From 8da35c1898c8eecad3ed5ac9ec722e29c931c0fb Mon Sep 17 00:00:00 2001
From: Jason DeTiberus <915544+detiber@users.noreply.github.com>
Date: Sat, 14 Dec 2024 19:45:59 -0500
Subject: [PATCH] blow up the world

---
 .gitattributes                                |  13 +
 .github/dependabot.yml                        |   6 +-
 .github/workflows/base-build.yml              |   4 +-
 .github/workflows/bluefin-latest.yml          |  27 +
 .github/workflows/bluefin-reusable-build.yml  | 279 ++++++
 .github/workflows/bluefin-stable.yml          |  26 +
 .github/workflows/build.yml                   |  43 -
 {hack => docs/archived}/base.butane           |   0
 {hack => docs/archived}/base.ign              |   0
 .../archived}/beardy-autorebase.butane        |   0
 {hack => docs/archived}/beardy-autorebase.ign |   0
 .../archived}/beardy-bootc-switch.butane      |   0
 .../archived}/beardy-bootc-switch.ign         |   0
 {hack => docs/archived}/boot-remote.ipxe      |   0
 docs/archived/osbuild-blueprint-bootc.toml    |   9 +
 docs/archived/osbuild-blueprint.toml          |  33 +
 .../archived/recipes}/beardy-bazzite-deck.yml |   0
 .../archived/recipes}/beardy-bazzite.yml      |   0
 {recipes => docs/archived/recipes}/beardy.yml |   0
 files/scripts/example.sh                      |  10 -
 files/system/common/etc/.gitkeep              |   1 -
 .../common/etc/sudoers.d/wheel-nopassword     |   1 -
 .../common/etc/ublue-update/ublue-update.toml |   8 -
 .../share/applications/system-update.desktop  |   9 -
 .../usr/share/ublue-os/just/10-update.just    |  45 -
 .../usr/share/ublue-os/topgrade-bootc.toml    |  11 -
 .../common/usr/share/ublue-os/topgrade.toml   |  11 -
 hack/bib-img-config.toml                      |   6 -
 just/archive.just                             | 357 ++++++++
 just/bib.just                                 |  20 +
 just/common.just                              |  25 +
 justfile                                      | 479 +----------
 ublue-image-template/Containerfile            | 213 -----
 ublue-image-template/README.md                |  87 --
 .../common/usr => variants/bazzite}/.gitkeep  |   0
 variants/bluefin/.gitignore                   |  11 +
 variants/bluefin/Containerfile                |  36 +
 .../bluefin/beardy_flatpaks/flatpaks          |   0
 variants/bluefin/boot_menu.yml                |   6 +
 .../bluefin/build_files/base}/.gitkeep        |   0
 .../bluefin/build_files/base/00-image-info.sh |  53 ++
 .../bluefin/build_files/base/04-packages.sh   |  51 ++
 .../bluefin/build_files/dx/03-packages-dx.sh  |  55 ++
 .../bluefin/build_files/shared/build-base.sh  |  66 ++
 .../bluefin/build_files/shared/build-dx.sh    |  42 +
 .../bluefin/build_files/shared/clean-stage.sh |   8 +
 variants/bluefin/dx_flatpaks/flatpaks         |   0
 variants/bluefin/just/beardy-apps.just        |   0
 variants/bluefin/just/beardy-system.just      |   0
 variants/bluefin/justfile                     | 812 ++++++++++++++++++
 variants/bluefin/packages.json                |  37 +
 .../bluefin/system_files/bluefin/.gitkeep     |   0
 variants/bluefin/system_files/dx/.gitkeep     |   0
 .../shared}/etc/distrobox/distrobox.conf      |   0
 .../shared}/etc/distrobox/distrobox.example   |   0
 .../shared}/etc/distrobox/distrobox.ini       |   0
 {bootc => variants/bootc}/Containerfile       |  10 +-
 variants/bootc/bib-img-config.toml            |   4 +
 {hack => variants/bootc}/bib-iso-config.toml  |   1 +
 variants/bootc/justfile                       |  28 +
 variants/ublue/Containerfile                  |  89 ++
 .../ublue}/scripts/unwrap-cli.sh              |   0
 62 files changed, 2126 insertions(+), 906 deletions(-)
 create mode 100644 .gitattributes
 create mode 100644 .github/workflows/bluefin-latest.yml
 create mode 100644 .github/workflows/bluefin-reusable-build.yml
 create mode 100644 .github/workflows/bluefin-stable.yml
 delete mode 100644 .github/workflows/build.yml
 rename {hack => docs/archived}/base.butane (100%)
 rename {hack => docs/archived}/base.ign (100%)
 rename {hack => docs/archived}/beardy-autorebase.butane (100%)
 rename {hack => docs/archived}/beardy-autorebase.ign (100%)
 rename {hack => docs/archived}/beardy-bootc-switch.butane (100%)
 rename {hack => docs/archived}/beardy-bootc-switch.ign (100%)
 rename {hack => docs/archived}/boot-remote.ipxe (100%)
 create mode 100644 docs/archived/osbuild-blueprint-bootc.toml
 create mode 100644 docs/archived/osbuild-blueprint.toml
 rename {recipes => docs/archived/recipes}/beardy-bazzite-deck.yml (100%)
 rename {recipes => docs/archived/recipes}/beardy-bazzite.yml (100%)
 rename {recipes => docs/archived/recipes}/beardy.yml (100%)
 delete mode 100644 files/scripts/example.sh
 delete mode 100644 files/system/common/etc/.gitkeep
 delete mode 100644 files/system/common/etc/sudoers.d/wheel-nopassword
 delete mode 100644 files/system/common/etc/ublue-update/ublue-update.toml
 delete mode 100644 files/system/common/usr/share/applications/system-update.desktop
 delete mode 100644 files/system/common/usr/share/ublue-os/just/10-update.just
 delete mode 100644 files/system/common/usr/share/ublue-os/topgrade-bootc.toml
 delete mode 100644 files/system/common/usr/share/ublue-os/topgrade.toml
 delete mode 100644 hack/bib-img-config.toml
 create mode 100644 just/archive.just
 create mode 100644 just/bib.just
 create mode 100644 just/common.just
 delete mode 100644 ublue-image-template/Containerfile
 delete mode 100644 ublue-image-template/README.md
 rename {files/system/common/usr => variants/bazzite}/.gitkeep (100%)
 create mode 100644 variants/bluefin/.gitignore
 create mode 100644 variants/bluefin/Containerfile
 rename files/scripts/fix-copr-repos.sh => variants/bluefin/beardy_flatpaks/flatpaks (100%)
 create mode 100644 variants/bluefin/boot_menu.yml
 rename {modules => variants/bluefin/build_files/base}/.gitkeep (100%)
 create mode 100755 variants/bluefin/build_files/base/00-image-info.sh
 create mode 100755 variants/bluefin/build_files/base/04-packages.sh
 create mode 100755 variants/bluefin/build_files/dx/03-packages-dx.sh
 create mode 100755 variants/bluefin/build_files/shared/build-base.sh
 create mode 100755 variants/bluefin/build_files/shared/build-dx.sh
 create mode 100755 variants/bluefin/build_files/shared/clean-stage.sh
 create mode 100644 variants/bluefin/dx_flatpaks/flatpaks
 create mode 100644 variants/bluefin/just/beardy-apps.just
 create mode 100644 variants/bluefin/just/beardy-system.just
 create mode 100644 variants/bluefin/justfile
 create mode 100644 variants/bluefin/packages.json
 create mode 100644 variants/bluefin/system_files/bluefin/.gitkeep
 create mode 100644 variants/bluefin/system_files/dx/.gitkeep
 rename {files/system/common => variants/bluefin/system_files/shared}/etc/distrobox/distrobox.conf (100%)
 rename {files/system/common => variants/bluefin/system_files/shared}/etc/distrobox/distrobox.example (100%)
 rename {files/system/common => variants/bluefin/system_files/shared}/etc/distrobox/distrobox.ini (100%)
 rename {bootc => variants/bootc}/Containerfile (77%)
 create mode 100644 variants/bootc/bib-img-config.toml
 rename {hack => variants/bootc}/bib-iso-config.toml (98%)
 create mode 100644 variants/bootc/justfile
 create mode 100644 variants/ublue/Containerfile
 rename {files => variants/ublue}/scripts/unwrap-cli.sh (100%)

diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..9a5a2c5
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,13 @@
+*.yml linguist-detectable=true
+*.yml linguist-language=YAML
+
+*.yaml linguist-detectable=true
+*.yaml linguist-language=YAML
+
+*.just linguist-detectable=true
+*.just linguist-documentation=false
+*.just linguist-language=Just
+
+*.json linguist-detectable=true
+*.json linguist-documentation=false
+*.json linguist-language=JSON
\ No newline at end of file
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 1230149..a7feb97 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -3,4 +3,8 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "daily"
+      interval: "weekly"
+  - package-ecosystem: "devcontainers"
+    directory: "/"
+    schedule:
+      interval: weekly
\ No newline at end of file
diff --git a/.github/workflows/base-build.yml b/.github/workflows/base-build.yml
index 9bb6455..0c6ee48 100644
--- a/.github/workflows/base-build.yml
+++ b/.github/workflows/base-build.yml
@@ -35,12 +35,12 @@
           matrix:
             include:
               - base: bootc
-                containerfile: bootc/Containerfile
+                containerfile: variants/bootc/Containerfile
                 name: "${{ github.event.repository.name }}-bootc"  # the name of the image produced by this build, matches repo name appended with '-bootc'
                 description: "bootc-based base image for bearded developers"
 
               - base: ublue
-                containerfile: ublue-image-template/Containerfile
+                containerfile: variants/ublue/Containerfile
                 name: "${{ github.event.repository.name }}-ublue"  # the name of the image produced by this build, matches repo name appended with '-ublue'
                 description: "ublue-based base image for bearded developers"
         steps:
diff --git a/.github/workflows/bluefin-latest.yml b/.github/workflows/bluefin-latest.yml
new file mode 100644
index 0000000..c326e25
--- /dev/null
+++ b/.github/workflows/bluefin-latest.yml
@@ -0,0 +1,27 @@
+name: Latest Images
+on:
+  merge_group:
+  pull_request:
+    branches:
+      - main
+    paths-ignore:
+      - "**.md"
+  schedule:
+    - cron: "50 5 * * 1,2,3,4,5,6" # 5:50 UTC All But Sunday (1 hour after bluefin)
+    - cron: "50 5 * * 0" # 5:50 UTC Sunday (1 hour after bluefin)
+  workflow_call:
+  workflow_dispatch:
+
+jobs:
+  build-image-latest:
+    name: Build Latest Images
+    uses: ./.github/workflows/bluefin-reusable-build.yml
+    secrets: inherit
+    strategy:
+      fail-fast: false
+      matrix:
+        brand_name: ["beardy-bluefin"]
+    with:
+      image_flavors: '["main", "nvidia", "hwe", "hwe-nvidia"]'
+      brand_name: ${{ matrix.brand_name }}
+      stream_name: latest
diff --git a/.github/workflows/bluefin-reusable-build.yml b/.github/workflows/bluefin-reusable-build.yml
new file mode 100644
index 0000000..0829a53
--- /dev/null
+++ b/.github/workflows/bluefin-reusable-build.yml
@@ -0,0 +1,279 @@
+name: Reusable Build and Push
+on:
+  workflow_call:
+    inputs:
+      image_flavors:
+        description: "JSON string of flavors to build, '[main, nvidia, hwe, hwe-nvidia]'"
+        default: "['main']"
+        type: string
+      brand_name:
+        description: "The Brand Name: beardy-bluefin"
+        required: true
+        default: beardy-bluefin
+        type: string
+      stream_name:
+        description: "The Fedora Version: stable, or latest"
+        required: true
+        type: string
+    outputs:
+      images:
+        description: "An array of images built and pushed to the registry"
+        value: ${{ jobs.check.outputs.images }}
+env:
+  IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }}
+  cancel-in-progress: true
+
+jobs:
+  build_container:
+    name: image
+    runs-on: ubuntu-24.04
+    continue-on-error: false
+    outputs:
+      image_full: ${{ steps.generate-outputs.outputs.image }}
+    strategy:
+      fail-fast: false
+      matrix:
+        image_flavor: ${{ fromJson(inputs.image_flavors) }}
+        base_name: ["${{ inputs.brand_name }}", "${{ inputs.brand_name }}-dx"]
+        stream_name: ["${{ inputs.stream_name }}"]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Install Just
+        shell: bash
+        run: |
+          set -eoux pipefail
+          JUST_VERSION=$(curl -L https://api.github.com/repos/casey/just/releases/latest | jq -r '.tag_name')
+          curl -sSLO https://github.com/casey/just/releases/download/${JUST_VERSION}/just-${JUST_VERSION}-x86_64-unknown-linux-musl.tar.gz
+          tar -zxvf just-${JUST_VERSION}-x86_64-unknown-linux-musl.tar.gz -C /tmp just
+          sudo mv /tmp/just /usr/local/bin/just
+          rm -f just-${JUST_VERSION}-x86_64-unknown-linux-musl.tar.gz
+
+      - name: Check Just Syntax
+        shell: bash
+        run: |
+          just check
+
+      - name: Image Name
+        shell: bash
+        run: |
+          IMAGE_NAME="$(just bluefin::image_name ${{ matrix.base_name }} ${{ matrix.stream_name }} ${{ matrix.image_flavor }})"
+          echo "IMAGE_NAME=${IMAGE_NAME}" >> $GITHUB_ENV
+
+      - name: Default Tag
+        shell: bash
+        run: |
+          DEFAULT_TAG="$(just bluefin::generate-default-tag \
+                       ${{ matrix.stream_name }} \
+                       "1")"
+          echo "Default Tag: ${DEFAULT_TAG}"
+          echo "DEFAULT_TAG=${DEFAULT_TAG}" >> $GITHUB_ENV
+
+      - name: Maximize build space
+        uses: ublue-os/remove-unwanted-software@517622d6452028f266b7ba4cc9a123b5f58a6b53 # v7
+        with:
+          remove-codeql: true
+
+      - name: Build Image
+        id: build-image
+        shell: bash
+        run: |
+          sudo just repo_organization="${{ github.repository_owner }}" \
+                    bluefin::build-ghcr "${{ matrix.base_name }}" \
+                               "${{ matrix.stream_name }}" \
+                               "${{ matrix.image_flavor }}" \
+                               ""
+
+      - name: Rechunk Image
+        id: rechunk-image
+        shell: bash
+        run: |
+          sudo just bluefin::rechunk "${{ matrix.base_name }}" \
+                            "${{ matrix.stream_name }}" \
+                            "${{ matrix.image_flavor }}" \
+                            "1"
+
+      - name: Load Image into Podman
+        id: load-rechunk
+        shell: bash
+        run: |
+          just bluefin::load-rechunk "${{ matrix.base_name }}" \
+                            "${{ env.DEFAULT_TAG }}" \
+                            "${{ matrix.image_flavor }}"
+
+      - name: Secureboot Check
+        id: secureboot
+        shell: bash
+        run: |
+          just bluefin::secureboot "${{ matrix.base_name }}" \
+                          "${{ env.DEFAULT_TAG }}" \
+                          "${{ matrix.image_flavor }}"
+
+      - name: Generate tags
+        id: generate-tags
+        shell: bash
+        run: |
+          alias_tags="$(just bluefin::generate-build-tags \
+                     "${{ matrix.base_name }}" \
+                     "${{ matrix.stream_name }}" \
+                     "${{ matrix.image_flavor }}" \
+                     "" \
+                     "1" \
+                     "$(podman inspect ${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }} | jq -r '.[].Config.Labels["org.opencontainers.image.version"]')" \
+                     "${{ github.event_name }}" \
+                     "${{ github.event.number }}")"
+
+          echo "Tags for this Action..."
+          echo "$alias_tags"
+          echo "alias_tags=${alias_tags}" >> $GITHUB_OUTPUT
+
+      # Tag Images
+      - name: Tag Images
+        shell: bash
+        run: |
+          set -eoux pipefail
+          just bluefin::tag-images "${{ env.IMAGE_NAME }}" \
+                          "${{ env.DEFAULT_TAG }}" \
+                          "${{ steps.generate-tags.outputs.alias_tags }}"
+
+      # Workaround bug where capital letters in your GitHub username make it impossible to push to GHCR.
+      # https://github.com/macbre/push-to-ghcr/issues/12
+      - name: Lowercase Registry
+        id: registry_case
+        uses: ASzc/change-string-case-action@d0603cd0a7dd490be678164909f65c7737470a7f # v6
+        with:
+          string: ${{ env.IMAGE_REGISTRY }}
+
+      - name: Login to GitHub Container Registry
+        if: github.event_name != 'pull_request'
+        run: |
+          echo ${{ secrets.GITHUB_TOKEN }} | podman login ghcr.io -u ${{ github.actor }} --password-stdin
+          echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+
+      - name: Push to GHCR
+        id: push
+        if: github.event_name != 'pull_request'
+        uses: Wandalen/wretry.action@ffdd254f4eaf1562b8a2c66aeaa37f1ff2231179 # v3.7.3
+        with:
+          attempt_limit: 3
+          attempt_delay: 15000
+          command: |
+            set -euox pipefail
+
+            for tag in ${{ steps.generate-tags.outputs.alias_tags }}; do
+              podman push ${{ env.IMAGE_NAME }}:${tag} ${{ steps.registry_case.outputs.lowercase }}/${{ env.IMAGE_NAME }}:${tag}
+            done
+
+            if [[ "${{ matrix.image_flavor }}" =~ hwe ]]; then
+
+              image_name="${{ env.IMAGE_NAME }}"
+              asus_name="${image_name/hwe/asus}"
+              surface_name="${image_name/hwe/surface}"
+
+              for tag in ${{ steps.generate-tags.outputs.alias_tags }}; do
+                podman push ${asus_name}:${tag} ${{ steps.registry_case.outputs.lowercase }}/${asus_name}:${tag}
+                podman push ${surface_name}:${tag} ${{ steps.registry_case.outputs.lowercase }}/${surface_name}:${tag}
+              done
+            fi
+
+            digest=$(skopeo inspect docker://${{ steps.registry_case.outputs.lowercase }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }} --format '{{.Digest}}')
+
+            echo "digest=${digest}" >> $GITHUB_OUTPUT
+
+      - name: Sign container image
+        if: github.event_name != 'pull_request'
+        run: |
+          cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ env.IMAGE_NAME }}@${TAGS}
+        env:
+          TAGS: ${{ steps.push.outputs.outputs && fromJSON(steps.push.outputs.outputs).digest }}
+          COSIGN_EXPERIMENTAL: false
+          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
+
+      - name: Sign container image
+        if: github.event_name != 'pull_request' && contains(matrix.image_flavor, 'hwe')
+        shell: bash
+        run: |
+          image_name="${{ env.IMAGE_NAME }}"
+          asus_name="${image_name/hwe/asus}"
+          surface_name="${image_name/hwe/surface}"
+          cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${asus_name}@${TAGS}
+          cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${surface_name}@${TAGS}
+        env:
+          TAGS: ${{ steps.push.outputs.outputs && fromJSON(steps.push.outputs.outputs).digest }}
+          COSIGN_EXPERIMENTAL: false
+          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
+
+      - name: Generate file containing outputs
+        if: github.event_name != 'pull_request'
+        env:
+          DIGEST: ${{ steps.push.outputs.outputs && fromJSON(steps.push.outputs.outputs).digest }}
+          IMAGE_REGISTRY: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}
+          IMAGE_NAME: ${{ env.IMAGE_NAME }}
+          FEDORA_VERSION: ${{ matrix.stream_name }}
+        run: echo "${IMAGE_REGISTRY}@${DIGEST}" > "${IMAGE_NAME}-${FEDORA_VERSION}.txt"
+
+      - name: Upload artifact
+        if: github.event_name != 'pull_request'
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
+        with:
+          name: image-${{ env.IMAGE_NAME }}-${{ matrix.stream_name }}
+          retention-days: 1
+          if-no-files-found: error
+          path: |
+            ${{ env.IMAGE_NAME }}-${{ matrix.stream_name }}.txt
+
+  check:
+    name: Check all ${{ matrix.stream_name }} builds successful
+    if: always()
+    runs-on: ubuntu-latest
+    needs: [build_container]
+    outputs:
+      images: ${{ steps.generate-outputs.outputs.images }}
+    steps:
+      - name: Download artifacts
+        if: github.event_name != 'pull_request'
+        id: download-artifacts
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
+        with:
+          pattern: image-*
+          merge-multiple: true
+
+      - name: Create output
+        if: github.event_name != 'pull_request'
+        id: generate-outputs
+        env:
+          JOBS: ${{ toJson(needs) }}
+          ARTIFACT_PATH: ${{ steps.download-artifacts.outputs.download-path }}
+        run: |
+          # Initialize the array
+          images=()
+
+          # Populate the array with each line from each file in the artifacts directory
+          for file in $ARTIFACT_PATH/*; do
+              while IFS= read -r line; do
+                images+=("$line")
+              done < "$file"
+          done
+
+          # Create the GITHUB_OUTPUT in the format '["image1", "image2", ...]'
+          echo "images=$(printf '%s\n' "${images[@]}" | jq -R -s -c 'split("\n") | .[:-1]')" >> $GITHUB_OUTPUT
+
+      - name: Check Jobs
+        env:
+          JOBS: ${{ toJson(needs) }}
+        run: |
+          echo "Job status:"
+          echo $JOBS | jq -r 'to_entries[] | " - \(.key): \(.value.result)"'
+
+          for i in $(echo $JOBS | jq -r 'to_entries[] | .value.result'); do
+            if [ "$i" != "success" ] && [ "$i" != "skipped" ]; then
+              echo ""
+              echo "Status check not okay!"
+              exit 1
+            fi
+          done
\ No newline at end of file
diff --git a/.github/workflows/bluefin-stable.yml b/.github/workflows/bluefin-stable.yml
new file mode 100644
index 0000000..2f2a3cc
--- /dev/null
+++ b/.github/workflows/bluefin-stable.yml
@@ -0,0 +1,26 @@
+name: Stable Images
+on:
+  merge_group: # Make Stable-Daily run on merge groups
+  pull_request:
+    branches:
+      - main
+    paths-ignore:
+      - "**.md"
+  schedule:
+    - cron: "50 6 * * 1,2,3,4,5,6" # 6:50 UTC everyday (1 hour after bluefin)
+    - cron: "50 6 * * 0" # 6:50 UTC sunday (1 hour after bluefin)
+  workflow_call:
+  workflow_dispatch:
+
+jobs:
+  build-image-stable:
+    name: Build Stable Images
+    uses: ./.github/workflows/bluefin-reusable-build.yml
+    secrets: inherit
+    strategy:
+      fail-fast: false
+      matrix:
+        brand_name: ["beardy-bluefin"]
+    with:
+      brand_name: ${{ matrix.brand_name }}
+      stream_name: stable
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
deleted file mode 100644
index 9f91f9a..0000000
--- a/.github/workflows/build.yml
+++ /dev/null
@@ -1,43 +0,0 @@
-name: bluebuild
-on:
-  schedule:
-    - cron:
-        "00 06 * * *" # build at 06:00 UTC every day 
-        # (20 minutes after last ublue images start building)
-  push:
-    paths-ignore: # don't rebuild if only documentation has changed
-      - "**.md"
-
-  pull_request:
-  workflow_dispatch: # allow manually triggering builds
-concurrency:
-  # only run one build at a time
-  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
-  cancel-in-progress: true
-jobs:
-  bluebuild:
-    name: Build Custom Image
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-      id-token: write
-    strategy:
-      fail-fast: false # stop GH from cancelling all matrix builds if one fails
-      matrix:
-        recipe:
-          - beardy.yml
-          # - beardy-bazzite.yml
-          # - beardy-bazzite-deck.yml
-    steps:
-      # the build is fully handled by the reusable github action
-      - name: Build Custom Image
-        uses: blue-build/github-action@v1.8
-        with:
-          recipe: ${{ matrix.recipe }}
-          cosign_private_key: ${{ secrets.SIGNING_SECRET }}
-          registry_token: ${{ github.token }}
-          pr_event_number: ${{ github.event.number }}
-
-          # enabled by default, disable if your image is small and you want faster builds
-          maximize_build_space: true
diff --git a/hack/base.butane b/docs/archived/base.butane
similarity index 100%
rename from hack/base.butane
rename to docs/archived/base.butane
diff --git a/hack/base.ign b/docs/archived/base.ign
similarity index 100%
rename from hack/base.ign
rename to docs/archived/base.ign
diff --git a/hack/beardy-autorebase.butane b/docs/archived/beardy-autorebase.butane
similarity index 100%
rename from hack/beardy-autorebase.butane
rename to docs/archived/beardy-autorebase.butane
diff --git a/hack/beardy-autorebase.ign b/docs/archived/beardy-autorebase.ign
similarity index 100%
rename from hack/beardy-autorebase.ign
rename to docs/archived/beardy-autorebase.ign
diff --git a/hack/beardy-bootc-switch.butane b/docs/archived/beardy-bootc-switch.butane
similarity index 100%
rename from hack/beardy-bootc-switch.butane
rename to docs/archived/beardy-bootc-switch.butane
diff --git a/hack/beardy-bootc-switch.ign b/docs/archived/beardy-bootc-switch.ign
similarity index 100%
rename from hack/beardy-bootc-switch.ign
rename to docs/archived/beardy-bootc-switch.ign
diff --git a/hack/boot-remote.ipxe b/docs/archived/boot-remote.ipxe
similarity index 100%
rename from hack/boot-remote.ipxe
rename to docs/archived/boot-remote.ipxe
diff --git a/docs/archived/osbuild-blueprint-bootc.toml b/docs/archived/osbuild-blueprint-bootc.toml
new file mode 100644
index 0000000..9edf32c
--- /dev/null
+++ b/docs/archived/osbuild-blueprint-bootc.toml
@@ -0,0 +1,9 @@
+[customizations]
+
+[[customizations.user]]
+name = "beardy"
+groups = ["wheel"]
+
+[customizations.installer]
+unattended = true
+sudo-nopasswd = ["user", "%wheel"]
diff --git a/docs/archived/osbuild-blueprint.toml b/docs/archived/osbuild-blueprint.toml
new file mode 100644
index 0000000..705f9e0
--- /dev/null
+++ b/docs/archived/osbuild-blueprint.toml
@@ -0,0 +1,33 @@
+name = "beardy-os"
+description = "The preferred OS for bearded developers."
+version = "0.0.1"
+
+distro = "???"
+
+[customizations]
+hostname = "beardy"
+
+[[customizations.user]]
+name = "beardy"
+groups = ["wheel"]
+
+[[customizations.timezone]]
+timezone = "US/Eastern"
+
+[[customizations.locale]]
+languages = ["en_US.UTF-8"]
+keyboard = "us"
+
+[customizations.installer]
+unattended = true
+sudo-nopasswd = ["user", "%wheel"]
+
+[customizations.installer.kickstart]
+contents = """
+text --non-interactive
+zerombr
+clearpart --all --initlabel --disklabel=gpt
+autopart --noswap --type=lvm
+network --bootproto=dhcp --device=link --activate --onboot=on
+"""
+
diff --git a/recipes/beardy-bazzite-deck.yml b/docs/archived/recipes/beardy-bazzite-deck.yml
similarity index 100%
rename from recipes/beardy-bazzite-deck.yml
rename to docs/archived/recipes/beardy-bazzite-deck.yml
diff --git a/recipes/beardy-bazzite.yml b/docs/archived/recipes/beardy-bazzite.yml
similarity index 100%
rename from recipes/beardy-bazzite.yml
rename to docs/archived/recipes/beardy-bazzite.yml
diff --git a/recipes/beardy.yml b/docs/archived/recipes/beardy.yml
similarity index 100%
rename from recipes/beardy.yml
rename to docs/archived/recipes/beardy.yml
diff --git a/files/scripts/example.sh b/files/scripts/example.sh
deleted file mode 100644
index fdb2e04..0000000
--- a/files/scripts/example.sh
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-
-# Tell this script to exit if there are any errors.
-# You should have this in every custom script, to ensure that your completed
-# builds actually ran successfully without any errors!
-set -oue pipefail
-
-# Your code goes here.
-echo 'This is an example shell script'
-echo 'Scripts here will run during build if specified in recipe.yml'
diff --git a/files/system/common/etc/.gitkeep b/files/system/common/etc/.gitkeep
deleted file mode 100644
index 8b13789..0000000
--- a/files/system/common/etc/.gitkeep
+++ /dev/null
@@ -1 +0,0 @@
-
diff --git a/files/system/common/etc/sudoers.d/wheel-nopassword b/files/system/common/etc/sudoers.d/wheel-nopassword
deleted file mode 100644
index c4065fc..0000000
--- a/files/system/common/etc/sudoers.d/wheel-nopassword
+++ /dev/null
@@ -1 +0,0 @@
-%wheel         ALL = (ALL) NOPASSWD: ALL
\ No newline at end of file
diff --git a/files/system/common/etc/ublue-update/ublue-update.toml b/files/system/common/etc/ublue-update/ublue-update.toml
deleted file mode 100644
index fcd67a2..0000000
--- a/files/system/common/etc/ublue-update/ublue-update.toml
+++ /dev/null
@@ -1,8 +0,0 @@
-# copied from https://github.com/ublue-os/bluefin
-[checks]
-    min_battery_percent = 20.0
-    max_cpu_load_percent = 50.0
-    max_mem_percent = 90.0
-    network_not_metered = true  # Abort if network connection is metered
-[notify]
-    dbus_notify = false
diff --git a/files/system/common/usr/share/applications/system-update.desktop b/files/system/common/usr/share/applications/system-update.desktop
deleted file mode 100644
index 2839171..0000000
--- a/files/system/common/usr/share/applications/system-update.desktop
+++ /dev/null
@@ -1,9 +0,0 @@
-# copied from https://github.com/ublue-os/bluefin
-[Desktop Entry]
-Type=Application
-Name=System Update
-Comment=Update Bluefin, Flatpaks, Distrobox containers, and more
-Icon=ublue-update
-Categories=ConsoleOnly;System;
-Terminal=true
-Exec=/usr/bin/ujust update
diff --git a/files/system/common/usr/share/ublue-os/just/10-update.just b/files/system/common/usr/share/ublue-os/just/10-update.just
deleted file mode 100644
index 2ace18a..0000000
--- a/files/system/common/usr/share/ublue-os/just/10-update.just
+++ /dev/null
@@ -1,45 +0,0 @@
-# vim: set ft=make :
-# copied from https://github.com/ublue-os/bluefin
-
-alias upgrade := update
-
-# Update system, flatpaks, and containers all at once
-update:
-    #!/usr/bin/bash
-    TOPGRADE_CONFIG="/usr/share/ublue-os/topgrade"
-    /usr/bin/grep "^LockLayering=true" /etc/rpm-ostreed.conf &>/dev/null && TOPGRADE_CONFIG="${TOPGRADE_CONFIG}-bootc"
-    /usr/bin/topgrade --config "${TOPGRADE_CONFIG}.toml" --keep
-
-alias auto-update := toggle-updates
-
-# Turn automatic updates on or off
-toggle-updates ACTION="prompt":
-    #!/usr/bin/bash
-    source /usr/lib/ujust/ujust.sh
-    CURRENT_STATE="Disabled"
-    if systemctl is-enabled ublue-update.timer | grep -q enabled; then
-        CURRENT_STATE="Enabled"
-    fi
-    OPTION={{ ACTION }}
-    if [ "$OPTION" == "prompt" ]; then
-        echo "Automatic updates are currently: ${bold}${CURRENT_STATE}${normal}"
-        echo "Enable or Disable automatic updates?"
-        OPTION=$(ugum choose Enable Disable)
-    elif [ "$OPTION" == "help" ]; then
-        echo "Usage: ujust toggle-updates <option>"
-        echo "  <option>: Specify the quick option - 'enable' or 'disable'"
-        echo "  Use 'enable' to Enable automatic updates."
-        echo "  Use 'disable' to Disable automatic updates."
-        exit 0
-    fi
-    if [ "${OPTION,,}" == "enable" ]; then
-        sudo systemctl enable ublue-update.timer
-    elif [ "${OPTION,,}" == "disable" ]; then
-        sudo systemctl disable ublue-update.timer
-    fi
-
-alias changelog := changelogs
-
-# Show the changelog
-changelogs:
-    rpm-ostree db diff --changelogs
\ No newline at end of file
diff --git a/files/system/common/usr/share/ublue-os/topgrade-bootc.toml b/files/system/common/usr/share/ublue-os/topgrade-bootc.toml
deleted file mode 100644
index 27fb3bf..0000000
--- a/files/system/common/usr/share/ublue-os/topgrade-bootc.toml
+++ /dev/null
@@ -1,11 +0,0 @@
-# copied from https://github.com/ublue-os/bluefin
-[misc]
-no_self_update = true
-only = ["custom_commands", "flatpak", "distrobox", "firmware"]
-disable = ["self_update", "toolbx", "containers", "helm", "system"]
-ignore_failures = ["distrobox", "flatpak", "brew_cask", "brew_formula", "nix", "node", "pip3", "home_manager", "firmware"]
-assume_yes = true
-no_retry = false
-
-[commands]
-"System Upgrade" = "sudo bootc upgrade"
diff --git a/files/system/common/usr/share/ublue-os/topgrade.toml b/files/system/common/usr/share/ublue-os/topgrade.toml
deleted file mode 100644
index 20895c6..0000000
--- a/files/system/common/usr/share/ublue-os/topgrade.toml
+++ /dev/null
@@ -1,11 +0,0 @@
-# copied from https://github.com/ublue-os/bluefin
-[misc]
-no_self_update = true
-only = ["system", "flatpak", "distrobox", "firmware"]
-disable = ["self_update", "toolbx", "containers", "helm"]
-ignore_failures = ["distrobox", "flatpak", "brew_cask", "brew_formula", "nix", "node", "pip3", "home_manager", "firmware"]
-assume_yes = true
-no_retry = false
-
-[linux]
-rpm_ostree = true
diff --git a/hack/bib-img-config.toml b/hack/bib-img-config.toml
deleted file mode 100644
index 1604d97..0000000
--- a/hack/bib-img-config.toml
+++ /dev/null
@@ -1,6 +0,0 @@
-# TODO: sort out a proper config
-[[customizations.user]]
-name = "detiber"
-password = "changeme"
-key = "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDFeiGuhMVEvVcRI8/yb1U6SkdNnv4OaBlfbcEWkKhafAAAABHNzaDo="
-groups = ["wheel"]
diff --git a/just/archive.just b/just/archive.just
new file mode 100644
index 0000000..e4b849c
--- /dev/null
+++ b/just/archive.just
@@ -0,0 +1,357 @@
+# # Using main to bring in --tempdir arg, can change back to latest once that feature is released
+# bluebuild-version := "main"
+# bluebuild-image := "ghcr.io/blue-build/cli:" + bluebuild-version
+# butane-version := "release"
+# butane-image := "quay.io/coreos/butane:" + butane-version
+# [group('lint')]
+# [group('validate')]
+# validate-all: validate-recipes
+# # Validate all recipes
+# [group('lint')]
+# [group('validate')]
+# validate-recipes:
+#   for file in `ls recipes/*.yml`; do \
+#     just validate-recipe-for ${file}; \
+#   done
+# _validate-recipe-for recipe_def:
+#   podman run -it --rm \
+#     --pull=newer \
+#     --security-opt label=type:unconfined_t \
+#     -v '{{absolute_path(".")}}':/bluebuild \
+#     {{bluebuild-image}} \
+#     bluebuild validate {{recipe_def}}
+# [group('generate')]
+# generate-all: generate-ignition
+# # Generate ignition config
+# [group('generate')]
+# [group('ignition')]
+# generate-ignition:
+#   for file in `ls hack/*.butane`; do \
+#     just _generate-ignition-for ${file}; \
+#   done
+# _generate-ignition-for butane_config:
+#   @echo {{without_extension(butane_config)}}
+#   podman run -i --rm \
+#     --pull=newer \
+#     {{butane-image}} \
+#     --pretty --strict \
+#     < {{butane_config}} \
+#     > {{without_extension(butane_config)}}.ign
+# # common-bib-image-config := absolute_path("./hack/bib-img-config.toml")
+# # common-bib-image-args := "--type qcow2 --rootfs btrfs"
+# _bib-image image output_dir: \
+#   && (_bib image output_dir common-bib-image-config
+#     common-bib-image-args)
+# # common-bib-iso-config := absolute_path("./hack/osbuild-blueprint-bootc.toml")
+# # common-bib-iso-args := "--type anaconda-iso"
+# _bib-iso image output_dir: \
+#   && (_bib image output_dir common-bib-iso-config common-bib-iso-args)
+# bib-beardy-image-name := "beardy-os"
+# bib-beardy-image := beardy-repo + "/" \
+#   + bib-beardy-image-name + ":" + beardy-version
+# bib-beardy-image-output-dir := join(common-bib-output-dir, "beardy")
+# [group('disk images')]
+# [group('bib')]
+# bib-image-beardy: (_ensure-directory bib-beardy-image-output-dir) \
+#   && (_bib-image bib-beardy-image bib-beardy-image-output-dir)
+# [group('iso')]
+# [group('bib')]
+# bib-iso-beardy: (_ensure-directory bib-beardy-image-output-dir) && \
+#   (_bib-iso bib-beardy-image bib-beardy-image-output-dir)
+# common-bluebuild-output-dir := join(common-build-dir,
+#   "bluebuild", "output")
+# common-bluebuild-tmp-dir := join(common-build-dir,
+#   "bluebuild", "tmp")
+# _bluebuild-containerfile recipe output_dir:
+#   podman run -it --rm \
+#     --pull=newer \
+#     --security-opt label=type:unconfined_t \
+#     -v '{{absolute_path(".")}}':/bluebuild \
+#     -v '{{output_dir}}':/output \
+#     {{bluebuild-image}} \
+#     bluebuild generate -o /output/Containerfile {{recipe}}
+# _bluebuild-iso output_dir image_name variant args: \
+#   (_ensure-directory common-bluebuild-tmp-dir)
+#   sudo podman run -it --rm \
+#     --privileged \
+#     --pull=newer \
+#     --security-opt label=type:unconfined_t \
+#     -v '{{absolute_path(".")}}':/bluebuild \
+#     -v '{{output_dir}}':/output \
+#     -v '{{common-bluebuild-tmp-dir}}':/build_tmp \
+#     {{bluebuild-image}} \
+#     bluebuild generate-iso \
+#     --tempdir /build_tmp \
+#     -o /output \
+#     --variant {{variant}} \
+#     --iso-name "{{image_name}}-{{variant}}.iso" \
+#     -R podman -B podman -I podman \
+#     {{args}}
+# _bluebuild-iso-from-image output_dir image_name image variant: \
+#   (_ensure-directory common-bluebuild-tmp-dir) \
+#   && (_bluebuild-iso output_dir image_name variant "image " + image)
+# _bluebuild-iso-from-recipe output_dir image_name recipe variant: \
+#   (_ensure-directory common-bluebuild-tmp-dir) \
+#   && (_bluebuild-iso output_dir image_name variant "recipe " + recipe)
+# bluebuild-beardy-output-dir := join(common-bluebuild-output-dir,
+#   "beardy")
+# bluebuild-beardy-recipe-file := "recipes/beardy.yml"
+# bluebuild-beardy-image-name := "beardy-os"
+# bluebuild-beardy-image := beardy-repo + "/" \
+#   + bluebuild-beardy-image-name + ":" + beardy-version
+# [group('containerfile')]
+# [group('bluebuild')]
+# bluebuild-containerfile-beardy: \
+#   (_ensure-directory bluebuild-beardy-output-dir) \
+#   && (_bluebuild-containerfile
+#     bluebuild-beardy-recipe-file
+#     bluebuild-beardy-output-dir)
+# [group('iso')]
+# [group('bluebuild')]
+# bluebuild-iso-beardy-server: \
+#   (_ensure-directory bluebuild-beardy-output-dir) \
+#   && (_bluebuild-iso-from-image
+#     bluebuild-beardy-output-dir
+#     bluebuild-beardy-image-name
+#     bluebuild-beardy-image
+#     "server")
+# [group('iso')]
+# [group('bluebuild')]
+# bluebuild-local-iso-beardy-server: \
+#   (_ensure-directory bluebuild-beardy-output-dir) \
+#   && (_bluebuild-iso-from-recipe
+#     bluebuild-beardy-output-dir
+#     bluebuild-beardy-image-name
+#     bluebuild-beardy-recipe-file
+#     "server")
+# [group('iso')]
+# [group('bluebuild')]
+# bluebuild-iso-beardy-kinoite: \
+#   (_ensure-directory bluebuild-beardy-output-dir) \
+#   && (_bluebuild-iso-from-image
+#     bluebuild-beardy-output-dir
+#     bluebuild-beardy-image-name
+#     bluebuild-beardy-image
+#     "kinoite")
+# [group('iso')]
+# [group('bluebuild')]
+# bluebuild-local-iso-beardy-kinoite: \
+#   (_ensure-directory bluebuild-beardy-output-dir) \
+#   && (_bluebuild-iso-from-recipe
+#     bluebuild-beardy-output-dir
+#     bluebuild-beardy-image-name
+#     bluebuild-beardy-recipe-file
+#     "kinoite")
+# [group('iso')]
+# [group('bluebuild')]
+# bluebuild-iso-beardy-silverblue: \
+#   (_ensure-directory bluebuild-beardy-output-dir) \
+#   && (_bluebuild-iso-from-image
+#     bluebuild-beardy-output-dir
+#     bluebuild-beardy-image-name
+#     bluebuild-beardy-image
+#     "silverblue")
+# [group('iso')]
+# [group('bluebuild')]
+# bluebuild-local-iso-beardy-silverblue: \
+#   (_ensure-directory bluebuild-beardy-output-dir) \
+#   && (_bluebuild-iso-from-recipe
+#     bluebuild-beardy-output-dir
+#     bluebuild-beardy-image-name
+#     bluebuild-beardy-recipe-file
+#     "silverblue")
+# [group('clean')]
+# clean-all: clean-bib-cache clean-bib-output clean-bluebuild-output
+# [group('clean')]
+# [group('bib')]
+# clean-bib-cache:
+#   rm -rf {{common-bib-cache-dir}}
+# [group('clean')]
+# [group('bib')]
+# clean-bib-output:
+#   rm -rf {{common-bib-output-dir}}
+# [group('clean')]
+# [group('bluebuild')]
+# clean-bluebuild-output:
+#   rm -rf build/bluebuild/output
+# coreos-installer-version := "release"
+# coreos-installer-image := "quay.io/coreos/coreos-installer:" \
+#   + coreos-installer-version
+# coreos-pxe-output-dir := join(common-build-dir, "coreos", "pxe")
+# coreos-pxe: (_ensure-directory coreos-pxe-output-dir)
+#   podman run --rm \
+#     --pull=newer \
+#     --security-opt label=type:unconfined_t \
+#     -v '{{coreos-pxe-output-dir}}':/data \
+#     -w /data \
+#     {{coreos-installer-image}} \
+#     download -f pxe
+# coreos-pxe-customize: (_ensure-directory coreos-pxe-output-dir)
+#   podman run --rm \
+#     --pull=newer \
+#     --security-opt label=type:unconfined_t \
+#     -v '{{coreos-pxe-output-dir}}':/data \
+#     -v '{{absolute_path("./hack/base.ign")}}':/config/config.ign \
+#     -w /data \
+#     {{coreos-installer-image}} \
+#     pxe customize \
+#     --dest-device /dev/vda \
+#     --dest-ignition /config/config.ign \
+#     -o /data/wrapped-initramfs.img \
+#     fedora-coreos-41.20241109.3.0-live-initramfs.x86_64.img
+# coreos-iso-output-dir := join(common-build-dir, "coreos", "iso")
+# coreos-iso: (_ensure-directory coreos-iso-output-dir)
+#   podman run --rm \
+#     --pull=newer \
+#     --security-opt label=type:unconfined_t \
+#     -v '{{coreos-iso-output-dir}}':/data \
+#     -w /data \
+#     {{coreos-installer-image}} \
+#     download -f iso
+# coreos-iso-customize: (_ensure-directory coreos-iso-output-dir)
+#   podman run --rm \
+#     --pull=newer \
+#     --security-opt label=type:unconfined_t \
+#     -v '{{coreos-iso-output-dir}}':/data \
+#     -v '{{absolute_path("./hack/base.ign")}}':/config/config.ign \
+#     -w /data \
+#     {{coreos-installer-image}} \
+#     iso customize \
+#     --dest-device /dev/vda \
+#     --dest-ignition /config/config.ign \
+#     -o /data/coreos-custom.iso \
+#     fedora-coreos-41.20241109.3.0-live.x86_64.iso
+# coreos-iso-rebase: (_ensure-directory coreos-iso-output-dir)
+#   podman run --rm \
+#     --pull=newer \
+#     --security-opt label=type:unconfined_t \
+#     -v '{{coreos-iso-output-dir}}':/data \
+#     -v '{{absolute_path("./hack/beardy-autorebase.ign")}}':/config/config.ign \
+#     -w /data \
+#     {{coreos-installer-image}} \
+#     iso customize \
+#     --dest-device /dev/vda \
+#     --dest-ignition /config/config.ign \
+#     -o /data/coreos-rebase-beardy.iso \
+#     fedora-coreos-41.20241109.3.0-live.x86_64.iso
+# coreos-iso-switch: (_ensure-directory coreos-iso-output-dir)
+#   podman run --rm \
+#     --pull=newer \
+#     --security-opt label=type:unconfined_t \
+#     -v '{{coreos-iso-output-dir}}':/data \
+#     -v '{{absolute_path("./hack/beardy-bootc-switch.ign")}}':/config/config.ign \
+#     -w /data \
+#     {{coreos-installer-image}} \
+#     iso customize \
+#     --dest-device /dev/vda \
+#     --dest-ignition /config/config.ign \
+#     -o /data/coreos-switch-beardy.iso \
+#     fedora-coreos-41.20241109.3.0-live.x86_64.iso
+# common-bootc-output-dir := join(common-build-dir, "bootc", "output")
+# _bootc image args: (_ensure-directory common-bootc-output-dir)
+#   sudo podman run -it --rm \
+#     --privileged \
+#     --pull=newer \
+#     --pid=host \
+#     --security-opt label=type:unconfined_t \
+#     -e BOOTC_DIRECT_IO=on \
+#     -e LANG="en_US.UTF-8" \
+#     -v '{{common-bootc-output-dir}}':/output \
+#     -v /var/lib/containers/storage:/var/lib/containers/storage \
+#     -v /dev:/dev \
+#     {{image}} \
+#     bootc {{args}}
+# _bootc-create-file name: (_ensure-directory common-bootc-output-dir)
+#   dd of='{{common-bootc-output-dir}}/{{name}}' bs=20G seek=1 count=0
+# # TODO: set BOOTC_DIRECT_IO=on
+# bootc-install-disk image filename additional_args="": \
+#   (_bootc-create-file filename) \
+#   && (_bootc
+#     image
+#     "install to-disk --wipe --filesystem=btrfs " \
+#     + "--generic-image --via-loopback /output/" + filename \
+#     + " " + additional_args)
+# local-build tag containerfile additional_args="":
+#   sudo podman build \
+#     {{additional_args}} \
+#     -t {{tag}} \
+#     -f {{containerfile}} \
+#     .
+# local-build-ublue-base-name := "beardy-base"
+# local-build-ublue-base-image := "localhost/" \
+#   + local-build-ublue-base-name + ":latest"
+# local-build-ublue-base-containerfile := "ublue-image-template/Containerfile"
+# local-build-ublue-base: \
+#   && (local-build
+#     local-build-ublue-base-image
+#     local-build-ublue-base-containerfile)
+# local-build-bootc-base-name := "beardy-bootc"
+# local-build-bootc-base-image := "localhost/" \
+#   + local-build-bootc-base-name + ":latest"
+# local-build-bootc-base-containerfile := "bootc/Containerfile"
+# local-build-bootc-base: \
+#   && (local-build
+#     local-build-bootc-base-image
+#     local-build-bootc-base-containerfile)
+# local-bib-image-args := common-bib-image-args + " --local"
+# _local-bib-image image output_dir: \
+#   && (_bib
+#     image
+#     output_dir
+#     common-bib-image-config
+#     local-bib-image-args)
+# local-bib-iso-args := common-bib-iso-args + " --local"
+# _local-bib-iso image output_dir: \
+#   && (_bib
+#     image
+#     output_dir
+#     common-bib-iso-config
+#     local-bib-iso-args)
+# local-bib-ublue-base-image-output-dir := join(common-bib-output-dir,
+#   "local", "base")
+# [group('disk images')]
+# [group('bib')]
+# local-bib-image-ublue-base: \
+#   (_ensure-directory local-bib-ublue-base-image-output-dir) \
+#   (local-build-ublue-base) \
+#   && (_local-bib-image
+#     local-build-ublue-base-image
+#     local-bib-ublue-base-image-output-dir)
+# [group('iso')]
+# [group('bib')]
+# local-bib-iso-ublue-base: \
+#   (_ensure-directory local-bib-ublue-base-image-output-dir) \
+#   (local-build-ublue-base) \
+#   && (_local-bib-iso
+#     local-build-ublue-base-image
+#     local-bib-ublue-base-image-output-dir)
+# local-bib-bootc-base-image-output-dir := join(common-bib-output-dir,
+#   "local", "bootc")
+# [group('disk images')]
+# [group('bib')]
+# local-bib-image-bootc-base: \
+#   (_ensure-directory local-bib-bootc-base-image-output-dir) \
+#   (local-build-bootc-base) \
+#   && (_local-bib-image
+#     local-build-bootc-base-image
+#     local-bib-bootc-base-image-output-dir)
+# [group('iso')]
+# [group('bib')]
+# local-bib-iso-bootc-base: \
+#   (_ensure-directory local-bib-bootc-base-image-output-dir) \
+#   (local-build-bootc-base) \
+#   && (_local-bib-iso
+#     local-build-bootc-base-image
+#     local-bib-bootc-base-image-output-dir)
+# local-bootc-install-ublue-base: \
+#   (local-build-ublue-base) \
+#   && (bootc-install-disk
+#     local-build-ublue-base-image
+#     "beardy-ublue.raw"
+#     " --skip-fetch-check")
+# local-bootc-install-bootc-base: \
+#   (local-build-bootc-base) \
+#   && (bootc-install-disk
+#     local-build-bootc-base-image
+#     "beardy-bootc.raw"
+#     " --skip-fetch-check")
diff --git a/just/bib.just b/just/bib.just
new file mode 100644
index 0000000..fb7dc31
--- /dev/null
+++ b/just/bib.just
@@ -0,0 +1,20 @@
+import 'common.just'
+
+bib-version := "latest"
+bib-image := "quay.io/centos-bootc/bootc-image-builder:" + bib-version
+bib-cache-dir := join(build-dir, 'cache', 'bib')
+
+_bib image output_dir build_cache_dir config args: (_ensure-directory output_dir) (_ensure-directory join(build_cache_dir, 'store')) (_ensure-directory join(build_cache_dir, 'rpmmd'))
+    sudo podman run -it --rm \
+      --privileged \
+      --pull=newer \
+      --security-opt label=type:unconfined_t \
+      -v '{{ config }}':/config.toml:ro \
+      -v '{{ output_dir }}':/output \
+      -v '{{ join(build_cache_dir, 'store') }}':/store \
+      -v '{{ join(build_cache_dir, 'rpmmd') }}':/rpmmd \
+      -v /var/lib/containers/storage:/var/lib/containers/storage \
+      {{ bib-image }} \
+      {{ args }} \
+      --log-level info \
+      {{ image }}
diff --git a/just/common.just b/just/common.just
new file mode 100644
index 0000000..c61fcbe
--- /dev/null
+++ b/just/common.just
@@ -0,0 +1,25 @@
+beardy-version := "latest"
+beardy-repo := "ghcr.io/detiber"
+root-dir := canonicalize(parent_directory(source_directory()))
+build-dir := join(root-dir, 'build')
+
+_ensure-directory dir_path:
+    mkdir -p {{ dir_path }}
+
+# sudoif bash function
+[group('Utility')]
+[private]
+sudoif command *args:
+    #!/usr/bin/bash
+    function sudoif(){
+        if [[ "${UID}" -eq 0 ]]; then
+            "$@"
+        elif [[ "$(command -v sudo)" && -n "${SSH_ASKPASS:-}" ]] && [[ -n "${DISPLAY:-}" || -n "${WAYLAND_DISPLAY:-}" ]]; then
+            /usr/bin/sudo --askpass "$@" || exit 1
+        elif [[ "$(command -v sudo)" ]]; then
+            /usr/bin/sudo "$@" || exit 1
+        else
+            exit 1
+        fi
+    }
+    sudoif {{ command }} {{ args }}
\ No newline at end of file
diff --git a/justfile b/justfile
index d4b73a0..0495da5 100644
--- a/justfile
+++ b/justfile
@@ -1,453 +1,30 @@
-# default recipe to display help information
-default:
-  @just --list
-
-beardy-version := "latest"
-beardy-repo := "ghcr.io/detiber"
-#beardy-image := beardy-repo + "/beardy-os:" + beardy-version
-
-# Using main to bring in --tempdir arg, can change back to latest once that feature is released
-bluebuild-version := "main"
-bluebuild-image := "ghcr.io/blue-build/cli:" + bluebuild-version
-
-butane-version := "release"
-butane-image := "quay.io/coreos/butane:" + butane-version
-
-bib-version := "latest"
-bib-image := "quay.io/centos-bootc/bootc-image-builder:" + bib-version
-
-[group('lint')]
-[group('validate')]
-validate-all: validate-recipes
-
-# Validate all recipes
-[group('lint')]
-[group('validate')]
-validate-recipes:
-  for file in `ls recipes/*.yml`; do \
-    just validate-recipe-for ${file}; \
-  done
-
-_validate-recipe-for recipe_def:
-  podman run -it --rm \
-    --pull=newer \
-    --security-opt label=type:unconfined_t \
-    -v '{{absolute_path(".")}}':/bluebuild \
-    {{bluebuild-image}} \
-    bluebuild validate {{recipe_def}}
-
-[group('generate')]
-generate-all: generate-ignition
-
-# Generate ignition config
-[group('generate')]
-[group('ignition')]
-generate-ignition:
-  for file in `ls hack/*.butane`; do \
-    just _generate-ignition-for ${file}; \
-  done
-
-_generate-ignition-for butane_config:
-  @echo {{without_extension(butane_config)}}
-  podman run -i --rm \
-    --pull=newer \
-    {{butane-image}} \
-    --pretty --strict \
-    < {{butane_config}} \
-    > {{without_extension(butane_config)}}.ign
-
-common-build-dir := absolute_path("./build")
-_ensure-directory dir_path:
-  mkdir -p {{dir_path}}
-
-common-bib-output-dir := join(common-build-dir, "bib", "output")
-common-bib-cache-dir := join(common-build-dir, "bib", "cache")
-common-bib-store-cache-dir := join(common-bib-cache-dir, "store")
-common-bib-rpmmd-cache-dir := join(common-bib-cache-dir, "rpmmd")
-_bib image output_dir config args: \
-  (_ensure-directory common-bib-store-cache-dir) \
-  (_ensure-directory common-bib-rpmmd-cache-dir)
-  sudo podman run -it --rm \
-    --privileged \
-    --pull=newer \
-    --security-opt label=type:unconfined_t \
-    -v '{{config}}':/config.toml:ro \
-    -v '{{output_dir}}':/output \
-    -v '{{common-bib-store-cache-dir}}':/store \
-    -v '{{common-bib-rpmmd-cache-dir}}':/rpmmd \
-    -v /var/lib/containers/storage:/var/lib/containers/storage \
-    {{bib-image}} \
-    {{args}} \
-    --log-level info \
-    {{image}}
-
-common-bib-image-config := absolute_path("./hack/bib-img-config.toml")
-common-bib-image-args := "--type qcow2 --rootfs btrfs"
-_bib-image image output_dir: \
-  && (_bib image output_dir common-bib-image-config
-    common-bib-image-args)
-
-common-bib-iso-config := absolute_path("./hack/bib-iso-config.toml")
-common-bib-iso-args := "--type anaconda-iso"
-_bib-iso image output_dir: \
-  && (_bib image output_dir common-bib-iso-config common-bib-iso-args)
-
-bib-base-image-name := "beardy-os-base"
-bib-base-image := beardy-repo + "/" \
-  + bib-base-image-name + ":" + beardy-version
-bib-base-image-output-dir := join(common-bib-output-dir, "base")
-[group('disk images')]
-[group('bib')]
-bib-image-base: (_ensure-directory bib-base-image-output-dir) \
-  && (_bib-image bib-base-image bib-base-image-output-dir)
-
-[group('iso')]
-[group('bib')]
-bib-iso-base: (_ensure-directory bib-base-image-output-dir) \
-  && (_bib-iso bib-base-image bib-base-image-output-dir)
-
-bib-beardy-image-name := "beardy-os"
-bib-beardy-image := beardy-repo + "/" \
-  + bib-beardy-image-name + ":" + beardy-version
-bib-beardy-image-output-dir := join(common-bib-output-dir, "beardy")
-[group('disk images')]
-[group('bib')]
-bib-image-beardy: (_ensure-directory bib-beardy-image-output-dir) \
-  && (_bib-image bib-beardy-image bib-beardy-image-output-dir)
-
-[group('iso')]
-[group('bib')]
-bib-iso-beardy: (_ensure-directory bib-beardy-image-output-dir) && \
-  (_bib-iso bib-beardy-image bib-beardy-image-output-dir)
-
-common-bluebuild-output-dir := join(common-build-dir,
-  "bluebuild", "output")
-common-bluebuild-tmp-dir := join(common-build-dir,
-  "bluebuild", "tmp")
-_bluebuild-containerfile recipe output_dir:
-  podman run -it --rm \
-    --pull=newer \
-    --security-opt label=type:unconfined_t \
-    -v '{{absolute_path(".")}}':/bluebuild \
-    -v '{{output_dir}}':/output \
-    {{bluebuild-image}} \
-    bluebuild generate -o /output/Containerfile {{recipe}}
-
-_bluebuild-iso output_dir image_name variant args: \
-  (_ensure-directory common-bluebuild-tmp-dir)
-  sudo podman run -it --rm \
-    --privileged \
-    --pull=newer \
-    --security-opt label=type:unconfined_t \
-    -v '{{absolute_path(".")}}':/bluebuild \
-    -v '{{output_dir}}':/output \
-    -v '{{common-bluebuild-tmp-dir}}':/build_tmp \
-    {{bluebuild-image}} \
-    bluebuild generate-iso \
-    --tempdir /build_tmp \
-    -o /output \
-    --variant {{variant}} \
-    --iso-name "{{image_name}}-{{variant}}.iso" \
-    -R podman -B podman -I podman \
-    {{args}}
-
-_bluebuild-iso-from-image output_dir image_name image variant: \
-  (_ensure-directory common-bluebuild-tmp-dir) \
-  && (_bluebuild-iso output_dir image_name variant "image " + image)
-
-_bluebuild-iso-from-recipe output_dir image_name recipe variant: \
-  (_ensure-directory common-bluebuild-tmp-dir) \
-  && (_bluebuild-iso output_dir image_name variant "recipe " + recipe)
-
-bluebuild-beardy-output-dir := join(common-bluebuild-output-dir,
-  "beardy")
-bluebuild-beardy-recipe-file := "recipes/beardy.yml"
-bluebuild-beardy-image-name := "beardy-os"
-bluebuild-beardy-image := beardy-repo + "/" \
-  + bluebuild-beardy-image-name + ":" + beardy-version
-[group('containerfile')]
-[group('bluebuild')]
-bluebuild-containerfile-beardy: \
-  (_ensure-directory bluebuild-beardy-output-dir) \
-  && (_bluebuild-containerfile
-    bluebuild-beardy-recipe-file 
-    bluebuild-beardy-output-dir)
-
-[group('iso')]
-[group('bluebuild')]
-bluebuild-iso-beardy-server: \
-  (_ensure-directory bluebuild-beardy-output-dir) \
-  && (_bluebuild-iso-from-image
-    bluebuild-beardy-output-dir
-    bluebuild-beardy-image-name
-    bluebuild-beardy-image
-    "server")
-
-[group('iso')]
-[group('bluebuild')]
-bluebuild-local-iso-beardy-server: \
-  (_ensure-directory bluebuild-beardy-output-dir) \
-  && (_bluebuild-iso-from-recipe
-    bluebuild-beardy-output-dir
-    bluebuild-beardy-image-name
-    bluebuild-beardy-recipe-file
-    "server")
-
-[group('iso')]
-[group('bluebuild')]
-bluebuild-iso-beardy-kinoite: \
-  (_ensure-directory bluebuild-beardy-output-dir) \
-  && (_bluebuild-iso-from-image
-    bluebuild-beardy-output-dir
-    bluebuild-beardy-image-name
-    bluebuild-beardy-image
-    "kinoite")
+mod bootc 'variants/bootc/justfile'
+mod bluefin 'variants/bluefin/justfile'
 
-[group('iso')]
-[group('bluebuild')]
-bluebuild-local-iso-beardy-kinoite: \
-  (_ensure-directory bluebuild-beardy-output-dir) \
-  && (_bluebuild-iso-from-recipe
-    bluebuild-beardy-output-dir
-    bluebuild-beardy-image-name
-    bluebuild-beardy-recipe-file
-    "kinoite")
+import 'just/common.just'
 
-[group('iso')]
-[group('bluebuild')]
-bluebuild-iso-beardy-silverblue: \
-  (_ensure-directory bluebuild-beardy-output-dir) \
-  && (_bluebuild-iso-from-image
-    bluebuild-beardy-output-dir
-    bluebuild-beardy-image-name
-    bluebuild-beardy-image
-    "silverblue")
-
-[group('iso')]
-[group('bluebuild')]
-bluebuild-local-iso-beardy-silverblue: \
-  (_ensure-directory bluebuild-beardy-output-dir) \
-  && (_bluebuild-iso-from-recipe
-    bluebuild-beardy-output-dir
-    bluebuild-beardy-image-name
-    bluebuild-beardy-recipe-file
-    "silverblue")
-
-[group('clean')]
-clean-all: clean-bib-cache clean-bib-output clean-bluebuild-output
-
-[group('clean')]
-[group('bib')]
-clean-bib-cache:
-  rm -rf {{common-bib-cache-dir}}
-
-[group('clean')]
-[group('bib')]
-clean-bib-output:
-  rm -rf {{common-bib-output-dir}}
-
-[group('clean')]
-[group('bluebuild')]
-clean-bluebuild-output:
-  rm -rf build/bluebuild/output
-
-coreos-installer-version := "release"
-coreos-installer-image := "quay.io/coreos/coreos-installer:" \
-  + coreos-installer-version
-coreos-pxe-output-dir := join(common-build-dir, "coreos", "pxe")
-coreos-pxe: (_ensure-directory coreos-pxe-output-dir)
-  podman run --rm \
-    --pull=newer \
-    --security-opt label=type:unconfined_t \
-    -v '{{coreos-pxe-output-dir}}':/data \
-    -w /data \
-    {{coreos-installer-image}} \
-    download -f pxe
-
-coreos-pxe-customize: (_ensure-directory coreos-pxe-output-dir)
-  podman run --rm \
-    --pull=newer \
-    --security-opt label=type:unconfined_t \
-    -v '{{coreos-pxe-output-dir}}':/data \
-    -v '{{absolute_path("./hack/base.ign")}}':/config/config.ign \
-    -w /data \
-    {{coreos-installer-image}} \
-    pxe customize \
-    --dest-device /dev/vda \
-    --dest-ignition /config/config.ign \
-    -o /data/wrapped-initramfs.img \
-    fedora-coreos-41.20241109.3.0-live-initramfs.x86_64.img
-
-coreos-iso-output-dir := join(common-build-dir, "coreos", "iso")
-coreos-iso: (_ensure-directory coreos-iso-output-dir)
-  podman run --rm \
-    --pull=newer \
-    --security-opt label=type:unconfined_t \
-    -v '{{coreos-iso-output-dir}}':/data \
-    -w /data \
-    {{coreos-installer-image}} \
-    download -f iso
-
-coreos-iso-customize: (_ensure-directory coreos-iso-output-dir)
-  podman run --rm \
-    --pull=newer \
-    --security-opt label=type:unconfined_t \
-    -v '{{coreos-iso-output-dir}}':/data \
-    -v '{{absolute_path("./hack/base.ign")}}':/config/config.ign \
-    -w /data \
-    {{coreos-installer-image}} \
-    iso customize \
-    --dest-device /dev/vda \
-    --dest-ignition /config/config.ign \
-    -o /data/coreos-custom.iso \
-    fedora-coreos-41.20241109.3.0-live.x86_64.iso
-
-coreos-iso-rebase: (_ensure-directory coreos-iso-output-dir)
-  podman run --rm \
-    --pull=newer \
-    --security-opt label=type:unconfined_t \
-    -v '{{coreos-iso-output-dir}}':/data \
-    -v '{{absolute_path("./hack/beardy-autorebase.ign")}}':/config/config.ign \
-    -w /data \
-    {{coreos-installer-image}} \
-    iso customize \
-    --dest-device /dev/vda \
-    --dest-ignition /config/config.ign \
-    -o /data/coreos-rebase-beardy.iso \
-    fedora-coreos-41.20241109.3.0-live.x86_64.iso
-
-coreos-iso-switch: (_ensure-directory coreos-iso-output-dir)
-  podman run --rm \
-    --pull=newer \
-    --security-opt label=type:unconfined_t \
-    -v '{{coreos-iso-output-dir}}':/data \
-    -v '{{absolute_path("./hack/beardy-bootc-switch.ign")}}':/config/config.ign \
-    -w /data \
-    {{coreos-installer-image}} \
-    iso customize \
-    --dest-device /dev/vda \
-    --dest-ignition /config/config.ign \
-    -o /data/coreos-switch-beardy.iso \
-    fedora-coreos-41.20241109.3.0-live.x86_64.iso
-
-common-bootc-output-dir := join(common-build-dir, "bootc", "output")
-_bootc image args: (_ensure-directory common-bootc-output-dir)
-  sudo podman run -it --rm \
-    --privileged \
-    --pull=newer \
-    --pid=host \
-    --security-opt label=type:unconfined_t \
-    -e BOOTC_DIRECT_IO=on \
-    -e LANG="en_US.UTF-8" \
-    -v '{{common-bootc-output-dir}}':/output \
-    -v /var/lib/containers/storage:/var/lib/containers/storage \
-    -v /dev:/dev \
-    {{image}} \
-    bootc {{args}}
-
-_bootc-create-file name: (_ensure-directory common-bootc-output-dir)
-  dd of='{{common-bootc-output-dir}}/{{name}}' bs=20G seek=1 count=0
-
-# TODO: set BOOTC_DIRECT_IO=on
-bootc-install-disk image filename additional_args="": \
-  (_bootc-create-file filename) \
-  && (_bootc
-    image
-    "install to-disk --wipe --filesystem=btrfs " \
-    + "--generic-image --via-loopback /output/" + filename \
-    + " " + additional_args)
-
-local-build tag containerfile additional_args="":
-  sudo podman build \
-    {{additional_args}} \
-    -t {{tag}} \
-    -f {{containerfile}} \
-    .
-
-local-build-ublue-base-name := "beardy-base"
-local-build-ublue-base-image := "localhost/" \
-  + local-build-ublue-base-name + ":latest"
-local-build-ublue-base-containerfile := "ublue-image-template/Containerfile"
-local-build-ublue-base: \
-  && (local-build
-    local-build-ublue-base-image
-    local-build-ublue-base-containerfile)
-
-local-build-bootc-base-name := "beardy-bootc"
-local-build-bootc-base-image := "localhost/" \
-  + local-build-bootc-base-name + ":latest"
-local-build-bootc-base-containerfile := "bootc/Containerfile"
-local-build-bootc-base: \
-  && (local-build
-    local-build-bootc-base-image
-    local-build-bootc-base-containerfile)
-
-local-bib-image-args := common-bib-image-args + " --local"
-_local-bib-image image output_dir: \
-  && (_bib
-    image
-    output_dir
-    common-bib-image-config
-    local-bib-image-args)
-
-local-bib-iso-args := common-bib-iso-args + " --local"
-_local-bib-iso image output_dir: \
-  && (_bib
-    image
-    output_dir
-    common-bib-iso-config
-    local-bib-iso-args)
-
-local-bib-ublue-base-image-output-dir := join(common-bib-output-dir,
-  "local", "base")
-[group('disk images')]
-[group('bib')]
-local-bib-image-ublue-base: \
-  (_ensure-directory local-bib-ublue-base-image-output-dir) \
-  (local-build-ublue-base) \
-  && (_local-bib-image
-    local-build-ublue-base-image
-    local-bib-ublue-base-image-output-dir)
-
-[group('iso')]
-[group('bib')]
-local-bib-iso-ublue-base: \
-  (_ensure-directory local-bib-ublue-base-image-output-dir) \
-  (local-build-ublue-base) \
-  && (_local-bib-iso
-    local-build-ublue-base-image
-    local-bib-ublue-base-image-output-dir)
-
-local-bib-bootc-base-image-output-dir := join(common-bib-output-dir,
-  "local", "bootc")
-[group('disk images')]
-[group('bib')]
-local-bib-image-bootc-base: \
-  (_ensure-directory local-bib-bootc-base-image-output-dir) \
-  (local-build-bootc-base) \
-  && (_local-bib-image
-    local-build-bootc-base-image
-    local-bib-bootc-base-image-output-dir)
-
-[group('iso')]
-[group('bib')]
-local-bib-iso-bootc-base: \
-  (_ensure-directory local-bib-bootc-base-image-output-dir) \
-  (local-build-bootc-base) \
-  && (_local-bib-iso
-    local-build-bootc-base-image
-    local-bib-bootc-base-image-output-dir)
-
-local-bootc-install-ublue-base: \
-  (local-build-ublue-base) \
-  && (bootc-install-disk
-    local-build-ublue-base-image
-    "beardy-ublue.raw"
-    " --skip-fetch-check")
-
-local-bootc-install-bootc-base: \
-  (local-build-bootc-base) \
-  && (bootc-install-disk
-    local-build-bootc-base-image
-    "beardy-bootc.raw"
-    " --skip-fetch-check")
+# default recipe to display help information
+default:
+    @just --list
+
+# Check Just Syntax
+[group('Just')]
+check:
+    #!/usr/bin/bash
+    find {{ root-dir }} -type f -name "*.just" | while read -r file; do
+    	echo "Checking syntax: $file"
+    	just --unstable --fmt --check -f $file
+    done
+    echo "Checking syntax: justfile"
+    just --unstable --fmt --check -f justfile
+
+# Fix Just Syntax
+[group('Just')]
+fix:
+    #!/usr/bin/bash
+    find {{ root-dir }} -type f -name "*.just" | while read -r file; do
+    	echo "Checking syntax: $file"
+    	just --unstable --fmt -f $file
+    done
+    echo "Checking syntax: justfile"
+    just --unstable --fmt -f justfile || { exit 1; }
diff --git a/ublue-image-template/Containerfile b/ublue-image-template/Containerfile
deleted file mode 100644
index bd73d4f..0000000
--- a/ublue-image-template/Containerfile
+++ /dev/null
@@ -1,213 +0,0 @@
-# Hacked containerfile that mashes up bluebuild w/ upstream template
-# Mainly attempting to leverage some of the bluebuild tooling, while
-# using a dnf5-centric approach until the tooling catches up
-# Will likely need to be updated as bluebuild/upstream changes
-
-# bluebuild: This stage is responsible for holding onto
-# your config without copying it directly into
-# the final image
-FROM scratch AS stage-files
-COPY ./files /files
-
-# bluebuild: Copy modules
-# The default modules are inside blue-build/modules
-# Custom modules overwrite defaults
-FROM scratch AS stage-modules
-COPY --from=ghcr.io/blue-build/modules:latest /modules /modules
-COPY ./modules /modules
-
-# bluebuild: Bins to install
-# These are basic tools that are added to all images.
-# Generally used for the build process. We use a multi
-# stage process so that adding the bins into the image
-# can be added to the ostree commits.
-FROM scratch AS stage-bins
-COPY --from=gcr.io/projectsigstore/cosign /ko-app/cosign /bins/cosign
-COPY --from=ghcr.io/blue-build/cli:latest-installer /out/bluebuild /bins/bluebuild
-
-# bluebuild: Keys for pre-verified images
-# Used to copy the keys into the final image
-# and perform an ostree commit.
-#
-# Currently only holds the current image's
-# public key.
-FROM scratch AS stage-keys
-COPY cosign.pub /keys/beardy-os.pub
-
-# Base ublue image
-FROM ghcr.io/ublue-os/base-main:latest
-
-# bluebuild: args
-ARG CONFIG_DIRECTORY="/tmp/files"
-ARG FORCE_COLOR=1
-ARG CLICOLOR_FORCE=1
-ARG LANG="en_US.UTF-8"
-
-ENV LANG $LANG
-
-# bluebuild: script module (unwrap cli asap)
-RUN \
---mount=type=bind,from=stage-files,src=/files,dst=/tmp/files,rw \
---mount=type=bind,from=stage-modules,src=/modules,dst=/tmp/modules,rw \
---mount=type=bind,from=ghcr.io/blue-build/cli/build-scripts:a8cac2adc90fa842e4565bc1825e588df4f5bcbd,src=/scripts/,dst=/tmp/scripts/ \
---mount=type=cache,dst=/var/cache/rpm-ostree,id=rpm-ostree-cache-beardy-os-latest,sharing=locked \
---mount=type=cache,dst=/var/cache/libdnf5,id=dnf-cache-beardy-os-latest,sharing=locked \
-/tmp/scripts/run_module.sh 'script' '{"type":"script","scripts":["unwrap-cli.sh"]}' \
-&& ostree container commit
-
-# Install required packages
-RUN \
---mount=type=cache,dst=/var/cache/rpm-ostree,id=rpm-ostree-cache-beardy-os-latest,sharing=locked \
---mount=type=cache,dst=/var/cache/libdnf5,id=dnf-cache-beardy-os-latest,sharing=locked \
-dnf5 -y install glibc-locale-source glibc-langpack-en osbuild-selinux && \
-dnf5 -y copr enable gmaglione/podman-bootc && \
-dnf5 -y install podman-bootc && \
-ostree container commit
-
-RUN localedef -i en_US -f UTF-8 en_US.UTF-8
-RUN echo "LANG=\"en_US.UTF-8\"" > /etc/locale.conf
-RUN ln -s -f /usr/share/zoneinfo/America/New_York /etc/localtime
-RUN echo "%wheel         ALL = (ALL) NOPASSWD: ALL" > /etc/sudoers.d/wheel-nopassword
-
-# bluebuild: Key RUN
-RUN --mount=type=bind,from=stage-keys,src=/keys,dst=/tmp/keys \
-  mkdir -p /etc/pki/containers/ \
-  mkdir -p /usr/etc/pki/containers/ \
-  && cp /tmp/keys/* /etc/pki/containers/ \
-  && cp /tmp/keys/* /usr/etc/pki/containers/ \
-  && ostree container commit
-
-# bluebuild: Bin RUN
-RUN --mount=type=bind,from=stage-bins,src=/bins,dst=/tmp/bins \
-  mkdir -p /usr/bin/ \
-  && cp /tmp/bins/* /usr/bin/ \
-  && ostree container commit
-
-# TODO: skipped running pre_build.sh from bluebuild here, since it uses rpm-ostree instead of dnf5
-# It only installs jq and does a commit, unsure if jq install is even necessary at this point
-
-# bluebuild: bling module
-# TODO: bling modules 1password, ublue-update, negativo17, and rpmfusion use rpm-ostree
-# bling/dconf-update-service is safe, though (I think)
-RUN \
---mount=type=bind,from=stage-files,src=/files,dst=/tmp/files,rw \
---mount=type=bind,from=stage-modules,src=/modules,dst=/tmp/modules,rw \
---mount=type=bind,from=ghcr.io/blue-build/cli/build-scripts:a8cac2adc90fa842e4565bc1825e588df4f5bcbd,src=/scripts/,dst=/tmp/scripts/ \
-  --mount=type=cache,dst=/var/cache/rpm-ostree,id=rpm-ostree-cache-beardy-os-latest,sharing=locked \
-  --mount=type=cache,dst=/var/cache/libdnf5,id=dnf-cache-beardy-os-latest,sharing=locked \
-  /tmp/scripts/run_module.sh 'bling' '{"type":"bling","install":["dconf-update-service"]}' \  && ostree container commit
-
-# Install additional packages
-RUN \
---mount=type=cache,dst=/var/cache/rpm-ostree,id=rpm-ostree-cache-beardy-os-latest,sharing=locked \
---mount=type=cache,dst=/var/cache/libdnf5,id=dnf-cache-beardy-os-latest,sharing=locked \
-dnf5 -y install \
-cockpit-bridge \
-cockpit-machines \
-cockpit-navigator \
-cockpit-networkmanager \
-cockpit-ostree \
-cockpit-podman \
-cockpit-selinux \
-cockpit-storaged \
-cockpit-system \
-cockpit-composer \
-podman-compose \
-libvirt-client \
-virt-install \
-btrfs-assistant \
-btrfsmaintenance \
-dbus-daemon \
-dbus-tools \
-fastfetch \
-ptyxis \
-setroubleshoot-plugins \
-setroubleshoot-server \
-usermode \
-virt-install \
-virt-manager \
-virt-what \
-xdg-user-dirs \
-xdg-user-dirs-gtk \
-tig \
-libguestfs \
-lorax \
-&& ostree container commit
-
-# TODO: ublue-update
-
-# bluebuild: files module
-RUN \
---mount=type=bind,from=stage-files,src=/files,dst=/tmp/files,rw \
---mount=type=bind,from=stage-modules,src=/modules,dst=/tmp/modules,rw \
---mount=type=bind,from=ghcr.io/blue-build/cli/build-scripts:a8cac2adc90fa842e4565bc1825e588df4f5bcbd,src=/scripts/,dst=/tmp/scripts/ \
-  --mount=type=cache,dst=/var/cache/rpm-ostree,id=rpm-ostree-cache-beardy-os-latest,sharing=locked \
-  --mount=type=cache,dst=/var/cache/libdnf5,id=dnf-cache-beardy-os-latest,sharing=locked \
-  /tmp/scripts/run_module.sh 'files' '{"type":"files","files":[{"source":"system/common","destination":"/"}]}' \
-  && ostree container commit
-
-# bluebuild: default_flatpacks module
-RUN \
---mount=type=bind,from=stage-files,src=/files,dst=/tmp/files,rw \
---mount=type=bind,from=stage-modules,src=/modules,dst=/tmp/modules,rw \
---mount=type=bind,from=ghcr.io/blue-build/cli/build-scripts:a8cac2adc90fa842e4565bc1825e588df4f5bcbd,src=/scripts/,dst=/tmp/scripts/ \
-  --mount=type=cache,dst=/var/cache/rpm-ostree,id=rpm-ostree-cache-beardy-os-latest,sharing=locked \
-  --mount=type=cache,dst=/var/cache/libdnf5,id=dnf-cache-beardy-os-latest,sharing=locked \
-  /tmp/scripts/run_module.sh 'default-flatpaks' '{"type":"default-flatpaks","notify":true,"system":{"install":["com.github.tchx84.Flatseal","com.google.Chrome","com.mattjakeman.ExtensionManager","com.valvesoftware.Steam","com.valvesoftware.SteamLink","io.github.dvlv.boxbuddyrs","io.github.flattool.Warehouse","io.github.pwr_solaar.solaar","io.missioncenter.MissionCenter","io.podman_desktop.PodmanDesktop","org.cockpit_project.CockpitClient","org.fedoraproject.MediaWriter"],"remove":["org.gnome.eog"]},"user":{}}' \
-  && ostree container commit
-
-# bluebuild: systemd module
-RUN \
---mount=type=bind,from=stage-files,src=/files,dst=/tmp/files,rw \
---mount=type=bind,from=stage-modules,src=/modules,dst=/tmp/modules,rw \
---mount=type=bind,from=ghcr.io/blue-build/cli/build-scripts:a8cac2adc90fa842e4565bc1825e588df4f5bcbd,src=/scripts/,dst=/tmp/scripts/ \
-  --mount=type=cache,dst=/var/cache/rpm-ostree,id=rpm-ostree-cache-beardy-os-latest,sharing=locked \
-  --mount=type=cache,dst=/var/cache/libdnf5,id=dnf-cache-beardy-os-latest,sharing=locked \
-  /tmp/scripts/run_module.sh 'systemd' '{"type":"systemd","system":{"enabled":["podman.socket","sshd.service"]}}' \
-  && ostree container commit
-
-RUN bootc container lint
-
-# # bluebuild: post_build.sh clears out /tmp/* and /var/* and does a commit
-# RUN --mount=type=bind,from=ghcr.io/blue-build/cli/build-scripts:a8cac2adc90fa842e4565bc1825e588df4f5bcbd,src=/scripts/,dst=/scripts/ \
-#   /scripts/post_build.sh
-
-# ## Install applications
-# # Anything in Fedora
-
-# RUN dnf5 install vlc
-
-## Add COPRs
-# RUN dnf copr enable (copr-author/name)
-# RUN dnf5 install thing-from-copr
-
-## Manage services
-# systemctl enable foo.service
-
-# TODO: figure out why this needs to be created manually...
-# fixes systemd tainted with 'var-run-bad'
-# TODO: remove after sorting out issues with ro filesystem and systemd-tmpfiles failing to create necessary symlinks
-# RUN ln -s /run /var/run && ostree container commit
-
-# TODO: re-enable signing
-# bluebuild: signing module
-# RUN \
-# --mount=type=bind,from=stage-files,src=/files,dst=/tmp/files,rw \
-# --mount=type=bind,from=stage-modules,src=/modules,dst=/tmp/modules,rw \
-# --mount=type=bind,from=ghcr.io/blue-build/cli/build-scripts:a8cac2adc90fa842e4565bc1825e588df4f5bcbd,src=/scripts/,dst=/tmp/scripts/ \
-# --mount=type=cache,dst=/var/cache/rpm-ostree,id=rpm-ostree-cache-beardy-os-latest,sharing=locked \
-# --mount=type=cache,dst=/var/cache/libdnf5,id=dnf-cache-beardy-os-latest,sharing=locked \
-# /tmp/scripts/run_module.sh 'signing' '{"type":"signing"}' \
-# && ostree container commit
-
-# bluebuild: Labels are added last since they cause cache misses with buildah
-LABEL org.blue-build.build-id="c74bf003-e98a-4ac0-8db2-8869239c6c13"
-LABEL org.opencontainers.image.title="beardy-os"
-LABEL org.opencontainers.image.description="The preferred u-blue based OS for bearded developers."
-LABEL org.opencontainers.image.base.digest="sha256:4ff605c93dca3a99b434f7363f400925685432cc22c5affbef9567e97d49603d"
-LABEL org.opencontainers.image.base.name="ghcr.io/ublue-os/silverblue-main:latest"
-LABEL org.opencontainers.image.created="2024-12-10T01:22:13.918756743+00:00"
-LABEL io.artifacthub.package.readme-url=https://raw.githubusercontent.com/detiber/beardy-os/main/README.md
-LABEL org.opencontainers.image.source=https://github.com/detiber/beardy-os
-LABEL org.opencontainers.image.url=https://github.com/detiber/beardy-os
-LABEL org.opencontainers.image.vendor=detiber
diff --git a/ublue-image-template/README.md b/ublue-image-template/README.md
deleted file mode 100644
index 0675f62..0000000
--- a/ublue-image-template/README.md
+++ /dev/null
@@ -1,87 +0,0 @@
-# image-template
-
-# Purpose
-
-This repository is meant to be a template for building your own custom Universal Blue image. 
-
-# Prerequisites
-
-Working knowledge in the following topics:
-
-- Containers
-  - https://www.youtube.com/watch?v=SnSH8Ht3MIc
-  - https://www.mankier.com/5/Containerfile
-- bootc
-  - https://containers.github.io/bootc/
-- Fedora Silverblue (and other Fedora Atomic variants)
-  - https://docs.fedoraproject.org/en-US/fedora-silverblue/
-- Github Workflows
-  - https://docs.github.com/en/actions/using-workflows
-
-# How to Use
-
-## Template
-
-Select `Use this Template` and create a new repository from it. To enable the workflows, you may need to go the `Actions` tab of the new repository and click to enable workflows.
-
-## Containerfile
-
-The top line is the base image you want to start FROM. Any valid image can be a starting point, examples include:
-
-- `FROM ghcr.io/ublue-os/bazzite:latest`
-- `FROM ghcr.io/ublue-os/bluefin:stable`
-- `FROM ghcr.io/ublue-os/aurora-dx:stable`
-
-## "Empty" base images
-
-These contain a base system WITHOUT a pre-existing desktop. This is recommended for a more bottom up approach or if you want to to use a different desktop environment than is currently available:
-
-- `FROM ghcr.io/ublue-os/base-main:latest`
-
-Use `base-nvidia:latest` if you need the Nvidia drivers. You can also lock to a specific version like `base-nvidia:41`, etc.
-
-## Workflows
-
-### build.yml
-
-This workflow creates your custom OCI image and publishes it to the Github Container Registry (GHCR). By default, the image name will match the Github repository name.
-
-#### Container Signing
-
-Container signing is important for end-user security and is enabled on all Universal Blue images. It is recommended you set this up, and by default the image builds *will fail* if you don't.
-
-This provides users a method of verifying the image.
-
-1. Install the [cosign CLI tool](https://edu.chainguard.dev/open-source/sigstore/cosign/how-to-install-cosign/#installing-cosign-with-the-cosign-binary)
-
-2. Run inside your repo folder:
-
-    ```bash
-    cosign generate-key-pair
-    ```
-
-    
-    - Do NOT put in a password when it asks you to, just press enter. The signing key will be used in GitHub Actions and will not work if it is encrypted.
-
-> [!WARNING]
-> Be careful to *never* accidentally commit `cosign.key` into your git repo.
-
-3. Add the private key to GitHub
-
-    - This can also be done manually. Go to your repository settings, under Secrets and Variables -> Actions
-    ![image](https://user-images.githubusercontent.com/1264109/216735595-0ecf1b66-b9ee-439e-87d7-c8cc43c2110a.png)
-    Add a new secret and name it `SIGNING_SECRET`, then paste the contents of `cosign.key` into the secret and save it. Make sure it's the .key file and not the .pub file. Once done, it should look like this:
-    ![image](https://user-images.githubusercontent.com/1264109/216735690-2d19271f-cee2-45ac-a039-23e6a4c16b34.png)
-
-    - (CLI instructions) If you have the `github-cli` installed, run:
-
-    ```bash
-    gh secret set SIGNING_SECRET < cosign.key
-    ```
-
-4. Commit the `cosign.pub` file into your git repository
-
-### Examples
-- [m2os](https://github.com/m2giles/m2os)
-- [bos](https://github.com/bsherman/bos)
-- [homer](https://github.com/bketelsen/homer/)
diff --git a/files/system/common/usr/.gitkeep b/variants/bazzite/.gitkeep
similarity index 100%
rename from files/system/common/usr/.gitkeep
rename to variants/bazzite/.gitkeep
diff --git a/variants/bluefin/.gitignore b/variants/bluefin/.gitignore
new file mode 100644
index 0000000..3f2f542
--- /dev/null
+++ b/variants/bluefin/.gitignore
@@ -0,0 +1,11 @@
+*.iso
+*.iso-CHECKSUM
+flatpaks_with_deps
+flatpak.*
+
+*_build
+*_build.*
+previous.manifest.json
+changelog.md
+output.env
+version.txt
diff --git a/variants/bluefin/Containerfile b/variants/bluefin/Containerfile
new file mode 100644
index 0000000..ada49d4
--- /dev/null
+++ b/variants/bluefin/Containerfile
@@ -0,0 +1,36 @@
+ARG BASE_VERSION="41"
+ARG BASE_IMAGE="ghcr.io/ublue-os/bluefin"
+ARG DX_BASE_IMAGE="ghcr.io/ublue-os/bluefin-dx"
+
+FROM scratch AS ctx
+COPY / /
+
+## base image section
+FROM ${BASE_IMAGE}:${BASE_VERSION} AS base
+
+ARG BASE_IMAGE_NAME="silverblue"
+ARG IMAGE_NAME="beardy-bluefin"
+ARG IMAGE_VENDOR="detiber"
+ARG SHA_HEAD_SHORT="dedbeef"
+ARG UBLUE_IMAGE_TAG="stable"
+ARG FEDORA_MAJOR_VERSION="41"
+
+# Build, cleanup, commit.
+RUN --mount=type=cache,dst=/var/cache/rpm-ostree \
+    --mount=type=bind,from=ctx,source=/,target=/ctx \
+    /ctx/build_files/shared/build-base.sh
+
+## dx section
+FROM ${DX_BASE_IMAGE}:${BASE_VERSION} AS dx
+
+ARG BASE_IMAGE_NAME="silverblue"
+ARG IMAGE_NAME="beardy-bluefin-dx"
+ARG IMAGE_VENDOR="detiber"
+ARG SHA_HEAD_SHORT="dedbeef"
+ARG UBLUE_IMAGE_TAG="stable"
+ARG FEDORA_MAJOR_VERSION="41"
+
+# Build, Clean-up, Commit
+RUN --mount=type=cache,dst=/var/cache/rpm-ostree \
+    --mount=type=bind,from=ctx,source=/,target=/ctx \
+    /ctx/build_files/shared/build-dx.sh
diff --git a/files/scripts/fix-copr-repos.sh b/variants/bluefin/beardy_flatpaks/flatpaks
similarity index 100%
rename from files/scripts/fix-copr-repos.sh
rename to variants/bluefin/beardy_flatpaks/flatpaks
diff --git a/variants/bluefin/boot_menu.yml b/variants/bluefin/boot_menu.yml
new file mode 100644
index 0000000..234765a
--- /dev/null
+++ b/variants/bluefin/boot_menu.yml
@@ -0,0 +1,6 @@
+ublue_variants:
+  - label: detiber/beardy-bluefin
+    ks: /kickstart/beardy-os.ks
+    flavors:
+      - label: bluefin
+        info: Bluefin
diff --git a/modules/.gitkeep b/variants/bluefin/build_files/base/.gitkeep
similarity index 100%
rename from modules/.gitkeep
rename to variants/bluefin/build_files/base/.gitkeep
diff --git a/variants/bluefin/build_files/base/00-image-info.sh b/variants/bluefin/build_files/base/00-image-info.sh
new file mode 100755
index 0000000..94e242d
--- /dev/null
+++ b/variants/bluefin/build_files/base/00-image-info.sh
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+
+set -ouex pipefail
+
+IMAGE_PRETTY_NAME="Beardy OS (Bluefin)"
+IMAGE_LIKE="fedora"
+HOME_URL="https://github.com/detiber/beardy-os"
+DOCUMENTATION_URL="https://github.com/detiber/beardy-os"
+SUPPORT_URL="https://github.com/detiber/beardy-os/issues/"
+BUG_SUPPORT_URL="https://github.com/detiber/beardy-os/issues/"
+CODE_NAME="BlueBeard"
+
+IMAGE_INFO="/usr/share/ublue-os/image-info.json"
+IMAGE_REF="ostree-image-signed:docker://ghcr.io/$IMAGE_VENDOR/$IMAGE_NAME"
+
+# Image Flavor
+image_flavor="main"
+if [[ "${IMAGE_NAME}" =~ nvidia ]]; then
+  image_flavor="nvidia"
+fi
+
+cat > $IMAGE_INFO <<EOF
+{
+  "image-name": "$IMAGE_NAME",
+  "image-flavor": "$image_flavor",
+  "image-vendor": "$IMAGE_VENDOR",
+  "image-ref": "$IMAGE_REF",
+  "image-tag":"$UBLUE_IMAGE_TAG",
+  "base-image-name": "$BASE_IMAGE_NAME",
+  "fedora-version": "$FEDORA_MAJOR_VERSION"
+}
+EOF
+
+# OS Release File
+sed -i "s/^VARIANT_ID=.*/VARIANT_ID=$IMAGE_NAME/" /usr/lib/os-release
+sed -i "s/^PRETTY_NAME=.*/PRETTY_NAME=\"${IMAGE_PRETTY_NAME} $FEDORA_MAJOR_VERSION (FROM Fedora ${BASE_IMAGE_NAME^})\"/" /usr/lib/os-release
+sed -i "s/^NAME=.*/NAME=\"$IMAGE_PRETTY_NAME\"/" /usr/lib/os-release
+sed -i "s|^HOME_URL=.*|HOME_URL=\"$HOME_URL\"|" /usr/lib/os-release
+sed -i "s|^DOCUMENTATION_URL=.*|DOCUMENTATION_URL=\"$DOCUMENTATION_URL\"|" /usr/lib/os-release
+sed -i "s|^SUPPORT_URL=.*|SUPPORT_URL=\"$SUPPORT_URL\"|" /usr/lib/os-release
+sed -i "s|^BUG_REPORT_URL=.*|BUG_REPORT_URL=\"$BUG_SUPPORT_URL\"|" /usr/lib/os-release
+sed -i "s|^CPE_NAME=\"cpe:/o:fedoraproject:fedora|CPE_NAME=\"cpe:/o:universal-blue:${IMAGE_PRETTY_NAME,}|" /usr/lib/os-release
+sed -i "s/^DEFAULT_HOSTNAME=.*/DEFAULT_HOSTNAME=\"${IMAGE_PRETTY_NAME,}\"/" /usr/lib/os-release
+sed -i "s/^ID=fedora/ID=${IMAGE_PRETTY_NAME,}\nID_LIKE=\"${IMAGE_LIKE}\"/" /usr/lib/os-release
+sed -i "/^REDHAT_BUGZILLA_PRODUCT=/d; /^REDHAT_BUGZILLA_PRODUCT_VERSION=/d; /^REDHAT_SUPPORT_PRODUCT=/d; /^REDHAT_SUPPORT_PRODUCT_VERSION=/d" /usr/lib/os-release
+sed -i "s|^VERSION_CODENAME=.*|VERSION_CODENAME=\"$CODE_NAME\"|" /usr/lib/os-release
+
+if [[ -n "${SHA_HEAD_SHORT:-}" ]]; then
+  echo "BUILD_ID=\"$SHA_HEAD_SHORT\"" >> /usr/lib/os-release
+fi
+
+# Fix issues caused by ID no longer being fedora
+sed -i "s/^EFIDIR=.*/EFIDIR=\"fedora\"/" /usr/sbin/grub2-switch-to-blscfg
diff --git a/variants/bluefin/build_files/base/04-packages.sh b/variants/bluefin/build_files/base/04-packages.sh
new file mode 100755
index 0000000..6c453e3
--- /dev/null
+++ b/variants/bluefin/build_files/base/04-packages.sh
@@ -0,0 +1,51 @@
+#!/usr/bin/bash
+
+set -ouex pipefail
+
+# build list of all packages requested for inclusion
+INCLUDED_PACKAGES=($(jq -r "[(.all.include | (select(.all != null).all)[]), \
+                    (.all.include | (select(.\"$BASE_IMAGE_NAME\" != null).\"$BASE_IMAGE_NAME\")[]), \
+                    (select(.\"$FEDORA_MAJOR_VERSION\" != null).\"$FEDORA_MAJOR_VERSION\".include | (select(.all != null).all)[]), \
+                    (select(.\"$FEDORA_MAJOR_VERSION\" != null).\"$FEDORA_MAJOR_VERSION\".include | (select(.\"$BASE_IMAGE_NAME\" != null).\"$BASE_IMAGE_NAME\")[])] \
+                    | sort | unique[]" /tmp/packages.json))
+
+# build list of all packages requested for exclusion
+EXCLUDED_PACKAGES=($(jq -r "[(.all.exclude | (select(.all != null).all)[]), \
+                    (.all.exclude | (select(.\"$BASE_IMAGE_NAME\" != null).\"$BASE_IMAGE_NAME\")[]), \
+                    (select(.\"$FEDORA_MAJOR_VERSION\" != null).\"$FEDORA_MAJOR_VERSION\".exclude | (select(.all != null).all)[]), \
+                    (select(.\"$FEDORA_MAJOR_VERSION\" != null).\"$FEDORA_MAJOR_VERSION\".exclude | (select(.\"$BASE_IMAGE_NAME\" != null).\"$BASE_IMAGE_NAME\")[])] \
+                    | sort | unique[]" /tmp/packages.json))
+
+# store a list of RPMs installed on the image
+INSTALLED_EXCLUDED_PACKAGES=()
+
+# ensure exclusion list only contains packages already present on image
+if [[ "${#EXCLUDED_PACKAGES[@]}" -gt 0 ]]; then
+    INSTALLED_EXCLUDED_PACKAGES=($(rpm -qa --queryformat='%{NAME} ' ${EXCLUDED_PACKAGES[@]}))
+fi
+
+# simple case to install where no packages need excluding
+if [[ "${#INCLUDED_PACKAGES[@]}" -gt 0 && "${#INSTALLED_EXCLUDED_PACKAGES[@]}" -eq 0 ]]; then
+    rpm-ostree install \
+        ${INCLUDED_PACKAGES[@]}
+
+# install/excluded packages both at same time
+elif [[ "${#INCLUDED_PACKAGES[@]}" -gt 0 && "${#INSTALLED_EXCLUDED_PACKAGES[@]}" -gt 0 ]]; then
+    rpm-ostree override remove \
+        ${INSTALLED_EXCLUDED_PACKAGES[@]} \
+        $(printf -- "--install=%s " ${INCLUDED_PACKAGES[@]})
+else
+    echo "No packages to install."
+fi
+
+# check if any excluded packages are still present
+# (this can happen if an included package pulls in a dependency)
+if [[ "${#EXCLUDED_PACKAGES[@]}" -gt 0 ]]; then
+    INSTALLED_EXCLUDED_PACKAGES=($(rpm -qa --queryformat='%{NAME} ' ${EXCLUDED_PACKAGES[@]}))
+fi
+
+# remove any excluded packages which are still present on image
+if [[ "${#INSTALLED_EXCLUDED_PACKAGES[@]}" -gt 0 ]]; then
+    rpm-ostree override remove \
+        ${INSTALLED_EXCLUDED_PACKAGES[@]}
+fi
diff --git a/variants/bluefin/build_files/dx/03-packages-dx.sh b/variants/bluefin/build_files/dx/03-packages-dx.sh
new file mode 100755
index 0000000..7850d48
--- /dev/null
+++ b/variants/bluefin/build_files/dx/03-packages-dx.sh
@@ -0,0 +1,55 @@
+#!/usr/bin/bash
+
+set -ouex pipefail
+
+# build list of all packages requested for inclusion
+INCLUDED_PACKAGES=($(jq -r "[(.all.include | (select(.all != null).all)[]), \
+                    (.all.include | (select(.\"$BASE_IMAGE_NAME\" != null).\"$BASE_IMAGE_NAME\")[]), \
+                    (.all.include | (select(.dx != null).dx)[]), \
+                    (select(.\"$FEDORA_MAJOR_VERSION\" != null).\"$FEDORA_MAJOR_VERSION\".include | (select(.all != null).all)[]), \
+                    (select(.\"$FEDORA_MAJOR_VERSION\" != null).\"$FEDORA_MAJOR_VERSION\".include | (select(.\"$BASE_IMAGE_NAME\" != null).\"$BASE_IMAGE_NAME\")[]),
+                    (select(.\"$FEDORA_MAJOR_VERSION\" != null).\"$FEDORA_MAJOR_VERSION\".include | (select(.dx != null).dx)[])] \
+                    | sort | unique[]" /tmp/packages.json))
+
+# build list of all packages requested for exclusion
+EXCLUDED_PACKAGES=($(jq -r "[(.all.exclude | (select(.all != null).all)[]), \
+                    (.all.exclude | (select(.\"$BASE_IMAGE_NAME\" != null).\"$BASE_IMAGE_NAME\")[]), \
+                    (.all.exclude | (select(.dx != null).dx)[]), \
+                    (select(.\"$FEDORA_MAJOR_VERSION\" != null).\"$FEDORA_MAJOR_VERSION\".exclude | (select(.all != null).all)[]), \
+                    (select(.\"$FEDORA_MAJOR_VERSION\" != null).\"$FEDORA_MAJOR_VERSION\".exclude | (select(.\"$BASE_IMAGE_NAME\" != null).\"$BASE_IMAGE_NAME\")[]),
+                    (select(.\"$FEDORA_MAJOR_VERSION\" != null).\"$FEDORA_MAJOR_VERSION\".exclude | (select(.dx != null).dx)[])] \
+                    | sort | unique[]" /tmp/packages.json))
+
+# store a list of RPMs installed on the image
+INSTALLED_EXCLUDED_PACKAGES=()
+
+# ensure exclusion list only contains packages already present on image
+if [[ "${#EXCLUDED_PACKAGES[@]}" -gt 0 ]]; then
+    INSTALLED_EXCLUDED_PACKAGES=($(rpm -qa --queryformat='%{NAME} ' ${EXCLUDED_PACKAGES[@]}))
+fi
+
+# simple case to install where no packages need excluding
+if [[ "${#INCLUDED_PACKAGES[@]}" -gt 0 && "${#INSTALLED_EXCLUDED_PACKAGES[@]}" -eq 0 ]]; then
+    rpm-ostree install \
+        ${INCLUDED_PACKAGES[@]}
+
+# install/excluded packages both at same time
+elif [[ "${#INCLUDED_PACKAGES[@]}" -gt 0 && "${#INSTALLED_EXCLUDED_PACKAGES[@]}" -gt 0 ]]; then
+    rpm-ostree override remove \
+        ${INSTALLED_EXCLUDED_PACKAGES[@]} \
+        $(printf -- "--install=%s " ${INCLUDED_PACKAGES[@]})
+else
+    echo "No packages to install."
+fi
+
+# check if any excluded packages are still present
+# (this can happen if an included package pulls in a dependency)
+if [[ "${#EXCLUDED_PACKAGES[@]}" -gt 0 ]]; then
+    INSTALLED_EXCLUDED_PACKAGES=($(rpm -qa --queryformat='%{NAME} ' ${EXCLUDED_PACKAGES[@]}))
+fi
+
+# remove any excluded packages which are still present on image
+if [[ "${#INSTALLED_EXCLUDED_PACKAGES[@]}" -gt 0 ]]; then
+    rpm-ostree override remove \
+        ${INSTALLED_EXCLUDED_PACKAGES[@]}
+fi
diff --git a/variants/bluefin/build_files/shared/build-base.sh b/variants/bluefin/build_files/shared/build-base.sh
new file mode 100755
index 0000000..1a17fd0
--- /dev/null
+++ b/variants/bluefin/build_files/shared/build-base.sh
@@ -0,0 +1,66 @@
+#!/usr/bin/bash
+
+set -eoux pipefail
+
+# Make Alternatives Directory
+mkdir -p /var/lib/alternatives
+
+# Copy Files to Container
+cp -r /ctx/just /tmp/just
+cp /ctx/packages.json /tmp/packages.json
+# cp /ctx/system_files/shared/etc/ublue-update/ublue-update.toml /tmp/ublue-update.toml
+rsync -rvK /ctx/system_files/shared/ /
+rsync -rvK /ctx/system_files/"${BASE_IMAGE_NAME}"/ /
+
+# Generate image-info.json
+/ctx/build_files/base/00-image-info.sh
+
+# # Build Fix - Fix known skew offenders
+# /ctx/build_files/base/01-build-fix.sh
+
+# # Get COPR Repos
+# /ctx/build_files/base/02-install-copr-repos.sh
+
+# # Install Kernel and Akmods
+# /ctx/build_files/base/03-install-kernel-akmods.sh
+
+# Install Additional Packages
+/ctx/build_files/base/04-packages.sh
+
+# # Install Overrides and Fetch Install
+# /ctx/build_files/base/05-override-install.sh
+
+# # Base Image Changes
+# /ctx/build_files/base/07-base-image-changes.sh
+
+# # Get Firmare for Framework
+# /ctx/build_files/base/08-firmware.sh
+
+# # Make HWE changes
+# /ctx/build_files/base/09-hwe-additions.sh
+
+# # Install Brew
+# /ctx/build_files/base/10-brew.sh
+
+
+## late stage changes
+
+# # Make sure Bootc works
+# /ctx/build_files/base/16-bootc.sh
+
+# # Systemd and Remove Items
+# /ctx/build_files/base/17-cleanup.sh
+
+# # Run workarounds for lf (Likely not needed)
+# /ctx/build_files/base/18-workarounds.sh
+
+# # Regenerate initramfs
+# /ctx/build_files/base/19-initramfs.sh
+
+# Clean Up
+mv /var/lib/alternatives /staged-alternatives
+/ctx/build_files/shared/clean-stage.sh
+mkdir -p /var/lib && mv /staged-alternatives /var/lib/alternatives && \
+mkdir -p /var/tmp && \
+chmod -R 1777 /var/tmp
+ostree container commit
diff --git a/variants/bluefin/build_files/shared/build-dx.sh b/variants/bluefin/build_files/shared/build-dx.sh
new file mode 100755
index 0000000..7eda0a4
--- /dev/null
+++ b/variants/bluefin/build_files/shared/build-dx.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/bash
+
+set -eoux pipefail
+
+# Make Alternatives Directory
+mkdir -p /var/lib/alternatives
+
+# Copy Files to Image
+cp /ctx/packages.json /tmp/packages.json
+rsync -rvK /ctx/system_files/dx/ /
+
+# Apply IP Forwarding before installing Docker to prevent messing with LXC networking
+sysctl -p
+
+# Generate image-info.json (Not Needed?)
+# /ctx/build_files/shared/image-info.sh
+
+# # COPR Repos
+# /ctx/build_files/dx/01-install-copr-repos-dx.sh
+
+# # Install AKMODS
+# /ctx/build_files/dx/02-install-kernel-akmods-dx.sh
+
+# Install Packages
+/ctx/build_files/dx/03-packages-dx.sh
+
+# # Fetch Install
+# /ctx/build_files/dx/04-override-install-dx.sh
+
+# Branding Changes
+sed -i '/^PRETTY_NAME/s/Bluefin/Bluefin-dx/' /usr/lib/os-release
+
+# # Systemd and Disable Repos
+# /ctx/build_files/dx/09-cleanup-dx.sh
+
+# Clean Up
+mv /var/lib/alternatives /staged-alternatives
+/ctx/build_files/shared/clean-stage.sh
+mkdir -p /var/lib && mv /staged-alternatives /var/lib/alternatives && \
+mkdir -p /var/tmp && \
+chmod -R 1777 /var/tmp
+ostree container commit
diff --git a/variants/bluefin/build_files/shared/clean-stage.sh b/variants/bluefin/build_files/shared/clean-stage.sh
new file mode 100755
index 0000000..064dd0b
--- /dev/null
+++ b/variants/bluefin/build_files/shared/clean-stage.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/bash
+
+set -eoux pipefail
+shopt -s extglob
+
+rm -rf /tmp/* || true
+rm -rf /var/!(cache)
+rm -rf /var/cache/!(rpm-ostree)
diff --git a/variants/bluefin/dx_flatpaks/flatpaks b/variants/bluefin/dx_flatpaks/flatpaks
new file mode 100644
index 0000000..e69de29
diff --git a/variants/bluefin/just/beardy-apps.just b/variants/bluefin/just/beardy-apps.just
new file mode 100644
index 0000000..e69de29
diff --git a/variants/bluefin/just/beardy-system.just b/variants/bluefin/just/beardy-system.just
new file mode 100644
index 0000000..e69de29
diff --git a/variants/bluefin/justfile b/variants/bluefin/justfile
new file mode 100644
index 0000000..c0a8dc5
--- /dev/null
+++ b/variants/bluefin/justfile
@@ -0,0 +1,812 @@
+# Blatently stolen and modified from https://github.com/ublue-os/bluefin/blob/main/Justfile
+
+import '../../just/common.just'
+
+repo_organization := "detiber"
+rechunker_image := "ghcr.io/hhd-dev/rechunk:v1.0.1"
+iso_builder_image := "ghcr.io/jasonn3/build-container-installer:v1.2.3"
+images := '(
+    [beardy-bluefin]=beardy-bluefin
+    [beardy-bluefin-dx]=beardy-bluefin-dx
+)'
+flavors := '(
+    [main]=main
+    [nvidia]=nvidia
+    [hwe]=hwe
+    [hwe-nvidia]=hwe-nvidia
+    [asus]=asus
+    [asus-nvidia]=asus-nvidia
+    [surface]=surface
+    [surface-nvidia]=surface-nvidia
+)'
+tags := '(
+    [stable]=stable
+    [latest]=latest
+)'
+
+[private]
+default:
+    @just --list
+
+# Clean Repo
+[group('Utility')]
+clean:
+    #!/usr/bin/bash
+    set -eoux pipefail
+    touch _build
+    find *_build* -exec rm -rf {} \;
+    rm -f previous.manifest.json
+    rm -f changelog.md
+    rm -f output.env
+
+# Sudo Clean Repo
+[group('Utility')]
+[private]
+sudo-clean:
+    just sudoif just clean
+
+# Check if valid combo
+[group('Utility')]
+[private]
+validate image="" tag="" flavor="":
+    #!/usr/bin/bash
+    set -eou pipefail
+    declare -A images={{ images }}
+    declare -A tags={{ tags }}
+    declare -A flavors={{ flavors }}
+
+    image={{ image }}
+    tag={{ tag }}
+    flavor={{ flavor }}
+
+    # Handle Stable Daily
+    if [[ "${tag}" == "stable-daily" ]]; then
+        tag="stable"
+    fi
+
+    checkimage="${images[${image}]-}"
+    checktag="${tags[${tag}]-}"
+    checkflavor="${flavors[${flavor}]-}"
+
+    # Validity Checks
+    if [[ -z "$checkimage" ]]; then
+        echo "Invalid Image..."
+        exit 1
+    fi
+    if [[ -z "$checktag" ]]; then
+        echo "Invalid tag..."
+        exit 1
+    fi
+    if [[ -z "$checkflavor" ]]; then
+        echo "Invalid flavor..."
+        exit 1
+    fi
+    if [[ ! "$checktag" =~ latest && "$checkflavor" =~ hwe|asus|surface ]]; then
+        echo "HWE images are only built on latest..."
+        exit 1
+    fi
+
+# Build Image
+[group('Image')]
+build image="beardy-bluefin" tag="latest" flavor="main" rechunk="0" ghcr="0" pipeline="0" kernel_pin="":
+    #!/usr/bin/bash
+    set -eoux pipefail
+    image={{ image }}
+    tag={{ tag }}
+    flavor={{ flavor }}
+
+    # Validate
+    just validate "${image}" "${tag}" "${flavor}"
+
+    # Image Name
+    image_name=$(just image_name {{ image }} {{ tag }} {{ flavor }})
+
+    # Base Image
+    base_image_name="bluefin"
+
+    # Target
+    if [[ "${image}" =~ dx ]]; then
+        target="dx"
+    else
+        target="base"
+    fi
+
+    # AKMODS Flavor and Kernel Version
+    # if [[ "${flavor}" =~ hwe ]]; then
+    #     akmods_flavor="bazzite"
+    # elif [[ "${tag}" =~ stable|gts ]]; then
+    #     akmods_flavor="coreos-stable"
+    # elif [[ "${tag}" =~ beta ]]; then
+    #     akmods_flavor="coreos-testing"
+    # else
+    akmods_flavor="main"
+    # fi
+
+    # Fedora Version
+    if [[ {{ ghcr }} == "0" ]]; then
+        rm -f /tmp/manifest.json
+    fi
+    fedora_version=$(just fedora_version '{{ image }}' '{{ tag }}' '{{ flavor }}' '{{ kernel_pin }}')
+
+    # Verify Base Image with cosign
+    just verify-container "${base_image_name}:${fedora_version}"
+
+    # Kernel Release/Pin
+    # kernel_pin="{{ kernel_pin }}"
+    # if [[ -z "${kernel_pin:-}" ]]; then
+    #     kernel_release=$(skopeo inspect --retry-times 3 docker://ghcr.io/ublue-os/${akmods_flavor}-kernel:"${fedora_version}" | jq -r '.Labels["ostree.linux"]')
+    # else
+    #     kernel_release="${kernel_pin}"
+    # fi
+
+    # # Verify Containers with Cosign
+    # just verify-container "${akmods_flavor}-kernel:${kernel_release}"
+    # just verify-container "akmods:${akmods_flavor}-${fedora_version}-${kernel_release}"
+    # if [[ "${akmods_flavor}" =~ coreos ]]; then
+    #     just verify-container "akmods-zfs:${akmods_flavor}-${fedora_version}-${kernel_release}"
+    # fi
+    # if [[ "${flavor}" =~ nvidia ]]; then
+    #     just verify-container "akmods-nvidia:${akmods_flavor}-${fedora_version}-${kernel_release}"
+    # fi
+
+    # Get Version
+    if [[ "${tag}" =~ stable ]]; then
+        ver="${fedora_version}.$(date +%Y%m%d)"
+    else
+        ver="${tag}-${fedora_version}.$(date +%Y%m%d)"
+    fi
+
+    # Build Arguments
+    BUILD_ARGS=()
+    # BUILD_ARGS+=("--build-arg" "AKMODS_FLAVOR=${akmods_flavor}")
+    BUILD_ARGS+=("--build-arg" "BASE_IMAGE_NAME=${base_image_name}")
+    BUILD_ARGS+=("--build-arg" "FEDORA_MAJOR_VERSION=${fedora_version}")
+    BUILD_ARGS+=("--build-arg" "IMAGE_NAME=${image_name}")
+    BUILD_ARGS+=("--build-arg" "IMAGE_VENDOR={{ repo_organization }}")
+    # BUILD_ARGS+=("--build-arg" "KERNEL=${kernel_release}")
+    if [[ -z "$(git status -s)" ]]; then
+        BUILD_ARGS+=("--build-arg" "SHA_HEAD_SHORT=$(git rev-parse --short HEAD)")
+    fi
+    BUILD_ARGS+=("--build-arg" "UBLUE_IMAGE_TAG=${tag}")
+
+    # Labels
+    LABELS=()
+    LABELS+=("--label" "org.opencontainers.image.title=${image_name}")
+    LABELS+=("--label" "org.opencontainers.image.version=${ver}")
+    # LABELS+=("--label" "ostree.linux=${kernel_release}")
+    LABELS+=("--label" "io.artifacthub.package.readme-url=https://raw.githubusercontent.com/detiber/beardy-os/main/README.md")
+    LABELS+=("--label" "io.artifacthub.package.logo-url=https://avatars.githubusercontent.com/u/120078124?s=200&v=4")
+    LABELS+=("--label" "org.opencontainers.image.description=The preferred Bluefin-based OS of bearded developers")
+
+    # Build Image
+    podman build \
+        "${BUILD_ARGS[@]}" \
+        "${LABELS[@]}" \
+        --target "${target}" \
+        --tag "${image_name}:${tag}" \
+        .
+
+    # Rechunk
+    if [[ "{{ rechunk }}" == "1" && "{{ ghcr }}" == "1" && "{{ pipeline }}" == "1" ]]; then
+        just rechunk "${image}" "${tag}" "${flavor}" 1 1
+    elif [[ "{{ rechunk }}" == "1" && "{{ ghcr }}" == "1" ]]; then
+        just rechunk "${image}" "${tag}" "${flavor}" 1
+    elif [[ "{{ rechunk }}" == "1" ]]; then
+        just rechunk "${image}" "${tag}" "${flavor}"
+    fi
+
+# Build Image and Rechunk
+[group('Image')]
+build-rechunk image="beardy-bluefin" tag="latest" flavor="main" kernel_pin="":
+    @just build {{ image }} {{ tag }} {{ flavor }} 1 0 0 {{ kernel_pin }}
+
+# Build Image with GHCR Flag
+[group('Image')]
+build-ghcr image="beardy-bluefin" tag="latest" flavor="main" kernel_pin="":
+    #!/usr/bin/bash
+    if [[ "${UID}" -gt "0" ]]; then
+        echo "Must Run with sudo or as root..."
+        exit 1
+    fi
+    just build {{ image }} {{ tag }} {{ flavor }} 0 1 0 {{ kernel_pin }}
+
+# Build Image for Pipeline:
+[group('Image')]
+build-pipeline image="beardy-bluefin" tag="latest" flavor="main" kernel_pin="":
+    #!/usr/bin/bash
+    if [[ "${UID}" -gt "0" ]]; then
+        echo "Must Run with sudo or as root..."
+        exit 1
+    fi
+    just build {{ image }} {{ tag }} {{ flavor }} 1 1 1 {{ kernel_pin }}
+
+# Rechunk Image
+[group('Image')]
+[private]
+rechunk image="beardy-bluefin" tag="latest" flavor="main" ghcr="0" pipeline="0":
+    #!/usr/bin/bash
+    set -eoux pipefail
+
+    image={{ image }}
+    tag={{ tag }}
+    flavor={{ flavor }}
+
+    # Validate
+    just validate "${image}" "${tag}" "${flavor}"
+
+    # Image Name
+    image_name=$(just image_name {{ image }} {{ tag }} {{ flavor }})
+
+    # Check if image is already built
+    ID=$(podman images --filter reference=localhost/"${image_name}":"${tag}" --format "'{{ '{{.ID}}' }}'")
+    if [[ -z "$ID" ]]; then
+        just build "${image}" "${tag}" "${flavor}"
+    fi
+
+    # Load into Rootful Podman
+    ID=$(just sudoif podman images --filter reference=localhost/"${image_name}":"${tag}" --format "'{{ '{{.ID}}' }}'")
+    if [[ -z "$ID" ]]; then
+        just sudoif podman image scp ${UID}@localhost::localhost/"${image_name}":"${tag}" root@localhost::localhost/"${image_name}":"${tag}"
+    fi
+
+    # Prep Container
+    CREF=$(just sudoif podman create localhost/"${image_name}":"${tag}" bash)
+    OLD_IMAGE=$(just sudoif podman inspect $CREF | jq -r '.[].Image')
+    OUT_NAME="${image_name}_build"
+    MOUNT=$(just sudoif podman mount "${CREF}")
+
+    # Fedora Version
+    fedora_version=$(just sudoif podman inspect $CREF | jq -r '.[].Config.Labels["ostree.linux"]' | grep -oP 'fc\K[0-9]+')
+
+    # Label Version
+    if [[ "{{ tag }}" =~ stable ]]; then
+        VERSION="${fedora_version}.$(date +%Y%m%d)"
+    else
+        VERSION="${tag}-${fedora_version}.$(date +%Y%m%d)"
+    fi
+
+    # Cleanup Space during Github Action
+    if [[ "{{ ghcr }}" == "1" ]]; then
+        base_image_name=bluefin
+        if [[ "${tag}" =~ stable ]]; then
+            tag="stable-daily"
+        fi
+        ID=$(just sudoif podman images --filter reference=ghcr.io/ublue-os/"${base_image_name}":${fedora_version} --format "'{{ '{{.ID}}' }}'")
+        if [[ -n "$ID" ]]; then
+            podman rmi "$ID"
+        fi
+    fi
+
+    # Rechunk Container
+    rechunker="{{ rechunker_image }}"
+
+    # Run Rechunker's Prune
+    just sudoif podman run --rm \
+        --pull=newer \
+        --security-opt label=disable \
+        --volume "$MOUNT":/var/tree \
+        --env TREE=/var/tree \
+        --user 0:0 \
+        "${rechunker}" \
+        /sources/rechunk/1_prune.sh
+
+    # Run Rechunker's Create
+    just sudoif podman run --rm \
+        --security-opt label=disable \
+        --volume "$MOUNT":/var/tree \
+        --volume "cache_ostree:/var/ostree" \
+        --env TREE=/var/tree \
+        --env REPO=/var/ostree/repo \
+        --env RESET_TIMESTAMP=1 \
+        --user 0:0 \
+        "${rechunker}" \
+        /sources/rechunk/2_create.sh
+
+    # Cleanup Temp Container Reference
+    just sudoif podman unmount "$CREF"
+    just sudoif podman rm "$CREF"
+    just sudoif podman rmi "$OLD_IMAGE"
+
+    SHA="dedbeef"
+    if [[ -z "$(git status -s)" ]]; then
+        SHA=$(git rev-parse HEAD)
+    fi
+    # Run Rechunker
+    just sudoif podman run --rm \
+        --pull=newer \
+        --security-opt label=disable \
+        --volume "$PWD:/workspace" \
+        --volume "$PWD:/var/git" \
+        --volume cache_ostree:/var/ostree \
+        --env REPO=/var/ostree/repo \
+        --env PREV_REF=ghcr.io/detiber/"${image_name}":"${tag}" \
+        --env OUT_NAME="$OUT_NAME" \
+        --env LABELS="org.opencontainers.image.title=${image_name}$'\n''io.artifacthub.package.readme-url=https://raw.githubusercontent.com/detiber/beardy-os/refs/heads/main/README.md'$'\n''io.artifacthub.package.logo-url=https://avatars.githubusercontent.com/u/120078124?s=200&v=4'$'\n'" \
+        --env "DESCRIPTION='The preferred bluefin-based OS of bearded developers'" \
+        --env "VERSION=${VERSION}" \
+        --env VERSION_FN=/workspace/version.txt \
+        --env OUT_REF="oci:$OUT_NAME" \
+        --env GIT_DIR="/var/git" \
+        --env REVISION="$SHA" \
+        --user 0:0 \
+        "${rechunker}" \
+        /sources/rechunk/3_chunk.sh
+
+    # Fix Permissions of OCI
+    if [[ "${UID}" -gt "0" ]]; then
+        just sudoif chown "${UID}:${GROUPS}" -R "${PWD}"
+    elif [[ -n "${SUDO_UID:-}" ]]; then
+        chown "${SUDO_UID}":"${SUDO_GID}" -R "${PWD}"
+    fi
+
+    # Remove cache_ostree
+    just sudoif podman volume rm cache_ostree
+
+    # Show OCI Labels
+    just sudoif skopeo inspect oci:"${PWD}"/"${OUT_NAME}" | jq -r '.Labels'
+
+    # Pipeline Checks
+    if [[ {{ pipeline }} == "1" && -n "${SUDO_USER:-}" ]]; then
+        sudo -u "${SUDO_USER}" just load-rechunk "${image}" "${tag}" "${flavor}"
+        sudo -u "${SUDO_USER}" just secureboot "${image}" "${tag}" "${flavor}"
+    fi
+
+# Load OCI into Podman Store
+[group('Image')]
+load-rechunk image="beardy-bluefin" tag="latest" flavor="main":
+    #!/usr/bin/bash
+    set -eou pipefail
+
+    # Validate
+    just validate {{ image }} {{ tag }} {{ flavor }}
+
+    # Image Name
+    image_name=$(just image_name {{ image }} {{ tag }} {{ flavor }})
+
+    # Load Image
+    OUT_NAME="${image_name}_build"
+    IMAGE=$(podman pull oci:"${PWD}"/"${OUT_NAME}")
+    podman tag ${IMAGE} localhost/"${image_name}":{{ tag }}
+
+    # Cleanup
+    just sudoif "rm -rf ${OUT_NAME}*"
+    just sudoif "rm -f previous.manifest.json"
+
+# Run Container
+[group('Image')]
+run image="beardy-bluefin" tag="latest" flavor="main":
+    #!/usr/bin/bash
+    set -eoux pipefail
+    image={{ image }}
+    tag={{ tag }}
+    flavor={{ flavor }}
+
+    # Validate
+    just validate "${image}" "${tag}" "${flavor}"
+
+    # Image Name
+    image_name=$(just image_name {{ image }} {{ tag }} {{ flavor }})
+
+    # Check if image exists
+    ID=$(podman images --filter reference=localhost/"${image_name}":"${tag}" --format "'{{ '{{.ID}}' }}'")
+    if [[ -z "$ID" ]]; then
+        just build "$image" "$tag" "$flavor"
+    fi
+
+    # Run Container
+    podman run -it --rm localhost/"${image_name}":"${tag}" bash
+
+# Build ISO
+[group('ISO')]
+build-iso image="beardy-bluefin" tag="latest" flavor="main" ghcr="0" pipeline="0":
+    #!/usr/bin/bash
+    set -eoux pipefail
+    image={{ image }}
+    tag={{ tag }}
+    flavor={{ flavor }}
+
+    # Validate
+    just validate "${image}" "${tag}" "${flavor}"
+
+    # Image Name
+    image_name=$(just image_name {{ image }} {{ tag }} {{ flavor }})
+
+    build_dir="${image_name}_build"
+    mkdir -p "$build_dir"
+
+    if [[ -f "${build_dir}/${image_name}-${tag}.iso" || -f "${build_dir}/${image_name}-${tag}.iso-CHECKSUM" ]]; then
+        echo "ERROR - ISO or Checksum already exist. Please mv or rm to build new ISO"
+        exit 1
+    fi
+
+    # Local or Github Build
+    if [[ "{{ ghcr }}" == "1" ]]; then
+        IMAGE_FULL=ghcr.io/detiber/"${image_name}":"${tag}"
+        IMAGE_REPO=ghcr.io/detiber
+        podman pull "${IMAGE_FULL}"
+    else
+        IMAGE_FULL=localhost/"${image_name}":"${tag}"
+        IMAGE_REPO=localhost
+        ID=$(podman images --filter reference=localhost/"${image_name}":"${tag}" --format "'{{ '{{.ID}}' }}'")
+        if [[ -z "$ID" ]]; then
+            just build "$image" "$tag" "$flavor"
+        fi
+    fi
+
+    # Fedora Version
+    FEDORA_VERSION=$(podman inspect ${IMAGE_FULL} | jq -r '.[]["Config"]["Labels"]["ostree.linux"]' | grep -oP 'fc\K[0-9]+')
+
+    # Load Image into rootful podman
+    if [[ "${UID}" -gt 0 && {{ ghcr }} == "0" ]]; then
+        just sudoif podman image scp "${UID}"@localhost::"${IMAGE_FULL}" root@localhost::"${IMAGE_FULL}"
+    fi
+
+    FLATPAK_DIR_SHORTNAME="beardy_flatpaks"
+
+    # Generate Flatpak List
+    TEMP_FLATPAK_INSTALL_DIR="$(mktemp -d -p /tmp flatpak-XXXXX)"
+    flatpak_refs=()
+    while IFS= read -r line; do
+        flatpak_refs+=("$line")
+    done < "${FLATPAK_DIR_SHORTNAME}/flatpaks"
+
+    # Add DX Flatpaks if needed
+    if [[ "${image_name}" =~ dx ]]; then
+        while IFS= read -r line; do
+            flatpak_refs+=("$line")
+        done < "dx_flatpaks/flatpaks"
+    fi
+
+    echo "Flatpak refs: ${flatpak_refs[@]}"
+
+    # Generate Install Script for Flatpaks
+    tee "${TEMP_FLATPAK_INSTALL_DIR}/install-flatpaks.sh"<<EOF
+    mkdir -p /flatpak/flatpak /flatpak/triggers
+    mkdir -p /var/tmp
+    chmod -R 1777 /var/tmp
+    flatpak config --system --set languages "*"
+    flatpak remote-add --system flathub https://flathub.org/repo/flathub.flatpakrepo
+    flatpak install --system -y flathub ${flatpak_refs[@]}
+    ostree refs --repo=\${FLATPAK_SYSTEM_DIR}/repo | grep '^deploy/' | grep -v 'org\.freedesktop\.Platform\.openh264' | sed 's/^deploy\///g' > /output/flatpaks-with-deps
+    EOF
+
+    # Create Flatpak List with dependencies
+    flatpak_list_args=()
+    flatpak_list_args+=("--rm" "--privileged")
+    flatpak_list_args+=("--entrypoint" "/usr/bin/bash")
+    flatpak_list_args+=("--env" "FLATPAK_SYSTEM_DIR=/flatpak/flatpak")
+    flatpak_list_args+=("--env" "FLATPAK_TRIGGERSDIR=/flatpak/triggers")
+    flatpak_list_args+=("--volume" "$(realpath ./${build_dir}):/output")
+    flatpak_list_args+=("--volume" "${TEMP_FLATPAK_INSTALL_DIR}:/temp_flatpak_install_dir")
+    flatpak_list_args+=("${IMAGE_FULL}" /temp_flatpak_install_dir/install-flatpaks.sh)
+
+    if [[ ! -f "${build_dir}/flatpaks-with-deps" ]]; then
+        podman run "${flatpak_list_args[@]}"
+    else
+        echo "WARNING - Reusing previous determined flatpaks-with-deps"
+    fi
+
+    if [[ "{{ pipeline }}" == "1" ]]; then
+    	podman rmi ${IMAGE_FULL}
+    fi
+
+    # List Flatpaks with Dependencies
+    cat "${build_dir}/flatpaks-with-deps"
+
+    # Build ISO
+    iso_build_args=()
+    iso_build_args+=("--rm" "--privileged" "--pull=newer")
+    if [[ "{{ ghcr }}" == "0" ]]; then
+    	iso_build_args+=(--volume "/var/lib/containers/storage:/var/lib/containers/storage")
+    fi
+    iso_build_args+=(--volume "${PWD}:/github/workspace/")
+    iso_build_args+=("{{ iso_builder_image }}")
+    iso_build_args+=(ARCH="x86_64")
+    iso_build_args+=(ENROLLMENT_PASSWORD="universalblue")
+    iso_build_args+=(FLATPAK_REMOTE_REFS_DIR="/github/workspace/${build_dir}")
+    iso_build_args+=(IMAGE_NAME="${image_name}")
+    iso_build_args+=(IMAGE_REPO="${IMAGE_REPO}")
+    iso_build_args+=(IMAGE_SIGNED="true")
+    if [[ "{{ ghcr }}" == "0" ]]; then
+    	iso_build_args+=(IMAGE_SRC="containers-storage:${IMAGE_FULL}")
+    fi
+    iso_build_args+=(IMAGE_TAG="${tag}")
+    iso_build_args+=(ISO_NAME="/github/workspace/${build_dir}/${image_name}-${tag}.iso")
+    iso_build_args+=(SECURE_BOOT_KEY_URL="https://github.com/ublue-os/akmods/raw/main/certs/public_key.der")
+    iso_build_args+=(VARIANT="Silverblue")
+    iso_build_args+=(VERSION="${FEDORA_VERSION}")
+    iso_build_args+=(WEB_UI="false")
+
+    just sudoif podman run "${iso_build_args[@]}"
+
+    if [[ "${UID}" -gt "0" ]]; then
+        just sudoif chown "${UID}:${GROUPS}" -R "${PWD}"
+    elif [[ -n "${SUDO_UID:-}" ]]; then
+        chown "${SUDO_UID}":"${SUDO_GID}" -R "${PWD}"
+    fi
+
+# Build ISO using GHCR Image
+[group('ISO')]
+build-iso-ghcr image="beardy-bluefin" tag="latest" flavor="main":
+    @just build-iso {{ image }} {{ tag }} {{ flavor }} 1
+
+# Run ISO
+[group('ISO')]
+run-iso image="beardy-bluefin" tag="latest" flavor="main":
+    #!/usr/bin/bash
+    set -eoux pipefail
+    image={{ image }}
+    tag={{ tag }}
+    flavor={{ flavor }}
+
+    # Validate
+    just validate "${image}" "${tag}" "${flavor}"
+
+    # Image Name
+    image_name=$(just image_name {{ image }} {{ tag }} {{ flavor }})
+
+    # Check if ISO Exists
+    if [[ ! -f "${image_name}_build/${image_name}-${tag}.iso" ]]; then
+        just build-iso "$image" "$tag" "$flavor"
+    fi
+
+    # Determine which port to use
+    port=8006;
+    while grep -q :${port} <<< $(ss -tunalp); do
+        port=$(( port + 1 ))
+    done
+    echo "Using Port: ${port}"
+    echo "Connect to http://localhost:${port}"
+    run_args=()
+    run_args+=(--rm --privileged)
+    run_args+=(--pull=newer)
+    run_args+=(--publish "127.0.0.1:${port}:8006")
+    run_args+=(--env "CPU_CORES=4")
+    run_args+=(--env "RAM_SIZE=8G")
+    run_args+=(--env "DISK_SIZE=64G")
+    run_args+=(--env "BOOT_MODE=windows_secure")
+    run_args+=(--env "TPM=Y")
+    run_args+=(--env "GPU=Y")
+    run_args+=(--device=/dev/kvm)
+    run_args+=(--volume "${PWD}/${image_name}_build/${image_name}-${tag}.iso":"/boot.iso")
+    run_args+=(docker.io/qemux/qemu-docker)
+    podman run "${run_args[@]}" &
+    xdg-open http://localhost:${port}
+    fg "%podman"
+
+## Disabled until there are changelogs
+# # Test Changelogs
+# [group('Changelogs')]
+# changelogs branch="stable" handwritten="":
+#     #!/usr/bin/bash
+#     set -eou pipefail
+#     python3 ./.github/changelogs.py "{{ branch }}" ./output.env ./changelog.md --workdir . --handwritten "{{ handwritten }}"
+
+# Verify Container with Cosign
+[group('Utility')]
+verify-container container="" registry="ghcr.io/ublue-os" key="":
+    #!/usr/bin/bash
+    set -eoux pipefail
+
+    # Get Cosign if Needed
+    if [[ ! $(command -v cosign) ]]; then
+        COSIGN_CONTAINER_ID=$(just sudoif podman create cgr.dev/chainguard/cosign:latest bash)
+        just sudoif podman cp "${COSIGN_CONTAINER_ID}":/usr/bin/cosign /usr/local/bin/cosign
+        just sudoif podman rm -f "${COSIGN_CONTAINER_ID}"
+    fi
+
+    # Verify Cosign Image Signatures if needed
+    if [[ -n "${COSIGN_CONTAINER_ID:-}" ]]; then
+        if ! cosign verify --certificate-oidc-issuer=https://token.actions.githubusercontent.com --certificate-identity=https://github.com/chainguard-images/images/.github/workflows/release.yaml@refs/heads/main cgr.dev/chainguard/cosign >/dev/null; then
+            echo "NOTICE: Failed to verify cosign image signatures."
+            exit 1
+        fi
+    fi
+
+    # Public Key for Container Verification
+    key={{ key }}
+    if [[ -z "${key:-}" ]]; then
+        key="https://raw.githubusercontent.com/ublue-os/main/main/cosign.pub"
+    fi
+
+    # Verify Container using cosign public key
+    if ! cosign verify --key "${key}" "{{ registry }}"/"{{ container }}" >/dev/null; then
+        echo "NOTICE: Verification failed. Please ensure your public key is correct."
+        exit 1
+    fi
+
+# Secureboot Check
+[group('Utility')]
+secureboot image="beardy-bluefin" tag="latest" flavor="main":
+    #!/usr/bin/bash
+    set -eoux pipefail
+    image={{ image }}
+    tag={{ tag }}
+    flavor={{ flavor }}
+
+    # Validate
+    just validate "${image}" "${tag}" "${flavor}"
+
+    # Image Name
+    image_name=$(just image_name ${image} ${tag} ${flavor})
+
+    # Get the vmlinuz to check
+    kernel_release=$(podman inspect "${image_name}":"${tag}" | jq -r '.[].Config.Labels["ostree.linux"]')
+    TMP=$(podman create "${image_name}":"${tag}" bash)
+    podman cp "$TMP":/usr/lib/modules/"${kernel_release}"/vmlinuz /tmp/vmlinuz
+    podman rm "$TMP"
+
+    # Get the Public Certificates
+    curl --retry 3 -Lo /tmp/kernel-sign.der https://github.com/ublue-os/kernel-cache/raw/main/certs/public_key.der
+    curl --retry 3 -Lo /tmp/akmods.der https://github.com/ublue-os/kernel-cache/raw/main/certs/public_key_2.der
+    openssl x509 -in /tmp/kernel-sign.der -out /tmp/kernel-sign.crt
+    openssl x509 -in /tmp/akmods.der -out /tmp/akmods.crt
+
+    # Make sure we have sbverify
+    CMD="$(command -v sbverify)"
+    if [[ -z "${CMD:-}" ]]; then
+        temp_name="sbverify-${RANDOM}"
+        podman run -dt \
+            --entrypoint /bin/sh \
+            --volume /tmp/vmlinuz:/tmp/vmlinuz:z \
+            --volume /tmp/kernel-sign.crt:/tmp/kernel-sign.crt:z \
+            --volume /tmp/akmods.crt:/tmp/akmods.crt:z \
+            --name ${temp_name} \
+            alpine:edge
+        podman exec ${temp_name} apk add sbsigntool
+        CMD="podman exec ${temp_name} /usr/bin/sbverify"
+    fi
+
+    # Confirm that Signatures Are Good
+    $CMD --list /tmp/vmlinuz
+    returncode=0
+    if ! $CMD --cert /tmp/kernel-sign.crt /tmp/vmlinuz || ! $CMD --cert /tmp/akmods.crt /tmp/vmlinuz; then
+        echo "Secureboot Signature Failed...."
+        returncode=1
+    fi
+    if [[ -n "${temp_name:-}" ]]; then
+        podman rm -f "${temp_name}"
+    fi
+    exit "$returncode"
+
+# Get Fedora Version of an image
+[group('Utility')]
+[private]
+fedora_version image="beardy-bluefin" tag="latest" flavor="main" $kernel_pin="":
+    #!/usr/bin/bash
+    set -eou pipefail
+    just validate {{ image }} {{ tag }} {{ flavor }}
+    if [[ ! -f /tmp/manifest.json ]]; then
+        if [[ "{{ tag }}" =~ stable ]]; then
+            # CoreOS does not uses cosign
+            skopeo inspect --retry-times 3 docker://quay.io/fedora/fedora-coreos:stable > /tmp/manifest.json
+        else
+            skopeo inspect --retry-times 3 docker://ghcr.io/ublue-os/base-main:"{{ tag }}" > /tmp/manifest.json
+        fi
+    fi
+    fedora_version=$(jq -r '.Labels["ostree.linux"]' < /tmp/manifest.json | grep -oP 'fc\K[0-9]+')
+    if [[ -n "${kernel_pin:-}" ]]; then
+        fedora_version=$(echo "${kernel_pin}" | grep -oP 'fc\K[0-9]+')
+    fi
+    echo "${fedora_version}"
+
+# Image Name
+[group('Utility')]
+[private]
+image_name image="beardy-bluefin" tag="latest" flavor="main":
+    #!/usr/bin/bash
+    set -eou pipefail
+    just validate {{ image }} {{ tag }} {{ flavor }}
+    if [[ "{{ flavor }}" =~ main ]]; then
+        image_name={{ image }}
+    else
+        image_name="{{ image }}-{{ flavor }}"
+    fi
+    echo "${image_name}"
+
+# Generate Tags
+[group('Utility')]
+generate-build-tags image="beardy-bluefin" tag="latest" flavor="main" kernel_pin="" ghcr="0" $version="" github_event="" github_number="":
+    #!/usr/bin/bash
+    set -eou pipefail
+
+    TODAY="$(date +%A)"
+    WEEKLY="Sunday"
+    if [[ {{ ghcr }} == "0" ]]; then
+        rm -f /tmp/manifest.json
+    fi
+    FEDORA_VERSION="$(just fedora_version '{{ image }}' '{{ tag }}' '{{ flavor }}' '{{ kernel_pin }}')"
+    DEFAULT_TAG=$(just generate-default-tag {{ tag }} {{ ghcr }})
+    IMAGE_NAME=$(just image_name {{ image }} {{ tag }} {{ flavor }})
+    # Use Build Version from Rechunk
+    if [[ -z "${version:-}" ]]; then
+        version="{{ tag }}-${FEDORA_VERSION}.$(date +%Y%m%d)"
+    fi
+    version=${version#{{ tag }}-}
+
+    # Arrays for Tags
+    BUILD_TAGS=()
+    COMMIT_TAGS=()
+
+    # Commit Tags
+    github_number="{{ github_number }}"
+    SHA_SHORT="$(git rev-parse --short HEAD)"
+    if [[ "{{ ghcr }}" == "1" ]]; then
+        COMMIT_TAGS+=(pr-${github_number:-}-{{ tag }}-${version})
+        COMMIT_TAGS+=(${SHA_SHORT}-{{ tag }}-${version})
+    fi
+
+    # Convenience Tags
+    if [[ "{{ tag }}" =~ stable ]]; then
+        BUILD_TAGS+=("stable-daily" "${version}" "stable-daily-${version}" "stable-daily-${version:3}")
+    else
+        BUILD_TAGS+=("{{ tag }}" "{{ tag }}-${version}" "{{ tag }}-${version:3}")
+    fi
+
+    # Weekly Stable / Rebuild Stable on workflow_dispatch
+    github_event="{{ github_event }}"
+    if [[ "{{ tag }}" =~ "stable" && "${WEEKLY}" == "${TODAY}" && "${github_event}" =~ schedule ]]; then
+        BUILD_TAGS+=("stable" "stable-${version}" "stable-${version:3}")
+    elif [[ "{{ tag }}" =~ "stable" && "${github_event}" =~ workflow_dispatch|workflow_call ]]; then
+        BUILD_TAGS+=("stable" "stable-${version}" "stable-${version:3}")
+    elif [[ "{{ tag }}" =~ "stable" && "{{ ghcr }}" == "0" ]]; then
+        BUILD_TAGS+=("stable" "stable-${version}" "stable-${version:3}")
+    elif [[ ! "{{ tag }}" =~ stable|beta ]]; then
+        BUILD_TAGS+=("${FEDORA_VERSION}" "${FEDORA_VERSION}-${version}" "${FEDORA_VERSION}-${version:3}")
+    fi
+
+    if [[ "${github_event}" == "pull_request" ]]; then
+        alias_tags=("${COMMIT_TAGS[@]}")
+    else
+        alias_tags=("${BUILD_TAGS[@]}")
+    fi
+
+    echo "${alias_tags[*]}"
+
+# Generate Default Tag
+[group('Utility')]
+generate-default-tag tag="latest" ghcr="0":
+    #!/usr/bin/bash
+    set -eou pipefail
+
+    # Default Tag
+    if [[ "{{ tag }}" =~ stable && "{{ ghcr }}" == "1" ]]; then
+        DEFAULT_TAG="stable-daily"
+    elif [[ "{{ tag }}" =~ stable && "{{ ghcr }}" == "0" ]]; then
+        DEFAULT_TAG="stable"
+    else
+        DEFAULT_TAG="{{ tag }}"
+    fi
+
+    echo "${DEFAULT_TAG}"
+
+# Tag Images
+[group('Utility')]
+tag-images image_name="" default_tag="" tags="":
+    #!/usr/bin/bash
+    set -eou pipefail
+
+    # Get Image, and untag
+    IMAGE=$(podman inspect localhost/{{ image_name }}:{{ default_tag }} | jq -r .[].Id)
+    podman untag localhost/{{ image_name }}:{{ default_tag }}
+
+    # Tag Image
+    for tag in {{ tags }}; do
+        podman tag $IMAGE {{ image_name }}:${tag}
+    done
+
+    # HWE Tagging
+    if [[ "{{ image_name }}" =~ hwe ]]; then
+
+        image_name="{{ image_name }}"
+        asus_name="${image_name/hwe/asus}"
+        surface_name="${image_name/hwe/surface}"
+
+        for tag in {{ tags }}; do
+            podman tag "${IMAGE}" "${asus_name}":${tag}
+            podman tag "${IMAGE}" "${surface_name}":${tag}
+        done
+    fi
+
+    # Show Images
+    podman images
diff --git a/variants/bluefin/packages.json b/variants/bluefin/packages.json
new file mode 100644
index 0000000..b3a5841
--- /dev/null
+++ b/variants/bluefin/packages.json
@@ -0,0 +1,37 @@
+{
+	"all": {
+		"include": {
+			"all": [],
+			"silverblue": [],
+			"dx": []
+		},
+		"exclude": {
+			"all": [],
+			"silverblue": [],
+			"dx": []
+		}
+	},
+	"40": {
+		"include": {
+			"all": [],
+			"silverblue": [],
+			"dx": []
+		},
+		"exclude": {
+			"all": [],
+			"silverblue": [],
+			"dx": []
+		}
+	},
+	"41": {
+		"include": {
+			"all": [],
+			"silverblue": []
+		},
+		"exclude": {
+			"all": [],
+			"silverblue": [],
+			"dx": []
+		}
+	}
+}
\ No newline at end of file
diff --git a/variants/bluefin/system_files/bluefin/.gitkeep b/variants/bluefin/system_files/bluefin/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/variants/bluefin/system_files/dx/.gitkeep b/variants/bluefin/system_files/dx/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/files/system/common/etc/distrobox/distrobox.conf b/variants/bluefin/system_files/shared/etc/distrobox/distrobox.conf
similarity index 100%
rename from files/system/common/etc/distrobox/distrobox.conf
rename to variants/bluefin/system_files/shared/etc/distrobox/distrobox.conf
diff --git a/files/system/common/etc/distrobox/distrobox.example b/variants/bluefin/system_files/shared/etc/distrobox/distrobox.example
similarity index 100%
rename from files/system/common/etc/distrobox/distrobox.example
rename to variants/bluefin/system_files/shared/etc/distrobox/distrobox.example
diff --git a/files/system/common/etc/distrobox/distrobox.ini b/variants/bluefin/system_files/shared/etc/distrobox/distrobox.ini
similarity index 100%
rename from files/system/common/etc/distrobox/distrobox.ini
rename to variants/bluefin/system_files/shared/etc/distrobox/distrobox.ini
diff --git a/bootc/Containerfile b/variants/bootc/Containerfile
similarity index 77%
rename from bootc/Containerfile
rename to variants/bootc/Containerfile
index 219a5d6..395c7d0 100644
--- a/bootc/Containerfile
+++ b/variants/bootc/Containerfile
@@ -62,13 +62,9 @@ lorax \
 
 RUN bootc container lint
 
-# bluebuild: Labels are added last since they cause cache misses with buildah
-LABEL org.blue-build.build-id="c74bf003-e98a-4ac0-8db2-8869239c6c13"
-LABEL org.opencontainers.image.title="beardy-os"
-LABEL org.opencontainers.image.description="The preferred u-blue based OS for bearded developers."
-LABEL org.opencontainers.image.base.digest="sha256:4ff605c93dca3a99b434f7363f400925685432cc22c5affbef9567e97d49603d"
-LABEL org.opencontainers.image.base.name="ghcr.io/ublue-os/silverblue-main:latest"
-LABEL org.opencontainers.image.created="2024-12-10T01:22:13.918756743+00:00"
+# Labels are added last since they cause cache misses with buildah
+LABEL org.opencontainers.image.title="beardy-os-bootc"
+LABEL org.opencontainers.image.description="The preferred bootc based OS for bearded developers."
 LABEL io.artifacthub.package.readme-url=https://raw.githubusercontent.com/detiber/beardy-os/main/README.md
 LABEL org.opencontainers.image.source=https://github.com/detiber/beardy-os
 LABEL org.opencontainers.image.url=https://github.com/detiber/beardy-os
diff --git a/variants/bootc/bib-img-config.toml b/variants/bootc/bib-img-config.toml
new file mode 100644
index 0000000..c4e61c0
--- /dev/null
+++ b/variants/bootc/bib-img-config.toml
@@ -0,0 +1,4 @@
+# TODO: sort out a proper config
+[[customizations.user]]
+name = "detiber"
+groups = ["wheel"]
diff --git a/hack/bib-iso-config.toml b/variants/bootc/bib-iso-config.toml
similarity index 98%
rename from hack/bib-iso-config.toml
rename to variants/bootc/bib-iso-config.toml
index 31ad069..c972ef6 100644
--- a/hack/bib-iso-config.toml
+++ b/variants/bootc/bib-iso-config.toml
@@ -8,6 +8,7 @@
 [customizations.installer.kickstart]
 contents = """
 graphical --non-interactive
+lang en_US.UTF-8
 zerombr
 clearpart --all --initlabel --disklabel=gpt
 autopart --noswap --type btrfs
diff --git a/variants/bootc/justfile b/variants/bootc/justfile
new file mode 100644
index 0000000..480603b
--- /dev/null
+++ b/variants/bootc/justfile
@@ -0,0 +1,28 @@
+import '../../just/common.just'
+import '../../just/bib.just'
+
+# default recipe to display help information
+default:
+  @just --list
+
+beardy-bootc-version := beardy-version
+beardy-bootc-image-name := "beardy-os-bootc"
+beardy-bootc-image := beardy-repo + "/" \
+  + beardy-bootc-image-name + ":" + beardy-bootc-version
+
+_bib-bootc config args: \
+  && (_bib \
+    beardy-bootc-image \
+    join(build-dir, 'output', 'variants', 'bootc') \
+    join(build-dir, 'cache', 'bib') \
+    config \
+    args
+    )
+
+bib-qcow2: && (_bib-bootc \
+    join(source_directory(), 'bib-img-config.toml') \
+    "--type qcow2 --rootfs btrfs")
+
+bib-iso: && (_bib-bootc \
+    join(source_directory(), 'bib-iso-config.toml') \
+    "--type anaconda-iso")
diff --git a/variants/ublue/Containerfile b/variants/ublue/Containerfile
new file mode 100644
index 0000000..aa81c15
--- /dev/null
+++ b/variants/ublue/Containerfile
@@ -0,0 +1,89 @@
+# Base ublue image
+FROM ghcr.io/ublue-os/base-main:latest
+
+ARG LANG="en_US.UTF-8"
+ARG TZ="America/New_York"
+ARG lang_charmap="UTF-8"
+ARG lang_inputfile="en_US"
+
+ENV LANG $LANG
+ENV TZ $TZ
+
+# TODO: run unwrap-cli script
+# TODO: add 1password
+# TODO: add ublue-update
+
+# Install required packages
+RUN \
+--mount=type=cache,dst=/var/cache/rpm-ostree,id=rpm-ostree-cache-beardy-os-latest,sharing=locked \
+--mount=type=cache,dst=/var/cache/libdnf5,id=dnf-cache-beardy-os-latest,sharing=locked \
+dnf5 -y install glibc-locale-source glibc-langpack-en osbuild-selinux && \
+dnf5 -y copr enable gmaglione/podman-bootc && \
+dnf5 -y install podman-bootc && \
+ostree container commit
+
+RUN localedef -i ${lang_inputfile} -f ${lang_charmap} en_US.UTF-8
+RUN echo "LANG=\"${LANG}\"" > /etc/locale.conf
+RUN ln -s -f "/usr/share/zoneinfo/${TZ}" /etc/localtime
+RUN echo "%wheel         ALL = (ALL) NOPASSWD: ALL" > /etc/sudoers.d/wheel-nopassword
+
+# Install additional packages
+RUN \
+--mount=type=cache,dst=/var/cache/rpm-ostree,id=rpm-ostree-cache-beardy-os-latest,sharing=locked \
+--mount=type=cache,dst=/var/cache/libdnf5,id=dnf-cache-beardy-os-latest,sharing=locked \
+dnf5 -y install \
+cockpit-bridge \
+cockpit-machines \
+cockpit-navigator \
+cockpit-networkmanager \
+cockpit-ostree \
+cockpit-podman \
+cockpit-selinux \
+cockpit-storaged \
+cockpit-system \
+cockpit-composer \
+podman-compose \
+libvirt-client \
+virt-install \
+btrfs-assistant \
+btrfsmaintenance \
+dbus-daemon \
+dbus-tools \
+fastfetch \
+ptyxis \
+setroubleshoot-plugins \
+setroubleshoot-server \
+usermode \
+virt-install \
+virt-manager \
+virt-what \
+xdg-user-dirs \
+xdg-user-dirs-gtk \
+tig \
+libguestfs \
+lorax \
+&& ostree container commit
+
+RUN bootc container lint
+
+## Manage services
+# systemctl enable foo.service
+
+# TODO: re-enable signing
+# bluebuild: signing module
+# RUN \
+# --mount=type=bind,from=stage-files,src=/files,dst=/tmp/files,rw \
+# --mount=type=bind,from=stage-modules,src=/modules,dst=/tmp/modules,rw \
+# --mount=type=bind,from=ghcr.io/blue-build/cli/build-scripts:a8cac2adc90fa842e4565bc1825e588df4f5bcbd,src=/scripts/,dst=/tmp/scripts/ \
+# --mount=type=cache,dst=/var/cache/rpm-ostree,id=rpm-ostree-cache-beardy-os-latest,sharing=locked \
+# --mount=type=cache,dst=/var/cache/libdnf5,id=dnf-cache-beardy-os-latest,sharing=locked \
+# /tmp/scripts/run_module.sh 'signing' '{"type":"signing"}' \
+# && ostree container commit
+
+# Labels are added last since they cause cache misses with buildah
+LABEL org.opencontainers.image.title="beardy-os-ublue"
+LABEL org.opencontainers.image.description="The preferred ublue based OS for bearded developers."
+LABEL io.artifacthub.package.readme-url=https://raw.githubusercontent.com/detiber/beardy-os/main/README.md
+LABEL org.opencontainers.image.source=https://github.com/detiber/beardy-os
+LABEL org.opencontainers.image.url=https://github.com/detiber/beardy-os
+LABEL org.opencontainers.image.vendor=detiber
diff --git a/files/scripts/unwrap-cli.sh b/variants/ublue/scripts/unwrap-cli.sh
similarity index 100%
rename from files/scripts/unwrap-cli.sh
rename to variants/ublue/scripts/unwrap-cli.sh