iankelling.org Git - automated-distro-installer/blob - fai/config/hooks/partition.DEFAULT

   1 #!/bin/bash -x
   2
   3 set -eE -o pipefail
   4 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?"' ERR
   5
   6 # # fai's setup-storage won't do btrfs on luks,
   7 # # so we do it ourself :)
   8
   9
  10 #### begin configuration
  11 if ifclass VM; then
  12     d=vd
  13 else
  14     d=sd
  15 fi
  16
  17
  18 if ifclass TWO_DISK; then
  19     letters=(a b)
  20 elif ifclass ONE_DISK; then
  21     letters=(a)
  22 else
  23     exit
  24 fi
  25 ##### end configuration
  26 skiptask partition
  27 devs=(${letters[@]/#//dev/${d}})
  28 crypt_devs=(${letters[@]/#//dev/mapper/crypt_dev_${d}})
  29
  30 # we can set this manually to force partitioning
  31 #partition=false
  32
  33 # somewhat crude detection of whether to partition
  34 for dev in ${devs[@]}; do
  35     x=($dev[0-9])
  36     [[ ${#x[@]}  == 4 ]] || partition=true
  37     for part in ${dev}{1,2,3,4}; do
  38         [[ -e $part ]] || partition=true
  39     done
  40     # type tells us it's not totally blank
  41     for part in ${dev}{1,3}; do
  42         blkid | grep "^$part:.*TYPE=" &>/dev/null || partition=true
  43     done
  44 done
  45
  46 partition=true # override temporarily
  47
  48 # keyfiles generated like:
  49 # head -c 2048 /dev/urandom | od | s dd of=/q/root/luks/host-demohost
  50 luks_dir=/var/lib/fai/config/distro-install-common/luks
  51 if ifclass tp; then
  52     lukspw=$(cat $luks_dir/traci)
  53 else
  54     lukspw=$(cat $luks_dir/ian)
  55 fi
  56 if ifclass demohost; then
  57     lukspw=x
  58 fi
  59
  60 boot_end=504
  61
  62 crypt=/dev/mapper/crypt_dev_${d##/dev/}a3
  63
  64
  65
  66 # 1.5 x based on https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Installation_Guide/sect-disk-partitioning-setup-x86.html#sect-custom-partitioning-x86
  67 swap_end=$(( $(grep ^MemTotal: /proc/meminfo| awk '{print $2}') * 3/(${#devs[@]} * 2 ) / 1000 + boot_end ))
  68
  69 create_subvols() {
  70     cd /mnt
  71     for x in a home root; do
  72         btrfs subvolume list . | grep "$x$" >/dev/null || btrfs subvolume create $x
  73     done
  74     btrfs subvolume set-default \
  75           $(btrfs subvolume list . | grep 'root$' | awk '{print $2}') .
  76     cd /
  77     umount /mnt
  78 }
  79
  80 shopt -s nullglob
  81 if $partition; then
  82     mkdir -p /tmp/fai
  83     for dev in ${devs[@]}; do
  84         for x in $dev[0-9]; do wipefs -a $x; done
  85         parted -s $dev mklabel gpt
  86         # gpt ubuntu cloud image uses ~4. fai uses 1 MiB. ehh, i'll do 4.
  87         # also, using MB instead of MiB causes complains about alignment.
  88         parted -s $dev mkpart primary "ext3" 4MB ${boot_end}MiB
  89         parted -s $dev set 1 boot on
  90         parted -s $dev mkpart primary "linux-swap" ${boot_end}MiB ${swap_end}MiB
  91         parted -s -- $dev mkpart primary "" ${swap_end}MiB -0
  92         parted -s $dev mkpart primary "" 1MiB 4MiB
  93         parted -s $dev set 4 bios_grub on
  94         # the mkfs failed randomly on a vm, so I threw a sleep in here.
  95         sleep .1
  96         mkfs.ext4 -F ${dev}1
  97         # 3 is device which simply holds a key for the 4's,
  98         # so we can unlock multi-device btrfs fs with 1 manually entered passphrase.
  99         #
 100         # Background: It's of course possible modify the initramfs to
 101         # put the input from a passphrase prompt into a variable and use
 102         # it to unlock multiple devices, but that would require figuring
 103         # more things out.
 104         #
 105         for luks_dev in ${dev}3; do
 106             yes YES | cryptsetup luksFormat $luks_dev $luks_dir/host-$HOSTNAME \
 107                                  -c aes-cbc-essiv:sha256 -s 256 || [[ $? == 141 ]]
 108             yes "$lukspw" | \
 109                 cryptsetup luksAddKey --key-file $luks_dir/host-$HOSTNAME \
 110                            $luks_dev || [[ $? == 141 ]]
 111             # background: Keyfile and password are treated just
 112             # like 2 ways to input a passphrase, so we don't actually need to have
 113             # different contents of keyfile and passphrase, but it makes some
 114             # security sense to a really big randomly generated passphrase
 115             # as much as possible, so we have both.
 116             #
 117             # This would remove the keyfile.
 118             #    yes 'test' | cryptsetup luksRemoveKey /dev/... \
 119                 #                            /key/file || [[ $? == 141 ]]
 120
 121             cryptsetup luksOpen $luks_dev crypt_dev_${luks_dev##/dev/} \
 122                        --key-file $luks_dir/host-$HOSTNAME
 123         done
 124     done
 125     mkfs.btrfs -f ${crypt_devs[@]/%/3}
 126     parted ${devs[0]} set 1 boot on
 127     mount $crypt /mnt
 128     create_subvols
 129 else
 130     for dev in ${devs[@]}; do
 131         mkfs.ext4 -F ${dev}1
 132         cryptsetup luksOpen ${dev}3 crypt_dev_${dev##/dev/}3 \
 133                    --key-file $luks_dir/host-$HOSTNAME || [[ $? == 141 ]]
 134     done
 135     sleep 1
 136     mount -o subvolid=0 $crypt /mnt
 137     # systemd creates subvolumes we want to delete.
 138     s=($(btrfs subvolume list --sort=-path /mnt |
 139                 sed -rn 's#^.*path\s*(root/\S+)\s*$#\1#p'))
 140     for subvol in ${s[@]}; do btrfs subvolume delete /mnt/$subvol; done
 141     btrfs subvolume set-default 0 /mnt
 142     btrfs subvolume delete /mnt/root
 143     create_subvols
 144 fi
 145
 146
 147 for dev in ${devs[@]}; do
 148     cat >>/tmp/fai/crypttab <<EOF
 149 crypt_dev_${dev##/dev/}3  ${dev}3  none  keyscript=/root/keyscript,discard,luks
 150 EOF
 151 done
 152
 153 for dev in ${devs[@]}; do
 154     cat >>/tmp/fai/crypttab <<EOF
 155 swap ${dev}2  /dev/urandom  swap,cipher=aes-xts-plain64,size=256,hash=ripemd160
 156 EOF
 157 done
 158
 159 # this is duplicated in arch-init
 160 cat > /tmp/fai/fstab <<EOF
 161 $crypt  /  btrfs  noatime,subvol=/root  0 0
 162 $crypt  /a  btrfs  noatime,subvol=/a  0 0
 163 $crypt  /home  btrfs  noatime,subvol=/home  0 0
 164 ${devs[0]}1  /boot  ext4  noatime  0 2
 165 EOF
 166
 167
 168 cat >/tmp/fai/disk_var.sh <<EOF
 169 ROOT_PARTITION=\${ROOT_PARTITION:-$crypt}
 170 BOOT_PARTITION=\${BOOT_PARTITION:-${devs[0]}1}
 171 BOOT_DEVICE=\${BOOT_DEVICE:-"${devs[0]}"}
 172 SWAPLIST=\${SWAPLIST:-"${devs[@]/%/2}"}
 173 EOF