Publish baldeagleos-repo candidate 0000000325-20260922-184323

7 files changed, 236 insertions, 0 deletions

diff --git a/sys-auth/citadel/Manifest b/sys-auth/citadel/Manifest
new file mode 100644
index 000000000000..fd7c3bad3fb9
--- /dev/null
+++ b/sys-auth/citadel/Manifest
@@ -0,0 +1 @@
+DIST citadel-0.1.0-r1.tar.zst 28960023 BLAKE2B 035b1a70273b3e73a62574327a491805d108dc2fd3898ba585ece86565abb769a5804fc121e8dea8cc2c622772e292324d6f0d67a2b5e4edf732d6029b563017 SHA512 d58e9099dfc9cc5e73bd5aad3583e1d6e0ef86618cdf03ec4540ff6afafdcc32fa890c254214de82e62e3d8535f210ab75e04f61e738e85fdcef9bf0c17e1411
diff --git a/sys-auth/citadel/citadel-0.1.0-r1.ebuild b/sys-auth/citadel/citadel-0.1.0-r1.ebuild
new file mode 100755
index 000000000000..cb0528eb3e0b
--- /dev/null
+++ b/sys-auth/citadel/citadel-0.1.0-r1.ebuild
@@ -0,0 +1,60 @@
+EAPI=8
+
+DESCRIPTION="Generic modular identity, session, authorization and node-enrollment service"
+HOMEPAGE="https://baldeagleos.com/"
+SRC_URI="https://distfiles.baldeagleos.com/citadel-0.1.0-r1.tar.zst"
+S="${WORKDIR}/citadel"
+
+LICENSE="all-rights-reserved"
+SLOT="0"
+KEYWORDS="~amd64"
+IUSE=""
+
+RDEPEND="
+	dev-db/postgresql:18
+	acct-group/citadel
+	acct-group/citadel-agent
+	acct-user/citadel
+	acct-user/citadel-agent
+"
+BDEPEND="
+	dev-lang/rust
+	net-misc/rsync
+"
+
+src_unpack() {
+	# Portage on this host does not recognize .tar.zst through the generic
+	# unpack helper; extract explicitly and retain the immutable source root.
+	mkdir -p "${WORKDIR}" || die
+	tar --zstd -xf "${DISTDIR}/citadel-0.1.0-r1.tar.zst" -C "${WORKDIR}" || die
+	local extracted
+	extracted=$(find "${WORKDIR}" -mindepth 1 -maxdepth 1 -type d -name 'citadel-package-src.*' -print -quit)
+	[[ -n ${extracted} && -d ${extracted} ]] || die "unexpected Citadel source root"
+	mv "${extracted}" "${WORKDIR}/citadel" || die
+	S="${WORKDIR}/citadel"
+}
+
+src_compile() {
+	cd "${S}" || die
+	cargo build --offline --release --workspace --locked || die
+}
+
+src_install() {
+	newbin target/release/login-server citadeld
+	newbin target/release/login-admin citadel-admin
+	dodir /etc/citadel
+	keepdir /var/lib/citadel /var/log/citadel
+	insinto /usr/share/citadel
+	doins -r migrations
+	doins -r config
+	insinto /etc/citadel
+	doins config/callers.example.json
+	newinitd "${FILESDIR}/citadeld.initd" citadeld
+	newconfd "${FILESDIR}/citadeld.confd" citadeld
+	fperms 0750 /etc/citadel /var/lib/citadel /var/log/citadel
+}
+
+pkg_postinst() {
+	einfo "Citadel is installed but not enabled or started."
+	einfo "Run the explicit migration/bootstrap qualification before production use."
+}
diff --git a/sys-auth/citadel/citadel-0.1.0-r2.ebuild b/sys-auth/citadel/citadel-0.1.0-r2.ebuild
new file mode 100755
index 000000000000..cb0528eb3e0b
--- /dev/null
+++ b/sys-auth/citadel/citadel-0.1.0-r2.ebuild
@@ -0,0 +1,60 @@
+EAPI=8
+
+DESCRIPTION="Generic modular identity, session, authorization and node-enrollment service"
+HOMEPAGE="https://baldeagleos.com/"
+SRC_URI="https://distfiles.baldeagleos.com/citadel-0.1.0-r1.tar.zst"
+S="${WORKDIR}/citadel"
+
+LICENSE="all-rights-reserved"
+SLOT="0"
+KEYWORDS="~amd64"
+IUSE=""
+
+RDEPEND="
+	dev-db/postgresql:18
+	acct-group/citadel
+	acct-group/citadel-agent
+	acct-user/citadel
+	acct-user/citadel-agent
+"
+BDEPEND="
+	dev-lang/rust
+	net-misc/rsync
+"
+
+src_unpack() {
+	# Portage on this host does not recognize .tar.zst through the generic
+	# unpack helper; extract explicitly and retain the immutable source root.
+	mkdir -p "${WORKDIR}" || die
+	tar --zstd -xf "${DISTDIR}/citadel-0.1.0-r1.tar.zst" -C "${WORKDIR}" || die
+	local extracted
+	extracted=$(find "${WORKDIR}" -mindepth 1 -maxdepth 1 -type d -name 'citadel-package-src.*' -print -quit)
+	[[ -n ${extracted} && -d ${extracted} ]] || die "unexpected Citadel source root"
+	mv "${extracted}" "${WORKDIR}/citadel" || die
+	S="${WORKDIR}/citadel"
+}
+
+src_compile() {
+	cd "${S}" || die
+	cargo build --offline --release --workspace --locked || die
+}
+
+src_install() {
+	newbin target/release/login-server citadeld
+	newbin target/release/login-admin citadel-admin
+	dodir /etc/citadel
+	keepdir /var/lib/citadel /var/log/citadel
+	insinto /usr/share/citadel
+	doins -r migrations
+	doins -r config
+	insinto /etc/citadel
+	doins config/callers.example.json
+	newinitd "${FILESDIR}/citadeld.initd" citadeld
+	newconfd "${FILESDIR}/citadeld.confd" citadeld
+	fperms 0750 /etc/citadel /var/lib/citadel /var/log/citadel
+}
+
+pkg_postinst() {
+	einfo "Citadel is installed but not enabled or started."
+	einfo "Run the explicit migration/bootstrap qualification before production use."
+}
diff --git a/sys-auth/citadel/citadel-0.1.0-r3.ebuild b/sys-auth/citadel/citadel-0.1.0-r3.ebuild
new file mode 100755
index 000000000000..9faa9b157c8f
--- /dev/null
+++ b/sys-auth/citadel/citadel-0.1.0-r3.ebuild
@@ -0,0 +1,62 @@
+EAPI=8
+
+DESCRIPTION="Generic modular identity, session, authorization and node-enrollment service"
+HOMEPAGE="https://baldeagleos.com/"
+SRC_URI="https://distfiles.baldeagleos.com/citadel-0.1.0-r1.tar.zst"
+S="${WORKDIR}/citadel"
+
+LICENSE="all-rights-reserved"
+SLOT="0"
+KEYWORDS="~amd64"
+IUSE=""
+
+RDEPEND="
+	dev-db/postgresql:18
+	acct-group/citadel
+	acct-group/citadel-agent
+	acct-user/citadel
+	acct-user/citadel-agent
+"
+BDEPEND="
+	dev-lang/rust
+	net-misc/rsync
+"
+
+src_unpack() {
+	# Portage on this host does not recognize .tar.zst through the generic
+	# unpack helper; extract explicitly and retain the immutable source root.
+	mkdir -p "${WORKDIR}" || die
+	tar --zstd -xf "${DISTDIR}/citadel-0.1.0-r1.tar.zst" -C "${WORKDIR}" || die
+	local extracted
+	extracted=$(find "${WORKDIR}" -mindepth 1 -maxdepth 1 -type d -name 'citadel-package-src.*' -print -quit)
+	[[ -n ${extracted} && -d ${extracted} ]] || die "unexpected Citadel source root"
+	mv "${extracted}" "${WORKDIR}/citadel" || die
+	S="${WORKDIR}/citadel"
+}
+
+src_compile() {
+	cd "${S}" || die
+	cargo build --offline --release --workspace --locked || die
+}
+
+src_install() {
+	newbin target/release/login-server citadeld
+	newbin target/release/login-admin citadel-admin
+	dodir /etc/citadel
+	keepdir /var/lib/citadel /var/log/citadel
+	insinto /usr/share/citadel
+	doins -r migrations
+	doins -r config
+	dodir /usr/share/citadel/tools
+	doins tools/preflight-production-import.py
+	insinto /etc/citadel
+	doins config/callers.example.json
+	newinitd "${FILESDIR}/citadeld.initd" citadeld
+	newconfd "${FILESDIR}/citadeld.confd" citadeld
+	fperms 0750 /etc/citadel /var/lib/citadel /var/log/citadel
+}
+
+pkg_postinst() {
+	einfo "Citadel is installed but not enabled or started."
+	einfo "Run the explicit migration/bootstrap qualification before production use."
+}
diff --git a/sys-auth/citadel/files/citadeld.confd b/sys-auth/citadel/files/citadeld.confd
new file mode 100644
index 000000000000..19ccf1f270ad
--- /dev/null
+++ b/sys-auth/citadel/files/citadeld.confd
@@ -0,0 +1,9 @@
+# Citadel runtime configuration. Keep credentials and master keys outside the
+# package and provision them through the host's secret management workflow.
+CITADEL_DATABASE_URL="postgresql:///citadel?host=/run/postgresql"
+CITADEL_SOCKET_PATH="/run/citadel/http.socket"
+CITADEL_CALLERS_FILE="/etc/citadel/callers.json"
+CITADEL_SOCKET_GID="$(getent group citadel | cut -d: -f3)"
+# Shared with the legacy Authd key during the migration; provision this file
+# through the host's secret-management process before enabling Citadel.
+CITADEL_MASTER_KEY_FILE="/etc/citadel/master.key"
diff --git a/sys-auth/citadel/files/citadeld.initd b/sys-auth/citadel/files/citadeld.initd
new file mode 100644
index 000000000000..d3108514372b
--- /dev/null
+++ b/sys-auth/citadel/files/citadeld.initd
@@ -0,0 +1,34 @@
+#!/sbin/openrc-run
+
+description="Citadel identity and authorization service"
+command="/usr/bin/citadeld"
+command_args=""
+command_user="citadel:citadel"
+command_background="yes"
+pidfile="/run/citadel/citadeld.pid"
+output_log="/var/log/citadel/citadeld.log"
+error_log="/var/log/citadel/citadeld.log"
+
+depend() {
+	need net postgresql-18
+}
+
+start_pre() {
+	checkpath --directory --owner citadel:citadel --mode 0750 /run/citadel || return 1
+	chmod 0750 /run/citadel || return 1
+	checkpath --directory --owner citadel:citadel --mode 0750 /var/log/citadel || return 1
+	checkpath --directory --owner citadel:citadel --mode 0750 /var/lib/citadel || return 1
+	checkpath --directory --owner citadel:citadel --mode 0750 /etc/citadel || return 1
+	: ${CITADEL_DATABASE_URL:?CITADEL_DATABASE_URL must be set in /etc/conf.d/citadeld}
+	: ${CITADEL_SOCKET_PATH:?CITADEL_SOCKET_PATH must be set in /etc/conf.d/citadeld}
+	: ${CITADEL_CALLERS_FILE:?CITADEL_CALLERS_FILE must be set in /etc/conf.d/citadeld}
+	export LOGIN_DATABASE_URL="${CITADEL_DATABASE_URL}"
+	export LOGIN_SOCKET_PATH="${CITADEL_SOCKET_PATH}"
+	export LOGIN_CALLERS_FILE="${CITADEL_CALLERS_FILE}"
+	: ${CITADEL_SOCKET_GID:?CITADEL_SOCKET_GID must be set in /etc/conf.d/citadeld}
+	export LOGIN_SOCKET_GID="${CITADEL_SOCKET_GID}"
+	if [ -n "${CITADEL_MASTER_KEY_FILE:-}" ]; then
+		: ${CITADEL_MASTER_KEY_FILE:?CITADEL_MASTER_KEY_FILE must be set in /etc/conf.d/citadeld}
+		export LOGIN_MASTER_KEY_FILE="${CITADEL_MASTER_KEY_FILE}"
+	fi
+}
diff --git a/sys-auth/citadel/metadata.xml b/sys-auth/citadel/metadata.xml
new file mode 100644
index 000000000000..c0b61346d933
--- /dev/null
+++ b/sys-auth/citadel/metadata.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>root@localhost</email>
+    <name>BaldEagleOS platform</name>
+  </maintainer>
+  <longdescription>Citadel provides generic identity, session, authorization, and node enrollment APIs for local and distributed services.</longdescription>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>