then here:       limactl shell {{.Name}} sudo gw join <token>
  join enrolls the node AND enables the OpenRC service (greasewood.<mesh>) at boot.
  manage it with:  sudo rc-service greasewood.<mesh> {status,restart}