Stage 6: server image with a console installer (0.4.0)

- server/ profile and build-iso.sh [desktop|server]; make iso-server,
  make qemu-server, run-qemu.sh --serial; login on tty and ttyS0
- das-server: SSH, chrony, NetworkManager/dhcpcd, Docker with Compose,
  nftables (closed except SSH, own table), fail2ban reading socklog,
  sshd without root passwords, Docker log rotation, tools
- das-server-install: dialog installer in Ukrainian and English, or
  unattended with --config; GPT + Btrfs subvolumes, GRUB for UEFI and BIOS,
  serial console, SSH key with optional keys-only logins
- das-install-common: mount-source and postinstall shared with Calamares
- dsv: runit service manager (list, enable, disable, start, stop,
  restart, status, logs) with bash completion, also on the desktop
- das-update split into a subpackage without GTK; the window and tray
  icon move to /usr/libexec/das/das-update-gui
- das-snapper-setup enables dbus, which snapper needs
- TODO: ISO size review with measured numbers and options

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

srcpkgs/das-server/files/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Das
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

srcpkgs/das-server/files/docker-daemon.json

@@ -0,0 +1,3 @@
+{
+	"log-driver": "local"
+}

srcpkgs/das-server/files/fail2ban-das.conf

@@ -0,0 +1,15 @@
+# Das OS: ban addresses that keep failing SSH logins, through nftables.
+[DEFAULT]
+banaction = nftables-multiport
+banaction_allports = nftables-allports
+
+[sshd]
+enabled = true
+backend = polling
+# socklog-void collects auth messages here. svlogd starts each line with a
+# UTC time stamp; the pattern also consumes the facility and the syslog date
+# that follow it, so the sshd filter sees "sshd-session[pid]: ...":
+# 2026-10-19T17:25:46.09500 auth.info: Oct 19 20:25:46 sshd-session[1154]: Invalid user ...
+logpath = /var/log/socklog/secure/current
+datepattern = ^%%Y-%%m-%%dT%%H:%%M:%%S\.%%f(?: \S+: \S+ +\d+ \S+)?
+logtimezone = UTC

srcpkgs/das-server/files/nftables.conf

@@ -0,0 +1,31 @@
+#!/usr/sbin/nft -f
+# Das OS server firewall: incoming connections are closed except SSH.
+#
+# Only the "das" table is replaced, so loading this file again
+# (dsv restart nftables) keeps the rules of Docker and fail2ban.
+# Ports that Docker containers publish (-p 8080:80) pass through Docker's
+# own forwarding rules, not the input chain below.
+
+table inet das
+delete table inet das
+
+table inet das {
+	chain input {
+		type filter hook input priority filter; policy drop;
+
+		ct state established,related accept
+		ct state invalid drop
+		iif lo accept
+		meta l4proto { icmp, ipv6-icmp } accept
+		# DHCPv6 answers come from the router's link-local address
+		ip6 saddr fe80::/10 udp dport dhcpv6-client accept
+		# Containers may reach services on the host (DNS, a database...)
+		iifname "docker0" accept
+		iifname "br-*" accept
+
+		tcp dport ssh accept
+
+		# Open more ports here, then: dsv restart nftables
+		# tcp dport { http, https } accept
+	}
+}

srcpkgs/das-server/files/sshd-das.conf

@@ -0,0 +1,4 @@
+# Das OS server defaults, see sshd_config(5). sshd keeps the first value it
+# reads, so a file sorted before this one (40-local.conf) overrides it.
+PermitRootLogin prohibit-password
+X11Forwarding no