iankelling.org Git - automated-distro-installer/blob - fai/config/scripts/IANK/11-iank

   1 #!/bin/bash -x
   2 # This file is part of Ian Kelling's automated-distro-installer
   3 # Copyright (C) 2024 Ian Kelling
   4
   5 # This program is free software; you can redistribute it and/or
   6 # modify it under the terms of the GNU General Public License
   7 # as published by the Free Software Foundation; either version 2
   8 # of the License, or (at your option) any later version.
   9
  10 # This program is distributed in the hope that it will be useful,
  11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 # GNU General Public License for more details.
  14
  15 # You should have received a copy of the GNU General Public License
  16 # along with this program; if not, write to the Free Software
  17 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  18
  19 set -eE -o pipefail
  20 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
  21
  22 if [[ $EUID != 0 ]]; then
  23   echo "$0: error: expected to be root."
  24   exit 1
  25 fi
  26
  27 # ignore this line. hack to make shellcheck ignore $target
  28 if [[ ! $target ]]; then target=; fi
  29
  30 if ! type -t fcopy &>/dev/null; then
  31   sudo apt-get -y install fai-client
  32 fi
  33
  34 # -r = recursive
  35 # -i = ignore non-matching class warnings, always exit 0
  36 # -B = no backup files
  37 fcopy -riB /boot
  38 # this is also done by FAIBASE/10-misc by default (without B)
  39 fcopy -riB /usr/local/bin
  40
  41 fcopy -riB /etc/apt/logind.conf.d
  42
  43 # this gets done by fai, but just happens too often that
  44 # I add sources due to new distros, whatever.
  45 fcopy -riB /etc/apt/preferences.d
  46 fcopy -riB /etc/apt/sources.list.d
  47
  48
  49 src=$FAI/distro-install-common/shadow
  50 dst=/q/root/shadow
  51 if [[ ! -e $dst && -e $src ]]; then
  52   # outside of fai context, we skip this
  53   mkdir -p $dst
  54   mount -o bind $src $dst
  55 fi
  56
  57
  58
  59 $FAI/distro-install-common/end
  60
  61
  62
  63 ### begin sources install + updates
  64 # these get copied in an earlier stage by fai, but leaving it here since
  65 # I run this as a single post-fai script to update things that have changed.
  66 tmpfile1=$(mktemp)
  67 # this can fail if we need an apt update
  68 $ROOTCMD /usr/bin/apt-cache policy >$tmpfile1 ||:
  69 fcopy -riB /etc/apt
  70
  71 tmpfile2=$(mktemp)
  72 $ROOTCMD /usr/bin/apt-cache policy >$tmpfile2
  73 if ! diff -q $tmpfile1 $tmpfile2; then
  74   $ROOTCMD /usr/bin/apt update
  75 fi
  76 # outside of fai, this seems to regularly lead to
  77 # E: Could not get lock /var/lib/apt/lists/lock - open (11: Resource temporarily unavailable)
  78 # so add a sleep. 1 sec is probably way more than needed.
  79 sleep 1
  80 f=$FAI_ROOT/var/cache/apt/pkgcache.bin
  81 if [[ ! -r $f ]] || (( $(( $(date +%s) - $(stat -c %Y $f ) )) > 60*60*2 )); then
  82   i=0
  83   while fuser $FAI_ROOT/var/lib/dpkg/lock &>/dev/null; do
  84     sleep 1
  85     i=$(( i+1 ))
  86     if (( i > 300 )); then
  87       echo "error: timed out waiting for /var/lib/dpkg/lock" >&2
  88       exit 1
  89     fi
  90     $ROOTCMD apt-get update
  91   done
  92 fi
  93 ### end sources install + updates
  94
  95
  96 #### misc configurations
  97
  98 if [[ $FAI_ACTION != dirinstall ]] && ! ifclass NOCRYPT; then
  99   if ifclass LINODE; then
 100     speed=19200
 101     cmdline="rd.luks.crypttab=no net.ifnames=0 console=ttyS0,${speed}n8"
 102   else
 103     speed=115200
 104     cmdline="rd.luks.crypttab=no net.ifnames=0 console=ttyS0,${speed}n8 console=tty0"
 105     case $HOSTNAME in
 106       kd)
 107         fcopy -v /usr/bin/myncq
 108
 109         cat >$target/etc/systemd/system/myncq.service <<'EOF'
 110 [Unit]
 111 Description=fix ncq errors
 112
 113 [Service]
 114 Type=oneshot
 115 ExecStart=/usr/bin/myncq
 116 TimeoutStartSec=20
 117
 118 [Install]
 119 # https://www.enricozini.org/blog/2017/debian/systemd-07-devices/
 120 WantedBy=dev-disk-by\x2did-ata\x2dSamsung_SSD_870_QVO_8TB_S5VUNG0N900656V.device
 121 EOF
 122
 123         $ROOTCMD bash <<'EOFOUTER'
 124 systemctl enable myncq.service
 125 /usr/bin/myncq no-upgrub
 126 EOFOUTER
 127
 128         ;;&
 129       # per rubens suggestion to make a d16 more stable
 130       kd|kw) cmdline+=" pci=realloc=off" ;;
 131     esac
 132   fi
 133
 134 fi ##### end != dirinstall && != NOCRYPT
 135
 136
 137 ###### begin network setup ####
 138
 139 # use old names. the idea of them changing between boots has never
 140 # happened to me and I usually only have 1 wired or other type.
 141 # If I ever do need to care about it, I will.
 142 # Strangely this didn't work on kw, so I added kernel cmdline parameter.
 143 # https://www.freedesktop.org/wiki/Software/systemd/PredictableNetworkInterfaceNames/
 144 ln -sf /dev/null $target/etc/systemd/network/99-default.link
 145
 146
 147 # bitfolk installer handles the rest
 148 case $HOSTNAME in
 149   bk|je) exit 0 ;;
 150 esac
 151
 152
 153 # bug fix, somewhere between t9's xorg 1.19.6
 154 # and 1.20.1-3ubuntu2
 155 #  xserver-xorg-video-nouveau                 1:1.0.15-3
 156 # xorg stopped load nouveau
 157 #  https://www.linuxquestions.org/questions/slackware-14/kernel-modules-conflicting-with-nouveau-driver-4175623867/
 158 # https://nouveau.freedesktop.org/InstallNouveau.html
 159 # And now in t11, things got worse with a newer card also not loading
 160 # nouveau when it did in t10.
 161 if lspci|grep -q 'VGA compatible controller: NVIDIA'; then
 162   mkdir -p $target/etc/X11/xorg.conf.d/
 163   cat >$target/etc/X11/xorg.conf.d/10-nouveau.conf <<'EOF'
 164 Section "Device"
 165 Identifier "Device0"
 166 Driver "nouveau"
 167 EndSection
 168 EOF
 169 fi
 170
 171 # use networkmanager if this host has wireless.
 172 if [[ $(iw dev) || $HOSTNAME == so ]]; then
 173   $ROOTCMD bash -xe <<EOF
 174 apt-get -y install network-manager
 175 EOF
 176
 177   # allow networkmanager to manage interfaces
 178   #https://bugs.launchpad.net/ubuntu/+source/network-manager/+bug/1638842
 179   # touch $target/etc/NetworkManager/conf.d/10-globally-managed-devices.conf
 180   #
 181   # in 24.04, netplan takes over and nm won't automatically connect any
 182   # ethernet devices. Ya, man NetworkManager helpfully suggests the
 183   # config setting device*.managed=1, but of course that isn't REAL
 184   # setting, you go to man NetworkManager.conf and find that every
 185   # setting has a section.  So what section is that setting in? It
 186   # doesn't tell you. You have to figure out that it is implied that a
 187   # setting x.y means section x, setting y.  Ok, but what section is
 188   # device*? that isn't documented in the man page either (at least not
 189   # properly). But if you read closely, you can intuit that device* is
 190   # likely a valid section and then try it. Might as use this same magic
 191   # config file name since it is supposed to exist, but I have no idea
 192   # if it is still magic. note: In figuring this out, I also removed
 193   # /etc/netplan/*, which seemed to have no effect. dunno if it matters.
 194   cat >$target/etc/NetworkManager/conf.d/10-globally-managed-devices.conf <<'EOF'
 195 [device*]
 196 managed=1
 197 EOF
 198   # in a default desktop install, it looks like netplan creates this file under
 199   # run/NetworkManager/conf.d in early boot.
 200
 201   # By default, dns=default is set in etiona, and dns is just broken.
 202   # Maybe with resolvconf it would work, but theres no need for that.
 203   # https://wiki.gnome.org/Projects/NetworkManager/DNS
 204   cat >$target/etc/NetworkManager/conf.d/99-iank.conf <<'EOF'
 205 [main]
 206 dns=systemd-resolved
 207 EOF
 208
 209
 210   if [[ ! $FAI_WRAPPER || $SSH_CLIENT ]]; then
 211     # for running from fai or remote connections, don't kill the internet
 212     ethusb_arg=-c
 213   fi
 214   if [[ $(timeout 1 dig +short @10.2.0.1 -x 10.2.0.2 2>&1 ||:) == kd.b8.nz. ]] \
 215        && ip n show 10.2.0.1 | grep . &>/dev/null; then
 216     # we are at_home
 217     $FAI/distro-install-common/ethusb-static $ethusb_arg
 218   else
 219     $FAI/distro-install-common/ethusb-static off $ethusb_arg
 220   fi
 221
 222
 223 else
 224   cat > $target/etc/network/interfaces <<-EOF
 225 # generated by FAI
 226 auto lo eth0
 227 iface lo inet loopback
 228 iface eth0 inet dhcp
 229 iface eth0 inet6 auto
 230
 231 source-directory /etc/network/interfaces.d
 232 EOF
 233
 234   # previously had an else condition after
 235   #elif ifclass VM || ifclass LINODE; then
 236   # iface $NIC1 inet manual
 237   # iface br0 inet dhcp
 238   #   bridge_ports $NIC1
 239   #   bridge_stp off
 240   #   bridge_maxwait 0
 241   # however, on t9, on startup, br0, became
 242   # rename1 and didn't come up. i dunno why,
 243   # but the bridge is for vms that I rarely use,
 244   # so not bothering to figure it out.
 245
 246
 247 fi
 248
 249 if ifclass LINODE; then
 250   mkdir -p $target/etc/initramfs-tools/conf.d
 251   # shellcheck disable=SC2154 # comes with LINODE environment
 252   cat >$target/etc/initramfs-tools/conf.d/mine <<EOF
 253 # dhcp in initramfs doesn't work on linode. i dunno why, whatever.
 254 # man 5 initramfs.conf
 255 # /usr/share/doc/klibc-utils/README.ipconfig.gz
 256 # /usr/share/initramfs-tools/scripts/functions
 257 IP=$linode_ip::$linode_gw:255.255.255.0::eth0:off
 258 EOF
 259
 260
 261   if [[ $HOSTNAME == li ]]; then
 262     cat > $target/etc/network/interfaces <<-EOF
 263 # generated by FAI
 264 auto lo eth0
 265 iface lo inet loopback
 266 iface eth0 inet dhcp
 267 # for the standard network config, uncomment this and comment the lines after it.
 268 #iface eth0 inet6 auto
 269
 270 iface eth0 inet6 static
 271 # this is really a /128. it seems like we need to assign it for ipv6 to work.
 272 address 2600:3c00::f03c:91ff:fe6d:baf8/64
 273 gateway fe80::1
 274
 275 iface eth0 inet6 static
 276 # from a requested /64 pool
 277 address 2600:3c00:e000:280::2/64
 278
 279 source-directory /etc/network/interfaces.d
 280 EOF
 281   fi
 282 fi
 283
 284
 285 ##### end network setup  #####
 286
 287
 288 if ifclass VOL_BULLSEYE_BOOTSTRAP || ifclass VOL_BOOKWORM_BOOTSTRAP; then
 289   fcopy /etc/systemd/system/faicheck.service
 290   $ROOTCMD bash <<'EOFOUTER'
 291 systemctl enable faicheck.service
 292 EOFOUTER
 293   exit 0 # avoid unnecessary stuff in bootstrap vol
 294 fi
 295
 296
 297 ## misc settings
 298 $ROOTCMD bash <<'EOFOUTER'
 299 #### begin .ssh setup ###
 300 set -x
 301 set -eE -o pipefail
 302 if ! [[ -s /home/iank/.ssh/authorized_keys ]]; then
 303   mkdir -p /home/iank/.ssh
 304   f=/root/.ssh/authorized_keys
 305   if [[ -e $f ]]; then
 306      cp $f /home/iank/.ssh
 307   fi
 308   chown -R 1000:1000 /home/iank/.ssh
 309   chmod -R u=Xrw,og= /home/iank/.ssh
 310   rm -rf /root/.ssh
 311   # remove broken symlinks or the following cp will fail
 312   find /home/iank/.ssh -xtype l -exec rm '{}' \;
 313   cp -rL /home/iank/.ssh /root
 314   chown -R root:root /root/.ssh
 315   chmod 700 /root/.ssh
 316 fi
 317
 318 # old link from
 319 # # https://ticktockhouse.svbtle.com/my-obligatory-ubuntu-ssh-agent-post
 320 # but that made a service that started too soon and didn't pick up our
 321 # x env vars. instead, copy from the root ssh-agent just the
 322 # appropriate things into a new service.
 323
 324 rm -f /home/iank/.local/share/systemd/user/sshaiank.service \
 325   /home/iank/.config/systemd/user/default.target.wants/sshaiank.service
 326
 327 #### end .ssh setup ###
 328
 329 ## duplicated in ssh-emacs-setup
 330 # done here so its setup earlier for convenience
 331 line='AcceptEnv INSIDE_EMACS BRC COLUMNS'
 332 f=/etc/ssh/sshd_config
 333 grep -xFq "$line" $f || tee -a $f <<<"$line"
 334
 335
 336 # default debian groups (jessie through buster) + adm, root, admin
 337 for g in cdrom floppy audio dip video plugdev netdev adm sudo admin; do
 338   if getent group $g >/dev/null; then
 339     usermod -aG $g iank
 340   fi
 341 done
 342
 343 if getent group systemd-journal >/dev/null; then
 344   usermod -aG systemd-journal iank
 345 fi
 346 EOFOUTER
 347
 348 rm -f $target/etc/resolv.conf
 349 ln -s ../run/systemd/resolve/stub-resolv.conf $target/etc/resolv.conf
 350 # needed for bitfolk image
 351 if [[ -e /a/bin/fai/fai-wrapper ]]; then
 352   systemctl enable systemd-resolved
 353   systemctl start systemd-resolved
 354 fi
 355
 356
 357
 358 # reading through the groups that iank is in but user2 isn't,
 359 for g in plugdev audio video cdrom; do
 360   $ROOTCMD usermod -a -G $g user2
 361 done
 362
 363 ## begin get new kernel and btrfs-progs ##
 364 case $HOSTNAME in
 365   sy|so)
 366     # on sy t11, severe wifi degredation on 6.8
 367     # on so t11, no x11 display on 6.8
 368     $FAI/distro-install-common/install-mainline-kernel-debs stable
 369     ;;
 370   *)
 371     if ! $ROOTCMD dpkg -s -- freesh-archive-keyring  2>&1 | grep -Fx "Status: install ok installed" &>/dev/null; then
 372       apt-get -y install wget
 373       wget -O /target/tmp/x.deb https://linux-libre.fsfla.org/pub/linux-libre/freesh/pool/main/f/freesh-archive-keyring/freesh-archive-keyring_1.1_all.deb
 374       $ROOTCMD dpkg -i /tmp/x.deb
 375       $ROOTCMD apt-get update
 376       $ROOTCMD apt-get -y install linux-libre
 377     fi
 378     ;;
 379 esac
 380
 381 pre=https://mirrors.edge.kernel.org/pub/linux/kernel/people/kdave/btrfs-progs
 382 tarball=$(curl -s $pre/sha256sums.asc \
 383             | awk '$2 ~ /^btrfs-progs-v/ { print $2 }' | grep -v -- -rc | grep "^btrfs-progs-v.*gz\$" | sort -V | tail -n1)
 384 url="$pre/$tarball"
 385 dir=${tarball%.tar.gz}
 386 ver=${dir#btrfs-progs-}
 387 cur_ver=$($ROOTCMD btrfs --version 2>/dev/null | awk '{print $2}') ||:
 388
 389 if [[ $FAI_ROOT == / ]]; then
 390   bp_dir=/a/opt/btrfs-progs-release
 391 else
 392   bp_dir=$FAI/distro-install-common/btrfs-progs-release
 393 fi
 394 if [[ $ver != "$cur_ver" ]]; then
 395   if [[ $ver != "$($bp_dir/btrfs --version 2>/dev/null | awk '{print $2}')" ]]; then
 396     cd $target/tmp
 397     wget $url
 398     tar xzf $tarball
 399     $ROOTCMD apt-get -y build-dep btrfs-progs
 400     # no docs cuz I didn't want to bother fixing error of missing docs dependencies
 401     $ROOTCMD bash -xe <<EOF
 402 cd /tmp/${tarball%.tar.gz}
 403 ./configure --disable-documentation
 404 make
 405 make install
 406 EOF
 407     # If our desktop is HOST2, will we btrbk this latest bprogs to other
 408     # machines.
 409     if [[ -s /a/bin/bash_unpublished/source-state ]]; then
 410       source /a/bin/bash_unpublished/source-state
 411     fi
 412     if [[ $HOST2 == "$HOSTNAME" && $FAI_ROOT != / ]]; then
 413       rm -rf $bp_dir
 414       chown -R iank:iank $target/tmp/${tarball%.tar.gz}
 415       mv $target/tmp/${tarball%.tar.gz} $bp_dir
 416     fi
 417   else
 418     if ! $ROOTCMD dpkg -s -- build-essential  2>&1 | grep -Fx "Status: install ok installed" &>/dev/null; then
 419       $ROOTCMD apt-get -y install build-essential
 420     fi
 421
 422     if [[ $FAI_ROOT == / ]]; then
 423       cd /a/opt/btrfs-progs-release
 424       make install
 425     else
 426       mkdir -p $target/tmp/bprogs
 427       mount -o bind $bp_dir $target/tmp/bprogs
 428       $ROOTCMD bash -xe <<EOF
 429 cd /tmp/bprogs
 430 make install
 431 EOF
 432     fi
 433   fi
 434 fi
 435 ## end get new kernel and btrfs-progs ##