2 # Copyright (C) 2018 Ian Kelling
4 # This program is free software; you can redistribute it and/or
5 # modify it under the terms of the GNU General Public License
6 # as published by the Free Software Foundation; either version 2
7 # of the License, or (at your option) any later version.
9 # This program is distributed in the hope that it will be useful,
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 # GNU General Public License for more details.
14 # You should have received a copy of the GNU General Public License
15 # along with this program; if not, write to the Free Software
16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
18 set -e; .
/usr
/local
/lib
/bash-bear
; set +e
20 [[ $EUID == 0 ]] ||
exec sudo
-E "${BASH_SOURCE[0]}" "$@"
25 usage: faiserver-setup [-h|--help] [BASE_CODENAME] [ARCH]
26 install fai-server on the current machine
28 Initial setup of a fai server. works on localhost. Set's the current ip
29 as the tftp server. I vaguely remember that using a hostname does not
30 work. Separate from running this, faiserver needs to be setup in dns to
31 point to whatever host this is run on.
33 Default BASE_CODENAME is bookworm. Default ARCH is 64. The script expects corresponding
34 $BASEFILE_DIR/${UPCASED_BASE_CODENAME}${ARCH}.tar.(zst|xz) to exist, and it must have been
35 generated around the same time as the nfsroot, at least so it has the
38 for copying and running this on a remote server,
40 scp $(readlink -f ~/.ssh/home.pub) SERVER:.ssh
41 scp /a/bin/cedit/cedit SERVER:/usr/local/bin
42 # todo: make the above key be an option
45 Note: there is a bug in 5.9.4, fixed by adding
48 Note: in t9, there is a bug in recent fai packages (eg 2021+), where
49 unshare uses a too new argument. I was able to fix it by
50 just going to the site of the error and changing unshare to
51 chroot like it used to be, but I'm not bothering to make
52 any persistent fix, since I'm now on t10. If it ever came
53 up again, using an old fai package would also work.
54 /usr/sbin/fai-make-nfsroot:503, before apt-get update
65 e
() { echo "+ $*"; "$@"; }
71 if [[ $base == [[:upper
:]] ]]; then
72 echo $0: error
: use lowercase base
76 basefile
=$BASEFILE_DIR/${base^^}${arch^^}.
tar.zst
77 sed="sed -ri --follow-symlinks"
79 if [[ ! -e $basefile ]]; then
80 printf "%s\n" "$0: error basefile=$basefile does not exist" >&2
84 if [[ ! -d $BASEFILE_DIR ]]; then
85 printf "%s\n" "$0: error BASEFILE_DIR=$BASEFILE_DIR does not exist" >&2
90 if ! type -p wget
&>/dev
/null
; then
91 apt-get
install -y wget
95 [[ $
(dpkg
--print-architecture) == armhf
]]
98 # fai on ubuntu only has official support using the universe repo, but newer
99 # tends to have less bugs.
100 wget
-O - https
://fai-project.org
/download
/fai-project.gpg | sudo
dd of
=/etc
/apt
/trusted.gpg.d
/fai-project.gpg
104 stretch|buster|bullseye|bookworm
)
105 if ! grep -qFx "deb https://fai-project.org/download $base koeln" /etc
/apt
/sources.list.d
/fai.list
; then
108 cat >/etc
/apt
/sources.list.d
/fai.list
<<EOF
109 deb https://fai-project.org/download $base koeln
113 echo "$0: error: script needs updating for new base" >&2
118 f
=/var
/cache
/apt
/pkgcache.bin
;
120 cachetime
=$
(stat
-c %Y
$f );
122 limittime
=$
(( now
- 60*60*2 ))
123 if (( cachetime
> limittime
)); then
132 # Relevant packages from fai-quickstart depends and fai-server recommends.
133 # I especially do not wait isc-dhcp-server or an inetd. Also excludes
134 # nfs-kernel-server. On an android chroot, we don\'t have nfs in the
135 # kernel, or the ability to install it.
136 # xorriso is for running fai-cd -a, not strictly need for fai-server
137 # perl-tk is for fai-monitor-gui
138 # mtools is for fai-cd
139 pkgs
=(fai-doc tftpd-hpa
tar reprepro squashfs-tools binutils xorriso perl-tk mtools
)
140 if modprobe nfsd
&>/dev
/null
; then
141 pkgs
+=(nfs-kernel-server
)
147 e apt-get
install -y ${pkgs[@]}
148 # confnew since we edit /etc/fai/NFSROOT in an automated way
149 # fai-client is already a fai-server dependency, but make sure it gets upgraded
150 e apt-get
install --no-install-recommends -y -o Dpkg
::Options
::=--no-force-confdef -o Dpkg
::Options
::=--force-confnew fai-server fai-client
152 r
=http
://http.us.debian.org
/debian
153 # like default, but scrap httpredir, and nonfree.
154 # All my systems should be able to get along without nonfree
155 # for a base working system afaik.
157 cat >/etc
/fai
/apt
/sources.list
<<EOF
158 deb $r $base main contrib
161 ### begin setup security repo ###
164 cat >>/etc
/fai
/apt
/sources.list
<<EOF
165 deb http://security.debian.org/debian-security $base/updates main contrib
169 # new naming convention
170 cat >>/etc
/fai
/apt
/sources.list
<<EOF
171 deb http://security.debian.org/debian-security $base-security main contrib
174 ### end setup security repo ###
177 cat >>/etc
/fai
/apt
/sources.list
<<EOF
178 # use fai repo. it's commented in the defaults. it's got bug fixes.
179 # and may contain newer packages.
180 deb http://fai-project.org/download $base koeln
183 ## Get latest kernel and btrfs for dealing with btrfs issues.
184 # if [[ $base == buster ]]; then
185 # cat >>/etc/fai/apt/sources.list <<'EOF'
186 # deb http://ftp.debian.org/debian buster-backports main
188 # # note, fai doesn\'t look at /etc/fai/apt/preferences.d
189 # cat >/etc/fai/apt/preferences <<'EOF'
190 # Package: linux-* firmware-linux-free btrfs-progs
191 # Pin: release a=buster-backports
197 if [[ -s /q
/root
/shadow
/standard
]]; then
198 $sed -f - /etc
/fai
/nfsroot.conf
<<EOF
199 $ a FAI_ROOTPW='$(</q/root/shadow/standard)'
204 $sed -f - /etc
/fai
/nfsroot.conf
<<EOF
205 $ a SSH_IDENTITY=/root/.ssh/home.pub
207 s,^( *FAI_DEBOOTSTRAP=).*,\1"$base $r",
208 # add --arch amd64. this is needed on arm system which is
209 # used to install amd64 clients. On amd64 servers, it's redundant.
210 # disabled for now, since creating fai nfsroot on my arm machine
212 #/--arch amd64/!s/^(\s*FAI_DEBOOTSTRAP_OPTS=")/\1--arch amd64 /
215 $sed 's/#LOGUSER/LOGUSER/' /etc
/fai
/fai.conf
216 $sed -i '/^LOGUSER=/d' /etc
/fai
/fai.conf
217 $sed -i '/^FAI_FLAGS=/d' /etc
/fai
/fai.conf
218 echo "FAI_FLAGS=verbose" >>/etc
/fai
/fai.conf
219 # note if this isnt set, the user isnt created
220 echo "LOGUSER=fai" >>/etc
/fai
/fai.conf
222 # from man fai-make-nfsroot,
223 # figured out after partitioning ignored my crypt partition
226 cedit
/etc
/fai
/NFSROOT
<<'EOF' || [[ $? == 1 ]]
227 # inserted by faserver-setup
230 # default one is linux-image-server, doesnt exist anymore
232 # default is btrfs-tools which doesnt exist anymore
235 # got an error in error.log about not having gpg.
236 # system seemed to still install ok, so i havent tested if this fixes it.
244 # background: Can't build the nfsroot on my arm system now. First,
245 # fai-make-nfsroot won't work out of the box. One idea to make it work
246 # is by installing qemu-user-static, then copying qemu-x86_64-static
247 # into the nfsroot, and prepending it to chroot commands in
248 # fai-make-nfsroot, but that fails in odd ways. ls has permissions
249 # problems on reading directories, various programs segfault
250 # immediately, cat can't open a file, etc.
252 NFSROOT
=/srv
/fai
/nfsroot
253 TFTPROOT
=/srv
/tftp
/fai
255 # setup_tftp is copied from fai-make-nfsroot,
256 # todo: need to check for an update, and we had an unused variable in ours: $v
263 pxebin
=$NFSROOT/usr
/lib
/syslinux
/pxelinux
.0
265 rm -f $NFSROOT/boot
/*.bak
266 mkdir
-p $TFTPROOT/pxelinux.cfg
267 if ! chmod a
+r
$NFSROOT/boot
/initrd.img-
*; then
268 echo "$0: error: No initrd was created. Check the package name of the linux-image package in /etc/fai/NFSROOT."
271 cp -p $NFSROOT/boot
/vmlinu?
-* $NFSROOT/boot
/initrd.img-
* $TFTPROOT
272 cp -u $pxebin $TFTPROOT
273 if [ -f $NFSROOT/usr
/lib
/syslinux
/modules
/bios
/ldlinux.c32
]; then
274 cp -u $NFSROOT/usr
/lib
/syslinux
/modules
/bios
/ldlinux.c32
$TFTPROOT
279 # -g causes skipping set_root_pw() in fai-make-nfsroot, -ag
280 # is the only way to make it run without chrooting. the options
281 # seem contradictory, but it works.
285 # note, this copies the -B arg to
286 # /srv/fai/nfsroot/var/tmp/base.tar.xz
287 e fai-setup
-evf -B $basefile
288 # fai-setup expert mode avoids writing to /var/log/fai/variables
289 # at least config_src is needed for autodiscover
292 # lld /var/log/fai/remote-logs:
293 # d 750 fai nogroup 100 08-07 08:51 pm /var/log/fai/remote-logs
294 # We could change the group or something, but why not just give me more permissions :)
295 e usermod
-a -G nogroup iank
296 $sed '/^FAI_CONFIGDIR|^FAI_CONFIG_SRC|^LOGUSER/d' /var
/log
/fai
/variables
297 tee -a /var
/log
/fai
/variables
<<'EOF'
299 FAI_CONFIGDIR=/srv/fai/config
300 FAI_CONFIG_SRC=nfs://faiserver.b8.nz/srv/fai/config
302 # make the faiserver also the apt proxy server
303 # apt-get -y install apt-cacher-ng
306 rm -f /srv
/fai
/nfsroot
/root
/.ssh
/known_hosts
307 if [[ $HOSTNAME == kd
]]; then
308 keyscan_arg
="-p 8989"
310 key
=$
(ssh-keyscan
$keyscan_arg localhost |
& grep -o "ecdsa-sha2-nistp256.*")
311 for ip
in faiserver.b8.nz $
(ip addr show up|
grep -w '^ *inet' |
awk '{print $2}'| cut
-d / -f 1 |
grep -vF 127.0.0.1); do
312 echo "$ip $key" >>/srv
/fai
/nfsroot
/root
/.ssh
/known_hosts
315 # make it the root because pxe-kexec only looks there.
316 # It wouldn't be too hard to change if we needed.
317 # We could also just dump things in /srv/tftp, but fai
318 # has some defaults, which I don't even use, which expect
319 # the other directory, so it's kind of a tossup, whatever.
320 # This means fai's example isc-dhcp-server filename directory should remove the fai/ prefix.
321 sed -ri 's,^ *(TFTP_DIRECTORY=).*,\1"/srv/tftp/fai",' /etc
/default
/tftpd-hpa
322 systemctl restart tftpd-hpa
327 # https://wiki.archlinux.org/index.php/working_with_the_serial_console
328 # at runtime, running this from ssh worked:
329 # https://unix.stackexchange.com/questions/242778/what-is-the-easiest-way-to-configure-serial-port-on-linux
330 # stty -F /dev/ttyS0 115200 cs8 -cstopb -parenb
331 # /sbin/agetty 115200 ttyS0 linux
332 # dated info, but validation that this might work on debian:
333 # https://help.ubuntu.com/community/SerialConsoleHowto
334 # note in the nfsroot, systemd is not running.
335 echo "c0:2345:respawn:/sbin/agetty 115200 ttyS0 linux" >>/srv
/fai
/nfsroot
/etc
/inittab
337 # initially did the basic fai-chboot -Iv $std_arg default
338 # but found in console that it wanted to mount nfsroot
339 # to be the same as my dhcp server.
340 # Figured out to change the root= parameter from googling,
341 # and seeing fai-chboot -L
342 # using hostname failed.
343 # for -f, combined the 2 defaults so it will reboot and print to screen.
345 # Add debug to -f flag for more verbose output.
348 # background on choosing apt-cacher-ng:
349 # googling around a bit finds 2 main solutions:
350 # http://askubuntu.com/questions/3503/best-way-to-cache-apt-downloads-on-a-lan
351 # apt-cacher-ng doesn\'t have zeroconf.
352 # It touts having minimal dependencies, but I don\'t care.
353 # The downside to squid-deb-proxy is that it\'s config is for specific repos,
354 # you have to add all the repos you use.
355 # That is the main reason I use apt-cacher-ng.
356 # It has a web portal, at http://faiserver:3142/acng-report.html
359 # random fai note: as far as I can tell, profiles are just for putting
360 # in a selectable boot menu, which I don\'t want.
362 # the logsave prompted because the hostname faiserver was uknown.
363 # Here it was faiserver.lan when running from a faiserver vm.
364 # When running from a normal host with faiserver alias, it was the normal hosts name.
365 $sed 's/(^[^,]+,)\S+/\1faiserver.b8.nz/' /srv
/fai
/nfsroot
/root
/.ssh
/known_hosts
366 # ditch the logo banner up top which screws with less.
367 touch /srv
/fai
/nfsroot
/.nocolorlogo