X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;ds=sidebyside;f=fai%2Fconfig%2Fhooks%2Fpartition.DEFAULT;h=31f07ec1174a7409d9097d9573680b648454dc59;hb=a43d3eec943c5f0491b300214a3c744d31a6e542;hp=2632da4a990c4e6685a72a5afbe656ecc49bfc9c;hpb=eae06d9028e4e70a211afef4a73b971067203da1;p=automated-distro-installer diff --git a/fai/config/hooks/partition.DEFAULT b/fai/config/hooks/partition.DEFAULT index 2632da4..31f07ec 100755 --- a/fai/config/hooks/partition.DEFAULT +++ b/fai/config/hooks/partition.DEFAULT @@ -6,142 +6,177 @@ trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?"' ERR # # fai's setup-storage won't do btrfs on luks, # # so we do it ourself :) -partition=false -# keyfiles generated like: -# head -c 2048 /dev/urandom | od | s dd of=/q/root/luks/host-demohost -luks_dir=/var/lib/fai/config/distro-install-common/luks - -letters=(a) +#### begin configuration -if ifclass VM; then - d=/dev/vd +if ifclass TWO_DISK || ifclass demohost; then + letters=(a b) +elif ifclass ONE_DISK; then + letters=(a) else - d=/dev/sd + exit 1 fi +##### end configuration -if ifclass TWO_DISK; then - skiptask partition - devs=(${d}{a,b}) - [[ -e /dev/md127 ]] || partition=true -elif ifclass ONE_DISK; then - skiptask partition - devs=(${d}a) +if ifclass VM; then + d=vd else - exit + d=sd fi -# somewhat crude detection of wehter to partition + + +skiptask partition ||: # for running out of fai +devs=(${letters[@]/#//dev/${d}}) +crypt_devs=(${letters[@]/#//dev/mapper/crypt_dev_${d}}) + +# we can set this manually to force partitioning +#partition=false + +# somewhat crude detection of whether to partition for dev in ${devs[@]}; do + x=($dev[0-9]) + [[ ${#x[@]} == 4 ]] || partition=true for part in ${dev}{1,2,3,4}; do [[ -e $part ]] || partition=true done + # type tells us it's not totally blank + for part in ${dev}{1,3}; do + blkid | grep "^$part:.*TYPE=" &>/dev/null || partition=true + done done +#partition=true # for temporarily override -boot_end=504 - -! ifclass tp || letters=(a b) - -md() { ((${#letters[@]} > 1)); } - -if md; then - # if partition with md0, then reboot into the installer, - # it becomes md127. So might as well start with 127 for simplicity. - crypt=md127 +# keyfiles generated like: +# head -c 2048 /dev/urandom | od | s dd of=/q/root/luks/host-demohost +luks_dir=${LUKS_DIR:-/var/lib/fai/config/distro-install-common/luks} +if ifclass tp; then + lukspw=$(cat $luks_dir/traci) else - crypt=${d##/dev/}a3 + lukspw=$(cat $luks_dir/ian) +fi +if ifclass demohost; then + lukspw=x fi +boot_end=504 + +crypt=/dev/mapper/crypt_dev_${d##/dev/}a3 + # 1.5 x based on https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Installation_Guide/sect-disk-partitioning-setup-x86.html#sect-custom-partitioning-x86 -swap_end=$(( $(grep ^MemTotal: /proc/meminfo| awk '{print $2}') * 3/(${#letters[@]} * 2 ) / 1000 + boot_end ))MiB +swap_end=$(( $(grep ^MemTotal: /proc/meminfo| awk '{print $2}') * 3/(${#devs[@]} * 2 ) / 1000 + boot_end )) +create_subvols() { + cd /mnt + for x in q home root; do + btrfs subvolume list . | grep "$x$" >/dev/null || btrfs subvolume create $x + done + btrfs subvolume set-default \ + $(btrfs subvolume list . | grep 'root$' | awk '{print $2}') . + chattr -Rf +C root + cd / + umount /mnt +} + +mkdir -p /tmp/fai shopt -s nullglob if $partition; then - mkdir -p /tmp/fai for dev in ${devs[@]}; do - for x in /dev/md*; do [[ -d $x ]] || mdadm --stop $x; done for x in $dev[0-9]; do wipefs -a $x; done + done + for dev in ${devs[@]}; do parted -s $dev mklabel gpt # gpt ubuntu cloud image uses ~4. fai uses 1 MiB. ehh, i'll do 4. # also, using MB instead of MiB causes complains about alignment. parted -s $dev mkpart primary "ext3" 4MB ${boot_end}MiB parted -s $dev set 1 boot on - parted -s $dev mkpart primary "linux-swap" ${boot_end}MiB $swap_end - parted -s -- $dev mkpart primary "" $swap_end -0 - parted -s $dev set 3 raid on + parted -s $dev mkpart primary "linux-swap" ${boot_end}MiB ${swap_end}MiB + parted -s -- $dev mkpart primary "" ${swap_end}MiB -0 parted -s $dev mkpart primary "" 1MiB 4MiB parted -s $dev set 4 bios_grub on # the mkfs failed randomly on a vm, so I threw a sleep in here. sleep .1 mkfs.ext4 -F ${dev}1 + # 3 is device which simply holds a key for the 4's, + # so we can unlock multi-device btrfs fs with 1 manually entered passphrase. + # + # Background: It's of course possible modify the initramfs to + # put the input from a passphrase prompt into a variable and use + # it to unlock multiple devices, but that would require figuring + # more things out. + # + for luks_dev in ${dev}3; do + yes YES | cryptsetup luksFormat $luks_dev $luks_dir/host-$HOSTNAME \ + -c aes-cbc-essiv:sha256 -s 256 || [[ $? == 141 ]] + yes "$lukspw" | \ + cryptsetup luksAddKey --key-file $luks_dir/host-$HOSTNAME \ + $luks_dev || [[ $? == 141 ]] + # background: Keyfile and password are treated just + # like 2 ways to input a passphrase, so we don't actually need to have + # different contents of keyfile and passphrase, but it makes some + # security sense to a really big randomly generated passphrase + # as much as possible, so we have both. + # + # This would remove the keyfile. + # yes 'test' | cryptsetup luksRemoveKey /dev/... \ + # /key/file || [[ $? == 141 ]] + + cryptsetup luksOpen $luks_dev crypt_dev_${luks_dev##/dev/} \ + --key-file $luks_dir/host-$HOSTNAME + done done - if md; then - yes | mdadm --create /dev/$crypt --level=raid0 --force --run \ - --raid-devices=${#devs[@]} ${devs[@]/%/3} || [[ $? == 141 ]] - fi - - yes YES | cryptsetup luksFormat /dev/$crypt $luks_dir/host-$HOSTNAME \ - -c aes-cbc-essiv:sha256 -s 256 || [[ $? == 141 ]] - yes $(cat $luks_dir/traci) | \ - cryptsetup luksAddKey --key-file \ - $luks_dir/host-$HOSTNAME /dev/$crypt || [[ $? == 141 ]] - # this would remove the keyfile. we will do that manually later. - # yes 'test' | cryptsetup luksRemoveKey /dev/... \ - # /key/file || [[ $? == 141 ]] - cryptsetup luksOpen /dev/$crypt crypt_dev_$crypt --key-file \ - $luks_dir/host-$HOSTNAME + mkfs.btrfs -f ${crypt_devs[@]/%/3} parted ${devs[0]} set 1 boot on - mkfs.btrfs -f /dev/mapper/crypt_dev_$crypt - mount /dev/mapper/crypt_dev_$crypt /mnt - cd /mnt - btrfs subvolume create a - btrfs subvolume create root - btrfs subvolume set-default $(btrfs subvolume list . | grep 'root$' | awk '{print $2}') . - cd / - umount /mnt + mount $crypt /mnt + create_subvols else for dev in ${devs[@]}; do mkfs.ext4 -F ${dev}1 + cryptsetup luksOpen ${dev}3 crypt_dev_${dev##/dev/}3 \ + --key-file $luks_dir/host-$HOSTNAME || [[ $? == 141 ]] done - yes $(cat $luks_dir/traci) | \ - cryptsetup luksOpen /dev/$crypt crypt_dev_$crypt || [[ $? == 141 ]] sleep 1 - mount -o subvolid=0 /dev/mapper/crypt_dev_$crypt /mnt + mount -o subvolid=0 $crypt /mnt # systemd creates subvolumes we want to delete. s=($(btrfs subvolume list --sort=-path /mnt | sed -rn 's#^.*path\s*(root/\S+)\s*$#\1#p')) for subvol in ${s[@]}; do btrfs subvolume delete /mnt/$subvol; done btrfs subvolume set-default 0 /mnt btrfs subvolume delete /mnt/root - btrfs subvolume create /mnt/root - btrfs subvolume set-default $(btrfs subvolume list /mnt | grep 'root$' | awk '{print $2}') /mnt - umount /mnt + create_subvols fi -cat > /tmp/fai/crypttab <> /tmp/fai/crypttab < /tmp/fai/fstab <>/tmp/fai/crypttab <> /tmp/fai/fstab </tmp/fai/disk_var.sh <