Stage 6: server image with a console installer (0.4.0)

- server/ profile and build-iso.sh [desktop|server]; make iso-server,
  make qemu-server, run-qemu.sh --serial; login on tty and ttyS0
- das-server: SSH, chrony, NetworkManager/dhcpcd, Docker with Compose,
  nftables (closed except SSH, own table), fail2ban reading socklog,
  sshd without root passwords, Docker log rotation, tools
- das-server-install: dialog installer in Ukrainian and English, or
  unattended with --config; GPT + Btrfs subvolumes, GRUB for UEFI and BIOS,
  serial console, SSH key with optional keys-only logins
- das-install-common: mount-source and postinstall shared with Calamares
- dsv: runit service manager (list, enable, disable, start, stop,
  restart, status, logs) with bash completion, also on the desktop
- das-update split into a subpackage without GTK; the window and tray
  icon move to /usr/libexec/das/das-update-gui
- das-snapper-setup enables dbus, which snapper needs
- TODO: ISO size review with measured numbers and options

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

srcpkgs/das-install-common/files/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Das
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

srcpkgs/das-install-common/files/mount-source

@@ -0,0 +1,17 @@
+#!/bin/sh
+# Mount the clean live image for Calamares' unpackfs at /run/das-installer/root.
+#
+# Dracut runs the live root as a device-mapper snapshot (live-rw) that also
+# holds the live user and boot-time tweaks. Its origin, live-base, is the
+# untouched LiveOS/rootfs.img; mount it read-only without journal replay.
+set -eu
+
+root=/run/das-installer/root
+mountpoint -q "$root" && exit 0
+
+if [ ! -b /dev/mapper/live-base ]; then
+	echo "mount-source: /dev/mapper/live-base not found, is this the live system?" >&2
+	exit 1
+fi
+mkdir -p "$root"
+mount -o ro,noload /dev/mapper/live-base "$root"

srcpkgs/das-install-common/files/postinstall

@@ -0,0 +1,71 @@
+#!/bin/sh
+# Finish a Das OS installation. The installers (Calamares, das-server-install)
+# run this inside the target system after users and locale are configured,
+# before GRUB.
+set -eu
+
+msg() { echo "das-postinstall: $*"; }
+
+# Calamares writes LANG to /etc/locale.conf, but glibc on Void only builds the
+# locales enabled in /etc/default/libc-locales.
+lang=$(sed -n 's/^LANG=//p' /etc/locale.conf 2>/dev/null | tr -d '"')
+for l in "$lang" en_US.UTF-8; do
+	[ -n "$l" ] || continue
+	re=$(printf '%s' "$l" | sed 's/[.]/\\./g')
+	sed -i "s/^#\(${re} \)/\1/" /etc/default/libc-locales
+done
+msg "building locales"
+xbps-reconfigure -f glibc-locales
+
+# Calamares mounts /tmp on tmpfs only when the root disk is an SSD; Void's own
+# installer always does.
+if ! grep -q '^[^#]*[[:space:]]/tmp[[:space:]]' /etc/fstab; then
+	echo "tmpfs /tmp tmpfs defaults,nosuid,nodev 0 0" >>/etc/fstab
+fi
+
+# Guest tools only help inside their own hypervisor (VirtualBox's ones even
+# complain at every login elsewhere).
+machine=$(cat /sys/class/dmi/id/sys_vendor /sys/class/dmi/id/product_name 2>/dev/null || true)
+if ! grep -q '^flags.* hypervisor' /proc/cpuinfo; then
+	machine="real hardware"
+fi
+case $machine in
+*VirtualBox* | *innotek*) unused="spice-vdagent qemu-ga" ;;
+*QEMU* | *KVM*) unused="virtualbox-ose-guest" ;;
+*) unused="spice-vdagent qemu-ga virtualbox-ose-guest" ;;
+esac
+installed=""
+for pkg in $unused; do
+	xbps-query "$pkg" >/dev/null 2>&1 && installed="$installed $pkg"
+done
+case $installed in
+*spice-vdagent*) rm -f /etc/runit/runsvdir/default/spice-vdagentd ;;
+esac
+case $installed in
+# The live image replaces this autostart file, so xbps keeps it as modified
+*virtualbox*) rm -f /etc/xdg/autostart/vboxclient.desktop ;;
+esac
+if [ -n "$installed" ]; then
+	msg "removing guest tools not needed here:$installed"
+	# shellcheck disable=SC2086
+	xbps-remove -Ry $installed || true
+fi
+
+# Snapper, hourly snapshots and the GRUB snapshot menu (Btrfs only).
+das-snapper-setup
+
+# The installer copies files with rsync --sparse, which turns the zero tail of
+# a kernel image into a Btrfs hole that GRUB 2.12 can't read ("premature end
+# of file"). Rewrite the kernels in full.
+for f in /boot/vmlinuz-*; do
+	cp --sparse=never "$f" "$f.das-tmp"
+	mv "$f.das-tmp" "$f"
+done
+
+# The live image has a generic initramfs. Build the target's own the same way
+# Void does on kernel updates (host-only), with das-snapshot-overlay included.
+msg "building the initramfs"
+for kver in $(ls /usr/lib/modules); do
+	dracut -q --force "/boot/initramfs-$kver.img" "$kver"
+done
+msg "done"