iankelling.org Git - automated-distro-installer/blob - faiserver-setup

   1 #!/bin/bash
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # This program is free software; you can redistribute it and/or
   5 # modify it under the terms of the GNU General Public License
   6 # as published by the Free Software Foundation; either version 2
   7 # of the License, or (at your option) any later version.
   8
   9 # This program is distributed in the hope that it will be useful,
  10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12 # GNU General Public License for more details.
  13
  14 # You should have received a copy of the GNU General Public License
  15 # along with this program; if not, write to the Free Software
  16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  17
  18 x="$(readlink -f "$BASH_SOURCE")"; source "${x%/*}/bash-trace"
  19
  20 [[ $EUID == 0 ]] || exec sudo "${BASH_SOURCE}" "$@"
  21
  22 usage() {
  23     cat <<EOF
  24 usage: ${0##*/} [-h|--help]
  25 install fai-server on the current machine
  26
  27 Initial setup of a fai server on debian. works on localhost.
  28 Set's the current ip as the tftp server. I vaguely remember
  29 that using a hostname does not work.
  30 Separate from running this, faiserver needs to be setup in dns
  31 to point to whatever host this is run on.
  32
  33 For running on arm, it expects Ian's fai-basefiles repository at
  34 /a/bin/fai-basefiles
  35
  36 EOF
  37     exit $1
  38 }
  39 case $1 in
  40     -h|--help) usage ;;
  41 esac
  42
  43
  44 e() { echo "$@"; "$@"; }
  45
  46 # When stretch becomes stable, change this to stretch.
  47 # I\'ve tested this with stretch, it works, but notably,
  48 # the automatic basefile getting will be for stretch
  49 # instead of jessie, so if you install jessie, you need
  50 # to setup the basefile and it\'s corresponding class.
  51 base=stretch
  52 sed="sed -ri --follow-symlinks"
  53
  54 if ! type -p wget &>/dev/null; then
  55   apt-get install -y wget
  56 fi
  57
  58 armhf() {
  59     [[ $(dpkg --print-architecture) == armhf ]]
  60 }
  61
  62 if armhf; then
  63   if apt-cache policy | grep o=Debian,a=testing,n=stretch &>/dev/null; then
  64     cat >/etc/apt/sources.list.d/testing.list <<'EOF'
  65 deb http://http.us.debian.org/debian testing main contrib non-free
  66 deb-src http://http.us.debian.org/debian testing main contrib non-free
  67
  68 deb http://security.debian.org/ testing/updates main contrib non-free
  69 deb-src http://security.debian.org/ testing/updates main contrib non-free
  70
  71 deb http://http.us.debian.org/debian testing-updates main contrib non-free
  72 deb-src http://http.us.debian.org/debian testing-updates main contrib non-free
  73 EOF
  74
  75     cat >/etc/apt/preferences.d/fai <<'EOF'
  76 Package: fai-server fai-client fai-doc
  77 Pin: release a=testing
  78 Pin-Priority: 500
  79
  80 Package: *
  81 Pin: release a=testing
  82 Pin-Priority: -10
  83 EOF
  84   fi
  85 elif grep -xFq 'VERSION="8 (jessie)"' /etc/os-release; then
  86   gpg -a --recv-keys 2BF8D9FE074BCDE4; gpg -a --export 2BF8D9FE074BCDE4 | apt-key add -
  87   cat >/etc/apt/sources.list.d/fai.list <<'EOF'
  88 deb http://fai-project.org/download jessie koeln
  89 EOF
  90 elif grep -xFq 'VERSION="9 (stretch)"' /etc/os-release; then
  91   gpg -a --recv-keys 2BF8D9FE074BCDE4; gpg -a --export 2BF8D9FE074BCDE4 | apt-key add -
  92
  93   cat >/etc/apt/sources.list.d/fai.list <<'EOF'
  94 deb http://fai-project.org/download stretch koeln
  95 EOF
  96 else
  97     rm -f /etc/apt/sources.list.d/fai.list
  98 fi
  99
 100 # for ubuntu:
 101 #add-apt-repository -y ppa:fai/ppa
 102
 103 # for debian:
 104
 105
 106 apt-get update
 107
 108 # Relevant packages from fai-quickstart depends and fai-server recommends.
 109 # I especially do not wait isc-dhcp-server or an inetd. Also excludes
 110 # nfs-kernel-server. On an android chroot, we don\'t have nfs in the
 111 # kernel, or the ability to install it.
 112 pkgs=(fai-doc tftpd-hpa tar reprepro squashfs-tools binutils)
 113 if modprobe nfsd &>/dev/null; then
 114   pkgs+=(nfs-kernel-server)
 115 else
 116     pkgs+=(apache2)
 117 fi
 118
 119
 120 apt-get install -y ${pkgs[@]}
 121 apt-get install --no-install-recommends -y fai-server
 122
 123 r=http://http.us.debian.org/debian
 124 # like default, but scrap httpredir, and nonfree.
 125 # All my systems should be able to get along without nonfree
 126 # for a base working system afaik.
 127 cat >/etc/fai/apt/sources.list <<EOF
 128 deb $r $base main contrib
 129 deb http://security.debian.org/debian-security $base/updates main contrib
 130 EOF
 131
 132
 133 case $base in
 134     jessie|stretch)
 135         cat >>/etc/fai/apt/sources.list <<EOF
 136 # use fai repo. it's commented in the defaults. it's got bug fixes.
 137 # and may contain newer packages.
 138 deb http://fai-project.org/download $base koeln
 139 EOF
 140         ;;
 141 esac
 142
 143 if [[ $base == jessie ]]; then
 144   cat >>/etc/fai/apt/sources.list <<'EOF'
 145 # fix tar https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=819978
 146 deb http://ftp.debian.org/debian jessie-backports main
 147 EOF
 148   # note, fai doesn\'t look at /etc/fai/apt/preferences.d
 149   cat >/etc/fai/apt/preferences <<'EOF'
 150 Package: tar
 151 Pin: release a=jessie-backports
 152 Pin-Priority: 500
 153 EOF
 154 fi
 155
 156
 157 # tried out a stretch base, doesn't work yet.
 158 #
 159 $sed -f - /etc/fai/nfsroot.conf <<EOF
 160 $ a FAI_ROOTPW="$(</q/root/shadow/standard)"
 161 /^\s*FAI_ROOTPW/d
 162 s,^( *FAI_DEBOOTSTRAP=).*,\1"$base $r",
 163 # add --arch amd64. this is needed on arm system which is
 164 # used to install amd64 clients. On amd64 servers, it's redundant.
 165 # disabled for now, since creating fai nfsroot on my arm machine
 166 # is not working
 167 #/--arch amd64/!s/^(\s*FAI_DEBOOTSTRAP_OPTS=")/\1--arch amd64 /
 168 EOF
 169
 170 $sed 's/#LOGUSER/LOGUSER/' /etc/fai/fai.conf
 171 # from man fai-make-nfsroot,
 172 # figured out after partitioning ignored my crypt partition
 173
 174
 175 if ! grep cryptsetup /etc/fai/NFSROOT &>/dev/null; then
 176   $sed '/^PACKAGES install$/a cryptsetup' /etc/fai/NFSROOT
 177 fi
 178
 179 if armhf; then
 180   cd /srv/fai
 181   rm -rf nfsroot
 182   tar Jxf /a/bin/fai-basefiles/base.tar.xz
 183   # background: Can't build the nfsroot on my arm system now.  First,
 184   # fai-make-nfsroot won't work out of the box. One idea to make it work
 185   # is by installing qemu-user-static, then copying qemu-x86_64-static
 186   # into the nfsroot, and prepending it to chroot commands in
 187   # fai-make-nfsroot, but that fails in odd ways. ls has permissions
 188   # problems on reading directories, various programs segfault
 189   # immediately, cat can't open a file, etc.
 190
 191   NFSROOT=/srv/fai/nfsroot
 192   TFTPROOT=/srv/tftp/fai
 193
 194   # test if our copy of setup_tftp has changed in fai-make-nfsroot,
 195   # and if not, run it.
 196   setup_tftp(){
 197
 198       # tftp environment
 199       local pxebin
 200
 201       # wheezy path
 202       if [ -f $NFSROOT/usr/lib/PXELINUX/pxelinux.0 ]; then
 203         pxebin=$NFSROOT/usr/lib/PXELINUX/pxelinux.0
 204       else
 205           # jessie/stretch path
 206           pxebin=$NFSROOT/usr/lib/syslinux/pxelinux.0
 207       fi
 208
 209       rm -f $NFSROOT/boot/*.bak
 210       mkdir -p $TFTPROOT/pxelinux.cfg
 211       chmod a+r $NFSROOT/boot/initrd.img-* || die 9 "No initrd was created. Check the package name of the linux-image package in /etc/fai/NFSROOT."
 212       cp -p $v $NFSROOT/boot/vmlinu?-* $NFSROOT/boot/initrd.img-* $TFTPROOT
 213       cp -u $pxebin $TFTPROOT
 214       if [ -f $NFSROOT/usr/lib/syslinux/modules/bios/ldlinux.c32 ]; then
 215         cp -u $NFSROOT/usr/lib/syslinux/modules/bios/ldlinux.c32 $TFTPROOT
 216       fi
 217       if [ X$verbose = X1 ]; then
 218         echo "TFTP environment prepared. Enable DHCP and start the TFTP daemon on root $TFTPROOT."
 219       fi
 220   }
 221   diff -u <(type setup_tftp) <(cat <(sed -n '/^setup_tftp(){/,/^}/p' $(which fai-make-nfsroot) ) - <<'EOF' |bash
 222 type setup_tftp
 223 EOF
 224                               )
 225   setup_tftp
 226
 227   # -g causes skipping set_root_pw() in fai-make-nfsroot, -ag
 228   # is the only way to make it run without chrooting. the options
 229   # seem contradictory, but it works.
 230   fai-setup -evag
 231
 232 else
 233     e fai-setup -e -vf
 234     # make the faiserver also the apt proxy server
 235     apt-get -y install apt-cacher-ng
 236 fi
 237
 238 { head -n 1 /srv/fai/nfsroot/root/.ssh/known_hosts | awk '{print $1}' \
 239     | tr '\n' ' '; ssh-keyscan localhost |& grep -o "ecdsa-sha2-nistp256.*"; \
 240   } >>/srv/fai/nfsroot/root/.ssh/known_hosts
 241
 242 # initially did the basic fai-chboot -Iv $std_arg default
 243 # but found in console that it wanted to mount nfsroot
 244 # to be the same as my dhcp server.
 245 # Figured out to change the root= parameter from googling,
 246 # and seeing fai-chboot -L
 247 # using hostname failed.
 248 # for -f, combined the 2 defaults so it will reboot and print to screen.
 249
 250 # Add debug to -f flag for more verbose output.
 251
 252
 253 # background on choosing apt-cacher-ng:
 254 # googling around a bit finds 2 main solutions:
 255 # http://askubuntu.com/questions/3503/best-way-to-cache-apt-downloads-on-a-lan
 256 # apt-cacher-ng doesn\'t have zeroconf.
 257 # It touts having minimal dependencies, but I don\'t care.
 258 # The downside to squid-deb-proxy is that it\'s config is for specific repos,
 259 # you have to add all the repos you use.
 260 # That is the main reason I use apt-cacher-ng.
 261 # It has a web portal, at http://faiserver:3142/acng-report.html
 262
 263
 264 # random fai note: as far as I can tell, profiles are just for putting
 265 # in a selectable boot menu, which I don\'t want.
 266
 267 # the logsave prompted because the hostname faiserver was uknown.
 268 # Here it was faiserver.lan when running from a faiserver vm.
 269 # When running from a normal host with faiserver alias, it was the normal hosts name.
 270 $sed 's/(^[^,]+,)\S+/\1faiserver/' /srv/fai/nfsroot/root/.ssh/known_hosts
 271 # ditch the logo banner up top which screws with less.
 272 touch /srv/fai/nfsroot/.nocolorlogo