Skip to content

Installing Stronghold

Stronghold is a package: dnf install stronghold, on any Fedora. A box installed from an image is the same package in a Fedora bootc image (D23). The functions (DHCP, DNS, the IDS, …) are installed when they are turned on, not with Stronghold (D21).

These steps, the ISOs and the notes as a site: https://stronghold.home.rydekull.se/ (scripts/publish-site.sh).

Until Stronghold is in Fedora's repositories, its own repository comes first: the lab's is https://rpm.home.rydekull.se/ (its key RPM-GPG-KEY-stronghold-lab there).

sudo dnf config-manager addrepo --id=stronghold \
    --set=baseurl=https://rpm.home.rydekull.se/ --set=gpgcheck=1 \
    --set=gpgkey=https://rpm.home.rydekull.se/RPM-GPG-KEY-stronghold-lab

On a Fedora host

sudo dnf install stronghold
sudo systemctl enable --now strongholdd cockpit.socket

Then https://<host>:9090/stronghold (Cockpit, with administrative access), or sudo stronghold status. First boot (first-boot.md) takes the ports as it finds them, or a config put in /etc/stronghold/config before strongholdd starts. Turn functions on in Features: each installs then, its packages through PackageKit or, with functions.prefer: container, its container from the functions' registry.

Updates are Fedora's: dnf upgrade (or Stronghold's updates, updates.md, as an offline update) brings Fedora's packages and Stronghold's alike; after an upgrade strongholdd moves the functions' containers to the images the new package names.

Ansible does the same: the collection's role stronghold.gateway.install (stronghold_repo for a repository of one's own).

Image mode

The image is Fedora's bootc base and the same package:

FROM quay.io/fedora/fedora-bootc:44
RUN dnf -y install stronghold && systemctl enable strongholdd cockpit.socket

Stronghold's own image (stronghold-images, make image) starts from the minimal base and adds what a gateway's host needs, Fedora's packages all; the lab publishes it as containers.home.rydekull.se/stronghold:44 (scripts/host-image.sh), rebuilt when Fedora updates. A box takes it with bootc switch, or is installed from it:

sudo bootc switch containers.home.rydekull.se/stronghold:44

From then on its updates (bootc upgrade, in Stronghold's update window) take each new build of the stream: Fedora's updates with no new Stronghold, and Stronghold's when it publishes. The functions are containers only, installed when turned on.

Without a network

The disconnected ISO (scripts/create-disconnected-iso.sh) installs the image with the functions' images in it, as a cache: DHCP and the DNS resolver run from the first boot, and any other function installs from the cache when it is turned on. Nothing is pulled until the box is updated.