2 # Copyright (C) 2018 Ian Kelling
4 # This program is free software; you can redistribute it and/or
5 # modify it under the terms of the GNU General Public License
6 # as published by the Free Software Foundation; either version 2
7 # of the License, or (at your option) any later version.
9 # This program is distributed in the hope that it will be useful,
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 # GNU General Public License for more details.
14 # You should have received a copy of the GNU General Public License
15 # along with this program; if not, write to the Free Software
16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
18 x
="$(readlink -f "$BASH_SOURCE")"; source "${x%/*}/bash-trace"
20 [[ $EUID == 0 ]] ||
exec sudo
-E "${BASH_SOURCE[0]}" "$@"
25 usage: ${0##*/} [-h|--help] [BASE_CODENAME] [ARCH]
26 install fai-server on the current machine
28 Initial setup of a fai server. works on localhost. Set's the current ip
29 as the tftp server. I vaguely remember that using a hostname does not
30 work. Separate from running this, faiserver needs to be setup in dns to
31 point to whatever host this is run on.
33 Default BASE_CODENAME is bookworm. Default ARCH is 64. The script expects corresponding
34 $BASEFILE_DIR/${UPCASED_BASE_CODENAME}${ARCH}.tar.(zst|xz) to exist, and it must have been
35 generated around the same time as the nfsroot, at least so it has the
38 for copying and running this on a remote server,
40 scp $(readlink -f ~/.ssh/home.pub) SERVER:.ssh
41 scp /a/bin/cedit/cedit SERVER:/usr/local/bin
42 # todo: make the above key be an option
45 Note: there is a bug in 5.9.4, fixed by adding
48 Note: in t9, there is a bug in recent fai packages (eg 2021+), where
49 unshare uses a too new argument. I was able to fix it by
50 just going to the site of the error and changing unshare to
51 chroot like it used to be, but I'm not bothering to make
52 any persistent fix, since I'm now on t10. If it ever came
53 up again, using an old fai package would also work.
54 /usr/sbin/fai-make-nfsroot:503, before apt-get update
65 e
() { echo "+ $@"; "$@"; }
71 if [[ $base == [[:upper
:]] ]]; then
72 echo $0: error
: use lowercase base
76 basefile
=($BASEFILE_DIR/${base^^}${arch^^}.
tar.zst
)
77 sed="sed -ri --follow-symlinks"
79 if [[ ! -e $basefile ]]; then
80 printf "%s\n" "$0: error basefile=$basefile does not exist" >&2
84 if [[ ! -d $BASEFILE_DIR ]]; then
85 printf "%s\n" "$0: error BASEFILE_DIR=$BASEFILE_DIR does not exist" >&2
90 if ! type -p wget
&>/dev
/null
; then
91 apt-get
install -y wget
95 [[ $
(dpkg
--print-architecture) == armhf
]]
98 # fai on ubuntu only has official support using the universe repo, but newer
99 # tends to have less bugs.
100 wget
-O - https
://fai-project.org
/download
/fai-project.gpg | sudo
dd of
=/etc
/apt
/trusted.gpg.d
/fai-project.gpg
104 stretch|buster|bullseye|bookworm
)
105 if ! grep -qFx "deb https://fai-project.org/download $base koeln" /etc
/apt
/sources.list.d
/fai.list
; then
108 cat >/etc
/apt
/sources.list.d
/fai.list
<<EOF
109 deb https://fai-project.org/download $base koeln
113 echo "$0: error: script needs updating for new base" >&2
118 f
=/var
/cache
/apt
/pkgcache.bin
;
120 cachetime
=$
(stat
-c %Y
$f );
122 limittime
=$
(( now
- 60*60*2 ))
123 if (( cachetime
> limittime
)); then
132 # Relevant packages from fai-quickstart depends and fai-server recommends.
133 # I especially do not wait isc-dhcp-server or an inetd. Also excludes
134 # nfs-kernel-server. On an android chroot, we don\'t have nfs in the
135 # kernel, or the ability to install it.
136 # xorriso is for running fai-cd -a, not strictly need for fai-server
137 # perl-tk is for fai-monitor-gui
138 # mtools is for fai-cd
139 pkgs
=(fai-doc tftpd-hpa
tar reprepro squashfs-tools binutils xorriso perl-tk mtools
)
140 if modprobe nfsd
&>/dev
/null
; then
141 pkgs
+=(nfs-kernel-server
)
147 e apt-get
install -y ${pkgs[@]}
148 # confnew since we edit /etc/fai/NFSROOT in an automated way
149 # fai-client is already a fai-server dependency, but make sure it gets upgraded
150 e apt-get
install --no-install-recommends -y -o Dpkg
::Options
::=--no-force-confdef -o Dpkg
::Options
::=--force-confnew fai-server fai-client
152 r
=http
://http.us.debian.org
/debian
153 # like default, but scrap httpredir, and nonfree.
154 # All my systems should be able to get along without nonfree
155 # for a base working system afaik.
157 cat >/etc
/fai
/apt
/sources.list
<<EOF
158 deb $r $base main contrib
161 ### begin setup security repo ###
164 cat >>/etc
/fai
/apt
/sources.list
<<EOF
165 deb http://security.debian.org/debian-security $base/updates main contrib
169 # new naming convention
170 cat >>/etc
/fai
/apt
/sources.list
<<EOF
171 deb http://security.debian.org/debian-security $base-security main contrib
174 ### end setup security repo ###
177 cat >>/etc
/fai
/apt
/sources.list
<<EOF
178 # use fai repo. it's commented in the defaults. it's got bug fixes.
179 # and may contain newer packages.
180 deb http://fai-project.org/download $base koeln
183 ## Get latest kernel and btrfs for dealing with btrfs issues.
184 # if [[ $base == buster ]]; then
185 # cat >>/etc/fai/apt/sources.list <<'EOF'
186 # deb http://ftp.debian.org/debian buster-backports main
188 # # note, fai doesn\'t look at /etc/fai/apt/preferences.d
189 # cat >/etc/fai/apt/preferences <<'EOF'
190 # Package: linux-* firmware-linux-free btrfs-progs
191 # Pin: release a=buster-backports
197 if [[ -s /q
/root
/shadow
/standard
]]; then
198 $sed -f - /etc
/fai
/nfsroot.conf
<<EOF
199 $ a FAI_ROOTPW='$(</q/root/shadow/standard)'
204 $sed -f - /etc
/fai
/nfsroot.conf
<<EOF
205 $ a SSH_IDENTITY=/root/.ssh/home.pub
207 s,^( *FAI_DEBOOTSTRAP=).*,\1"$base $r",
208 # add --arch amd64. this is needed on arm system which is
209 # used to install amd64 clients. On amd64 servers, it's redundant.
210 # disabled for now, since creating fai nfsroot on my arm machine
212 #/--arch amd64/!s/^(\s*FAI_DEBOOTSTRAP_OPTS=")/\1--arch amd64 /
215 $sed 's/#LOGUSER/LOGUSER/' /etc
/fai
/fai.conf
216 $sed -i '/^LOGUSER=/d' /etc
/fai
/fai.conf
217 $sed -i '/^FAI_FLAGS=/d' /etc
/fai
/fai.conf
218 echo "FAI_FLAGS=verbose" >>/etc
/fai
/fai.conf
219 # note if this isnt set, the user isnt created
220 echo "LOGUSER=fai" >>/etc
/fai
/fai.conf
222 # from man fai-make-nfsroot,
223 # figured out after partitioning ignored my crypt partition
226 cedit
/etc
/fai
/NFSROOT
<<'EOF' || [[ $? == 1 ]]
227 # inserted by faserver-setup
230 # default one is linux-image-server, doesnt exist anymore
232 # default is btrfs-tools which doesnt exist anymore
235 # got an error in error.log about not having gpg.
236 # system seemed to still install ok, so i havent tested if this fixes it.
244 # background: Can't build the nfsroot on my arm system now. First,
245 # fai-make-nfsroot won't work out of the box. One idea to make it work
246 # is by installing qemu-user-static, then copying qemu-x86_64-static
247 # into the nfsroot, and prepending it to chroot commands in
248 # fai-make-nfsroot, but that fails in odd ways. ls has permissions
249 # problems on reading directories, various programs segfault
250 # immediately, cat can't open a file, etc.
252 NFSROOT
=/srv
/fai
/nfsroot
253 TFTPROOT
=/srv
/tftp
/fai
255 # test if our copy of setup_tftp has changed in fai-make-nfsroot,
256 # and if not, run it.
263 pxebin
=$NFSROOT/usr
/lib
/syslinux
/pxelinux
.0
265 rm -f $NFSROOT/boot
/*.bak
266 mkdir
-p $TFTPROOT/pxelinux.cfg
267 if ! chmod a
+r
$NFSROOT/boot
/initrd.img-
*; then
268 echo "$0: error: No initrd was created. Check the package name of the linux-image package in /etc/fai/NFSROOT."
271 cp -p $v $NFSROOT/boot
/vmlinu?
-* $NFSROOT/boot
/initrd.img-
* $TFTPROOT
272 cp -u $pxebin $TFTPROOT
273 if [ -f $NFSROOT/usr
/lib
/syslinux
/modules
/bios
/ldlinux.c32
]; then
274 cp -u $NFSROOT/usr
/lib
/syslinux
/modules
/bios
/ldlinux.c32
$TFTPROOT
276 if [ X
$verbose = X1
]; then
277 echo "TFTP environment prepared. Enable DHCP and start the TFTP daemon on root $TFTPROOT."
280 diff -u <(type setup_tftp
) <(cat <(sed -n '/^setup_tftp(){/,/^}/p' $
(which fai-make-nfsroot
) ) - <<'EOF' |bash
286 # -g causes skipping set_root_pw() in fai-make-nfsroot, -ag
287 # is the only way to make it run without chrooting. the options
288 # seem contradictory, but it works.
292 # note, this copies the -B arg to
293 # /srv/fai/nfsroot/var/tmp/base.tar.xz
294 e fai-setup
-evf -B $basefile
295 # fai-setup expert mode avoids writing to /var/log/fai/variables
296 # at least config_src is needed for autodiscover
299 # lld /var/log/fai/remote-logs:
300 # d 750 fai nogroup 100 08-07 08:51 pm /var/log/fai/remote-logs
301 # We could change the group or something, but why not just give me more permissions :)
302 e usermod
-a -G nogroup iank
303 $sed '/^FAI_CONFIGDIR|^FAI_CONFIG_SRC|^LOGUSER/d' /var
/log
/fai
/variables
304 tee -a /var
/log
/fai
/variables
<<'EOF'
306 FAI_CONFIGDIR=/srv/fai/config
307 FAI_CONFIG_SRC=nfs://faiserver/srv/fai/config
309 # make the faiserver also the apt proxy server
310 # apt-get -y install apt-cacher-ng
313 rm -f /srv
/fai
/nfsroot
/root
/.ssh
/known_hosts
314 if [[ $HOSTNAME == kd
]]; then
315 keyscan_arg
="-p 8989"
317 key
=$
(ssh-keyscan
$keyscan_arg localhost |
& grep -o "ecdsa-sha2-nistp256.*")
318 for ip
in faiserver $
(ip addr show up|
grep -w '^ *inet' |
awk '{print $2}'| cut
-d / -f 1 |
grep -vF 127.0.0.1); do
319 echo "$ip $key" >>/srv
/fai
/nfsroot
/root
/.ssh
/known_hosts
322 # make it the root because pxe-kexec only looks there.
323 # It wouldn't be too hard to change if we needed.
324 # We could also just dump things in /srv/tftp, but fai
325 # has some defaults, which I don't even use, which expect
326 # the other directory, so it's kind of a tossup, whatever.
327 # This means fai's example isc-dhcp-server filename directory should remove the fai/ prefix.
328 sed -ri 's,^ *(TFTP_DIRECTORY=).*,\1"/srv/tftp/fai",' /etc
/default
/tftpd-hpa
329 systemctl restart tftpd-hpa
334 # https://wiki.archlinux.org/index.php/working_with_the_serial_console
335 # at runtime, running this from ssh worked:
336 # https://unix.stackexchange.com/questions/242778/what-is-the-easiest-way-to-configure-serial-port-on-linux
337 # stty -F /dev/ttyS0 115200 cs8 -cstopb -parenb
338 # /sbin/agetty 115200 ttyS0 linux
339 # dated info, but validation that this might work on debian:
340 # https://help.ubuntu.com/community/SerialConsoleHowto
341 # note in the nfsroot, systemd is not running.
342 echo "c0:2345:respawn:/sbin/agetty 115200 ttyS0 linux" >>/srv
/fai
/nfsroot
/etc
/inittab
344 # initially did the basic fai-chboot -Iv $std_arg default
345 # but found in console that it wanted to mount nfsroot
346 # to be the same as my dhcp server.
347 # Figured out to change the root= parameter from googling,
348 # and seeing fai-chboot -L
349 # using hostname failed.
350 # for -f, combined the 2 defaults so it will reboot and print to screen.
352 # Add debug to -f flag for more verbose output.
355 # background on choosing apt-cacher-ng:
356 # googling around a bit finds 2 main solutions:
357 # http://askubuntu.com/questions/3503/best-way-to-cache-apt-downloads-on-a-lan
358 # apt-cacher-ng doesn\'t have zeroconf.
359 # It touts having minimal dependencies, but I don\'t care.
360 # The downside to squid-deb-proxy is that it\'s config is for specific repos,
361 # you have to add all the repos you use.
362 # That is the main reason I use apt-cacher-ng.
363 # It has a web portal, at http://faiserver:3142/acng-report.html
366 # random fai note: as far as I can tell, profiles are just for putting
367 # in a selectable boot menu, which I don\'t want.
369 # the logsave prompted because the hostname faiserver was uknown.
370 # Here it was faiserver.lan when running from a faiserver vm.
371 # When running from a normal host with faiserver alias, it was the normal hosts name.
372 $sed 's/(^[^,]+,)\S+/\1faiserver/' /srv
/fai
/nfsroot
/root
/.ssh
/known_hosts
373 # ditch the logo banner up top which screws with less.
374 touch /srv
/fai
/nfsroot
/.nocolorlogo