create-nspawn-vps

#!/bin/bash
set -e

# Configuration
GITHUB_USER="kaihendry"
SSH_USER="hendry"
DEBIAN_MIRROR="http://www.mirrorservice.org/sites/ftp.debian.org/debian/"

# Generate random container name
CONTAINER_NAME="debian-$(shuf -n 1 /usr/share/dict/words | tr '[:upper:]' '[:lower:]' | tr -cd 'a-z')"

echo "Creating container: $CONTAINER_NAME"

# Bootstrap Debian trixie
echo "Bootstrapping Debian trixie from $DEBIAN_MIRROR"
sudo debootstrap --variant=minbase --include=systemd,dbus,openssh-server,curl,sudo,iputils-ping,iproute2,systemd-resolved,neovim,ca-certificates trixie \
    /var/lib/machines/$CONTAINER_NAME \
    $DEBIAN_MIRROR

# Set hostname
echo "$CONTAINER_NAME" | sudo tee /var/lib/machines/$CONTAINER_NAME/etc/hostname > /dev/null
echo "127.0.1.1       $CONTAINER_NAME" | sudo tee -a /var/lib/machines/$CONTAINER_NAME/etc/hosts > /dev/null

# Configure network
sudo mkdir -p /var/lib/machines/$CONTAINER_NAME/etc/systemd/network

sudo tee /var/lib/machines/$CONTAINER_NAME/etc/systemd/network/80-public.network > /dev/null << EOF
[Match]
Name=mv-*

[Network]
DHCP=yes
EOF

# Set up systemd-resolved symlink
sudo rm -f /var/lib/machines/$CONTAINER_NAME/etc/resolv.conf
sudo ln -sf /run/systemd/resolve/stub-resolv.conf \
    /var/lib/machines/$CONTAINER_NAME/etc/resolv.conf

# Enable systemd services
sudo systemd-nspawn -D /var/lib/machines/$CONTAINER_NAME \
    systemctl enable systemd-networkd systemd-resolved

# Create user with sudo access (without interactive shell)
sudo systemd-nspawn -D /var/lib/machines/$CONTAINER_NAME \
    useradd -m -s /bin/bash -G sudo $SSH_USER

sudo tee /var/lib/machines/$CONTAINER_NAME/etc/sudoers.d/${SSH_USER} > /dev/null << EOF
${SSH_USER} ALL=(ALL) NOPASSWD:ALL
EOF
sudo chmod 440 /var/lib/machines/$CONTAINER_NAME/etc/sudoers.d/${SSH_USER}

# Set up SSH keys
sudo mkdir -p /var/lib/machines/$CONTAINER_NAME/home/$SSH_USER/.ssh
sudo chmod 700 /var/lib/machines/$CONTAINER_NAME/home/$SSH_USER/.ssh

curl -fsSL https://github.com/${GITHUB_USER}.keys | \
    sudo tee /var/lib/machines/$CONTAINER_NAME/home/$SSH_USER/.ssh/authorized_keys > /dev/null
sudo chmod 600 /var/lib/machines/$CONTAINER_NAME/home/$SSH_USER/.ssh/authorized_keys

# Fix ownership (get UID from container's passwd)
USER_UID=$(sudo chroot /var/lib/machines/$CONTAINER_NAME id -u $SSH_USER)
USER_GID=$(sudo chroot /var/lib/machines/$CONTAINER_NAME id -g $SSH_USER)
sudo chown -R $USER_UID:$USER_GID /var/lib/machines/$CONTAINER_NAME/home/$SSH_USER/.ssh

# Configure SSH
sudo tee -a /var/lib/machines/$CONTAINER_NAME/etc/ssh/sshd_config.d/10-disable-password.conf > /dev/null << EOF
PasswordAuthentication no
PubkeyAuthentication yes
EOF

# Enable SSH
sudo systemd-nspawn -D /var/lib/machines/$CONTAINER_NAME \
    systemctl enable ssh

# Create .nspawn file
sudo tee /etc/systemd/nspawn/${CONTAINER_NAME}.nspawn > /dev/null << EOF
[Exec]
Boot=yes

[Network]
MACVLAN=end0.3
EOF

echo "Created .nspawn file for $CONTAINER_NAME"

# Reload systemd to pick up new .nspawn file
sudo systemctl daemon-reload

# Start container
sudo systemctl start systemd-nspawn@${CONTAINER_NAME}.service

echo ""
echo "✅ Container created successfully!"
echo "   Name: $CONTAINER_NAME"
echo "   User: $SSH_USER"
echo ""
echo "ssh ${SSH_USER}@${CONTAINER_NAME}"
echo "sudo machinectl shell ${CONTAINER_NAME}"