arch use by-id and various fixes
[automated-distro-installer] / fai / config / hooks / partition.DEFAULT
1 #!/bin/bash -x
2
3 set -eE -o pipefail
4 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?"' ERR
5
6 # # fai's setup-storage won't do btrfs on luks,
7 # # so we do it ourself :)
8
9 skiptask partition || ! type skiptask # for running not in fai
10
11 #### begin configuration
12
13 rootn=1
14 swapn=2
15 bootn=3
16 bios_grubn=4
17 boot_mib=1500
18
19
20 ##### end configuration
21
22
23 add-part() {
24 local d ret
25 if [[ $# == 1 ]]; then
26 d=$dev
27 part=$1
28 else
29 d=$1
30 part=$2
31 fi
32 if [[ $d == /dev/disk/by-id/* ]]; then
33 ret=$d-part$part
34 else
35 ret=$d$part
36 fi
37 echo $ret
38 }
39
40 bootdev() { add-part $@ $bootn; }
41 rootdev() { add-part $@ $rootn; }
42 swapdev() { add-part $@ $swapn; }
43 bios_grubdev() { add-part $@ $bios_grubn; }
44
45 crypt-dev() { echo /dev/mapper/crypt_dev_${1##*/}; }
46 crypt-name() { echo crypt_dev_${1##*/}; }
47 root-cryptdev() { crypt-dev $(rootdev $@); }
48 swap-cryptdev() { crypt-dev $(swapdev $@); }
49 root-cryptname() { crypt-name $(rootdev $@); }
50 swap-cryptname() { crypt-name $(swapdev $@); }
51
52
53 ##### end function defs
54
55 if ifclass REPARTITION;then
56 partition=true # force a full wipe
57 else
58 partition=false # change to true to force a full wipe
59 fi
60
61 lastn=$bios_grubn
62
63
64 hdds=()
65 ssds=()
66 cd /sys/block
67 for disk in [sv]d[a-z]; do
68 case $(cat $disk/queue/rotational) in
69 0) ssds+=(/dev/$disk) ;;
70 1) hdds+=(/dev/$disk) ;;
71 *) echo "$0: error: unknown /sys/block/$disk/queue/rotational: \
72 $(cat $disk/queue/rotational)"; exit 1 ;;
73 esac
74 done
75
76 # install all ssds, or if there are none, all hdds
77 if (( ${#ssds[@]} > 0 )); then
78 short_devs=( ${ssds[@]} )
79 else
80 short_devs=( ${hdds[@]} )
81 fi
82
83 # check if the partitions exist have the right filesystems
84 #blkid="$(blkid -s TYPE)"
85 for dev in ${short_devs[@]}; do
86 ! $partition || break
87 y=$(readlink -f $dev)
88 x=($y[0-9])
89 [[ ${#x[@]} == "${lastn}" ]] || partition=true
90 for (( i=1; i <= lastn; i++ )); do
91 [[ -e ${dev}$i ]] || partition=true
92 done
93 # On one system, blkid is missing some partitions.
94 # maybe we need a flag, like FUZZY_BLKID or something, so we
95 # can check that at least some exist.
96 # for x in "`rootdev`: TYPE=\"crypto_LUKS\"" "`bootdev`: TYPE=\"btrfs\""; do
97 # echo "$blkid" | grep -Fx "$x" &>/dev/null || partition=true
98 # done
99 done
100
101 if $partition && ifclass PARTITION_PROMPT; then
102 echo "Press any key except ctrl-c to continue and partition these drives:"
103 echo " ${short_devs[@]}"
104 read
105 fi
106
107 devs=()
108 shopt -s extglob
109 for short_dev in ${short_devs[@]}; do
110 devs+=($(devbyid $short_dev))
111 done
112
113
114
115 boot_devs=()
116 for dev in ${devs[@]}; do
117 if ifclass frodo; then
118 # I ran into a machine where the bios doesn't know about some disks,
119 # so 1st stage of grub also doesn't know about them.
120 # Also, grub does not support mounting degraded btrfs as far as
121 # I can tell with some googling.
122 # From within an arch install env, I could detect them by noting
123 # their partitions were mixed with the next disk in /dev/disk/by-path,
124 # and I have mixed model disks, and I could see the 8 models which showed
125 # up in the bios, and thus see which 2 models were missing.
126 # hdparm -I /dev/sdh will give model info in linux.
127 # However, in fai on jessie, /dev/disk/by-path dir doesn't exist,
128 # and I don't see another way, so I'm hardcoding them.
129 # We still put grub on them and partition them the same, for uniformity
130 # and in case they get moved to a system that can recognize them,
131 # we just exclude them from the boot filesystem.
132 cd /dev/disk/by-id/
133 bad_disk=false
134 for id in ata-TOSHIBA_MD04ACA500_8539K4TQFS9A \
135 ata-TOSHIBA_MD04ACA500_Y5IFK6IJFS9A; do
136 if [[ $(readlink -f $id) == "$(readlink -f $dev)" ]]; then
137 bad_disk=true
138 break
139 fi
140 done
141 $bad_disk || boot_devs+=(`bootdev`)
142 else
143 boot_devs+=(`bootdev`)
144 fi
145 done
146
147 if [[ ! $DISTRO ]]; then
148 if ifclass STABLE; then
149 DISTRO=debianstable
150 else
151 DISTRO=debiantesting
152 fi
153 fi
154
155
156
157 case ${#boot_devs[@]} in
158 # need double the space if we are raid 10, and then
159 # might as well give some extra overhead.
160 [4-9]*|[1-3]?*) boot_mib=$((boot_mib * 3)) ;;
161 esac
162
163
164 bpart() { # btrfs a partition
165 case ${#@} in
166 [1-3]) mkfs.btrfs -f $@ ;;
167 [4-9]*|[1-3]?*) mkfs.btrfs -f -m raid10 -d raid10 $@ ;;
168 esac
169 }
170
171 first_boot_dev=$(bootdev ${devs[0]})
172
173 # keyfiles generated like:
174 # head -c 2048 /dev/urandom | od | s dd of=/q/root/luks/host-demohost
175 luks_dir=${LUKS_DIR:-/var/lib/fai/config/distro-install-common/luks}
176 if ifclass tp; then
177 lukspw=$(cat $luks_dir/traci)
178 else
179 lukspw=$(cat $luks_dir/ian)
180 fi
181 if ifclass demohost; then
182 lukspw=x
183 fi
184
185
186 first_root_crypt=$(root-cryptdev ${devs[0]})
187
188 bios_grubn=4
189 # 1.5 x based on https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Installation_Guide/sect-disk-partitioning-setup-x86.html#sect-custom-partitioning-x86
190 swap_mib=$(( $(grep ^MemTotal: /proc/meminfo | \
191 awk '{print $2}') * 3/(${#devs[@]} * 2 ) / 1024 ))
192
193 mkdir -p /tmp/fai
194 shopt -s nullglob
195 if $partition; then
196 for dev in ${devs[@]}; do
197 for x in $dev[0-9]; do
198 count_down=10
199 # wipefs has failed, manual run works, google suggests timing issue
200 while ! wipefs -a $x; do
201 sleep 2
202 count_down=$((count_down - 1))
203 (( count_down > 0 )) || exit 1
204 done
205 done
206 done
207 for dev in ${devs[@]}; do
208 # parted will round up the disk size. Do -1 so we can have
209 # fully 1MiB unit partitions for easy resizing of the last partition.
210 # Otherwise we would pass in -0 for the end argument for the last partition.
211 #
212 # parted print error output is expected. example:
213 # Error: /dev/vda: unrecognised disk label
214 disk_mib=$(( $(parted -m $dev unit MiB print | \
215 sed -nr "s#^/dev/[^:]+:([0-9]+).*#\1#p") - 1))
216 root_end=$(( disk_mib - swap_mib - boot_mib / ${#boot_devs[@]} ))
217 swap_end=$(( root_end + swap_mib))
218
219 parted -s $dev mklabel gpt
220 # gpt ubuntu cloud image uses ~4. fai uses 1 MiB.
221 # I read something in the parted manual saying cheap flash media
222 # likes to start at 4.
223 # MiB because parted complains about alignment otherwise.
224 pcmd="parted -a optimal -s -- $dev"
225 $pcmd mkpart primary "ext3" 4MiB ${root_end}MiB
226 $pcmd mkpart primary "linux-swap" ${root_end}MiB ${swap_end}MiB
227 $pcmd mkpart primary "" ${swap_end}MiB ${disk_mib}MiB
228 $pcmd mkpart primary "" 1MiB 4MiB
229 $pcmd set $bios_grubn bios_grub on
230 $pcmd set $bootn boot on # generally not needed on modern systems
231 # the mkfs failed before on a vm, which prompted me to add
232 # sleep .1
233 # then failed on a physical machine
234 # with:
235 # Device /dev/disk/by-id/foo doesn't exist or access denied,
236 # so here we wait.
237 secs=0
238 while [[ ! -e `rootdev` ]] && (( secs < 10 )); do
239 sleep 1
240 secs=$((secs +1))
241 done
242 yes YES | cryptsetup luksFormat `rootdev` $luks_dir/host-$HOSTNAME \
243 -c aes-cbc-essiv:sha256 -s 256 || [[ $? == 141 ]]
244 yes "$lukspw" | \
245 cryptsetup luksAddKey --key-file $luks_dir/host-$HOSTNAME \
246 `rootdev` || [[ $? == 141 ]]
247 # background: Keyfile and password are treated just
248 # like 2 ways to input a passphrase, so we don't actually need to have
249 # different contents of keyfile and passphrase, but it makes some
250 # security sense to a really big randomly generated passphrase
251 # as much as possible, so we have both.
252 #
253 # This would remove the keyfile.
254 # yes 'test' | cryptsetup luksRemoveKey /dev/... \
255 # /key/file || [[ $? == 141 ]]
256
257 cryptsetup luksOpen `rootdev` `root-cryptname` \
258 --key-file $luks_dir/host-$HOSTNAME
259 done
260 ls -la /dev/btrfs-control
261 sleep 1
262 bpart $(for dev in ${devs[@]}; do root-cryptdev; done)
263 bpart ${boot_devs[@]}
264 else
265 for dev in ${devs[@]}; do
266 cryptsetup luksOpen `rootdev` `root-cryptname` \
267 --key-file $luks_dir/host-$HOSTNAME
268 done
269 sleep 1
270 fi
271
272 mount -o subvolid=0 $first_root_crypt /mnt
273 # systemd creates subvolumes we want to delete.
274 s=($(btrfs subvolume list --sort=-path /mnt |
275 sed -rn "s#^.*path\s*(root_$DISTRO/\S+)\s*\$#\1#p"))
276 for subvol in ${s[@]}; do btrfs subvolume delete /mnt/$subvol; done
277 btrfs subvolume set-default 0 /mnt
278 [[ ! -e /mnt/root_$DISTRO ]] || btrfs subvolume delete /mnt/root_$DISTRO
279
280
281 ## create subvols ##
282 cd /mnt
283 for x in q home_$DISTRO root_$DISTRO; do
284 btrfs subvolume list . | grep "$x$" >/dev/null || btrfs subvolume create $x
285 done
286 chown root:1000 q
287
288
289 mkdir -p /mnt/root_$DISTRO/boot
290 for x in root/a q/a; do
291 mkdir -p $x
292 chown 1000:1000 $x
293 chmod 755 $x
294 done
295 # could set default like this, but no reason to.
296 # btrfs subvolume set-default \
297 # $(btrfs subvolume list . | grep "root_$DISTRO$" | awk '{print $2}') .
298 chattr -Rf +C root_$DISTRO
299 cd /
300 umount /mnt
301 mount -o subvolid=0 $first_boot_dev /mnt
302 cd /mnt
303 btrfs subvolume set-default 0 /mnt
304 [[ ! -e /mnt/boot_$DISTRO ]] || btrfs subvolume delete /mnt/boot_$DISTRO
305 btrfs subvolume create boot_$DISTRO
306 cd /
307 umount /mnt
308 ## end create subvols ##
309
310
311
312 cat > /tmp/fai/fstab <<EOF
313 $first_root_crypt / btrfs noatime,subvol=root_$DISTRO 0 0
314 $first_root_crypt /q btrfs noatime,subvol=q 0 0
315 /q/a /a none bind 0 0
316 $first_root_crypt /home btrfs noatime,subvol=home_$DISTRO 0 0
317 $first_boot_dev /boot btrfs noatime,subvol=boot_$DISTRO 0 0
318 EOF
319
320 swaps=()
321 for dev in ${devs[@]}; do
322 swaps+=(`swap-cryptname`)
323 cat >>/tmp/fai/crypttab <<EOF
324 `root-cryptname` `rootdev` none keyscript=/root/keyscript,discard,luks
325 `swap-cryptname` `swapdev` /dev/urandom swap,cipher=aes-xts-plain64,size=256,hash=ripemd160
326 EOF
327 cat >> /tmp/fai/fstab <<EOF
328 `swap-cryptdev` none swap sw 0 0
329 EOF
330 done
331
332 # fai would do this:
333 #BOOT_DEVICE=\${BOOT_DEVICE:-"${devs[0]}"}
334
335 # swaplist seems to do nothing.
336 cat >/tmp/fai/disk_var.sh <<EOF
337 ROOT_PARTITION=\${ROOT_PARTITION:-$first_root_crypt}
338 BOOT_PARTITION=\${BOOT_PARTITION:-$first_boot_dev}
339 BOOT_DEVICE="${short_devs[@]}"
340 SWAPLIST=\${SWAPLIST:-"${swaps[@]}"}
341 EOF