iankelling.org Git - automated-distro-installer/blob - fai/config/hooks/partition.DEFAULT

   1 #!/bin/bash -x
   2
   3 set -eE -o pipefail
   4 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?"' ERR
   5
   6 # # fai's setup-storage won't do btrfs on luks,
   7 # # so we do it ourself :)
   8
   9
  10 #### begin configuration
  11
  12 if ifclass TWO_DISK || ifclass demohost; then
  13     letters=(a b)
  14 elif ifclass ONE_DISK; then
  15     letters=(a)
  16 else
  17     exit 1
  18 fi
  19 ##### end configuration
  20
  21 if ifclass VM; then
  22     d=vd
  23 else
  24     d=sd
  25 fi
  26
  27
  28
  29 skiptask partition ||: # for running out of fai
  30 devs=(${letters[@]/#//dev/${d}})
  31 crypt_devs=(${letters[@]/#//dev/mapper/crypt_dev_${d}})
  32
  33 partition=false
  34
  35 # somewhat crude detection of whether to partition
  36 for dev in ${devs[@]}; do
  37     x=($dev[0-9])
  38     [[ ${#x[@]}  == 4 ]] || partition=true
  39     for part in ${dev}{1,2,3,4}; do
  40         [[ -e $part ]] || partition=true
  41     done
  42     # type tells us it's not totally blank
  43     for part in ${dev}{1,3}; do
  44         blkid | grep "^$part:.*TYPE=" &>/dev/null || partition=true
  45     done
  46 done
  47
  48 #partition=true # for temporarily override
  49
  50 # keyfiles generated like:
  51 # head -c 2048 /dev/urandom | od | s dd of=/q/root/luks/host-demohost
  52 luks_dir=${LUKS_DIR:-/var/lib/fai/config/distro-install-common/luks}
  53 if ifclass tp; then
  54     lukspw=$(cat $luks_dir/traci)
  55 else
  56     lukspw=$(cat $luks_dir/ian)
  57 fi
  58 if ifclass demohost; then
  59     lukspw=x
  60 fi
  61
  62 boot_end=504
  63
  64 crypt=/dev/mapper/crypt_dev_${d##/dev/}a3
  65
  66
  67
  68 # 1.5 x based on https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Installation_Guide/sect-disk-partitioning-setup-x86.html#sect-custom-partitioning-x86
  69 swap_end=$(( $(grep ^MemTotal: /proc/meminfo| awk '{print $2}') * 3/(${#devs[@]} * 2 ) / 1000 + boot_end ))
  70
  71 create_subvols() {
  72     cd /mnt
  73     for x in q home root; do
  74         btrfs subvolume list . | grep "$x$" >/dev/null || btrfs subvolume create $x
  75     done
  76     for x in root/a q/a; do
  77         mkdir -p $x
  78         chown 1000:1000 $x
  79         chmod 755 $x
  80     done
  81     btrfs subvolume set-default \
  82           $(btrfs subvolume list . | grep 'root$' | awk '{print $2}') .
  83     chattr -Rf +C root
  84     cd /
  85     umount /mnt
  86 }
  87
  88 mkdir -p /tmp/fai
  89 shopt -s nullglob
  90 if $partition; then
  91     for dev in ${devs[@]}; do
  92         for x in $dev[0-9]; do wipefs -a $x; done
  93     done
  94     for dev in ${devs[@]}; do
  95         parted -s $dev mklabel gpt
  96         # gpt ubuntu cloud image uses ~4. fai uses 1 MiB. ehh, i'll do 4.
  97         # also, using MB instead of MiB causes complains about alignment.
  98         parted -s $dev mkpart primary "ext3" 4MB ${boot_end}MiB
  99         parted -s $dev set 1 boot on
 100         parted -s $dev mkpart primary "linux-swap" ${boot_end}MiB ${swap_end}MiB
 101         parted -s -- $dev mkpart primary "" ${swap_end}MiB -0
 102         parted -s $dev mkpart primary "" 1MiB 4MiB
 103         parted -s $dev set 4 bios_grub on
 104         # the mkfs failed randomly on a vm, so I threw a sleep in here.
 105         sleep .1
 106         mkfs.ext4 -F ${dev}1
 107         # 3 is device which simply holds a key for the 4's,
 108         # so we can unlock multi-device btrfs fs with 1 manually entered passphrase.
 109         #
 110         # Background: It's of course possible modify the initramfs to
 111         # put the input from a passphrase prompt into a variable and use
 112         # it to unlock multiple devices, but that would require figuring
 113         # more things out.
 114         #
 115         for luks_dev in ${dev}3; do
 116             yes YES | cryptsetup luksFormat $luks_dev $luks_dir/host-$HOSTNAME \
 117                                  -c aes-cbc-essiv:sha256 -s 256 || [[ $? == 141 ]]
 118             yes "$lukspw" | \
 119                 cryptsetup luksAddKey --key-file $luks_dir/host-$HOSTNAME \
 120                            $luks_dev || [[ $? == 141 ]]
 121             # background: Keyfile and password are treated just
 122             # like 2 ways to input a passphrase, so we don't actually need to have
 123             # different contents of keyfile and passphrase, but it makes some
 124             # security sense to a really big randomly generated passphrase
 125             # as much as possible, so we have both.
 126             #
 127             # This would remove the keyfile.
 128             #    yes 'test' | cryptsetup luksRemoveKey /dev/... \
 129                 #                            /key/file || [[ $? == 141 ]]
 130
 131             cryptsetup luksOpen $luks_dev crypt_dev_${luks_dev##/dev/} \
 132                        --key-file $luks_dir/host-$HOSTNAME
 133         done
 134     done
 135     mkfs.btrfs -f ${crypt_devs[@]/%/3}
 136     parted ${devs[0]} set 1 boot on
 137     mount $crypt /mnt
 138     create_subvols
 139 else
 140     for dev in ${devs[@]}; do
 141         mkfs.ext4 -F ${dev}1
 142         cryptsetup luksOpen ${dev}3 crypt_dev_${dev##/dev/}3 \
 143                    --key-file $luks_dir/host-$HOSTNAME || [[ $? == 141 ]]
 144     done
 145     sleep 1
 146     mount -o subvolid=0 $crypt /mnt
 147     # systemd creates subvolumes we want to delete.
 148     s=($(btrfs subvolume list --sort=-path /mnt |
 149                 sed -rn 's#^.*path\s*(root/\S+)\s*$#\1#p'))
 150     for subvol in ${s[@]}; do btrfs subvolume delete /mnt/$subvol; done
 151     btrfs subvolume set-default 0 /mnt
 152     btrfs subvolume delete /mnt/root
 153     create_subvols
 154 fi
 155
 156
 157
 158 cat > /tmp/fai/fstab <<EOF
 159 $crypt  /  btrfs  noatime,subvol=/root  0 0
 160 $crypt  /q  btrfs  noatime,subvol=/q  0 0
 161 /q/a  /a  none  bind  0 0
 162 $crypt  /home  btrfs  noatime,subvol=/home  0 0
 163 ${devs[0]}1  /boot  ext4  noatime  0 2
 164 EOF
 165
 166
 167 swaps=()
 168 for dev in ${devs[@]}; do
 169     s=crypt_swap_${dev##/dev/}2
 170     swaps+=(/dev/mapper/$s)
 171     cat >>/tmp/fai/crypttab <<EOF
 172 crypt_dev_${dev##/dev/}3  ${dev}3  none  keyscript=/root/keyscript,discard,luks
 173 $s ${dev}2  /dev/urandom  swap,cipher=aes-xts-plain64,size=256,hash=ripemd160
 174 EOF
 175     cat >> /tmp/fai/fstab <<EOF
 176 /dev/mapper/$s  none  swap  sw  0 0
 177 EOF
 178 done
 179
 180
 181 # swaplist seems to do nothing.
 182 cat >/tmp/fai/disk_var.sh <<EOF
 183 ROOT_PARTITION=\${ROOT_PARTITION:-$crypt}
 184 BOOT_PARTITION=\${BOOT_PARTITION:-${devs[0]}1}
 185 BOOT_DEVICE=\${BOOT_DEVICE:-"${devs[0]}"}
 186 SWAPLIST=\${SWAPLIST:-"${swaps[@]}"}
 187 EOF