ce7cb702218693d08ea6d83464d2457c9250027c

services/oci-l4-relay-guest/image/artifacts

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ $# -ne 1 ]]; then
+  printf 'usage: %s OUTPUT_DIRECTORY\n' "$0" >&2
+  exit 2
+fi
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
+output_directory="$(realpath -m "$1")"
+temporary_directory="$(mktemp -d)"
+trap 'rm -rf "$temporary_directory"' EXIT
+vlagent_version=1.51.0
+vlagent_archive="vlutils-linux-arm64-v${vlagent_version}.tar.gz"
+vlagent_archive_sha256=6618825d0632bf0a145107a5c6a26e07513164d82157d03896507cb72a7be19c
+
+mkdir -p "$output_directory"
+GOCACHE="$temporary_directory/guest-cache" CGO_ENABLED=0 GOOS=linux GOARCH=arm64 \
+  go build -C "$root/services/oci-l4-relay-guest" -trimpath -ldflags='-s -w -buildid=' \
+  -o "$output_directory/oci-l4-relay-guest" .
+GOCACHE="$temporary_directory/admission-cache" CGO_ENABLED=0 GOOS=linux GOARCH=arm64 \
+  go build -C "$root/services/oci-l4-relay-guest" -trimpath -ldflags='-s -w -buildid=' \
+  -o "$output_directory/oci-l4-relay-admission" ./cmd/admission
+GOCACHE="$temporary_directory/smtp-deny-cache" CGO_ENABLED=0 GOOS=linux GOARCH=arm64 \
+  go build -C "$root/services/oci-l4-relay-guest" -trimpath -ldflags='-s -w -buildid=' \
+  -o "$output_directory/oci-l4-relay-smtp-deny" ./cmd/smtp-deny
+GOCACHE="$temporary_directory/smtp-evidence-cache" CGO_ENABLED=0 GOOS=linux GOARCH=arm64 \
+  go build -C "$root/services/oci-l4-relay-guest" -trimpath -ldflags='-s -w -buildid=' \
+  -o "$output_directory/oci-l4-relay-smtp-evidence" ./cmd/smtp-evidence
+curl -fsSL \
+  -o "$temporary_directory/$vlagent_archive" \
+  "https://github.com/VictoriaMetrics/VictoriaLogs/releases/download/v${vlagent_version}/${vlagent_archive}"
+printf '%s  %s\n' "$vlagent_archive_sha256" "$temporary_directory/$vlagent_archive" | sha256sum -c -
+tar -xzf "$temporary_directory/$vlagent_archive" -C "$temporary_directory" vlagent-prod
+install -m 0755 "$temporary_directory/vlagent-prod" "$output_directory/vlagent"
+
+guest_sha256="$(sha256sum "$output_directory/oci-l4-relay-guest" | awk '{print $1}')"
+admission_sha256="$(sha256sum "$output_directory/oci-l4-relay-admission" | awk '{print $1}')"
+smtp_deny_sha256="$(sha256sum "$output_directory/oci-l4-relay-smtp-deny" | awk '{print $1}')"
+smtp_evidence_sha256="$(sha256sum "$output_directory/oci-l4-relay-smtp-evidence" | awk '{print $1}')"
+vlagent_sha256="$(sha256sum "$output_directory/vlagent" | awk '{print $1}')"
+jq -n \
+  --arg admission_sha256 "$admission_sha256" \
+  --arg guest_sha256 "$guest_sha256" \
+  --arg smtp_deny_sha256 "$smtp_deny_sha256" \
+  --arg smtp_evidence_sha256 "$smtp_evidence_sha256" \
+  --arg vlagent_sha256 "$vlagent_sha256" \
+  --arg vlagent_version "$vlagent_version" \
+  '{admission_sha256:$admission_sha256,guest_sha256:$guest_sha256,smtp_deny_sha256:$smtp_deny_sha256,smtp_evidence_sha256:$smtp_evidence_sha256,vlagent_sha256:$vlagent_sha256,vlagent_version:$vlagent_version}' \
+  >"$output_directory/artifact-manifest.json"

services/oci-l4-relay-guest/image/create

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ $# -ne 1 ]]; then
+  printf 'usage: %s ARTIFACT_DIRECTORY\n' "$0" >&2
+  exit 2
+fi
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
+artifact_directory="$(realpath "$1")"
+template="$root/services/oci-l4-relay-guest/image/relay.pkr.hcl"
+image_directory="$root/services/oci-l4-relay-guest/image"
+terraform="$root/terraform/external/oci-relay"
+tofu="$root/scripts/tofu-pg-state"
+packer="${PACKER:-packer}"
+manifest="$artifact_directory/image-manifest.json"
+pending_manifest="$manifest.pending"
+
+command -v "$packer" >/dev/null
+command -v jq >/dev/null
+command -v uv >/dev/null
+command -v vault >/dev/null
+test ! -e "$manifest"
+test ! -e "$pending_manifest"
+for artifact in artifact-manifest.json oci-l4-relay-admission oci-l4-relay-guest oci-l4-relay-smtp-deny oci-l4-relay-smtp-evidence vlagent; do
+  test -f "$artifact_directory/$artifact"
+done
+
+credentials="$(vault kv get -format=json "${OCI_OPERATOR_API_VAULT_PATH:-secret/oci/operator-api}")"
+guest_sha256="$(jq -er '.guest_sha256' "$artifact_directory/artifact-manifest.json")"
+admission_sha256="$(jq -er '.admission_sha256' "$artifact_directory/artifact-manifest.json")"
+smtp_deny_sha256="$(jq -er '.smtp_deny_sha256' "$artifact_directory/artifact-manifest.json")"
+smtp_evidence_sha256="$(jq -er '.smtp_evidence_sha256' "$artifact_directory/artifact-manifest.json")"
+vlagent_sha256="$(jq -er '.vlagent_sha256' "$artifact_directory/artifact-manifest.json")"
+image_revision_sha256="$(
+  tar --create --file=- --sort=name --mtime='UTC 1970-01-01' --owner=0 --group=0 --numeric-owner \
+    --directory="$image_directory" provision.sh relay.pkr.hcl etc systemd |
+    sha256sum | awk '{print $1}'
+)"
+
+export PKR_VAR_admission_binary_path="$artifact_directory/oci-l4-relay-admission"
+export PKR_VAR_admission_sha256="$admission_sha256"
+export PKR_VAR_smtp_deny_binary_path="$artifact_directory/oci-l4-relay-smtp-deny"
+export PKR_VAR_smtp_deny_sha256="$smtp_deny_sha256"
+export PKR_VAR_smtp_evidence_binary_path="$artifact_directory/oci-l4-relay-smtp-evidence"
+export PKR_VAR_smtp_evidence_sha256="$smtp_evidence_sha256"
+export PKR_VAR_availability_domain="$("$tofu" -chdir="$terraform" output -raw availability_domain)"
+export PKR_VAR_base_image_ocid="$("$tofu" -chdir="$terraform" output -raw base_image_ocid)"
+export PKR_VAR_compartment_ocid="$("$tofu" -chdir="$terraform" output -raw compartment_id)"
+export PKR_VAR_guest_binary_path="$artifact_directory/oci-l4-relay-guest"
+export PKR_VAR_guest_sha256="$guest_sha256"
+export PKR_VAR_image_manifest_path="$manifest"
+export PKR_VAR_image_name="oci-l4-relay-${guest_sha256:0:12}-${admission_sha256:0:12}-${smtp_deny_sha256:0:12}-${smtp_evidence_sha256:0:12}-${vlagent_sha256:0:12}-${image_revision_sha256:0:12}"
+export PKR_VAR_image_revision_sha256="$image_revision_sha256"
+export PKR_VAR_network_security_group_ocid="$("$tofu" -chdir="$terraform" output -raw image_builder_network_security_group_id)"
+export PKR_VAR_operator_api_vault_path="${OCI_OPERATOR_API_VAULT_PATH:-secret/oci/operator-api}"
+export PKR_VAR_oci_fingerprint="$(jq -er '.data.data.fingerprint' <<<"$credentials")"
+export PKR_VAR_oci_private_key="$(jq -er '.data.data.private_key' <<<"$credentials")"
+export PKR_VAR_oci_region="$(jq -er '.data.data.region' <<<"$credentials")"
+export PKR_VAR_oci_tenancy_ocid="$(jq -er '.data.data.tenancy_ocid' <<<"$credentials")"
+export PKR_VAR_oci_user_ocid="$(jq -er '.data.data.user_ocid' <<<"$credentials")"
+export PKR_VAR_subnet_ocid="$("$tofu" -chdir="$terraform" output -raw relay_subnet_id)"
+export PKR_VAR_uv_cache_directory="$artifact_directory/.uv-cache"
+export PKR_VAR_uv_project_environment="$artifact_directory/.oci-image-venv"
+export PKR_VAR_vlagent_binary_path="$artifact_directory/vlagent"
+export PKR_VAR_vlagent_sha256="$vlagent_sha256"
+
+"$packer" init "$template"
+"$packer" validate "$template"
+"$packer" build "$template"

services/oci-l4-relay-guest/image/create_image.py

@@ -0,0 +1,113 @@
+import json
+import os
+import subprocess
+import time
+import uuid
+from pathlib import Path
+
+import oci
+
+
+def write_json(path: Path, value: dict) -> None:
+    temporary_path = path.with_suffix(f"{path.suffix}.{uuid.uuid4().hex}.tmp")
+    temporary_path.write_text(
+        json.dumps(value, indent=2, sort_keys=True) + "\n",
+        encoding="utf-8",
+    )
+    temporary_path.replace(path)
+
+
+def main() -> None:
+    if oci.__version__ != "2.160.3":
+        raise RuntimeError(f"unsupported OCI SDK version {oci.__version__}")
+
+    manifest_path = Path(os.environ["OCI_IMAGE_MANIFEST_PATH"])
+    pending_path = manifest_path.with_suffix(f"{manifest_path.suffix}.pending")
+    if manifest_path.exists() or pending_path.exists():
+        raise FileExistsError(f"image manifest already exists for {manifest_path}")
+
+    secret = json.loads(
+        subprocess.run(
+            [
+                "vault",
+                "kv",
+                "get",
+                "-format=json",
+                os.environ["OCI_OPERATOR_API_VAULT_PATH"],
+            ],
+            check=True,
+            capture_output=True,
+            text=True,
+        ).stdout
+    )["data"]["data"]
+    config = {
+        "region": secret["region"],
+        "tenancy": secret["tenancy_ocid"],
+        "user": secret["user_ocid"],
+        "fingerprint": secret["fingerprint"],
+        "key_file": "/dev/null",
+    }
+    signer = oci.signer.Signer(
+        secret["tenancy_ocid"],
+        secret["user_ocid"],
+        secret["fingerprint"],
+        None,
+        private_key_content=secret["private_key"],
+    )
+    client = oci.core.ComputeClient(config, signer=signer)
+    response = client.create_image(
+        oci.core.models.CreateImageDetails(
+            compartment_id=os.environ["OCI_IMAGE_COMPARTMENT_ID"],
+            display_name=os.environ["OCI_IMAGE_NAME"],
+            freeform_tags={
+                "managed-by": "packer",
+                "service": "oci-l4-relay",
+            },
+            instance_id=os.environ["OCI_IMAGE_INSTANCE_ID"],
+        )
+    )
+    run_uuid = str(uuid.uuid4())
+    build = {
+        "artifact_id": f"{secret['region']}:{response.data.id}",
+        "build_time": int(time.time()),
+        "builder_type": "oracle-oci",
+        "custom_data": {
+            "admission_sha256": os.environ["OCI_IMAGE_ADMISSION_SHA256"],
+            "base_image_ocid": os.environ["OCI_IMAGE_BASE_IMAGE_OCID"],
+            "guest_sha256": os.environ["OCI_IMAGE_GUEST_SHA256"],
+            "image_revision_sha256": os.environ["OCI_IMAGE_REVISION_SHA256"],
+            "smtp_deny_sha256": os.environ["OCI_IMAGE_SMTP_DENY_SHA256"],
+            "smtp_evidence_sha256": os.environ["OCI_IMAGE_SMTP_EVIDENCE_SHA256"],
+            "vlagent_sha256": os.environ["OCI_IMAGE_VLAGENT_SHA256"],
+        },
+        "name": "relay",
+        "packer_run_uuid": run_uuid,
+    }
+    write_json(
+        pending_path,
+        {
+            "builds": [build],
+            "last_run_uuid": run_uuid,
+            "lifecycle_state": response.data.lifecycle_state,
+        },
+    )
+    image = oci.wait_until(
+        client,
+        client.get_image(response.data.id),
+        "lifecycle_state",
+        "AVAILABLE",
+        max_wait_seconds=1800,
+    ).data
+    write_json(
+        manifest_path,
+        {
+            "builds": [build],
+            "last_run_uuid": run_uuid,
+            "lifecycle_state": image.lifecycle_state,
+        },
+    )
+    pending_path.unlink()
+
+
+if __name__ == "__main__":
+    main()

services/oci-l4-relay-guest/image/etc/100-oracle-cloud-agent-run-command

@@ -0,0 +1 @@
+ocarun ALL=(ALL) NOPASSWD:ALL

services/oci-l4-relay-guest/image/etc/journald@oci-l4-relay.conf

@@ -0,0 +1,7 @@
+[Journal]
+Storage=persistent
+Compress=yes
+Seal=yes
+SystemMaxUse=64M
+RuntimeMaxUse=16M
+MaxRetentionSec=7day

services/oci-l4-relay-guest/image/etc/modules-load.conf

@@ -0,0 +1 @@
+nf_conntrack

services/oci-l4-relay-guest/image/etc/nftables.conf

@@ -0,0 +1,20 @@
+flush ruleset
+table inet oci_l4_relay_web_allow {
+  counter web_allow_denied {}
+  chain ingress {
+    type filter hook prerouting priority raw - 20; policy accept;
+    fib daddr type local tcp dport { 80, 443, 465, 993 } counter name web_allow_denied drop
+  }
+}
+
+table inet oci_l4_relay_smtp_deny {
+  set denied_v4 {
+    type ipv4_addr
+    flags interval, timeout
+  }
+  counter smtp_denied {}
+  chain ingress {
+    type filter hook prerouting priority raw - 19; policy accept;
+    fib daddr type local tcp dport 25 ip saddr @denied_v4 counter name smtp_denied drop
+  }
+}

services/oci-l4-relay-guest/image/provision.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+dnf upgrade --assumeyes
+dnf install --assumeyes \
+  ca-certificates-2025.2.80_v9.0.305-102.el10_1 \
+  iproute-6.14.0-2.el10 \
+  iproute-tc-6.14.0-2.el10 \
+  nftables-1:1.1.1-9.el10_1 \
+  systemd-journal-remote-257-13.0.1.el10_1.3 \
+  wireguard-tools-1.0.20210914-6.el10
+getent group oci-l4-relay-logs >/dev/null || useradd --system --user-group --home-dir /nonexistent --shell /sbin/nologin oci-l4-relay-logs
+install -d -o root -g oci-l4-relay-logs -m 0710 /etc/oci-l4-relay
+install -d -m 0700 /var/lib/oci-l4-relay/web-allow
+install -d -m 0700 /var/lib/oci-l4-relay/smtp-deny
+install -m 0755 /tmp/oci-l4-relay-guest /usr/local/sbin/oci-l4-relay-guest
+install -m 0755 /tmp/oci-l4-relay-admission /usr/local/libexec/oci-l4-relay-admission
+install -m 0755 /tmp/oci-l4-relay-smtp-deny /usr/local/libexec/oci-l4-relay-smtp-deny
+install -m 0755 /tmp/oci-l4-relay-smtp-evidence /usr/local/libexec/oci-l4-relay-smtp-evidence
+install -m 0755 /tmp/vlagent /usr/local/bin/vlagent
+install -m 0600 /tmp/nftables.conf /etc/sysconfig/nftables.conf
+install -m 0644 /tmp/modules-load.conf /etc/modules-load.d/oci-l4-relay.conf
+install -m 0440 /tmp/100-oracle-cloud-agent-run-command /etc/sudoers.d/100-oracle-cloud-agent-run-command
+install -m 0644 /tmp/[email protected] /etc/systemd/[email protected]
+install -m 0644 /tmp/oci-l4-relay-bootstrap.service /etc/systemd/system/oci-l4-relay-bootstrap.service
+install -m 0644 /tmp/oci-l4-relay-admission.service /etc/systemd/system/oci-l4-relay-admission.service
+install -m 0644 /tmp/oci-l4-relay-admission.timer /etc/systemd/system/oci-l4-relay-admission.timer
+install -m 0644 /tmp/oci-l4-relay-smtp-deny.service /etc/systemd/system/oci-l4-relay-smtp-deny.service
+install -m 0644 /tmp/oci-l4-relay-smtp-deny.timer /etc/systemd/system/oci-l4-relay-smtp-deny.timer
+install -m 0644 /tmp/oci-l4-relay-smtp-evidence.service /etc/systemd/system/oci-l4-relay-smtp-evidence.service
+install -m 0644 /tmp/oci-l4-relay-journal-upload.service /etc/systemd/system/oci-l4-relay-journal-upload.service
+install -m 0644 /tmp/oci-l4-relay-log-credential.service /etc/systemd/system/oci-l4-relay-log-credential.service
+install -m 0644 /tmp/oci-l4-relay-log-credential.timer /etc/systemd/system/oci-l4-relay-log-credential.timer
+install -m 0644 /tmp/oci-l4-relay-logs.path /etc/systemd/system/oci-l4-relay-logs.path
+install -m 0644 /tmp/oci-l4-relay-logs.slice /etc/systemd/system/oci-l4-relay-logs.slice
+install -m 0644 /tmp/oci-l4-relay-logs.target /etc/systemd/system/oci-l4-relay-logs.target
+install -m 0644 /tmp/oci-l4-relay-telemetry.service /etc/systemd/system/oci-l4-relay-telemetry.service
+install -m 0644 /tmp/oci-l4-relay-telemetry.timer /etc/systemd/system/oci-l4-relay-telemetry.timer
+install -m 0644 /tmp/oci-l4-relay-vlagent.service /etc/systemd/system/oci-l4-relay-vlagent.service
+rpm -q ca-certificates iproute iproute-tc kernel-uek-core kernel-uek-modules nftables systemd-journal-remote wireguard-tools | sort > /usr/share/oci-l4-relay-package-manifest.txt
+sha256sum /usr/local/bin/vlagent /usr/local/sbin/oci-l4-relay-guest /usr/local/libexec/oci-l4-relay-admission /usr/local/libexec/oci-l4-relay-smtp-deny /usr/local/libexec/oci-l4-relay-smtp-evidence > /usr/share/oci-l4-relay-binary-manifest.txt
+systemd-analyze verify /etc/systemd/system/oci-l4-relay-*.service /etc/systemd/system/oci-l4-relay-*.timer /etc/systemd/system/oci-l4-relay-logs.path /etc/systemd/system/oci-l4-relay-logs.slice /etc/systemd/system/oci-l4-relay-logs.target
+systemctl disable firewalld.service dnf-makecache.timer
+systemctl mask sshd.service sshd.socket
+systemctl enable nftables.service oci-l4-relay-bootstrap.service oci-l4-relay-admission.timer oci-l4-relay-smtp-deny.timer oci-l4-relay-smtp-evidence.service oci-l4-relay-log-credential.timer oci-l4-relay-logs.path oci-l4-relay-telemetry.timer
+visudo -cf /etc/sudoers
+rm -f /root/.ssh/authorized_keys /home/opc/.ssh/authorized_keys
+cloud-init clean --logs --machine-id

services/oci-l4-relay-guest/image/pyproject.toml

@@ -0,0 +1,7 @@
+[project]
+name = "oci-l4-relay-image"
+version = "0.1.0"
+requires-python = ">=3.11"
+dependencies = [
+    "oci==2.160.3",
+]

services/oci-l4-relay-guest/image/relay.pkr.hcl

@@ -0,0 +1,227 @@
+packer {
+  required_plugins {
+    oracle = {
+      source  = "github.com/hashicorp/oracle"
+      version = "= 1.1.2"
+    }
+  }
+}
+
+variable "availability_domain" {
+  type = string
+}
+
+variable "base_image_ocid" {
+  type = string
+}
+
+variable "compartment_ocid" {
+  type = string
+}
+
+variable "image_name" {
+  type = string
+}
+
+variable "image_manifest_path" {
+  type = string
+}
+
+variable "guest_sha256" {
+  type = string
+}
+
+variable "admission_sha256" {
+  type = string
+}
+
+variable "vlagent_sha256" {
+  type = string
+}
+
+variable "image_revision_sha256" {
+  type = string
+}
+
+variable "admission_binary_path" {
+  type = string
+}
+
+variable "smtp_deny_binary_path" {
+  type = string
+}
+
+variable "smtp_deny_sha256" {
+  type = string
+}
+
+variable "smtp_evidence_binary_path" {
+  type = string
+}
+
+variable "smtp_evidence_sha256" {
+  type = string
+}
+
+variable "guest_binary_path" {
+  type = string
+}
+
+variable "vlagent_binary_path" {
+  type = string
+}
+
+variable "network_security_group_ocid" {
+  type = string
+}
+
+variable "operator_api_vault_path" {
+  type = string
+}
+
+variable "oci_fingerprint" {
+  type = string
+}
+
+variable "oci_private_key" {
+  type      = string
+  sensitive = true
+}
+
+variable "oci_region" {
+  type = string
+}
+
+variable "oci_tenancy_ocid" {
+  type = string
+}
+
+variable "oci_user_ocid" {
+  type = string
+}
+
+variable "subnet_ocid" {
+  type = string
+}
+
+variable "uv_cache_directory" {
+  type = string
+}
+
+variable "uv_project_environment" {
+  type = string
+}
+
+source "oracle-oci" "relay" {
+  availability_domain = var.availability_domain
+  base_image_ocid     = var.base_image_ocid
+  compartment_ocid    = var.compartment_ocid
+  create_vnic_details {
+    assign_public_ip = true
+    nsg_ids          = [var.network_security_group_ocid]
+  }
+  image_name                                          = var.image_name
+  instance_name                                       = "oci-l4-relay-image-builder"
+  instance_options_are_legacy_imds_endpoints_disabled = true
+  fingerprint                                         = var.oci_fingerprint
+  key                                                 = var.oci_private_key
+  region                                              = var.oci_region
+  shape                                               = "VM.Standard.A1.Flex"
+  shape_config {
+    memory_in_gbs = 4
+    ocpus         = 1
+  }
+  skip_create_image = true
+  ssh_username      = "opc"
+  subnet_ocid       = var.subnet_ocid
+  tenancy_ocid      = var.oci_tenancy_ocid
+  tags = {
+    managed-by = "packer"
+    service    = "oci-l4-relay"
+  }
+  user_ocid = var.oci_user_ocid
+}
+
+build {
+  sources = ["source.oracle-oci.relay"]
+
+  provisioner "file" {
+    source      = var.guest_binary_path
+    destination = "/tmp/oci-l4-relay-guest"
+  }
+
+  provisioner "file" {
+    source      = var.admission_binary_path
+    destination = "/tmp/oci-l4-relay-admission"
+  }
+
+  provisioner "file" {
+    source      = var.smtp_deny_binary_path
+    destination = "/tmp/oci-l4-relay-smtp-deny"
+  }
+
+  provisioner "file" {
+    source      = var.smtp_evidence_binary_path
+    destination = "/tmp/oci-l4-relay-smtp-evidence"
+  }
+
+  provisioner "file" {
+    source      = var.vlagent_binary_path
+    destination = "/tmp/vlagent"
+  }
+
+  provisioner "file" {
+    source      = "${path.root}/etc/nftables.conf"
+    destination = "/tmp/nftables.conf"
+  }
+
+  provisioner "file" {
+    source      = "${path.root}/etc/modules-load.conf"
+    destination = "/tmp/modules-load.conf"
+  }
+
+  provisioner "file" {
+    source      = "${path.root}/etc/100-oracle-cloud-agent-run-command"
+    destination = "/tmp/100-oracle-cloud-agent-run-command"
+  }
+
+  provisioner "file" {
+    source      = "${path.root}/etc/[email protected]"
+    destination = "/tmp/[email protected]"
+  }
+
+  provisioner "file" {
+    source      = "${path.root}/systemd/"
+    destination = "/tmp"
+  }
+
+  provisioner "shell" {
+    execute_command = "chmod +x {{ .Path }}; sudo {{ .Vars }} {{ .Path }}"
+    script          = "${path.root}/provision.sh"
+  }
+
+  provisioner "shell-local" {
+    environment_vars = [
+      "OCI_IMAGE_ADMISSION_SHA256=${var.admission_sha256}",
+      "OCI_IMAGE_BASE_IMAGE_OCID=${var.base_image_ocid}",
+      "OCI_IMAGE_COMPARTMENT_ID=${var.compartment_ocid}",
+      "OCI_IMAGE_GUEST_SHA256=${var.guest_sha256}",
+      "OCI_IMAGE_INSTANCE_ID=${build.ID}",
+      "OCI_IMAGE_MANIFEST_PATH=${var.image_manifest_path}",
+      "OCI_IMAGE_NAME=${var.image_name}",
+      "OCI_IMAGE_REVISION_SHA256=${var.image_revision_sha256}",
+      "OCI_IMAGE_SMTP_DENY_SHA256=${var.smtp_deny_sha256}",
+      "OCI_IMAGE_SMTP_EVIDENCE_SHA256=${var.smtp_evidence_sha256}",
+      "OCI_IMAGE_VLAGENT_SHA256=${var.vlagent_sha256}",
+      "OCI_OPERATOR_API_VAULT_PATH=${var.operator_api_vault_path}",
+      "UV_CACHE_DIR=${var.uv_cache_directory}",
+      "UV_PROJECT_ENVIRONMENT=${var.uv_project_environment}",
+    ]
+    execute_command = [
+      "/bin/sh",
+      "-c",
+      "{{.Vars}} uv run --project '${path.root}' --locked python {{.Script}}",
+    ]
+    script = "${path.root}/create_image.py"
+  }
+}

services/oci-l4-relay-guest/image/systemd/oci-l4-relay-admission.service

@@ -0,0 +1,32 @@
+[Unit]
+Description=Update OCI L4 relay address admission
+Wants=network-online.target
+After=network-online.target nftables.service oci-l4-relay-bootstrap.service
+ConditionPathExists=/etc/oci-l4-relay/config.json
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/oci-l4-relay-guest admission refresh
+LogNamespace=oci-l4-relay
+CapabilityBoundingSet=CAP_NET_ADMIN
+LockPersonality=true
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+PrivateDevices=true
+PrivateTmp=true
+ProtectClock=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectHostname=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectSystem=strict
+ReadWritePaths=/var/lib/oci-l4-relay/web-allow
+RestrictAddressFamilies=AF_UNIX AF_INET AF_NETLINK
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+UMask=0077

services/oci-l4-relay-guest/image/systemd/oci-l4-relay-admission.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=Periodically update OCI L4 relay address admission
+
+[Timer]
+OnBootSec=6h
+OnUnitActiveSec=6h
+RandomizedDelaySec=15m
+Persistent=true
+
+[Install]
+WantedBy=timers.target

services/oci-l4-relay-guest/image/systemd/oci-l4-relay-bootstrap.service

@@ -0,0 +1,37 @@
+[Unit]
+Description=Bootstrap OCI L4 relay
+Wants=network-online.target
+After=network-online.target nftables.service
+ConditionPathExists=/etc/oci-l4-relay/config.json
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/oci-l4-relay-guest bootstrap
+RemainAfterExit=true
+LogNamespace=oci-l4-relay
+CapabilityBoundingSet=CAP_NET_ADMIN
+LockPersonality=true
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+PrivateDevices=true
+PrivateTmp=true
+ProtectClock=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectHostname=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectSystem=strict
+ReadWritePaths=/etc/oci-l4-relay /etc/sysconfig /etc/sysctl.d /var/lib/oci-l4-relay
+RestrictAddressFamilies=AF_UNIX AF_INET AF_NETLINK
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+Restart=on-failure
+RestartSec=15
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target

services/oci-l4-relay-guest/image/systemd/oci-l4-relay-journal-upload.service

@@ -0,0 +1,46 @@
+[Unit]
+Description=Upload OCI L4 relay journal namespace to vlagent
+Requires=oci-l4-relay-vlagent.service
+After=oci-l4-relay-vlagent.service [email protected]
+ConditionPathExists=/etc/oci-l4-relay/log-ingest.token
+PartOf=oci-l4-relay-logs.target
+
+[Service]
+Type=simple
+DynamicUser=yes
+User=systemd-journal-upload
+SupplementaryGroups=systemd-journal
+StateDirectory=systemd/journal-upload
+ExecStart=/usr/lib/systemd/systemd-journal-upload --namespace=oci-l4-relay --url=http://127.0.0.1:19532/insert/journald --save-state --system --follow
+Restart=on-failure
+RestartSec=10s
+RestartSteps=10
+RestartMaxDelaySec=60
+Slice=oci-l4-relay-logs.slice
+WatchdogSec=3min
+CapabilityBoundingSet=
+IPAddressDeny=any
+IPAddressAllow=localhost
+LockPersonality=true
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+PrivateDevices=true
+PrivateTmp=true
+ProtectClock=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectHostname=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectProc=invisible
+ProtectSystem=strict
+ReadWritePaths=/var/lib/systemd/journal-upload
+RestrictAddressFamilies=AF_UNIX AF_INET
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+UMask=0077
+LimitNOFILE=524288

services/oci-l4-relay-guest/image/systemd/oci-l4-relay-log-credential.service

@@ -0,0 +1,35 @@
+[Unit]
+Description=Update OCI L4 relay log ingestion credential
+Wants=network-online.target
+After=network-online.target oci-l4-relay-bootstrap.service
+ConditionPathExists=/etc/oci-l4-relay/config.json
+StartLimitIntervalSec=10m
+StartLimitBurst=20
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/oci-l4-relay-guest logs update
+LogNamespace=oci-l4-relay
+LockPersonality=true
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+PrivateDevices=true
+PrivateTmp=true
+ProtectClock=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectHostname=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectSystem=strict
+ReadWritePaths=/etc/oci-l4-relay
+Restart=on-failure
+RestartSec=30s
+RestrictAddressFamilies=AF_UNIX AF_INET
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+UMask=0077

services/oci-l4-relay-guest/image/systemd/oci-l4-relay-log-credential.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=Periodically update OCI L4 relay log ingestion credential
+
+[Timer]
+OnBootSec=1m
+OnUnitActiveSec=1h
+RandomizedDelaySec=30s
+Persistent=true
+
+[Install]
+WantedBy=timers.target

services/oci-l4-relay-guest/image/systemd/oci-l4-relay-logs.path

@@ -0,0 +1,9 @@
+[Unit]
+Description=Start OCI L4 relay log ingestion after credential delivery
+
+[Path]
+PathExists=/etc/oci-l4-relay/log-ingest.token
+Unit=oci-l4-relay-logs.target
+
+[Install]
+WantedBy=multi-user.target

services/oci-l4-relay-guest/image/systemd/oci-l4-relay-logs.slice

@@ -0,0 +1,7 @@
+[Unit]
+Description=OCI L4 relay log ingestion resource boundary
+
+[Slice]
+MemoryAccounting=yes
+MemoryHigh=128M
+MemoryMax=256M

services/oci-l4-relay-guest/image/systemd/oci-l4-relay-logs.target

@@ -0,0 +1,4 @@
+[Unit]
+Description=OCI L4 relay log ingestion
+Wants=oci-l4-relay-vlagent.service oci-l4-relay-journal-upload.service
+After=oci-l4-relay-bootstrap.service

services/oci-l4-relay-guest/image/systemd/oci-l4-relay-smtp-deny.service

@@ -0,0 +1,32 @@
+[Unit]
+Description=Update OCI L4 relay SMTP deny policy
+Wants=network-online.target
+After=network-online.target nftables.service oci-l4-relay-bootstrap.service
+ConditionPathExists=/etc/oci-l4-relay/config.json
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/oci-l4-relay-guest smtp-deny refresh
+LogNamespace=oci-l4-relay
+CapabilityBoundingSet=CAP_NET_ADMIN
+LockPersonality=true
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+PrivateDevices=true
+PrivateTmp=true
+ProtectClock=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectHostname=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectSystem=strict
+ReadWritePaths=/var/lib/oci-l4-relay/smtp-deny
+RestrictAddressFamilies=AF_UNIX AF_INET AF_NETLINK
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+UMask=0077