add arg to just gen files, refactor, cleanup

diff --git a/README b/README
index aeb39571f561569a37deecf6544df13f79e56395..3f01a9726948b5dac69ce49a161f828ab20f1925 100644 (file)
--- a/README
+++ b/README
@@ -286,6 +286,13 @@ umount dev
 umount sys
 reboot
 
 umount sys
 reboot
 

+# for switching the boot to root2
+zboot
+# for switching back, efibootmgr, if there is a problem with the root filesystem detection,
+# boot into the debian bootstrap distro, run partition.DEFAULT using comments for mktab arg.
+# then manually run iboot and then reboot.
+
+

 # pine rock64 notes
 # the only useful image is ubuntu 18.04 ayafun or something.
 # using emmc usb:
 # pine rock64 notes
 # the only useful image is ubuntu 18.04 ayafun or something.
 # using emmc usb:


@@ -300,6 +307,9 @@ s apt-get update
 s apt dist-upgrade
 
 
 s apt dist-upgrade
 
 

+
+
+

 # TODO
 Change arch to archlike and to support arch and parabola
 
 # TODO
 Change arch to archlike and to support arch and parabola
 

diff --git a/fai/config/hooks/partition.DEFAULT b/fai/config/hooks/partition.DEFAULT
index f3df8652b9532ab4f38f97ed70ad30ecd6c01e0d..fc6da117fcd01cc2aafb91784c11a8fb7175961c 100755 (executable)
--- a/fai/config/hooks/partition.DEFAULT
+++ b/fai/config/hooks/partition.DEFAULT
@@ -24,7 +24,7 @@ if [[ $EUID != 0 ]]; then
   exit 1
 fi
 
   exit 1
 fi
 

-# for calling outside of FAI:
+# for calling outside of FAI without args:

 # fai-redep
 #
 # source /b/fai/fai-wrapper
 # fai-redep
 #
 # source /b/fai/fai-wrapper


@@ -33,13 +33,29 @@ fi
 # - Set a VOL_DISTROVER (if not doing mkroot2) eg:
 #   fai-setclass VOL_NABIA
 #
 # - Set a VOL_DISTROVER (if not doing mkroot2) eg:
 #   fai-setclass VOL_NABIA
 #

-# OPTIONS:
+# ARGS (only 1 is valid):

 #
 # mkroot2: for running outside of fai and setting up the root2/boot2 luks and btrfs and tab files
 #
 # mkroot2tab: for running outside of fai and setting up the root2/boot2 tab files, in case luks and btrfs
 # happen to already be setup.
 #
 #
 # mkroot2: for running outside of fai and setting up the root2/boot2 luks and btrfs and tab files
 #
 # mkroot2tab: for running outside of fai and setting up the root2/boot2 tab files, in case luks and btrfs
 # happen to already be setup.
 #

+# mktab: for running outside of fai and generating a crypttab for
+# the main root fs in /tmp/fai. Must run with env var, eg export DISTRO=trisquelnabia.
+#
+# Example use in a bootstrap distro:
+# scp /a/bin/fai/fai/config/{distro-install-common/devbyid,hooks/partition.DEFAULT} root@HOST:
+# sl HOST
+# export DISTRO=trisquelnabia; ./partition.DEFAULT mktab
+# ## cryptsetup wont take within a pipeline
+# mapfile -t lines < <(awk '! /swap/ {print $2,$1}' /tmp/fai/crypttab )
+# for l in "${lines[@]}"; do cryptsetup luksOpen $l; done
+#
+# # or alternatively, to avoid typing it many times:
+# read -r lukspw; for l in "${lines[@]}"; do yes "$lukspw" | cryptsetup luksOpen $l; done
+
+## potentially useful later:
+# sed 's#/root/keyscript,#decrypt_keyctl,#;s/$/,noauto/' /tmp/fai/crypttab >/etc/crypttab

 #
 # environment variables:
 #
 #
 # environment variables:
 #


@@ -70,7 +86,16 @@ fi
 
 mkroot2tab=false
 mkroot2=false
 
 mkroot2tab=false
 mkroot2=false

+mktab=false

 if [[ $1 ]]; then
 if [[ $1 ]]; then

+  ## duplicates fai-wrapper, for convenience of not needing it
+  if ! type -t ifclass &>/dev/null; then
+    ifclass() {
+      local var=${1/#/CLASS_}
+      [[ $HOSTNAME == $1 || ${!var} ]]
+    }
+  fi
+

   case $1 in
     mkroot2)
       mkroot2=true
   case $1 in
     mkroot2)
       mkroot2=true


@@ -78,6 +103,9 @@ if [[ $1 ]]; then
     mkroot2tab)
       mkroot2tab=true
       ;;
     mkroot2tab)
       mkroot2tab=true
       ;;

+    mktab)
+      mktab=true
+      ;;

     *)
       echo "$0: error: unsupported arg: $1" >&2
       exit 1
     *)
       echo "$0: error: unsupported arg: $1" >&2
       exit 1


@@ -147,6 +175,7 @@ lastn=$bios_grubn
 
 ##### end configuration
 
 
 ##### end configuration
 

+##### begin function defs

 
 add-part() { # add partition suffix to $dev
   local d part
 
 add-part() { # add partition suffix to $dev
   local d part


@@ -162,22 +191,31 @@ add-part() { # add partition suffix to $dev
 
 rootdev() { add-part $@ $rootn; }
 root2dev() { add-part $@ $root2n; }
 
 rootdev() { add-part $@ $rootn; }
 root2dev() { add-part $@ $root2n; }

-swapdev() { add-part $@ $swapn; }
-bootdev() { add-part $@ $bootn; }
-boot2dev() { add-part $@ $boot2n; }
-efidev() { add-part $@ $efin; }
-grub_extdev() { add-part $@ $grub_extn; }
-bios_grubdev() { add-part $@ $bios_grubn; }
-even_bigdev() { add-part $@ $even_bign; }
+
+# note, the following block could all have $@ like below
+# But it is not added since it is not used and shellcheck
+# rightly says args never used should not exist.
+##swapdev() { add-part $swapn; }
+
+swapdev() { add-part $swapn; }
+bootdev() { add-part $bootn; }
+boot2dev() { add-part $boot2n; }
+efidev() { add-part $efin; }
+grub_extdev() { add-part $grub_extn; }
+bios_grubdev() { add-part $bios_grubn; }
+even_bigdev() { add-part $even_bign; }

 
 crypt-dev() { echo /dev/mapper/crypt_dev_${1##*/}; }
 crypt-name() { echo crypt_dev_${1##*/}; }
 root-cryptdev() { crypt-dev $(rootdev $@); }
 root2-cryptdev() { crypt-dev $(root2dev $@); }
 
 crypt-dev() { echo /dev/mapper/crypt_dev_${1##*/}; }
 crypt-name() { echo crypt_dev_${1##*/}; }
 root-cryptdev() { crypt-dev $(rootdev $@); }
 root2-cryptdev() { crypt-dev $(root2dev $@); }

-swap-cryptdev() { crypt-dev $(swapdev $@); }
-root-cryptname() { crypt-name $(rootdev $@); }
-root2-cryptname() { crypt-name $(root2dev $@); }
-swap-cryptname() { crypt-name $(swapdev $@); }
+
+# I omit a possible parameter since it is unused:
+##swap-cryptdev() { crypt-dev $(swapdev $@); }
+swap-cryptdev() { crypt-dev $(swapdev); }
+root-cryptname() { crypt-name $(rootdev); }
+root2-cryptname() { crypt-name $(root2dev); }
+swap-cryptname() { crypt-name $(swapdev); }

 
 dev-mib() {
   local d=${1:-$dev}
 
 dev-mib() {
   local d=${1:-$dev}


@@ -212,6 +250,8 @@ luks-setup() {
 
 ##### end function defs
 
 
 ##### end function defs
 

+
+##### begin variable setup

 if ifclass REPARTITION; then
   partition=true # force a full wipe
 else
 if ifclass REPARTITION; then
   partition=true # force a full wipe
 else


@@ -228,11 +268,12 @@ if (($(nproc) > 2)); then
 fi
 
 declare -A disk_excludes
 fi
 
 declare -A disk_excludes

-if ! $mkroot2 && ! $mkroot2tab ! ifclass USE_MOUNTED; then
+if ! $mkroot2 && ! $mkroot2tab && ! $mktab ! ifclass USE_MOUNTED; then

   ## ignore disks that are mounted, eg when running from fai-cd
   while read -r l; do
     eval "$l"
     if [[ ! $PKNAME ]]; then
   ## ignore disks that are mounted, eg when running from fai-cd
   while read -r l; do
     eval "$l"
     if [[ ! $PKNAME ]]; then

+      # shellcheck disable=SC2153 # not a misspelling

       PKNAME="$KNAME"
     fi
     if [[ $MOUNTPOINT ]]; then
       PKNAME="$KNAME"
     fi
     if [[ $MOUNTPOINT ]]; then


@@ -249,8 +290,8 @@ for disk in $(lsblk -do name,tran -n | awk '$2 ~ "^(sata|nvme)$" { print $1 }');
     continue
   fi
   case $(cat /sys/block/$disk/queue/rotational) in
     continue
   fi
   case $(cat /sys/block/$disk/queue/rotational) in

-    0) ssds+=(/dev/$disk) ;;
-    1) hdds+=(/dev/$disk) ;;
+    0) ssds+=("/dev/$disk") ;;
+    1) hdds+=("/dev/$disk") ;;

     *) echo "$0: error: unknown /sys/block/$disk/queue/rotational: \
 $(cat $disk/queue/rotational)"; exit 1 ;;
   esac
     *) echo "$0: error: unknown /sys/block/$disk/queue/rotational: \
 $(cat $disk/queue/rotational)"; exit 1 ;;
   esac


@@ -261,9 +302,9 @@ done
 # very odd, but convenient for ignoring them here.
 # TODO: find a reliable way to ignore them.
 if ! ifclass ROTATIONAL && (( ${#ssds[@]} > 0 )); then
 # very odd, but convenient for ignoring them here.
 # TODO: find a reliable way to ignore them.
 if ! ifclass ROTATIONAL && (( ${#ssds[@]} > 0 )); then

-  short_devs=( ${ssds[@]} )
+  read -ra short_devs<<<"${ssds[@]}"

 else
 else

-  short_devs=( ${hdds[@]} )
+  read -ra short_devs<<<"${hdds[@]}"

 fi
 
 # check if the partitions exist have the right filesystems
 fi
 
 # check if the partitions exist have the right filesystems


@@ -271,6 +312,7 @@ fi
 for dev in ${short_devs[@]}; do
   if $partition; then break; fi
   y=$(readlink -f $dev)
 for dev in ${short_devs[@]}; do
   if $partition; then break; fi
   y=$(readlink -f $dev)

+  # shellcheck disable=SC2206 # globbing is intended

   arr=($y?*)
   if (( ${#arr[@]} < lastn )); then
     partition=true
   arr=($y?*)
   if (( ${#arr[@]} < lastn )); then
     partition=true


@@ -292,7 +334,7 @@ fi
 devs=()
 shopt -s extglob
 for short_dev in ${short_devs[@]}; do
 devs=()
 shopt -s extglob
 for short_dev in ${short_devs[@]}; do

-  devs+=($(devbyid $short_dev))
+  devs+=("$(devbyid $short_dev)")

 done
 if [[ ! ${devs[0]} ]]; then
   echo "$0: error: failed to detect devs" >&2
 done
 if [[ ! ${devs[0]} ]]; then
   echo "$0: error: failed to detect devs" >&2


@@ -329,16 +371,16 @@ for dev in ${devs[@]}; do
       fi
     done
     if ! $bad_disk; then
       fi
     done
     if ! $bad_disk; then

-      boot_devs+=($(bootdev))
-      boot2_devs+=($(boot2dev))
+      boot_devs+=("$(bootdev)")
+      boot2_devs+=("$(boot2dev)")

     fi
   else
     boot_space=$(( boot_space + $(parted -m $dev unit MiB print | \
                                     sed -nr "s#^/dev/[^:]+:([0-9]+).*#\1#p") - 1))
     fi
   else
     boot_space=$(( boot_space + $(parted -m $dev unit MiB print | \
                                     sed -nr "s#^/dev/[^:]+:([0-9]+).*#\1#p") - 1))

-    boot_devs+=($(bootdev))
-    boot2_devs+=($(boot2dev))
+    boot_devs+=("$(bootdev)")
+    boot2_devs+=("$(boot2dev)")

   fi
   fi

-  if $first && [[ $boot_devs ]]; then
+  if $first && (( ${boot_devs[@]} >= 1 )) ; then

     first_efi=$(efidev)
     first_grub_extdev=$(grub_extdev)
     first=false
     first_efi=$(efidev)
     first_grub_extdev=$(grub_extdev)
     first=false


@@ -358,6 +400,8 @@ else
   raid_level=10
 fi
 
   raid_level=10
 fi
 

+
+

 ### Begin calculate boot partition space
 # due to raid duplication
 case $raid_level in
 ### Begin calculate boot partition space
 # due to raid duplication
 case $raid_level in


@@ -392,6 +436,13 @@ case $raid_level in
 esac
 ### end calculate boot partition space
 
 esac
 ### end calculate boot partition space
 

+bpart() { # btrfs a partition
+  case $raid_level in
+    0) mkfs.btrfs -f $@ ;;
+    1) mkfs.btrfs -f -m raid1 -d raid1 $@ ;;
+    10) mkfs.btrfs -f -m raid10 -d raid10 $@ ;;
+  esac
+}

 
 
 if [[ ! $DISTRO ]]; then
 
 
 if [[ ! $DISTRO ]]; then


@@ -427,48 +478,12 @@ if [[ ! $DISTRO ]]; then
   fi
 fi
 
   fi
 fi
 

-
-bpart() { # btrfs a partition
-  case $raid_level in
-    0) mkfs.btrfs -f $@ ;;
-    1) mkfs.btrfs -f -m raid1 -d raid1 $@ ;;
-    10) mkfs.btrfs -f -m raid10 -d raid10 $@ ;;
-  esac
-}
-
-
-if [[ ! $luks_dir ]]; then
-  # see README for docs about how to create these
-  luks_dir=$FAI/distro-install-common/luks
-  if [[ ! -d $luks_dir ]]; then
-    luks_dir=/q/root/luks
-  fi
-  if [[ ! -d $luks_dir ]]; then
-    echo "$0: error: no luks_dir found" >&2
-    exit 1
-  fi
-fi
-
-luks_file=$luks_dir/host-$HOSTNAME
-if [[ ! -e $luks_file ]]; then
-  hostkeys=($luks_dir/host-*)
-  # if there is only one key, we might be deploying somewhere
-  # where dhcp doesnt give us a proper hostname, so use that.
-  if [[ ${#hostkeys[@]} == 1 && -e ${hostkeys[0]} ]]; then
-    luks_file=${hostkeys[0]}
-  else
-    echo "$0: error: no key for hostname at $luks_file" >&2
-    exit 1
-  fi
-fi
-
-# # note, corresponding changes in /b/ds/keyscript-{on,off}
-if ifclass demohost; then
-  lukspw=x
-elif [[ -e $luks_dir/$HOSTNAME ]]; then
-  lukspw=$(cat $luks_dir/$HOSTNAME)
+if [[ $DISTRO == debianbullseye_bootstrap ]]; then
+  # this is just convenience for the libreboot_grub config
+  # so we can glob the other ones easier.
+  boot_vol=$DISTRO

 else
 else

-  lukspw=$(cat $luks_dir/iank)
+  boot_vol=boot_$DISTRO

 fi
 
 
 fi
 
 


@@ -478,26 +493,141 @@ first_root_crypt=$(root-cryptdev ${devs[0]})
 swap_mib=$(( $(grep ^MemTotal: /proc/meminfo | \
                  awk '{print $2}') * 3/(${#devs[@]} * 2 ) / 1024 ))
 
 swap_mib=$(( $(grep ^MemTotal: /proc/meminfo | \
                  awk '{print $2}') * 3/(${#devs[@]} * 2 ) / 1024 ))
 

-mkdir -p /tmp/fai

 root_devs=()
 for dev in ${devs[@]}; do
 root_devs=()
 for dev in ${devs[@]}; do

-  root_devs+=($(rootdev))
+  root_devs+=("$(rootdev)")

 done
 shopt -s nullglob
 done
 shopt -s nullglob

+##### end variable setup

 
 

-# We write to these files instead of just /etc/fstab, /etc/crypttab,
-# because these are filesystems created after our current root, and so
-# this allows us to update other root filesystems too.
-rm -f /mnt/root/root2-{fs,crypt}tab
-if $mkroot2 || $mkroot2tab; then
+
+
+mktab() {
+  mkdir -p /tmp/fai
+  dev=${boot_devs[0]}
+  fstabstd="x-systemd.device-timeout=30s,x-systemd.mount-timeout=30s"
+
+  if [[ $DISTRO == debianbullseye_bootstrap ]]; then
+    cat > /tmp/fai/fstab <<EOF
+$first_boot_dev  /  btrfs  noatime,subvol=$boot_vol  0 0
+$first_efi  /boot/efi  vfat          nofail,$fstabstd  0 0
+EOF
+    cat >/tmp/fai/disk_var.sh <<EOF
+BOOT_DEVICE="${short_devs[@]}"
+ROOT_PARTITION=$first_boot_dev
+EOF
+  else
+    # note, fai creates the mountpoints listed here
+    cat > /tmp/fai/fstab <<EOF
+$first_root_crypt  /  btrfs                 $fstabstd,noatime,subvol=root_$DISTRO$mopts  0 0
+$first_root_crypt  /mnt/root  btrfs  nofail,$fstabstd,noatime,subvolid=0$mopts  0 0
+$first_boot_dev  /boot  btrfs        nofail,$fstabstd,noatime,subvol=$boot_vol  0 0
+$first_efi  /boot/efi  vfat          nofail,$fstabstd  0 0
+$first_boot_dev  /mnt/boot  btrfs    nofail,$fstabstd,noatime,subvolid=0  0 0
+EOF
+    swaps=()
+    rm -f /tmp/fai/crypttab
+    for dev in ${devs[@]}; do
+      swaps+=("$(swap-cryptname)")
+      cat >>/tmp/fai/crypttab <<EOF
+$(root-cryptname) $(rootdev)  none  keyscript=/root/keyscript,discard,luks,initramfs
+$(swap-cryptname) $(swapdev)  /dev/urandom  swap,cipher=aes-xts-plain64,size=256,hash=ripemd160
+EOF
+      cat >> /tmp/fai/fstab <<EOF
+$(swap-cryptdev)  none  swap  nofail,$fstabstd,sw  0 0
+EOF
+    done
+
+    # fai would do this:
+    #BOOT_DEVICE=\${BOOT_DEVICE:-"${devs[0]}"}
+
+    # note: swaplist seems to do nothing.
+    cat >/tmp/fai/disk_var.sh <<EOF
+BOOT_DEVICE="${short_devs[@]}"
+BOOT_PARTITION=\${BOOT_PARTITION:-$first_boot_dev}
+# ROOT_PARTITIONS is added by me, used in arch setup.
+ROOT_PARTITIONS="${root_devs[@]}"
+ROOT_PARTITION=\${ROOT_PARTITION:-$first_root_crypt}
+SWAPLIST=\${SWAPLIST:-"${swaps[@]}"}
+EOF
+
+    if [[ $HOSTNAME == kd ]]; then
+      # note, having these with keyscript and initramfs causes a luks error in fai.log,
+      # but it is safely ignorable and gets us the ability to just type our password
+      # in once at boot. A downside is that they are probably needed to be plugged in to boot.
+      cat >>/tmp/fai/crypttab <<EOF
+crypt_dev_ata-Samsung_SSD_870_QVO_8TB_S5VUNG0N900656V-part${even_bign} /dev/disk/by-id/ata-Samsung_SSD_870_QVO_8TB_S5VUNG0N900656V-part7  none  keyscript=decrypt_keyctl,discard,luks,initramfs
+crypt_dev_ata-TOSHIBA_MD04ACA500_84R2K773FS9A-part1 /dev/disk/by-id/ata-TOSHIBA_MD04ACA500_84R2K773FS9A-part1  none  keyscript=decrypt_keyctl,discard,luks,initramfs
+crypt_dev_ata-ST6000DM001-1XY17Z_Z4D29EBL-part1 /dev/disk/by-id/ata-ST6000DM001-1XY17Z_Z4D29EBL-part1  none  keyscript=decrypt_keyctl,discard,luks,initramfs
+EOF
+      cat >> /tmp/fai/fstab <<EOF
+# r7 = root partition7. it isnt actually #7 anymore, not a great name, but whatever
+/dev/mapper/crypt_dev_ata-Samsung_SSD_870_QVO_8TB_S5VUNG0N900656V-part${even_bign}  /mnt/r7  btrfs  nofail,$fstabstd,noatime,compress=zstd,subvolid=0  0 0
+/dev/mapper/crypt_dev_ata-TOSHIBA_MD04ACA500_84R2K773FS9A-part1  /mnt/rust1  btrfs  nofail,$fstabstd,noatime,compress=zstd,subvolid=0  0 0
+/dev/mapper/crypt_dev_ata-ST6000DM001-1XY17Z_Z4D29EBL-part1  /mnt/rust2  btrfs  nofail,$fstabstd,noatime,compress=zstd,subvolid=0  0 0
+EOF
+    fi
+  fi
+}
+
+
+
+getluks() {
+  if [[ ! $luks_dir ]]; then
+    # see README for docs about how to create these
+    luks_dir=$FAI/distro-install-common/luks
+    if [[ ! -d $luks_dir ]]; then
+      luks_dir=/q/root/luks
+    fi
+    if [[ ! -d $luks_dir ]]; then
+      echo "$0: error: no luks_dir found" >&2
+      exit 1
+    fi
+  fi
+
+  luks_file=$luks_dir/host-$HOSTNAME
+  if [[ ! -e $luks_file ]]; then
+    # shellcheck disable=SC2206 # globbing is intended
+    hostkeys=($luks_dir/host-*)
+    # if there is only one key, we might be deploying somewhere
+    # where dhcp doesnt give us a proper hostname, so use that.
+    if [[ ${#hostkeys[@]} == 1 && -e ${hostkeys[0]} ]]; then
+      luks_file=${hostkeys[0]}
+    else
+      echo "$0: error: no key for hostname at $luks_file" >&2
+      exit 1
+    fi
+  fi
+
+  # # note, corresponding changes in /b/ds/keyscript-{on,off}
+  if ifclass demohost; then
+    lukspw=x
+  elif [[ -e $luks_dir/$HOSTNAME ]]; then
+    lukspw=$(cat $luks_dir/$HOSTNAME)
+  else
+    lukspw=$(cat $luks_dir/iank)
+  fi
+
+  if $mkroot2; then
+    luks_file=$luks_dir/host-amy
+    lukspw=$(cat $luks_dir/amy)
+  fi
+}
+
+
+#### root2 non-fai run
+doroot2() {
+
+  # We write to these files instead of just /etc/fstab, /etc/crypttab,
+  # because these are filesystems created after our current root, and so
+  # this allows us to update other root filesystems too.
+  rm -f /mnt/root/root2-{fs,crypt}tab

   if $partition; then
     echo $0: error: found partition=true but have mkroot2 arg
     exit 1
   fi
   for dev in ${devs[@]}; do
     if $mkroot2; then
   if $partition; then
     echo $0: error: found partition=true but have mkroot2 arg
     exit 1
   fi
   for dev in ${devs[@]}; do
     if $mkroot2; then

-      luks_file=$luks_dir/host-amy
-      lukspw=$(cat $luks_dir/amy)

       luks-setup $(root2dev)
     fi
     cat >>/mnt/root/root2-crypttab <<EOF
       luks-setup $(root2dev)
     fi
     cat >>/mnt/root/root2-crypttab <<EOF


@@ -514,6 +644,17 @@ $(root2-cryptdev ${devs[0]}) /mnt/root2  btrfs  nofail,x-systemd.device-timeout=
 ${boot2_devs[0]} /mnt/boot2  btrfs    nofail,x-systemd.device-timeout=30s,x-systemd.mount-timeout=30s,noatime,subvolid=0  0 0
 EOF
   exit 0
 ${boot2_devs[0]} /mnt/boot2  btrfs    nofail,x-systemd.device-timeout=30s,x-systemd.mount-timeout=30s,noatime,subvolid=0  0 0
 EOF
   exit 0

+}
+
+if $mkroot2 || $mkroot2tab; then
+  getluks
+  doroot2
+elif $mktab; then
+  mktab
+  exit 0
+else
+  mktab
+  getluks

 fi
 
 
 fi
 
 


@@ -690,8 +831,8 @@ if $wipe && [[ $DISTRO != debianbullseye_bootstrap ]]; then
   # bootstrap distro doesn't use separate encrypted root.
   mount -o subvolid=0 $first_root_crypt /mnt
   # systemd creates subvolumes we want to delete.
   # bootstrap distro doesn't use separate encrypted root.
   mount -o subvolid=0 $first_root_crypt /mnt
   # systemd creates subvolumes we want to delete.

-  s=($(btrfs subvolume list --sort=-path /mnt |
-         sed -rn "s#^.*path\s*(root_$DISTRO/\S+)\s*\$#\1#p"))
+  mapfile -t s < <(btrfs subvolume list --sort=-path /mnt |
+                     sed -rn "s#^.*path\s*(root_$DISTRO/\S+)\s*\$#\1#p")

   for subvol in ${s[@]}; do btrfs subvolume delete /mnt/$subvol; done
   btrfs subvolume set-default 0 /mnt
   [[ ! -e /mnt/root_$DISTRO ]] || btrfs subvolume delete /mnt/root_$DISTRO
   for subvol in ${s[@]}; do btrfs subvolume delete /mnt/$subvol; done
   btrfs subvolume set-default 0 /mnt
   [[ ! -e /mnt/root_$DISTRO ]] || btrfs subvolume delete /mnt/root_$DISTRO


@@ -726,13 +867,6 @@ btrfs subvolume set-default 0 /mnt # already default, just ensuring it.
 mkdir -p /mnt/grub2
 cp $FAI/distro-install-common/libreboot_grub.cfg /mnt/grub2
 
 mkdir -p /mnt/grub2
 cp $FAI/distro-install-common/libreboot_grub.cfg /mnt/grub2
 

-if [[ $DISTRO == debianbullseye_bootstrap ]]; then
-  # this is just convenience for the libreboot_grub config
-  # so we can glob the other ones easier.
-  boot_vol=$DISTRO
-else
-  boot_vol=boot_$DISTRO
-fi

 if $wipe && [[ -e /mnt/$boot_vol ]]; then
   btrfs subvolume delete /mnt/$boot_vol
 fi
 if $wipe && [[ -e /mnt/$boot_vol ]]; then
   btrfs subvolume delete /mnt/$boot_vol
 fi


@@ -743,75 +877,11 @@ cd /
 umount /mnt
 ## end create subvols ##
 
 umount /mnt
 ## end create subvols ##
 

-dev=${boot_devs[0]}

 mount $first_grub_extdev /mnt
 grub-editenv /mnt/grubenv set did_fai_check=true
 grub-editenv /mnt/grubenv set last_boot=/$boot_vol
 umount /mnt
 
 mount $first_grub_extdev /mnt
 grub-editenv /mnt/grubenv set did_fai_check=true
 grub-editenv /mnt/grubenv set last_boot=/$boot_vol
 umount /mnt
 

-fstabstd=x-systemd.device-timeout=30s,x-systemd.mount-timeout=30s
-if [[ $DISTRO == debianbullseye_bootstrap ]]; then
-  cat > /tmp/fai/fstab <<EOF
-$first_boot_dev  /  btrfs  noatime,subvol=$boot_vol  0 0
-$first_efi  /boot/efi  vfat          nofail,$fstabstd  0 0
-EOF
-  cat >/tmp/fai/disk_var.sh <<EOF
-BOOT_DEVICE="${short_devs[@]}"
-ROOT_PARTITION=$first_boot_dev
-EOF
-else
-  # note, fai creates the mountpoints listed here
-  cat > /tmp/fai/fstab <<EOF
-$first_root_crypt  /  btrfs $fstabstdopts,noatime,subvol=root_$DISTRO$mopts  0 0
-$first_root_crypt  /mnt/root  btrfs  nofail,$fstabstd,noatime,subvolid=0$mopts  0 0
-$first_boot_dev  /boot  btrfs        nofail,$fstabstd,noatime,subvol=$boot_vol  0 0
-$first_efi  /boot/efi  vfat          nofail,$fstabstd  0 0
-$first_boot_dev  /mnt/boot  btrfs    nofail,$fstabstd,noatime,subvolid=0  0 0
-EOF
-  swaps=()
-  rm -f /tmp/fai/crypttab
-  for dev in ${devs[@]}; do
-    swaps+=($(swap-cryptname))
-    cat >>/tmp/fai/crypttab <<EOF
-$(root-cryptname) $(rootdev)  none  keyscript=/root/keyscript,discard,luks,initramfs
-$(swap-cryptname) $(swapdev)  /dev/urandom  swap,cipher=aes-xts-plain64,size=256,hash=ripemd160
-EOF
-    cat >> /tmp/fai/fstab <<EOF
-$(swap-cryptdev)  none  swap  nofail,$fstabstd,sw  0 0
-EOF
-  done
-
-  # fai would do this:
-  #BOOT_DEVICE=\${BOOT_DEVICE:-"${devs[0]}"}
-
-  # note: swaplist seems to do nothing.
-  cat >/tmp/fai/disk_var.sh <<EOF
-BOOT_DEVICE="${short_devs[@]}"
-BOOT_PARTITION=\${BOOT_PARTITION:-$first_boot_dev}
-# ROOT_PARTITIONS is added by me, used in arch setup.
-ROOT_PARTITIONS="${root_devs[@]}"
-ROOT_PARTITION=\${ROOT_PARTITION:-$first_root_crypt}
-SWAPLIST=\${SWAPLIST:-"${swaps[@]}"}
-EOF
-
-  if [[ $HOSTNAME == kd ]]; then
-    # note, having these with keyscript and initramfs causes a luks error in fai.log,
-    # but it is safely ignorable and gets us the ability to just type our password
-    # in once at boot. A downside is that they are probably needed to be plugged in to boot.
-    cat >>/tmp/fai/crypttab <<EOF
-crypt_dev_ata-Samsung_SSD_870_QVO_8TB_S5VUNG0N900656V-part${even_bign} /dev/disk/by-id/ata-Samsung_SSD_870_QVO_8TB_S5VUNG0N900656V-part7  none  keyscript=decrypt_keyctl,discard,luks,initramfs
-crypt_dev_ata-TOSHIBA_MD04ACA500_84R2K773FS9A-part1 /dev/disk/by-id/ata-TOSHIBA_MD04ACA500_84R2K773FS9A-part1  none  keyscript=decrypt_keyctl,discard,luks,initramfs
-crypt_dev_ata-ST6000DM001-1XY17Z_Z4D29EBL-part1 /dev/disk/by-id/ata-ST6000DM001-1XY17Z_Z4D29EBL-part1  none  keyscript=decrypt_keyctl,discard,luks,initramfs
-EOF
-    cat >> /tmp/fai/fstab <<EOF
-# r7 = root partition7. it isnt actually #7 anymore, not a great name, but whatever
-/dev/mapper/crypt_dev_ata-Samsung_SSD_870_QVO_8TB_S5VUNG0N900656V-part${even_bign}  /mnt/r7  btrfs  nofail,$fstabstd,noatime,compress=zstd,subvolid=0  0 0
-/dev/mapper/crypt_dev_ata-TOSHIBA_MD04ACA500_84R2K773FS9A-part1  /mnt/rust1  btrfs  nofail,$fstabstd,noatime,compress=zstd,subvolid=0  0 0
-/dev/mapper/crypt_dev_ata-ST6000DM001-1XY17Z_Z4D29EBL-part1  /mnt/rust2  btrfs  nofail,$fstabstd,noatime,compress=zstd,subvolid=0  0 0
-EOF
-  fi
-
-fi

 
 # initial setup of extra data fs, mounted,
 # btrfs subvol create nocow
 
 # initial setup of extra data fs, mounted,
 # btrfs subvol create nocow