iankelling.org / git / automated-distro-installer / blob
? search:


56919e91a292cdb0a4867dfc625e761056fab085
[automated-distro-installer] / fai / config / hooks / partition.DEFAULT
1 #!/bin/bash -x
2 # Copyright (C) 2016 Ian Kelling
3
4 # This program is free software; you can redistribute it and/or
5 # modify it under the terms of the GNU General Public License
6 # as published by the Free Software Foundation; either version 2
7 # of the License, or (at your option) any later version.
8
9 # This program is distributed in the hope that it will be useful,
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 # GNU General Public License for more details.
13
14 # You should have received a copy of the GNU General Public License
15 # along with this program; if not, write to the Free Software
16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
17
18 PS4='+ $LINENO '
19 set -eE -o pipefail
20 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
21
22 if [[ $EUID != 0 ]]; then
23 echo "$0: error: need to run as root" >&2
24 exit 1
25 fi
26
27 # for calling outside of FAI:
28 # fai-redep
29 #
30 # source /b/fai/fai-wrapper
31 # - set any appropriate classes with: fai-setclass OPT1... which sets CLASS_OPT1=true...
32 # or run eval-fai-classfile FILE.
33 # - Set a VOL_DISTROVER (if not doing mkroot2) eg:
34 # fai-setclass VOL_NABIA
35 #
36 # OPTIONS:
37 #
38 # mkroot2: for running outside of fai and setting up the root2/boot2 luks and btrfs
39 #
40 # environment variables:
41 #
42 # HOSTNAME: if frodo, we exclude 2 devices from the /boot array, which
43 # the bios does not see. if demohost, we set the luks password to just
44 # 'x'.
45 #
46 # SPECIAL_DISK: For use outside of fai. A base disk name like
47 # /dev/sdk. If set, we just cryptsetup and partition this one disk then
48 # exit. This is useful for partitioning a disk in preparation to replace
49 # a failed or failing disk from a raid10 array.
50 #
51 # classes:
52 #
53 # REPARTITION: forces repartitioning even if we detect the proper amount
54 # of partitions already exist.
55 #
56 # NOWIPE: use existing subvolumes if they exist
57 #
58 # ROTATIONAL: forces to install onto hdds instead of sdds. normally sdds
59 # are chosen if they exist.
60 #
61 # PARTITION_PROMPT: command line prompt before partitioning
62 #
63 # RAID0: forces raid0 filesystem. Normally with 4+ devices, we use
64 # raid10.
65 # RAID1: forces raid1 filesystem.
66
67 mkroot2=false
68 if [[ $1 ]]; then
69 case $1 in
70 mkroot2)
71 mkroot2=true
72 ;;
73 *)
74 echo "$0: error: unsupported arg: $1" >&2
75 exit 1
76 ;;
77 esac
78 fi
79
80
81 if [[ $SPECIAL_DISK ]]; then
82 export CLASS_REPARTITION=true
83 fi
84
85 # # fai's setup-storage won't do btrfs on luks,
86 # # so we do it ourself :)
87 # inspiration taken from files in fai-setup-storage package
88
89 # if we are not running in fai, skiptask won't be defined, so carry on.
90 skiptask partition || ! type skiptask
91
92 if ! type -p devbyid; then
93 for d in $FAI/distro-install-common \
94 /a/bin/fai/fai/config/distro-install-common $FAI $PWD; do
95 [[ -d $d ]] || continue
96 if [[ -e $d/devbyid ]]; then
97 devbyid=$d/devbyid
98 devbyid() { $devbyid "$@"; }
99 break
100 fi
101 done
102 if [[ ! $devbyid ]]; then
103 echo "$0: error: failed to find devbyid script" >&2
104 exit 1
105 fi
106 fi
107
108
109
110 #### begin configuration
111
112 # this is the ordering of the /dev/sdaX, but
113 # the ordering of the partition layout goes like this:
114 # bios_grub
115 # grub_ext
116 # efi
117 # root
118 # swap
119 # boot
120
121 rootn=1
122 root2n=2
123 swapn=3
124 bootn=4
125 boot2n=5
126 efin=6
127 # ext partition so grub can write persistent variables,
128 # so it can do a one time boot. grub can't write to
129 # btrfs or any cow fs because it's more
130 # more complicated to do and they don't want to.
131 grub_extn=7
132 # bios boot partition,
133 # https://wiki.archlinux.org/index.php/GRUB
134 bios_grubn=8
135 even_bign=9
136 lastn=$bios_grubn
137
138
139
140 ##### end configuration
141
142
143 add-part() { # add partition suffix to $dev
144 local d part
145 if [[ $# == 1 ]]; then
146 d=$dev
147 part=$1
148 else
149 d=$1
150 part=$2
151 fi
152 echo $d-part$part
153 }
154
155 rootdev() { add-part $@ $rootn; }
156 root2dev() { add-part $@ $root2n; }
157 swapdev() { add-part $@ $swapn; }
158 bootdev() { add-part $@ $bootn; }
159 boot2dev() { add-part $@ $boot2n; }
160 efidev() { add-part $@ $efin; }
161 grub_extdev() { add-part $@ $grub_extn; }
162 bios_grubdev() { add-part $@ $bios_grubn; }
163 even_bigdev() { add-part $@ $even_bign; }
164
165 crypt-dev() { echo /dev/mapper/crypt_dev_${1##*/}; }
166 crypt-name() { echo crypt_dev_${1##*/}; }
167 root-cryptdev() { crypt-dev $(rootdev $@); }
168 root2-cryptdev() { crypt-dev $(root2dev $@); }
169 swap-cryptdev() { crypt-dev $(swapdev $@); }
170 root-cryptname() { crypt-name $(rootdev $@); }
171 root2-cryptname() { crypt-name $(root2dev $@); }
172 swap-cryptname() { crypt-name $(swapdev $@); }
173
174 dev-mib() {
175 local d=${1:-$dev}
176 echo $(( $(parted -m $d unit MiB print | \
177 sed -nr "s#^/dev/[^:]+:([0-9]+).*#\1#p") - 1))
178 }
179
180 luks-setup() {
181 local luksdev="$1"
182 # when we move to newer than trisquel 9, we can remove
183 # --type luks1. We can also check on cryptsetup --help | less /compil
184 # to see about the other settings. Default in debian 9 is luks2.
185 # You can convert from luks2 to luks 1 by adding a temporary key:
186 # cryptsetup luksAddKey --pbkdf pbkdf2
187 # then remove the new format keys with cryptsetup luksRemoveKey
188 # then cryptsetup convert DEV --type luks1, then readd old keys and remove temp.
189 yes YES | cryptsetup luksFormat $luksdev $luks_file || [[ $? == 141 ]]
190 yes "$lukspw" | \
191 cryptsetup luksAddKey --key-file $luks_file \
192 $luksdev || [[ $? == 141 ]]
193 # background: Keyfile and password are treated just
194 # like 2 ways to input a passphrase, so we don't actually need to have
195 # different contents of keyfile and passphrase, but it makes some
196 # security sense to a really big randomly generated passphrase
197 # as much as possible, so we have both.
198 #
199 # This would remove the keyfile.
200 # yes 'test' | cryptsetup luksRemoveKey /dev/... \
201 # /key/file || [[ $? == 141 ]]
202 cryptsetup luksOpen $luksdev $(crypt-name $luksdev) --key-file $luks_file
203 }
204
205 ##### end function defs
206
207 if ifclass REPARTITION; then
208 partition=true # force a full wipe
209 else
210 partition=false # change to true to force a full wipe
211 fi
212 if ifclass NOWIPE; then
213 wipe=false
214 else
215 wipe=true
216 fi
217
218 if (($(nproc) > 2)); then
219 mopts=,compress=zstd
220 fi
221
222 declare -A disk_excludes
223 if ! $mkroot2 && ! ifclass USE_MOUNTED; then
224 ## ignore disks that are mounted, eg when running from fai-cd
225 while read -r l; do
226 eval "$l"
227 if [[ ! $PKNAME ]]; then
228 PKNAME="$KNAME"
229 fi
230 if [[ $MOUNTPOINT ]]; then
231 disk_excludes[$PKNAME]=true
232 fi
233 done < <(lsblk -nP -o KNAME,MOUNTPOINT,PKNAME)
234 fi
235
236 hdds=()
237 ssds=()
238 # this excludes usb. note: i may encounter some other type in the future.
239 for disk in $(lsblk -do name,tran -n | awk '$2 ~ "^(sata|nvme)$" { print $1 }'); do
240 if [[ ${disk_excludes[$disk]} ]]; then
241 continue
242 fi
243 case $(cat /sys/block/$disk/queue/rotational) in
244 0) ssds+=(/dev/$disk) ;;
245 1) hdds+=(/dev/$disk) ;;
246 *) echo "$0: error: unknown /sys/block/$disk/queue/rotational: \
247 $(cat $disk/queue/rotational)"; exit 1 ;;
248 esac
249 done
250
251 # install all ssds, or if there are none, all hdds.
252 # Note, usb flash disks are seen as rotational, which is
253 # very odd, but convenient for ignoring them here.
254 # TODO: find a reliable way to ignore them.
255 if ! ifclass ROTATIONAL && (( ${#ssds[@]} > 0 )); then
256 short_devs=( ${ssds[@]} )
257 else
258 short_devs=( ${hdds[@]} )
259 fi
260
261 # check if the partitions exist have the right filesystems
262 #blkid="$(blkid -s TYPE)"
263 for dev in ${short_devs[@]}; do
264 if $partition; then break; fi
265 y=$(readlink -f $dev)
266 arr=($y?*)
267 if (( ${#arr[@]} < lastn )); then
268 partition=true
269 fi
270 # On one system, blkid is missing some partitions.
271 # maybe we need a flag, like FUZZY_BLKID or something, so we
272 # can check that at least some exist.
273 # for x in "`rootdev`: TYPE=\"crypto_LUKS\"" "`bootdev`: TYPE=\"btrfs\""; do
274 # echo "$blkid" | grep -Fx "$x" &>/dev/null || partition=true
275 # done
276 done
277
278 if $partition && ifclass PARTITION_PROMPT; then
279 echo "Press any key except ctrl-c to continue and partition these drives:"
280 echo " ${short_devs[*]}"
281 read -r
282 fi
283
284 devs=()
285 shopt -s extglob
286 for short_dev in ${short_devs[@]}; do
287 devs+=($(devbyid $short_dev))
288 done
289 if [[ ! ${devs[0]} ]]; then
290 echo "$0: error: failed to detect devs" >&2
291 exit 1
292 fi
293
294 boot_space=0
295 first=true
296 boot_devs=()
297 boot2_devs=()
298 for dev in ${devs[@]}; do
299 if ifclass frodo; then
300 # I ran into a machine where the bios doesn't know about some disks,
301 # so 1st stage of grub also doesn't know about them.
302 # Also, grub does not support mounting degraded btrfs as far as
303 # I can tell with some googling.
304 # From within an arch install env, I could detect them by noting
305 # their partitions were mixed with the next disk in /dev/disk/by-path,
306 # and I have mixed model disks, and I could see the 8 models which showed
307 # up in the bios, and thus see which 2 models were missing.
308 # hdparm -I /dev/sdh will give model info in linux.
309 # However, in fai on jessie, /dev/disk/by-path dir doesn't exist,
310 # and I don't see another way, so I'm hardcoding them.
311 # We still put grub on them and partition them the same, for uniformity
312 # and in case they get moved to a system that can recognize them,
313 # we just exclude them from the boot filesystem.
314 cd /dev/disk/by-id/
315 bad_disk=false
316 for id in ata-TOSHIBA_MD04ACA500_8539K4TQFS9A \
317 ata-TOSHIBA_MD04ACA500_Y5IFK6IJFS9A; do
318 if [[ $(readlink -f $id) == "$(readlink -f $dev)" ]]; then
319 bad_disk=true
320 break
321 fi
322 done
323 if ! $bad_disk; then
324 boot_devs+=($(bootdev))
325 boot2_devs+=($(boot2dev))
326 fi
327 else
328 boot_space=$(( boot_space + $(parted -m $dev unit MiB print | \
329 sed -nr "s#^/dev/[^:]+:([0-9]+).*#\1#p") - 1))
330 boot_devs+=($(bootdev))
331 boot2_devs+=($(boot2dev))
332 fi
333 if $first && [[ $boot_devs ]]; then
334 first_efi=$(efidev)
335 first_grub_extdev=$(grub_extdev)
336 first=false
337 fi
338 done
339 first_boot_dev=${boot_devs[0]}
340
341 even_raid=false
342 if ifclass RAID0 || (( ${#boot_devs[@]} == 1 )); then
343 raid_level=0
344 elif ifclass RAID1 || (( ${#boot_devs[@]} <= 3 )); then
345 if (( ${#boot_devs[@]} == 2 )); then
346 even_raid=true
347 fi
348 raid_level=1
349 else
350 raid_level=10
351 fi
352
353 ### Begin calculate boot partition space
354 # due to raid duplication
355 case $raid_level in
356 1*) boot_space=$(( boot_space / 2 )) ;;
357 esac
358 if (( boot_space > 60000 )); then
359 # this is larger than needed for several /boot subvols,
360 # becuase I keep a minimal debian install on it for
361 # recovery needs and for doing pxe-kexec.
362 boot_mib=10000
363 root2_mib=200000
364 boot2_mib=2000
365 elif (( boot_spa_ce > 30000 )); then
366 boot_mib=$(( 5000 + (boot_space - 30000) / 2 ))
367 root2_mib=100
368 boot2_mib=100
369 else
370 # Small vms don't have room for /boot recovery. With 3 kernels
371 # installed, i'm using 132M on t8, so this seems like plenty of
372 # room. note: rhel 8 recomments 1g for /boot.
373 boot_mib=500
374 root2_mib=100
375 boot2_mib=100
376 fi
377 case $raid_level in
378 1*)
379 boot_mib=$(( boot_mib * 2 ))
380 boot2_mib=$(( boot2_mib * 2 ))
381 root2_mib=$(( root2_mib * 2 ))
382 ;;
383 esac
384 ### end calculate boot partition space
385
386
387
388 if [[ ! $DISTRO ]]; then
389 if ifclass VOL_BULLSEYE_BOOTSTRAP; then
390 DISTRO=debianbullseye_bootstrap
391 elif ifclass VOL_STRETCH; then
392 DISTRO=debianstretch
393 elif ifclass VOL_BUSTER; then
394 DISTRO=debianbuster
395 elif ifclass VOL_BULLSEYE; then
396 DISTRO=debianbullseye
397 elif ifclass VOL_TESTING; then
398 DISTRO=debiantesting
399 elif ifclass VOL_XENIAL; then
400 DISTRO=ubuntuxenial
401 elif ifclass VOL_BIONIC; then
402 DISTRO=ubuntubionic
403 elif ifclass VOL_FOCAL; then
404 DISTRO=ubuntufocal
405 elif ifclass VOL_FLIDAS; then
406 DISTRO=trisquelflidas
407 elif ifclass VOL_ETIONA; then
408 DISTRO=trisqueletiona
409 elif ifclass VOL_NABIA; then
410 DISTRO=trisquelnabia
411 elif $mkroot2; then
412 :
413 else
414 echo "PARTITIONER ERROR: no distro class/var set" >&2
415 exit 1
416 fi
417 fi
418
419
420 bpart() { # btrfs a partition
421 case $raid_level in
422 0) mkfs.btrfs -f $@ ;;
423 1) mkfs.btrfs -f -m raid1 -d raid1 $@ ;;
424 10) mkfs.btrfs -f -m raid10 -d raid10 $@ ;;
425 esac
426 }
427
428
429 if [[ ! $luks_dir ]]; then
430 # see README for docs about how to create these
431 luks_dir=$FAI/distro-install-common/luks
432 if [[ ! -d $luks_dir ]]; then
433 luks_dir=/q/root/luks
434 fi
435 if [[ ! -d $luks_dir ]]; then
436 echo "$0: error: no luks_dir found" >&2
437 exit 1
438 fi
439 fi
440
441 luks_file=$luks_dir/host-$HOSTNAME
442 if [[ ! -e $luks_file ]]; then
443 hostkeys=($luks_dir/host-*)
444 # if there is only one key, we might be deploying somewhere
445 # where dhcp doesnt give us a proper hostname, so use that.
446 if [[ ${#hostkeys[@]} == 1 && -e ${hostkeys[0]} ]]; then
447 luks_file=${hostkeys[0]}
448 else
449 echo "$0: error: no key for hostname at $luks_file" >&2
450 exit 1
451 fi
452 fi
453
454 # # note, corresponding changes in /b/ds/keyscript-{on,off}
455 if ifclass demohost; then
456 lukspw=x
457 elif [[ -e $luks_dir/$HOSTNAME ]]; then
458 lukspw=$(cat $luks_dir/$HOSTNAME)
459 else
460 lukspw=$(cat $luks_dir/iank)
461 fi
462
463
464 first_root_crypt=$(root-cryptdev ${devs[0]})
465
466 # 1.5 x based on https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Installation_Guide/sect-disk-partitioning-setup-x86.html#sect-custom-partitioning-x86
467 swap_mib=$(( $(grep ^MemTotal: /proc/meminfo | \
468 awk '{print $2}') * 3/(${#devs[@]} * 2 ) / 1024 ))
469
470 mkdir -p /tmp/fai
471 root_devs=()
472 for dev in ${devs[@]}; do
473 root_devs+=($(rootdev))
474 done
475 shopt -s nullglob
476
477 # We write to these files instead of just /etc/fstab, /etc/crypttab,
478 # because these are filesystems created after our current root, and so
479 # this allows us to update other root filesystems too.
480 rm -f /mnt/root/root2-{fs,crypt}tab
481 if $mkroot2; then
482 if $partition; then
483 echo $0: error: found partition=true but have mkroot2 arg
484 exit 1
485 fi
486 for dev in ${devs[@]}; do
487 luks_file=$luks_dir/host-amy
488 lukspw=$(cat $luks_dir/amy)
489 luks-setup $(root2dev)
490 cat >>/mnt/root/root2-crypttab <<EOF
491 $(root2-cryptname) $(root2dev) $luks_file discard,luks,initramfs
492 EOF
493 done
494 bpart $(for dev in ${devs[@]}; do root2-cryptdev; done)
495 bpart ${boot2_devs[@]}
496 mkdir -p /mnt/root2 /mnt/boot2
497 cat >>/mnt/root/root2-fstab <<EOF
498 $(root2-cryptdev ${devs[0]}) /mnt/root2 btrfs nofail,x-systemd.device-timeout=30s,x-systemd.mount-timeout=30s,noatime,subvolid=0$mopts 0 0
499 ${boot2_devs[0]} /mnt/boot2 btrfs nofail,x-systemd.device-timeout=30s,x-systemd.mount-timeout=30s,noatime,subvolid=0 0 0
500 EOF
501 exit 0
502 fi
503
504
505 if $partition; then
506 ### begin wipefs
507 if [[ ! $SPECIAL_DISK ]]; then
508 for dev in ${devs[@]}; do
509 # if we repartition to the same as an old partition,
510 # we don't want any old fses hanging around.
511 for (( i=1; i <= lastn; i++ )); do
512 x=$(add-part $i)
513 [[ -e $x ]] || continue
514 count_down=10
515 # wipefs has failed, manual run works, google suggests timing issue
516 while ! wipefs -a $x; do
517 sleep 2
518 count_down=$((count_down - 1))
519 (( count_down > 0 )) || exit 1
520 done
521 done
522 done
523 fi
524 ### end wipefs
525
526
527 # When we have 2 disks of at least 100g difference in size,
528 # make an extra partition on the end of the bigger one.
529 even_big_part=false
530 even_diff_min=100000
531 if $even_raid; then
532 smalli=0
533 bigi=1
534 if (( $(dev-mib ${devs[0]}) >= $(dev-mib ${devs[1]}) )); then
535 smalli=1
536 bigi=0
537 fi
538 disk_mib=$(dev-mib ${devs[smalli]})
539 even_big_dev=${devs[bigi]}
540 even_big_mib=$(dev-mib $even_big_dev)
541 if (( even_big_mib - disk_mib > even_diff_min )); then
542 even_big_part=true
543 fi
544 fi
545
546 for dev in ${devs[@]}; do
547 if [[ $SPECIAL_DISK ]]; then
548 dev=$(devbyid $SPECIAL_DISK)
549 fi
550
551 # parted will round up the disk size. Do -1 so we can have
552 # fully 1MiB unit partitions for easy resizing of the last partition.
553 # Otherwise we would pass in -0 for the end argument for the last partition.
554 #
555 # Note: parted print error output is expected. example:
556 # Error: /dev/vda: unrecognised disk label
557 if ! $even_raid; then
558 disk_mib=$(dev-mib)
559 fi
560
561 boot_part_mib=$(( boot_mib / ${#boot_devs[@]} ))
562 boot2_part_mib=$(( boot2_mib / ${#boot_devs[@]} ))
563 root2_part_mib=$(( root2_mib / ${#root_devs[@]} ))
564 root_end=$(( disk_mib - root2_part_mib - swap_mib - boot_part_mib - boot2_part_mib ))
565 root2_end=$(( root_end + root2_part_mib ))
566 swap_end=$(( root2_end + swap_mib ))
567 boot_end=$(( swap_end + boot_part_mib ))
568
569 parted -s $dev mklabel gpt
570 # MiB because parted complains about alignment otherwise.
571 pcmd="parted -a optimal -s -- $dev"
572 # root partition, the main big one
573 $pcmd mkpart primary ext3 524MiB ${root_end}MiB
574 # without naming, systemd gives us misc errors like:
575 # dev-disk-by\x2dpartlabel-primary.device: Dev dev-disk-by\x2dpartlabel-primary.device appeared twice
576 $pcmd name $rootn root
577 # root2 partition
578 $pcmd mkpart primary ext3 ${root_end}MiB ${root2_end}MiB
579 $pcmd name $root2n root2
580 # normally a swap is type "linux-swap", but this is encrypted swap. using that
581 # label will confuse systemd.
582 # swap partition
583 $pcmd mkpart primary "" ${root2_end}MiB ${swap_end}MiB
584 $pcmd name $swapn swap
585 # boot partition
586 $pcmd mkpart primary "" ${swap_end}MiB ${boot_end}MiB
587 $pcmd name $bootn boot
588 # boot2 partition
589 $pcmd mkpart primary "" ${boot_end}MiB ${disk_mib}MiB
590 $pcmd name $boot2n boot2
591 # uefi partition. efi sucks, half a gig, rediculous.
592 $pcmd mkpart primary "fat32" 12MiB 524MiB
593 $pcmd name $efin efi
594 $pcmd set $efin esp on
595 # note, this is shown here: https://support.system76.com/articles/bootloader/
596 # but not mentioned https://wiki.archlinux.org/index.php/EFI_system_partition
597 # probably not needed
598 $pcmd set $bootn boot on
599 $pcmd set $boot2n boot on
600 # i only need a few k, but googling min size,
601 # I found someone saying that gparted required
602 # required at least 8 because of their hard drive cylinder size.
603 # And 8 is still very tiny.
604 # grub_ext partition
605 $pcmd mkpart primary "ext2" 4MiB 12MiB
606 $pcmd name $grub_extn grubext
607 # gpt ubuntu cloud image uses ~4 mb for this partition. fai uses 1 MiB.
608 # so, I use 3, whatever.
609 # note: parted manual saying cheap flash media
610 # should to start at 4.
611 # biols grub partition
612 $pcmd mkpart primary "" 1MiB 4MiB
613 $pcmd name $bios_grubn biosgrub
614 $pcmd set $bios_grubn bios_grub on
615 if $even_big_part && [[ $dev == "$even_big_dev" ]]; then
616 $pcmd mkpart primary ext3 ${disk_mib}MiB ${even_big_mib}MiB
617 $pcmd name $even_bign even_big
618 fi
619
620 # the mkfs failed before on a vm, which prompted me to add
621 # sleep .1
622 # then it failed again on a physical machine
623 # with:
624 # Device /dev/disk/by-id/foo doesn't exist or access denied,
625 # so I added a wait until it existed.
626 # Then I added the mkfs.ext2, which claimed to succeed,
627 # but then couldn't be found upon reboot. In that case we didn't
628 # wait at all. So I've added a 3 second minimum wait.
629 secs=0
630 while [[ ! -e $(bios_grubdev) ]] && (( secs < 10 )); do
631 sleep 1
632 secs=$((secs +1))
633 done
634 sleep 3
635
636 mkfs.fat -F32 $(efidev)
637
638 if $even_big_part && [[ $dev == "$even_big_dev" ]]; then
639 luks-setup $(even_bigdev)
640 mkfs.btrfs -f $(crypt-dev $(even_bigdev))
641 fi
642
643 # Holds just a single file, rarely written, so
644 # use ext2, like was often used for the /boot partition.
645 # This exists because grub can only persist data to a non-cow fs.
646 # And we use persisting a var in grub to do a one time boot.
647 # We could pass the data on the kernel command line and persist it
648 # to grubenv after booting, but that relies on the boot always succeeding.
649 # This is just a bit more robust, and it could work for booting
650 # into ipxe which can't persist data, if we ever got that working.
651 mkfs.ext2 $(grub_extdev)
652 luks-setup $(rootdev)
653
654 if [[ $SPECIAL_DISK ]]; then
655 exit 0
656 fi
657 done
658 ls -la /dev/btrfs-control # this was probably for debugging...
659 sleep 1
660 bpart $(for dev in ${devs[@]}; do root-cryptdev; done)
661 bpart ${boot_devs[@]}
662 else
663 for dev in ${devs[@]}; do
664 if [[ -e /dev/mapper/$(root-cryptname) ]]; then
665 continue
666 fi
667 cryptsetup luksOpen $(rootdev) $(root-cryptname) \
668 --key-file $luks_file
669 done
670 sleep 1
671 fi
672
673
674 if $wipe && [[ $DISTRO != debianbullseye_bootstrap ]]; then
675 # bootstrap distro doesn't use separate encrypted root.
676 mount -o subvolid=0 $first_root_crypt /mnt
677 # systemd creates subvolumes we want to delete.
678 s=($(btrfs subvolume list --sort=-path /mnt |
679 sed -rn "s#^.*path\s*(root_$DISTRO/\S+)\s*\$#\1#p"))
680 for subvol in ${s[@]}; do btrfs subvolume delete /mnt/$subvol; done
681 btrfs subvolume set-default 0 /mnt
682 [[ ! -e /mnt/root_$DISTRO ]] || btrfs subvolume delete /mnt/root_$DISTRO
683
684 ## create subvols ##
685 cd /mnt
686
687 btrfs subvolume create root_$DISTRO
688
689 # could set default subvol like this, but no reason to.
690 # btrfs subvolume set-default \
691 # $(btrfs subvolume list . | grep "root_$DISTRO$" | awk '{print $2}') .
692
693 # For raid systems, cow allows for error correction, for non-raid systems,
694 # protects root fs from having the plug pulled. Reprovisioning a root
695 # subvol is not my favorite thing to do.
696 # # no cow on the root filesystem. it's setup is fully scripted,
697 # # if it's messed up, we will just recreated it,
698 # # and we can get better perf with this.
699 # # I can't remember exactly why, but this is preferable to mounting with
700 # # -o nodatacow, I think because subvolumes inherit that.
701 # chattr -Rf +C root_$DISTRO
702 cd /
703 umount /mnt
704 fi
705
706 mount -o subvolid=0 $first_boot_dev /mnt
707 cd /mnt
708 btrfs subvolume set-default 0 /mnt # already default, just ensuring it.
709
710 # for libreboot systems. grub2 only reads from subvolid=0
711 mkdir -p /mnt/grub2
712 cp $FAI/distro-install-common/libreboot_grub.cfg /mnt/grub2
713
714 if [[ $DISTRO == debianbullseye_bootstrap ]]; then
715 # this is just convenience for the libreboot_grub config
716 # so we can glob the other ones easier.
717 boot_vol=$DISTRO
718 else
719 boot_vol=boot_$DISTRO
720 fi
721 if $wipe && [[ -e /mnt/$boot_vol ]]; then
722 btrfs subvolume delete /mnt/$boot_vol
723 fi
724 if [[ ! -e /mnt/$boot_vol ]]; then
725 btrfs subvolume create $boot_vol
726 fi
727 cd /
728 umount /mnt
729 ## end create subvols ##
730
731 dev=${boot_devs[0]}
732 mount $first_grub_extdev /mnt
733 grub-editenv /mnt/grubenv set did_fai_check=true
734 grub-editenv /mnt/grubenv set last_boot=/$boot_vol
735 umount /mnt
736
737 fstabstd=x-systemd.device-timeout=30s,x-systemd.mount-timeout=30s
738 if [[ $DISTRO == debianbullseye_bootstrap ]]; then
739 cat > /tmp/fai/fstab <<EOF
740 $first_boot_dev / btrfs noatime,subvol=$boot_vol 0 0
741 $first_efi /boot/efi vfat nofail,$fstabstd 0 0
742 EOF
743 cat >/tmp/fai/disk_var.sh <<EOF
744 BOOT_DEVICE="${short_devs[@]}"
745 ROOT_PARTITION=$first_boot_dev
746 EOF
747 else
748 # note, fai creates the mountpoints listed here
749 cat > /tmp/fai/fstab <<EOF
750 $first_root_crypt / btrfs $fstabstdopts,noatime,subvol=root_$DISTRO$mopts 0 0
751 $first_root_crypt /mnt/root btrfs nofail,$fstabstd,noatime,subvolid=0$mopts 0 0
752 $first_boot_dev /boot btrfs nofail,$fstabstd,noatime,subvol=$boot_vol 0 0
753 $first_efi /boot/efi vfat nofail,$fstabstd 0 0
754 $first_boot_dev /mnt/boot btrfs nofail,$fstabstd,noatime,subvolid=0 0 0
755 EOF
756 swaps=()
757 rm -f /tmp/fai/crypttab
758 for dev in ${devs[@]}; do
759 swaps+=($(swap-cryptname))
760 cat >>/tmp/fai/crypttab <<EOF
761 $(root-cryptname) $(rootdev) none keyscript=/root/keyscript,discard,luks,initramfs
762 $(swap-cryptname) $(swapdev) /dev/urandom swap,cipher=aes-xts-plain64,size=256,hash=ripemd160
763 EOF
764 cat >> /tmp/fai/fstab <<EOF
765 $(swap-cryptdev) none swap nofail,$fstabstd,sw 0 0
766 EOF
767 done
768
769 # fai would do this:
770 #BOOT_DEVICE=\${BOOT_DEVICE:-"${devs[0]}"}
771
772 # note: swaplist seems to do nothing.
773 cat >/tmp/fai/disk_var.sh <<EOF
774 BOOT_DEVICE="${short_devs[@]}"
775 BOOT_PARTITION=\${BOOT_PARTITION:-$first_boot_dev}
776 # ROOT_PARTITIONS is added by me, used in arch setup.
777 ROOT_PARTITIONS="${root_devs[@]}"
778 ROOT_PARTITION=\${ROOT_PARTITION:-$first_root_crypt}
779 SWAPLIST=\${SWAPLIST:-"${swaps[@]}"}
780 EOF
781
782 if [[ $HOSTNAME == kd ]]; then
783 # note, having these with keyscript and initramfs causes a luks error in fai.log,
784 # but it is safely ignorable and gets us the ability to just type our password
785 # in once at boot. A downside is that they are probably needed to be plugged in to boot.
786 cat >>/tmp/fai/crypttab <<EOF
787 crypt_dev_ata-Samsung_SSD_870_QVO_8TB_S5VUNG0N900656V-part${even_bign} /dev/disk/by-id/ata-Samsung_SSD_870_QVO_8TB_S5VUNG0N900656V-part7 none keyscript=decrypt_keyctl,discard,luks,initramfs
788 crypt_dev_ata-TOSHIBA_MD04ACA500_84R2K773FS9A-part1 /dev/disk/by-id/ata-TOSHIBA_MD04ACA500_84R2K773FS9A-part1 none keyscript=decrypt_keyctl,discard,luks,initramfs
789 crypt_dev_ata-ST6000DM001-1XY17Z_Z4D29EBL-part1 /dev/disk/by-id/ata-ST6000DM001-1XY17Z_Z4D29EBL-part1 none keyscript=decrypt_keyctl,discard,luks,initramfs
790 EOF
791 cat >> /tmp/fai/fstab <<EOF
792 # r7 = root partition7. it isnt actually #7 anymore, not a great name, but whatever
793 /dev/mapper/crypt_dev_ata-Samsung_SSD_870_QVO_8TB_S5VUNG0N900656V-part${even_bign} /mnt/r7 btrfs nofail,$fstabstd,noatime,compress=zstd,subvolid=0 0 0
794 /dev/mapper/crypt_dev_ata-TOSHIBA_MD04ACA500_84R2K773FS9A-part1 /mnt/rust1 btrfs nofail,$fstabstd,noatime,compress=zstd,subvolid=0 0 0
795 /dev/mapper/crypt_dev_ata-ST6000DM001-1XY17Z_Z4D29EBL-part1 /mnt/rust2 btrfs nofail,$fstabstd,noatime,compress=zstd,subvolid=0 0 0
796 EOF
797 fi
798
799 fi
800
801 # initial setup of extra data fs, mounted,
802 # btrfs subvol create nocow
803 # chattr +C nocow
804 # chown iank.iank nocow
805
PXE install w multi-boot, btrfs & Libreboot support