From 1cc5b1f6c57478f35fd0fcfc75c97e1f8c987e84 Mon Sep 17 00:00:00 2001
From: brent s <bts@square-r00t.net>
Date: Sun, 8 Dec 2019 02:07:21 -0500
Subject: [PATCH] cleaning up aif

---
 schema/aif.xsd   | 625 ++++++++++++++++++++++++++++++++++++++++++++---
 schema/bdisk.xsd |   3 +
 schema/linux.xsd |  38 +++
 schema/net.xsd   |  95 ++++---
 schema/std.xsd   |  13 +
 schema/unix.xsd  |  18 +-
 6 files changed, 724 insertions(+), 68 deletions(-)

diff --git a/schema/aif.xsd b/schema/aif.xsd
index 3d1d1cf..cd8a220 100644
--- a/schema/aif.xsd
+++ b/schema/aif.xsd
@@ -11,23 +11,6 @@
            elementFormDefault="qualified"
            attributeFormDefault="qualified">
 
-    <xs:simpleType name="t_disksize">
-        <xs:restriction base="xs:string">
-            <xs:pattern value="[-|+]?\s*([0-9]+)\s*(%|((k|Ki)|[MGTPEZY]i?)?B?|)\s*"/>
-            <xs:whiteSpace value="collapse"/>
-        </xs:restriction>
-    </xs:simpleType>
-
-    <xs:simpleType name="t_iface_name">
-        <xs:union memberTypes="linux:t_iface_name">
-            <xs:simpleType>
-                <xs:restriction>
-                    <xs:enumeration value="auto"/>
-                </xs:restriction>
-            </xs:simpleType>
-        </xs:union>
-    </xs:simpleType>
-
     <xs:simpleType name="t_auto_ip6">
         <xs:union memberTypes="net:t_auto_ip6">
             <xs:simpleType>
@@ -40,14 +23,17 @@
         </xs:union>
     </xs:simpleType>
 
-    <xs:simpleType name="t_netproto">
-        <xs:union memberTypes="net:t_netproto">
-            <xs:simpleType>
-                <xs:restriction>
-                    <xs:enumeration value="both"/>
-                </xs:restriction>
-            </xs:simpleType>
-        </xs:union>
+    <xs:simpleType name="t_bootloaders">
+        <!-- TODO: expand?
+             https://wiki.archlinux.org/index.php/Category:Boot_loaders
+             https://wiki.archlinux.org/index.php/Arch_boot_process#Boot_loader -->
+        <xs:restriction base="xs:token">
+            <xs:enumeration value="grub"/>
+            <xs:enumeration value="systemd"/>
+            <xs:enumeration value="syslinux"/>
+            <xs:enumeration value="lilo"/>
+            <xs:whiteSpace value="collapse"/>
+        </xs:restriction>
     </xs:simpleType>
 
     <xs:simpleType name="t_dhcp_clients">
@@ -58,11 +44,9 @@
         </xs:restriction>
     </xs:simpleType>
 
-    <xs:simpleType name="t_netprov">
-        <xs:restriction base="xs:token">
-            <xs:enumeration value="netctl"/>
-            <xs:enumeration value="nm"/>
-            <xs:enumeration value="networkd"/>
+    <xs:simpleType name="t_disksize">
+        <xs:restriction base="xs:string">
+            <xs:pattern value="[-|+]?\s*([0-9]+)\s*(%|((k|Ki)|[MGTPEZY]i?)?B?|)\s*"/>
             <xs:whiteSpace value="collapse"/>
         </xs:restriction>
     </xs:simpleType>
@@ -211,6 +195,16 @@
         <xs:attribute name="searchDomain" type="std:t_nonempty" use="optional"/>
     </xs:complexType>
 
+    <xs:simpleType name="t_iface_name">
+        <xs:union memberTypes="linux:t_iface_name">
+            <xs:simpleType>
+                <xs:restriction>
+                    <xs:enumeration value="auto"/>
+                </xs:restriction>
+            </xs:simpleType>
+        </xs:union>
+    </xs:simpleType>
+
     <xs:complexType name="t_iface_wifi">
         <xs:complexContent>
             <xs:extension base="aif:t_iface">
@@ -225,6 +219,52 @@
         </xs:complexContent>
     </xs:complexType>
 
+    <xs:simpleType name="t_netproto">
+        <xs:union memberTypes="net:t_netproto">
+            <xs:simpleType>
+                <xs:restriction>
+                    <xs:enumeration value="both"/>
+                </xs:restriction>
+            </xs:simpleType>
+        </xs:union>
+    </xs:simpleType>
+
+    <xs:simpleType name="t_netprov">
+        <xs:restriction base="xs:token">
+            <xs:enumeration value="netctl"/>
+            <xs:enumeration value="nm"/>
+            <xs:enumeration value="networkd"/>
+            <xs:whiteSpace value="collapse"/>
+        </xs:restriction>
+    </xs:simpleType>
+
+    <xs:complexType name="t_nixpass">
+        <xs:choice minOccurs="1" maxOccurs="1">
+            <xs:element name="passwordPlain">
+                <xs:complexType>
+                    <xs:simpleContent>
+                        <xs:extension base="xs:string">
+                            <xs:attribute name="hashType" use="optional" default="sha512"
+                                          type="linux:t_passwd_hashtypes"/>
+                            <xs:attribute name="rounds" use="optional" default="5000" type="xs:positiveInteger"/>
+                        </xs:extension>
+                    </xs:simpleContent>
+                </xs:complexType>
+            </xs:element>
+            <xs:element name="passwordHash">
+                <xs:complexType>
+                    <xs:simpleContent>
+                        <xs:extension base="linux:t_shadowhash">
+                            <xs:attribute name="hashType" use="optional" default="(detect)"
+                                          type="aif:t_passwd_hashtypes_detect"/>
+                        </xs:extension>
+                    </xs:simpleContent>
+                </xs:complexType>
+            </xs:element>
+        </xs:choice>
+        <xs:attribute name="locked" use="optional" default="false" type="xs:boolean"/>
+    </xs:complexType>
+
     <xs:simpleType name="t_pacuri">
         <!-- xs:anyURI is too permissive. -->
         <!-- <xs:restriction base="xs:anyURI"> -->
@@ -244,4 +284,529 @@
         </xs:union>
     </xs:simpleType>
 
+    <!-- ROOT -->
+    <xs:element name="aif">
+        <xs:complexType>
+            <xs:all>
+                <!-- BEGIN BOOTSTRAP -->
+                <xs:element name="bootstrap" minOccurs="1" maxOccurs="1">
+                    <xs:complexType>
+                        <xs:all>
+                            <xs:element name="tarball" minOccurs="1" maxOccurs="1" type="aif:t_uri"/>
+                            <xs:element name="verify" minOccurs="0" maxOccurs="1">
+
+                            </xs:element>
+                        </xs:all>
+                    </xs:complexType>
+                </xs:element>
+                <!-- END BOOTSTRAP -->
+                <!-- BEGIN STORAGE -->
+                <xs:element name="storage" minOccurs="1" maxOccurs="1">
+                    <xs:complexType>
+                        <xs:all>
+                            <!-- BEGIN BLOCKDEVICES -->
+                            <xs:element name="blockDevices" minOccurs="0" maxOccurs="1">
+                                <xs:complexType>
+                                    <xs:sequence minOccurs="1" maxOccurs="unbounded">
+                                        <xs:element name="disk" minOccurs="1" maxOccurs="unbounded">
+                                            <xs:complexType>
+                                                <xs:sequence>
+                                                    <xs:element name="part" minOccurs="1" maxOccurs="unbounded">
+                                                        <xs:complexType>
+                                                            <xs:sequence minOccurs="0" maxOccurs="1">
+                                                                <xs:element name="partitionFlag" minOccurs="1"
+                                                                            maxOccurs="unbounded"
+                                                                            type="aif:t_part_flags"/>
+                                                            </xs:sequence>
+                                                            <xs:attribute name="id" type="xs:ID"
+                                                                          use="required"/>
+                                                            <xs:attribute name="name" type="aif:t_nonempty"
+                                                                          use="optional"/>
+                                                            <xs:attribute name="label" type="aif:t_nonempty"
+                                                                          use="optional"/>
+                                                            <xs:attribute name="start" type="aif:t_disksize"
+                                                                          use="required"/>
+                                                            <xs:attribute name="stop" type="aif:t_disksize"
+                                                                          use="required"/>
+                                                            <xs:attribute name="fsType" type="aif:t_fstype"
+                                                                          use="required"/>
+                                                        </xs:complexType>
+                                                    </xs:element>
+                                                </xs:sequence>
+                                                <xs:attribute name="id" type="xs:ID" use="required"/>
+                                                <xs:attribute name="device" type="aif:t_diskdev" use="required"/>
+                                                <xs:attribute name="diskFormat" type="aif:t_diskfmt" use="required"/>
+                                            </xs:complexType>
+                                            <xs:unique name="uniq_diskdev">
+                                                <xs:selector xpath="aif:disk"/>
+                                                <xs:field xpath="@device"/>
+                                            </xs:unique>
+                                        </xs:element>
+                                    </xs:sequence>
+                                </xs:complexType>
+                            </xs:element>
+                            <!-- END DISK -->
+                            <!-- BEGIN FILESYSTEMS -->
+                            <xs:element name="fileSystems" minOccurs="1" maxOccurs="1">
+                                <xs:complexType>
+                                    <xs:sequence>
+                                        <xs:element name="fs" minOccurs="1" maxOccurs="unbounded">
+                                            <xs:complexType>
+                                                <xs:sequence>
+                                                    <xs:element name="opt" minOccurs="0" maxOccurs="unbounded"
+                                                                type="aif:t_cmdopts"/>
+                                                </xs:sequence>
+                                                <xs:attribute name="id" type="xs:ID" use="required"/>
+                                                <xs:attribute name="source" type="xs:IDREF" use="required"/>
+                                                <!-- We validate this in-code because there's way too many and
+                                                     it's way too variable per-host. -->
+                                                <xs:attribute name="type" type="aif:t_nonempty" use="required"/>
+                                            </xs:complexType>
+                                        </xs:element>
+                                    </xs:sequence>
+                                </xs:complexType>
+                            </xs:element>
+                            <!-- END FILESYSTEMS -->
+                            <!-- BEGIN LUKS -->
+                            <xs:element name="luks" minOccurs="0" maxOccurs="1">
+                                <xs:complexType>
+                                    <xs:sequence>
+                                        <!-- TODO: add support for custom flags/opts? -->
+                                        <xs:element name="luksDev" minOccurs="1" maxOccurs="unbounded">
+                                            <xs:complexType>
+                                                <xs:sequence>
+                                                    <xs:element name="secrets" minOccurs="1"
+                                                                maxOccurs="10">
+                                                        <xs:complexType>
+                                                            <xs:sequence minOccurs="1" maxOccurs="unbounded">
+                                                                <xs:element name="passphrase" minOccurs="0"
+                                                                            maxOccurs="unbounded"
+                                                                            type="aif:t_nonempty"/>
+                                                                <!-- TODO: support URI to *read* bytes from? -->
+                                                                <xs:element name="keyFile" minOccurs="0"
+                                                                            maxOccurs="unbounded">
+                                                                    <xs:complexType>
+                                                                        <xs:simpleContent>
+                                                                            <xs:extension base="aif:t_filepath">
+                                                                                <xs:attribute name="size"
+                                                                                              type="xs:positiveInteger"
+                                                                                              use="optional"/>
+                                                                            </xs:extension>
+                                                                        </xs:simpleContent>
+                                                                    </xs:complexType>
+                                                                </xs:element>
+                                                            </xs:sequence>
+                                                        </xs:complexType>
+                                                    </xs:element>
+                                                </xs:sequence>
+                                                <xs:attribute name="id" type="xs:ID" use="required"/>
+                                                <xs:attribute name="name" type="aif:t_nonempty" use="required"/>
+                                                <xs:attribute name="source" type="xs:IDREF" use="required"/>
+                                            </xs:complexType>
+                                        </xs:element>
+                                    </xs:sequence>
+                                </xs:complexType>
+                                <xs:unique name="uniq_luks_name">
+                                    <xs:selector xpath="aif:luksDev"/>
+                                    <xs:field xpath="@name"/>
+                                </xs:unique>
+                            </xs:element>
+                            <!-- END LUKS -->
+                            <!-- BEGIN LVM -->
+                            <xs:element name="lvm" minOccurs="0" maxOccurs="1">
+                                <xs:complexType>
+                                    <xs:sequence>
+                                        <xs:element name="volumeGroup" minOccurs="1" maxOccurs="unbounded">
+                                            <xs:complexType>
+                                                <xs:all>
+                                                    <xs:element name="physicalVolumes" minOccurs="1" maxOccurs="1">
+                                                        <xs:complexType>
+                                                            <xs:sequence>
+                                                                <xs:element name="pv" minOccurs="1"
+                                                                            maxOccurs="unbounded">
+                                                                    <xs:complexType>
+                                                                        <xs:attribute name="id" type="xs:ID"
+                                                                                      use="required"/>
+                                                                        <xs:attribute name="source" type="xs:IDREF"
+                                                                                      use="required"/>
+                                                                    </xs:complexType>
+                                                                </xs:element>
+                                                            </xs:sequence>
+                                                        </xs:complexType>
+                                                    </xs:element>
+                                                    <xs:element name="logicalVolumes" minOccurs="1" maxOccurs="1">
+                                                        <xs:complexType>
+                                                            <xs:sequence>
+                                                                <xs:element name="lv" minOccurs="1"
+                                                                            maxOccurs="unbounded">
+                                                                    <xs:complexType>
+                                                                        <xs:sequence minOccurs="0"
+                                                                                     maxOccurs="unbounded">
+                                                                            <xs:element name="pvMember" minOccurs="1"
+                                                                                        maxOccurs="unbounded">
+                                                                                <xs:complexType>
+                                                                                    <xs:attribute name="source"
+                                                                                                  use="required"
+                                                                                                  type="xs:IDREF"/>
+                                                                                </xs:complexType>
+                                                                            </xs:element>
+                                                                        </xs:sequence>
+                                                                        <xs:attribute name="id" type="xs:ID"
+                                                                                      use="required"/>
+                                                                        <xs:attribute name="name" type="aif:t_nonempty"
+                                                                                      use="required"/>
+                                                                        <xs:attribute name="size" type="aif:t_lvsize"
+                                                                                      use="required"/>
+                                                                    </xs:complexType>
+                                                                </xs:element>
+                                                            </xs:sequence>
+                                                        </xs:complexType>
+                                                    </xs:element>
+                                                </xs:all>
+                                                <xs:attribute name="id" type="xs:ID" use="required"/>
+                                                <xs:attribute name="name" type="aif:t_nonempty" use="required"/>
+                                                <xs:attribute name="extentSize" type="aif:t_pesize" use="optional"
+                                                              default="0"/>
+                                            </xs:complexType>
+                                        </xs:element>
+                                    </xs:sequence>
+                                </xs:complexType>
+                                <xs:unique name="uniq_vg_names">
+                                    <xs:selector xpath="aif:volumeGroup"/>
+                                    <xs:field xpath="@name"/>
+                                </xs:unique>
+                                <xs:unique name="uniq_vg_lv">
+                                    <xs:selector xpath=".//aif:lv"/>
+                                    <xs:field xpath="@name"/>
+                                </xs:unique>
+                                <xs:unique name="uniq_vg_pv">
+                                    <xs:selector xpath=".//aif:pv"/>
+                                    <xs:field xpath="@source"/>
+                                </xs:unique>
+                            </xs:element>
+                            <!-- END LVM -->
+                            <!-- BEGIN MDADM -->
+                            <xs:element name="mdadm" minOccurs="0" maxOccurs="1">
+                                <xs:complexType>
+                                    <xs:sequence minOccurs="1" maxOccurs="unbounded">
+                                        <xs:element name="array" minOccurs="1" maxOccurs="unbounded">
+                                            <xs:complexType>
+                                                <xs:sequence minOccurs="1" maxOccurs="unbounded">
+                                                    <xs:element name="member" minOccurs="1" maxOccurs="unbounded">
+                                                        <xs:complexType>
+                                                            <xs:attribute name="source" type="xs:IDREF"
+                                                                          use="required"/>
+                                                        </xs:complexType>
+                                                    </xs:element>
+                                                </xs:sequence>
+                                                <xs:attribute name="id" use="required" type="xs:ID"/>
+                                                <xs:attribute name="name" use="required" type="aif:t_nonempty"/>
+                                                <xs:attribute name="meta" use="optional" default="1.2"
+                                                              type="aif:t_raid_meta"/>
+                                                <xs:attribute name="level" use="required" type="aif:t_raid_levels"/>
+                                                <!-- KB *only*. -->
+                                                <!-- Can be pretty important!
+                                                     https://www.zdnet.com/article/chunks-the-hidden-key-to-raid-performance/ -->
+                                                <xs:attribute name="chunkSize" use="optional" type="xs:positiveInteger"
+                                                              default="512"/>
+                                                <xs:attribute name="layout" use="optional" type="aif:t_raid_layout"
+                                                              default="none"/>
+                                            </xs:complexType>
+                                        </xs:element>
+                                    </xs:sequence>
+                                </xs:complexType>
+                                <xs:unique name="uniq_array_name">
+                                    <xs:selector xpath="aif:array"/>
+                                    <xs:field xpath="@name"/>
+                                </xs:unique>
+                            </xs:element>
+                            <!-- END MDADM -->
+                            <!-- BEGIN MOUNTPOINTS -->
+                            <xs:element name="mountPoints" minOccurs="1">
+                                <xs:complexType>
+                                    <xs:sequence minOccurs="1" maxOccurs="unbounded">
+                                        <xs:element name="mount" minOccurs="1" maxOccurs="unbounded">
+                                            <xs:complexType>
+                                                <xs:sequence minOccurs="0" maxOccurs="unbounded">
+                                                    <xs:element name="opt" minOccurs="1" maxOccurs="unbounded"
+                                                                type="aif:t_cmdopts"/>
+                                                </xs:sequence>
+                                                <xs:attribute name="source" type="xs:IDREF" use="required"/>
+                                                <xs:attribute name="target" type="aif:t_filepath" use="required"/>
+                                            </xs:complexType>
+                                            <xs:unique name="uniq_mnts_src">
+                                                <xs:selector xpath="aif:mount"/>
+                                                <xs:field xpath="@source"/>
+                                            </xs:unique>
+                                            <xs:unique name="uniq_mnts_tgt">
+                                                <xs:selector xpath="aif:mount"/>
+                                                <xs:field xpath="@target"/>
+                                            </xs:unique>
+                                        </xs:element>
+                                    </xs:sequence>
+                                </xs:complexType>
+                            </xs:element>
+                            <!-- END MOUNTPOINTS -->
+                        </xs:all>
+                    </xs:complexType>
+                </xs:element>
+                <!-- END STORAGE -->
+                <!-- BEGIN NETWORK -->
+                <xs:element name="network" minOccurs="1" maxOccurs="1">
+                    <xs:complexType>
+                        <xs:choice minOccurs="1" maxOccurs="unbounded">
+                            <xs:element name="ethernet" type="aif:t_iface" minOccurs="0" maxOccurs="unbounded"/>
+                            <xs:element name="wireless" type="aif:t_iface_wifi" minOccurs="0" maxOccurs="unbounded"/>
+                        </xs:choice>
+                        <!-- It's nearly impossible to validate FQDNs/hostnames in XSD, so we do it in-code. -->
+                        <xs:attribute name="hostname" type="aif:t_nonempty" use="required"/>
+                        <xs:attribute name="provider" type="aif:t_netprov" use="optional" default="networkd"/>
+                        <xs:attribute name="dhcpClient" type="aif:t_dhcp_clients" use="optional" default="dhcpcd"/>
+                    </xs:complexType>
+                    <xs:unique name="uniq_iface_eth">
+                        <xs:selector xpath="aif:ethernet|aif:wireless"/>
+                        <xs:field xpath="@device"/>
+                    </xs:unique>
+                </xs:element>
+                <!-- END NETWORK -->
+                <!-- BEGIN SYSTEM -->
+                <xs:element name="system" maxOccurs="1" minOccurs="1">
+                    <xs:complexType>
+                        <xs:all>
+                            <xs:element name="rootPassword" minOccurs="0" maxOccurs="1"
+                                        type="aif:t_nixpass"/>
+                            <xs:element name="locales" minOccurs="1" maxOccurs="1">
+                                <xs:complexType>
+                                    <xs:sequence minOccurs="1" maxOccurs="unbounded">
+                                        <xs:element name="locale" minOccurs="1" maxOccurs="unbounded">
+                                            <xs:complexType>
+                                                <xs:simpleContent>
+                                                    <xs:extension base="xs:token">
+                                                        <xs:attribute name="name" type="aif:t_nonempty" use="required"/>
+                                                    </xs:extension>
+                                                </xs:simpleContent>
+                                            </xs:complexType>
+                                        </xs:element>
+                                    </xs:sequence>
+                                </xs:complexType>
+                            </xs:element>
+                            <xs:element name="console" minOccurs="0" maxOccurs="1">
+                                <!-- vconsole.conf(5) -->
+                                <!-- timezone and kbd/xkbd are validated in-code. -->
+                                <xs:complexType>
+                                    <xs:all minOccurs="1">
+                                        <!-- These are validated in-code -->
+                                        <xs:element name="keyboard" minOccurs="1" maxOccurs="1">
+                                            <xs:complexType>
+                                                <xs:choice>
+                                                    <xs:element name="map" minOccurs="0" maxOccurs="1"
+                                                                type="aif:t_nonempty" default="us"/>
+                                                    <xs:element name="toggle" minOccurs="0" maxOccurs="1"
+                                                                type="aif:t_nonempty"/>
+
+                                                </xs:choice>
+                                            </xs:complexType>
+                                        </xs:element>
+                                        <xs:element name="text" minOccurs="0" maxOccurs="1">
+                                            <xs:complexType>
+                                                <xs:choice minOccurs="1" maxOccurs="3">
+                                                    <xs:element name="font" minOccurs="0" maxOccurs="1"
+                                                                type="aif:t_nonempty"/>
+                                                    <xs:element name="map" minOccurs="0" maxOccurs="1"
+                                                                type="aif:t_nonempty"/>
+                                                    <xs:element name="unicodeMap" minOccurs="0" maxOccurs="1"
+                                                                type="aif:t_nonempty"/>
+                                                </xs:choice>
+                                            </xs:complexType>
+                                        </xs:element>
+                                    </xs:all>
+                                </xs:complexType>
+                            </xs:element>
+                            <xs:element name="users" minOccurs="0" maxOccurs="1">
+                                <xs:complexType>
+                                    <xs:sequence>
+                                        <xs:element name="user" minOccurs="1" maxOccurs="unbounded">
+                                            <xs:complexType>
+                                                <xs:sequence>
+                                                    <xs:element name="password" minOccurs="0" maxOccurs="1"
+                                                                type="aif:t_nixpass"/>
+                                                    <xs:element name="xGroup" minOccurs="0" maxOccurs="unbounded">
+                                                        <xs:complexType>
+                                                            <xs:attribute name="name" type="aif:t_posixUserGroup"
+                                                                          use="required"/>
+                                                            <xs:attribute name="create" type="xs:boolean" use="optional"
+                                                                          default="false"/>
+                                                            <xs:attribute name="gid" type="xs:positiveInteger"
+                                                                          use="optional"/>
+                                                        </xs:complexType>
+                                                        <xs:unique name="uniq_grp">
+                                                            <xs:selector xpath="aif:xGroup"/>
+                                                            <xs:field xpath="@name"/>
+                                                        </xs:unique>
+                                                    </xs:element>
+                                                </xs:sequence>
+                                                <xs:attribute name="name" type="aif:t_posixUserGroup" use="required"/>
+                                                <xs:attribute name="home" type="aif:t_filepath" use="optional"/>
+                                                <xs:attribute name="uid" type="xs:positiveInteger" use="optional"/>
+                                                <xs:attribute name="group" type="aif:t_posixUserGroup" use="optional"/>
+                                                <xs:attribute name="gid" type="xs:positiveInteger" use="optional"/>
+                                                <xs:attribute name="comment" type="aif:t_nonempty" use="optional"/>
+                                                <xs:attribute name="sudo" type="xs:boolean" use="optional"
+                                                              default="false"/>
+                                                <xs:attribute name="sudoPassword" type="xs:boolean" use="optional"
+                                                              default="true"/>
+                                                <xs:attribute name="shell" type="aif:t_filepath" use="optional"
+                                                              default="/bin/bash"/>
+                                                <!-- TODO: change the positiveIntegers to xs:duration? or union? -->
+                                                <!-- Might be pointless since the smallest increment is 1 day in
+                                                     shadow(5). -->
+                                                <xs:attribute name="minAge" type="xs:positiveInteger" use="optional"/>
+                                                <xs:attribute name="maxAge" type="xs:positiveInteger" use="optional"/>
+                                                <xs:attribute name="warnDays" type="xs:positiveInteger"
+                                                              use="optional"/>
+                                                <xs:attribute name="inactiveDays" type="xs:positiveInteger"
+                                                              use="optional"/>
+                                                <xs:attribute name="expireDate" type="aif:t_epoch_or_iso"
+                                                              use="optional"/>
+                                            </xs:complexType>
+                                        </xs:element>
+                                    </xs:sequence>
+                                </xs:complexType>
+                                <xs:unique name="uniq_usr">
+                                    <xs:selector xpath="aif:user"/>
+                                    <xs:field xpath="@name"/>
+                                </xs:unique>
+                            </xs:element>
+                            <xs:element name="services" minOccurs="0" maxOccurs="1">
+                                <xs:complexType>
+                                    <xs:sequence>
+                                        <xs:element name="service" minOccurs="1" maxOccurs="unbounded">
+                                            <xs:complexType>
+                                                <xs:simpleContent>
+                                                    <xs:extension base="aif:t_nonempty">
+                                                        <xs:attribute name="status" type="xs:boolean" use="optional"
+                                                                      default="true"/>
+                                                    </xs:extension>
+                                                </xs:simpleContent>
+                                            </xs:complexType>
+                                            <xs:unique name="uniq_svc">
+                                                <xs:selector xpath="aif:service"/>
+                                                <xs:field xpath="@name"/>
+                                                <xs:field xpath="@status"/>
+                                            </xs:unique>
+                                        </xs:element>
+                                    </xs:sequence>
+                                </xs:complexType>
+                            </xs:element>
+                        </xs:all>
+                        <xs:attribute name="timezone" type="aif:t_nonempty" use="optional" default="UTC"/>
+                    </xs:complexType>
+                </xs:element>
+                <!-- END SYSTEM -->
+                <!-- BEGIN PACMAN -->
+                <xs:element name="pacman" maxOccurs="1" minOccurs="1">
+                    <xs:complexType>
+                        <xs:sequence>
+                            <xs:element name="repos" maxOccurs="1" minOccurs="1">
+                                <xs:complexType>
+                                    <xs:sequence>
+                                        <xs:element name="repo" maxOccurs="unbounded" minOccurs="1">
+                                            <xs:complexType>
+                                                <xs:attribute name="name" type="aif:t_nonempty" use="required"/>
+                                                <xs:attribute name="enabled" type="xs:boolean" use="required"/>
+                                                <xs:attribute name="sigLevel" type="aif:t_nonempty" use="required"/>
+                                                <xs:attribute name="mirror" type="aif:t_pacuri" use="required"/>
+                                            </xs:complexType>
+                                        </xs:element>
+                                    </xs:sequence>
+                                </xs:complexType>
+                                <xs:unique name="uniq_repo">
+                                    <xs:selector xpath="aif:repo"/>
+                                    <xs:field xpath="@name"/>
+                                </xs:unique>
+                            </xs:element>
+                            <xs:element name="mirrorList" maxOccurs="1" minOccurs="0">
+                                <xs:complexType>
+                                    <xs:sequence>
+                                        <xs:element name="mirror" type="aif:t_pacuri" maxOccurs="unbounded"
+                                                    minOccurs="1"/>
+                                    </xs:sequence>
+                                </xs:complexType>
+                            </xs:element>
+                            <xs:element name="software" maxOccurs="1" minOccurs="0">
+                                <xs:complexType>
+                                    <xs:sequence>
+                                        <xs:element name="package" maxOccurs="unbounded" minOccurs="1">
+                                            <xs:complexType>
+                                                <xs:simpleContent>
+                                                    <xs:extension base="aif:t_nonempty">
+                                                        <xs:attribute name="repo" type="aif:t_nonempty" use="optional"/>
+                                                    </xs:extension>
+                                                </xs:simpleContent>
+                                            </xs:complexType>
+                                        </xs:element>
+                                    </xs:sequence>
+                                </xs:complexType>
+                                <xs:unique name="uniq_mirror">
+                                    <xs:selector xpath="aif:mirrorList"/>
+                                    <xs:field xpath="mirror"/>
+                                </xs:unique>
+                                <xs:unique name="uniq_pkg">
+                                    <xs:selector xpath="aif:software"/>
+                                    <xs:field xpath="package"/>
+                                </xs:unique>
+                            </xs:element>
+                        </xs:sequence>
+                        <xs:attribute name="command" type="aif:t_nonempty" use="optional" default="pacman -S"/>
+                    </xs:complexType>
+                </xs:element>
+                <!-- END PACMAN -->
+                <!-- BEGIN BOOTLOADER -->
+                <xs:element name="bootloader" maxOccurs="1" minOccurs="1">
+                    <xs:complexType>
+                        <xs:attribute name="type" type="aif:t_bootloaders" use="required"/>
+                        <xs:attribute name="target" type="std:t_nonempty" use="required"/>
+                        <xs:attribute name="efi" type="xs:boolean" use="optional" default="1"/>
+                    </xs:complexType>
+                </xs:element>
+                <!-- END BOOTLOADER -->
+                <!--- BEGIN SCRIPTS -->
+                <xs:element name="scripts" maxOccurs="1" minOccurs="0">
+                    <xs:complexType>
+                        <xs:sequence>
+                            <xs:element name="pre" minOccurs="0" maxOccurs="unbounded">
+                                <xs:complexType>
+                                    <xs:sequence>
+                                        <xs:element name="script" minOccurs="1" maxOccurs="unbounded"
+                                                    type="net:t_http_resource"/>
+                                    </xs:sequence>
+                                </xs:complexType>
+                            </xs:element>
+                            <xs:element name="post" minOccurs="0" maxOccurs="unbounded">
+                                <xs:complexType>
+                                    <xs:sequence>
+                                        <xs:element name="script" minOccurs="1" maxOccurs="unbounded"
+                                                    type="net:t_http_resource"/>
+                                    </xs:sequence>
+                                </xs:complexType>
+                            </xs:element>
+                            <xs:element name="pkg" minOccurs="0" maxOccurs="unbounded">
+                                <xs:complexType>
+                                    <xs:sequence>
+                                        <xs:element name="script" minOccurs="1" maxOccurs="unbounded"
+                                                    type="net:t_http_resource"/>
+                                    </xs:sequence>
+                                </xs:complexType>
+                            </xs:element>
+                        </xs:sequence>
+                    </xs:complexType>
+                </xs:element>
+                <!-- END SCRIPTS -->
+            </xs:all>
+            <xs:attribute name="chrootPath" type="unix:t_filepath" use="required"/>
+            <xs:attribute name="reboot" type="xs:boolean" use="optional" default="false"/>
+            <xs:attribute name="bootstrapTarball" type="std:t_uri" use="required"/>
+        </xs:complexType>
+    </xs:element>
+
 </xs:schema>
diff --git a/schema/bdisk.xsd b/schema/bdisk.xsd
index afc246c..ca62eae 100644
--- a/schema/bdisk.xsd
+++ b/schema/bdisk.xsd
@@ -5,4 +5,7 @@
            xmlns:xs="http://www.w3.org/2001/XMLSchema"
            elementFormDefault="qualified"
            attributeFormDefault="qualified">
+
+<!-- TODO -->
+
 </xs:schema>
diff --git a/schema/linux.xsd b/schema/linux.xsd
index 9ffc889..cbd3357 100644
--- a/schema/linux.xsd
+++ b/schema/linux.xsd
@@ -171,6 +171,44 @@
         </xs:restriction>
     </xs:simpleType>
 
+    <xs:simpleType name="t_raid_layout">
+        <!-- mdadm(8), "layout=" option -->
+        <!-- We don't need to cook in the "faulty" levels. -->
+        <xs:restriction base="xs:token">
+            <xs:pattern
+                    value="((left|right)-a?symmetric(-6)?|[lr][as]|parity-(fir|la)st|ddf-(zero|N)-restart|ddf-N-continue|parity-first-6|[nof][0-9]+|none)"/>
+            <xs:whiteSpace value="collapse"/>
+        </xs:restriction>
+    </xs:simpleType>
+
+    <xs:simpleType name="t_raid_levels">
+        <xs:restriction base="xs:integer">
+            <xs:enumeration value="0"/>
+            <xs:enumeration value="1"/>
+            <xs:enumeration value="4"/>
+            <xs:enumeration value="5"/>
+            <xs:enumeration value="6"/>
+            <xs:enumeration value="10"/>
+        </xs:restriction>
+    </xs:simpleType>
+
+    <xs:simpleType name="t_raid_meta">
+        <!-- Program should warn about 1.x used for non-aware bootloaders.
+             0.90 should be used in that case. -->
+        <xs:restriction base="xs:token">
+            <xs:enumeration value="0"/><!-- Same as 0.90 -->
+            <xs:enumeration value="0.90"/><!-- Same as 0 -->
+            <xs:enumeration value="1"/><!-- Same as 1.2, default -->
+            <xs:enumeration value="1.0"/>
+            <xs:enumeration value="1.1"/>
+            <xs:enumeration value="1.2"/><!-- Same as 1, default -->
+            <xs:enumeration value="default"/><!-- Same as 1, 1.2 -->
+            <xs:enumeration value="ddf"/>
+            <xs:enumeration value="imsm"/>
+            <xs:whiteSpace value="collapse"/>
+        </xs:restriction>
+    </xs:simpleType>
+
     <xs:simpleType name="t_shadowhash">
         <xs:union memberTypes="unix:t_shadowhash">
             <xs:simpleType>
diff --git a/schema/net.xsd b/schema/net.xsd
index 51b0bc5..7e9cb35 100644
--- a/schema/net.xsd
+++ b/schema/net.xsd
@@ -2,19 +2,11 @@
 <xs:schema targetNamespace="http://schema.xml.r00t2.io/net.xsd"
            xmlns="http://schema.xml.r00t2.io/net.xsd"
            xmlns:net="http://schema.xml.r00t2.io/net.xsd"
+           xmlns:std="http://schema.xml.r00t2.io/std.xsd"
            xmlns:xs="http://www.w3.org/2001/XMLSchema"
            elementFormDefault="qualified"
            attributeFormDefault="qualified">
 
-    <xs:simpleType name="t_qualified_addr_ip4">
-        <!-- This is a REALLY LAZY regex. Matching IPv4 in regex is ugly as heck, so we do that in-code.
-             This is just a gatekeeper. -->
-        <xs:restriction base="xs:string">
-            <xs:pattern value="[0-9.]{7,15}/[0-9]{1,2}"/>
-            <xs:whiteSpace value="collapse"/>
-        </xs:restriction>
-    </xs:simpleType>
-
     <xs:simpleType name="t_addr_ip4">
         <xs:restriction base="xs:string">
             <!-- This is a REALLY LAZY regex. Matching IPv4 in regex is ugly as heck, so we do that in-code.
@@ -24,15 +16,6 @@
         </xs:restriction>
     </xs:simpleType>
 
-    <xs:simpleType name="t_qualified_addr_ip6">
-        <!-- This is a REALLY LAZY regex. Matching IPv6 in regex is ugly as heck, so we do that in-code.
-             This is just a gatekeeper. -->
-        <xs:restriction base="xs:string">
-            <xs:pattern value="[A-Za-z0-9:]+/[0-9]{1,3}"/>
-            <xs:whiteSpace value="collapse"/>
-        </xs:restriction>
-    </xs:simpleType>
-
     <xs:simpleType name="t_addr_ip6">
         <xs:restriction base="xs:string">
             <!-- This is a REALLY LAZY regex. Matching IPv6 in regex is ugly as heck, so we do that in-code.
@@ -42,12 +25,13 @@
         </xs:restriction>
     </xs:simpleType>
 
-    <xs:simpleType name="t_both_qualified_addr">
-        <xs:union memberTypes="net:t_qualified_addr_ip4 net:t_qualified_addr_ip6"/>
-    </xs:simpleType>
-
-    <xs:simpleType name="t_both_addr">
-        <xs:union memberTypes="net:t_addr_ip4 net:t_addr_ip6"/>
+    <xs:simpleType name="t_authselect">
+        <xs:restriction base="xs:token">
+            <xs:enumeration value="basic"/>
+            <xs:enumeration value="digest"/>
+            <xs:enumeration value="none"/>
+            <xs:whiteSpace value="collapse"/>
+        </xs:restriction>
     </xs:simpleType>
 
     <xs:simpleType name="t_auto_ip6">
@@ -57,6 +41,25 @@
         </xs:restriction>
     </xs:simpleType>
 
+    <xs:simpleType name="t_both_addr">
+        <xs:union memberTypes="net:t_addr_ip4 net:t_addr_ip6"/>
+    </xs:simpleType>
+
+    <xs:simpleType name="t_both_qualified_addr">
+        <xs:union memberTypes="net:t_qualified_addr_ip4 net:t_qualified_addr_ip6"/>
+    </xs:simpleType>
+
+    <xs:complexType name="t_http_resource">
+        <xs:simpleContent>
+            <xs:extension base="std:t_uri">
+                <xs:attribute name="user" type="std:t_nonempty" use="optional"/>
+                <xs:attribute name="password" type="std:t_nonempty" use="optional"/>
+                <xs:attribute name="realm" type="std:t_nonempty" use="optional"/>
+                <xs:attribute name="authtype" type="net:t_authselect" use="optional" default="none"/>
+            </xs:extension>
+        </xs:simpleContent>
+    </xs:complexType>
+
     <xs:simpleType name="t_mac_addr">
         <xs:restriction base="xs:token">
             <!-- EUI48[RFC7043§3] (previously MAC48[RFC7042§2.1]) -->
@@ -68,6 +71,42 @@
         </xs:restriction>
     </xs:simpleType>
 
+    <xs:simpleType name="t_netproto">
+        <xs:restriction base="xs:token">
+            <xs:enumeration value="ipv4"/>
+            <xs:enumeration value="ipv6"/>
+            <xs:whiteSpace value="collapse"/>
+        </xs:restriction>
+    </xs:simpleType>
+
+    <xs:simpleType name="t_proto">
+        <!-- TODO: expand? Remove gre? -->
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="tcp"/>
+            <xs:enumeration value="udp"/>
+            <xs:enumeration value="icmp"/>
+            <xs:enumeration value="gre"/>
+        </xs:restriction>
+    </xs:simpleType>
+
+    <xs:simpleType name="t_qualified_addr_ip4">
+        <!-- This is a REALLY LAZY regex. Matching IPv4 in regex is ugly as heck, so we do that in-code.
+             This is just a gatekeeper. -->
+        <xs:restriction base="xs:string">
+            <xs:pattern value="[0-9.]{7,15}/[0-9]{1,2}"/>
+            <xs:whiteSpace value="collapse"/>
+        </xs:restriction>
+    </xs:simpleType>
+
+    <xs:simpleType name="t_qualified_addr_ip6">
+        <!-- This is a REALLY LAZY regex. Matching IPv6 in regex is ugly as heck, so we do that in-code.
+             This is just a gatekeeper. -->
+        <xs:restriction base="xs:string">
+            <xs:pattern value="[A-Za-z0-9:]+/[0-9]{1,3}"/>
+            <xs:whiteSpace value="collapse"/>
+        </xs:restriction>
+    </xs:simpleType>
+
     <!-- TODO: "enterprise" WPA2 (add'l details)?
            WPA3?
            EAP,
@@ -110,12 +149,4 @@
         </xs:all>
     </xs:complexType>
 
-    <xs:simpleType name="t_netproto">
-        <xs:restriction base="xs:token">
-            <xs:enumeration value="ipv4"/>
-            <xs:enumeration value="ipv6"/>
-            <xs:whiteSpace value="collapse"/>
-        </xs:restriction>
-    </xs:simpleType>
-
 </xs:schema>
diff --git a/schema/std.xsd b/schema/std.xsd
index 09c768e..3cb6a3c 100644
--- a/schema/std.xsd
+++ b/schema/std.xsd
@@ -13,6 +13,19 @@
         </xs:restriction>
     </xs:simpleType>
 
+    <xs:complexType name="t_cmdopts">
+        <xs:simpleContent>
+            <xs:extension base="xs:string">
+                <xs:attribute name="name" use="required" type="xs:token"/>
+            </xs:extension>
+        </xs:simpleContent>
+    </xs:complexType>
+
+    <xs:simpleType name="t_epoch_or_iso">
+        <!-- positiveInteger is used for UNIX Epoch. -->
+        <xs:union memberTypes="xs:dateTime xs:positiveInteger"/>
+    </xs:simpleType>
+
     <xs:simpleType name="t_nonempty">
         <xs:restriction base="xs:token">
             <xs:minLength value="1"/>
diff --git a/schema/unix.xsd b/schema/unix.xsd
index 2e13640..8bcf5ba 100644
--- a/schema/unix.xsd
+++ b/schema/unix.xsd
@@ -6,6 +6,18 @@
            elementFormDefault="qualified"
            attributeFormDefault="qualified">
 
+    <xs:simpleType name="t_filepath">
+        <xs:restriction base="xs:string">
+            <xs:pattern value="(/[^/]+)+/?"/>
+        </xs:restriction>
+    </xs:simpleType>
+
+    <xs:simpleType name="t_passwd_hashtypes">
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="md5"/>
+        </xs:restriction>
+    </xs:simpleType>
+
     <xs:simpleType name="t_posixUserGroup">
         <!-- https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap03.html#tag_03_437
              https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap03.html#tag_03_282
@@ -16,12 +28,6 @@
         </xs:restriction>
     </xs:simpleType>
 
-    <xs:simpleType name="t_passwd_hashtypes">
-        <xs:restriction base="xs:string">
-            <xs:enumeration value="md5"/>
-        </xs:restriction>
-    </xs:simpleType>
-
     <xs:simpleType name="t_shadowhash">
         <!-- http://man7.org/linux/man-pages/man3/crypt.3.html#NOTES -->
         <xs:restriction base="xs:token">