iankelling.org Git - automated-distro-installer/blob - fai/config/scripts/IANK/11-iank

   1 #!/bin/bash -x
   2 # This file is part of Ian Kelling's automated-distro-installer
   3 # Copyright (C) 2024 Ian Kelling
   4
   5 # This program is free software; you can redistribute it and/or
   6 # modify it under the terms of the GNU General Public License
   7 # as published by the Free Software Foundation; either version 2
   8 # of the License, or (at your option) any later version.
   9
  10 # This program is distributed in the hope that it will be useful,
  11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 # GNU General Public License for more details.
  14
  15 # You should have received a copy of the GNU General Public License
  16 # along with this program; if not, write to the Free Software
  17 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  18
  19 set -eE -o pipefail
  20 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
  21
  22 if [[ $EUID != 0 ]]; then
  23   echo "$0: error: expected to be root."
  24   exit 1
  25 fi
  26
  27 # ignore this line. hack to make shellcheck ignore $target
  28 if [[ ! $target ]]; then target=; fi
  29
  30 if ! type -t fcopy &>/dev/null; then
  31   sudo apt-get -y install fai-client
  32 fi
  33
  34 # -r = recursive
  35 # -i = ignore non-matching class warnings, always exit 0
  36 # -B = no backup files
  37 fcopy -riB /boot
  38 # this is also done by FAIBASE/10-misc by default (without B)
  39 fcopy -riB /usr/local/bin
  40
  41 fcopy -riB /etc/apt/logind.conf.d
  42
  43 # this gets done by fai, but just happens too often that
  44 # I add sources due to new distros, whatever.
  45 fcopy -riB /etc/apt/preferences.d
  46 fcopy -riB /etc/apt/sources.list.d
  47
  48
  49 src=$FAI/distro-install-common/shadow
  50 dst=/q/root/shadow
  51 if [[ ! -e $dst && -e $src ]]; then
  52   # outside of fai context, we skip this
  53   mkdir -p $dst
  54   mount -o bind $src $dst
  55 fi
  56
  57
  58
  59 $FAI/distro-install-common/end
  60
  61
  62
  63 ### begin sources install + updates
  64 # these get copied in an earlier stage by fai, but leaving it here since
  65 # I run this as a single post-fai script to update things that have changed.
  66 tmpfile1=$(mktemp)
  67 # this can fail if we need an apt update
  68 $ROOTCMD /usr/bin/apt-cache policy >$tmpfile1 ||:
  69 fcopy -riB /etc/apt
  70
  71 tmpfile2=$(mktemp)
  72 $ROOTCMD /usr/bin/apt-cache policy >$tmpfile2
  73 if ! diff -q $tmpfile1 $tmpfile2; then
  74   $ROOTCMD /usr/bin/apt update
  75 fi
  76 # outside of fai, this seems to regularly lead to
  77 # E: Could not get lock /var/lib/apt/lists/lock - open (11: Resource temporarily unavailable)
  78 # so add a sleep. 1 sec is probably way more than needed.
  79 sleep 1
  80 f=$FAI_ROOT/var/cache/apt/pkgcache.bin
  81 if [[ ! -r $f ]] || (( $(( $(date +%s) - $(stat -c %Y $f ) )) > 60*60*2 )); then
  82   i=0
  83   while fuser $FAI_ROOT/var/lib/dpkg/lock &>/dev/null; do
  84     sleep 1
  85     i=$(( i+1 ))
  86     if (( i > 300 )); then
  87       echo "error: timed out waiting for /var/lib/dpkg/lock" >&2
  88       exit 1
  89     fi
  90     $ROOTCMD apt-get update
  91   done
  92 fi
  93 ### end sources install + updates
  94
  95
  96 #### misc configurations
  97
  98 if [[ $FAI_ACTION != dirinstall ]] && ! ifclass NOCRYPT; then
  99   if ifclass LINODE; then
 100     speed=19200
 101     cmdline="rd.luks.crypttab=no net.ifnames=0 console=ttyS0,${speed}n8"
 102   else
 103     speed=115200
 104     cmdline="rd.luks.crypttab=no net.ifnames=0 console=ttyS0,${speed}n8 console=tty0"
 105     case $HOSTNAME in
 106       kd)
 107         fcopy -v /usr/bin/myncq
 108
 109         cat >$target/etc/systemd/system/myncq.service <<'EOF'
 110 [Unit]
 111 Description=fix ncq errors
 112
 113 [Service]
 114 Type=oneshot
 115 ExecStart=/usr/bin/myncq
 116 TimeoutStartSec=20
 117
 118 [Install]
 119 # https://www.enricozini.org/blog/2017/debian/systemd-07-devices/
 120 WantedBy=dev-disk-by\x2did-ata\x2dSamsung_SSD_870_QVO_8TB_S5VUNG0N900656V.device
 121 EOF
 122
 123         $ROOTCMD bash <<'EOFOUTER'
 124 systemctl enable myncq.service
 125 /usr/bin/myncq no-upgrub
 126 EOFOUTER
 127
 128         ;;&
 129       # per rubens suggestion to make a d16 more stable
 130       kd|kw) cmdline+=" pci=realloc=off" ;;
 131     esac
 132   fi
 133
 134 fi ##### end != dirinstall && != NOCRYPT
 135
 136
 137 ###### begin network setup ####
 138
 139 # use old names. the idea of them changing between boots has never
 140 # happened to me and I usually only have 1 wired or other type.
 141 # If I ever do need to care about it, I will.
 142 # Strangely this didn't work on kw, so I added kernel cmdline parameter.
 143 # https://www.freedesktop.org/wiki/Software/systemd/PredictableNetworkInterfaceNames/
 144 ln -sf /dev/null $target/etc/systemd/network/99-default.link
 145
 146
 147 # bitfolk installer handles the rest
 148 case $HOSTNAME in
 149   bk|je) exit 0 ;;
 150 esac
 151
 152
 153 # bug fix, somewhere between t9's xorg 1.19.6
 154 # and 1.20.1-3ubuntu2
 155 #  xserver-xorg-video-nouveau                 1:1.0.15-3
 156 # xorg stopped load nouveau
 157 #  https://www.linuxquestions.org/questions/slackware-14/kernel-modules-conflicting-with-nouveau-driver-4175623867/
 158 # https://nouveau.freedesktop.org/InstallNouveau.html
 159 # And now in t11, things got worse with a newer card also not loading
 160 # nouveau when it did in t10.
 161 if lspci|grep -q 'VGA compatible controller: NVIDIA'; then
 162   mkdir -p $target/etc/X11/xorg.conf.d/
 163   cat >$target/etc/X11/xorg.conf.d/10-nouveau.conf <<'EOF'
 164 Section "Device"
 165 Identifier "Device0"
 166 Driver "nouveau"
 167 EndSection
 168 EOF
 169 fi
 170
 171 # use networkmanager if this host has wireless.
 172 if [[ $(iw dev) ]]; then
 173   $ROOTCMD bash -xe <<EOF
 174 apt-get -y install network-manager
 175 EOF
 176
 177   # allow networkmanager to manage interfaces
 178   #https://bugs.launchpad.net/ubuntu/+source/network-manager/+bug/1638842
 179   touch $target/etc/NetworkManager/conf.d/10-globally-managed-devices.conf
 180   # in a default desktop install, it looks like netplan creates this file under
 181   # run/NetworkManager/conf.d in early boot.
 182
 183   # By default, dns=default is set in etiona, and dns is just broken.
 184   # Maybe with resolvconf it would work, but theres no need for that.
 185   # https://wiki.gnome.org/Projects/NetworkManager/DNS
 186   cat >$target/etc/NetworkManager/conf.d/99-iank.conf <<'EOF'
 187 [main]
 188 dns=systemd-resolved
 189 EOF
 190
 191
 192   if [[ ! $FAI_WRAPPER || $SSH_CLIENT ]]; then
 193     # for running from fai or remote connections, don't kill the internet
 194     ethusb_arg=-c
 195   fi
 196   if [[ $(dig +short @10.2.0.1 -x 10.2.0.2 2>&1 ||:) == kd.b8.nz. ]] \
 197        && ip n show 10.2.0.1 | grep . &>/dev/null; then
 198     # we are at_home
 199     $FAI/distro-install-common/ethusb-static $ethusb_arg
 200   else
 201     $FAI/distro-install-common/ethusb-static off $ethusb_arg
 202   fi
 203
 204
 205 else
 206   cat > $target/etc/network/interfaces <<-EOF
 207 # generated by FAI
 208 auto lo eth0
 209 iface lo inet loopback
 210 iface eth0 inet dhcp
 211 iface eth0 inet6 auto
 212
 213 source-directory /etc/network/interfaces.d
 214 EOF
 215
 216   # previously had an else condition after
 217   #elif ifclass VM || ifclass LINODE; then
 218   # iface $NIC1 inet manual
 219   # iface br0 inet dhcp
 220   #   bridge_ports $NIC1
 221   #   bridge_stp off
 222   #   bridge_maxwait 0
 223   # however, on t9, on startup, br0, became
 224   # rename1 and didn't come up. i dunno why,
 225   # but the bridge is for vms that I rarely use,
 226   # so not bothering to figure it out.
 227
 228
 229 fi
 230
 231 if ifclass LINODE; then
 232   mkdir -p $target/etc/initramfs-tools/conf.d
 233   # shellcheck disable=SC2154 # comes with LINODE environment
 234   cat >$target/etc/initramfs-tools/conf.d/mine <<EOF
 235 # dhcp in initramfs doesn't work on linode. i dunno why, whatever.
 236 # man 5 initramfs.conf
 237 # /usr/share/doc/klibc-utils/README.ipconfig.gz
 238 # /usr/share/initramfs-tools/scripts/functions
 239 IP=$linode_ip::$linode_gw:255.255.255.0::eth0:off
 240 EOF
 241
 242
 243   if [[ $HOSTNAME == li ]]; then
 244     cat > $target/etc/network/interfaces <<-EOF
 245 # generated by FAI
 246 auto lo eth0
 247 iface lo inet loopback
 248 iface eth0 inet dhcp
 249 # for the standard network config, uncomment this and comment the lines after it.
 250 #iface eth0 inet6 auto
 251
 252 iface eth0 inet6 static
 253 # this is really a /128. it seems like we need to assign it for ipv6 to work.
 254 address 2600:3c00::f03c:91ff:fe6d:baf8/64
 255 gateway fe80::1
 256
 257 iface eth0 inet6 static
 258 # from a requested /64 pool
 259 address 2600:3c00:e000:280::2/64
 260
 261 source-directory /etc/network/interfaces.d
 262 EOF
 263   fi
 264 fi
 265
 266
 267 ##### end network setup  #####
 268
 269
 270 if ifclass VOL_BULLSEYE_BOOTSTRAP || ifclass VOL_BOOKWORM_BOOTSTRAP; then
 271   fcopy /etc/systemd/system/faicheck.service
 272   $ROOTCMD bash <<'EOFOUTER'
 273 systemctl enable faicheck.service
 274 EOFOUTER
 275   exit 0 # avoid unnecessary stuff in bootstrap vol
 276 fi
 277
 278
 279 ## misc settings
 280 $ROOTCMD bash <<'EOFOUTER'
 281 #### begin .ssh setup ###
 282 set -x
 283 set -eE -o pipefail
 284 if ! [[ -s /home/iank/.ssh/authorized_keys ]]; then
 285   mkdir -p /home/iank/.ssh
 286   f=/root/.ssh/authorized_keys
 287   if [[ -e $f ]]; then
 288      cp $f /home/iank/.ssh
 289   fi
 290   chown -R 1000:1000 /home/iank/.ssh
 291   chmod -R u=Xrw,og= /home/iank/.ssh
 292   rm -rf /root/.ssh
 293   # remove broken symlinks or the following cp will fail
 294   find /home/iank/.ssh -xtype l -exec rm '{}' \;
 295   cp -rL /home/iank/.ssh /root
 296   chown -R root:root /root/.ssh
 297   chmod 700 /root/.ssh
 298 fi
 299
 300 # old link from
 301 # # https://ticktockhouse.svbtle.com/my-obligatory-ubuntu-ssh-agent-post
 302 # but that made a service that started too soon and didn't pick up our
 303 # x env vars. instead, copy from the root ssh-agent just the
 304 # appropriate things into a new service.
 305
 306 rm -f /home/iank/.local/share/systemd/user/sshaiank.service \
 307   /home/iank/.config/systemd/user/default.target.wants/sshaiank.service
 308
 309 #### end .ssh setup ###
 310
 311 ## duplicated in ssh-emacs-setup
 312 # done here so its setup earlier for convenience
 313 line='AcceptEnv INSIDE_EMACS BRC COLUMNS'
 314 f=/etc/ssh/sshd_config
 315 grep -xFq "$line" $f || tee -a $f <<<"$line"
 316
 317
 318 # default debian groups (jessie through buster) + adm, root, admin
 319 for g in cdrom floppy audio dip video plugdev netdev adm sudo admin; do
 320   if getent group $g >/dev/null; then
 321     usermod -aG $g iank
 322   fi
 323 done
 324
 325 if getent group systemd-journal >/dev/null; then
 326   usermod -aG systemd-journal iank
 327 fi
 328 EOFOUTER
 329
 330 rm -f $target/etc/resolv.conf
 331 ln -s ../run/systemd/resolve/stub-resolv.conf $target/etc/resolv.conf
 332 # needed for bitfolk image
 333 if [[ -e /a/bin/fai/fai-wrapper ]]; then
 334   systemctl enable systemd-resolved
 335   systemctl start systemd-resolved
 336 fi
 337
 338
 339
 340 # reading through the groups that iank is in but user2 isn't,
 341 for g in plugdev audio video cdrom; do
 342   $ROOTCMD usermod -a -G $g user2
 343 done
 344
 345 ## begin get new kernel and btrfs-progs ##
 346 case $HOSTNAME in
 347   sy|so)
 348     # on sy t11, severe wifi degredation on 6.8
 349     # on so t11, no x11 display on 6.8
 350     $FAI/distro-install-common/install-mainline-kernel-debs stable
 351     ;;
 352   *)
 353     if ! $ROOTCMD dpkg -s -- freesh-archive-keyring  2>&1 | grep -Fx "Status: install ok installed" &>/dev/null; then
 354       apt-get -y install wget
 355       wget -O /target/tmp/x.deb https://linux-libre.fsfla.org/pub/linux-libre/freesh/pool/main/f/freesh-archive-keyring/freesh-archive-keyring_1.1_all.deb
 356       $ROOTCMD dpkg -i /tmp/x.deb
 357       $ROOTCMD apt-get update
 358       $ROOTCMD apt-get -y install linux-libre
 359     fi
 360     ;;
 361 esac
 362
 363 pre=https://mirrors.edge.kernel.org/pub/linux/kernel/people/kdave/btrfs-progs
 364 tarball=$(curl -s $pre/sha256sums.asc \
 365             | awk '$2 ~ /^btrfs-progs-v/ { print $2 }' | grep -v -- -rc | grep "^btrfs-progs-v.*gz\$" | sort -V | tail -n1)
 366 url="$pre/$tarball"
 367 dir=${tarball%.tar.gz}
 368 ver=${dir#btrfs-progs-}
 369 cur_ver=$($ROOTCMD btrfs --version 2>/dev/null | awk '{print $2}') ||:
 370
 371 if [[ $FAI_ROOT == / ]]; then
 372   bp_dir=/a/opt/btrfs-progs-release
 373 else
 374   bp_dir=$FAI/distro-install-common/btrfs-progs-release
 375 fi
 376 if [[ $ver != "$cur_ver" ]]; then
 377   if [[ $ver != "$($bp_dir/btrfs --version 2>/dev/null | awk '{print $2}')" ]]; then
 378     cd $target/tmp
 379     wget $url
 380     tar xzf $tarball
 381     $ROOTCMD apt-get -y build-dep btrfs-progs
 382     # no docs cuz I didn't want to bother fixing error of missing docs dependencies
 383     $ROOTCMD bash -xe <<EOF
 384 cd /tmp/${tarball%.tar.gz}
 385 ./configure --disable-documentation
 386 make
 387 make install
 388 EOF
 389     # If our desktop is HOST2, will we btrbk this latest bprogs to other
 390     # machines.
 391     if [[ -s /a/bin/bash_unpublished/source-state ]]; then
 392       source /a/bin/bash_unpublished/source-state
 393     fi
 394     if [[ $HOST2 == "$HOSTNAME" && $FAI_ROOT != / ]]; then
 395       rm -rf $bp_dir
 396       chown -R iank:iank $target/tmp/${tarball%.tar.gz}
 397       mv $target/tmp/${tarball%.tar.gz} $bp_dir
 398     fi
 399   else
 400     if ! $ROOTCMD dpkg -s -- build-essential  2>&1 | grep -Fx "Status: install ok installed" &>/dev/null; then
 401       $ROOTCMD apt-get -y install build-essential
 402     fi
 403
 404     if [[ $FAI_ROOT == / ]]; then
 405       cd /a/opt/btrfs-progs-release
 406       make install
 407     else
 408       mkdir -p $target/tmp/bprogs
 409       mount -o bind $bp_dir $target/tmp/bprogs
 410       $ROOTCMD bash -xe <<EOF
 411 cd /tmp/bprogs
 412 make install
 413 EOF
 414     fi
 415   fi
 416 fi
 417 ## end get new kernel and btrfs-progs ##