iankelling.org Git - automated-distro-installer/blob - fai/config/scripts/IANK/11-iank

   1 #!/bin/bash -x
   2 # This file is part of Ian Kelling's automated-distro-installer
   3 # Copyright (C) 2024 Ian Kelling
   4
   5 # This program is free software; you can redistribute it and/or
   6 # modify it under the terms of the GNU General Public License
   7 # as published by the Free Software Foundation; either version 2
   8 # of the License, or (at your option) any later version.
   9
  10 # This program is distributed in the hope that it will be useful,
  11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 # GNU General Public License for more details.
  14
  15 # You should have received a copy of the GNU General Public License
  16 # along with this program; if not, write to the Free Software
  17 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  18
  19 set -eE -o pipefail
  20 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
  21
  22 if [[ $EUID != 0 ]]; then
  23   echo "$0: error: expected to be root."
  24   exit 1
  25 fi
  26
  27 if ! type -t fcopy &>/dev/null; then
  28   sudo apt-get -y install fai-client
  29 fi
  30
  31 # -r = recursive
  32 # -i = ignore non-matching class warnings, always exit 0
  33 # -B = no backup files
  34 fcopy -riB /boot
  35 # this is also done by FAIBASE/10-misc by default (without B)
  36 fcopy -riB /usr/local/bin
  37
  38 fcopy -riB /etc/apt/logind.conf.d
  39
  40 # this gets done by fai, but just happens too often that
  41 # I add sources due to new distros, whatever.
  42 fcopy -riB /etc/apt/preferences.d
  43 fcopy -riB /etc/apt/sources.list.d
  44
  45
  46 src=$FAI/distro-install-common/shadow
  47 dst=/q/root/shadow
  48 if [[ ! -e $dst && -e $src ]]; then
  49   # outside of fai context, we skip this
  50   mkdir -p $dst
  51   mount -o bind $src $dst
  52 fi
  53
  54
  55
  56 $FAI/distro-install-common/end
  57
  58
  59
  60 ### begin sources install + updates
  61 # these get copied in an earlier stage by fai, but leaving it here since
  62 # I run this as a single post-fai script to update things that have changed.
  63 tmpfile1=$(mktemp)
  64 # this can fail if we need an apt update
  65 $ROOTCMD /usr/bin/apt-cache policy >$tmpfile1 ||:
  66 fcopy -riB /etc/apt
  67
  68 tmpfile2=$(mktemp)
  69 $ROOTCMD /usr/bin/apt-cache policy >$tmpfile2
  70 if ! diff -q $tmpfile1 $tmpfile2; then
  71   $ROOTCMD /usr/bin/apt update
  72 fi
  73 # outside of fai, this seems to regularly lead to
  74 # E: Could not get lock /var/lib/apt/lists/lock - open (11: Resource temporarily unavailable)
  75 # so add a sleep. 1 sec is probably way more than needed.
  76 sleep 1
  77 f=$FAI_ROOT/var/cache/apt/pkgcache.bin
  78 if [[ ! -r $f ]] || (( $(( $(date +%s) - $(stat -c %Y $f ) )) > 60*60*2 )); then
  79   i=0
  80   while fuser $FAI_ROOT/var/lib/dpkg/lock &>/dev/null; do
  81     sleep 1
  82     i=$(( i+1 ))
  83     if (( i > 300 )); then
  84       echo "error: timed out waiting for /var/lib/dpkg/lock" >&2
  85       exit 1
  86     fi
  87     $ROOTCMD apt-get update
  88   done
  89 fi
  90 ### end sources install + updates
  91
  92
  93 #### misc configurations
  94
  95 if [[ $FAI_ACTION != dirinstall ]] && ! ifclass NOCRYPT; then
  96   if ifclass LINODE; then
  97     speed=19200
  98     cmdline="rd.luks.crypttab=no net.ifnames=0 console=ttyS0,${speed}n8"
  99   else
 100     speed=115200
 101     cmdline="rd.luks.crypttab=no net.ifnames=0 console=ttyS0,${speed}n8 console=tty0"
 102     case $HOSTNAME in
 103       kd)
 104         fcopy -v /usr/bin/myncq
 105
 106         cat >$target/etc/systemd/system/myncq.service <<'EOF'
 107 [Unit]
 108 Description=fix ncq errors
 109
 110 [Service]
 111 Type=oneshot
 112 ExecStart=/usr/bin/myncq
 113 TimeoutStartSec=20
 114
 115 [Install]
 116 # https://www.enricozini.org/blog/2017/debian/systemd-07-devices/
 117 WantedBy=dev-disk-by\x2did-ata\x2dSamsung_SSD_870_QVO_8TB_S5VUNG0N900656V.device
 118 EOF
 119
 120         $ROOTCMD bash <<'EOFOUTER'
 121 systemctl enable myncq.service
 122 /usr/bin/myncq no-upgrub
 123 EOFOUTER
 124
 125         ;;&
 126       # per rubens suggestion to make a d16 more stable
 127       kd|kw) cmdline+=" pci=realloc=off" ;;
 128     esac
 129   fi
 130
 131 fi ##### end != dirinstall && != NOCRYPT
 132
 133
 134 ###### begin network setup ####
 135
 136 # use old names. the idea of them changing between boots has never
 137 # happened to me and I usually only have 1 wired or other type.
 138 # If I ever do need to care about it, I will.
 139 # Strangely this didn't work on kw, so I added kernel cmdline parameter.
 140 # https://www.freedesktop.org/wiki/Software/systemd/PredictableNetworkInterfaceNames/
 141 ln -sf /dev/null $target/etc/systemd/network/99-default.link
 142
 143
 144 # bitfolk installer handles the rest
 145 case $HOSTNAME in
 146   bk|je) exit 0 ;;
 147 esac
 148
 149
 150 # bug fix, somewhere between t9's xorg 1.19.6
 151 # and 1.20.1-3ubuntu2
 152 #  xserver-xorg-video-nouveau                 1:1.0.15-3
 153 # xorg stopped load nouveau
 154 #  https://www.linuxquestions.org/questions/slackware-14/kernel-modules-conflicting-with-nouveau-driver-4175623867/
 155 # https://nouveau.freedesktop.org/InstallNouveau.html
 156 # And now in t11, things got worse with a newer card also not loading
 157 # nouveau when it did in t10.
 158 if lspci|grep -q 'VGA compatible controller: NVIDIA'; then
 159   mkdir -p $target/etc/X11/xorg.conf.d/
 160   cat >$target/etc/X11/xorg.conf.d/10-nouveau.conf <<'EOF'
 161 Section "Device"
 162 Identifier "Device0"
 163 Driver "nouveau"
 164 EndSection
 165 EOF
 166 fi
 167
 168 # use networkmanager if this host has wireless.
 169 if [[ $(iw dev) ]]; then
 170   $ROOTCMD bash -xe <<EOF
 171 apt-get -y install network-manager
 172 EOF
 173
 174   # allow networkmanager to manage interfaces
 175   #https://bugs.launchpad.net/ubuntu/+source/network-manager/+bug/1638842
 176   touch $target/etc/NetworkManager/conf.d/10-globally-managed-devices.conf
 177   # in a default desktop install, it looks like netplan creates this file under
 178   # run/NetworkManager/conf.d in early boot.
 179
 180   # By default, dns=default is set in etiona, and dns is just broken.
 181   # Maybe with resolvconf it would work, but theres no need for that.
 182   # https://wiki.gnome.org/Projects/NetworkManager/DNS
 183   cat >$target/etc/NetworkManager/conf.d/99-iank.conf <<'EOF'
 184 [main]
 185 dns=systemd-resolved
 186 EOF
 187
 188   $FAI/distro-install-common/ethusb-static
 189   if [[ $(dig +short @10.2.0.1 -x 10.2.0.2 2>&1 ||:) == kd.b8.nz. ]] \
 190        && ip n show 10.2.0.1 | grep . &>/dev/null; then
 191     : # we are at home. note: logic duplicated in btrbk-run
 192   else
 193     $FAI/distro-install-common/ethusb-nm
 194   fi
 195
 196
 197 else
 198   cat > $target/etc/network/interfaces <<-EOF
 199 # generated by FAI
 200 auto lo eth0
 201 iface lo inet loopback
 202 iface eth0 inet dhcp
 203 iface eth0 inet6 auto
 204
 205 source-directory /etc/network/interfaces.d
 206 EOF
 207
 208   # previously had an else condition after
 209   #elif ifclass VM || ifclass LINODE; then
 210   # iface $NIC1 inet manual
 211   # iface br0 inet dhcp
 212   #   bridge_ports $NIC1
 213   #   bridge_stp off
 214   #   bridge_maxwait 0
 215   # however, on t9, on startup, br0, became
 216   # rename1 and didn't come up. i dunno why,
 217   # but the bridge is for vms that I rarely use,
 218   # so not bothering to figure it out.
 219
 220
 221 fi
 222
 223 if ifclass LINODE; then
 224   mkdir -p $target/etc/initramfs-tools/conf.d
 225   cat >$target/etc/initramfs-tools/conf.d/mine <<EOF
 226 # dhcp in initramfs doesn't work on linode. i dunno why, whatever.
 227 # man 5 initramfs.conf
 228 # /usr/share/doc/klibc-utils/README.ipconfig.gz
 229 # /usr/share/initramfs-tools/scripts/functions
 230 IP=$linode_ip::$linode_gw:255.255.255.0::eth0:off
 231 EOF
 232
 233
 234   if [[ $HOSTNAME == li ]]; then
 235     cat > $target/etc/network/interfaces <<-EOF
 236 # generated by FAI
 237 auto lo eth0
 238 iface lo inet loopback
 239 iface eth0 inet dhcp
 240 # for the standard network config, uncomment this and comment the lines after it.
 241 #iface eth0 inet6 auto
 242
 243 iface eth0 inet6 static
 244 # this is really a /128. it seems like we need to assign it for ipv6 to work.
 245 address 2600:3c00::f03c:91ff:fe6d:baf8/64
 246 gateway fe80::1
 247
 248 iface eth0 inet6 static
 249 # from a requested /64 pool
 250 address 2600:3c00:e000:280::2/64
 251
 252 source-directory /etc/network/interfaces.d
 253 EOF
 254   fi
 255 fi
 256
 257
 258 ##### end network setup  #####
 259
 260
 261 if ifclass VOL_BULLSEYE_BOOTSTRAP || ifclass VOL_BOOKWORM_BOOTSTRAP; then
 262   fcopy /etc/systemd/system/faicheck.service
 263   $ROOTCMD bash <<'EOFOUTER'
 264 systemctl enable faicheck.service
 265 EOFOUTER
 266   exit 0 # avoid unnecessary stuff in bootstrap vol
 267 fi
 268
 269
 270 ## misc settings
 271 $ROOTCMD bash <<'EOFOUTER'
 272 #### begin .ssh setup ###
 273 set -x
 274 set -eE -o pipefail
 275 if ! [[ -s /home/iank/.ssh/authorized_keys ]]; then
 276   mkdir -p /home/iank/.ssh
 277   f=/root/.ssh/authorized_keys
 278   if [[ -e $f ]]; then
 279      cp $f /home/iank/.ssh
 280   fi
 281   chown -R 1000:1000 /home/iank/.ssh
 282   chmod -R u=Xrw,og= /home/iank/.ssh
 283   rm -rf /root/.ssh
 284   # remove broken symlinks or the following cp will fail
 285   find /home/iank/.ssh -xtype l -exec rm '{}' \;
 286   cp -rL /home/iank/.ssh /root
 287   chown -R root:root /root/.ssh
 288   chmod 700 /root/.ssh
 289 fi
 290
 291 # old link from
 292 # # https://ticktockhouse.svbtle.com/my-obligatory-ubuntu-ssh-agent-post
 293 # but that made a service that started too soon and didn't pick up our
 294 # x env vars. instead, copy from the root ssh-agent just the
 295 # appropriate things into a new service.
 296
 297 rm -f /home/iank/.local/share/systemd/user/sshaiank.service \
 298   /home/iank/.config/systemd/user/default.target.wants/sshaiank.service
 299
 300 #### end .ssh setup ###
 301
 302 ## duplicated in ssh-emacs-setup
 303 # done here so its setup earlier for convenience
 304 line='AcceptEnv INSIDE_EMACS BRC COLUMNS'
 305 f=/etc/ssh/sshd_config
 306 grep -xFq "$line" $f || tee -a $f <<<"$line"
 307
 308
 309 # default debian groups (jessie through buster) + adm, root, admin
 310 for g in cdrom floppy audio dip video plugdev netdev adm sudo admin; do
 311   if getent group $g >/dev/null; then
 312     usermod -aG $g iank
 313   fi
 314 done
 315
 316 if getent group systemd-journal >/dev/null; then
 317   usermod -aG systemd-journal iank
 318 fi
 319 EOFOUTER
 320
 321 rm -f $target/etc/resolv.conf
 322 ln -s ../run/systemd/resolve/stub-resolv.conf $target/etc/resolv.conf
 323 # needed for bitfolk image
 324 if [[ -e /a/bin/fai/fai-wrapper ]]; then
 325   systemctl enable systemd-resolved
 326   systemctl start systemd-resolved
 327 fi
 328
 329
 330
 331 # reading through the groups that iank is in but user2 isn't,
 332 for g in plugdev audio video cdrom; do
 333   $ROOTCMD usermod -a -G $g user2
 334 done
 335
 336
 337 ## begin get new kernel and btrfs-progs ##
 338 case $HOSTNAME in
 339   sy|so)
 340     $FAI/distro-install-common/install-stable-kernel-debs
 341     ;;
 342   *)
 343     $ROOTCMD apt-get -y install linux-libre
 344     ;;
 345 esac
 346
 347 pre=https://mirrors.edge.kernel.org/pub/linux/kernel/people/kdave/btrfs-progs
 348 tarball=$(curl -s $pre/sha256sums.asc \
 349             | awk '$2 ~ /^btrfs-progs-v/ { print $2 }' | grep -v -- -rc | grep "^btrfs-progs-v.*gz\$" | sort -V | tail -n1)
 350 url="$pre/$tarball"
 351 dir=${tarball%.tar.gz}
 352 ver=${dir#btrfs-progs-}
 353 cur_ver=$($ROOTCMD btrfs --version 2>/dev/null | awk '{print $2}') ||:
 354
 355 if [[ $FAI_ROOT == / ]]; then
 356   bp_dir=/a/opt/btrfs-progs-release
 357 else
 358   bp_dir=$FAI/distro-install-common/btrfs-progs-release
 359 fi
 360 if [[ $ver != "$cur_ver" ]]; then
 361   if [[ $ver != "$($bp_dir/btrfs --version 2>/dev/null | awk '{print $2}')" ]]; then
 362     cd $target/tmp
 363     wget $url
 364     tar xzf $tarball
 365     $ROOTCMD apt-get -y build-dep btrfs-progs
 366     # no docs cuz I didn't want to bother fixing error of missing docs dependencies
 367     $ROOTCMD bash -xe <<EOF
 368 cd /tmp/${tarball%.tar.gz}
 369 ./configure --disable-documentation
 370 make
 371 make install
 372 EOF
 373     # If our desktop is HOST2, will we btrbk this latest bprogs to other
 374     # machines.
 375     if [[ -s /a/bin/bash_unpublished/source-state ]]; then
 376       source /a/bin/bash_unpublished/source-state
 377     fi
 378     if [[ $HOST2 == "$HOSTNAME" && $FAI_ROOT != / ]]; then
 379       rm -rf $bp_dir
 380       chown -R iank:iank $target/tmp/${tarball%.tar.gz}
 381       mv $target/tmp/${tarball%.tar.gz} $bp_dir
 382     fi
 383   else
 384     if ! $ROOTCMD dpkg -s -- build-essential  2>&1 | grep -Fx "Status: install ok installed" &>/dev/null; then
 385       $ROOTCMD apt-get -y install build-essential
 386     fi
 387
 388     if [[ $FAI_ROOT == / ]]; then
 389       cd /a/opt/btrfs-progs-release
 390       make install
 391     else
 392       mkdir -p $target/tmp/bprogs
 393       mount -o bind $bp_dir $target/tmp/bprogs
 394       $ROOTCMD bash -xe <<EOF
 395 cd /tmp/bprogs
 396 make install
 397 EOF
 398     fi
 399   fi
 400 fi
 401 ## end get new kernel and btrfs-progs ##