iankelling.org Git - automated-distro-installer/blob - fai/config/hooks/partition.DEFAULT

   1 #!/bin/bash -x
   2
   3 set -eE -o pipefail
   4 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?"' ERR
   5
   6 # # fai's setup-storage won't do btrfs on luks,
   7 # # so we do it ourself :)
   8
   9
  10 #### begin configuration
  11
  12 if ifclass TWO_DISK || ifclass demohost; then
  13     letters=(a b)
  14 elif ifclass ONE_DISK; then
  15     letters=(a)
  16 else
  17     exit 1
  18 fi
  19 ##### end configuration
  20
  21 if ifclass VM; then
  22     d=vd
  23 else
  24     d=sd
  25 fi
  26
  27
  28
  29 skiptask partition ||: # for running out of fai
  30 devs=(${letters[@]/#//dev/${d}})
  31 crypt_devs=(${letters[@]/#//dev/mapper/crypt_dev_${d}})
  32
  33 # we can set this manually to force partitioning
  34 #partition=false
  35
  36 # somewhat crude detection of whether to partition
  37 for dev in ${devs[@]}; do
  38     x=($dev[0-9])
  39     [[ ${#x[@]}  == 4 ]] || partition=true
  40     for part in ${dev}{1,2,3,4}; do
  41         [[ -e $part ]] || partition=true
  42     done
  43     # type tells us it's not totally blank
  44     for part in ${dev}{1,3}; do
  45         blkid | grep "^$part:.*TYPE=" &>/dev/null || partition=true
  46     done
  47 done
  48
  49 partition=true # override temporarily
  50
  51 # keyfiles generated like:
  52 # head -c 2048 /dev/urandom | od | s dd of=/q/root/luks/host-demohost
  53 luks_dir=${LUKS_DIR:-/var/lib/fai/config/distro-install-common/luks}
  54 if ifclass tp; then
  55     lukspw=$(cat $luks_dir/traci)
  56 else
  57     lukspw=$(cat $luks_dir/ian)
  58 fi
  59 if ifclass demohost; then
  60     lukspw=x
  61 fi
  62
  63 boot_end=504
  64
  65 crypt=/dev/mapper/crypt_dev_${d##/dev/}a3
  66
  67
  68
  69 # 1.5 x based on https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Installation_Guide/sect-disk-partitioning-setup-x86.html#sect-custom-partitioning-x86
  70 swap_end=$(( $(grep ^MemTotal: /proc/meminfo| awk '{print $2}') * 3/(${#devs[@]} * 2 ) / 1000 + boot_end ))
  71
  72 create_subvols() {
  73     cd /mnt
  74     for x in q home root; do
  75         btrfs subvolume list . | grep "$x$" >/dev/null || btrfs subvolume create $x
  76     done
  77     btrfs subvolume set-default \
  78           $(btrfs subvolume list . | grep 'root$' | awk '{print $2}') .
  79     chattr -Rf +C root
  80     cd /
  81     umount /mnt
  82 }
  83
  84 mkdir -p /tmp/fai
  85 shopt -s nullglob
  86 if $partition; then
  87     for dev in ${devs[@]}; do
  88         for x in $dev[0-9]; do wipefs -a $x; done
  89         parted -s $dev mklabel gpt
  90         # gpt ubuntu cloud image uses ~4. fai uses 1 MiB. ehh, i'll do 4.
  91         # also, using MB instead of MiB causes complains about alignment.
  92         parted -s $dev mkpart primary "ext3" 4MB ${boot_end}MiB
  93         parted -s $dev set 1 boot on
  94         parted -s $dev mkpart primary "linux-swap" ${boot_end}MiB ${swap_end}MiB
  95         parted -s -- $dev mkpart primary "" ${swap_end}MiB -0
  96         parted -s $dev mkpart primary "" 1MiB 4MiB
  97         parted -s $dev set 4 bios_grub on
  98         # the mkfs failed randomly on a vm, so I threw a sleep in here.
  99         sleep .1
 100         mkfs.ext4 -F ${dev}1
 101         # 3 is device which simply holds a key for the 4's,
 102         # so we can unlock multi-device btrfs fs with 1 manually entered passphrase.
 103         #
 104         # Background: It's of course possible modify the initramfs to
 105         # put the input from a passphrase prompt into a variable and use
 106         # it to unlock multiple devices, but that would require figuring
 107         # more things out.
 108         #
 109         for luks_dev in ${dev}3; do
 110             yes YES | cryptsetup luksFormat $luks_dev $luks_dir/host-$HOSTNAME \
 111                                  -c aes-cbc-essiv:sha256 -s 256 || [[ $? == 141 ]]
 112             yes "$lukspw" | \
 113                 cryptsetup luksAddKey --key-file $luks_dir/host-$HOSTNAME \
 114                            $luks_dev || [[ $? == 141 ]]
 115             # background: Keyfile and password are treated just
 116             # like 2 ways to input a passphrase, so we don't actually need to have
 117             # different contents of keyfile and passphrase, but it makes some
 118             # security sense to a really big randomly generated passphrase
 119             # as much as possible, so we have both.
 120             #
 121             # This would remove the keyfile.
 122             #    yes 'test' | cryptsetup luksRemoveKey /dev/... \
 123                 #                            /key/file || [[ $? == 141 ]]
 124
 125             cryptsetup luksOpen $luks_dev crypt_dev_${luks_dev##/dev/} \
 126                        --key-file $luks_dir/host-$HOSTNAME
 127         done
 128     done
 129     mkfs.btrfs -f ${crypt_devs[@]/%/3}
 130     parted ${devs[0]} set 1 boot on
 131     mount $crypt /mnt
 132     create_subvols
 133 else
 134     for dev in ${devs[@]}; do
 135         mkfs.ext4 -F ${dev}1
 136         cryptsetup luksOpen ${dev}3 crypt_dev_${dev##/dev/}3 \
 137                    --key-file $luks_dir/host-$HOSTNAME || [[ $? == 141 ]]
 138     done
 139     sleep 1
 140     mount -o subvolid=0 $crypt /mnt
 141     # systemd creates subvolumes we want to delete.
 142     s=($(btrfs subvolume list --sort=-path /mnt |
 143                 sed -rn 's#^.*path\s*(root/\S+)\s*$#\1#p'))
 144     for subvol in ${s[@]}; do btrfs subvolume delete /mnt/$subvol; done
 145     btrfs subvolume set-default 0 /mnt
 146     btrfs subvolume delete /mnt/root
 147     create_subvols
 148 fi
 149
 150
 151
 152 cat > /tmp/fai/fstab <<EOF
 153 $crypt  /  btrfs  noatime,subvol=/root  0 0
 154 $crypt  /q  btrfs  noatime,subvol=/q  0 0
 155 $crypt  /home  btrfs  noatime,subvol=/home  0 0
 156 ${devs[0]}1  /boot  ext4  noatime  0 2
 157 EOF
 158
 159
 160 swaps=()
 161 for dev in ${devs[@]}; do
 162     s=crypt_swap_${dev##/dev/}2
 163     swaps+=(/dev/mapper/$s)
 164     cat >>/tmp/fai/crypttab <<EOF
 165 crypt_dev_${dev##/dev/}3  ${dev}3  none  keyscript=/root/keyscript,discard,luks
 166 $s ${dev}2  /dev/urandom  swap,cipher=aes-xts-plain64,size=256,hash=ripemd160
 167 EOF
 168     cat >> /tmp/fai/fstab <<EOF
 169 /dev/mapper/$s  none  swap  sw  0 0
 170 EOF
 171 done
 172
 173
 174 # swaplist seems to do nothing.
 175 cat >/tmp/fai/disk_var.sh <<EOF
 176 ROOT_PARTITION=\${ROOT_PARTITION:-$crypt}
 177 BOOT_PARTITION=\${BOOT_PARTITION:-${devs[0]}1}
 178 BOOT_DEVICE=\${BOOT_DEVICE:-"${devs[0]}"}
 179 SWAPLIST=\${SWAPLIST:-"${swaps[@]}"}
 180 EOF