Commit 1f3071f2a1c3

@@ -6,8 +6,16 @@
 # Prerequisites: Fedora CSB installed, user has sudo access
 # Usage: ./bootstrap.sh
 #   Or remotely: ssh vdemeest@aomi.home 'bash -s' < imperative/aomi/bootstrap.sh
+#
+# Can also be sourced to run individual phases without poisoning the calling
+# shell with errexit:
+#   bash -c 'source imperative/aomi/bootstrap.sh && setup_crc'
 
-set -euo pipefail
+# Only enable strict mode when executed directly, not when sourced — otherwise
+# a failing command would kill the interactive shell that sourced this file.
+if [[ "${BASH_SOURCE[0]:-}" == "${0}" ]]; then
+	set -euo pipefail
+fi
 
 readonly GREEN='\033[0;32m'
 readonly YELLOW='\033[1;33m'
@@ -18,6 +26,10 @@ REPO_URL="${REPO_URL:-https://git.sbr.pm/home.git}"
 REPO_PATH="${REPO_PATH:-$HOME/src/home}"
 SYSTEM_CONFIG="${SYSTEM_CONFIG:-aomi}"
 
+# CRC (OpenShift Local) — public mirror (no login required)
+CRC_URL="${CRC_URL:-https://mirror.openshift.com/pub/openshift-v4/clients/crc/latest/crc-linux-amd64.tar.xz}"
+CRC_PULL_SECRET="${CRC_PULL_SECRET:-$HOME/.crc/pull-secret.json}"
+
 log_info() { echo -e "${GREEN}[INFO]${NC} $*"; }
 log_warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
 log_error() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
@@ -165,7 +177,8 @@ install_native_apps() {
 		kitty \
 		xwayland-satellite \
 		xdg-desktop-portal-gnome \
-		xdg-desktop-portal-gtk
+		xdg-desktop-portal-gtk \
+		libvirt
 
 	# Flatpak apps (sandboxed, auto-updating)
 	if ! command -v flatpak &>/dev/null; then
@@ -347,6 +360,62 @@ setup_wireguard() {
 	log_warn "Then re-run:  sudo systemctl restart wg-quick@wg0"
 }
 
+# --- Phase 7: CRC (OpenShift Local) ---
+
+setup_crc() {
+	# CRC runs a single-node OpenShift cluster in a libvirt VM. It requires
+	# libvirt + NetworkManager (installed via install_native_apps) and a Red Hat
+	# pull secret (download from https://console.redhat.com/openshift/create/local).
+	log_info "Setting up CRC (OpenShift Local)..."
+
+	# CRC needs the user in the libvirt group to manage the VM
+	if ! id -nG "$USER" | grep -qw libvirt; then
+		log_info "Adding $USER to libvirt group..."
+		sudo usermod -aG libvirt "$USER"
+		log_warn "Log out/in (or reboot) for libvirt group membership to take effect"
+	fi
+	sudo systemctl enable --now libvirtd 2>/dev/null || true
+
+	# Install the crc binary into ~/bin if missing
+	if command -v crc &>/dev/null; then
+		log_info "crc already installed: $(crc version 2>/dev/null | head -1)"
+	else
+		log_info "Downloading crc from $CRC_URL ..."
+		local tmpdir
+		tmpdir=$(mktemp -d)
+		if curl -fSL "$CRC_URL" -o "${tmpdir}/crc-linux-amd64.tar.xz"; then
+			tar -xf "${tmpdir}/crc-linux-amd64.tar.xz" -C "${tmpdir}"
+			mkdir -p "$HOME/bin"
+			install -m 755 "${tmpdir}"/crc-linux-*-amd64/crc "$HOME/bin/crc"
+			log_info "crc installed to $HOME/bin/crc"
+		else
+			log_warn "Failed to download crc; skipping (set CRC_URL or install manually)"
+			rm -rf "${tmpdir}"
+			return 0
+		fi
+		rm -rf "${tmpdir}"
+	fi
+
+	export PATH="$PATH:$HOME/bin"
+
+	# Pull secret is required for `crc start`; warn rather than fail
+	if [[ ! -f "$CRC_PULL_SECRET" ]]; then
+		log_warn "CRC pull secret not found at $CRC_PULL_SECRET"
+		log_warn "  Download it from https://console.redhat.com/openshift/create/local"
+		log_warn "  and save it there, then run: crc setup && crc start --pull-secret-file $CRC_PULL_SECRET"
+		log_warn "Skipping 'crc setup' until pull secret is present"
+		return 0
+	fi
+
+	log_info "Running 'crc setup'..."
+	crc setup
+
+	log_info "CRC ready. Start the cluster with:"
+	log_info "  crc start --pull-secret-file $CRC_PULL_SECRET"
+}
+
+# --- Phase 7: summary ---
+
 print_summary() {
 	log_info ""
 	log_info "╔══════════════════════════════════════════╗"
@@ -356,6 +425,7 @@ print_summary() {
 	log_info "║  System-manager: ✓ activated             ║"
 	log_info "║  Home-manager:   ✓ activated             ║"
 	log_info "║  Native apps:    ✓ installed             ║"
+	log_info "║  CRC:            ✓ installed (needs pull) ║"
 	log_info "╠══════════════════════════════════════════╣"
 	log_info "║  Rebuild system:                         ║"
 	log_info "║    nix build .#systemConfigs.aomi        ║"
@@ -405,8 +475,15 @@ main() {
 	setup_lid
 	setup_unscd
 	setup_home_manager
+	setup_crc
 	setup_shell
 	print_summary
 }
 
-main "$@"
+# Only run main when executed directly, not when sourced. This lets you run
+# individual phases, e.g. (use bash, the script targets bash):
+#   source imperative/aomi/bootstrap.sh
+#   setup_crc
+if [[ "${BASH_SOURCE[0]:-}" == "${0}" ]]; then
+	main "$@"
+fi

@@ -57,6 +57,31 @@ sudo cat /etc/wireguard/private.key | wg pubkey
 sudo systemctl restart wireguard-wg0
 ```
 
+## Local OpenShift (CRC)
+
+The bootstrap installs **CRC (OpenShift Local)** — a single-node
+OpenShift cluster running in a libvirt VM. The `crc` binary is
+downloaded to `~/bin`. Requires a Red Hat pull secret (download from
+<https://console.redhat.com/openshift/create/local> and save to
+`~/.crc/pull-secret.json`), then:
+
+```bash
+crc setup
+crc start --pull-secret-file ~/.crc/pull-secret.json
+```
+
+CRC needs `libvirt`/`NetworkManager` (installed by the bootstrap) and the
+user in the `libvirt` group (added by the bootstrap; log out/in to apply).
+
+For a lighter MicroShift-style cluster, use the CRC preset instead of a
+separate install (the `@redhat-et/microshift` Fedora COPR is abandoned;
+MicroShift is now RHEL-only):
+
+```bash
+crc config set preset microshift
+crc setup && crc start --pull-secret-file ~/.crc/pull-secret.json
+```
+
 ## Syncthing
 
 After activation, Syncthing runs as a system service under the