flashbots · alexhulbert · Nov 4, 2025 · Nov 4, 2025 · Nov 5, 2025 · Nov 7, 2025
diff --git a/.gitignore b/.gitignore
@@ -1,15 +1,27 @@
-build/
+# mkosi/build artifacts
+
+*.qcow2
 build.*/
-mkosi/
+build/
 env.json
-mkosi.packages/
-mkosi.cache/
 mkosi.builddir/
-*.qcow2
-.claudesync/
-.claudeignore
-tmp/
-.temp
+mkosi.cache/
+mkosi.packages/
+mkosi/
 NvVars
+
+# temporary files
+
+.temp
+tmp/
+
+# IDEs/agents/whatnot
+
+.claudeignore
+.claudesync/
 .vscode
+
+# Special files for dev
+
 .bypass-lima
+mkosi.profiles/devtools/authorized_keys
diff --git a/Makefile b/Makefile
@@ -5,6 +5,7 @@ SHELL := /usr/bin/env bash
 WRAPPER := scripts/env_wrapper.sh
 
 FILE ?= build/latest.efi
+SERIAL_CONSOLE ?= false
 
 ##@ Help
 
@@ -35,13 +36,17 @@ all: build
 setup: ## Install dependencies (Linux only)
 	@scripts/setup_deps.sh
 
+preflight:
+	@$(WRAPPER) echo "Ready to build"
+
 # Build module
 build: setup ## Build the specified module
 	$(WRAPPER) mkosi --force --image-id $(IMAGE) --include=images/$(IMAGE).conf
 
 # Build module with devtools profile
+build-dev: SERIAL_CONSOLE_PROFILE := $(if $(filter true,$(SERIAL_CONSOLE)),serial-console,)
 build-dev: setup ## Build module with development tools
-	$(WRAPPER) mkosi --force --image-id $(IMAGE)-dev --profile=devtools --include=images/$(IMAGE).conf
+	$(WRAPPER) mkosi --force --image-id $(IMAGE)-dev --profile=devtools,$(SERIAL_CONSOLE_PROFILE) --include=images/$(IMAGE).conf
 
 ##@ Utilities
 

diff --git a/README.md b/README.md
@@ -47,10 +47,37 @@ make build IMAGE=l2-builder
 # Build with development tools
 make build-dev IMAGE=flashbox-l1
 
+# Build dev image with serial console + password auth enabled
+make build-dev IMAGE=flashbox-l1 SERIAL_CONSOLE=true
+
 # View all available targets
 make help
 ```
 
+#### Dev image SSH access
+
+Dev images (`build-dev`) use SSH authorized keys for root login instead of a password. Before building, place your public key at:
+
+```
+mkosi.profiles/devtools/authorized_keys
+```
+
+This file is gitignored, so you can add a personal public key. For example:
+
+```bash
+cp ~/.ssh/id_ed25519.pub mkosi.profiles/devtools/authorized_keys
+```
+
+Once the image is running, SSH in as root:
+
+```bash
+ssh -p 2222 root@localhost
+```
+
+#### Serial console
+
+Pass `SERIAL_CONSOLE=true` to enable the serial console service and password authentication. This also sets a fixed root password (`dqSPjo4p`) for SSH login, so only use this for local development/debugging.
+
 ### Measuring TDX Boot Process
 
 **Export TDX measurements** for the built image:
@@ -104,7 +131,7 @@ sudo usermod -aG kvm $USER
   ```
 
 > [!NOTE]
-> 
+>
 > Depending on your Linux distro, these commands may require changing the
 > supplied OVMF paths or installing your distro's OVMF package.
 

diff --git a/images/l2-op-rbuilder-bproxy.conf b/images/l2-op-rbuilder-bproxy.conf
@@ -0,0 +1,11 @@
+[Config]
+Profiles=gcp
+
+[Distribution]
+Snapshot=20260301T083349Z
+
+[Include]
+Include=shared/mkosi.conf
+Include=modules/l2/_common/mkosi.conf
+Include=modules/l2/_gcp/mkosi.conf
+Include=modules/l2/op-rbuilder-bproxy/mkosi.conf
diff --git a/images/l2-op-rbuilder.conf b/images/l2-op-rbuilder.conf
@@ -0,0 +1,11 @@
+[Config]
+Profiles=gcp
+
+[Distribution]
+Snapshot=20260301T083349Z
+
+[Include]
+Include=shared/mkosi.conf
+Include=modules/l2/_common/mkosi.conf
+Include=modules/l2/_gcp/mkosi.conf
+Include=modules/l2/op-rbuilder/mkosi.conf
diff --git a/images/l2-simulator.conf b/images/l2-simulator.conf
@@ -0,0 +1,11 @@
+[Config]
+Profiles=gcp
+
+[Distribution]
+Snapshot=20260301T083349Z
+
+[Include]
+Include=shared/mkosi.conf
+Include=modules/l2/_common/mkosi.conf
+Include=modules/l2/_gcp/mkosi.conf
+Include=modules/l2/simulator/mkosi.conf
diff --git a/mkosi.profiles/devtools/mkosi.conf b/mkosi.profiles/devtools/mkosi.conf
@@ -1,6 +1,5 @@
 [Content]
-ExtraTrees=mkosi.extra
-           custom
+ExtraTrees=custom
 PostInstallationScripts=custom.postinst.d/*.sh
 
 Packages=adjtimex
@@ -18,6 +17,7 @@ Packages=adjtimex
          screen
          socat
          strace
+         sudo
          tcpdump
          tcpflow
          vim

diff --git a/mkosi.profiles/devtools/mkosi.postinst b/mkosi.profiles/devtools/mkosi.postinst
@@ -1,21 +1,22 @@
 #!/bin/bash
-set -euxo pipefail
 
-# Deterministically set root password
-PASSWORD="dqSPjo4p"
-HASH=$(mkosi-chroot openssl passwd -6 -salt salt "$PASSWORD")
-mkosi-chroot passwd -u root
-mkosi-chroot usermod -p "$HASH" root
+set -euxo pipefail
 
 # Remove git files in custom/ folder
 mkosi-chroot rm /.gitignore /.gitkeep || true
 
+if [ -f "$SRCDIR/mkosi.profiles/devtools/authorized_keys" ]; then
+    mkdir -p "$BUILDROOT/root/.ssh"
+    cp "$SRCDIR/mkosi.profiles/devtools/authorized_keys" "$BUILDROOT/root/.ssh/authorized_keys"
+    chmod 600 "$BUILDROOT/root/.ssh/authorized_keys"
+    chmod 700 "$BUILDROOT/root/.ssh"
+fi
+
 if [ -f "$BUILDROOT/etc/default/dropbear" ]; then
     # Remove -s, -w, -g flags from dropbear args
     sed -i '/^DROPBEAR_EXTRA_ARGS=/s/-[swg] \?//g' "$BUILDROOT/etc/default/dropbear"
 else
     echo "PermitRootLogin yes" >> "$BUILDROOT/etc/ssh/sshd_config"
-    echo "PasswordAuthentication yes" >> "$BUILDROOT/etc/ssh/sshd_config"
-    mkosi-chroot systemctl unmask ssh.service ssh.socket
-    mkosi-chroot systemctl add-wants minimal.target ssh.service
+    mkosi-chroot systemctl unmask ssh.service ssh.socket systemd-user-sessions.service
+    mkosi-chroot systemctl add-wants minimal.target ssh.service systemd-user-sessions.service
 fi
diff --git a/mkosi.profiles/serial-console/mkosi.conf b/mkosi.profiles/serial-console/mkosi.conf
@@ -0,0 +1,2 @@
+[Content]
+ExtraTrees=serial-console.service:/usr/lib/systemd/system/serial-console.service
diff --git a/mkosi.profiles/serial-console/mkosi.postinst b/mkosi.profiles/serial-console/mkosi.postinst
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -euxo pipefail
+
+# Enable console service
+mkosi-chroot systemctl unmask serial-console.service
+mkosi-chroot systemctl add-wants minimal.target serial-console.service
+
+# Deterministically set root password
+PASSWORD="dqSPjo4p"
+HASH=$(mkosi-chroot openssl passwd -6 -salt salt "$PASSWORD")
+mkosi-chroot passwd -u root
+mkosi-chroot usermod -p "$HASH" root
+
+# Allow login by password
+echo "PasswordAuthentication yes" >> "$BUILDROOT/etc/ssh/sshd_config"
diff --git a/...etc/systemd/system/serial-console.service → ...les/serial-console/serial-console.service b/...etc/systemd/system/serial-console.service → ...les/serial-console/serial-console.service
diff --git a/modules/l2/_common/kernel/config.d/30-xfs b/modules/l2/_common/kernel/config.d/30-xfs
@@ -0,0 +1 @@
+CONFIG_XFS_FS=y
diff --git a/modules/l2/_common/mkosi.build b/modules/l2/_common/mkosi.build
@@ -0,0 +1,62 @@
+#!/bin/bash
+
+set -euxo pipefail
+
+ENV_YAML="$SRCDIR/modules/l2/_common/mkosi.extra/etc/flashbots/l2.yaml"
+
+VAULT_REF=$(mkosi-chroot yq -r '.vault.git_reference' < "$ENV_YAML")
+GOMPLATE_REF=$(mkosi-chroot yq -r '.gomplate.git_reference' < "$ENV_YAML")
+GCP_OPS_AGENT_REF=$(mkosi-chroot yq -r '.gcp_ops_agent.git_reference' < "$ENV_YAML")
+
+source scripts/make_git_package.sh
+
+# build gomplate
+
+make_git_package \
+    "gomplate" \
+    "${GOMPLATE_REF}" \
+    "https://github.com/hairyhenderson/gomplate" \
+    'go build -trimpath -ldflags "-s -w -X github.com/hairyhenderson/gomplate/v4/version=${GOMPLATE_REF} -buildid=" -o ./build/gomplate ./cmd/gomplate' \
+    "build/gomplate:/usr/bin/gomplate"
+chmod +x $DESTDIR/usr/bin/gomplate
+
+# build vault
+
+make_git_package \
+    "vault" \
+    "${VAULT_REF}" \
+    "https://github.com/hashicorp/vault.git" \
+    'go build -tags minimal -trimpath -ldflags "-s -w -X github.com/hashicorp/vault/version.Version=${VAULT_REF} -buildid=" -o ./bin/vault .' \
+    "bin/vault:/usr/bin/vault"
+chmod +x $DESTDIR/usr/bin/vault
+
+# build gcp ops agent
+
+cd "$BUILDROOT"
+IMPORT_PATH="github.com/GoogleCloudPlatform/ops-agent"
+BUILD_CMD="
+    # Main gcs agent binaries
+    mkdir -p out/libexec
+    LDFLAGS='-s -w -buildid='
+    go build -buildvcs=false -trimpath -ldflags \"\$LDFLAGS \\
+        -X $IMPORT_PATH/internal/version.BuildDistro=debian13 \\
+        -X $IMPORT_PATH/internal/version.Version=$GCP_OPS_AGENT_REF\" \\
+        -o out/libexec/google_cloud_ops_agent_engine \\
+        $IMPORT_PATH/cmd/google_cloud_ops_agent_engine
+
+    go build -buildvcs=false -trimpath -ldflags \"\$LDFLAGS\" \\
+        -o out/libexec/google_cloud_ops_agent_wrapper \\
+        $IMPORT_PATH/cmd/agent_wrapper
+"
+make_git_package \
+    "google-cloud-ops-agent" \
+    "$GCP_OPS_AGENT_REF" \
+    "https://github.com/GoogleCloudPlatform/ops-agent" \
+    "$BUILD_CMD" \
+    "out/libexec:/opt/google-cloud-ops-agent/libexec" \
+    "systemd/google-cloud-ops-agent-fluent-bit.service:/usr/lib/systemd/system/google-cloud-ops-agent-fluent-bit.service" \
+    "systemd/google-cloud-ops-agent.service:/usr/lib/systemd/system/google-cloud-ops-agent.service"
+chmod +x $DESTDIR/opt/google-cloud-ops-agent/libexec/*
+mkdir -p "$DESTDIR/opt/google-cloud-ops-agent/subagents"
+ln -s /opt/fluent-bit "$DESTDIR/opt/google-cloud-ops-agent/subagents/fluent-bit"
+sed -i 's|@PREFIX@|/opt/google-cloud-ops-agent|g; s|@SYSCONFDIR@|/etc|g' "$DESTDIR/usr/lib/systemd/system/google-cloud-ops-agent"*.service
diff --git a/modules/l2/_common/mkosi.conf b/modules/l2/_common/mkosi.conf
@@ -0,0 +1,20 @@
+[Build]
+Environment=KERNEL_CONFIG_SNIPPETS_L2_COMMON=modules/l2/_common/kernel/config.d
+WithNetwork=true
+
+[Content]
+BuildScripts=modules/l2/_common/mkosi.build
+ExtraTrees=modules/l2/_common/mkosi.extra
+PostInstallationScripts=modules/l2/_common/mkosi.postinst.chroot
+SyncScripts=modules/l2/_common//mkosi.sync
+
+Packages=fluent-bit
+         prometheus-node-exporter
+         prometheus-process-exporter
+         usrmerge
+         xfsprogs
+
+BuildPackages=golang
+              libssl-dev
+              unzip
+              yq
diff --git a/modules/l2/_common/mkosi.extra/etc/default/prometheus-node-exporter b/modules/l2/_common/mkosi.extra/etc/default/prometheus-node-exporter
@@ -0,0 +1,7 @@
+# Set the command-line arguments to pass to the server.
+ARGS="\
+--collector.systemd \
+--collector.systemd.unit-include=\".*(prometheus-node-exporter|prometheus-process-exporter|vault-agent).*\" \
+--log.format=json \
+--web.listen-address=0.0.0.0:9100 \
+"
diff --git a/modules/l2/_common/mkosi.extra/etc/default/prometheus-process-exporter b/modules/l2/_common/mkosi.extra/etc/default/prometheus-process-exporter
@@ -0,0 +1,6 @@
+# Set the command-line arguments to pass to the server.
+ARGS="\
+-config.path=/etc/prometheus-process-exporter/config.yaml \
+-threads=false \
+-web.listen-address=0.0.0.0:9256 \
+"
diff --git a/modules/l2/_common/mkosi.extra/etc/flashbots/l2.yaml b/modules/l2/_common/mkosi.extra/etc/flashbots/l2.yaml
@@ -0,0 +1,8 @@
+gcp_ops_agent:
+  git_reference: 2.57.0
+
+gomplate:
+  git_reference: v4.3.0
+
+vault:
+  git_reference: v1.20.1
diff --git a/modules/l2/_common/mkosi.extra/etc/google-cloud-ops-agent/config.yaml b/modules/l2/_common/mkosi.extra/etc/google-cloud-ops-agent/config.yaml
@@ -0,0 +1,18 @@
+logging:
+  receivers:
+    syslog:
+      type: files
+      include_paths:
+        - /var/log/messages
+        - /var/log/syslog
+  processors:
+    parse_json:
+      type: parse_json
+      field: message
+      time_key: "@timestamp"
+      time_format: "%Y-%m-%dT%H:%M:%S.%L%z"
+  service:
+    pipelines:
+      default_pipeline:
+        receivers: [syslog]
+        processors: [parse_json]
diff --git a/modules/l2/_common/mkosi.extra/etc/logrotate.d/rsyslog b/modules/l2/_common/mkosi.extra/etc/logrotate.d/rsyslog
@@ -0,0 +1,13 @@
+/var/log/syslog {
+    hourly
+    rotate 2
+    notifempty
+    create
+    nocompress
+    missingok
+    size 128M
+    sharedscripts
+    postrotate
+        /usr/lib/rsyslog/rsyslog-rotate
+    endscript
+}
diff --git a/modules/l2/_common/mkosi.extra/etc/prometheus-process-exporter/config.yaml b/modules/l2/_common/mkosi.extra/etc/prometheus-process-exporter/config.yaml
@@ -0,0 +1,4 @@
+process_names:
+  - name: vault-agent
+    cmdline:
+      - '^\/([-.0-9a-zA-Z]+\/)*vault[-.0-9a-zA-Z]* '
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		[Content]
		ExtraTrees=serial-console.service:/usr/lib/systemd/system/serial-console.service