2 # Copyright (C) 2018 Ian Kelling
4 # This program is free software; you can redistribute it and/or
5 # modify it under the terms of the GNU General Public License
6 # as published by the Free Software Foundation; either version 2
7 # of the License, or (at your option) any later version.
9 # This program is distributed in the hope that it will be useful,
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 # GNU General Public License for more details.
14 # You should have received a copy of the GNU General Public License
15 # along with this program; if not, write to the Free Software
16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
18 x
="$(readlink -f "$BASH_SOURCE")"; source "${x%/*}/bash-trace"
20 [[ $EUID == 0 ]] ||
exec sudo
-E "${BASH_SOURCE[0]}" "$@"
22 LC_USEBASHRC
=t
; . ~
/.bashrc
26 usage: ${0##*/} [-h|--help] [BASE_CODENAME] [ARCH]
27 install fai-server on the current machine
29 Initial setup of a fai server. works on localhost. Set's the current ip
30 as the tftp server. I vaguely remember that using a hostname does not
31 work. Separate from running this, faiserver needs to be setup in dns to
32 point to whatever host this is run on.
34 Default BASE_CODENAME is bullseye. Default ARCH is 64. The script expects corresponding
35 $BASEFILE_DIR/${UPCASED_BASE_CODENAME}${ARCH}.tar.(gz|xz) to exist, and it must have been
36 generated around the same time as the nfsroot, at least so it has the
40 Note: there is a bug in 5.9.4, fixed by adding
43 Note: in t9, there is a bug in recent fai packages (eg 2021+), where
44 unshare uses a too new argument. I was able to fix it by
45 just going to the site of the error and changing unshare to
46 chroot like it used to be, but I'm not bothering to make
47 any persistent fix, since I'm now on t10. If it ever came
48 up again, using an old fai package would also work.
50 /usr/sbin/fai-make-nfsroot:503, before apt-get update
61 e
() { echo "+ $@"; "$@"; }
67 if [[ $base == [[:upper
:]] ]]; then
68 echo $0: error
: use lowercase base
72 basefile
=($BASEFILE_DIR/${base^^}${arch^^}.
tar.gz
)
73 sed="sed -ri --follow-symlinks"
75 if [[ ! -e $basefile ]]; then
76 printf "%s\n" "$0: error basefile=$basefile does not exist" >&2
80 if [[ ! -d $BASEFILE_DIR ]]; then
81 printf "%s\n" "$0: error BASEFILE_DIR=$BASEFILE_DIR does not exist" >&2
86 if ! type -p wget
&>/dev
/null
; then
87 apt-get
install -y wget
91 [[ $
(dpkg
--print-architecture) == armhf
]]
94 # fai on ubuntu only has official support using the universe repo, but newer
95 # tends to have less bugs.
96 wget
-O - https
://fai-project.org
/download
/2BF8D9FE074BCDE4.asc | apt-key add
-
100 stretch|bullseye|bullseye
)
101 if ! grep -qFx "deb https://fai-project.org/download $base koeln" /etc
/apt
/sources.list.d
/fai.list
; then
104 cat >/etc
/apt
/sources.list.d
/fai.list
<<EOF
105 deb https://fai-project.org/download $base koeln
109 echo "$0: error: script needs updating for new base" >&2
114 f
=/var
/cache
/apt
/pkgcache.bin
;
116 cachetime
=$
(stat
-c %Y
$f );
118 limittime
=$
(( now
- 60*60*2 ))
119 if (( cachtime
> limittime
)); then
128 # Relevant packages from fai-quickstart depends and fai-server recommends.
129 # I especially do not wait isc-dhcp-server or an inetd. Also excludes
130 # nfs-kernel-server. On an android chroot, we don\'t have nfs in the
131 # kernel, or the ability to install it.
132 # xorriso is for running fai-cd -a, not strictly need for fai-server
133 # perl-tk is for fai-monitor-gui
134 # mtools is for fai-cd
135 pkgs
=(fai-doc tftpd-hpa
tar reprepro squashfs-tools binutils xorriso perl-tk mtools
)
136 if modprobe nfsd
&>/dev
/null
; then
137 pkgs
+=(nfs-kernel-server
)
143 e apt-get
install -y ${pkgs[@]}
144 # confnew since we edit /etc/fai/NFSROOT in an automated way
145 # fai-client is already a fai-server dependency, but make sure it gets upgraded
146 e apt-get
install --no-install-recommends -y -o Dpkg
::Options
::=--no-force-confdef -o Dpkg
::Options
::=--force-confnew fai-server fai-client
148 r
=http
://http.us.debian.org
/debian
149 # like default, but scrap httpredir, and nonfree.
150 # All my systems should be able to get along without nonfree
151 # for a base working system afaik.
153 cat >/etc
/fai
/apt
/sources.list
<<EOF
154 deb $r $base main contrib
157 ### begin setup security repo ###
160 cat >>/etc
/fai
/apt
/sources.list
<<EOF
161 deb http://security.debian.org/debian-security $base/updates main contrib
165 # new naming convention
166 cat >>/etc
/fai
/apt
/sources.list
<<EOF
167 deb http://security.debian.org/debian-security $base-security main contrib
170 ### end setup security repo ###
173 cat >>/etc
/fai
/apt
/sources.list
<<EOF
174 # use fai repo. it's commented in the defaults. it's got bug fixes.
175 # and may contain newer packages.
176 deb http://fai-project.org/download $base koeln
179 ## Get latest kernel and btrfs for dealing with btrfs issues.
180 # if [[ $base == buster ]]; then
181 # cat >>/etc/fai/apt/sources.list <<'EOF'
182 # deb http://ftp.debian.org/debian buster-backports main
184 # # note, fai doesn\'t look at /etc/fai/apt/preferences.d
185 # cat >/etc/fai/apt/preferences <<'EOF'
186 # Package: linux-* firmware-linux-free btrfs-progs
187 # Pin: release a=buster-backports
193 $sed -f - /etc
/fai
/nfsroot.conf
<<EOF
194 $ a FAI_ROOTPW='$(</q/root/shadow/standard)'
196 $ a SSH_IDENTITY=/root/.ssh/home.pub
198 s,^( *FAI_DEBOOTSTRAP=).*,\1"$base $r",
199 # add --arch amd64. this is needed on arm system which is
200 # used to install amd64 clients. On amd64 servers, it's redundant.
201 # disabled for now, since creating fai nfsroot on my arm machine
203 #/--arch amd64/!s/^(\s*FAI_DEBOOTSTRAP_OPTS=")/\1--arch amd64 /
206 $sed 's/#LOGUSER/LOGUSER/' /etc
/fai
/fai.conf
207 $sed -i '/^LOGUSER=/d' /etc
/fai
/fai.conf
208 $sed -i '/^FAI_FLAGS=/d' /etc
/fai
/fai.conf
209 echo "FAI_FLAGS=verbose" >>/etc
/fai
/fai.conf
210 # note if this isnt set, the user isnt created
211 echo "LOGUSER=fai" >>/etc
/fai
/fai.conf
213 # from man fai-make-nfsroot,
214 # figured out after partitioning ignored my crypt partition
217 cedit
/etc
/fai
/NFSROOT
<<'EOF' || [[ $? == 1 ]]
218 # inserted by faserver-setup
221 # default one is linux-image-server, doesnt exist anymore
223 # default is btrfs-tools which doesnt exist anymore
226 # got an error in error.log about not having gpg.
227 # system seemed to still install ok, so i havent tested if this fixes it.
235 # background: Can't build the nfsroot on my arm system now. First,
236 # fai-make-nfsroot won't work out of the box. One idea to make it work
237 # is by installing qemu-user-static, then copying qemu-x86_64-static
238 # into the nfsroot, and prepending it to chroot commands in
239 # fai-make-nfsroot, but that fails in odd ways. ls has permissions
240 # problems on reading directories, various programs segfault
241 # immediately, cat can't open a file, etc.
243 NFSROOT
=/srv
/fai
/nfsroot
244 TFTPROOT
=/srv
/tftp
/fai
246 # test if our copy of setup_tftp has changed in fai-make-nfsroot,
247 # and if not, run it.
254 pxebin
=$NFSROOT/usr
/lib
/syslinux
/pxelinux
.0
256 rm -f $NFSROOT/boot
/*.bak
257 mkdir
-p $TFTPROOT/pxelinux.cfg
258 if ! chmod a
+r
$NFSROOT/boot
/initrd.img-
*; then
259 echo "$0: error: No initrd was created. Check the package name of the linux-image package in /etc/fai/NFSROOT."
262 cp -p $v $NFSROOT/boot
/vmlinu?
-* $NFSROOT/boot
/initrd.img-
* $TFTPROOT
263 cp -u $pxebin $TFTPROOT
264 if [ -f $NFSROOT/usr
/lib
/syslinux
/modules
/bios
/ldlinux.c32
]; then
265 cp -u $NFSROOT/usr
/lib
/syslinux
/modules
/bios
/ldlinux.c32
$TFTPROOT
267 if [ X
$verbose = X1
]; then
268 echo "TFTP environment prepared. Enable DHCP and start the TFTP daemon on root $TFTPROOT."
271 diff -u <(type setup_tftp
) <(cat <(sed -n '/^setup_tftp(){/,/^}/p' $
(which fai-make-nfsroot
) ) - <<'EOF' |bash
277 # -g causes skipping set_root_pw() in fai-make-nfsroot, -ag
278 # is the only way to make it run without chrooting. the options
279 # seem contradictory, but it works.
283 # note, this copies the -B arg to
284 # /srv/fai/nfsroot/var/tmp/base.tar.xz
285 e fai-setup
-evf -B $basefile
286 # fai-setup expert mode avoids writing to /var/log/fai/variables
287 # at least config_src is needed for autodiscover
288 $sed '/^FAI_CONFIGDIR|^FAI_CONFIG_SRC|^LOGUSER/d' /var
/log
/fai
/variables
289 tee -a /var
/log
/fai
/variables
<<'EOF'
291 FAI_CONFIGDIR=/srv/fai/config
292 FAI_CONFIG_SRC=nfs://faiserver/srv/fai/config
294 # make the faiserver also the apt proxy server
295 apt-get
-y install apt-cacher-ng
298 rm -f /srv
/fai
/nfsroot
/root
/.ssh
/known_hosts
299 if [[ $HOSTNAME == kd
]]; then
300 keyscan_arg
="-p 8989"
302 key
=$
(ssh-keyscan
$keyscan_arg localhost |
& grep -o "ecdsa-sha2-nistp256.*")
303 for ip
in faiserver $
(ip addr show up|
grep -w '^ *inet' |
awk '{print $2}'| cut
-d / -f 1 |
grep -vF 127.0.0.1); do
304 echo "$ip $key" >>/srv
/fai
/nfsroot
/root
/.ssh
/known_hosts
307 # make it the root because pxe-kexec only looks there.
308 # It wouldn't be too hard to change if we needed.
309 # We could also just dump things in /srv/tftp, but fai
310 # has some defaults, which I don't even use, which expect
311 # the other directory, so it's kind of a tossup, whatever.
312 sed -ri 's,^ *(TFTP_DIRECTORY=).*,\1"/srv/tftp/fai",' /etc
/default
/tftpd-hpa
313 systemctl restart tftpd-hpa
318 # https://wiki.archlinux.org/index.php/working_with_the_serial_console
319 # at runtime, running this from ssh worked:
320 # https://unix.stackexchange.com/questions/242778/what-is-the-easiest-way-to-configure-serial-port-on-linux
321 # stty -F /dev/ttyS0 115200 cs8 -cstopb -parenb
322 # /sbin/agetty 115200 ttyS0 linux
323 # dated info, but validation that this might work on debian:
324 # https://help.ubuntu.com/community/SerialConsoleHowto
325 # note in the nfsroot, systemd is not running.
326 echo "c0:2345:respawn:/sbin/agetty 115200 ttyS0 linux" >>/srv
/fai
/nfsroot
/etc
/inittab
328 # initially did the basic fai-chboot -Iv $std_arg default
329 # but found in console that it wanted to mount nfsroot
330 # to be the same as my dhcp server.
331 # Figured out to change the root= parameter from googling,
332 # and seeing fai-chboot -L
333 # using hostname failed.
334 # for -f, combined the 2 defaults so it will reboot and print to screen.
336 # Add debug to -f flag for more verbose output.
339 # background on choosing apt-cacher-ng:
340 # googling around a bit finds 2 main solutions:
341 # http://askubuntu.com/questions/3503/best-way-to-cache-apt-downloads-on-a-lan
342 # apt-cacher-ng doesn\'t have zeroconf.
343 # It touts having minimal dependencies, but I don\'t care.
344 # The downside to squid-deb-proxy is that it\'s config is for specific repos,
345 # you have to add all the repos you use.
346 # That is the main reason I use apt-cacher-ng.
347 # It has a web portal, at http://faiserver:3142/acng-report.html
350 # random fai note: as far as I can tell, profiles are just for putting
351 # in a selectable boot menu, which I don\'t want.
353 # the logsave prompted because the hostname faiserver was uknown.
354 # Here it was faiserver.lan when running from a faiserver vm.
355 # When running from a normal host with faiserver alias, it was the normal hosts name.
356 $sed 's/(^[^,]+,)\S+/\1faiserver/' /srv
/fai
/nfsroot
/root
/.ssh
/known_hosts
357 # ditch the logo banner up top which screws with less.
358 touch /srv
/fai
/nfsroot
/.nocolorlogo