Merge pull request #5096 from jestabro/extend-activation-system

T8445: T8335: Extend config activation system

17 files changed, 636 insertions, 31 deletions

diff --git a/.gitignore b/.gitignore
index 06ae0c0db..06ab1dcd2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -155,6 +155,9 @@ data/reftree.cache
 data/op_cache.json
 # autogenerated vyos-configd JSON definition
 data/configd-include.json
+# autogenerated activation-scripts JSON definition
+data/activation-list
+data/activation-init
 
 # autogenerated vyos-commitd protobuf files
 python/vyos/proto/*.desc
diff --git a/Makefile b/Makefile
index 131f05917..df89b555e 100644
--- a/Makefile
+++ b/Makefile
@@ -78,7 +78,7 @@ vyshim:
 	$(MAKE) -C $(SHIM_DIR)
 
 .PHONY: all
-all: clean copyright libvyosconfig pylint interface_definitions op_mode_definitions test j2lint vyshim generate-configd-include-json
+all: clean copyright libvyosconfig pylint interface_definitions op_mode_definitions test j2lint vyshim generate-configd-include-json generate-activation-scripts-json
 
 .PHONY: copyright
 copyright:
@@ -130,6 +130,10 @@ deb:
 generate-configd-include-json:
 	@scripts/generate-configd-include-json.py
 
+.PHONY: generate-activation-scripts-json
+generate-activation-scripts-json:
+	@scripts/generate-activation-scripts-json.py
+
 .PHONY: schema
 schema:
 	trang -I rnc -O rng schema/interface_definition.rnc schema/interface_definition.rng
diff --git a/op-mode-definitions/system-activation.xml.in b/op-mode-definitions/system-activation.xml.in
new file mode 100644
index 000000000..7a6ee17f6
--- /dev/null
+++ b/op-mode-definitions/system-activation.xml.in
@@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<interfaceDefinition>
+  <node name="set">
+    <properties>
+      <help>Set parameters and behaviors</help>
+    </properties>
+    <children>
+      <node name="system">
+        <properties>
+          <help>Set system operational parameters</help>
+        </properties>
+        <children>
+          <node name="activation">
+            <properties>
+              <help>Activation units at boot</help>
+            </properties>
+            <children>
+              <tagNode name="unit">
+                <properties>
+                  <help>Unit name</help>
+                  <completionHelp>
+                    <script>${vyos_op_scripts_dir}/activation.py show_list</script>
+                  </completionHelp>
+                </properties>
+                <children>
+                  <tagNode name="active">
+                    <properties>
+                      <help>Execute on reboot</help>
+                      <completionHelp>
+                        <script>${vyos_op_scripts_dir}/activation.py show_opts</script>
+                      </completionHelp>
+                    </properties>
+                    <command>${vyos_op_scripts_dir}/activation.py set_active --name "${5}" --value "${7}"</command>
+                  </tagNode>
+                </children>
+              </tagNode>
+            </children>
+          </node>
+        </children>
+      </node>
+    </children>
+  </node>
+  <node name="show">
+    <children>
+      <node name="system">
+        <properties>
+          <help>Show system information</help>
+        </properties>
+        <children>
+          <node name="activation">
+            <properties>
+              <help>Activation scripts at boot</help>
+            </properties>
+            <command>${vyos_op_scripts_dir}/activation.py show</command>
+          </node>
+        </children>
+      </node>
+    </children>
+  </node>
+</interfaceDefinition>
+
diff --git a/op-mode-definitions/system-image.xml.in b/op-mode-definitions/system-image.xml.in
index a6634fc65..200d44e59 100644
--- a/op-mode-definitions/system-image.xml.in
+++ b/op-mode-definitions/system-image.xml.in
@@ -64,7 +64,7 @@
   </node>
   <node name="set">
     <properties>
-      <help>Install a new system</help>
+      <help>Set parameters and behaviors</help>
     </properties>
     <children>
       <node name="system">
diff --git a/op-mode-definitions/terminal.xml.in b/op-mode-definitions/terminal.xml.in
index 163159846..86af27bf1 100644
--- a/op-mode-definitions/terminal.xml.in
+++ b/op-mode-definitions/terminal.xml.in
@@ -28,7 +28,7 @@
   </node>
   <node name="set">
     <properties>
-      <help>Set operational options</help>
+      <help>Set parameters and behaviors</help>
     </properties>
     <children>
       <tagNode name="builtin">
diff --git a/python/vyos/defaults.py b/python/vyos/defaults.py
index 6aa93ebed..78721c0d2 100644
--- a/python/vyos/defaults.py
+++ b/python/vyos/defaults.py
@@ -102,3 +102,7 @@ SSH_DSA_DEPRECATION_WARNING: str = \
 'ED25519) to avoid authentication failures after the upgrade.'
 
 reference_tree_cache = '/usr/share/vyos/reftree.cache'
+
+activation_list = os.path.join(directories['config'], 'activation-list')
+activation_init = os.path.join(directories['data'], 'activation-init')
+activation_hint = os.path.join(directories['data'], '.activation_hint')
diff --git a/python/vyos/utils/activate.py b/python/vyos/utils/activate.py
new file mode 100644
index 000000000..51b92a4aa
--- /dev/null
+++ b/python/vyos/utils/activate.py
@@ -0,0 +1,126 @@
+# Copyright (C) VyOS Inc.
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+
+import json
+import typing
+from pathlib import Path
+
+from vyos.base import Warning as Warn
+from vyos.defaults import activation_list
+from vyos.defaults import activation_init
+from vyos.defaults import activation_hint
+from vyos.defaults import directories
+
+
+ActiveOpt = typing.Literal['enabled', 'once', 'off', 'never']
+
+
+def get_activation_scripts() -> dict:
+    list_path = Path(activation_list)
+    return json.loads(list_path.read_text())
+
+
+def set_activation(file_name: str, value: ActiveOpt):
+    script_dict = get_activation_scripts()
+    file_key = Path(file_name).stem
+    script_dict[file_key] = value
+    list_path = Path(activation_list)
+    list_path.write_text(json.dumps(script_dict))
+
+
+def get_activation(file_name: str) -> ActiveOpt:
+    script_dict = get_activation_scripts()
+    file_key = Path(file_name).stem
+    return script_dict[file_key]
+
+
+def is_active(file_name: str) -> bool:
+    script_dict = get_activation_scripts()
+    file_key = Path(file_name).stem
+    if script_dict[file_key] in ('enabled', 'once'):
+        return True
+    return False
+
+
+def stable_update(new: dict, old: dict):
+    res = {}
+    for key in new.keys():
+        res[key] = old[key] if key in old.keys() else new[key]
+    return res
+
+
+def init_activation_list() -> bool:
+    """Init if activation_hint exists, left on install_image or if image was
+    built as raw_image"""
+
+    init_hint = Path(activation_hint)
+    if not init_hint.exists():
+        return False
+
+    init_hint.unlink()
+    init_list = Path(activation_init)
+    data_list = Path(activation_list)
+    data_obj = json.loads(init_list.read_text())
+    data_list.write_text(json.dumps(data_obj))
+
+    return True
+
+
+def refresh_activation_list():
+    """Refresh activation list, as will be needed after image update"""
+
+    if init_activation_list():
+        return
+
+    new_list_path = Path(directories['data']).joinpath(Path(activation_list).name)
+    if not new_list_path.exists():
+        return
+
+    new_obj = json.loads(new_list_path.read_text())
+
+    orig_list_path = Path(activation_list)
+    if orig_list_path.exists():
+        orig_obj = json.loads(orig_list_path.read_text())
+        if orig_obj == new_obj:
+            return
+
+        obj = stable_update(new_obj, orig_obj)
+    else:
+        obj = new_obj
+
+    orig_list_path.write_text(json.dumps(obj))
+
+
+first_installed_boot_file = '/run/first_installed_boot'
+
+
+def set_first_installed_boot():
+    try:
+        Path(first_installed_boot_file).touch(exist_ok=False)
+    except FileExistsError:
+        Warn('redundant set of first_installed_boot')
+
+
+def is_first_installed_boot():
+    return Path(first_installed_boot_file).exists()
+
+
+def set_config_path_hint():
+    """The config hint allows subsequent installs to find previous disk
+    resident config data. It is traditionally added as part of the image
+    install procedure, however, for raw image builds an alternative is
+    needed."""
+    Path(directories['config']).joinpath('.vyatta_config').touch(exist_ok=True)
diff --git a/python/vyos/utils/func.py b/python/vyos/utils/func.py
new file mode 100644
index 000000000..830b76c94
--- /dev/null
+++ b/python/vyos/utils/func.py
@@ -0,0 +1,28 @@
+# Copyright (C) VyOS Inc.
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+
+"""Module for functors and higher order functions."""
+
+
+class FalseCallable:
+    """Define falsy callable for use as default value for getattr of a
+    function from a module defined by vyos.utils.system.load_as_module"""
+
+    def __call__(self, *args, **kwargs):
+        pass
+
+    def __bool__(self):
+        return False
diff --git a/scripts/generate-activation-scripts-json.py b/scripts/generate-activation-scripts-json.py
new file mode 100755
index 000000000..e8a7f34b4
--- /dev/null
+++ b/scripts/generate-activation-scripts-json.py
@@ -0,0 +1,55 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) VyOS Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+
+import re
+import json
+from pathlib import Path
+
+
+def filter_key(s: Path):
+    s = s.stem
+    return re.match(r'\d+\-.+', s)
+
+
+def sort_key(s: Path):
+    s = s.stem
+    pre, rem = re.match(r'(\d+)(?:-)(.+)', s).groups()
+    return int(pre), rem
+
+
+activation_dir = 'src/activation-scripts'
+activation_list = 'data/activation-list'
+activation_list_init = 'data/activation-init'
+
+activation_scripts = Path(activation_dir).glob('*.py')
+
+filtered = filter(filter_key, activation_scripts)
+script_list = sorted(filtered, key=sort_key)
+
+# default on system update
+script_dict = dict.fromkeys(map(lambda s: s.stem, script_list), 'enabled')
+# exceptions:
+# only enabled for script_dict_init
+script_dict['00-first-installed-boot'] = 'never'
+# for backward compatibility on system update
+script_dict['20-ethernet-offload'] = 'off'
+
+# installed on image creation
+script_dict_init = dict.fromkeys(map(lambda s: s.stem, script_list), 'enabled')
+
+Path(activation_list).write_text(json.dumps(script_dict))
+Path(activation_list_init).write_text(json.dumps(script_dict_init))
diff --git a/src/activation-scripts/00-first-installed-boot.py b/src/activation-scripts/00-first-installed-boot.py
new file mode 100644
index 000000000..ca02c2642
--- /dev/null
+++ b/src/activation-scripts/00-first-installed-boot.py
@@ -0,0 +1,35 @@
+# Copyright (C) VyOS Inc.
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+
+from vyos.configtree import ConfigTree
+from vyos.system.image import is_live_boot
+from vyos.utils.activate import set_activation
+from vyos.utils.activate import set_first_installed_boot
+from vyos.utils.activate import is_first_installed_boot
+
+
+def pre_condition() -> bool:
+    return not is_live_boot()
+
+
+def activate(_config: ConfigTree) -> None:
+    pass
+
+
+def post_condition() -> None:
+    set_first_installed_boot()
+    if is_first_installed_boot():
+        set_activation(__file__, 'never')
diff --git a/src/activation-scripts/01-set-config-path-hint.py b/src/activation-scripts/01-set-config-path-hint.py
new file mode 100644
index 000000000..3146a7905
--- /dev/null
+++ b/src/activation-scripts/01-set-config-path-hint.py
@@ -0,0 +1,35 @@
+# Copyright (C) VyOS Inc.
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+
+from vyos.configtree import ConfigTree
+from vyos.system.image import is_live_boot
+from vyos.utils.activate import set_activation
+from vyos.utils.activate import set_config_path_hint
+from vyos.utils.activate import is_first_installed_boot
+
+
+def pre_condition() -> bool:
+    return not is_live_boot()
+
+
+def activate(_config: ConfigTree) -> None:
+    pass
+
+
+def post_condition() -> None:
+    if is_first_installed_boot():
+        set_config_path_hint()
+        set_activation(__file__, 'never')
diff --git a/src/activation-scripts/20-ethernet_offload.py b/src/activation-scripts/20-ethernet-offload.py
index bc1e9f202..9f61f6d8f 100755..100644
--- a/src/activation-scripts/20-ethernet_offload.py
+++ b/src/activation-scripts/20-ethernet-offload.py
@@ -22,9 +22,12 @@
 
 from vyos.ethtool import Ethtool
 from vyos.configtree import ConfigTree
-from vyos.system.image import is_live_boot
+from vyos.utils.activate import set_activation
+from vyos.utils.activate import is_first_installed_boot
+
 
 def activate(config: ConfigTree):
+    # pylint: disable=too-many-branches
     base = ['interfaces', 'ethernet']
 
     if not config.exists(base):
@@ -39,7 +42,7 @@ def activate(config: ConfigTree):
         enabled, fixed = eth.get_generic_receive_offload()
         if configured and fixed:
             config.delete(base + [ifname, 'offload', 'gro'])
-        elif is_live_boot() and enabled and not fixed:
+        elif enabled and not fixed:
             config.set(base + [ifname, 'offload', 'gro'])
 
         # If GSO is enabled by the Kernel - we reflect this on the CLI. If GSO is
@@ -48,7 +51,7 @@ def activate(config: ConfigTree):
         enabled, fixed = eth.get_generic_segmentation_offload()
         if configured and fixed:
             config.delete(base + [ifname, 'offload', 'gso'])
-        elif is_live_boot() and enabled and not fixed:
+        elif enabled and not fixed:
             config.set(base + [ifname, 'offload', 'gso'])
 
         # If LRO is enabled by the Kernel - we reflect this on the CLI. If LRO is
@@ -57,7 +60,7 @@ def activate(config: ConfigTree):
         enabled, fixed = eth.get_large_receive_offload()
         if configured and fixed:
             config.delete(base + [ifname, 'offload', 'lro'])
-        elif is_live_boot() and enabled and not fixed:
+        elif enabled and not fixed:
             config.set(base + [ifname, 'offload', 'lro'])
 
         # If SG is enabled by the Kernel - we reflect this on the CLI. If SG is
@@ -66,7 +69,7 @@ def activate(config: ConfigTree):
         enabled, fixed = eth.get_scatter_gather()
         if configured and fixed:
             config.delete(base + [ifname, 'offload', 'sg'])
-        elif is_live_boot() and enabled and not fixed:
+        elif enabled and not fixed:
             config.set(base + [ifname, 'offload', 'sg'])
 
         # If TSO is enabled by the Kernel - we reflect this on the CLI. If TSO is
@@ -75,7 +78,7 @@ def activate(config: ConfigTree):
         enabled, fixed = eth.get_tcp_segmentation_offload()
         if configured and fixed:
             config.delete(base + [ifname, 'offload', 'tso'])
-        elif is_live_boot() and enabled and not fixed:
+        elif enabled and not fixed:
             config.set(base + [ifname, 'offload', 'tso'])
 
         # Remove deprecated UDP fragmentation offloading option
@@ -104,3 +107,8 @@ def activate(config: ConfigTree):
         if config.exists(flow_control_path):
             if not eth.check_flow_control():
                 config.delete(flow_control_path)
+
+
+def post_condition() -> None:
+    if is_first_installed_boot():
+        set_activation(__file__, 'off')
diff --git a/src/activation-scripts/example.py b/src/activation-scripts/example.py
new file mode 100644
index 000000000..74beedf80
--- /dev/null
+++ b/src/activation-scripts/example.py
@@ -0,0 +1,42 @@
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+
+from vyos.configtree import ConfigTree
+
+
+# pylint: disable=anomalous-backslash-in-string,pointless-string-statement
+"""Activation scripts must be named '^\\d+\\-.+.py$' to be included by the
+activation script runner. They are run in ascending order of prefix."""
+
+
+def pre_condition() -> bool:
+    """This function is not required.
+    If not present, or pre_condition returns True, the function activate
+    will be called on the config."""
+
+
+def activate(_config: ConfigTree) -> None:
+    """This function is expected.
+    If not present, the script is ignored. The function itself can be a
+    no-op."""
+
+
+def post_condition() -> None:
+    """This function is not required.
+    If present, and application of 'activate' succeeds, post_condition will
+    be called.
+    Commonly used to set activation 'off' for the script, after first run on
+    an installed system."""
diff --git a/src/helpers/run-config-activation.py b/src/helpers/run-config-activation.py
index f20adff1e..7e7a6571e 100755
--- a/src/helpers/run-config-activation.py
+++ b/src/helpers/run-config-activation.py
@@ -14,20 +14,33 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import re
+
+import sys
 import logging
+
 from pathlib import Path
 from argparse import ArgumentParser
 
 from vyos.compose_config import ComposeConfig
 from vyos.compose_config import ComposeConfigError
+from vyos.utils.activate import refresh_activation_list
+from vyos.utils.activate import get_activation_scripts
+from vyos.utils.activate import get_activation
+from vyos.utils.activate import set_activation
+from vyos.utils.activate import is_active
+from vyos.utils.system import load_as_module
+from vyos.utils.func import FalseCallable
 from vyos.defaults import directories
+from vyos.defaults import activation_list
+
 
 parser = ArgumentParser()
-parser.add_argument('config_file', type=str,
-                    help="configuration file to modify with system-specific settings")
-parser.add_argument('--test-script', type=str,
-                    help="test effect of named script")
+parser.add_argument(
+    'config_file',
+    type=str,
+    help='configuration file to modify with system-specific settings',
+)
+parser.add_argument('--test-script', type=str, help='test effect of named script')
 
 args = parser.parse_args()
 
@@ -40,6 +53,7 @@ formatter = logging.Formatter('%(message)s')
 fh.setFormatter(formatter)
 logger.addHandler(fh)
 
+
 if 'vyos-activate-debug' in Path('/proc/cmdline').read_text():
     print(f'\nactivate-debug enabled: file {checkpoint_file}_* on error')
     debug = checkpoint_file
@@ -48,36 +62,67 @@ else:
     debug = None
     logger.setLevel(logging.INFO)
 
-def sort_key(s: Path):
-    s = s.stem
-    pre, rem = re.match(r'(\d*)(?:-)?(.+)', s).groups()
-    return int(pre or 0), rem
 
 def file_ext(file_name: str) -> str:
-    """Return an identifier from file name for checkpoint file extension.
-    """
+    """Return an identifier from file name for checkpoint file extension."""
     return Path(file_name).stem
 
+
+refresh_activation_list()
+
+if not Path(activation_list).exists():
+    logger.error('Missing config activation list!')
+    sys.exit(1)
+
 script_dir = Path(directories['activate'])
 
 if args.test_script:
-    script_list = [script_dir.joinpath(args.test_script)]
+    script_list = [script_dir.joinpath(args.test_script).stem]
 else:
-    script_list = sorted(script_dir.glob('*.py'), key=sort_key)
+    script_list = list(get_activation_scripts())
 
 config_file = args.config_file
 config_str = Path(config_file).read_text()
 
 compose = ComposeConfig(config_str, checkpoint_file=debug)
 
+false_call = FalseCallable()
+
+update_config = False
 for file in script_list:
-    file = file.as_posix()
+    if not is_active(file):
+        continue
+
     logger.info(f'calling {file}')
-    try:
-        compose.apply_file(file, func_name='activate')
-    except ComposeConfigError as e:
-        if debug:
-            compose.write(f'{compose.checkpoint_file}_{file_ext(file)}')
-        logger.error(f'config-activation error in {file}: {e}')
-
-compose.write(config_file, with_version=True)
+
+    mod_name = Path(file).stem.replace('-', '_')
+    mod = load_as_module(mod_name, script_dir.joinpath(f'{file}.py').as_posix())
+
+    pre_condition = getattr(mod, 'pre_condition', false_call)
+    post_condition = getattr(mod, 'post_condition', false_call)
+    activate = getattr(mod, 'activate', false_call)
+
+    if not activate:
+        logger.error(f'missing activate function in {file}')
+        continue
+
+    if not pre_condition or pre_condition():
+        try:
+            compose.apply_func(activate)
+        except ComposeConfigError as e:
+            if debug:
+                compose.write(f'{compose.checkpoint_file}_{file_ext(file)}')
+            logger.error(f'config-activation error in {file}: {e}')
+            update_config = False
+            break
+
+        if post_condition:
+            post_condition()
+
+        if get_activation(file) == 'once':
+            set_activation(file, 'off')
+
+        update_config = True
+
+if update_config:
+    compose.write(config_file, with_version=True)
diff --git a/src/init/vyos-router b/src/init/vyos-router
index 600892c93..982126637 100755
--- a/src/init/vyos-router
+++ b/src/init/vyos-router
@@ -199,7 +199,12 @@ system_activate ()
     if [ -x $vyos_libexec_dir/run-config-activation.py ]; then
         log_progress_msg activate
         sg ${GROUP} -c "$vyos_libexec_dir/run-config-activation.py $BOOTFILE"
+        STATUS=$?
+        if [[ "$STATUS" != "0" ]]; then
+            return 1
+        fi
     fi
+    return 0
 }
 
 # load the initial config
diff --git a/src/op_mode/activation.py b/src/op_mode/activation.py
new file mode 100644
index 000000000..16192f3eb
--- /dev/null
+++ b/src/op_mode/activation.py
@@ -0,0 +1,144 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) VyOS Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+
+import sys
+import re
+import typing
+import tabulate
+
+import vyos.opmode
+from vyos.utils.activate import get_activation_scripts
+from vyos.utils.activate import set_activation as util_activate
+from vyos.utils.activate import get_activation
+from vyos.utils.activate import ActiveOpt
+from vyos.utils.io import ask_yes_no
+from vyos.base import Warning as Warn
+
+
+def _get_raw_data() -> dict:
+    return get_activation_scripts()
+
+
+def _split_name(name: str) -> tuple[str, str]:
+    # script names are guaranteed to have this format by construction:
+    # cf. scripts/generate-activation-scripts-json.py
+    match = re.match(r'(\d+)\-(.+)', name)
+    if match is None:
+        return '0', '_'
+    prio, base_name = match.groups()
+    return prio, base_name
+
+
+def _find_full_name(name: str) -> typing.Optional[str]:
+    script_names = list(_get_raw_data())
+    result = list(filter(lambda s: s.endswith(name), script_names))
+
+    return result[0] if result else None
+
+
+def show_list(raw: bool) -> typing.Optional[list]:
+    scripts = _get_raw_data()
+    data = []
+    for key in scripts.keys():
+        _, name = _split_name(key)
+        data.append(name)
+
+    if raw:
+        return data
+
+    print(*data)
+    return None
+
+
+def show_opts(raw: bool) -> typing.Optional[list]:
+    opts = list(typing.get_args(ActiveOpt))
+
+    if raw:
+        return opts
+
+    print(*opts)
+    return None
+
+
+def _format_scripts(scripts: dict):
+    headers = ['name', 'activate on reboot', 'priority']
+    data = []
+    for key in scripts.keys():
+        prio, name = _split_name(key)
+        value = scripts[key]
+        data.append([name, value, prio])
+
+    print('Activation units:')
+    print(tabulate.tabulate(data, headers))
+
+
+def show(raw: bool):
+    activation_dict = _get_raw_data()
+    if raw:
+        return activation_dict
+    return _format_scripts(activation_dict)
+
+
+def set_active(name: str, value: ActiveOpt, no_prompt: bool = False):
+    PROMPT_ENABLED = f'This will set {name} active on subsequent reboots. Proceed ?'
+    PROMPT_ONCE = f'This will set {name} active only for the next reboot. Proceed ?'
+    PROMPT_OFF = f'This will set {name} inactive. Proceed ?'
+    UNCHANGED = f'{name} is already set to {value}'
+    UNKNOWN = 'None such'
+
+    full_name = _find_full_name(name)
+    if not full_name:
+        Warn(f'No activation unit {name}')
+        return
+
+    state = get_activation(full_name)
+
+    if state == 'never':
+        Warn(f'{name} has been set to \'never\' and should not be reset')
+        return
+
+    if value == state:
+        print(UNCHANGED)
+        return
+
+    if value not in list(typing.get_args(ActiveOpt)):
+        Warn(f'No such value {value}')
+        return
+
+    match value:
+        case 'enabled':
+            message = PROMPT_ENABLED
+        case 'once':
+            message = PROMPT_ONCE
+        case 'off':
+            message = PROMPT_OFF
+        case _:
+            # not reached
+            message = UNKNOWN
+
+    if no_prompt or ask_yes_no(message, default=True):
+        util_activate(full_name, value)
+
+
+if __name__ == '__main__':
+    try:
+        res = vyos.opmode.run(sys.modules[__name__])
+        if res:
+            print(res)
+    except (ValueError, vyos.opmode.Error) as e:
+        print(e)
+        sys.exit(1)
diff --git a/src/op_mode/image_installer.py b/src/op_mode/image_installer.py
index 27d8214c3..07f69ccd5 100755
--- a/src/op_mode/image_installer.py
+++ b/src/op_mode/image_installer.py
@@ -46,6 +46,7 @@ from vyos.configtree import ConfigTree
 from vyos.config_mgmt import unsaved_commits
 from vyos.defaults import base_dir
 from vyos.defaults import directories
+from vyos.defaults import activation_hint
 from vyos.flavor import get_image_serial_console
 from vyos.remote import download
 from vyos.system import disk
@@ -133,6 +134,7 @@ CONST_RESERVED_SPACE: int = (2 + 1 + 256) * 1024**2
 
 # define directories and paths
 DIR_CONFIG: str = directories['config']
+DIR_DATA: str = directories['data']
 DIR_INSTALLATION: str = '/mnt/installation'
 DIR_ROOTFS_SRC: str = f'{DIR_INSTALLATION}/root_src'
 DIR_ROOTFS_DST: str = f'{DIR_INSTALLATION}/root_dst'
@@ -1041,6 +1043,14 @@ def install_image() -> None:
             write_dir: str = f'{DIR_DST_ROOT}/boot/{image_name}/rw'
             raid.update_default(write_dir)
 
+        # set activation hint
+        target_data_dir: str = f'{DIR_DST_ROOT}/boot/{image_name}/rw{DIR_DATA}/'
+        data_path = Path(target_data_dir)
+        data_path.mkdir(parents=True)
+        data_path.chmod(0o755)
+        init_hint = data_path.joinpath(Path(activation_hint).name)
+        init_hint.touch()
+
         setup_grub(DIR_DST_ROOT)
         # add information about version
         grub.create_structure()