# Sample config file for distribute.pl.
# 2025-01-27to28: Initial creation.

# Directories will be unveiled based on file and destination,
# except for custom type, which requires using unveil: (for
# r) or unveil-exec (for rx, for any command or script execution).
# Custom types require changes to distribute.pl to implement,
# including any additional required pledges.

# Macros definitions, can be used in any field values.
# macroname = "value"
# Macro names can be any combination of letters, numbers, hyphens, underscores.
# Values can be any combination of characters in quotes.
GENDOAS="/path/to/gendoas"

# List of hosts to distribute to.
host-list: foo, bar, baz
# syslock groups to unlock for installations. (use of syslock groups is optional)
syslock-groups-list: etc, local, reportnew, rsync, signify, ssl

# Plain files: scripts and configs.

name: reportnew.conf
file: /etc/reportnew/reportnew.conf
# dest optional if it's the same location
type: plain
syslock-groups: reportnew
hosts: all

name: rsync.conf
file: /etc/rsync/rsync.conf
type: plain
syslock-groups: rsync
hosts: all

name: install.pl
file: /usr/local/sbin/install.pl
dest: /usr/local/sbin/install.pl
type: plain
syslock-groups: local
hosts: all

# Packages.

name: reportnew
file: reportnew-PKG
type: package
hosts: all

name: rsync-tools
file: rsync-tools-PKG
type: package
hosts: all

name: p5-Signify
file: p5-Signify-PKG
type: package
hosts: all

name: sigtree
file: sigtree-PKG
type: package
hosts: all

name: syslock
file: syslock-PKG
type: package
hosts: all

name: arpwatch
file: arpwatch-PKG
type: package
hosts: foo, bar

name: curl
file: curl-PKG
type: package
hosts: all

name: emacs
file: emacs-PKG
type: package
hosts: all

name: glib2
file: glib2-PKG
type: package
hosts: all

name: gnupg
file: gnupg-PKG
type: package
hosts: all

name: gnutls
file: gnutls-PKG
type: package
hosts: all

name: libarchive
file: libarchive-PKG
type: package
hosts: foo, bar

name: libksba
file: libksba-PKG
type: package
hosts: all

name: libunbound
file: libunbound-PKG
type: package
hosts: all

name: libxml
file: libxml-PKG
type: package
hosts: all

name: nghttp2
file: nghttp2-PKG
type: package
hosts: all

name: oath-toolkit
file: oath-toolkit-PKG
type: package
hosts: foo, bar

name: p5-DBI
file: p5-DBI-PKG
type: package
hosts: foo, bar

name: p5-Digest-SHA3
file: p5-Digest-SHA3-PKG
type: package
hosts: all

name: python
file: python-PKG
type: package
hosts: all

name: quirks
file: quirks-PKG
type: package
hosts: all

name: rsync
file: rsync-PKG
type: package
hosts: all

name: sqlite3
file: sqlite-PKG
type: package
hosts: all

name: unrar
file: unrar-PKG
type: package
hosts: foo, bar

name: unzip
file: unzip-PKG
type: package
hosts: foo, bar

name: zstd
file: zstd-PKG
type: package
hosts: all

# Custom (require additional code inside distribute.pl to implement).

# doas.conf for hosts, generates them from template.
name: doas.conf
file: /etc/doas.conf.template
dest: /etc/doas.conf
type: custom
syslock-groups: etc
unveil: /etc
unveil-exec: /usr/bin/perl,%%GENDOAS%%
custom-vars: gendoas=%%GENDOAS%%
hosts: all

# IP address change, custom code splits out the files from the list,
# gets the sources from backups for each host, makes changes.
# $HOST can be used in file source to pull files for different hosts
# from separate subdirectories.
name: ip-address
file: <filesthatchange1>,<filesthatchange2>
dest: <filesthatchange>,<filesthatchange2>
type: custom
syslock-groups: etc
unveil: <dir-for-source-files>
unveil-exec: /bin/chmod
custom-vars: wan0=Provider 1,wan1=Provider 2,ipv6-name=Provider 3,dns=Provider 4,host-fqdn=external-host-name.domain
hosts: foo, bar

# Plain files: signify keys.
# file and dest are specially handled and replaced with proper values if
# name is <domain>-pkg.pub-[current|next]
# Change <domain> to your domain without the <>.
name: <domain>-pkg.pub-current
file: $SIGNIFY_PUB_KEY
dest: $SIGNIFY_PUB_KEY
type: plain
syslock-groups: signify
hosts: all

name: <domain>-pkg.pub-next
file: $SIGNIFY_PUB_KEY_NEXT
dest: $SIGNIFY_PUB_KEY_NEXT
type: plain
syslock-groups: signify
hosts: all

# Plain files: certificates.
name: cert.pem
file: /etc/ssl/cert.pem
dest: /etc/ssl/cert.pem
type: plain
syslock-groups: ssl
hosts: all
