iankelling.org / git / automated-distro-installer / blob
? search:


e9cce5009a04fb20311611299064982c7cd51353
[automated-distro-installer] / fai / config / hooks / partition.DEFAULT
1 #!/bin/bash -x
2 # Copyright (C) 2016 Ian Kelling
3
4 # This program is free software; you can redistribute it and/or
5 # modify it under the terms of the GNU General Public License
6 # as published by the Free Software Foundation; either version 2
7 # of the License, or (at your option) any later version.
8
9 # This program is distributed in the hope that it will be useful,
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 # GNU General Public License for more details.
13
14 # You should have received a copy of the GNU General Public License
15 # along with this program; if not, write to the Free Software
16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
17
18 PS4='+ $LINENO '
19 set -eE -o pipefail
20 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
21
22 if [[ $EUID != 0 ]]; then
23 echo "$0: error: need to run as root" >&2
24 exit 1
25 fi
26
27 # for calling outside of FAI:
28 # fai-redep
29 # s
30 # source /b/fai/fai-wrapper
31 # - set any appropriate classes with: fai-setclass OPT1... which sets CLASS_OPT1=true...
32 # or run eval-fai-classfile FILE
33 # export luks_dir=/q/root/luks
34 #
35 # OPTIONS:
36 #
37 # environment variables:
38 #
39 # HOSTNAME: if frodo, we exclude 2 devices from the /boot array, which
40 # the bios does not see. if demohost, we set the luks password to just
41 # 'x'.
42 #
43 # SPECIAL_DISK: For use outside of fai. A base disk name like
44 # /dev/sdk. If set, we just cryptsetup and partition this one disk then
45 # exit. This is useful for partitioning a disk in preparation to replace
46 # a failed or failing disk from a raid10 array.
47 #
48 # classes:
49 #
50 # REPARTITION: forces repartitioning even if we detect the proper amount
51 # of partitions already exist.
52 #
53 # NOWIPE: use existing subvolumes if they exist
54 #
55 # ROTATIONAL: forces to install onto hdds instead of sdds. normally sdds
56 # are chosen if they exist.
57 #
58 # PARTITION_PROMPT: command line prompt before partitioning
59 #
60 # RAID0: forces raid0 filesystem. Normally with 4+ devices, we use
61 # raid10.
62 # RAID1: forces raid1 filesystem.
63
64 if [[ $SPECIAL_DISK ]]; then
65 export CLASS_REPARTITION=true
66 fi
67
68 # # fai's setup-storage won't do btrfs on luks,
69 # # so we do it ourself :)
70 # inspiration taken from files in fai-setup-storage package
71
72 # if we are not running in fai, skiptask won't be defined, so carry on.
73 skiptask partition || ! type skiptask
74
75 if ! type -p devbyid; then
76 for d in $FAI/distro-install-common \
77 /a/bin/fai/fai/config/distro-install-common $FAI $PWD; do
78 [[ -d $d ]] || continue
79 if [[ -e $d/devbyid ]]; then
80 devbyid=$d/devbyid
81 devbyid() { $devbyid "$@"; }
82 break
83 fi
84 done
85 if [[ ! $devbyid ]]; then
86 echo "$0: error: failed to find devbyid script" >&2
87 exit 1
88 fi
89 fi
90
91
92
93 #### begin configuration
94
95 rootn=1
96 swapn=2
97 bootn=3
98 # ext partition so grub can write persistent variables,
99 # so it can do a one time boot. grub can't write to
100 # btrfs or any cow fs because it's more
101 # more complicated to do and they don't want to.
102 grub_extn=4
103 # bios boot partition,
104 # https://wiki.archlinux.org/index.php/GRUB
105 bios_grubn=5
106 lastn=$bios_grubn
107
108
109
110 ##### end configuration
111
112
113 add-part() { # add partition suffix to $dev
114 local d ret
115 if [[ $# == 1 ]]; then
116 d=$dev
117 part=$1
118 else
119 d=$1
120 part=$2
121 fi
122 if [[ $d == /dev/disk/by-id/* ]]; then
123 ret=$d-part$part
124 else
125 ret=$d$part
126 fi
127 echo $ret
128 }
129
130 bootdev() { add-part $@ $bootn; }
131 rootdev() { add-part $@ $rootn; }
132 swapdev() { add-part $@ $swapn; }
133 grub_extdev() { add-part $@ $grub_extn; }
134 bios_grubdev() { add-part $@ $bios_grubn; }
135
136 crypt-dev() { echo /dev/mapper/crypt_dev_${1##*/}; }
137 crypt-name() { echo crypt_dev_${1##*/}; }
138 root-cryptdev() { crypt-dev $(rootdev $@); }
139 swap-cryptdev() { crypt-dev $(swapdev $@); }
140 root-cryptname() { crypt-name $(rootdev $@); }
141 swap-cryptname() { crypt-name $(swapdev $@); }
142
143 ##### end function defs
144
145 if ifclass REPARTITION; then
146 partition=true # force a full wipe
147 else
148 partition=false # change to true to force a full wipe
149 fi
150 if ifclass NOWIPE; then
151 wipe=false
152 else
153 wipe=true
154 fi
155
156 if ((`nproc` > 2)); then
157 mopts=,compress=zstd
158 fi
159
160 declare -A disk_excludes
161 if ! ifclass USE_MOUNTED; then
162 ## ignore disks that are mounted, eg when running from fai-cd
163 while read -r l; do
164 eval "$l"
165 if [[ ! $PKNAME ]]; then
166 PKNAME="$KNAME"
167 fi
168 if [[ $MOUNTPOINT ]]; then
169 disk_excludes[$PKNAME]=true
170 fi
171 done < <(lsblk -nP -o KNAME,MOUNTPOINT,PKNAME)
172 fi
173
174 hdds=()
175 ssds=()
176 cd /sys/block
177 for disk in [sv]d[a-z]; do
178 if [[ ${disk_excludes[$disk]} ]]; then
179 continue
180 fi
181 case $(cat $disk/queue/rotational) in
182 0) ssds+=(/dev/$disk) ;;
183 1) hdds+=(/dev/$disk) ;;
184 *) echo "$0: error: unknown /sys/block/$disk/queue/rotational: \
185 $(cat $disk/queue/rotational)"; exit 1 ;;
186 esac
187 done
188
189 # install all ssds, or if there are none, all hdds.
190 # Note, usb flash disks are seen as rotational, which is
191 # very odd, but convenient for ignoring them here.
192 # TODO: find a reliable way to ignore them.
193 if ! ifclass ROTATIONAL && (( ${#ssds[@]} > 0 )); then
194 short_devs=( ${ssds[@]} )
195 else
196 short_devs=( ${hdds[@]} )
197 fi
198
199 # check if the partitions exist have the right filesystems
200 #blkid="$(blkid -s TYPE)"
201 for dev in ${short_devs[@]}; do
202 if $partition; then break; fi
203 y=$(readlink -f $dev)
204 arr=($y[0-9])
205 [[ ${#arr[@]} == "$lastn" ]] || partition=true
206 for (( i=1; i <= lastn; i++ )); do
207 [[ -e ${dev}$i ]] || partition=true
208 done
209 # On one system, blkid is missing some partitions.
210 # maybe we need a flag, like FUZZY_BLKID or something, so we
211 # can check that at least some exist.
212 # for x in "`rootdev`: TYPE=\"crypto_LUKS\"" "`bootdev`: TYPE=\"btrfs\""; do
213 # echo "$blkid" | grep -Fx "$x" &>/dev/null || partition=true
214 # done
215 done
216
217 if $partition && ifclass PARTITION_PROMPT; then
218 echo "Press any key except ctrl-c to continue and partition these drives:"
219 echo " ${short_devs[*]}"
220 read -r
221 fi
222
223 devs=()
224 shopt -s extglob
225 for short_dev in ${short_devs[@]}; do
226 devs+=($(devbyid $short_dev))
227 done
228 if [[ ! ${devs[0]} ]]; then
229 echo "$0: error: failed to detect devs" >&2
230 exit 1
231 fi
232
233 boot_space=0
234 first=false
235 boot_devs=()
236 for dev in ${devs[@]}; do
237 if ifclass frodo; then
238 # I ran into a machine where the bios doesn't know about some disks,
239 # so 1st stage of grub also doesn't know about them.
240 # Also, grub does not support mounting degraded btrfs as far as
241 # I can tell with some googling.
242 # From within an arch install env, I could detect them by noting
243 # their partitions were mixed with the next disk in /dev/disk/by-path,
244 # and I have mixed model disks, and I could see the 8 models which showed
245 # up in the bios, and thus see which 2 models were missing.
246 # hdparm -I /dev/sdh will give model info in linux.
247 # However, in fai on jessie, /dev/disk/by-path dir doesn't exist,
248 # and I don't see another way, so I'm hardcoding them.
249 # We still put grub on them and partition them the same, for uniformity
250 # and in case they get moved to a system that can recognize them,
251 # we just exclude them from the boot filesystem.
252 cd /dev/disk/by-id/
253 bad_disk=false
254 for id in ata-TOSHIBA_MD04ACA500_8539K4TQFS9A \
255 ata-TOSHIBA_MD04ACA500_Y5IFK6IJFS9A; do
256 if [[ $(readlink -f $id) == "$(readlink -f $dev)" ]]; then
257 bad_disk=true
258 break
259 fi
260 done
261 $bad_disk || boot_devs+=($(bootdev))
262 else
263 boot_space=$(( boot_space + $(parted -m $dev unit MiB print | \
264 sed -nr "s#^/dev/[^:]+:([0-9]+).*#\1#p") - 1))
265 boot_devs+=($(bootdev))
266 fi
267 if [[ $boot_devs && $first ]]; then
268 first_grub_extdev=$(grub_extdev)
269 first=false
270 fi
271 done
272
273 even_raid=false
274 if ifclass RAID0 || (( ${#boot_devs[@]} == 1 )); then
275 raid_level=0
276 elif ifclass RAID1 || (( ${#boot_devs[@]} <= 3 )); then
277 if (( ${#boot_devs[@]} == 2 )); then
278 even_raid=true
279 fi
280 raid_level=1
281 else
282 raid_level=10
283 fi
284
285 ### Begin calculate boot partition space
286 # due to raid duplication
287 case $raid_level in
288 1*) boot_space=$(( boot_space / 2 )) ;;
289 esac
290 if (( boot_space > 60000 )); then
291 # this is larger than needed for several /boot subvols,
292 # becuase I keep a minimal debian install on it for
293 # recovery needs and for doing pxe-kexec.
294 boot_mib=10000
295 elif (( boot_space > 30000 )); then
296 boot_mib=$(( 5000 + (boot_space - 30000) / 2 ))
297 else
298 # Small vms don't have room for /boot recovery. With 3 kernels
299 # installed, i'm using 132M on t8, so this seems like plenty of
300 # room. note: rhel 8 recomments 1g for /boot.
301 boot_mib=500
302 #
303 fi
304 case $raid_level in
305 1*) boot_mib=$(( boot_mib * 2 )) ;;
306 esac
307 ### end calculate boot partition space
308
309
310
311 if [[ ! $DISTRO ]]; then
312 if ifclass VOL_BUSTER_BOOTSTRAP; then
313 DISTRO=debianbuster_bootstrap
314 elif ifclass VOL_STRETCH; then
315 DISTRO=debianstretch
316 elif ifclass VOL_BUSTER; then
317 DISTRO=debianbuster
318 elif ifclass VOL_BULLSEYE; then
319 DISTRO=debianbullseye
320 elif ifclass VOL_TESTING; then
321 DISTRO=debiantesting
322 elif ifclass VOL_XENIAL; then
323 DISTRO=ubuntuxenial
324 elif ifclass VOL_BIONIC; then
325 DISTRO=ubuntubionic
326 elif ifclass VOL_FOCAL; then
327 DISTRO=ubuntufocal
328 elif ifclass VOL_FLIDAS; then
329 DISTRO=trisquelflidas
330 elif ifclass VOL_ETIONA; then
331 DISTRO=trisqueletiona
332 elif ifclass VOL_NABIA; then
333 DISTRO=trisquelnabia
334 else
335 echo "PARTITIONER ERROR: no distro class/var set" >&2
336 exit 1
337 fi
338 fi
339 first_boot_dev=${boot_devs[0]}
340
341
342 bpart() { # btrfs a partition
343 case $raid_level in
344 0) mkfs.btrfs -f $@ ;;
345 1) mkfs.btrfs -f -m raid1 -d raid1 $@ ;;
346 10) mkfs.btrfs -f -m raid10 -d raid10 $@ ;;
347 esac
348 }
349
350
351 if [[ ! $luks_dir ]]; then
352 # see README for docs about how to create these
353 luks_dir=$FAI/distro-install-common/luks
354 fi
355
356 luks_file=$luks_dir/host-$HOSTNAME
357 if [[ ! -e $luks_file ]]; then
358 hostkeys=($luks_dir/host-*)
359 # if there is only one key, we might be deploying somewhere
360 # where dhcp doesnt give us a proper hostname, so use that.
361 if [[ ${#hostkeys[@]} == 1 && -e ${hostkeys[0]} ]]; then
362 luks_file=${hostkeys[0]}
363 else
364 echo "$0: error: no key for hostname at $luks_file" >&2
365 exit 1
366 fi
367 fi
368
369 # # note, corresponding changes in /b/ds/keyscript-{on,off}
370 if ifclass demohost; then
371 lukspw=x
372 elif [[ -e $luks_dir/$HOSTNAME ]]; then
373 lukspw=$(cat $luks_dir/$HOSTNAME)
374 else
375 lukspw=$(cat $luks_dir/iank)
376 fi
377
378
379 first_root_crypt=$(root-cryptdev ${devs[0]})
380
381 # 1.5 x based on https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Installation_Guide/sect-disk-partitioning-setup-x86.html#sect-custom-partitioning-x86
382 swap_mib=$(( $(grep ^MemTotal: /proc/meminfo | \
383 awk '{print $2}') * 3/(${#devs[@]} * 2 ) / 1024 ))
384
385 mkdir -p /tmp/fai
386 root_devs=()
387 for dev in ${devs[@]}; do
388 root_devs+=($(rootdev))
389 done
390 shopt -s nullglob
391 if $partition; then
392
393 ### begin wipefs
394 if [[ ! $SPECIAL_DISK ]]; then
395 for dev in ${devs[@]}; do
396 # if we repartition to the same as an old partition,
397 # we don't want any old fses hanging around.
398 for (( i=1; i <= lastn; i++ )); do
399 x=$(add-part $dev $i)
400 [[ -e $x ]] || continue
401 count_down=10
402 # wipefs has failed, manual run works, google suggests timing issue
403 while ! wipefs -a $x; do
404 sleep 2
405 count_down=$((count_down - 1))
406 (( count_down > 0 )) || exit 1
407 done
408 done
409 done
410 fi
411 ### end wipefs
412
413
414 if $even_raid; then
415 for dev in ${devs[@]}; do
416 disk_mib=$(( $(parted -m $dev unit MiB print | \
417 sed -nr "s#^/dev/[^:]+:([0-9]+).*#\1#p") - 1))
418 if [[ ! min_disk_mib ]] || (( disk_mib < min_disk_mib )); then
419 min_disk_mib=$disk_mib
420 fi
421 done
422 fi
423
424 for dev in ${devs[@]}; do
425 if [[ $SPECIAL_DISK ]]; then
426 dev=$(devbyid $SPECIAL_DISK)
427 fi
428
429 # parted will round up the disk size. Do -1 so we can have
430 # fully 1MiB unit partitions for easy resizing of the last partition.
431 # Otherwise we would pass in -0 for the end argument for the last partition.
432 #
433 # Note: parted print error output is expected. example:
434 # Error: /dev/vda: unrecognised disk label
435 if $even_raid; then
436 disk_mib=$min_disk_mib
437 else
438 disk_mib=$(( $(parted -m $dev unit MiB print | \
439 sed -nr "s#^/dev/[^:]+:([0-9]+).*#\1#p") - 1))
440 fi
441 root_end=$(( disk_mib - swap_mib - boot_mib / ${#boot_devs[@]} ))
442 swap_end=$(( root_end + swap_mib))
443
444 parted -s $dev mklabel gpt
445 # MiB because parted complains about alignment otherwise.
446 pcmd="parted -a optimal -s -- $dev"
447 $pcmd mkpart primary ext3 12MiB ${root_end}MiB
448 # without naming, systemd gives us misc errors like:
449 # dev-disk-by\x2dpartlabel-primary.device: Dev dev-disk-by\x2dpartlabel-primary.device appeared twice
450 $pcmd name $rootn root
451 # normally a swap is type "linux-swap", but this is encrypted swap. using that
452 # label will confuse systemd.
453 $pcmd mkpart primary "" ${root_end}MiB ${swap_end}MiB
454 $pcmd name $swapn swap
455 $pcmd mkpart primary "" ${swap_end}MiB ${disk_mib}MiB
456 $pcmd name $bootn boot
457 # i only need a few k, but googling min size,
458 # I found someone saying that gparted required
459 # required at least 8 because of their hard drive cylinder size.
460 # And 8 is still very tiny.
461 $pcmd mkpart primary "ext2" 4MiB 12MiB
462 $pcmd name $grub_extn grubext
463 # gpt ubuntu cloud image uses ~4 mb for this partition. fai uses 1 MiB.
464 # so, I use 3, whatever.
465 # note: parted manual saying cheap flash media
466 # should to start at 4.
467 $pcmd mkpart primary "" 1MiB 4MiB
468 $pcmd name $bios_grubn biosgrub
469 $pcmd set $bios_grubn bios_grub on
470 $pcmd set $bootn boot on # generally not needed on modern systems
471 # the mkfs failed before on a vm, which prompted me to add
472 # sleep .1
473 # then it failed again on a physical machine
474 # with:
475 # Device /dev/disk/by-id/foo doesn't exist or access denied,
476 # so I added a wait until it existed.
477 # Then I added the mkfs.ext2, which claimed to succeed,
478 # but then couldn't be found upon reboot. In that case we didn't
479 # wait at all. So I've added a 3 second minimum wait.
480 sleep 3
481 secs=0
482 while [[ ! -e $(rootdev) ]] && (( secs < 10 )); do
483 sleep 1
484 secs=$((secs +1))
485 done
486 # Holds just a single file, rarely written, so
487 # use ext2, like was often used for the /boot partition.
488 # This exists because grub can only persist data to a non-cow fs.
489 # And we use persisting a var in grub to do a one time boot.
490 # We could pass the data on the kernel command line and persist it
491 # to grubenv after booting, but that relies on the boot always succeeding.
492 # This is just a bit more robust, and it could work for booting
493 # into ipxe which can't persist data, if we ever got that working.
494 mkfs.ext2 $(grub_extdev)
495 # when we move to newer than trisquel 9, we can remove
496 # --type luks1. We can also check on cryptsetup --help | less /compil
497 # to see about the other settings. Default in debian 9 is luks2.
498 # You can convert from luks2 to luks 1 by adding a temporary key:
499 # cryptsetup luksAddKey --pbkdf pbkdf2
500 # then remove the new format keys with cryptsetup luksRemoveKey
501 # then cryptsetup convert DEV --type luks1, then readd old keys and remove temp.
502 yes YES | cryptsetup luksFormat $(rootdev) $luks_file \
503 --type luks1 -c aes-cbc-essiv:sha256 -s 256 || [[ $? == 141 ]]
504 yes "$lukspw" | \
505 cryptsetup luksAddKey --key-file $luks_file \
506 $(rootdev) || [[ $? == 141 ]]
507 # background: Keyfile and password are treated just
508 # like 2 ways to input a passphrase, so we don't actually need to have
509 # different contents of keyfile and passphrase, but it makes some
510 # security sense to a really big randomly generated passphrase
511 # as much as possible, so we have both.
512 #
513 # This would remove the keyfile.
514 # yes 'test' | cryptsetup luksRemoveKey /dev/... \
515 # /key/file || [[ $? == 141 ]]
516
517 cryptsetup luksOpen $(rootdev) $(root-cryptname) \
518 --key-file $luks_file
519
520 if [[ $SPECIAL_DISK ]]; then
521 exit 0
522 fi
523 done
524 ls -la /dev/btrfs-control # this was probably for debugging...
525 sleep 1
526 bpart $(for dev in ${devs[@]}; do root-cryptdev; done)
527 bpart ${boot_devs[@]}
528 else
529 for dev in ${devs[@]}; do
530 if [[ -e /dev/mapper/$(root-cryptname) ]]; then
531 continue
532 fi
533 cryptsetup luksOpen $(rootdev) $(root-cryptname) \
534 --key-file $luks_file
535 done
536 sleep 1
537 fi
538
539
540 if $wipe && [[ $DISTRO != debianbuster_bootstrap ]]; then
541 # bootstrap distro doesn't use separate encrypted root.
542 mount -o subvolid=0 $first_root_crypt /mnt
543 # systemd creates subvolumes we want to delete.
544 s=($(btrfs subvolume list --sort=-path /mnt |
545 sed -rn "s#^.*path\s*(root_$DISTRO/\S+)\s*\$#\1#p"))
546 for subvol in ${s[@]}; do btrfs subvolume delete /mnt/$subvol; done
547 btrfs subvolume set-default 0 /mnt
548 [[ ! -e /mnt/root_$DISTRO ]] || btrfs subvolume delete /mnt/root_$DISTRO
549
550 ## create subvols ##
551 cd /mnt
552
553 btrfs subvolume create root_$DISTRO
554
555 # could set default subvol like this, but no reason to.
556 # btrfs subvolume set-default \
557 # $(btrfs subvolume list . | grep "root_$DISTRO$" | awk '{print $2}') .
558
559 # no cow on the root filesystem. it's setup is fully scripted,
560 # if it's messed up, we will just recreated it,
561 # and we can get better perf with this.
562 # I can't remember exactly why, but this is preferable to mounting with
563 # -o nodatacow, I think because subvolumes inherit that.
564 chattr -Rf +C root_$DISTRO
565 cd /
566 umount /mnt
567 fi
568
569 mount -o subvolid=0 $first_boot_dev /mnt
570 cd /mnt
571 btrfs subvolume set-default 0 /mnt # already default, just ensuring it.
572
573 # for libreboot systems. grub2 only reads from subvolid=0
574 mkdir -p /mnt/grub2
575 cp $FAI/distro-install-common/libreboot_grub.cfg /mnt/grub2
576
577 if [[ $DISTRO == debianbuster_bootstrap ]]; then
578 # this is just convenience for the libreboot_grub config
579 # so we can glob the other ones easier.
580 boot_vol=$DISTRO
581 else
582 boot_vol=boot_$DISTRO
583 fi
584 if $wipe && [[ -e /mnt/$boot_vol ]]; then
585 btrfs subvolume delete /mnt/$boot_vol
586 fi
587 if [[ ! -e /mnt/$boot_vol ]]; then
588 btrfs subvolume create $boot_vol
589 fi
590 cd /
591 umount /mnt
592 ## end create subvols ##
593
594 dev=${boot_devs[0]}
595 mount $first_grub_extdev /mnt
596 grub-editenv /mnt/grubenv set did_fai_check=true
597 grub-editenv /mnt/grubenv set last_boot=/$boot_vol
598 umount /mnt
599
600 if [[ $DISTRO == debianbuster_bootstrap ]]; then
601 cat > /tmp/fai/fstab <<EOF
602 $first_boot_dev / btrfs noatime,subvol=$boot_vol 0 0
603 EOF
604 cat >/tmp/fai/disk_var.sh <<EOF
605 BOOT_DEVICE="${short_devs[@]}"
606 ROOT_PARTITION=$first_boot_dev
607 EOF
608 else
609 # note, fai creates the mountpoints listed here
610 cat > /tmp/fai/fstab <<EOF
611 $first_root_crypt / btrfs noatime,subvol=root_$DISTRO$mopts 0 0
612 $first_root_crypt /mnt/root btrfs nofail,noatime,subvolid=0$mopts 0 0
613 $first_boot_dev /boot btrfs nofail,noatime,subvol=$boot_vol 0 0
614 $first_boot_dev /mnt/boot btrfs nofail,noatime,subvolid=0 0 0
615 EOF
616 swaps=()
617 rm -f /tmp/fai/crypttab
618 for dev in ${devs[@]}; do
619 swaps+=($(swap-cryptname))
620 cat >>/tmp/fai/crypttab <<EOF
621 $(root-cryptname) $(rootdev) none keyscript=/root/keyscript,discard,luks,initramfs
622 $(swap-cryptname) $(swapdev) /dev/urandom swap,cipher=aes-xts-plain64,size=256,hash=ripemd160
623 EOF
624 cat >> /tmp/fai/fstab <<EOF
625 $(swap-cryptdev) none swap nofail,sw 0 0
626 EOF
627 done
628
629 # fai would do this:
630 #BOOT_DEVICE=\${BOOT_DEVICE:-"${devs[0]}"}
631
632 # note: swaplist seems to do nothing.
633 cat >/tmp/fai/disk_var.sh <<EOF
634 BOOT_DEVICE="${short_devs[@]}"
635 BOOT_PARTITION=\${BOOT_PARTITION:-$first_boot_dev}
636 # ROOT_PARTITIONS is added by me, used in arch setup.
637 ROOT_PARTITIONS="${root_devs[@]}"
638 ROOT_PARTITION=\${ROOT_PARTITION:-$first_root_crypt}
639 SWAPLIST=\${SWAPLIST:-"${swaps[@]}"}
640 EOF
641 fi
PXE install w multi-boot, btrfs & Libreboot support