Manage the portable stack with Rust and rootless Podman

1 files changed, 28 insertions, 0 deletions

diff --git a/infra/host-setup.sh b/infra/host-setup.sh
new file mode 100755
index 0000000..e73645b
--- /dev/null
+++ b/infra/host-setup.sh
@@ -0,0 +1,28 @@
+#!/bin/sh
+# Copyright (C) 2026 Doan Luu Duc Tai <doan@luuduct.ai>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+set -eu
+[ "$(id -u)" = 0 ] || { echo 'Run this script through sudo.' >&2; exit 1; }
+id ops >/dev/null
+apt-get update
+apt-get install -y --no-install-recommends podman uidmap passt slirp4netns fuse-overlayfs netavark aardvark-dns
+awk -F: '$1 == "ops" && $3 >= 65536 { found=1 } END { exit !found }' /etc/subuid
+awk -F: '$1 == "ops" && $3 >= 65536 { found=1 } END { exit !found }' /etc/subgid
+install -d -m 755 /etc/sysctl.d
+printf '%s\n' 'net.ipv4.ip_unprivileged_port_start=80' > /etc/sysctl.d/90-stack-rootless-ports.conf
+sysctl -p /etc/sysctl.d/90-stack-rootless-ports.conf
+loginctl enable-linger ops
+printf '%s\n' 'Podman prerequisites ready. Existing production services remain running.'