iankelling.org Git - automated-distro-installer/blob - fai/config/hooks/partition.DEFAULT

   1 #!/bin/bash -x
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # This program is free software; you can redistribute it and/or
   5 # modify it under the terms of the GNU General Public License
   6 # as published by the Free Software Foundation; either version 2
   7 # of the License, or (at your option) any later version.
   8
   9 # This program is distributed in the hope that it will be useful,
  10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12 # GNU General Public License for more details.
  13
  14 # You should have received a copy of the GNU General Public License
  15 # along with this program; if not, write to the Free Software
  16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  17
  18 PS4='+ $LINENO '
  19 set -eE -o pipefail
  20 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
  21
  22 if [[ $EUID != 0 ]]; then
  23   echo "$0: error: need to run as root" >&2
  24   exit 1
  25 fi
  26
  27 # for calling outside of FAI:
  28 # fai-redep
  29 # s
  30 # source /b/fai/fai-wrapper
  31 # - set any appropriate classes with: fai-setclass OPT1... which sets CLASS_OPT1=true...
  32 #   or run eval-fai-classfile FILE.
  33 # - Set a VOL_DISTROVER, eg:
  34 #   fai-setclass VOL_NABIA
  35 # - export luks_dir=/q/root/luks
  36 #
  37 # OPTIONS:
  38 #
  39 # environment variables:
  40 #
  41 # HOSTNAME: if frodo, we exclude 2 devices from the /boot array, which
  42 # the bios does not see. if demohost, we set the luks password to just
  43 # 'x'.
  44 #
  45 # SPECIAL_DISK: For use outside of fai. A base disk name like
  46 # /dev/sdk. If set, we just cryptsetup and partition this one disk then
  47 # exit. This is useful for partitioning a disk in preparation to replace
  48 # a failed or failing disk from a raid10 array.
  49 #
  50 # classes:
  51 #
  52 # REPARTITION: forces repartitioning even if we detect the proper amount
  53 # of partitions already exist.
  54 #
  55 # NOWIPE: use existing subvolumes if they exist
  56 #
  57 # ROTATIONAL: forces to install onto hdds instead of sdds. normally sdds
  58 # are chosen if they exist.
  59 #
  60 # PARTITION_PROMPT: command line prompt before partitioning
  61 #
  62 # RAID0: forces raid0 filesystem. Normally with 4+ devices, we use
  63 # raid10.
  64 # RAID1: forces raid1 filesystem.
  65
  66 if [[ $SPECIAL_DISK ]]; then
  67   export CLASS_REPARTITION=true
  68 fi
  69
  70 # # fai's setup-storage won't do btrfs on luks,
  71 # # so we do it ourself :)
  72 # inspiration taken from files in fai-setup-storage package
  73
  74 # if we are not running in fai, skiptask won't be defined, so carry on.
  75 skiptask partition || ! type skiptask
  76
  77 if ! type -p devbyid; then
  78   for d in $FAI/distro-install-common \
  79                /a/bin/fai/fai/config/distro-install-common $FAI $PWD; do
  80     [[ -d $d ]] || continue
  81     if [[ -e $d/devbyid ]]; then
  82       devbyid=$d/devbyid
  83       devbyid() { $devbyid "$@"; }
  84       break
  85     fi
  86   done
  87   if [[ ! $devbyid ]]; then
  88     echo "$0: error: failed to find devbyid script" >&2
  89     exit 1
  90   fi
  91 fi
  92
  93
  94
  95 #### begin configuration
  96
  97 rootn=1
  98 swapn=2
  99 bootn=3
 100 efin=4
 101 # ext partition so grub can write persistent variables,
 102 # so it can do a one time boot. grub can't write to
 103 # btrfs or any cow fs because it's more
 104 # more complicated to do and they don't want to.
 105 grub_extn=5
 106 # bios boot partition,
 107 # https://wiki.archlinux.org/index.php/GRUB
 108 bios_grubn=6
 109 lastn=$bios_grubn
 110
 111
 112
 113 ##### end configuration
 114
 115
 116 add-part() { # add partition suffix to $dev
 117   local d ret
 118   if [[ $# == 1 ]]; then
 119     d=$dev
 120     part=$1
 121   else
 122     d=$1
 123     part=$2
 124   fi
 125   echo $d-part$part
 126 }
 127
 128 bootdev() { add-part $@ $bootn; }
 129 rootdev() { add-part $@ $rootn; }
 130 swapdev() { add-part $@ $swapn; }
 131 efidev() { add-part $@ $efin; }
 132 grub_extdev() { add-part $@ $grub_extn; }
 133 bios_grubdev() { add-part $@ $bios_grubn; }
 134
 135 crypt-dev() { echo /dev/mapper/crypt_dev_${1##*/}; }
 136 crypt-name() { echo crypt_dev_${1##*/}; }
 137 root-cryptdev() { crypt-dev $(rootdev $@); }
 138 swap-cryptdev() { crypt-dev $(swapdev $@); }
 139 root-cryptname() { crypt-name $(rootdev $@); }
 140 swap-cryptname() { crypt-name $(swapdev $@); }
 141
 142 dev-mib() {
 143   echo $(( $(parted -m $dev unit MiB print | \
 144                sed -nr "s#^/dev/[^:]+:([0-9]+).*#\1#p") - 1))
 145 }
 146
 147 ##### end function defs
 148
 149 if ifclass REPARTITION; then
 150   partition=true # force a full wipe
 151 else
 152   partition=false # change to true to force a full wipe
 153 fi
 154 if ifclass NOWIPE; then
 155   wipe=false
 156 else
 157   wipe=true
 158 fi
 159
 160 if ((`nproc` > 2)); then
 161   mopts=,compress=zstd
 162 fi
 163
 164 declare -A disk_excludes
 165 if ! ifclass USE_MOUNTED; then
 166   ## ignore disks that are mounted, eg when running from fai-cd
 167   while read -r l; do
 168     eval "$l"
 169     if [[ ! $PKNAME ]]; then
 170       PKNAME="$KNAME"
 171     fi
 172     if [[ $MOUNTPOINT ]]; then
 173       disk_excludes[$PKNAME]=true
 174     fi
 175   done < <(lsblk -nP -o KNAME,MOUNTPOINT,PKNAME)
 176 fi
 177
 178 hdds=()
 179 ssds=()
 180 # this excludes usb. note: i may encounter some other type in the future.
 181 for disk in $(lsblk -do name,tran -n | awk '$2 ~ "^(sata|nvme)$" { print $1 }'); do
 182   if [[ ${disk_excludes[$disk]} ]]; then
 183     continue
 184   fi
 185   case $(cat /sys/block/$disk/queue/rotational) in
 186     0) ssds+=(/dev/$disk) ;;
 187     1) hdds+=(/dev/$disk) ;;
 188     *) echo "$0: error: unknown /sys/block/$disk/queue/rotational: \
 189 $(cat $disk/queue/rotational)"; exit 1 ;;
 190   esac
 191 done
 192
 193 # install all ssds, or if there are none, all hdds.
 194 # Note, usb flash disks are seen as rotational, which is
 195 # very odd, but convenient for ignoring them here.
 196 # TODO: find a reliable way to ignore them.
 197 if ! ifclass ROTATIONAL && (( ${#ssds[@]} > 0 )); then
 198   short_devs=( ${ssds[@]} )
 199 else
 200   short_devs=( ${hdds[@]} )
 201 fi
 202
 203 # check if the partitions exist have the right filesystems
 204 #blkid="$(blkid -s TYPE)"
 205 for dev in ${short_devs[@]}; do
 206   if $partition; then break; fi
 207   y=$(readlink -f $dev)
 208   arr=($y?*)
 209   if (( ${#arr[@]}  != lastn )); then
 210     partition=true
 211   fi
 212   # On one system, blkid is missing some partitions.
 213   # maybe we need a flag, like FUZZY_BLKID or something, so we
 214   # can check that at least some exist.
 215   # for x in "`rootdev`: TYPE=\"crypto_LUKS\"" "`bootdev`: TYPE=\"btrfs\""; do
 216   #     echo "$blkid" | grep -Fx "$x" &>/dev/null || partition=true
 217   # done
 218 done
 219
 220 if $partition && ifclass PARTITION_PROMPT; then
 221   echo "Press any key except ctrl-c to continue and partition these drives:"
 222   echo "  ${short_devs[*]}"
 223   read -r
 224 fi
 225
 226 devs=()
 227 shopt -s extglob
 228 for short_dev in ${short_devs[@]}; do
 229   devs+=($(devbyid $short_dev))
 230 done
 231 if [[ ! ${devs[0]} ]]; then
 232   echo "$0: error: failed to detect devs" >&2
 233   exit 1
 234 fi
 235
 236 boot_space=0
 237 first=true
 238 boot_devs=()
 239 for dev in ${devs[@]}; do
 240   if ifclass frodo; then
 241     # I ran into a machine where the bios doesn't know about some disks,
 242     # so 1st stage of grub also doesn't know about them.
 243     # Also, grub does not support mounting degraded btrfs as far as
 244     # I can tell with some googling.
 245     # From within an arch install env, I could detect them by noting
 246     # their partitions were mixed with the next disk in /dev/disk/by-path,
 247     # and I have mixed model disks, and I could see the 8 models which showed
 248     # up in the bios, and thus see which 2 models were missing.
 249     # hdparm -I /dev/sdh will give model info in linux.
 250     # However, in fai on jessie, /dev/disk/by-path dir doesn't exist,
 251     # and I don't see another way, so I'm hardcoding them.
 252     # We still put grub on them and partition them the same, for uniformity
 253     # and in case they get moved to a system that can recognize them,
 254     # we just exclude them from the boot filesystem.
 255     cd /dev/disk/by-id/
 256     bad_disk=false
 257     for id in ata-TOSHIBA_MD04ACA500_8539K4TQFS9A \
 258                 ata-TOSHIBA_MD04ACA500_Y5IFK6IJFS9A; do
 259       if [[ $(readlink -f $id) == "$(readlink -f $dev)" ]]; then
 260         bad_disk=true
 261         break
 262       fi
 263     done
 264     $bad_disk || boot_devs+=($(bootdev))
 265   else
 266     boot_space=$(( boot_space + $(parted -m $dev unit MiB print | \
 267                                     sed -nr "s#^/dev/[^:]+:([0-9]+).*#\1#p") - 1))
 268     boot_devs+=($(bootdev))
 269   fi
 270   if $first && [[ $boot_devs ]]; then
 271     first_efi=$(efidev)
 272     first_grub_extdev=$(grub_extdev)
 273     first=false
 274   fi
 275 done
 276 first_boot_dev=${boot_devs[0]}
 277
 278 even_raid=false
 279 if ifclass RAID0 || (( ${#boot_devs[@]} == 1 )); then
 280   raid_level=0
 281 elif ifclass RAID1 || (( ${#boot_devs[@]} <= 3 )); then
 282   if (( ${#boot_devs[@]} == 2 )); then
 283     even_raid=true
 284   fi
 285   raid_level=1
 286 else
 287   raid_level=10
 288 fi
 289
 290 ### Begin calculate boot partition space
 291 # due to raid duplication
 292 case $raid_level in
 293   1*) boot_space=$(( boot_space / 2 )) ;;
 294 esac
 295 if (( boot_space > 60000 )); then
 296   # this is larger than needed for several /boot subvols,
 297   # becuase I keep a minimal debian install on it for
 298   # recovery needs and for doing pxe-kexec.
 299   boot_mib=10000
 300 elif (( boot_space > 30000 )); then
 301   boot_mib=$(( 5000 + (boot_space - 30000) / 2 ))
 302 else
 303   # Small vms don't have room for /boot recovery.  With 3 kernels
 304   # installed, i'm using 132M on t8, so this seems like plenty of
 305   # room. note: rhel 8 recomments 1g for /boot.
 306   boot_mib=500
 307   #
 308 fi
 309 case $raid_level in
 310   1*) boot_mib=$(( boot_mib * 2 )) ;;
 311 esac
 312 ### end calculate boot partition space
 313
 314
 315
 316 if [[ ! $DISTRO ]]; then
 317   if ifclass VOL_BUSTER_BOOTSTRAP; then
 318     DISTRO=debianbuster_bootstrap
 319   elif ifclass VOL_STRETCH; then
 320     DISTRO=debianstretch
 321   elif ifclass VOL_BUSTER; then
 322     DISTRO=debianbuster
 323   elif ifclass VOL_BULLSEYE; then
 324     DISTRO=debianbullseye
 325   elif ifclass VOL_TESTING; then
 326     DISTRO=debiantesting
 327   elif ifclass VOL_XENIAL; then
 328     DISTRO=ubuntuxenial
 329   elif ifclass VOL_BIONIC; then
 330     DISTRO=ubuntubionic
 331   elif ifclass VOL_FOCAL; then
 332     DISTRO=ubuntufocal
 333   elif ifclass VOL_FLIDAS; then
 334     DISTRO=trisquelflidas
 335   elif ifclass VOL_ETIONA; then
 336     DISTRO=trisqueletiona
 337   elif ifclass VOL_NABIA; then
 338     DISTRO=trisquelnabia
 339   else
 340     echo "PARTITIONER ERROR: no distro class/var set" >&2
 341     exit 1
 342   fi
 343 fi
 344
 345
 346 bpart() { # btrfs a partition
 347   case $raid_level in
 348     0) mkfs.btrfs -f $@ ;;
 349     1) mkfs.btrfs -f -m raid1 -d raid1 $@ ;;
 350     10) mkfs.btrfs -f -m raid10 -d raid10 $@ ;;
 351   esac
 352 }
 353
 354
 355 if [[ ! $luks_dir ]]; then
 356   # see README for docs about how to create these
 357   luks_dir=$FAI/distro-install-common/luks
 358 fi
 359
 360 luks_file=$luks_dir/host-$HOSTNAME
 361 if [[ ! -e $luks_file ]]; then
 362   hostkeys=($luks_dir/host-*)
 363   # if there is only one key, we might be deploying somewhere
 364   # where dhcp doesnt give us a proper hostname, so use that.
 365   if [[ ${#hostkeys[@]} == 1 && -e ${hostkeys[0]} ]]; then
 366     luks_file=${hostkeys[0]}
 367   else
 368     echo "$0: error: no key for hostname at $luks_file" >&2
 369     exit 1
 370   fi
 371 fi
 372
 373 # # note, corresponding changes in /b/ds/keyscript-{on,off}
 374 if ifclass demohost; then
 375   lukspw=x
 376 elif [[ -e $luks_dir/$HOSTNAME ]]; then
 377   lukspw=$(cat $luks_dir/$HOSTNAME)
 378 else
 379   lukspw=$(cat $luks_dir/iank)
 380 fi
 381
 382
 383 first_root_crypt=$(root-cryptdev ${devs[0]})
 384
 385 # 1.5 x based on https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Installation_Guide/sect-disk-partitioning-setup-x86.html#sect-custom-partitioning-x86
 386 swap_mib=$(( $(grep ^MemTotal: /proc/meminfo | \
 387                  awk '{print $2}') * 3/(${#devs[@]} * 2 ) / 1024 ))
 388
 389 mkdir -p /tmp/fai
 390 root_devs=()
 391 for dev in ${devs[@]}; do
 392   root_devs+=($(rootdev))
 393 done
 394 shopt -s nullglob
 395 if $partition; then
 396
 397   ### begin wipefs
 398   if [[ ! $SPECIAL_DISK ]]; then
 399     for dev in ${devs[@]}; do
 400       # if we repartition to the same as an old partition,
 401       # we don't want any old fses hanging around.
 402       for (( i=1; i <= lastn; i++ )); do
 403         x=$(add-part $i)
 404         [[ -e $x ]] || continue
 405         count_down=10
 406         # wipefs has failed, manual run works, google suggests timing issue
 407         while ! wipefs -a $x; do
 408           sleep 2
 409           count_down=$((count_down - 1))
 410           (( count_down > 0 )) || exit 1
 411         done
 412       done
 413     done
 414   fi
 415   ### end wipefs
 416
 417
 418   if $even_raid; then
 419     for dev in ${devs[@]}; do
 420       cur_mib=$(dev-mib)
 421       if [[ ! $disk_mib ]] || (( cur_mib < disk_mib )); then
 422         disk_mib=$cur_mib
 423       fi
 424     done
 425   fi
 426
 427   for dev in ${devs[@]}; do
 428     if [[ $SPECIAL_DISK ]]; then
 429       dev=$(devbyid $SPECIAL_DISK)
 430     fi
 431
 432     # parted will round up the disk size. Do -1 so we can have
 433     # fully 1MiB unit partitions for easy resizing of the last partition.
 434     # Otherwise we would pass in -0 for the end argument for the last partition.
 435     #
 436     # Note: parted print error output is expected. example:
 437     # Error: /dev/vda: unrecognised disk label
 438     if ! $even_raid; then
 439       disk_mib=$(dev-mib)
 440     fi
 441     root_end=$(( disk_mib - swap_mib - boot_mib /  ${#boot_devs[@]} ))
 442     swap_end=$(( root_end + swap_mib))
 443
 444     parted -s $dev mklabel gpt
 445     # MiB because parted complains about alignment otherwise.
 446     pcmd="parted -a optimal -s -- $dev"
 447     $pcmd mkpart primary ext3 524MiB ${root_end}MiB
 448     # without naming, systemd gives us misc errors like:
 449     # dev-disk-by\x2dpartlabel-primary.device: Dev dev-disk-by\x2dpartlabel-primary.device appeared twice
 450     $pcmd name $rootn root
 451     # normally a swap is type "linux-swap", but this is encrypted swap. using that
 452     # label will confuse systemd.
 453     $pcmd mkpart primary "" ${root_end}MiB ${swap_end}MiB
 454     $pcmd name $swapn swap
 455     $pcmd mkpart primary "" ${swap_end}MiB ${disk_mib}MiB
 456     $pcmd name $bootn boot
 457     # eufi = bloated, half a gig gimme a break.
 458     $pcmd mkpart primary "fat32" 12MiB 524MiB
 459     $pcmd name $efin efi
 460     $pcmd set $efin esp on
 461     # note, this is shown here: https://support.system76.com/articles/bootloader/
 462     # but not mentioned https://wiki.archlinux.org/index.php/EFI_system_partition
 463     # probably not needed
 464     $pcmd set $bootn boot on
 465     # i only need a few k, but googling min size,
 466     # I found someone saying that gparted required
 467     # required at least 8 because of their hard drive cylinder size.
 468     # And 8 is still very tiny.
 469     $pcmd mkpart primary "ext2" 4MiB 12MiB
 470     $pcmd name $grub_extn grubext
 471     # gpt ubuntu cloud image uses ~4 mb for this partition. fai uses 1 MiB.
 472     # so, I use 3, whatever.
 473     # note: parted manual saying cheap flash media
 474     # should to start at 4.
 475     $pcmd mkpart primary "" 1MiB 4MiB
 476     $pcmd name $bios_grubn biosgrub
 477     $pcmd set $bios_grubn bios_grub on
 478     $pcmd set $bootn boot on # generally not needed on modern systems
 479     # the mkfs failed before on a vm, which prompted me to add
 480     # sleep .1
 481     # then it failed again on a physical machine
 482     # with:
 483     # Device /dev/disk/by-id/foo doesn't exist or access denied,
 484     # so I added a wait until it existed.
 485     # Then I added the mkfs.ext2, which claimed to succeed,
 486     # but then couldn't be found upon reboot. In that case we didn't
 487     # wait at all. So I've added a 3 second minimum wait.
 488     sleep 3
 489     secs=0
 490     while [[ ! -e $(rootdev) ]] && (( secs < 10 )); do
 491       sleep 1
 492       secs=$((secs +1))
 493     done
 494
 495     mkfs.fat -F32 $(efidev)
 496
 497     # Holds just a single file, rarely written, so
 498     # use ext2, like was often used for the /boot partition.
 499     # This exists because grub can only persist data to a non-cow fs.
 500     # And we use persisting a var in grub to do a one time boot.
 501     # We could pass the data on the kernel command line and persist it
 502     # to grubenv after booting, but that relies on the boot always succeeding.
 503     # This is just a bit more robust, and it could work for booting
 504     # into ipxe which can't persist data, if we ever got that working.
 505     mkfs.ext2 $(grub_extdev)
 506     # when we move to newer than trisquel 9, we can remove
 507     # --type luks1. We can also check on cryptsetup --help | less /compil
 508     # to see about the other settings. Default in debian 9 is luks2.
 509     # You can convert from luks2 to luks 1 by adding a temporary key:
 510     # cryptsetup luksAddKey --pbkdf pbkdf2
 511     # then remove the new format keys with cryptsetup luksRemoveKey
 512     # then cryptsetup convert DEV --type luks1, then readd old keys and remove temp.
 513     yes YES | cryptsetup luksFormat $(rootdev) $luks_file \
 514                          --type luks1 -c aes-cbc-essiv:sha256 -s 256 || [[ $? == 141 ]]
 515     yes "$lukspw" | \
 516       cryptsetup luksAddKey --key-file $luks_file \
 517                  $(rootdev) || [[ $? == 141 ]]
 518     # background: Keyfile and password are treated just
 519     # like 2 ways to input a passphrase, so we don't actually need to have
 520     # different contents of keyfile and passphrase, but it makes some
 521     # security sense to a really big randomly generated passphrase
 522     # as much as possible, so we have both.
 523     #
 524     # This would remove the keyfile.
 525     #    yes 'test' | cryptsetup luksRemoveKey /dev/... \
 526       #                            /key/file || [[ $? == 141 ]]
 527
 528     cryptsetup luksOpen $(rootdev) $(root-cryptname) \
 529                --key-file $luks_file
 530
 531     if [[ $SPECIAL_DISK ]]; then
 532       exit 0
 533     fi
 534   done
 535   ls -la /dev/btrfs-control # this was probably for debugging...
 536   sleep 1
 537   bpart $(for dev in ${devs[@]}; do root-cryptdev; done)
 538   bpart ${boot_devs[@]}
 539 else
 540   for dev in ${devs[@]}; do
 541     if [[ -e /dev/mapper/$(root-cryptname) ]]; then
 542       continue
 543     fi
 544     cryptsetup luksOpen $(rootdev) $(root-cryptname) \
 545                --key-file $luks_file
 546   done
 547   sleep 1
 548 fi
 549
 550
 551 if $wipe && [[ $DISTRO != debianbuster_bootstrap ]]; then
 552   # bootstrap distro doesn't use separate encrypted root.
 553   mount -o subvolid=0 $first_root_crypt /mnt
 554   # systemd creates subvolumes we want to delete.
 555   s=($(btrfs subvolume list --sort=-path /mnt |
 556          sed -rn "s#^.*path\s*(root_$DISTRO/\S+)\s*\$#\1#p"))
 557   for subvol in ${s[@]}; do btrfs subvolume delete /mnt/$subvol; done
 558   btrfs subvolume set-default 0 /mnt
 559   [[ ! -e /mnt/root_$DISTRO ]] || btrfs subvolume delete /mnt/root_$DISTRO
 560
 561   ## create subvols ##
 562   cd /mnt
 563
 564   btrfs subvolume create root_$DISTRO
 565
 566   # could set default subvol like this, but no reason to.
 567   # btrfs subvolume set-default \
 568     #       $(btrfs subvolume list . | grep "root_$DISTRO$" | awk '{print $2}') .
 569
 570   # no cow on the root filesystem. it's setup is fully scripted,
 571   # if it's messed up, we will just recreated it,
 572   # and we can get better perf with this.
 573   # I can't remember exactly why, but this is preferable to mounting with
 574   # -o nodatacow, I think because subvolumes inherit that.
 575   chattr -Rf +C root_$DISTRO
 576   cd /
 577   umount /mnt
 578 fi
 579
 580 mount -o subvolid=0 $first_boot_dev /mnt
 581 cd /mnt
 582 btrfs subvolume set-default 0 /mnt # already default, just ensuring it.
 583
 584 # for libreboot systems. grub2 only reads from subvolid=0
 585 mkdir -p /mnt/grub2
 586 cp $FAI/distro-install-common/libreboot_grub.cfg /mnt/grub2
 587
 588 if [[ $DISTRO == debianbuster_bootstrap ]]; then
 589   # this is just convenience for the libreboot_grub config
 590   # so we can glob the other ones easier.
 591   boot_vol=$DISTRO
 592 else
 593   boot_vol=boot_$DISTRO
 594 fi
 595 if $wipe && [[ -e /mnt/$boot_vol ]]; then
 596   btrfs subvolume delete /mnt/$boot_vol
 597 fi
 598 if [[ ! -e /mnt/$boot_vol ]]; then
 599   btrfs subvolume create $boot_vol
 600 fi
 601 cd /
 602 umount /mnt
 603 ## end create subvols ##
 604
 605 dev=${boot_devs[0]}
 606 mount $first_grub_extdev /mnt
 607 grub-editenv /mnt/grubenv set did_fai_check=true
 608 grub-editenv /mnt/grubenv set last_boot=/$boot_vol
 609 umount /mnt
 610
 611 if [[ $DISTRO == debianbuster_bootstrap ]]; then
 612   cat > /tmp/fai/fstab <<EOF
 613 $first_boot_dev  /  btrfs  noatime,subvol=$boot_vol  0 0
 614 $first_efi  /boot/efi  vfat          nofail,x-systemd.device-timeout=30s,x-systemd.mount-timeout=30s  0 0
 615 EOF
 616   cat >/tmp/fai/disk_var.sh <<EOF
 617 BOOT_DEVICE="${short_devs[@]}"
 618 ROOT_PARTITION=$first_boot_dev
 619 EOF
 620 else
 621   # note, fai creates the mountpoints listed here
 622   cat > /tmp/fai/fstab <<EOF
 623 $first_root_crypt  /  btrfs          x-systemd.device-timeout=90s,x-systemd.mount-timeout=90s,noatime,subvol=root_$DISTRO$mopts  0 0
 624 $first_root_crypt  /mnt/root  btrfs  nofail,x-systemd.device-timeout=30s,x-systemd.mount-timeout=30s,noatime,subvolid=0$mopts  0 0
 625 $first_boot_dev  /boot  btrfs        nofail,x-systemd.device-timeout=30s,x-systemd.mount-timeout=30s,noatime,subvol=$boot_vol  0 0
 626 $first_efi  /boot/efi  vfat          nofail,x-systemd.device-timeout=30s,x-systemd.mount-timeout=30s  0 0
 627 $first_boot_dev  /mnt/boot  btrfs    nofail,x-systemd.device-timeout=30s,x-systemd.mount-timeout=30s,noatime,subvolid=0  0 0
 628 EOF
 629   swaps=()
 630   rm -f /tmp/fai/crypttab
 631   for dev in ${devs[@]}; do
 632     swaps+=($(swap-cryptname))
 633     cat >>/tmp/fai/crypttab <<EOF
 634 $(root-cryptname) $(rootdev)  none  keyscript=/root/keyscript,discard,luks,initramfs
 635 $(swap-cryptname) $(swapdev)  /dev/urandom  swap,cipher=aes-xts-plain64,size=256,hash=ripemd160
 636 EOF
 637     cat >> /tmp/fai/fstab <<EOF
 638 $(swap-cryptdev)  none  swap  nofail,x-systemd.device-timeout=30s,x-systemd.mount-timeout=30s,sw  0 0
 639 EOF
 640   done
 641
 642   # fai would do this:
 643   #BOOT_DEVICE=\${BOOT_DEVICE:-"${devs[0]}"}
 644
 645   # note: swaplist seems to do nothing.
 646   cat >/tmp/fai/disk_var.sh <<EOF
 647 BOOT_DEVICE="${short_devs[@]}"
 648 BOOT_PARTITION=\${BOOT_PARTITION:-$first_boot_dev}
 649 # ROOT_PARTITIONS is added by me, used in arch setup.
 650 ROOT_PARTITIONS="${root_devs[@]}"
 651 ROOT_PARTITION=\${ROOT_PARTITION:-$first_root_crypt}
 652 SWAPLIST=\${SWAPLIST:-"${swaps[@]}"}
 653 EOF
 654 fi
 655
 656 # initial setup of extra data fs, mounted,
 657 # btrfs subvol create nocow
 658 # chattr +C nocow
 659 # chown iank.iank nocow
 660
 661 if [[ $HOSTNAME == kd ]]; then
 662   cat >>/tmp/fai/crypttab <<EOF
 663 crypt_dev_ata-Samsung_SSD_870_QVO_8TB_S5VUNG0N900656V-part6 /dev/disk/by-id/ata-Samsung_SSD_870_QVO_8TB_S5VUNG0N900656V-part6  none  keyscript=decrypt_keyctl,discard,luks,initramfs
 664 crypt_dev_ata-TOSHIBA_MD04ACA500_84R2K773FS9A-part1 /dev/disk/by-id/ata-TOSHIBA_MD04ACA500_84R2K773FS9A-part1  keyscript=decrypt_keyctl,discard,luks,initramfs
 665 EOF
 666   cat >> /tmp/fai/fstab <<EOF
 667 /dev/mapper/crypt_dev_ata-Samsung_SSD_870_QVO_8TB_S5VUNG0N900656V-part6  /d  btrfs  nofail,x-systemd.device-timeout=30s,x-systemd.mount-timeout=30s,noatime,compress=zstd,subvol=nocow  0 0
 668 # r6 = root partition6
 669 /dev/mapper/crypt_dev_ata-Samsung_SSD_870_QVO_8TB_S5VUNG0N900656V-part6  /mnt/r6  btrfs  nofail,x-systemd.device-timeout=30s,x-systemd.mount-timeout=30s,noatime,compress=zstd,subvolid=0  0 0
 670 /dev/mapper/crypt_dev_ata-TOSHIBA_MD04ACA500_84R2K773FS9A-part1  /mnt/rust  btrfs  nofail,x-systemd.device-timeout=30s,x-systemd.mount-timeout=30s,noatime,compress=zstd,subvolid=0  0 0
 671 EOF
 672 fi