iankelling.org Git - automated-distro-installer/blob - fai/config/hooks/partition.DEFAULT

   1 #!/bin/bash -x
   2
   3 set -eE -o pipefail
   4 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?"' ERR
   5
   6 # # fai's setup-storage won't do btrfs on luks,
   7 # # so we do it ourself :)
   8
   9
  10 #### begin configuration
  11
  12 if ifclass TWO_DISK || ifclass demohost; then
  13     letters=(a b)
  14 elif ifclass ONE_DISK; then
  15     letters=(a)
  16 else
  17     exit 1
  18 fi
  19 ##### end configuration
  20
  21 if ifclass VM; then
  22     d=vd
  23 else
  24     d=sd
  25 fi
  26
  27
  28
  29 skiptask partition ||: # for running out of fai
  30 devs=(${letters[@]/#//dev/${d}})
  31 crypt_devs=(${letters[@]/#//dev/mapper/crypt_dev_${d}})
  32
  33 # we can set this manually to force partitioning
  34 #partition=false
  35
  36 # somewhat crude detection of whether to partition
  37 for dev in ${devs[@]}; do
  38     x=($dev[0-9])
  39     [[ ${#x[@]}  == 4 ]] || partition=true
  40     for part in ${dev}{1,2,3,4}; do
  41         [[ -e $part ]] || partition=true
  42     done
  43     # type tells us it's not totally blank
  44     for part in ${dev}{1,3}; do
  45         blkid | grep "^$part:.*TYPE=" &>/dev/null || partition=true
  46     done
  47 done
  48
  49 #partition=true # for temporarily override
  50
  51 # keyfiles generated like:
  52 # head -c 2048 /dev/urandom | od | s dd of=/q/root/luks/host-demohost
  53 luks_dir=${LUKS_DIR:-/var/lib/fai/config/distro-install-common/luks}
  54 if ifclass tp; then
  55     lukspw=$(cat $luks_dir/traci)
  56 else
  57     lukspw=$(cat $luks_dir/ian)
  58 fi
  59 if ifclass demohost; then
  60     lukspw=x
  61 fi
  62
  63 boot_end=504
  64
  65 crypt=/dev/mapper/crypt_dev_${d##/dev/}a3
  66
  67
  68
  69 # 1.5 x based on https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Installation_Guide/sect-disk-partitioning-setup-x86.html#sect-custom-partitioning-x86
  70 swap_end=$(( $(grep ^MemTotal: /proc/meminfo| awk '{print $2}') * 3/(${#devs[@]} * 2 ) / 1000 + boot_end ))
  71
  72 create_subvols() {
  73     cd /mnt
  74     for x in q home root; do
  75         btrfs subvolume list . | grep "$x$" >/dev/null || btrfs subvolume create $x
  76     done
  77     for x in root/a q/a; do
  78         mkdir -p $x
  79         chown 1000:1000 $x
  80         chmod 755 $x
  81     done
  82     btrfs subvolume set-default \
  83           $(btrfs subvolume list . | grep 'root$' | awk '{print $2}') .
  84     chattr -Rf +C root
  85     cd /
  86     umount /mnt
  87 }
  88
  89 mkdir -p /tmp/fai
  90 shopt -s nullglob
  91 if $partition; then
  92     for dev in ${devs[@]}; do
  93         for x in $dev[0-9]; do wipefs -a $x; done
  94     done
  95     for dev in ${devs[@]}; do
  96         parted -s $dev mklabel gpt
  97         # gpt ubuntu cloud image uses ~4. fai uses 1 MiB. ehh, i'll do 4.
  98         # also, using MB instead of MiB causes complains about alignment.
  99         parted -s $dev mkpart primary "ext3" 4MB ${boot_end}MiB
 100         parted -s $dev set 1 boot on
 101         parted -s $dev mkpart primary "linux-swap" ${boot_end}MiB ${swap_end}MiB
 102         parted -s -- $dev mkpart primary "" ${swap_end}MiB -0
 103         parted -s $dev mkpart primary "" 1MiB 4MiB
 104         parted -s $dev set 4 bios_grub on
 105         # the mkfs failed randomly on a vm, so I threw a sleep in here.
 106         sleep .1
 107         mkfs.ext4 -F ${dev}1
 108         # 3 is device which simply holds a key for the 4's,
 109         # so we can unlock multi-device btrfs fs with 1 manually entered passphrase.
 110         #
 111         # Background: It's of course possible modify the initramfs to
 112         # put the input from a passphrase prompt into a variable and use
 113         # it to unlock multiple devices, but that would require figuring
 114         # more things out.
 115         #
 116         for luks_dev in ${dev}3; do
 117             yes YES | cryptsetup luksFormat $luks_dev $luks_dir/host-$HOSTNAME \
 118                                  -c aes-cbc-essiv:sha256 -s 256 || [[ $? == 141 ]]
 119             yes "$lukspw" | \
 120                 cryptsetup luksAddKey --key-file $luks_dir/host-$HOSTNAME \
 121                            $luks_dev || [[ $? == 141 ]]
 122             # background: Keyfile and password are treated just
 123             # like 2 ways to input a passphrase, so we don't actually need to have
 124             # different contents of keyfile and passphrase, but it makes some
 125             # security sense to a really big randomly generated passphrase
 126             # as much as possible, so we have both.
 127             #
 128             # This would remove the keyfile.
 129             #    yes 'test' | cryptsetup luksRemoveKey /dev/... \
 130                 #                            /key/file || [[ $? == 141 ]]
 131
 132             cryptsetup luksOpen $luks_dev crypt_dev_${luks_dev##/dev/} \
 133                        --key-file $luks_dir/host-$HOSTNAME
 134         done
 135     done
 136     mkfs.btrfs -f ${crypt_devs[@]/%/3}
 137     parted ${devs[0]} set 1 boot on
 138     mount $crypt /mnt
 139     create_subvols
 140 else
 141     for dev in ${devs[@]}; do
 142         mkfs.ext4 -F ${dev}1
 143         cryptsetup luksOpen ${dev}3 crypt_dev_${dev##/dev/}3 \
 144                    --key-file $luks_dir/host-$HOSTNAME || [[ $? == 141 ]]
 145     done
 146     sleep 1
 147     mount -o subvolid=0 $crypt /mnt
 148     # systemd creates subvolumes we want to delete.
 149     s=($(btrfs subvolume list --sort=-path /mnt |
 150                 sed -rn 's#^.*path\s*(root/\S+)\s*$#\1#p'))
 151     for subvol in ${s[@]}; do btrfs subvolume delete /mnt/$subvol; done
 152     btrfs subvolume set-default 0 /mnt
 153     btrfs subvolume delete /mnt/root
 154     create_subvols
 155 fi
 156
 157
 158
 159 cat > /tmp/fai/fstab <<EOF
 160 $crypt  /  btrfs  noatime,subvol=/root  0 0
 161 $crypt  /q  btrfs  noatime,subvol=/q  0 0
 162 /q/a  /a  none  bind  0 0
 163 $crypt  /home  btrfs  noatime,subvol=/home  0 0
 164 ${devs[0]}1  /boot  ext4  noatime  0 2
 165 EOF
 166
 167
 168 swaps=()
 169 for dev in ${devs[@]}; do
 170     s=crypt_swap_${dev##/dev/}2
 171     swaps+=(/dev/mapper/$s)
 172     cat >>/tmp/fai/crypttab <<EOF
 173 crypt_dev_${dev##/dev/}3  ${dev}3  none  keyscript=/root/keyscript,discard,luks
 174 $s ${dev}2  /dev/urandom  swap,cipher=aes-xts-plain64,size=256,hash=ripemd160
 175 EOF
 176     cat >> /tmp/fai/fstab <<EOF
 177 /dev/mapper/$s  none  swap  sw  0 0
 178 EOF
 179 done
 180
 181
 182 # swaplist seems to do nothing.
 183 cat >/tmp/fai/disk_var.sh <<EOF
 184 ROOT_PARTITION=\${ROOT_PARTITION:-$crypt}
 185 BOOT_PARTITION=\${BOOT_PARTITION:-${devs[0]}1}
 186 BOOT_DEVICE=\${BOOT_DEVICE:-"${devs[0]}"}
 187 SWAPLIST=\${SWAPLIST:-"${swaps[@]}"}
 188 EOF