iankelling.org Git - automated-distro-installer/blob - arch-init-chroot

   1 #!/bin/bash -x
   2 set -eE -o pipefail
   3 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
   4
   5 for x in /etc/*.pacorig; do
   6     # This started breaking immediately when I stoped doing genfstab.
   7     # It's probably not needed anymore
   8     [[ -e $x ]] || break
   9     mv $x ${x%.pacorig}
  10 done
  11
  12 echo $hostname > /etc/hostname
  13 [[ -L /etc/localtime ]] || ln -s /usr/share/zoneinfo/America/Los_Angeles /etc/localtime
  14 l=en_US.UTF-8
  15 echo "$l UTF-8" > /etc/locale.gen
  16 locale-gen
  17 echo "LANG=$l" > /etc/locale.conf
  18 # if coming from windows, and you had to set the time, do this
  19 # hwclock --systohc --utc
  20
  21 # A password is required to access the  volume:
  22 # Command requires device and ampped name as arguments
  23
  24 # If we were using btrfs raid, we supposedly would need this.
  25 # # add btrfs as module instead of hook due to
  26 # # https://wiki.archlinux.org/index.php/Btrfs,
  27 # # https://bugs.archlinux.org/task/42884
  28 # # disabled, as with just the module, startup spammed something about
  29 # # command takes a device name and something else.
  30 # sed -ri '/^ *MODULES *=.*btrfs/!s/^( *MODULES *=.*)"/\1 btrfs"/' /etc/mkinitcpio.conf
  31 # # remove extra space
  32 # sed -ri 's/^( *MODULES *=[^"]*)" */\1"/' /etc/mkinitcpio.conf
  33
  34
  35
  36
  37 # for desktop without full fs encryption, use this:
  38 #cat > /etc/crypttab <<'EOF'
  39 #tmp  /dev/lvm/tmp  /dev/urandom  tmp,cipher=aes-xts-plain64,size=256
  40
  41 # otgherwise ERROR: file not found: `fsck.btrfs'
  42 pacman -S --noconfirm btrfs-progs
  43
  44 pacman -S --noconfirm grub gptfdisk
  45
  46
  47 shopt -s extglob
  48 echo "$0: fstab:"
  49 cat /etc/fstab
  50 # https://wiki.archlinux.org/index.php/Dm-crypt/System_configuration#Boot_loader
  51 # if cryptdevice was lvm, it woulde be in this format,
  52 # where x2-vg is from lvdisplay, VG Name field.
  53 # cryptdevice=/dev/disk/by-uuid/585dff23-136f-446f-815f-01053b70c957:x2-vg
  54 # but, if you are using your own fstab, it seems you just give it a name,
  55 # which will be the crypt device name under /dev/mapper/
  56 # https://wiki.archlinux.org/index.php/GRUB#Additional_arguments
  57
  58 first_boot_dev=${BOOT_DEVICE%% *}
  59 crypt_dev=${first_boot_dev}$rootn
  60 crypt_name=$(/root/devbyid $crypt_dev)
  61 crypt_name=crypt_dev_${crypt_name##*/}
  62
  63
  64 k_args=(
  65     cryptdevice=$crypt_dev:$crypt_name:allow-discards
  66     root=/dev/mapper/$crypt_name
  67     resume=${crypt_dev%[0-9]}$swapn
  68 )
  69 crypt_mapper_devs=(/dev/mapper/crypt_dev_*$rootn)
  70 crypt_count=${#crypt_mapper_devs[@]}
  71 if [[ crypt_count == 0 ]]; then
  72     echo "$0: error: expected crypt_mapper_devs length to be > 0"
  73     ls -la /dev/mapper
  74     exit 1
  75 fi
  76 keyfile_vars=()
  77 dup_keys=()
  78 extra_encrypt_hooks=()
  79
  80
  81 # If we have more than 1 to decrypt, arch wiki lead me onto
  82 # a sort of hacky way run the encrypt hook multiple times.
  83 for ((i=1; i < $crypt_count; i++)); do
  84     extra_encrypt_hooks+=(encrypt$i)
  85     if (( i = 1 )); then dup_keys=(" "); fi # prefix with an empty space
  86     cp /crypto_keyfile.bin /crypto_keyfile$i.bin
  87     dup_keys+=(/crypto_keyfile$i.bin)
  88     base=/usr/lib/initcpio
  89     cp $base/hooks/encrypt{,$i}
  90     cp $base/install/encrypt{,$i}
  91     sed -i "s/cryptdevice/cryptdevice$i/" $base/hooks/encrypt$i
  92     sed -i "s/cryptkey/cryptkey$i/" $base/hooks/encrypt$i
  93     crypt_name=${crypt_mapper_devs[i]#/dev/mapper/}
  94     crypt_dev=/dev/${crypt_name#crypt_dev_}
  95     k_args+=(cryptdevice$i=$crypt_dev:$crypt_name:allow-discards
  96              cryptkey$i=rootfs:/crypto_keyfile$i.bin)
  97 done
  98
  99 # https://wiki.archlinux.org/index.php/Dm-crypt/Encrypting_an_entire_system#Configuring_mkinitcpio_2
 100 # used to have lvm2 after encrypt for lvm, but not using lvm anymore
 101 for x in encrypt ${extra_encrypt_hooks[@]} btrfs; do
 102     sed -ri -f - /etc/mkinitcpio.conf <<EOF
 103 /^ *HOOKS.*\b$x\b/!s/^( *HOOKS=.*)filesystems/\1$x filesystems/
 104 EOF
 105 done
 106
 107 # this is the default file, otherwise you use cryptkey=device:fstype:path
 108 sed -ri -f - /etc/mkinitcpio.conf <<EOF
 109 s#^\s*FILES=.*#FILES="/crypto_keyfile.bin${dup_keys[*]}"#
 110 EOF
 111 echo "$0: FILES:"
 112 grep FILES /etc/mkinitcpio.conf
 113 k_args="${k_args[*]}"
 114 echo "$0: grub cmdline additions: $k_args"
 115 sed -ri -f - /etc/default/grub <<EOF
 116 \%$k_args%!s%^ *GRUB_CMDLINE_LINUX_DEFAULT *= *"%\0$k_args %
 117 EOF
 118
 119 mkinitcpio -p linux
 120
 121
 122 # remove the default quiet arg.
 123 # this doesn't seem to affect anything, so leave it alone.
 124 #sed -ri 's/^( *GRUB_CMDLINE_LINUX_DEFAULT *= *.*) ?\bquiet\b(.*)/\1\2/' /etc/default/grub
 125
 126 # https://wiki.archlinux.org/index.php/GRUB#Install_to_disk
 127 for dev in $BOOT_DEVICE; do
 128     grub-install --recheck $dev
 129 done
 130 grub-mkconfig -o /boot/grub/grub.cfg
 131 pacman -S --noconfirm openssh unison
 132
 133 echo "root:$ROOTPW" | chpasswd -e
 134
 135 pacman -S --noconfirm sudo
 136
 137 # 9 = user already exists. so we are idempotent.
 138 useradd -m -p "$ROOTPW" ian || [[ $? == 9 ]]
 139
 140 if [[ $hostname == frodo ]]; then
 141     useradd -m -p "$TPPASS" traci || [[ $? == 9 ]]
 142 else
 143     useradd -m traci || [[ $? == 9 ]]
 144 fi
 145 # comparing ian's groups to traci, I see none she should join on arch
 146 usermod -a -G traci ian
 147
 148
 149 /root/distro-install-common/end
 150 systemctl enable sshd
 151
 152 rm -rf /home/ian/.ssh
 153 cp -r /root/.ssh /home/ian
 154 chown ian:ian /home/ian/.ssh
 155 # the groups recommended by
 156 # https://wiki.archlinux.org/index.php/Users_and_groups#Group_list
 157 usermod -aG games,rfkill,users,uucp,wheel ian
 158
 159
 160 pacman -S --noconfirm net-tools # for route
 161 # get the mac of the interface used by the broadcast route.
 162 mac=$(cat /sys/class/net/$(route -n | sed -rn 's/^0\.0\.0\.0.*[[:space:]]([^[:space:]]+)[[:space:]]*$/\1/p')/address)
 163
 164
 165 # simple bridge.
 166 cat > /etc/systemd/network/wired.network <<EOF
 167 [Match]
 168 Name=en*
 169
 170 [Network]
 171 Bridge=br0
 172 EOF
 173
 174 cat > /etc/systemd/network/br0.network <<EOF
 175 [Match]
 176 Name=br0
 177
 178 [Network]
 179 DHCP=ipv4
 180 EOF
 181
 182 cat > /etc/systemd/network/br0.netdev <<EOF
 183 [NetDev]
 184 Name=br0
 185 Kind=bridge
 186 # use the same mac as the physical port,
 187 # which is mapped to a static ip in our dhcp server.
 188 MACAddress=$mac
 189 EOF
 190
 191
 192
 193
 194 for x in networkd resolved; do systemctl enable systemd-$x; done