iankelling.org / git / automated-distro-installer / blob
? search:


d702351a38178de41b5ed2e6395af241ab9035dc
[automated-distro-installer] / fai / config / hooks / partition.DEFAULT
1 #!/bin/bash -x
2 # Copyright (C) 2016 Ian Kelling
3
4 # This program is free software; you can redistribute it and/or
5 # modify it under the terms of the GNU General Public License
6 # as published by the Free Software Foundation; either version 2
7 # of the License, or (at your option) any later version.
8
9 # This program is distributed in the hope that it will be useful,
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 # GNU General Public License for more details.
13
14 # You should have received a copy of the GNU General Public License
15 # along with this program; if not, write to the Free Software
16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
17
18 PS4='+ $LINENO '
19 set -eE -o pipefail
20 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
21
22 if [[ $EUID != 0 ]]; then
23 echo "$0: error: need to run as root" >&2
24 exit 1
25 fi
26
27 # for calling outside of FAI without args:
28 # fai-redep
29 #
30 # source /b/fai/fai-wrapper
31 # - set any appropriate classes with: fai-setclass OPT1... which sets CLASS_OPT1=true...
32 # or run eval-fai-classfile FILE.
33 # - Set a VOL_DISTROVER (if not doing mkroot2) eg:
34 # fai-setclass VOL_NABIA
35 #
36 # ARGS (only 1 is valid):
37 #
38 # mkroot2: for running outside of fai and setting up the root2/boot2 luks and btrfs and tab files
39 #
40 # mkroot2tab: for running outside of fai and setting up the root2/boot2 tab files, in case luks and btrfs
41 # happen to already be setup.
42 #
43 # mktab: for running outside of fai and generating a crypttab for
44 # the main root fs in /tmp/fai. Must run with env var, eg export DISTRO=trisquelnabia.
45 #
46 # Example use in a bootstrap distro:
47 # scp /a/bin/fai/fai/config/{distro-install-common/devbyid,hooks/partition.DEFAULT} root@HOST:
48 # sl HOST
49 # export DISTRO=trisquelnabia; ./partition.DEFAULT mktab
50 # ## cryptsetup wont take within a pipeline
51 # mapfile -t lines < <(awk '! /swap/ {print $2,$1}' /tmp/fai/crypttab )
52 # for l in "${lines[@]}"; do cryptsetup luksOpen $l; done
53 #
54 # # or alternatively, to avoid typing it many times:
55 # read -r lukspw; for l in "${lines[@]}"; do yes "$lukspw" | cryptsetup luksOpen $l; done
56
57 ## potentially useful later:
58 # sed 's#/root/keyscript,#decrypt_keyctl,#;s/$/,noauto/' /tmp/fai/crypttab >/etc/crypttab
59 #
60 # environment variables:
61 #
62 # HOSTNAME: if frodo, we exclude 2 devices from the /boot array, which
63 # the bios does not see. if demohost, we set the luks password to just
64 # 'x'.
65 #
66 # SPECIAL_DISK: For use outside of fai. A base disk name like
67 # /dev/sdk. If set, we just cryptsetup and partition this one disk then
68 # exit. This is useful for partitioning a disk in preparation to replace
69 # a failed or failing disk from a raid10 array.
70 #
71 # classes:
72 #
73 # REPARTITION: forces repartitioning even if we detect the proper amount
74 # of partitions already exist.
75 #
76 # NOWIPE: use existing subvolumes if they exist
77 #
78 # REROOTFS: Don't reuse the root filesystem, even if we normally would
79 #
80 # ROTATIONAL: forces to install onto hdds instead of sdds. normally sdds
81 # are chosen if they exist.
82 #
83 # PARTITION_PROMPT: command line prompt before partitioning
84 #
85 # RAID0: forces raid0 filesystem. Normally with 4+ devices, we use
86 # raid10.
87 # RAID1: forces raid1 filesystem.
88
89 mkroot2tab=false
90 mkroot2=false
91 mktab=false
92 if [[ $1 ]]; then
93 ## duplicates fai-wrapper, for convenience of not needing it
94 if ! type -t ifclass &>/dev/null; then
95 ifclass() {
96 local var=${1/#/CLASS_}
97 [[ $HOSTNAME == $1 || ${!var} ]]
98 }
99 fi
100
101 case $1 in
102 mkroot2)
103 mkroot2=true
104 ;;
105 mkroot2tab)
106 mkroot2tab=true
107 ;;
108 mktab)
109 mktab=true
110 ;;
111 *)
112 echo "$0: error: unsupported arg: $1" >&2
113 exit 1
114 ;;
115 esac
116 fi
117
118
119 if [[ $SPECIAL_DISK ]]; then
120 export CLASS_REPARTITION=true
121 fi
122
123 # # fai's setup-storage won't do btrfs on luks,
124 # # so we do it ourself :)
125 # inspiration taken from files in fai-setup-storage package
126
127 # if we are not running in fai, skiptask won't be defined, so carry on.
128 skiptask partition || ! type skiptask
129
130 if ! type -p devbyid; then
131 for d in $FAI/distro-install-common \
132 /a/bin/fai/fai/config/distro-install-common $FAI $PWD; do
133 [[ -d $d ]] || continue
134 if [[ -e $d/devbyid ]]; then
135 devbyid=$d/devbyid
136 devbyid() { $devbyid "$@"; }
137 break
138 fi
139 done
140 if [[ ! $devbyid ]]; then
141 echo "$0: error: failed to find devbyid script" >&2
142 exit 1
143 fi
144 fi
145
146
147
148 #### begin configuration
149
150 # this is the ordering of the /dev/sdaX, but
151 # the ordering of the partition layout goes like this:
152 # bios_grub
153 # grub_ext
154 # efi
155 # root
156 # swap
157 # boot
158
159 rootn=1
160 root2n=2
161 swapn=3
162 bootn=4
163 boot2n=5
164 efin=6
165 # ext partition so grub can write persistent variables,
166 # so it can do a one time boot. grub can't write to
167 # btrfs or any cow fs because it's more
168 # more complicated to do and they don't want to.
169 grub_extn=7
170 # bios boot partition,
171 # https://wiki.archlinux.org/index.php/GRUB
172 bios_grubn=8
173 # for an even raid (raid 1), when one disk is bigger, this partition goes on the big disk
174 even_bign=9
175 lastn=$bios_grubn
176
177
178
179 ##### end configuration
180
181 ##### begin function defs
182
183 add-part() { # add partition suffix to $dev
184 local d part
185 if [[ $# == 1 ]]; then
186 d=$dev
187 part=$1
188 else
189 d=$1
190 part=$2
191 fi
192 echo $d-part$part
193 }
194
195 rootdev() { add-part $@ $rootn; }
196 root2dev() { add-part $@ $root2n; }
197
198 # note, the following block could all have $@ like below
199 # But it is not added since it is not used and shellcheck
200 # rightly says args never used should not exist.
201 ##swapdev() { add-part $swapn; }
202
203 swapdev() { add-part $swapn; }
204 bootdev() { add-part $bootn; }
205 boot2dev() { add-part $boot2n; }
206 efidev() { add-part $efin; }
207 grub_extdev() { add-part $grub_extn; }
208 bios_grubdev() { add-part $bios_grubn; }
209 even_bigdev() { add-part $even_bign; }
210
211 crypt-dev() { echo /dev/mapper/crypt_dev_${1##*/}; }
212 crypt-name() { echo crypt_dev_${1##*/}; }
213 root-cryptdev() { crypt-dev $(rootdev $@); }
214 root2-cryptdev() { crypt-dev $(root2dev $@); }
215
216 # I omit a possible parameter since it is unused:
217 ##swap-cryptdev() { crypt-dev $(swapdev $@); }
218 swap-cryptdev() { crypt-dev $(swapdev); }
219 root-cryptname() { crypt-name $(rootdev); }
220 root2-cryptname() { crypt-name $(root2dev); }
221 swap-cryptname() { crypt-name $(swapdev); }
222
223 dev-mib() {
224 local d=${1:-$dev}
225 echo $(( $(parted -m $d unit MiB print | \
226 sed -nr "s#^/dev/[^:]+:([0-9]+).*#\1#p") - 1))
227 }
228
229 luks-setup() {
230 local luksdev="$1"
231 # when we move to newer than trisquel 9, we can remove
232 # --type luks1. We can also check on cryptsetup --help | less /compil
233 # to see about the other settings. Default in debian 9 is luks2.
234 # You can convert from luks2 to luks 1 by adding a temporary key:
235 # cryptsetup luksAddKey --pbkdf pbkdf2
236 # then remove the new format keys with cryptsetup luksRemoveKey
237 # then cryptsetup convert DEV --type luks1, then readd old keys and remove temp.
238 yes YES | cryptsetup luksFormat $luksdev $luks_file || [[ $? == 141 ]]
239 yes "$lukspw" | \
240 cryptsetup luksAddKey --key-file $luks_file \
241 $luksdev || [[ $? == 141 ]]
242 # background: Keyfile and password are treated just
243 # like 2 ways to input a passphrase, so we don't actually need to have
244 # different contents of keyfile and passphrase, but it makes some
245 # security sense to a really big randomly generated passphrase
246 # as much as possible, so we have both.
247 #
248 # This would remove the keyfile.
249 # yes 'test' | cryptsetup luksRemoveKey /dev/... \
250 # /key/file || [[ $? == 141 ]]
251 cryptsetup luksOpen $luksdev $(crypt-name $luksdev) --key-file $luks_file
252 }
253
254 ##### end function defs
255
256
257 ##### begin variable setup
258 partition=false
259 if ifclass REPARTITION; then
260 partition=true # force a full wipe
261 fi
262 wipe=true
263 if ifclass NOWIPE; then
264 wipe=false
265 fi
266
267 rerootfs=false
268 if ifclass REROOTFS; then
269 rerootfs=true
270 fi
271
272 if (($(nproc) > 2)); then
273 mopts=,compress=zstd
274 fi
275
276 declare -A disk_excludes
277 if ! $mkroot2 && ! $mkroot2tab && ! $mktab ! ifclass USE_MOUNTED; then
278 ## ignore disks that are mounted, eg when running from fai-cd
279 while read -r l; do
280 eval "$l"
281 if [[ ! $PKNAME ]]; then
282 # shellcheck disable=SC2153 # not a misspelling
283 PKNAME="$KNAME"
284 fi
285 if [[ $MOUNTPOINT ]]; then
286 disk_excludes[$PKNAME]=true
287 fi
288 done < <(lsblk -nP -o KNAME,MOUNTPOINT,PKNAME)
289 fi
290
291 hdds=()
292 ssds=()
293 # this excludes usb. note: i may encounter some other type in the future.
294 for disk in $(lsblk -do name,tran -n | awk '$2 ~ "^(sata|nvme)$" { print $1 }'); do
295 if [[ ${disk_excludes[$disk]} ]]; then
296 continue
297 fi
298 case $(cat /sys/block/$disk/queue/rotational) in
299 0) ssds+=("/dev/$disk") ;;
300 1) hdds+=("/dev/$disk") ;;
301 *) echo "$0: error: unknown /sys/block/$disk/queue/rotational: \
302 $(cat $disk/queue/rotational)"; exit 1 ;;
303 esac
304 done
305
306 # install all ssds, or if there are none, all hdds.
307 # Note, usb flash disks are seen as rotational, which is
308 # very odd, but convenient for ignoring them here.
309 # TODO: find a reliable way to ignore them.
310 if ! ifclass ROTATIONAL && (( ${#ssds[@]} > 0 )); then
311 read -ra short_devs<<<"${ssds[@]}"
312 else
313 read -ra short_devs<<<"${hdds[@]}"
314 fi
315
316 # check if the partitions exist have the right filesystems
317 #blkid="$(blkid -s TYPE)"
318 for dev in ${short_devs[@]}; do
319 if $partition; then break; fi
320 y=$(readlink -f $dev)
321 # shellcheck disable=SC2206 # globbing is intended
322 arr=($y?*)
323 if (( ${#arr[@]} < lastn )); then
324 partition=true
325 fi
326 # On one system, blkid is missing some partitions.
327 # maybe we need a flag, like FUZZY_BLKID or something, so we
328 # can check that at least some exist.
329 # for x in "`rootdev`: TYPE=\"crypto_LUKS\"" "`bootdev`: TYPE=\"btrfs\""; do
330 # echo "$blkid" | grep -Fx "$x" &>/dev/null || partition=true
331 # done
332 done
333
334 if $partition && ifclass PARTITION_PROMPT; then
335 echo "Press any key except ctrl-c to continue and partition these drives:"
336 echo " ${short_devs[*]}"
337 read -r
338 fi
339
340 devs=()
341 shopt -s extglob
342 for short_dev in ${short_devs[@]}; do
343 devs+=("$(devbyid $short_dev)")
344 done
345 if [[ ! ${devs[0]} ]]; then
346 echo "$0: error: failed to detect devs" >&2
347 exit 1
348 fi
349
350 boot_space=0
351 first=true
352 boot_devs=()
353 boot2_devs=()
354 for dev in ${devs[@]}; do
355 if ifclass frodo; then
356 # I ran into a machine where the bios doesn't know about some disks,
357 # so 1st stage of grub also doesn't know about them.
358 # Also, grub does not support mounting degraded btrfs as far as
359 # I can tell with some googling.
360 # From within an arch install env, I could detect them by noting
361 # their partitions were mixed with the next disk in /dev/disk/by-path,
362 # and I have mixed model disks, and I could see the 8 models which showed
363 # up in the bios, and thus see which 2 models were missing.
364 # hdparm -I /dev/sdh will give model info in linux.
365 # However, in fai on jessie, /dev/disk/by-path dir doesn't exist,
366 # and I don't see another way, so I'm hardcoding them.
367 # We still put grub on them and partition them the same, for uniformity
368 # and in case they get moved to a system that can recognize them,
369 # we just exclude them from the boot filesystem.
370 cd /dev/disk/by-id/
371 bad_disk=false
372 for id in ata-TOSHIBA_MD04ACA500_8539K4TQFS9A \
373 ata-TOSHIBA_MD04ACA500_Y5IFK6IJFS9A; do
374 if [[ $(readlink -f $id) == "$(readlink -f $dev)" ]]; then
375 bad_disk=true
376 break
377 fi
378 done
379 if ! $bad_disk; then
380 boot_devs+=("$(bootdev)")
381 boot2_devs+=("$(boot2dev)")
382 fi
383 else
384 boot_space=$(( boot_space + $(parted -m $dev unit MiB print | \
385 sed -nr "s#^/dev/[^:]+:([0-9]+).*#\1#p") - 1))
386 boot_devs+=("$(bootdev)")
387 boot2_devs+=("$(boot2dev)")
388 fi
389 if $first && (( ${#boot_devs[@]} >= 1 )) ; then
390 first_efi=$(efidev)
391 first_grub_extdev=$(grub_extdev)
392 first=false
393 fi
394 done
395 first_boot_dev=${boot_devs[0]}
396
397 even_raid=false
398 if ifclass RAID0 || (( ${#boot_devs[@]} == 1 )); then
399 raid_level=0
400 elif ifclass RAID1 || (( ${#boot_devs[@]} <= 3 )); then
401 if (( ${#boot_devs[@]} == 2 )); then
402 even_raid=true
403 fi
404 raid_level=1
405 else
406 raid_level=10
407 fi
408
409
410
411 ### Begin calculate boot partition space
412 # due to raid duplication
413 case $raid_level in
414 1*) boot_space=$(( boot_space / 2 )) ;;
415 esac
416 if (( boot_space > 60000 )); then
417 # this is larger than needed for several /boot subvols,
418 # becuase I keep a minimal debian install on it for
419 # recovery needs and for doing pxe-kexec.
420 boot_mib=10000
421 root2_mib=1000000
422 boot2_mib=5000
423 elif (( boot_space > 30000 )); then
424 boot_mib=$(( 5000 + (boot_space - 30000) / 2 ))
425 root2_mib=100
426 boot2_mib=100
427 else
428 # Small vms don't have room for /boot recovery. With 3 kernels
429 # installed, i'm using 132M on t8, so this seems like plenty of
430 # room. note: rhel 8 recomments 1g for /boot. u20.04 with 3 kernels =
431 # 308 mb, so things have grown significantly
432 boot_mib=1000
433 root2_mib=100
434 boot2_mib=100
435 fi
436 case $raid_level in
437 1*)
438 boot_mib=$(( boot_mib * 2 ))
439 boot2_mib=$(( boot2_mib * 2 ))
440 root2_mib=$(( root2_mib * 2 ))
441 ;;
442 esac
443 ### end calculate boot partition space
444
445 bpart() { # btrfs a partition
446 case $raid_level in
447 0) mkfs.btrfs -f $@ ;;
448 1) mkfs.btrfs -f -m raid1 -d raid1 $@ ;;
449 10) mkfs.btrfs -f -m raid10 -d raid10 $@ ;;
450 esac
451 }
452
453
454 if [[ ! $DISTRO ]]; then
455 if ifclass VOL_BULLSEYE_BOOTSTRAP; then
456 DISTRO=debianbullseye_bootstrap
457 elif ifclass VOL_STRETCH; then
458 DISTRO=debianstretch
459 elif ifclass VOL_BUSTER; then
460 DISTRO=debianbuster
461 elif ifclass VOL_BULLSEYE; then
462 DISTRO=debianbullseye
463 elif ifclass VOL_BOOKWORM; then
464 DISTRO=debianbookworm
465 elif ifclass VOL_TESTING; then
466 DISTRO=debiantesting
467 elif ifclass VOL_XENIAL; then
468 DISTRO=ubuntuxenial
469 elif ifclass VOL_BIONIC; then
470 DISTRO=ubuntubionic
471 elif ifclass VOL_FOCAL; then
472 DISTRO=ubuntufocal
473 elif ifclass VOL_FLIDAS; then
474 DISTRO=trisquelflidas
475 elif ifclass VOL_ETIONA; then
476 DISTRO=trisqueletiona
477 elif ifclass VOL_NABIA; then
478 DISTRO=trisquelnabia
479 elif $mkroot2 || $mkroot2tab; then
480 :
481 else
482 echo "PARTITIONER ERROR: no distro class/var set" >&2
483 exit 1
484 fi
485 fi
486
487 if [[ $DISTRO == debianbullseye_bootstrap ]]; then
488 # this is just convenience for the libreboot_grub config
489 # so we can glob the other ones easier.
490 boot_vol=$DISTRO
491 else
492 boot_vol=boot_$DISTRO
493 fi
494
495
496 first_root_crypt=$(root-cryptdev ${devs[0]})
497
498 # 1.5 x based on https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Installation_Guide/sect-disk-partitioning-setup-x86.html#sect-custom-partitioning-x86
499 swap_mib=$(( $(grep ^MemTotal: /proc/meminfo | \
500 awk '{print $2}') * 3/(${#devs[@]} * 2 ) / 1024 ))
501
502 root_devs=()
503 for dev in ${devs[@]}; do
504 root_devs+=("$(rootdev)")
505 done
506 shopt -s nullglob
507 ##### end variable setup
508
509
510
511 mktab() {
512 mkdir -p /tmp/fai
513 dev=${boot_devs[0]}
514 fstabstd="x-systemd.device-timeout=30s,x-systemd.mount-timeout=30s"
515
516 if [[ $DISTRO == debianbullseye_bootstrap ]]; then
517 cat > /tmp/fai/fstab <<EOF
518 $first_boot_dev / btrfs noatime,subvol=$boot_vol 0 0
519 $first_efi /boot/efi vfat nofail,$fstabstd 0 0
520 EOF
521 cat >/tmp/fai/disk_var.sh <<EOF
522 BOOT_DEVICE="${short_devs[@]}"
523 ROOT_PARTITION=$first_boot_dev
524 EOF
525 else
526 # note, fai creates the mountpoints listed here
527 cat > /tmp/fai/fstab <<EOF
528 $first_root_crypt / btrfs $fstabstd,noatime,subvol=root_$DISTRO$mopts 0 0
529 $first_root_crypt /mnt/root btrfs nofail,$fstabstd,noatime,subvolid=0$mopts 0 0
530 $first_boot_dev /boot btrfs nofail,$fstabstd,noatime,subvol=$boot_vol 0 0
531 $first_efi /boot/efi vfat nofail,$fstabstd 0 0
532 $first_boot_dev /mnt/boot btrfs nofail,$fstabstd,noatime,subvolid=0 0 0
533 EOF
534 swaps=()
535 rm -f /tmp/fai/crypttab
536 for dev in ${devs[@]}; do
537 swaps+=("$(swap-cryptname)")
538 cat >>/tmp/fai/crypttab <<EOF
539 $(root-cryptname) $(rootdev) none keyscript=/root/keyscript,discard,luks,initramfs
540 $(swap-cryptname) $(swapdev) /dev/urandom swap,cipher=aes-xts-plain64,size=256,hash=ripemd160
541 EOF
542 cat >> /tmp/fai/fstab <<EOF
543 $(swap-cryptdev) none swap nofail,$fstabstd,sw 0 0
544 EOF
545 done
546
547 # fai would do this:
548 #BOOT_DEVICE=\${BOOT_DEVICE:-"${devs[0]}"}
549
550 # note: swaplist seems to do nothing.
551 cat >/tmp/fai/disk_var.sh <<EOF
552 BOOT_DEVICE="${short_devs[@]}"
553 BOOT_PARTITION=\${BOOT_PARTITION:-$first_boot_dev}
554 # ROOT_PARTITIONS is added by me, used in arch setup.
555 ROOT_PARTITIONS="${root_devs[@]}"
556 ROOT_PARTITION=\${ROOT_PARTITION:-$first_root_crypt}
557 SWAPLIST=\${SWAPLIST:-"${swaps[@]}"}
558 EOF
559
560 if [[ $HOSTNAME == kd ]]; then
561 # note, having these with keyscript and initramfs causes a luks error in fai.log,
562 # but it is safely ignorable and gets us the ability to just type our password
563 # in once at boot. A downside is that they are probably needed to be plugged in to boot.
564 cat >>/tmp/fai/crypttab <<EOF
565 crypt_dev_ata-Samsung_SSD_870_QVO_8TB_S5VUNG0N900656V-part${even_bign} /dev/disk/by-id/ata-Samsung_SSD_870_QVO_8TB_S5VUNG0N900656V-part${even_bign} none keyscript=decrypt_keyctl,discard,luks,initramfs
566 crypt_dev_ata-TOSHIBA_MD04ACA500_84R2K773FS9A-part1 /dev/disk/by-id/ata-TOSHIBA_MD04ACA500_84R2K773FS9A-part1 none keyscript=decrypt_keyctl,discard,luks,initramfs
567 crypt_dev_ata-ST6000DM001-1XY17Z_Z4D29EBL-part1 /dev/disk/by-id/ata-ST6000DM001-1XY17Z_Z4D29EBL-part1 none keyscript=decrypt_keyctl,discard,luks,initramfs
568 EOF
569 cat >> /tmp/fai/fstab <<EOF
570 # r7 = root partition7. it isnt actually #7 anymore, not a great name, but whatever
571 /dev/mapper/crypt_dev_ata-Samsung_SSD_870_QVO_8TB_S5VUNG0N900656V-part${even_bign} /mnt/r7 btrfs nofail,$fstabstd,noatime,compress=zstd,subvolid=0 0 0
572 /dev/mapper/crypt_dev_ata-TOSHIBA_MD04ACA500_84R2K773FS9A-part1 /mnt/rust1 btrfs nofail,$fstabstd,noatime,compress=zstd,subvolid=0 0 0
573 /dev/mapper/crypt_dev_ata-ST6000DM001-1XY17Z_Z4D29EBL-part1 /mnt/rust2 btrfs nofail,$fstabstd,noatime,compress=zstd,subvolid=0 0 0
574 EOF
575 fi
576 fi
577 }
578
579
580
581 getluks() {
582 if [[ ! $luks_dir ]]; then
583 # see README for docs about how to create these
584 luks_dir=$FAI/distro-install-common/luks
585 if [[ ! -d $luks_dir ]]; then
586 luks_dir=/q/root/luks
587 fi
588 if [[ ! -d $luks_dir ]]; then
589 echo "$0: error: no luks_dir found" >&2
590 exit 1
591 fi
592 fi
593
594 luks_file=$luks_dir/host-$HOSTNAME
595 if [[ ! -e $luks_file ]]; then
596 # shellcheck disable=SC2206 # globbing is intended
597 hostkeys=($luks_dir/host-*)
598 # if there is only one key, we might be deploying somewhere
599 # where dhcp doesnt give us a proper hostname, so use that.
600 if [[ ${#hostkeys[@]} == 1 && -e ${hostkeys[0]} ]]; then
601 luks_file=${hostkeys[0]}
602 else
603 echo "$0: error: no key for hostname at $luks_file" >&2
604 exit 1
605 fi
606 fi
607
608 # # note, corresponding changes in /b/ds/keyscript-{on,off}
609 if ifclass demohost; then
610 lukspw=x
611 elif [[ -e $luks_dir/$HOSTNAME ]]; then
612 lukspw=$(cat $luks_dir/$HOSTNAME)
613 else
614 lukspw=$(cat $luks_dir/iank)
615 fi
616
617 if $mkroot2; then
618 luks_file=$luks_dir/host-amy
619 lukspw=$(cat $luks_dir/amy)
620 fi
621 }
622
623
624 #### root2 non-fai run
625 doroot2() {
626
627 # We write to these files instead of just /etc/fstab, /etc/crypttab,
628 # because these are filesystems created after our current root, and so
629 # this allows us to update other root filesystems too.
630 rm -f /mnt/root/root2-{fs,crypt}tab
631 if $partition; then
632 echo $0: error: found partition=true but have mkroot2 arg
633 exit 1
634 fi
635 for dev in ${devs[@]}; do
636 if $mkroot2; then
637 luks-setup $(root2dev)
638 fi
639 cat >>/mnt/root/root2-crypttab <<EOF
640 $(root2-cryptname) $(root2dev) $luks_file discard,luks,initramfs
641 EOF
642 done
643 if $mkroot2; then
644 bpart $(for dev in ${devs[@]}; do root2-cryptdev; done)
645 bpart ${boot2_devs[@]}
646 fi
647 mkdir -p /mnt/root2 /mnt/boot2
648 cat >>/mnt/root/root2-fstab <<EOF
649 $(root2-cryptdev ${devs[0]}) /mnt/root2 btrfs nofail,x-systemd.device-timeout=30s,x-systemd.mount-timeout=30s,noatime,subvolid=0$mopts 0 0
650 ${boot2_devs[0]} /mnt/boot2 btrfs nofail,x-systemd.device-timeout=30s,x-systemd.mount-timeout=30s,noatime,subvolid=0 0 0
651 EOF
652 exit 0
653 }
654
655 if $mkroot2 || $mkroot2tab; then
656 getluks
657 doroot2
658 elif $mktab; then
659 mktab
660 exit 0
661 else
662 mktab
663 getluks
664 fi
665
666
667 if $partition; then
668 ### begin wipefs
669 if [[ ! $SPECIAL_DISK ]]; then
670 for dev in ${devs[@]}; do
671 # if we repartition to the same as an old partition,
672 # we don't want any old fses hanging around.
673 for (( i=1; i <= lastn; i++ )); do
674 x=$(add-part $i)
675 [[ -e $x ]] || continue
676 count_down=10
677 # wipefs has failed, manual run works, google suggests timing issue
678 while ! wipefs -a $x; do
679 sleep 2
680 count_down=$((count_down - 1))
681 (( count_down > 0 )) || exit 1
682 done
683 done
684 done
685 fi
686 ### end wipefs
687
688
689 # When we have 2 disks of at least 100g difference in size,
690 # make an extra partition on the end of the bigger one.
691 even_big_part=false
692 even_diff_min=100000
693 if $even_raid; then
694 smalli=0
695 bigi=1
696 if (( $(dev-mib ${devs[0]}) >= $(dev-mib ${devs[1]}) )); then
697 smalli=1
698 bigi=0
699 fi
700 disk_mib=$(dev-mib ${devs[smalli]})
701 even_big_dev=${devs[bigi]}
702 even_big_mib=$(dev-mib $even_big_dev)
703 if (( even_big_mib - disk_mib > even_diff_min )); then
704 even_big_part=true
705 fi
706 fi
707
708 for dev in ${devs[@]}; do
709 if [[ $SPECIAL_DISK ]]; then
710 dev=$(devbyid $SPECIAL_DISK)
711 fi
712
713 # parted will round up the disk size. Do -1 so we can have
714 # fully 1MiB unit partitions for easy resizing of the last partition.
715 # Otherwise we would pass in -0 for the end argument for the last partition.
716 #
717 # Note: parted print error output is expected. example:
718 # Error: /dev/vda: unrecognised disk label
719 if ! $even_raid; then
720 disk_mib=$(dev-mib)
721 fi
722
723 boot_part_mib=$(( boot_mib / ${#boot_devs[@]} ))
724 boot2_part_mib=$(( boot2_mib / ${#boot_devs[@]} ))
725 root2_part_mib=$(( root2_mib / ${#root_devs[@]} ))
726 root_end=$(( disk_mib - root2_part_mib - swap_mib - boot_part_mib - boot2_part_mib ))
727 root2_end=$(( root_end + root2_part_mib ))
728 swap_end=$(( root2_end + swap_mib ))
729 boot_end=$(( swap_end + boot_part_mib ))
730
731 parted -s $dev mklabel gpt
732 # MiB because parted complains about alignment otherwise.
733 pcmd="parted -a optimal -s -- $dev"
734 # root partition, the main big one
735 $pcmd mkpart primary ext3 524MiB ${root_end}MiB
736 # without naming, systemd gives us misc errors like:
737 # dev-disk-by\x2dpartlabel-primary.device: Dev dev-disk-by\x2dpartlabel-primary.device appeared twice
738 $pcmd name $rootn root
739 # root2 partition
740 $pcmd mkpart primary ext3 ${root_end}MiB ${root2_end}MiB
741 $pcmd name $root2n root2
742 # normally a swap is type "linux-swap", but this is encrypted swap. using that
743 # label will confuse systemd.
744 # swap partition
745 $pcmd mkpart primary "" ${root2_end}MiB ${swap_end}MiB
746 $pcmd name $swapn swap
747 # boot partition
748 $pcmd mkpart primary "" ${swap_end}MiB ${boot_end}MiB
749 $pcmd name $bootn boot
750 # boot2 partition
751 $pcmd mkpart primary "" ${boot_end}MiB ${disk_mib}MiB
752 $pcmd name $boot2n boot2
753 # uefi partition. efi sucks, half a gig, rediculous.
754 $pcmd mkpart primary "fat32" 12MiB 524MiB
755 $pcmd name $efin efi
756 $pcmd set $efin esp on
757 # note, this is shown here: https://support.system76.com/articles/bootloader/
758 # but not mentioned https://wiki.archlinux.org/index.php/EFI_system_partition
759 # probably not needed
760 $pcmd set $bootn boot on
761 $pcmd set $boot2n boot on
762 # i only need a few k, but googling min size,
763 # I found someone saying that gparted required
764 # required at least 8 because of their hard drive cylinder size.
765 # And 8 is still very tiny.
766 # grub_ext partition
767 $pcmd mkpart primary "ext2" 4MiB 12MiB
768 $pcmd name $grub_extn grubext
769 # gpt ubuntu cloud image uses ~4 mb for this partition. fai uses 1 MiB.
770 # so, I use 3, whatever.
771 # note: parted manual saying cheap flash media
772 # should to start at 4.
773 # biols grub partition
774 $pcmd mkpart primary "" 1MiB 4MiB
775 $pcmd name $bios_grubn biosgrub
776 $pcmd set $bios_grubn bios_grub on
777 if $even_big_part && [[ $dev == "$even_big_dev" ]]; then
778 $pcmd mkpart primary ext3 ${disk_mib}MiB ${even_big_mib}MiB
779 $pcmd name $even_bign even_big
780 fi
781
782 # the mkfs failed before on a vm, which prompted me to add
783 # sleep .1
784 # then it failed again on a physical machine
785 # with:
786 # Device /dev/disk/by-id/foo doesn't exist or access denied,
787 # so I added a wait until it existed.
788 # Then I added the mkfs.ext2, which claimed to succeed,
789 # but then couldn't be found upon reboot. In that case we didn't
790 # wait at all. So I've added a 3 second minimum wait.
791 secs=0
792 while [[ ! -e $(bios_grubdev) ]] && (( secs < 10 )); do
793 sleep 1
794 secs=$((secs +1))
795 done
796 sleep 3
797
798 mkfs.fat -F32 $(efidev)
799
800 if $even_big_part && [[ $dev == "$even_big_dev" ]]; then
801 luks-setup $(even_bigdev)
802 mkfs.btrfs -f $(crypt-dev $(even_bigdev))
803 fi
804
805 # Holds just a single file, rarely written, so
806 # use ext2, like was often used for the /boot partition.
807 # This exists because grub can only persist data to a non-cow fs.
808 # And we use persisting a var in grub to do a one time boot.
809 # We could pass the data on the kernel command line and persist it
810 # to grubenv after booting, but that relies on the boot always succeeding.
811 # This is just a bit more robust, and it could work for booting
812 # into ipxe which can't persist data, if we ever got that working.
813 mkfs.ext2 $(grub_extdev)
814 luks-setup $(rootdev)
815
816 if [[ $SPECIAL_DISK ]]; then
817 exit 0
818 fi
819 done
820 ls -la /dev/btrfs-control # this was probably for debugging...
821 sleep 1
822 bpart $(for dev in ${devs[@]}; do root-cryptdev; done)
823 bpart ${boot_devs[@]}
824 else
825 for dev in ${devs[@]}; do
826 if [[ -e /dev/mapper/$(root-cryptname) ]]; then
827 continue
828 fi
829 if $rerootfs; then
830 luks-setup $(rootdev)
831 sleep 1
832 bpart $(for dev in ${devs[@]}; do root-cryptdev; done)
833 else
834 cryptsetup luksOpen $(rootdev) $(root-cryptname) \
835 --key-file $luks_file
836 fi
837 done
838
839 if $rerootfs; then
840 sleep 1
841 bpart $(for dev in ${devs[@]}; do root-cryptdev; done)
842 fi
843 sleep 1
844 fi
845
846
847 if $wipe && [[ $DISTRO != debianbullseye_bootstrap ]]; then
848 # bootstrap distro doesn't use separate encrypted root.
849 mount -o subvolid=0 $first_root_crypt /mnt
850 # systemd creates subvolumes we want to delete.
851 mapfile -t s < <(btrfs subvolume list --sort=-path /mnt |
852 sed -rn "s#^.*path\s*(root_$DISTRO/\S+)\s*\$#\1#p")
853 for subvol in ${s[@]}; do btrfs subvolume delete /mnt/$subvol; done
854 btrfs subvolume set-default 0 /mnt
855 [[ ! -e /mnt/root_$DISTRO ]] || btrfs subvolume delete /mnt/root_$DISTRO
856
857 ## create subvols ##
858 cd /mnt
859
860 btrfs subvolume create root_$DISTRO
861
862 # could set default subvol like this, but no reason to.
863 # btrfs subvolume set-default \
864 # $(btrfs subvolume list . | grep "root_$DISTRO$" | awk '{print $2}') .
865
866 # For raid systems, cow allows for error correction, for non-raid systems,
867 # protects root fs from having the plug pulled. Reprovisioning a root
868 # subvol is not my favorite thing to do.
869 # # no cow on the root filesystem. it's setup is fully scripted,
870 # # if it's messed up, we will just recreated it,
871 # # and we can get better perf with this.
872 # # I can't remember exactly why, but this is preferable to mounting with
873 # # -o nodatacow, I think because subvolumes inherit that.
874 # chattr -Rf +C root_$DISTRO
875 cd /
876 umount /mnt
877 fi
878
879 mount -o subvolid=0 $first_boot_dev /mnt
880 cd /mnt
881 btrfs subvolume set-default 0 /mnt # already default, just ensuring it.
882
883 # for libreboot systems. grub2 only reads from subvolid=0
884 mkdir -p /mnt/grub2
885 cp $FAI/distro-install-common/libreboot_grub.cfg /mnt/grub2
886
887 if $wipe && [[ -e /mnt/$boot_vol ]]; then
888 btrfs subvolume delete /mnt/$boot_vol
889 fi
890 if [[ ! -e /mnt/$boot_vol ]]; then
891 btrfs subvolume create $boot_vol
892 fi
893 cd /
894 umount /mnt
895 ## end create subvols ##
896
897 mount $first_grub_extdev /mnt
898 grub-editenv /mnt/grubenv set did_fai_check=true
899 grub-editenv /mnt/grubenv set last_boot=/$boot_vol
900 umount /mnt
901
902
903 # initial setup of extra data fs, mounted,
904 # btrfs subvol create nocow
905 # chattr +C nocow
906 # chown iank.iank nocow
907
PXE install w multi-boot, btrfs & Libreboot support