add roles/toxcore/

2023-12-30 12:52:24 +00:00 · 2023-12-30 12:52:24 +00:00 · 273e6b2282
commit 273e6b2282
parent ac375a87c7
51 changed files with 9643 additions and 4 deletions
--- a/roles/ansible-gentoo_install/tasks/disk.yml
+++ b/roles/ansible-gentoo_install/tasks/disk.yml
@ -18,15 +18,21 @@
    
 - name: create disklabel
  command: parted -s {{ AGI_install_disk }} mklabel {{ AGI_install_disklabel }}
+  register: disklabel_out
+  #   stderr: 'Warning: Error fsyncing/closing /dev/nbd1: Input/output error'
+  failed_when: false

+- name: disklabel_out
+  debug:
+    var: disklabel_out
+  
 # We need to leave a small gap at the beginning of the disk, or grub won't be
 # able to install to the MBR
 - name: create boot partition
  shell: |
    parted -s {{ AGI_install_disk }} mkpart primary ext2 1M 200M
-    e2label  {{ AGI_install_disk }}p1 boot
  args:
-    creates: "{{ AGI_install_disk }}p2"
+    creates: "{{ AGI_install_disk }}p1"

 - name: mark boot partition as active
  shell: |
@ -35,14 +41,12 @@
 - name: create swap partition
  shell: |
    parted -s {{ AGI_install_disk }} -- mkpart primary linux-swap 201M 2200M
-    mkswap -L swap  "{{ AGI_install_disk }}p2"
  args:
    creates: "{{ AGI_install_disk }}p2"
 
 - name: create root partition
  shell: |
    parted -s {{ AGI_install_disk }} -- mkpart primary ext4 2201M 20070M
-    e2label  {{ AGI_install_disk }}p3 root
  args:
    creates: "{{ AGI_install_disk }}p3"

@ -61,3 +65,8 @@
  check_mode: false
  when: not ansible_check_mode

+- name: label partitions
+  shell: |
+    e2label  {{ AGI_install_disk }}p3 root
+    e2label  {{ AGI_install_disk }}p1 boot
+    mkswap -L swap  "{{ AGI_install_disk }}p2"
--- a/roles/toxcore/Makefile
+++ b/roles/toxcore/Makefile
@ -0,0 +1,24 @@
+# -*-mode: makefile; fill-column: 75; tab-width: 8; coding: utf-8-unix -*-
+
+ROLE=hostvms
+USER=`grep PRIV_SKEL_USERS_LIST /usr/local/etc/testforge/testforge.bash|sed -e 's/.*=//' -e 's/"//g'`
+
+VAGRANT_DOCTEST=python3.sh ../../../src/ansible/bin/vagrant_doctest-ssh.py
+PYTHON_DOCTEST=python3.sh -m doctest
+SSH_DOCTEST=python3.sh ../../../src/ansible/bin/vagrant_doctest-ssh.py -p 2222 --box="vagrant@127.0.0.1"
+LOCAL_DOCTEST=/var/local/bin/testforge_run_doctest2.bash
+
+DOCTEST=$(LOCAL_DOCTEST)
+
+default:: local
+
+test:: local # hourly
+	sudo -u ${USER} /var/local/src/var_local_$(ROLE).bash $@
+
+hourly::
+	/var/local/bin/$(ROLE)_hourly.bash
+
+local::
+	 $(DOCTEST) overlay/Linux/var/local/share/doc/txt/$(ROLE)3.txt
+#	 $(DOCTEST) overlay/Linux/var/local/share/doc/txt/proxy2.txt
+
--- a/roles/toxcore/defaults/main.yml
+++ b/roles/toxcore/defaults/main.yml
@ -0,0 +1,30 @@
+# -*- mode: yaml; indent-tabs-mode: nil; tab-width: 2; coding: utf-8-unix -*-
+---
+
+# be careful - these are running on the guest which may have no relationship with the other roles
+
+# "ansible_virtualization_role": ["host", "guest"]
+# "ansible_virtualization_type": ["kvm", "virtualbox", "chroot",  ...]
+
+TOXCORE_USR_LOCAL: "{{ USR_LOCAL }}"
+TOXCORE_VAR_LOCAL: "{{ USR_LOCAL }}"
+TOXCORE_LOG_DIR: "{{ TOXCORE_VAR_LOCAL }}/var/log"
+
+TOXCORE_HOURLY_LOG: "{{TOXCORE_LOG_DIR}}/hourly"
+TOXCORE_DAILY_LOG: "{{TOXCORE_LOG_DIR}}/daily"
+TOXCORE_WEEKLY_LOG: "{{TOXCORE_LOG_DIR}}/weekly"
+TOXCORE_MONTHLY_LOG: "{{TOXCORE_LOG_DIR}}/monthly"
+
+TOXCORE_VMS_DIR: "{{TOXCORE_VAR_LOCAL}}/data/Vms"
+TOXCORE_LOCAL_SRC: "{{TOXCORE_VAR_LOCAL}}/src"
+
+TOXCORE_GPG_SERVER: "{{BASE_GPG_SERVER}}"
+
+TOXCORE_GENTOO_FROM_MP: "{{BOX_GENTOO_FROM_MP}}"
+
+# TOXCORE_CTOXCORE_CMAKE:
+
+TOXCORE_FEATURES:
+  - libvirt
+  - docker
+  
--- a/roles/toxcore/meta/main.yml
+++ b/roles/toxcore/meta/main.yml
@ -0,0 +1,15 @@
+# -*- mode: yaml; indent-tabs-mode: nil; tab-width: 2; coding: utf-8-unix -*-
+
+---
+galaxy_info:
+  author: Funtoo
+  company: Remote
+  description: Toxcore provisioning
+  license: MIT
+  min_ansible_version: 2.9
+  platforms:
+    - name: Gentoo
+  categories:
+    - system
+
+dependencies: []
--- a/roles/toxcore/tasks/Devuan.yml
+++ b/roles/toxcore/tasks/Devuan.yml
@ -0,0 +1,33 @@
+# -*- mode: yaml; indent-tabs-mode: nil; tab-width: 2; coding: utf-8-unix -*-
+
+---
+
+- name: "toxcore Devuan.yml"
+  debug:
+    verbosity: 1
+    msg: "toxcore Devuan.yml"
+
+- name: "install toxcore_debs_inst packages"
+  environment:
+    - "RUNLEVEL": 1
+  apt:
+    force_apt_get: true
+    name: "{{ item }}"
+    state: latest
+    update_cache: no
+  when:
+    - item != '' and item != []
+    - not ansible_check_mode
+    - "BASE_ARE_CONNECTED|default('') != ''"
+  with_items:
+    - "{{ toxcore_debs_inst }}"
+    - "{{ toxcore_qemu_debs_inst    if 'qemu' in TOXCORE_FEATURES or 'libvirt' in TOXCORE_FEATURES else [] }}"
+    - "{{ proxy_libvirt_debs_inst    if 'libvirt' in TOXCORE_FEATURES else [] }}"
+    - "{{ toxcore_libvirt_debs_inst    if 'libvirt' in TOXCORE_FEATURES else [] }}"
+    - "{{ toxcore_virtualbox_debs_inst if 'virtualbox' in TOXCORE_FEATURES else [] }}"
+    - "{{ toxcore_vagrant_debs_inst    if 'vagrant' in TOXCORE_FEATURES else [] }}"
+    - "{{ toxcore_packer_debs_inst     if 'packer' in TOXCORE_FEATURES else [] }}"
+    - "{{ toxcore_docker_debs_inst     if 'docker' in TOXCORE_FEATURES else [] }}"
+  ignore_errors: "{{ BASE_PKG_IGNORE_ERRORS }}"
+
+
--- a/roles/toxcore/tasks/Gentoo.yml
+++ b/roles/toxcore/tasks/Gentoo.yml
@ -0,0 +1,171 @@
+# -*- mode: yaml; indent-tabs-mode: nil; tab-width: 2; coding: utf-8-unix -*-
+
+---
+- name: "DEBUG: toxcore Gentoo.yml"
+  debug:
+    verbosity: 1
+    msg: "DEBUG: Including toxcore Gentoo.ym"
+
+#    - "{{ ansible_distribution }}/{{ BOX_SERVICE_MGR }}"
+
+- name: install toxcore packages
+  environment: "{{ portage_proxy_env }}"
+  shell:  |
+    role=toxcore
+    cd {{ BASE_ROOT_LOG_DIR }} || exit 2
+    /usr/local/bin/usr_local_base.bash box_gentoo_emerge {{item}} || exit $?
+  with_items:
+    - "{{ toxcore_pkgs_inst }}"
+    - "{{ toxcore_qemu_pkgs_inst if 'qemu' in TOXCORE_FEATURES }}"
+    - "{{ toxcore_qemu_pkgs_inst if 'libvirt' in TOXCORE_FEATURES }}"
+    - "{{ toxcore_libvirt_pkgs_inst if 'libvirt' in TOXCORE_FEATURES }}"
+    - "{{ toxcore_docker_pkgs_inst if 'DOCKER' in TOXCORE_FEATURES }}"
+  ignore_errors: "{{ BASE_PKG_IGNORE_ERRORS }}"
+  when:
+    - item != '' and item != []
+    - BASE_ARE_CONNECTED|default('') != ''
+    - "{{ ansible_virtualization_role|replace('NA', 'host') == 'host' }}"
+
+- name: install toxcore packages GUEST
+  environment: "{{ portage_proxy_env }}"
+  shell:  |
+    cd {{ BASE_ROOT_LOG_DIR }} || exit 2
+    /usr/local/bin/usr_local_base.bash box_gentoo_emerge {{item}} || exit $?
+  with_items:
+    - "{{ toxcore_pkgs_inst_guest }}"
+  ignore_errors: "{{ BASE_PKG_IGNORE_ERRORS }}"
+  when:
+    - item != '' and item != []
+    - BASE_ARE_CONNECTED|default('') != ''
+    - "{{ ansible_virtualization_role|replace('NA', 'host') != 'host' }}"
+
+- name: /etc/conf.d/consolefont
+  blockinfile:
+    dest: "/etc/{{ETC_CONF_D}}/consolefont"
+    marker: "# {mark} ANSIBLE MANAGED BLOCK proxy Gentoo"
+    mode: 0644
+    owner: "{{BOX_ROOT_USER}}"
+    group: "{{BOX_ROOT_GROUP}}"
+    create: yes
+    block: |
+      # for 80x24
+      consolefont="ter-v24b"
+
+- name: /etc/local.d/rc.local.start later
+  shell: |
+    # not systemd
+    [ -d /etc/local.d ] || exit 0
+    [ -f "/etc/local.d/rc.local.start" ] && exit 0
+    echo /etc/rc.local > /etc/local.d/rc.local.start
+    chmod 755  /etc/local.d/rc.local.start
+    cat >> /etc/rc.local << EOF
+    /etc/init.d/consolefont stop; /etc/init.d/consolefont start
+    stty -F /dev/tty1 cols 80 rows 24
+    grep vda /proc/partitions && \
+        e2label /dev/vda3 root && \
+        e2label /dev/vda1 boot
+    sed -e 's/^#L/L/' -i /etc/fstab
+    EOF
+    bash /etc/rc.local
+    exit 0
+  when:
+    - not ansible_check_mode
+    - BOX_SERVICE_MGR != 'systemd' # maybe
+
+# safe ones
+- block:
+
+  - name: "/etc/portage/make.conf base Gentoo PORTAGE_ELOG"
+    blockinfile:
+      dest: /etc/portage/make.conf
+      create: false
+      marker: "# {mark} ANSIBLE MANAGED BLOCK base Gentoo.yml [PORTAGE_ELOG]"
+      block: |
+        PORTAGE_ELOG_CLASSES="warn error"
+        # NOT syslog
+        PORTAGE_ELOG_SYSTEM="save"
+  
+  - name: "/etc/portage/make.conf base Gentoo2.yml CFLAGS"
+    blockinfile:
+      dest: /etc/portage/make.conf
+      create: false
+      marker: "# {mark} ANSIBLE MANAGED BLOCK base Gentoo.yml [CFLAGS]"
+      block: |
+        # -pipe
+        CFLAGS="-mtune=generic -O2"
+        CXXFLAGS="-mtune=generic -O2"
+  
+  - name: "/etc/portage/make.conf base Gentoo.yml PORT_LOGDIR"
+    blockinfile:
+      dest: /etc/portage/make.conf
+      create: false
+      marker: "# {mark} ANSIBLE MANAGED BLOCK base Gentoo.yml [PORT_LOGDIR]"
+      block: |
+        PORT_LOGDIR="/var/log/portage"
+        PORTAGE_ELOG_CLASSES="log warn error info"
+        PORTAGE_ELOG_SYSTEM="echo:log,warn save:log,warn,error,info syslog:error"
+  
+  - name: "/etc/portage/make.conf base Gentoo.yml ACCEPT_KEYWORDS"
+    blockinfile:
+      dest: /etc/portage/make.conf
+      create: false
+      marker: "# {mark} ANSIBLE MANAGED BLOCK base Gentoo.yml [ACCEPT_KEYWORDS]"
+      block: |
+        # In ACCEPT_KEYWORDS, ~amd64 is used for current 64-bit builds;
+        # There is no tilde for the stable build.
+        ACCEPT_KEYWORDS="~amd64"
+  
+  - name: "/etc/portage/make.conf base Gentoo.yml GENTOO_MIRRORS"
+    blockinfile:
+      dest: /etc/portage/make.conf
+      create: false
+      marker: "# {mark} ANSIBLE MANAGED BLOCK base Gentoo.yml [GENTOO_MIRRORS]"
+      block: |
+        GENTOO_MIRRORS="http://distfiles.gentoo.org"
+  
+  - name: "/etc/portage/make.conf Gentoo2 base"
+    blockinfile:
+      dest: /etc/portage/make.conf
+      create: false
+      marker: "# {mark} ANSIBLE MANAGED BLOCK base Gentoo2.yml [COLLISION_IGNORE]"
+      block: |
+        # 2016-01 added for some py packages
+        COLLISION_IGNORE="/lib/modules/* *.py[co] __init__.py"
+  
+  - name: "/etc/portage/make.conf Gentoo2 UNINSTALL_IGNORE"
+    blockinfile:
+      dest: /etc/portage/make.conf
+      create: false
+      marker: "# {mark} ANSIBLE MANAGED BLOCK base Gentoo2.yml [UNINSTALL_IGNORE]"
+      block: |
+        # 2017-01 added for kernel compiling
+        UNINSTALL_IGNORE="/usr/src /opt /usr/lib32 /usr/lib64/python2.7"
+  
+  - name: "/etc/portage/make.conf Gentoo2 FEATURES-preserve-libs"
+    blockinfile:
+      dest: /etc/portage/make.conf
+      create: false
+      marker: "# {mark} ANSIBLE MANAGED BLOCK base Gentoo2.yml [FEATURES-preserve-libs]"
+      block: |
+        # https://wiki.gentoo.org/wiki/Project:Toolchain/libcrypt_implementation
+        FEATURES="${FEATURES} preserve-libs"
+  
+  - name: "/etc/portage/make.conf Gentoo2 FEATURES"
+    blockinfile:
+      dest: /etc/portage/make.conf
+      create: false
+      marker: "# {mark} ANSIBLE MANAGED BLOCK base Gentoo2.yml [CFLAGS]"
+      block: |
+        #Please adjust your CFLAGS as desired, information can be found here: https://wiki.gentoo.org/wiki/CFLAGS
+        #Do not modify these FLAGS unless you know what you are doing, always check the defaults first with "portageq envvar CFLAGS"
+        #This is the default for pentoo at the time of build:
+          #CFLAGS="-Os -mtune=nocona -pipe  -frecord-gcc-switches"
+          #A safe choice would be to keep whatever Pentoo defaults are, but optimize for your specific machine:
+          CFLAGS="-mtune=generic -O2 -pipe"
+          #If you do change your CFLAGS, it is best for all the compile flags to match so uncomment the following three lines:
+          CXXFLAGS="-mtune=generic -O2 -pipe"
+          FCFLAGS="${CFLAGS}"
+          FFLAGS="${CFLAGS}"
+  
+  when: true
+
--- a/roles/toxcore/tasks/Ubuntu.yml
+++ b/roles/toxcore/tasks/Ubuntu.yml
@ -0,0 +1,48 @@
+# -*- mode: yaml; indent-tabs-mode: nil; tab-width: 2; coding: utf-8-unix -*-
+
+---
+
+- name: "toxcore Ubuntu.yml"
+  debug:
+    verbosity: 1
+    msg: "toxcore Ubuntu.yml"
+
+- name: uninstall toxcore_lxd_debs_absent packages
+  environment:
+    - "RUNLEVEL": 1
+  apt:
+    force_apt_get: true
+    name: "{{item}}"
+    state: absent
+    update_cache: no
+  when:
+    - item != ''
+    - not ansible_check_mode
+    - "'lxd' not in TOXCORE_FEATURES"
+  with_items: "{{ toxcore_lxd_debs_absent }}"
+
+- name: "install toxcore_debs_inst packages"
+  environment:
+    - "RUNLEVEL": 1
+  shell: |
+    apt-get install -y \
+     "{{ toxcore_debs_inst|join('') }}" \
+     "{{ toxcore_qemu_debs_inst|join('') if 'qemu' in TOXCORE_FEATURES else '' }}" \
+     "{{ toxcore_libvirt_debs_inst|join('') if 'libvirt' in TOXCORE_FEATURES else '' }}" \
+     "{{ toxcore_docker_debs_inst|join('') if 'docker' in TOXCORE_FEATURES else '' }}" \
+      {{ '--print-uris' if BASE_ARE_CONNECTED|default('') == '' else '' }}
+  when:
+    - "item != ''"
+    - not ansible_check_mode
+    - "BASE_ARE_CONNECTED|default('') != ''"
+  ignore_errors: "{{ BASE_PKG_IGNORE_ERRORS }}"
+
+- block:
+
+  - name: "toxcore Ubuntu18.yml"
+    debug:
+      verbosity: 1
+      msg: "toxcore Ubuntu18.yml"
+
+  when: ansible_distribution_major_version == 18
+
--- a/roles/toxcore/tasks/Ubuntu18.yml
+++ b/roles/toxcore/tasks/Ubuntu18.yml
@ -0,0 +1,7 @@
+# -*- mode: yaml; indent-tabs-mode: nil; tab-width: 2; coding: utf-8-unix -*-
+---
+
+- debug:
+    verbosity: 1
+    msg: "hostvms/Ubuntu18"
+
--- a/roles/toxcore/tasks/bootstrap_nbd.yml
+++ b/roles/toxcore/tasks/bootstrap_nbd.yml
@ -0,0 +1,83 @@
+# -*- mode: yaml; indent-tabs-mode: nil; tab-width: 2; coding: utf-8-unix -*-
+
+---
+
+- name: "DEBUG: base bootstrap_nbd.yml nbd_out={{nbd_disk}}"
+  debug:
+    verbosity: 1
+    msg: "DEBUG: Including bootstrap_nbd nbd_out={{nbd_disk}}"
+
+- block:
+
+  - name: "partition the disk"
+    shell: |
+      cat /proc/partitions | grep {{BASE_NBD_DEV}}   || exit 1
+      cat /proc/partitions | grep {{BASE_NBD_DEV}}p1 || exit 0
+      [ {{BASE_NBD_DEV}}p1 = {{nbd_disk}} ]
+      parted -s {{nbd_disk}} mklabel msdos
+      parted -s {{nbd_disk}} mkpart primary 2048s 100%
+      partprobe
+      mkfs.ext4 -FF {{nbd_disk}}p1
+  
+  - name: "mount the disk"
+    shell: |
+      df | grep {{nbd_disk}}p1 && exit 0
+      [ -d {{BASE_NBD_MP}} ] || mkdir  {{BASE_NBD_MP}}
+      mount {{nbd_disk}}p1 {{BASE_NBD_MP}}
+      [ -d {{BASE_NBD_MP}}/lost+found ]
+  
+  - name: "check the disk"
+    shell: |
+      df | grep {{nbd_disk}}p1 || exit 1
+      [ -d {{BASE_NBD_MP}}/lost+found ] || exit 2
+      
+   
+  - name: check the downloads step5
+    shell: |
+      stage3_asc=stage3-amd64-openrc-20231217T170203Z.tar.xz.sha256
+      stage3_xz=stage3-amd64-openrc-20231217T170203Z.tar.xz
+      sha256sum -c $stage3_asc
+      tar xJpf $stage3 --xattrs-include='*.*' --numeric-owner -C {{BASE_NBD_MP}
+      
+      portage_xz=portage-20231221.tar.xz
+      tar xpJf $portage -C {{BASE_NBD_MP}}/usr
+
+      [ -d etc/portage/package.env ] || mkdir -p etc/portage/package.env
+      cat >> etc/portage/package.env/singlejob.txt << EOF
+      app-portage/eix singlejob.conf
+      dev-util/maturin singlejob.conf
+      dev-util/cmake singlejob.conf
+
+      [ -d etc/portage/package.license ] || mkdir -p etc/portage/package.license
+      EOF
+        
+    chdir: "{{BASE_NBD_MP}}"
+    creates: "{{BASE_NBD_MP}}/etc"
+    
+  - name: chroot into the partition - step4
+    shell: |
+      df | grep {{nbd_disk}}p1 || exit 1
+      [ -d {{BASE_NBD_MP}}/lost+found ] || exit 2
+      [ -d {{BASE_NBD_MP}}/proc ] && exit 0
+      /usr/local/sbin/base_chroot.bash {{BASE_NBD_MP}}
+    register: base_bootstrap_chroot_rc
+
+  - name: check the sources
+    shell: |
+      true
+
+  - name: install the downloads
+    shell: |
+      /usr/local/sbin/base_chroot_unbind.bash  {{BASE_NBD_MP}}
+    when: base_bootstrap_chroot_rc.rc == 0
+
+  - name: stop here
+    shell: |
+      exit 1
+    
+  delegate_to: localhost
+  when:
+    - nbd_disk != ''
+
+#gpg --keyserver hkps://keys.gentoo.org --recv-keys 0xBB572E0E2D182910
+
--- a/roles/toxcore/tasks/daily.yml
+++ b/roles/toxcore/tasks/daily.yml
@ -0,0 +1,37 @@
+# -*- mode: yaml; indent-tabs-mode: nil; tab-width: 2; coding: utf-8-unix -*-
+---
+
+- name: "toxcore daily.yml"
+  debug:
+    msg: "toxcore daily.yml ansible_virtualization_role {{ansible_virtualization_role|replace('NA', 'host')}}"
+
+# these should test on the host
+
+# delegate_to: localhost? - no - per test
+- name: "usr_local_toxcore.bash"
+  environment: "{{ shell_proxy_env }}"
+  shell: |
+    umask 0002
+    bash {{TOXCORE_USR_LOCAL}}/src/usr_local_toxcore.bash \
+              {{ 'test' if not ansible_check_mode }}
+    exit 0
+  args:
+    chdir: "{{TOXCORE_USR_LOCAL}}/src"
+  become: yes
+  become_user: "{{ BOX_USER_NAME }}"
+  ignore_errors: true
+  check_mode: false
+  
+- name: "run toxcore_daily.bash"
+  environment: "{{ shell_proxy_env }}"
+  shell: |
+    umask 0027
+    echo "INFO: toxcore_log_daily {{HARDEN_LOG_DIR}}"
+    cd {{USR_LOCAL}}/bin
+    toxcore_daily.bash
+  register: toxcore_log_daily
+  notify: summary of logs
+  ignore_errors: true
+  when:
+    - not ansible_check_mode
+    - false
--- a/roles/toxcore/tasks/hourly.yml
+++ b/roles/toxcore/tasks/hourly.yml
@ -0,0 +1,58 @@
+# -*- mode: yaml; indent-tabs-mode: nil; tab-width: 2; coding: utf-8-unix -*-
+---
+
+- name: "toxcore hourly.yml"
+  debug:
+    msg: "toxcore hourly.yml ansible_virtualization_role {{ansible_virtualization_role|replace('NA', 'host')}}"
+
+# these should test on the host
+- block:
+  - name: check ifconfig
+    # was toxcore_bin.bash
+    shell: |
+      echo WARN: this maybe vagrant only
+      ifconfig eth0 | grep 'inet ' || \
+          ifconfig eth0 netmask 255.255.255.0 192.168.122.22
+    when:
+      - false # this is vagrant only
+      - "ansible_virtualization_role|replace('NA', 'host') != 'host'"
+      
+  - name: check guest-agent
+    # was toxcore_bin.bash
+    shell: |
+      UNIT=qemu-guest-agent
+      S=/etc/init.d/$UNIT
+      $S $UNIT status || {
+          retval=$?
+          echo WARN: $UNIT not running
+          exit 0 # $retval
+          }
+      exit 0
+      
+  when: "ansible_virtualization_role|replace('NA', 'host') != 'host'"
+
+- name: run toxcore_check_modules.bash
+  # was toxcore_bin.bash
+  shell: |
+    bash toxcore_check_modules.bash {{TOXCORE_FEATURES|join(' ')}}
+  args:
+    chdir: "{{ TOXCORE_VAR_LOCAL }}/bin"
+  environment: "{{ shell_proxy_env }}"
+  register: toxcore_log_bin
+  notify: summary of logs
+  # FixMe?
+  ignore_errors: true
+
+- name: "run toxcore_hourly.bash"
+  environment: "{{ shell_proxy_env }}"
+  shell: |
+    umask 0027
+    echo "INFO: toxcore_log_hourly {{HARDEN_LOG_DIR}}"
+    cd {{VAR_LOCAL}}/bin
+    toxcore_hourly.bash
+  register: toxcore_log_hourly
+  notify: summary of logs
+  ignore_errors: true
+  when:
+    - not ansible_check_mode
+    - false
--- a/roles/toxcore/tasks/main.yml
+++ b/roles/toxcore/tasks/main.yml
@ -0,0 +1,342 @@
+# -*- mode: yaml; indent-tabs-mode: nil; tab-width: 2; coding: utf-8-unix -*-
+
+---
+
+- name: "toxcore main.yml"
+  debug:
+    verbosity: 1
+    msg: "toxcore main.yml BOX_OS_FAMILY={{BOX_OS_FAMILY}} {{BOX_GENTOO_FROM_MP}} {{ansible_virtualization_role|replace('NA', 'host')}}"  
+  
+- name: toxcore include_vars
+  include_vars: "{{item}}.yml"
+  with_items:
+    - Linux
+    - "{{ ansible_distribution }}{{ ansible_distribution_major_version }}"
+  tags: always
+
+- name: "rsync toxcore root_overlay"
+  synchronize:
+    src: "roles/toxcore/overlay/{{item}}/"
+    dest: /
+    compress: no
+    copy_links: yes
+    archive: no
+    recursive: yes
+    links: no
+    owner: no
+    perms: no
+    times: yes
+    rsync_opts: "{{base_rsync_opts}}"
+  with_items:
+    - Linux
+    - "{{ ansible_distribution }}"
+  notify:
+    - chmod /var/local
+  when:
+    - not ansible_check_mode
+    # FixAns: This remote host is being accessed via chroot instead so it cannot work
+    - ansible_connection|default('') not in PLAY_NORSYNC_CONNECTIONS
+  tags:
+    - always
+
+- name: rsync root_overlay - tar before running
+  unarchive:
+    dest: /
+    src: "{{item}}.tar"
+    keep_newer: true
+    owner: "{{BOX_ROOT_USER}}"
+    # extra_opts: "{{ BASE_UNTAR_ARGS }}"
+  with_items:
+    - Linux
+    - "{{ ansible_distribution }}"
+  notify:
+    - chmod /usr/local
+  ignore_errors: true
+  when:
+    - not ansible_check_mode
+    # FixAns: This remote host is being accessed via chroot instead so it cannot work
+    - ansible_connection|default('') in PLAY_NORSYNC_CONNECTIONS
+
+- name: "make /var/local/var/log/testforge toxcore"
+  file:
+    path: "{{ item }}"
+    state: directory
+    mode: 0775
+  with_items:
+    - "{{ TOXCORE_LOG_DIR }}"
+    - "{{ TOXCORE_DAILY_LOG }}"
+#    - "{{ TOXCORE_WEEKLY_LOG }}"
+#    - "{{ TOXCORE_MONTHLY_LOG }}"
+  tags:
+    - hourly
+    - daily
+    - weekly
+    - monthly
+
+- name: "/var/local/bin/toxcore_sign_modules.bash modules needed toxcore_kmods_in_host"
+  shell: |
+    KVER=`cat /proc/cmdline |sed -e 's/ .*//' -e 's/BOOT_IMAGE=//' -e 's/kernel-[a-z]*-x86_64-//'`
+    KDIR=/lib/modules/$KVER
+    DIR=$KDIR/misc
+    [ -d $DIR ] || { echo WARN: no directory $DIR ; exit 0 ; }
+    /var/local/bin/toxcore_sign_modules.bash {{ toxcore_kmods_in_host|flatten|join(' ') }}
+    
+  when: false
+  # this changes with kernel 4 -> 5
+
+- name: modprobe VM modules toxcore_kmods_in_host
+  modprobe:
+    name: "{{ item }}"
+    state: "{{ 'absent' if ansible_virtualization_role|replace('NA', 'host') != 'host' else 'present'}}"
+  when:
+    - item != ''
+  with_items: "{{ toxcore_kmods_in_host }}"
+  ignore_errors: true
+
+- name: modprobe VM modules toxcore_kmods_not_in_host
+  modprobe:
+    name: "{{ item }}"
+    state: absent
+  with_items: "{{ toxcore_kmods_not_in_host }}"
+  when: false
+  # I'm not sure kvm should be missing anymore 5+
+  ignore_errors: true
+
+- name: include by-platform tasks
+  include_tasks: "{{ ansible_distribution }}.yml"
+
+- name: grub.cfg from roles/ansible-gentoo_install/tasks/
+  shell: |
+    LINE="rd.skipfsck=1 ipv6.disable=1 console=tty1 lang=en keymap=us"
+    # LINE="$LINE pti=on doscsi iommu=pt  amd_iommu=on debugfs=off efi=disable_early_pci_dma extra_latent_entropy init_on_free=1 kvm.nx_huge_pages=force l1tf=full,force mce=0 mds=full,nosmt nosmt=force page_alloc.shuffle=1 pti=on random.trust_cpu=off slab_nomerge slub_debug=FZ spec_store_bypass_disable=on spectre_v2=on tsx_async_abort=full,nosmt vsyscall=none "
+    LINE="$LINE intel_iommu=on vga=0x315 text"
+    grep  /boot /etc/fstab || exit 1
+    df | grep /boot || mount /boot || exit 2
+    [ -d /boot/grub ] || exit 3
+    [ -f /boot/grub/grub.cfg ] || exit 4
+    [ -f /boot/grub/grub.cfg ] && cp -p /boot/grub/grub.cfg /boot/grub/grub.cfg.dst
+    sed -e 's@ ro *$@ '"$LINE"' ro@' -i /boot/grub/grub.cfg
+  ignore_errors: true
+
+- name: add standard_users to groups
+  user:
+    name: "{{ item.0 }}"
+    append: true
+    groups: "{{ item.1 }}"
+  when:
+    - item != ''
+  # some groups may not be there
+  ignore_errors: true
+  with_nested:
+    - "{{ base_system_users }}"
+    - "{{ toxcore_standard_users_groups }}"
+
+- name: "make a directory for /data/Vms"
+  file:
+    path: "{{item }}"
+    state: directory
+    mode: 0775
+  with_items:
+    - "{{TOXCORE_VMS_DIR}}"
+    - "{{TOXCORE_VMS_DIR}}/Instances"
+    - "{{TOXCORE_VMS_DIR}}/Qemu"
+    - "{{TOXCORE_VMS_DIR}}/Boxes"
+#?    - "{{TOXCORE_VMS_DIR}}/vagrant.d/tmp"
+  check_mode: false
+
+- name: "toxcore gpg keys system"
+  # Option --keyserver must be used to
+  environment: "{{ shell_proxy_env }}"
+  shell: |
+    /usr/bin/gpg --list-keys | grep "{{ item.primary }}" || \
+      /usr/bin/gpg --recv-keys "{{ item.uid }}" # --keyserver "{{ TOXCORE_GPG_SERVER }}"
+  with_items: "{{ toxcore_gpg_keys_system }}"
+  when:
+    - toxcore_gpg_keys_system|length > 0
+    - BASE_ARE_CONNECTED|default('') != ''
+  ignore_errors: true
+
+- name: "toxcore gpg keys gentoo"
+  environment: "{{ shell_proxy_env }}"
+  shell: |
+    [ -f /usr/share/openpgp-keys/gentoo-release.asc ] && exit 0
+    gpg --import /usr/local/share/openpgp-keys/gentoo-release.asc 
+ 
+# this should not run as root
+# delegate_to: localhost? - no - per test
+- name: "usr_local_toxcore.bash"
+  environment: "{{ shell_proxy_env }}"
+  shell: |
+    umask 0002
+    bash {{TOXCORE_USR_LOCAL}}/src/usr_local_toxcore.bash \
+              {{ 'check' if ansible_check_mode }}
+    exit 0
+  args:
+    chdir: "{{TOXCORE_USR_LOCAL}}/src"
+  become: yes
+  become_user: "{{ BOX_USER_NAME }}"
+  ignore_errors: true
+  check_mode: false
+  
+- name: "include_tasks toxcore vms as root"
+  include_tasks:
+    file: "{{LOOP_ITEM}}.yml"
+    apply:
+      environment: "{{ proxy_env }}"
+  when:
+    - LOOP_ITEM  != '' and LOOP_ITEM  != []
+  with_items:
+    - "vms"
+  loop_control:
+    loop_var: LOOP_ITEM
+
+- name: "include_tasks toxcore users on the command host"
+  include_tasks:
+    file: "{{ LOOP_USER_F[1] }}"
+    apply:
+      environment: "{{ proxy_env }}"
+      become_user: "{{ LOOP_USER_F[0] }}"
+  when:
+    - "LOOP_USER_F[1] != ''"
+    - "ansible_virtualization_role|replace('NA', 'host') == 'host'"
+  with_nested:
+    -
+      - "{{ toxcore_system_users }}"
+    -
+      - users.yml
+  loop_control:
+    loop_var: LOOP_USER_F
+
+- name: "include_tasks toxcore users as user"
+  include_tasks:
+    file: "{{ LOOP_USER_F[1] }}.yml"
+    apply:
+      environment: "{{ proxy_env }}"
+      become_user: "{{ LOOP_USER_F[0] }}"
+  when:
+    - "LOOP_USER_F[1] != ''"
+    - "ansible_virtualization_role|replace('NA', 'host') == 'host'"
+    - false
+  with_nested:
+    - "{{ toxcore_system_users }}"
+    -
+#no      - users
+      - "{{ 'libvirt_users' if 'libvirt' in TOXCORE_FEATURES else '' }}"
+#      - "{{ 'qemu_users' if 'qemu' in TOXCORE_FEATURES else '' }}"
+#      - "{{ 'docker_users' if 'docker' in TOXCORE_FEATURES else '' }}"
+  loop_control:
+    loop_var: LOOP_USER_F
+    
+- name: enable and start toxcore services
+  service:
+    name: "{{ item }}"
+    enabled: yes
+    state: started
+  when:
+    - "item != ''"
+    - ansible_connection|default('') not in PLAY_CHROOT_CONNECTIONS
+    - "toxcore_services_enabled|length > 0"
+  with_items: "{{ toxcore_services_enabled }}"
+  ignore_errors: true
+
+- name: start toxcore services
+  service:
+    name: "{{ item }}"
+    enabled: no
+    state: started
+  when:
+    - "item != ''"
+    - ansible_connection|default('') not in PLAY_CHROOT_CONNECTIONS
+    - false
+  with_items: "{{ toxcore_services_started }}"
+  ignore_errors: true
+
+- name: stop toxcore services
+  service:
+    name: "{{ item }}"
+    enabled: no
+    state: stopped
+  failed_when: false
+  when:
+    - "item != ''"
+    - ansible_connection|default('') not in PLAY_CHROOT_CONNECTIONS
+    - false
+  with_items: "{{ toxcore_services_stopped }}"
+
+- name: run ansible-gentoo_install
+  include_role:
+    name: ansible-gentoo_install
+  when:
+    - "ansible_virtualization_role|replace('NA', 'host') == 'host'"
+#    - BOX_OS_FAMILY == 'Gentoo' or BOX_GENTOO_FROM_MP not in ['/', '']
+
+  # Set BOX_NBD_OVERLAY_DIR environment variable to override storage location for VMs
+  #   -b      Bridge interface to use (defaults to virbr0)
+  #   -m      MAC address to use (default is to use a randomly-generated MAC)
+  #   -p      ansible users plaintext password
+  #   -k      Full path and name of the ansible user's public key file (required)
+ 
+- name: run toxcore_create-vm.bash
+  delegate_to: localhost
+  shell: |
+    export BOX_NBD_OVERLAY_DIR=${BOX_NBD_OVERLAY_DIR:-"${HOME}/vms/virsh"}
+    [ '{{BOX_NBD_OVERLAY_NAME}}' != '' ] || exit 1
+    [ '{{BOX_NBD_OVERLAY_DIR}}' != '' ] || exit 2
+    [ '{{BOX_NBD_BASE_PUBKEY}}' != '' ] || exit 3
+    [ '{{BOX_NBD_BASE_QCOW}}' != '' ] || exit 4
+    [ -f '{{BOX_NBD_BASE_QCOW}}' ] || exit 5
+    toxcore_create-vm.bash \
+             -n {{BOX_NBD_OVERLAY_NAME}} \
+             -k {{BOX_NBD_BASE_PUBKEY}} \
+             -i {{BOX_NBD_BASE_QCOW}} \
+             -s {{BOX_NBD_OVERLAY_GB}} \
+             -c {{BOX_NBD_OVERLAY_CPUS}} \
+             -r {{BOX_NBD_OVERLAY_RAM}} \
+             -d {{BOX_NBD_OVERLAY_DIR}} \
+             -b virbr0 \
+             -p gentoo \
+             -o gentoo 
+  ignore_errors: true
+  when:
+    - "ansible_virtualization_role|replace('NA', 'host') == 'host'"
+
+# run this last
+
+# works with apply tags hourly
+- name: toxcore hourly include_tasks
+  include_tasks:
+    file: "hourly.yml"
+    apply:
+      tags:
+        - always
+  with_items:
+    - "{{ toxcore_system_users }}"
+  loop_control:
+    loop_var: LOOP_USER
+  tags:
+    - always
+
+- name: toxcore daily include_tasks
+  include_tasks:
+    file: "daily.yml"
+    apply:
+      environment: "{{ proxy_env }}"
+      tags:
+        - daily
+  tags:
+    - daily
+
+- name: toxcore weekly include_tasks
+  include_tasks:
+    file: "weekly.yml"
+    apply:
+      environment: "{{ proxy_env }}"
+      tags:
+        - weekly
+  tags:
+    - weekly
+  when: false
+
+
+# replace this ^A with a control-A to provoke an error in the error handler of yamlint
+# yaml.reader.ReaderError: unacceptable character #x0001: special characters are not allowed
--- a/roles/toxcore/tasks/users.yml
+++ b/roles/toxcore/tasks/users.yml
@ -0,0 +1,118 @@
+# -*- mode: yaml; indent-tabs-mode: nil; tab-width: 2; coding: utf-8-unix -*-
+
+---
+
+- name: "toxcore users.yml LOOP_USER_F[0]"
+  debug:
+    verbosity: 1
+    msg: "toxcore users.yml LOOP_USER_F={{LOOP_USER_F[0]}}"
+
+- block:
+    
+  - name: /etc/sysconfig/docker
+    blockinfile:
+      dest: /etc/sysconfig/docker
+      create: yes
+      mode:  0644
+      marker: "# {mark} ANSIBLE MANAGED BLOCK proxy proxy_post.yml"
+      state: "{{ 'present' if HTTP_PROXYHOST != '' else 'absent' }}"
+      block: |
+        HTTP_PROXY={{HTTP_PROXYTYPE}}://{{HTTP_PROXYHOST}}:{{HTTP_PROXYPORT}}
+        HTTPS_PROXY={{HTTPS_PROXYTYPE}}://{{HTTPS_PROXYHOST}}:{{HTTPS_PROXYPORT}}
+
+  when:
+    - "'docker' in HOSTVMS_FEATURES|default([])"
+
+- name: Run c-toxcore ctest on the tester
+  delegate_to: localhost
+  shell: |
+    [ -d {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build ] || exit 0
+    cd {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build || exit 1
+    ctest
+    exit 0
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_TCP_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_announce_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_bootstrap_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_conference_av_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_conference_double_invite_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_conference_invite_merge_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_conference_peer_nick_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_conference_simple_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_conference_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_conference_two_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_crypto_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_dht_getnodes_api_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_encryptsave_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_file_saving_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_file_transfer_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_forwarding_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_friend_connection_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_friend_request_spam_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_friend_request_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_group_general_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_group_invite_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_group_message_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_group_moderation_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_group_save_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_group_state_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_group_sync_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_group_tcp_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_group_topic_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_invalid_tcp_proxy_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_invalid_udp_proxy_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_lan_discovery_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_lossless_packet_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_lossy_packet_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_network_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_onion_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_overflow_recvq_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_overflow_sendq_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_reconnect_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_save_compatibility_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_save_friend_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_save_load_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_send_message_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_set_name_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_set_status_message_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_tcp_relay_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_tox_dispatch_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_tox_events_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_tox_many_tcp_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_tox_many_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_tox_strncasecmp_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_toxav_basic_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_toxav_many_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_typing_test
+# {{TOXCORE_LOCAL_SRC}}/c-toxcore/_build/auto_tests/auto_version_test
+
+- name: Run c-toxcore dockerfiles on the tester
+  delegate_to: localhost
+  shell: |
+    [ -d {{TOXCORE_LOCAL_SRC}}/dockerfiles ] || exit 0
+    cd {{TOXCORE_LOCAL_SRC}}/dockerfiles || exit 1
+    exit 0
+
+# - alpine-s390x
+# - alpine-x86_64
+# - buildfarm
+# - compcert
+# - flutter
+# - frama-c
+# - freebsd
+# - ghc-android
+# - ghc
+# - haskell
+# - infer
+# - kythe
+# - nacl
+# - windows-qt5
+# - windows
+
+    
+- name: Run toxygen_wrapper on the tester
+  delegate_to: localhost
+  shell: |
+    [ -d {{TOXCORE_LOCAL_SRC}}/toxygen_wrapper ] || exit 0
+    cd {{TOXCORE_LOCAL_SRC}}/toxygen_wrapper || exit 1
+    exit 0
+
--- a/roles/toxcore/tasks/vms.yml
+++ b/roles/toxcore/tasks/vms.yml
@ -0,0 +1,144 @@
+# -*- mode: yaml; indent-tabs-mode: nil; tab-width: 2; coding: utf-8-unix -*-
+
+---
+
+- name: "toxcore vms.yml"
+  debug:
+    verbosity: 1
+    msg: "toxcore vms.yml TOXCORE_FEATURES={{TOXCORE_FEATURES}}"
+
+- name: "assert /dev/kvm"
+  shell: |
+    [ -e /dev/kvm ]
+  delegate_to: localhost
+  
+- name: "make a directory for /etc/pki/qemu"
+  file:
+    path: "{{item }}"
+    state: directory
+    owner: "{{BOX_ROOT_USER}}"
+    group: "{{BOX_ROOT_GROUP}}"
+    mode: 0770
+  when:
+    - "item != ''"
+  with_items:
+    # see /etc/libvirt/qemu.conf
+    - "{{ '/etc/pki/qemu' if ( 'qemu' in TOXCORE_FEATURES or 'libvirt' in TOXCORE_FEATURES ) else '' }}"
+
+- block:
+
+  - name: increase fs.inotify.max_user_instances (default 128)
+    blockinfile:
+      dest: /etc/sysctl.d/70_toxcore_libvirt.conf
+      marker: "# {mark} ANSIBLE MANAGED BLOCK toxcore lxd"
+      mode: 0440
+      group: "{{BOX_ALSO_GROUP}}"
+      create: yes
+      block: |
+        net.ipv4.ip_forward = 1
+
+  # NB this is per user
+  - name: check ulimit
+    shell: |
+      [ `ulimit -n` -lt 4913709 ]
+    register: ulimit_retval
+
+  # Kernel ulimit is less than the expected value! This might induce RC test
+  - name: /etc/security/limits.conf
+    blockinfile:
+      dest: /etc/security/limits.conf
+      create: yes
+      marker: "# {mark} ANSIBLE MANAGED BLOCK harden vms.yml lxd"
+      backup: 'yes'
+      mode: 0644
+      owner: "{{BOX_ROOT_USER}}"
+      group: "{{BOX_ROOT_GROUP}}"
+      block: |
+        root    soft    nofile  1048576
+        root    hard    nofile  1048576
+        # libvirt/whonix seems to run out at 1024 user tor in the contrainer
+        *       soft    nofile  1048576
+        *       hard    nofile  1048576
+        *       soft    memlock unlimited
+        *       hard    memlock unlimited
+    # FixMe: either this or @ docker break su with a cryptic
+    # pam_open_session: Permission denied
+    # with dmesg entries of
+    # elogind-daemon[7069]: Failed to open pin file: No such file or
+    # elogind-daemon[7069]: Failed to allocate manager object: No such file or
+    # and then later when with no limts.conf but still with a chown error on ~/
+    # su: Error in services module
+
+    # need this in libvirt guest.
+    when:
+      # do this anyway for tor and everybody else
+      - true or ulimit_retval.rc|default(1) == 0
+
+  when:
+    - true or ansible_connection|default('') not in PLAY_CHROOT_CONNECTIONS
+
+# https://github.com/lxc/lxc/issues/3068
+# lxc-create -t download -n my-container -- --keyserver hkp://p80.pool.sks-keyservers.net:80
+# Hope this helps others if it didn't at least help you
+# libvirt lxc docker
+- block:
+
+  # see also https://stackoverflow.com/questions/26415833/docker-ignores-limits-conf-trying-to-solve-too-many-open-files-error
+  # FixMe: conflicts with harden - use sysctl.d
+  # add to your /etc/sysctl.conf : fs.file-max = 64000
+  - name: Add fs.file-max to /etc/sysctl.conf
+    lineinfile:
+      dest: /etc/sysctl.conf
+      regexp: '^#* *{{item.key}}.*'
+      line: "{{item.key}} = {{item.val}}"
+      create: true
+      state: present
+    with_items:
+      - { key: "fs.file-max", val: "4913709" }
+      #? - {key: "net.ipv4.ip_forward", val: "0"}
+      #? not sure about this - see docker check-config.sh
+      - { key: "kernel.keys.root_maxkeys", val: "1000000" }
+    check_mode: false
+
+  - name: /etc/sysctl.conf.d/20_hugepages.conf
+    check_mode: false
+    lineinfile:
+      dest: /etc/sysctl.conf.d/20_hugepages.conf
+      regexp: '^#* *{{item.key}}.*'
+      line: "{{item.key}} = {{item.val}}"
+      state: present
+    with_items:
+# https://wiki.archlinux.org/title/KVM#Enabling_huge_pages
+# boot cmdline hugepages=
+      - { key: "vm.nr_hugepages", val: "550" }
+
+  when:
+    - ansible_virtualization_role|replace('NA', 'host') == 'host' or
+        ansible_virtualization_role|replace('NA', 'host') == 'guest'
+
+  rescue:
+    - debug:
+        verbosity: 1
+        msg: "Ignoring error"
+    
+#libvirt
+- block:
+
+  # /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/network.conf --leasefile-ro --dhcp-script=/usr/libexec/libvirt_leaseshelper
+  - name: "/bind-dynamic/bind-interfaces/ -i /var/lib/libvirt/dnsmasq/default.conf"
+    shell: |
+      [ -f {{item}} ] || exit 0
+      sed -e 's/bind-dynamic/bind-interfaces/' -i {{item}}
+      #? virsh net-edit default
+    # maybe just check ifconfig for ...
+    # bogus? var/lib?
+    with_items:
+      - /var/lib/libvirt/dnsmasq/network.conf
+      - /var/lib/libvirt/dnsmasq/default.conf
+    ignore_errors: true
+
+  when:
+    - "'libvirt' in TOXCORE_FEATURES" # or 'lxd' in TOXCORE_FEATURES"
+    - ( ansible_virtualization_type is not defined or
+        not (ansible_virtualization_type in ['chroot', 'lxc', 'lxd', 'docker', 'qemu', 'kvm']))
+
--- a/roles/toxcore/vars/Devuan5.yml
+++ b/roles/toxcore/vars/Devuan5.yml
@ -0,0 +1,213 @@
+# -*- mode: yaml; indent-tabs-mode: nil; tab-width: 2; coding: utf-8-unix -*-
+
+---
+
+# TOXCORE_FEATURES: ['virtualbox', 'libvirt', docker']
+
+toxcore_system_users:   "{{ BOX_USER_NAME }}"
+toxcore_also_users: "{{ BOX_ALSO_USERS }}"
+
+toxcore_standard_users_groups:
+  - disk
+  - "{{ 'libvirt-qemu' if 'libvirt' in TOXCORE_FEATURES else '' }}"
+  - "{{ 'kvm' if ( 'qemu' in TOXCORE_FEATURES or 'libvirt' in TOXCORE_FEATURES ) else '' }}"
+  - "{{ 'docker' if 'docker' in TOXCORE_FEATURES else '' }}"
+
+toxcore_libvirt_services:
+  - "{{ 'libvirtd' if 'libvirt' in TOXCORE_FEATURES else '' }}"
+  - "{{ 'virtlogd' if 'libvirt' in TOXCORE_FEATURES else '' }}"
+  - "{{ 'docker' if 'docker' in TOXCORE_FEATURES else '' }}"
+
+toxcore_debs_inst:
+  - gpg
+  - nbdkit
+  - nbd-client
+  - nbd-server
+  - python3-yaml
+  - gparted
+  - ebtables
+  - dnsmasq-base
+  # vagrant-libvirt/README.md
+  - libxslt-dev
+  - libxml2-dev
+  - zlib1g-dev
+  - iptables
+  - zstd
+  - bridge-utils
+  - sdparm
+  - hdparm
+  - libxml2
+  - zerofree
+  - openssh-sftp-server
+  - sshfs
+  - xmlstarlet
+  - libtss2-tcti-swtpm0
+# toxcore
+  - libconfig-dev
+  - libgtest-dev
+  - ninja-build
+  - pkg-config
+  - zip
+  - grep
+  - file
+  - ca-certificates
+  - autotools-dev
+  - autoconf
+  - automake
+  - git
+  - bc
+  - wget
+  - rsync
+  - cmake
+  - make
+  - pkg-config
+  - libtool
+  - ssh
+  - gzip
+  - tar
+  - unzip
+  - libcurl4-gnutls-dev
+  - coreutils
+  - libavutil-dev
+  - libsodium-dev
+  - libffms2-4
+  - libgpac10
+  - libx264-dev
+  - x264
+  - libv4lconvert0
+  - libv4l-dev
+  - libv4l-dev
+  - libv4l2rds0
+  - v4l-conf
+  - v4l-utils
+  - libv4l-dev
+  - libtool
+  - autotools-dev
+  - automake
+  - checkinstall
+  - check
+  - git
+  - yasm
+  - libv4lconvert0
+  - libv4l-dev
+  - libopus-dev
+  - libvpx-dev
+  - pkg-config
+  - libx264-dev
+  - libavcodec-dev
+  - libavdevice-dev
+# nbd
+  - genisoimage
+  - bridge-utils
+  - guestfsd
+  - libvirt-clients
+  - libvirt-daemon
+  - libvirt-daemon-system
+  - libvirt-daemon-driver-storage-zfs
+  - python3-libvirt
+  - virt-manager
+  - virtinst
+  - python3-hacking
+#  - cloud-init
+
+toxcore_qemu_debs_inst:
+  - qemu-kvm
+  - qemu
+  - qemu-block-extra
+  - qemu-system-common
+  - qemu-system-data
+  - qemu-system-x86
+  - qemu-utils
+  - guestfsd
+  - grub-firmware-qemu
+  - nbd-client
+  - aqemu
+  - seabios
+  - squashfs-tools
+  - attr
+  - zerofree
+  - nbdkit
+  - sgabios
+  - lzop
+  - firmware-realtek
+  - firmware-linux-free
+
+proxy_libvirt_debs_inst:
+  - libvirt-daemon-system
+  - libvirt-daemon
+  - libvirt-daemon-driver-vbox
+  - libvirt-daemon-driver-qemu
+  - libvirt-clients
+  - libvirt-daemon-driver-storage-zfs
+  - python3-libvirt
+  - virt-manager
+  - virtinst
+  - usbutils
+  - usb.ids
+  - guestfsd
+  - libguestfs-perl
+  - libguestfs-tools
+  #
+  - genisoimage
+  - bridge-utils
+  - guestfsd
+  - python3-hacking
+#?  - cloud-init
+
+toxcore_lxd_debs_absent:
+  - lxd
+  - lxd-client
+  - lxcfs
+  - liblxc1
+  - liblxc-common
+
+toxcore_lxd_debs_inst:
+  - lxcfs
+  - zfsutils-linux
+
+# see proxy_libvirt_debs_inst
+toxcore_libvirt_debs_inst:
+  - python3-libvirt
+  - libvirt-dev
+  - libguestfs
+  - libguestfs-tools
+  # OUCH 4G!
+  - libguestfs-appliance
+  - virt-top
+
+toxcore_packer_debs_inst:
+  - jq
+
+toxcore_docker_debs_inst:
+  - aufs-tools
+  - cgroup-lite
+  - linux-image-extra-virtual
+  - docker.io
+#  - docker-compose
+
+toxcore_ansible_debs_inst:
+  - jinja
+  - pycrypto
+  - python-ecdsa
+  - python-httplib2
+  - python-jinja2
+  - python-markupsafe
+  - python-paramiko
+
+toxcore_aws_debs_inst:
+# for aws
+  - boto
+  - bs4
+  - awscli
+
+toxcore_pips2_inst: []
+  
+toxcore_pips3_inst:
+  - pycrypto
+  - pywinrm
+  - requests-unixsocket
+  - ovirt-engine-sdk-python
+  - msgpack_python
+  - pysha3
+  - pycryptodomex
+  
--- a/roles/toxcore/vars/Gentoo2.yml
+++ b/roles/toxcore/vars/Gentoo2.yml
@ -0,0 +1,101 @@
+# -*- mode: yaml; indent-tabs-mode: nil; tab-width: 2; coding: utf-8-unix -*-
+---
+
+toxcore_system_users:   "{{ base_system_users }}"
+toxcore_also_users: "{{ base_also_users }}"
+
+toxcore_standard_users_groups:
+  - disk
+  - "{{ 'libvirt' if 'libvirt' in TOXCORE_FEATURES else '' }}"
+  - "{{ 'qemu' if ( 'qemu' in TOXCORE_FEATURES or 'libvirt' in TOXCORE_FEATURES ) else '' }}"
+  - "{{ 'kvm' if ( 'qemu' in TOXCORE_FEATURES or 'libvirt' in TOXCORE_FEATURES ) else '' }}"
+  - "{{ 'docker' if 'docker' in TOXCORE_FEATURES else '' }}"
+
+
+toxcore_libvirt_services:
+  - libvirtd
+#  - qemu-guest-agent
+
+toxcore_pkgs_inst_guest: []
+
+toxcore_pkgs_inst:
+  - net-firewall/iptables
+  - app-portage/gentoolkit
+  - sys-apps/gptfdisk
+  - app-admin/testdisk
+  - app-arch/zstd
+  - net-firewall/ebtables
+  - net-misc/bridge-utils
+  - sys-apps/sdparm
+  - sys-apps/hdparm
+  ### virt-manager
+  - media-libs/libvpx
+  - net-libs/libpsl
+  - x11-libs/libxcb
+  - x11-libs/libxkbcommon
+  - dev-libs/libxml2
+  - dev-python/argcomplete
+  - dev-python/libvirt-python
+  - dev-python/pygobject
+  - dev-python/requests
+  - gnome-base/dconf
+  - net-libs/gtk-vnc
+  - net-misc/spice-gtk
+  - sys-apps/dbus
+  - x11-libs/gtk+
+  - x11-libs/gtksourceview
+  - x11-libs/vte
+
+toxcore_pkgs_masked:
+  - x11-drivers/xf86-video-amdgpu
+  - x11-drivers/xf86-video-mga
+  - x11-drivers/xf86-video-radeon
+  - x11-drivers/xf86-video-siliconmotion
+  - x11-drivers/xf86-video-via
+
+toxcore_zfs_pkgs_inst:
+  - sys-fs/zfs-kmod
+  - sys-fs/zfs
+
+toxcore_qemu_pkgs_inst:
+  - app-emulation/qemu
+  - app-emulation/aqemu
+  - app-emulation/spice
+  - net-misc/spice-gtk
+  - qemu-guest-agent
+
+toxcore_libvirt_pkgs_inst:
+  - app-emulation/libvirt
+  - dev-python/libvirt
+  - app-emulation/virt-manager
+  - app-emulation/virt-viewer
+  - x11-drivers/xf86-video-qxl
+#  - sys-block/open-iscsi
+  - sys-firmware/edk2-ovmf
+  - app-emulation/libguestfs
+  - sys-block/nbd
+#?  - app-emulation/libguestfs-appliance
+  - dev-python/libvirt-python
+  - app-emulation/virtiofsd
+
+toxcore_docker_pkgs_inst:
+  - sys-process/tini
+  - app-emulation/docker
+  #? - dev-python/docker-pycreds
+  - dev-python/dockerpty
+  - dev-python/docker-py
+  - app-containers/docker
+#  - app-containers/docker-compose
+
+toxcore_pips2_inst: []
+
+toxcore_pips3_inst:
+  - pycrypto
+  - pywinrm
+  - requests-unixsocket
+  - ovirt-engine-sdk-python
+  - msgpack_python
+  - pysha3
+  - pycryptodomex
+  - pyanalyze
+
--- a/roles/toxcore/vars/Linux.yml
+++ b/roles/toxcore/vars/Linux.yml
@ -0,0 +1,37 @@
+# -*- mode: yaml; indent-tabs-mode: nil; tab-width: 2; coding: utf-8-unix -*-
+---
+
+# from BOX
+toxcore_system_users: "{{ base_system_users }}"
+toxcore_standard_users: "{{ base_standard_users }}"
+
+toxcore_etc_initd_libvirt_name: libvirtd
+
+toxcore_kmods_in_host:
+  - "{{ 'kvm' if ( ( 'qemu' in TOXCORE_FEATURES or 'libvirt' in TOXCORE_FEATURES ) and 'virtualbox' not in TOXCORE_FEATURES ) else '' }}"
+  - "{{ 'qxl' if ( 'qemu' in TOXCORE_FEATURES or 'libvirt' in TOXCORE_FEATURES ) else '' }}"
+  - "{{ 'nbd' if ( 'qemu' in TOXCORE_FEATURES or 'libvirt' in TOXCORE_FEATURES ) else '' }}"
+
+toxcore_kmods_not_in_host:
+  # I'm not sure kvm should be missing anymore 5+
+  # FixMe: how do these conflict? qemu libvirt
+  - "{{ 'kvm' if 'virtualbox' in TOXCORE_FEATURES else '' }}"
+
+toxcore_gpg_keys_system:
+
+  - uid: "30737D12308C9D0C882FC34B57CB0A121BAECB2E"
+    primary: "70ACBB6BFEE7BC572A8941D19266C4FA11FD00FD"
+    name: "Daniel Robbins (metro:node) <drobbins@funtoo.org>"
+    key: "9266C4FA11FD00FD"
+
+toxcore_services_enabled: []
+#  - qemu-guest-agent
+
+toxcore_services_started:
+  - "{{ toxcore_libvirt_services if 'libvirt' in TOXCORE_FEATURES else [] }}"
+  # not on Gentoo 5
+  #?  - "{{ 'docker'   if 'docker'  in TOXCORE_FEATURES else '' }}"
+
+toxcore_services_stopped:
+  - "{{ toxcore_libvirt_services if 'libvirt' not in TOXCORE_FEATURES else [] }}"
+
--- a/roles/toxcore/vars/Makefile
+++ b/roles/toxcore/vars/Makefile
@ -0,0 +1,25 @@
+# -*-mode: text; fill-column: 75; tab-width: 8; coding: utf-8-dos -*-
+
+test::
+
+update:: funtoo
+
+p_src.yaml:: /p/src/_p_src.yaml
+	( cd /p/src && $(MAKE) $(MFLAGS) funtoo )
+
+world.lis:: /var/lib/portage/world Makefile
+	cp -p /var/lib/portage/world world.lis
+	grep -h '^ *- .*/' main.yml base.yml p_src.yaml \
+	| sed -e 's@/@\\/@' -e 's@^ *- @/@' -e 's@$$@/d@' > world.sed
+	sed -f world.sed -i world.lis
+	
+funtoo:: world.lis Makefile
+	cp /dev/null python_world.lis
+	grep ^dev-python world.lis | while read file ; do \
+		grep -q "^- $$file" p_src.yaml && continue ; \
+		echo "$$file"  >> python_world.lis ; \
+	    done
+
+clean::
+#	find * -type f -name \*~ -exec rm '{}' \;
+	rm -f *~ world.sed
--- a/roles/toxcore/vars/Ubuntu18.yml
+++ b/roles/toxcore/vars/Ubuntu18.yml
@ -0,0 +1,155 @@
+# -*- mode: yaml; indent-tabs-mode: nil; tab-width: 2; coding: utf-8-unix -*-
+
+---
+
+# , 'lxd' 'vagrant'
+TOXCORE_FEATURES: ['libvirt'] # 'docker', 'packer'
+
+toxcore_system_users:   "{{ base_system_users }}"
+toxcore_also_users: "{{ base_also_users }}"
+
+toxcore_libvirt_services:
+  - libvirtd
+
+toxcore_debs_inst:
+  - python-yaml
+  - gparted
+  - libvncserver
+  - ebtables
+  - dnsmasq-base
+  # vagrant-libvirt/README.md
+  - libxslt-dev
+  - libxml2-dev
+  - zlib1g-dev
+  - iptables
+  - zstd
+  - ebtables
+  - bridge-utils
+  - sdparm
+  - hdparm
+  - libxml2
+  - sdparm
+  - hdparm
+  - libxml2
+  - zerofree
+  - openssh-sftp-server
+  - sshfs
+  - xmlstarlet
+  - libtss2-tcti-swtpm0
+# toxcore
+  - libconfig-dev
+  - libgtest-dev
+  - ninja-build
+  - pkg-config
+  - zip
+  - grep
+  - file
+  - ca-certificates
+  - autotools-dev
+  - autoconf
+  - automake
+  - git
+  - bc
+  - wget
+  - rsync
+  - cmake
+  - make
+  - pkg-config
+  - libtool
+  - ssh
+  - gzip
+  - tar
+  - unzip
+  - libcurl4-gnutls-dev
+  - coreutils
+  - libavutil-dev
+  - libsodium-dev
+  - libffms2-4
+  - libgpac10
+  - libx264-dev
+  - x264
+  - libv4lconvert0
+  - libv4l-dev
+  - libv4l-dev
+  - libv4l2rds0
+  - v4l-conf
+  - v4l-utils
+  - libv4l-dev
+  - libtool
+  - autotools-dev
+  - automake
+  - checkinstall
+  - check
+  - git
+  - yasm
+  - libv4lconvert0
+  - libv4l-dev
+  - libopus-dev
+  - libvpx-dev
+  - pkg-config
+  - libx264-dev
+  - libavcodec-dev
+  - libavdevice-dev
+
+toxcore_lxd_debs_absent:
+  - lxd
+  - lxd-client
+  - lxcfs
+  - liblxc1
+  - liblxc-common
+
+toxcore_lxd_pkgs_inst:
+  - lxcfs
+#  - lxd
+#  - lxd-client
+  - zfsutils-linux
+# or snapd
+
+toxcore_qemu_debs_inst:
+  - qemu-kvm
+
+toxcore_libvirt_debs_inst:
+#?  - libvirt
+  - libvirt-bin
+  - libvirt-dev
+  - virt-manager
+  - libguestfs
+  - libguestfs-tools
+  # OUCH 4G!
+#  - libguestfs-appliance
+  - python-libvirt
+  - qemu
+
+toxcore_virtualbox_debs_inst:
+  - virtualbox
+  - virtualbox-modules
+  - virtualbox-ext-pack
+# virtualbox bridged networking
+
+toxcore_packer_debs_inst:
+  - jq
+
+toxcore_docker_debs_inst:
+  - aufs-tools
+  - cgroup-lite
+  - libsystemd-journal0
+  - linux-image-extra-virtual
+  - docker.io
+
+toxcore_ansible_debs_inst:
+  - jinja
+  - pycrypto
+  - paramiko
+  - python-ecdsa
+  - python-httplib2
+  - python-jinja2
+  - python-markupsafe
+  - python-paramiko
+
+toxcore_aws_debs_inst:
+# for aws
+  - boto
+  - bs4
+  - requests_ntlm
+  - awscli
+