iankelling.org Git - automated-distro-installer/blob - fai/config/hooks/partition.DEFAULT

   1 #!/bin/bash -x
   2
   3 set -eE -o pipefail
   4 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
   5
   6 # # fai's setup-storage won't do btrfs on luks,
   7 # # so we do it ourself :)
   8
   9 skiptask partition || ! type skiptask # for running not in fai
  10
  11 #### begin configuration
  12
  13 rootn=1
  14 swapn=2
  15 bootn=3
  16 bios_grubn=4
  17 boot_mib=1500
  18
  19
  20 ##### end configuration
  21
  22
  23 add-part() {
  24     local d ret
  25     if [[ $# == 1 ]]; then
  26         d=$dev
  27         part=$1
  28     else
  29         d=$1
  30         part=$2
  31     fi
  32     if [[ $d == /dev/disk/by-id/* ]]; then
  33         ret=$d-part$part
  34     else
  35         ret=$d$part
  36     fi
  37     echo $ret
  38 }
  39
  40 bootdev() { add-part $@ $bootn; }
  41 rootdev() { add-part $@ $rootn; }
  42 swapdev() { add-part $@ $swapn; }
  43 bios_grubdev() { add-part $@ $bios_grubn; }
  44
  45 crypt-dev() { echo /dev/mapper/crypt_dev_${1##*/}; }
  46 crypt-name() { echo crypt_dev_${1##*/}; }
  47 root-cryptdev() { crypt-dev $(rootdev $@); }
  48 swap-cryptdev() { crypt-dev $(swapdev $@); }
  49 root-cryptname() { crypt-name $(rootdev $@); }
  50 swap-cryptname() { crypt-name $(swapdev $@); }
  51
  52
  53 ##### end function defs
  54
  55 if ifclass REPARTITION;then
  56     partition=true # force a full wipe
  57 else
  58     partition=false # change to true to force a full wipe
  59 fi
  60
  61 lastn=$bios_grubn
  62
  63
  64 hdds=()
  65 ssds=()
  66 cd /sys/block
  67 for disk in [sv]d[a-z]; do
  68     case $(cat $disk/queue/rotational) in
  69         0) ssds+=(/dev/$disk) ;;
  70         1) hdds+=(/dev/$disk) ;;
  71         *) echo "$0: error: unknown /sys/block/$disk/queue/rotational: \
  72 $(cat $disk/queue/rotational)"; exit 1 ;;
  73     esac
  74 done
  75
  76 # install all ssds, or if there are none, all hdds
  77 if (( ${#ssds[@]} > 0 )); then
  78     short_devs=( ${ssds[@]} )
  79 else
  80     short_devs=( ${hdds[@]} )
  81 fi
  82
  83 # check if the partitions exist have the right filesystems
  84 #blkid="$(blkid -s TYPE)"
  85 for dev in ${short_devs[@]}; do
  86     ! $partition || break
  87     y=$(readlink -f $dev)
  88     x=($y[0-9])
  89     [[ ${#x[@]}  == "${lastn}" ]] || partition=true
  90     for (( i=1; i <= lastn; i++ )); do
  91         [[ -e ${dev}$i ]] || partition=true
  92     done
  93     # On one system, blkid is missing some partitions.
  94     # maybe we need a flag, like FUZZY_BLKID or something, so we
  95     # can check that at least some exist.
  96     # for x in "`rootdev`: TYPE=\"crypto_LUKS\"" "`bootdev`: TYPE=\"btrfs\""; do
  97     #     echo "$blkid" | grep -Fx "$x" &>/dev/null || partition=true
  98     # done
  99 done
 100
 101 if $partition && ifclass PARTITION_PROMPT; then
 102     echo "Press any key except ctrl-c to continue and partition these drives:"
 103     echo "  ${short_devs[@]}"
 104     read
 105 fi
 106
 107 devs=()
 108 shopt -s extglob
 109 for short_dev in ${short_devs[@]}; do
 110     devs+=($(devbyid $short_dev))
 111 done
 112
 113
 114
 115 boot_devs=()
 116 for dev in ${devs[@]}; do
 117     if ifclass frodo; then
 118         # I ran into a machine where the bios doesn't know about some disks,
 119         # so 1st stage of grub also doesn't know about them.
 120         # Also, grub does not support mounting degraded btrfs as far as
 121         # I can tell with some googling.
 122         # From within an arch install env, I could detect them by noting
 123         # their partitions were mixed with the next disk in /dev/disk/by-path,
 124         # and I have mixed model disks, and I could see the 8 models which showed
 125         # up in the bios, and thus see which 2 models were missing.
 126         # hdparm -I /dev/sdh will give model info in linux.
 127         # However, in fai on jessie, /dev/disk/by-path dir doesn't exist,
 128         # and I don't see another way, so I'm hardcoding them.
 129         # We still put grub on them and partition them the same, for uniformity
 130         # and in case they get moved to a system that can recognize them,
 131         # we just exclude them from the boot filesystem.
 132         cd /dev/disk/by-id/
 133         bad_disk=false
 134         for id in ata-TOSHIBA_MD04ACA500_8539K4TQFS9A \
 135                       ata-TOSHIBA_MD04ACA500_Y5IFK6IJFS9A; do
 136             if [[ $(readlink -f $id) == "$(readlink -f $dev)" ]]; then
 137                 bad_disk=true
 138                 break
 139             fi
 140         done
 141         $bad_disk || boot_devs+=(`bootdev`)
 142     else
 143         boot_devs+=(`bootdev`)
 144     fi
 145 done
 146
 147 if [[ ! $DISTRO ]]; then
 148     if ifclass STABLE; then
 149         DISTRO=debianstable
 150     else
 151         DISTRO=debiantesting
 152     fi
 153 fi
 154
 155
 156
 157 case ${#boot_devs[@]} in
 158     # need double the space if we are raid 10, and then
 159     # might as well give some extra overhead.
 160     [4-9]*|[1-3]?*) boot_mib=$((boot_mib * 3)) ;;
 161 esac
 162
 163
 164 bpart() { # btrfs a partition
 165     case ${#@} in
 166         [1-3]) mkfs.btrfs -f $@ ;;
 167         [4-9]*|[1-3]?*) mkfs.btrfs -f -m raid10 -d raid10 $@ ;;
 168     esac
 169 }
 170
 171 first_boot_dev=$(bootdev ${devs[0]})
 172
 173 # keyfiles generated like:
 174 # head -c 2048 /dev/urandom | od | s dd of=/q/root/luks/host-demohost
 175 luks_dir=${LUKS_DIR:-/var/lib/fai/config/distro-install-common/luks}
 176
 177 if [[ ! -e $luks_dir/host-$HOSTNAME ]]; then
 178     echo "$0: error: no key for hostname at $luks_dir/host-$HOSTNAME" >&2
 179     exit 1
 180 fi
 181
 182 if ifclass tp; then
 183     lukspw=$(cat $luks_dir/traci)
 184 else
 185     lukspw=$(cat $luks_dir/ian)
 186 fi
 187 if ifclass demohost; then
 188     lukspw=x
 189 fi
 190
 191
 192 first_root_crypt=$(root-cryptdev ${devs[0]})
 193
 194 bios_grubn=4
 195 # 1.5 x based on https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Installation_Guide/sect-disk-partitioning-setup-x86.html#sect-custom-partitioning-x86
 196 swap_mib=$(( $(grep ^MemTotal: /proc/meminfo | \
 197                    awk '{print $2}') * 3/(${#devs[@]} * 2 ) / 1024 ))
 198
 199 mkdir -p /tmp/fai
 200 shopt -s nullglob
 201 if $partition; then
 202     for dev in ${devs[@]}; do
 203         for x in $dev[0-9]; do
 204             count_down=10
 205             # wipefs has failed, manual run works, google suggests timing issue
 206             while ! wipefs -a $x; do
 207                 sleep 2
 208                 count_down=$((count_down - 1))
 209                 (( count_down > 0 )) || exit 1
 210             done
 211         done
 212     done
 213     for dev in ${devs[@]}; do
 214         # parted will round up the disk size. Do -1 so we can have
 215         # fully 1MiB unit partitions for easy resizing of the last partition.
 216         # Otherwise we would pass in -0 for the end argument for the last partition.
 217         #
 218         # parted print error output is expected. example:
 219         # Error: /dev/vda: unrecognised disk label
 220         disk_mib=$(( $(parted -m $dev unit MiB print | \
 221                            sed -nr "s#^/dev/[^:]+:([0-9]+).*#\1#p") - 1))
 222         root_end=$(( disk_mib - swap_mib - boot_mib /  ${#boot_devs[@]} ))
 223         swap_end=$(( root_end + swap_mib))
 224
 225         parted -s $dev mklabel gpt
 226         # gpt ubuntu cloud image uses ~4. fai uses 1 MiB.
 227         # I read something in the parted manual saying cheap flash media
 228         # likes to start at 4.
 229         # MiB because parted complains about alignment otherwise.
 230         pcmd="parted -a optimal -s -- $dev"
 231         $pcmd mkpart primary "ext3" 4MiB ${root_end}MiB
 232         $pcmd mkpart primary "linux-swap" ${root_end}MiB ${swap_end}MiB
 233         $pcmd mkpart primary "" ${swap_end}MiB ${disk_mib}MiB
 234         $pcmd mkpart primary "" 1MiB 4MiB
 235         $pcmd set $bios_grubn bios_grub on
 236         $pcmd set $bootn boot on # generally not needed on modern systems
 237         # the mkfs failed before on a vm, which prompted me to add
 238         # sleep .1
 239         # then failed on a physical machine
 240         # with:
 241         # Device /dev/disk/by-id/foo doesn't exist or access denied,
 242         # so here we wait.
 243         secs=0
 244         while [[ ! -e `rootdev` ]] && (( secs < 10 )); do
 245             sleep 1
 246             secs=$((secs +1))
 247         done
 248         yes YES | cryptsetup luksFormat `rootdev` $luks_dir/host-$HOSTNAME \
 249                              -c aes-cbc-essiv:sha256 -s 256 || [[ $? == 141 ]]
 250         yes "$lukspw" | \
 251             cryptsetup luksAddKey --key-file $luks_dir/host-$HOSTNAME \
 252                        `rootdev` || [[ $? == 141 ]]
 253         # background: Keyfile and password are treated just
 254         # like 2 ways to input a passphrase, so we don't actually need to have
 255         # different contents of keyfile and passphrase, but it makes some
 256         # security sense to a really big randomly generated passphrase
 257         # as much as possible, so we have both.
 258         #
 259         # This would remove the keyfile.
 260         #    yes 'test' | cryptsetup luksRemoveKey /dev/... \
 261             #                            /key/file || [[ $? == 141 ]]
 262
 263         cryptsetup luksOpen `rootdev` `root-cryptname` \
 264                    --key-file $luks_dir/host-$HOSTNAME
 265     done
 266     ls -la /dev/btrfs-control
 267     sleep 1
 268     bpart $(for dev in ${devs[@]}; do root-cryptdev; done)
 269     bpart ${boot_devs[@]}
 270 else
 271     for dev in ${devs[@]}; do
 272         cryptsetup luksOpen `rootdev` `root-cryptname` \
 273                    --key-file $luks_dir/host-$HOSTNAME
 274     done
 275     sleep 1
 276 fi
 277
 278 mount -o subvolid=0 $first_root_crypt /mnt
 279 # systemd creates subvolumes we want to delete.
 280 s=($(btrfs subvolume list --sort=-path /mnt |
 281          sed -rn "s#^.*path\s*(root_$DISTRO/\S+)\s*\$#\1#p"))
 282 for subvol in ${s[@]}; do btrfs subvolume delete /mnt/$subvol; done
 283 btrfs subvolume set-default 0 /mnt
 284 [[ ! -e /mnt/root_$DISTRO ]] || btrfs subvolume delete /mnt/root_$DISTRO
 285
 286
 287 ## create subvols ##
 288 cd /mnt
 289 for x in q home_$DISTRO root_$DISTRO; do
 290     btrfs subvolume list . | grep "$x$" >/dev/null || btrfs subvolume create $x
 291 done
 292 chown root:1000 q
 293
 294
 295 mkdir -p /mnt/root_$DISTRO/boot
 296 for x in root/a q/a; do
 297     mkdir -p $x
 298     chown 1000:1000 $x
 299     chmod 755 $x
 300 done
 301 # could set default like this, but no reason to.
 302 # btrfs subvolume set-default \
 303     #       $(btrfs subvolume list . | grep "root_$DISTRO$" | awk '{print $2}') .
 304 chattr -Rf +C root_$DISTRO
 305 cd /
 306 umount /mnt
 307 mount -o subvolid=0 $first_boot_dev /mnt
 308 cd /mnt
 309 btrfs subvolume set-default 0 /mnt
 310 [[ ! -e /mnt/boot_$DISTRO ]] || btrfs subvolume delete /mnt/boot_$DISTRO
 311 btrfs subvolume create boot_$DISTRO
 312 cd /
 313 umount /mnt
 314 ## end create subvols ##
 315
 316
 317
 318 cat > /tmp/fai/fstab <<EOF
 319 $first_root_crypt  /  btrfs  noatime,subvol=root_$DISTRO  0 0
 320 $first_root_crypt  /q  btrfs  noatime,subvol=q  0 0
 321 /q/a  /a  none  bind  0 0
 322 $first_root_crypt  /home  btrfs  noatime,subvol=home_$DISTRO  0 0
 323 $first_boot_dev  /boot  btrfs  noatime,subvol=boot_$DISTRO  0 0
 324 EOF
 325
 326
 327 if ifclass treetowl; then
 328     cat >> /tmp/fai/fstab <<'EOF'
 329 UUID=3f7b31cd-f299-40b4-a86b-7604282e2715 /i btrfs  noatime    0 2
 330 EOF
 331 fi
 332
 333 swaps=()
 334 for dev in ${devs[@]}; do
 335     swaps+=(`swap-cryptname`)
 336     cat >>/tmp/fai/crypttab <<EOF
 337 `root-cryptname`  `rootdev`  none  keyscript=/root/keyscript,discard,luks
 338 `swap-cryptname` `swapdev`  /dev/urandom  swap,cipher=aes-xts-plain64,size=256,hash=ripemd160
 339 EOF
 340     cat >> /tmp/fai/fstab <<EOF
 341 `swap-cryptdev`  none  swap  sw  0 0
 342 EOF
 343 done
 344
 345 # fai would do this:
 346 #BOOT_DEVICE=\${BOOT_DEVICE:-"${devs[0]}"}
 347
 348 # swaplist seems to do nothing.
 349 cat >/tmp/fai/disk_var.sh <<EOF
 350 ROOT_PARTITION=\${ROOT_PARTITION:-$first_root_crypt}
 351 BOOT_PARTITION=\${BOOT_PARTITION:-$first_boot_dev}
 352 BOOT_DEVICE="${short_devs[@]}"
 353 SWAPLIST=\${SWAPLIST:-"${swaps[@]}"}
 354 EOF