--- /dev/null
+#!/bin/bash -x
+
+# see t.org for how to call
+
+set -eE -o pipefail
+trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?"' ERR
+
+cd "${BASH_SOURCE%/*}"
+
+export ROOTPW="$1"
+export hostname="$2"
+mirror=$3
+
+(( $# >= 2 )) || { echo "error: need 2 arguments"; exit 1; }
+
+case $hostname in
+ x2)
+ export grubdisk=/dev/sda
+ ;;
+ demohost)
+ export grubdisk=/dev/vda
+ ;;
+ treetowl)
+ bootid=64d495ee-c9fe-4174-b20a-6c5e47abcfa1
+ export grubdisk=$(blkid|sed -nr "/$bootid/s/^([^0-9]+).*/\1/p")
+ ;;
+ frodo)
+ rootid=e9ce7b46-9a21-4e79-b7f7-0b18acb57587
+ export grubdisk=$(blkid|sed -nr "/$rootid/s/(^[^0-9]*).*/\1/p")
+ ;;
+ *)
+ echo "unrecognized hostname: $hostname"
+ exit 1
+esac
+
+
+rm -f /etc/pacman.d/mirrorlist
+# https://wiki.archlinux.org/index.php/Mirrors#Sorting_mirrors
+
+if [[ $mirror ]]; then
+ echo "Server = $mirror" >> /etc/pacman.d/mirrorlist
+fi
+curl -s 'https://www.archlinux.org/mirrorlist/?country=US&protocol=https&ip_version=4&ip_version=6&use_mirror_status=on' |
+ sed -r 's/^[ #]*(Server *=)/\1/' >> /etc/pacman.d/mirrorlist
+
+ifclass() {
+ local var=${1/#/CLASS_}
+ [[ $hostname == $1 || ${!var} ]]
+}
+export -f ifclass
+for x in $(bash 50-host-classes); do
+ export CLASS_$x=true
+done
+
+export LUKS_DIR=/root/luks
+export HOSTNAME=$hostname
+chmod +x partition.DEFAULT
+./partition.DEFAULT
+# arch doesn't need crypttab entries for initramfs crypt partititions
+sed -ri '/^crypt_dev/d' /tmp/fai/crypttab
+mount -o subvol=/root /dev/mapper/crypt_dev_?da3 /mnt
+mkdir -p /mnt/{q,home}
+mount -o subvol=/q /dev/mapper/crypt_dev_?da3 /mnt/q
+mount -o subvol=/home /dev/mapper/crypt_dev_?da3 /mnt/home
+mkdir -p /mnt/etc
+cp /tmp/fai/{fstab,crypttab} /mnt/etc
+mkdir -p /mnt/boot
+mount /dev/?da1 /mnt/boot
+
+# https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption#Keyfiles
+cp /root/luks/host-$hostname /mnt/crypto_keyfile.bin
+
+
+shopt -s extglob
+case $hostname in
+ # these hosts are broken, not updated to new fai hyrbrid scripts.
+ frodo)
+
+ # for this system, no separate /boot, to keep partitions simple,
+ # since we want simpler backup recovery.
+ mount -U $rootid /mnt
+ ;;&
+ treetowl)
+ mount /dev/mapper/vg_treetowl00-lv02 /mnt
+ mount -U $bootid /mnt/boot
+ ;;&
+ frodo|treetowl)
+ rm -rf /mnt/!(a|i|q|f|boot) /mnt/boot/*
+ ;;
+esac
+
+
+
+if [[ $mirror ]]; then
+ echo "$0: 404 errors about core.db etc are normal,
+they will succeed using the secodary mirror"
+fi
+pacstrap /mnt base
+case $hostname in
+ frodo)
+ # the root .ssh needs to be like this,
+ # because it\'s used to get the key to mount an encrypted filesystem
+ # on top of itself.
+ d=/mnt/q/root/.ssh
+ rm -rf $d # for idempotency
+ mkdir -p $d
+ scp -oStrictHostKeyChecking=no ian@treetowl:/a/c/machine_specific/frodo/subdir_files/.ssh/* $d
+ cp .ssh/* $d
+ ln -s /q/root/.ssh /mnt/root
+ # background: errors=remount-ro is a debian installer thing. seems like
+ # not a bad idea. man mount says: The default is set in the filesystem
+ # superblock, and can be changed using tune2fs(8)
+
+ cat > /mnt/etc/fstab <<'EOF'
+UUID=e9ce7b46-9a21-4e79-b7f7-0b18acb57587 / ext4 noatime,errors=remount-ro 0 1
+UUID=dd67766f-93c5-4ce3-9877-a1d9841dd4a4 none swap sw 0 0
+/dev/sr0 /media/cdrom0 udf,iso9660 user,noauto 0 0
+/dev/mapper/crypta7 /mnt/btrfs_root btrfs subvolid=0,noatime,noauto 0 2
+/dev/mapper/crypta7 /a btrfs subvol=a,noatime,noauto 0 2
+EOF
+ ;;
+ *)
+ genfstab -p /mnt > /mnt/etc/fstab
+ cp -r .ssh /mnt/root
+ cp -r /root/distro-install-common /mnt/root
+ ;;&
+ treetowl)
+ echo "UUID=a9e83bb7-d23d-4de6-ba9f-d88b887f7206 /a ext4 noatime 0 2" >> /mnt/etc/fstab
+ ;;
+esac
+
+cp /root/arch-init-chroot /mnt/root
+# for manual commands, arch-chroot /mnt bash
+arch-chroot /mnt /root/arch-init-chroot
+
+# this gets mounted in chroot so we have to do it outside
+rm -f /mnt/etc/resolv.conf
+ln -s /run/systemd/resolve/resolv.conf /mnt/etc/resolv.conf
+
+# not necsesary, but makes reboot go fast.
+umount -R /mnt
+
+# causes 255 exit code, so doing this from the caller script.
+# reboot now