Initial commit.
commit
d6c6bc72dc
GPG Key ID:
1573F6D8EFE4D0CF
|
|
@ -0,0 +1,773 @@
|
||||||
|
#!/bin/bash -ex
|
||||||
|
|
||||||
|
# Automatic setup of Debian or Ubuntu on an Online.net or Hetzner rescue system.
|
||||||
|
#
|
||||||
|
# ref https://github.com/openzfs/zfs/wiki/Debian-Buster-Root-on-ZFS
|
||||||
|
#
|
||||||
|
# Author: Carl Kittelberger <icedream@icedream.pw>
|
||||||
|
# Version: 3.0.0-beta.2
|
||||||
|
# Date: 2021-05-01
|
||||||
|
|
||||||
|
raidtype=auto
|
||||||
|
disks=()
|
||||||
|
hostname=${hostname:-$(hostname)}
|
||||||
|
rpool=""
|
||||||
|
bpool=""
|
||||||
|
system="${system:-$(lsb_release -is | tr '[[:upper:]]' '[[:lower:]]')}"
|
||||||
|
mirror="http://deb.debian.org/debian"
|
||||||
|
|
||||||
|
# Ensure only valid defaults are set for system
|
||||||
|
case "$system" in
|
||||||
|
debian|ubuntu)
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
system=""
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
usage() {
|
||||||
|
echo "Usage: $0 [options] <disk> [<disk>...]" >&2
|
||||||
|
echo "" >&2
|
||||||
|
echo "Disks need to be supplied as /dev/disk/by-id/... path references.">&2
|
||||||
|
echo "" >&2
|
||||||
|
echo "Options:">&2
|
||||||
|
echo "" >&2
|
||||||
|
echo " -h, --help Show this help message" >&2
|
||||||
|
echo " --hostname HOSTNAME Set hostname to be written to the installed operating system. Default: $hostname" >&2
|
||||||
|
echo " --rpool RPOOL Set name of ZFS data pool. Default: <hostname>-rpool ($hostname-rpool)" >&2
|
||||||
|
echo " --bpool BPOOL Set name of ZFS data pool. Default: <hostname>-bpool ($hostname-bpool)" >&2
|
||||||
|
if [ -n "$system" ]
|
||||||
|
then
|
||||||
|
echo " -s, --system SYSTEM The system to install. Valid values are debian or ubuntu. Defaults to currently running operating system ($system)." >&2
|
||||||
|
else
|
||||||
|
echo " -s, --system SYSTEM The system to install. Valid values are debian or ubuntu. Required because the current operating system is not actually supported as target operating system." >&2
|
||||||
|
fi
|
||||||
|
echo " --hetzner Use Hetzner network mirror." >&2
|
||||||
|
echo " --online Use Online.net network mirror." >&2
|
||||||
|
echo " --mirror MIRROR Use custom mirror . Default: $mirror" >&2
|
||||||
|
}
|
||||||
|
|
||||||
|
noproc=0
|
||||||
|
while [ "$noproc" -eq 0 ] && [ "$#" -gt 0 ]
|
||||||
|
do
|
||||||
|
opt="$1"
|
||||||
|
case "$opt" in
|
||||||
|
-h|--help)
|
||||||
|
usage
|
||||||
|
exit
|
||||||
|
;;
|
||||||
|
--hostname)
|
||||||
|
if [ -z "$2" ]
|
||||||
|
then
|
||||||
|
echo "ERROR: Expected a value following $opt." >&2
|
||||||
|
fi
|
||||||
|
hostname="$2"
|
||||||
|
shift 2
|
||||||
|
;;
|
||||||
|
--rpool)
|
||||||
|
if [ -z "$2" ]
|
||||||
|
then
|
||||||
|
echo "ERROR: Expected a value following $opt." >&2
|
||||||
|
fi
|
||||||
|
rpool="$2"
|
||||||
|
shift 2
|
||||||
|
;;
|
||||||
|
--bpool)
|
||||||
|
if [ -z "$2" ]
|
||||||
|
then
|
||||||
|
echo "ERROR: Expected a value following $opt." >&2
|
||||||
|
fi
|
||||||
|
bpool="$2"
|
||||||
|
shift 2
|
||||||
|
;;
|
||||||
|
-s|--system)
|
||||||
|
if [ -z "$2" ]
|
||||||
|
then
|
||||||
|
echo "ERROR: Expected a value following $opt." >&2
|
||||||
|
fi
|
||||||
|
system="$2"
|
||||||
|
shift 2
|
||||||
|
;;
|
||||||
|
-t|--type)
|
||||||
|
if [ -z "$2" ]
|
||||||
|
then
|
||||||
|
echo "ERROR: Expected a value following $opt." >&2
|
||||||
|
fi
|
||||||
|
raidtype="$2"
|
||||||
|
shift 2
|
||||||
|
;;
|
||||||
|
--hetzner)
|
||||||
|
mirror="http://mirror.hetzner.de/${system}/packages"
|
||||||
|
shift 1
|
||||||
|
;;
|
||||||
|
--online)
|
||||||
|
mirror="https://mirrors.online.net/${system}"
|
||||||
|
shift 1
|
||||||
|
;;
|
||||||
|
--mirror)
|
||||||
|
if [ -z "$2" ]
|
||||||
|
then
|
||||||
|
echo "ERROR: Expected a value following $opt." >&2
|
||||||
|
fi
|
||||||
|
mirror="$2"
|
||||||
|
shift 2
|
||||||
|
;;
|
||||||
|
--)
|
||||||
|
noproc=1
|
||||||
|
shift 1
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
noproc=1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
|
rpool="${rpool:-${hostname}-rpool}"
|
||||||
|
bpool="${bpool:-${hostname}-bpool}"
|
||||||
|
|
||||||
|
echo "Data pool will be named $rpool." >&2
|
||||||
|
echo "Boot pool will be named $bpool." >&2
|
||||||
|
|
||||||
|
# Check disks use /dev/disk/by-id/... style reference
|
||||||
|
for disk in "$@"
|
||||||
|
do
|
||||||
|
case "$disk" in
|
||||||
|
/dev/disk/by-id/*)
|
||||||
|
echo "Considering disk $disk." >&2
|
||||||
|
disks+=("$disk")
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo "ERROR: Invalid disk reference $disk, needs to be formatted like this: /dev/disk/by-id/..." >&2
|
||||||
|
exit 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
|
# Did we receive any disk information at all?
|
||||||
|
if [ "${#disks[@]}" -lt 1 ]
|
||||||
|
then
|
||||||
|
echo "ERROR: Need at least one disk." >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Check if we got a valid target operating system to install
|
||||||
|
case "$system" in
|
||||||
|
debian|ubuntu)
|
||||||
|
;;
|
||||||
|
"")
|
||||||
|
echo "ERROR: You need to set a system to be installed." >&2
|
||||||
|
exit 1
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo "ERROR: You need to set a valid system to be installed. $system is not supported, only debian and ubuntu are." >&2
|
||||||
|
exit 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
# If raidtype is auto, automatically select one:
|
||||||
|
# - 1 disk: striped
|
||||||
|
# - 2 disks: mirror
|
||||||
|
# - 3+ disks: raidz
|
||||||
|
if [ "$raidtype" = auto ]
|
||||||
|
then
|
||||||
|
raidtype=striped
|
||||||
|
if [ "${#disks[@]}" -gt 2 ]
|
||||||
|
then
|
||||||
|
raidtype=raidz
|
||||||
|
elif [ "${#disks[@]}" -gt 1 ]
|
||||||
|
then
|
||||||
|
raidtype=mirror
|
||||||
|
fi
|
||||||
|
echo "Autoselected RAID type for ${#disks[@]} disks: $raidtype" >&2
|
||||||
|
fi
|
||||||
|
|
||||||
|
alldisks() {
|
||||||
|
for disk in "${disks[@]}"
|
||||||
|
do
|
||||||
|
"$@" "$disk" || return "$?"
|
||||||
|
done
|
||||||
|
}
|
||||||
|
|
||||||
|
allpartref() {
|
||||||
|
for disk in "${disks[@]}"
|
||||||
|
do
|
||||||
|
echo "${disk}-part$1"
|
||||||
|
done
|
||||||
|
}
|
||||||
|
|
||||||
|
# Only apply a patch if it wasn't already applied.
|
||||||
|
# Turns the error case of an already applied patch into a success case.
|
||||||
|
softpatch() {
|
||||||
|
patch "$@" || if [ "$?" -ne 1 ]
|
||||||
|
then
|
||||||
|
return $?
|
||||||
|
else
|
||||||
|
true
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
if [ "$(id -u)" != 0 ]; then
|
||||||
|
sudo -v
|
||||||
|
else
|
||||||
|
sudo() {
|
||||||
|
"$@"
|
||||||
|
}
|
||||||
|
export sudo
|
||||||
|
fi
|
||||||
|
|
||||||
|
export DEBIAN_FRONTEND="${DEBIAN_FRONTEND:-noninteractive}"
|
||||||
|
|
||||||
|
sudo apt install -y "linux-image-$(uname -r)" "linux-headers-$(uname -r)" eatmydata
|
||||||
|
sudo eatmydata apt-get autoremove -y $(eatmydata apt list | grep -P '^linux-(image|headers)' | grep -vP "^linux-(image|headers)-$(uname -r)" | cut -d/ -f 1)
|
||||||
|
for d in /lib/modules/*/
|
||||||
|
do
|
||||||
|
kernel_version=$(basename "$d")
|
||||||
|
if [ "${kernel_version}" != "$(uname -r)" ]
|
||||||
|
then
|
||||||
|
rm -rv "$d"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
sudo umount -l /mnt/dev || true
|
||||||
|
sudo umount -l /mnt/proc || true
|
||||||
|
sudo umount -l /mnt/sys || true
|
||||||
|
|
||||||
|
#sudo touch /boot/vmlinuz-4.4.0-97 /boot/vmlinuz-4.4.0-97-generic /boot/initrd.img-4.4.0-97 /boot/initrd.img-4.4.0-97-generic
|
||||||
|
|
||||||
|
#sudo sed -i 's,\bmain\b,main contrib,g' /etc/apt/sources.list
|
||||||
|
sudo eatmydata apt install -y mdadm gdisk "linux-headers-$(uname -r)"
|
||||||
|
if ! modprobe zfs
|
||||||
|
then
|
||||||
|
# check for backports
|
||||||
|
codename="$(lsb_release -cs)"
|
||||||
|
has_backports="$(curl -Ifso /dev/null "https://deb.debian.org/debian/dists/${codename}-backports/Release" && echo 1 || echo 0)"
|
||||||
|
if [ "${has_backports}" -ne 0 ]
|
||||||
|
then
|
||||||
|
echo "deb https://deb.debian.org/debian ${codename}-backports main contrib" > /etc/apt/sources.list.d/backports.list
|
||||||
|
eatmydata apt update
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ "${has_backports}" -ne 0 ]
|
||||||
|
then
|
||||||
|
sudo eatmydata apt install -y -t "${codename}-backports" zfs-dkms
|
||||||
|
|
||||||
|
# sudo eatmydata apt install -y devscripts
|
||||||
|
|
||||||
|
# # Build spl
|
||||||
|
# sudo eatmydata apt build-dep -y spl-linux
|
||||||
|
# rm -rf spl-linux*
|
||||||
|
# eatmydata apt source spl-linux
|
||||||
|
# wget -O spl-pr-710.patch https://github.com/zfsonlinux/spl/pull/710.patch
|
||||||
|
# if (cd spl-linux*/ && patch --dry-run --silent -N -p1 -i ../spl-pr-710.patch)
|
||||||
|
# then
|
||||||
|
# cd spl-linux*/
|
||||||
|
# patch -N -p1 -i ../spl-pr-710.patch
|
||||||
|
# echo '4.19' > debian/linux_compat
|
||||||
|
# dch -v 0.7.12 "Apply spl 0.7.12 patchset."
|
||||||
|
# cd ../spl-linux-*/
|
||||||
|
# dpkg-buildpackage -b
|
||||||
|
# cd ..
|
||||||
|
# sudo eatmydata apt install -y ./*.deb
|
||||||
|
# rm *.deb
|
||||||
|
# elif [ "$?" -eq 1 ]
|
||||||
|
# then
|
||||||
|
# echo "Patch was already applied, skipping spl-linux build." >&2
|
||||||
|
# else
|
||||||
|
# echo "ERROR: Failed to apply patch." >&2
|
||||||
|
# exit 1
|
||||||
|
# fi
|
||||||
|
# rm spl-pr-710.patch
|
||||||
|
|
||||||
|
# # Build zfs
|
||||||
|
# sudo eatmydata apt build-dep -y zfs-linux
|
||||||
|
# rm -rf zfs-linux*
|
||||||
|
# eatmydata apt source zfs-linux
|
||||||
|
# wget -O zfs-pr-8078.patch https://github.com/zfsonlinux/zfs/pull/8078.patch
|
||||||
|
# if (cd zfs-linux*/ && patch --dry-run --silent -N -p1 -i ../zfs-pr-8078.patch)
|
||||||
|
# then
|
||||||
|
# cd zfs-linux*/
|
||||||
|
# patch -N -p1 -i ../zfs-pr-8078.patch
|
||||||
|
# echo '4.19' > debian/linux_compat
|
||||||
|
# dch -v 0.7.12 "Apply zfsonlinux 0.7.12 patchset."
|
||||||
|
# cd ../zfs-linux-*/
|
||||||
|
# dpkg-buildpackage -b
|
||||||
|
# cd ..
|
||||||
|
# rm *dracut*.deb
|
||||||
|
# sudo eatmydata apt install -y ./*.deb
|
||||||
|
# rm *.deb
|
||||||
|
# elif [ "$?" -eq 1 ]
|
||||||
|
# then
|
||||||
|
# echo "Patch was already applied, skipping zfs build and installing zfs-dkms binary distribution." >&2
|
||||||
|
# sudo eatmydata apt install -y zfs-dkms
|
||||||
|
# else
|
||||||
|
# echo "ERROR: Failed to apply patch." >&2
|
||||||
|
# exit 1
|
||||||
|
# fi
|
||||||
|
# rm zfs-pr-8078.patch
|
||||||
|
else
|
||||||
|
sudo eatmydata apt install -y zfs-dkms
|
||||||
|
fi
|
||||||
|
sudo modprobe zfs
|
||||||
|
fi
|
||||||
|
|
||||||
|
sudo eatmydata apt install -y jq
|
||||||
|
debootstrap_version=$(wget -qO- https://sources.debian.org/api/src/debootstrap/ | jq '.versions[0].version' -r)
|
||||||
|
case "$system" in
|
||||||
|
debian)
|
||||||
|
sudo eatmydata apt install -y debian-archive-keyring
|
||||||
|
wget -Odebootstrap.deb https://deb.debian.org/debian/pool/main/d/debootstrap/debootstrap_${debootstrap_version}_all.deb
|
||||||
|
;;
|
||||||
|
ubuntu)
|
||||||
|
sudo eatmydata apt install -y ubuntu-keyring
|
||||||
|
wget -Odebootstrap.deb http://de.archive.ubuntu.com/ubuntu/pool/main/d/debootstrap/debootstrap_${debootstrap_version}ubuntu1_all.deb
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo "Unsupported system: $system"
|
||||||
|
exit 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
sudo eatmydata apt install -y --allow-downgrades ./debootstrap.deb
|
||||||
|
|
||||||
|
sudo zpool export "${hostname}" || true
|
||||||
|
sudo zpool export "${bpool}" || true
|
||||||
|
sudo zpool export "${rpool}" || true
|
||||||
|
sudo zpool destroy "${hostname}" || true
|
||||||
|
sudo zpool destroy "${bpool}" || true
|
||||||
|
sudo zpool destroy "${rpool}" || true
|
||||||
|
alldisks sudo mdadm --zero-superblock --force || true
|
||||||
|
alldisks sudo sgdisk --zap-all
|
||||||
|
alldisks sudo blkdiscard || for d in "${disks[@]}"; do
|
||||||
|
sudo dd if=/dev/zero of="${d}" bs=32M count=4 oflag=direct status=progress
|
||||||
|
done
|
||||||
|
partBIOS=1
|
||||||
|
partUEFI=2
|
||||||
|
partBootPool=3
|
||||||
|
partRootPool=4
|
||||||
|
alldisks sudo sgdisk -a1 -n1:24K:+1000K -t1:EF02 # bios boot
|
||||||
|
alldisks sudo sgdisk -n2:1M:+512M -t2:EF00 # uefi boot
|
||||||
|
alldisks sudo sgdisk -n3:0:+1G -t3:BF01 # boot pool
|
||||||
|
alldisks sudo sgdisk -n4:0:0 -t4:BF01 # zfs pool
|
||||||
|
sudo partprobe
|
||||||
|
# sudo hdparm -z "${disks[@]}"
|
||||||
|
sleep 1
|
||||||
|
for d in $(
|
||||||
|
allpartref "${partBootPool}"
|
||||||
|
allpartref "${partRootPool}"
|
||||||
|
)
|
||||||
|
do
|
||||||
|
sudo blkdiscard "$d" || sudo dd if=/dev/zero of="$d" bs=1M count=1
|
||||||
|
done
|
||||||
|
|
||||||
|
# create boot pool
|
||||||
|
sudo zpool create -o ashift=12 -d \
|
||||||
|
-o feature@async_destroy=enabled \
|
||||||
|
-o feature@bookmarks=enabled \
|
||||||
|
-o feature@embedded_data=enabled \
|
||||||
|
-o feature@empty_bpobj=enabled \
|
||||||
|
-o feature@enabled_txg=enabled \
|
||||||
|
-o feature@extensible_dataset=enabled \
|
||||||
|
-o feature@filesystem_limits=enabled \
|
||||||
|
-o feature@hole_birth=enabled \
|
||||||
|
-o feature@large_blocks=enabled \
|
||||||
|
-o feature@lz4_compress=enabled \
|
||||||
|
-o feature@spacemap_histogram=enabled \
|
||||||
|
-o feature@userobj_accounting=enabled \
|
||||||
|
-o feature@zpool_checkpoint=enabled \
|
||||||
|
-o feature@spacemap_v2=enabled \
|
||||||
|
-o feature@project_quota=enabled \
|
||||||
|
-o feature@resilver_defer=enabled \
|
||||||
|
-o feature@allocation_classes=enabled \
|
||||||
|
-O acltype=posixacl -O canmount=off -O compression=lz4 -O devices=off \
|
||||||
|
-O normalization=formD -O relatime=on -O xattr=sa \
|
||||||
|
-O mountpoint=/ -R /mnt -f \
|
||||||
|
"$bpool" "$raidtype" \
|
||||||
|
$(allpartref "${partBootPool}")
|
||||||
|
|
||||||
|
# create root pool
|
||||||
|
sudo zpool create -o ashift=12 \
|
||||||
|
-O acltype=posixacl -O canmount=off -O compression=lz4 \
|
||||||
|
-O dnodesize=auto -O normalization=formD -O relatime=on -O xattr=sa \
|
||||||
|
-O mountpoint=/ -R /mnt -f \
|
||||||
|
"$rpool" "$raidtype" \
|
||||||
|
$(allpartref "${partRootPool}")
|
||||||
|
|
||||||
|
# create filesystem dataset
|
||||||
|
sudo zfs create -o canmount=off -o mountpoint=none "$rpool/ROOT"
|
||||||
|
sudo zfs create -o canmount=off -o mountpoint=none "$bpool/BOOT"
|
||||||
|
|
||||||
|
# create filesystem dataset for root fs
|
||||||
|
sudo zfs create -o canmount=noauto -o mountpoint=/ "$rpool/ROOT/operating_system"
|
||||||
|
sudo zfs mount $rpool/ROOT/operating_system
|
||||||
|
sudo zfs create -o canmount=noauto -o mountpoint=/boot "$bpool/BOOT/operating_system"
|
||||||
|
sudo zfs mount $bpool/BOOT/operating_system
|
||||||
|
#sudo zpool set bootfs=$rpool/ROOT/operating_system $rpool
|
||||||
|
|
||||||
|
# create datasets for folders
|
||||||
|
sudo zfs create -o setuid=off "$rpool/home"
|
||||||
|
sudo zfs create -o mountpoint=/root "$rpool/home/root"
|
||||||
|
sudo zfs create -o canmount=off -o setuid=off -o exec=off "$rpool/var"
|
||||||
|
sudo zfs create -o canmount=off "$rpool/var/lib"
|
||||||
|
sudo zfs create -o acltype=posixacl -o xattr=sa "$rpool/var/log"
|
||||||
|
sudo zfs create "$rpool/var/mail"
|
||||||
|
sudo zfs create "$rpool/var/spool"
|
||||||
|
|
||||||
|
# Exclude cache and tmp files from snapshots
|
||||||
|
sudo zfs create -o com.sun:auto-snapshot=false "$rpool/var/cache"
|
||||||
|
sudo zfs create -o com.sun:auto-snapshot=false -o exec=on "$rpool/var/tmp"
|
||||||
|
|
||||||
|
# We may be using /usr/local
|
||||||
|
sudo zfs create -o canmount=off "$rpool/usr"
|
||||||
|
sudo zfs create "$rpool/usr/local"
|
||||||
|
|
||||||
|
# We may be using /opt
|
||||||
|
sudo zfs create "$rpool/opt"
|
||||||
|
|
||||||
|
# Do not snapshot ZFS
|
||||||
|
sudo zfs create "$rpool/srv"
|
||||||
|
# sudo zfs create -o com.sun:auto-snapshot=false -o mountpoint=/srv/nfs4 "$rpool/srv/nfs"
|
||||||
|
|
||||||
|
# install system
|
||||||
|
sudo chmod 1777 /mnt/var/tmp
|
||||||
|
|
||||||
|
if [ -z "$codename" ]
|
||||||
|
then
|
||||||
|
case "$system" in
|
||||||
|
debian)
|
||||||
|
codename="$(curl -L https://deb.debian.org/debian/dists/stable/Release | grep -Po '^Codename: \K(.+)$')"
|
||||||
|
;;
|
||||||
|
ubuntu)
|
||||||
|
codename="bionic" # TODO
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo "ERROR: Unsupported system: $system" >&2
|
||||||
|
exit 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
fi
|
||||||
|
sudo eatmydata debootstrap --include=console-setup,eatmydata,ca-certificates,coreutils,gdisk,ssh,zsh,nano,lsb-release "${codename}" /mnt "$mirror"
|
||||||
|
|
||||||
|
sudo zfs set devices=off "$rpool"
|
||||||
|
|
||||||
|
# hostname/hosts configuration
|
||||||
|
echo "${hostname}" | sudo tee /mnt/etc/hostname
|
||||||
|
sudo tee /mnt/etc/hosts <<EOF
|
||||||
|
127.0.0.1 localhost
|
||||||
|
127.0.1.1 ${hostname} ${hostname}.serverkomplex.de
|
||||||
|
|
||||||
|
# The following lines are desirable for IPv6 capable hosts
|
||||||
|
::1 ip6-localhost ip6-loopback
|
||||||
|
fe00::0 ip6-localnet
|
||||||
|
ff00::0 ip6-mcastprefix
|
||||||
|
ff02::1 ip6-allnodes
|
||||||
|
ff02::2 ip6-allrouters
|
||||||
|
ff02::3 ip6-allhosts
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# configure swap
|
||||||
|
sudo zfs create -V 64G -b "$(getconf PAGESIZE)" -o compression=zle \
|
||||||
|
-o logbias=throughput -o sync=always \
|
||||||
|
-o primarycache=metadata -o secondarycache=none \
|
||||||
|
-o com.sun:auto-snapshot=false "$rpool/swap"
|
||||||
|
while [ ! -b "/dev/zvol/$rpool/swap" ]
|
||||||
|
do
|
||||||
|
sleep 1
|
||||||
|
done
|
||||||
|
sudo mkswap -f "/dev/zvol/$rpool/swap"
|
||||||
|
echo "/dev/zvol/$rpool/swap none swap defaults 0 0" | sudo tee -a /mnt/etc/fstab >/dev/null
|
||||||
|
sudo mkdir -p /mnt/etc/initramfs-tools/conf.d
|
||||||
|
echo RESUME=none | sudo tee /mnt/etc/initramfs-tools/conf.d/resume >/dev/null
|
||||||
|
|
||||||
|
# prepare for chroot
|
||||||
|
sudo mount --bind /dev /mnt/dev
|
||||||
|
sudo mount --bind /proc /mnt/proc
|
||||||
|
sudo mount --bind /sys /mnt/sys
|
||||||
|
|
||||||
|
# configure
|
||||||
|
codename="$(sudo chroot /mnt lsb_release -cs)"
|
||||||
|
case "$system" in
|
||||||
|
debian)
|
||||||
|
sudo chroot /mnt grep '\bcontrib\b' /etc/apt/sources.list ||\
|
||||||
|
sudo chroot /mnt sed -i 's,\bmain\b,main contrib,g' /etc/apt/sources.list
|
||||||
|
url="https://deb.debian.org/debian"
|
||||||
|
if curl -o /dev/null --fail "${url}/dists/${codename}-backports/Release"
|
||||||
|
then
|
||||||
|
echo "deb ${url} ${codename}-backports main contrib" |\
|
||||||
|
sudo chroot /mnt tee /etc/apt/sources.list.d/backports.list
|
||||||
|
fi
|
||||||
|
success=0
|
||||||
|
for url in \
|
||||||
|
https://deb.debian.org/debian-security \
|
||||||
|
http://security.debian.org
|
||||||
|
do
|
||||||
|
for name in \
|
||||||
|
"${codename}/updates" \
|
||||||
|
"${codename}"
|
||||||
|
do
|
||||||
|
if curl -o /dev/null --fail "${url}/dists/${codename}/updates/Release"
|
||||||
|
then
|
||||||
|
echo "deb ${url} ${name} main contrib" |\
|
||||||
|
sudo chroot /mnt tee /etc/apt/sources.list.d/security.list
|
||||||
|
success=1
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
if [ "$success" -ne 0 ]
|
||||||
|
then
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
;;
|
||||||
|
ubuntu)
|
||||||
|
sudo chroot /mnt eatmydata apt update
|
||||||
|
sudo chroot /mnt eatmydata apt install -y software-properties-common
|
||||||
|
sudo chroot /mnt eatmydata apt-add-repository "${mirror}" multiverse universe
|
||||||
|
sudo chroot /mnt ln -s /proc/self/mounts /etc/mtab
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
sudo chroot /mnt eatmydata apt update
|
||||||
|
sudo chroot /mnt eatmydata apt install -y locales
|
||||||
|
sudo chroot /mnt dpkg-reconfigure locales
|
||||||
|
sudo chroot /mnt dpkg-reconfigure tzdata
|
||||||
|
case "$system" in
|
||||||
|
debian)
|
||||||
|
sudo chroot /mnt eatmydata apt install -y linux-headers-amd64 linux-image-amd64
|
||||||
|
;;
|
||||||
|
ubuntu)
|
||||||
|
sudo chroot /mnt eatmydata apt install -y --no-install-recommends linux-image-generic linux-headers-generic
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
sudo chroot /mnt eatmydata apt install -y -t "${codename}-backports" zfsutils-linux zfs-dkms zfs-initramfs
|
||||||
|
sudo chroot /mnt sh -c 'ZPOOL_VDEV_NAME_PATH=YES DEBIAN_NONINTERACTIVE=true eatmydata apt install -y grub-pc'
|
||||||
|
sudo tee /etc/ssh/sshd_config <<EOF
|
||||||
|
# Supported HostKey algorithms by order of preference.
|
||||||
|
HostKey /etc/ssh/ssh_host_ed25519_key
|
||||||
|
HostKey /etc/ssh/ssh_host_rsa_key
|
||||||
|
HostKey /etc/ssh/ssh_host_ecdsa_key
|
||||||
|
|
||||||
|
KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
|
||||||
|
|
||||||
|
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
|
||||||
|
|
||||||
|
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
|
||||||
|
|
||||||
|
# Password based logins are disabled - only public key based logins are allowed.
|
||||||
|
AuthenticationMethods publickey
|
||||||
|
|
||||||
|
# LogLevel VERBOSE logs user's key fingerprint on login. Needed to have a clear audit track of which key was using to log in.
|
||||||
|
LogLevel VERBOSE
|
||||||
|
|
||||||
|
# Log sftp level file access (read/write/etc.) that would not be easily logged otherwise.
|
||||||
|
Subsystem sftp $(sudo chroot /mnt find /usr/lib -name sftp-server -type f -executable) -f AUTHPRIV -l INFO
|
||||||
|
|
||||||
|
# Root login is not allowed for auditing reasons. This is because it's difficult to track which process belongs to which root user:
|
||||||
|
#
|
||||||
|
# On Linux, user sessions are tracking using a kernel-side session id, however, this session id is not recorded by OpenSSH.
|
||||||
|
# Additionally, only tools such as systemd and auditd record the process session id.
|
||||||
|
# On other OSes, the user session id is not necessarily recorded at all kernel-side.
|
||||||
|
# Using regular users in combination with /bin/su or /usr/bin/sudo ensure a clear audit track.
|
||||||
|
PermitRootLogin No
|
||||||
|
|
||||||
|
# Use kernel sandbox mechanisms where possible in unprivileged processes
|
||||||
|
# Systrace on OpenBSD, Seccomp on Linux, seatbelt on MacOSX/Darwin, rlimit elsewhere.
|
||||||
|
UsePrivilegeSeparation sandbox
|
||||||
|
EOF
|
||||||
|
if [ -f ~/.ssh/authorized_keys ]; then
|
||||||
|
sudo mkdir -p /mnt/root/.ssh
|
||||||
|
sudo chmod 700 /mnt/root/.ssh
|
||||||
|
cat ~/.ssh/authorized_keys | sudo tee /mnt/root/.ssh/authorized_keys
|
||||||
|
sudo chmod 600 /mnt/root/.ssh/authorized_keys
|
||||||
|
sudo chroot /mnt sed -i 's,PermitRootLogin .\+$,PermitRootLogin prohibit-password,' /etc/ssh/sshd_config
|
||||||
|
echo "Make sure to create a separate user account so you can set PermitRootLogin back to No in /etc/ssh/sshd_config."
|
||||||
|
else
|
||||||
|
# you should definitely change this ASAP!
|
||||||
|
sudo chroot /mnt sed -i 's,PermitRootLogin .\+$,PermitRootLogin yes,' /etc/ssh/sshd_config
|
||||||
|
echo "SSH will have to be secured as root is now accessible with a password."
|
||||||
|
fi
|
||||||
|
sudo chroot /mnt passwd
|
||||||
|
|
||||||
|
# Enable importing bpool
|
||||||
|
sudo tee /mnt/etc/systemd/system/zfs-import-bpool.service <<EOF
|
||||||
|
[Unit]
|
||||||
|
DefaultDependencies=no
|
||||||
|
Before=zfs-import-scan.service
|
||||||
|
Before=zfs-import-cache.service
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=oneshot
|
||||||
|
RemainAfterExit=yes
|
||||||
|
ExecStart=/sbin/zpool import -N -o cachefile=none "$bpool"
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=zfs-import.target
|
||||||
|
EOF
|
||||||
|
sudo chroot /mnt systemctl enable zfs-import-bpool.service
|
||||||
|
|
||||||
|
# Mount a tmpfs to /tmp
|
||||||
|
sudo chroot /mnt cp -v /usr/share/systemd/tmp.mount /etc/systemd/system/
|
||||||
|
sudo chroot /mnt systemctl enable tmp.mount
|
||||||
|
|
||||||
|
if ! (sudo chroot /mnt grub-probe /boot | grep '\bzfs\b')
|
||||||
|
then
|
||||||
|
echo "ERROR: Failed to validate that GRUB supports zfs. Aborting." >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
sudo chroot /mnt update-initramfs -u -k all
|
||||||
|
sudo chroot /mnt sed -e 's#GRUB_CMDLINE_LINUX="\(.*\)"#GRUB_CMDLINE_LINUX="root=ZFS='"$rpool"'/ROOT/operating_system \1"#' -i /etc/default/grub
|
||||||
|
sudo chroot /mnt update-grub
|
||||||
|
for d in "${disks[@]}"
|
||||||
|
do
|
||||||
|
sudo chroot /mnt sh -c "ZPOOL_VDEV_NAME_PATH=YES grub-install '${d}'"
|
||||||
|
done
|
||||||
|
if [ "$(sudo chroot /mnt find /boot/grub -name zfs.mod | wc -l)" -lt 1 ]
|
||||||
|
then
|
||||||
|
echo "ERROR: Installed GRUB does not seem to have ZFS module. Aborting." >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# fix filesystem mount ordering
|
||||||
|
sudo zfs set mountpoint=legacy "$bpool/BOOT/operating_system"
|
||||||
|
sudo tee -a /mnt/etc/fstab <<EOF
|
||||||
|
$bpool/BOOT/operating_system /boot zfs nodev,relatime,x-systemd.requires=zfs-import-bpool.service 0 0
|
||||||
|
EOF
|
||||||
|
sudo mkdir -p /mnt/etc/zfs/zfs-list.cache
|
||||||
|
#sudo mkdir -p /etc/zfs/zfs-list.cache
|
||||||
|
sudo touch "/mnt/etc/zfs/zfs-list.cache/$rpool"
|
||||||
|
#sudo touch "/etc/zfs/zfs-list.cache/$rpool"
|
||||||
|
sudo chroot /mnt ln -sf /usr/lib/zfs-linux/zed.d/history_event-zfs-list-cacher.sh /etc/zfs/zed.d
|
||||||
|
#sudo ln -sf /mnt/usr/lib/zfs-linux/zed.d/history_event-zfs-list-cacher.sh /etc/zfs/zed.d
|
||||||
|
zedpidfile=$(mktemp -p /mnt/var/tmp)
|
||||||
|
zedpidfile_chroot="${zedpidfile#/mnt}"
|
||||||
|
sudo chroot /mnt zed -p "${zedpidfile_chroot}"
|
||||||
|
echo "Waiting for ZFS cache to be written…"
|
||||||
|
sleep 5
|
||||||
|
until [ "$(cat /mnt/etc/zfs/zfs-list.cache/$rpool)" != "" ]
|
||||||
|
do
|
||||||
|
#sudo zfs set canmount=noauto "$rpool/ROOT/operating_system"
|
||||||
|
sleep 3
|
||||||
|
done
|
||||||
|
sudo chroot /mnt kill "$(cat "${zedpidfile}")"
|
||||||
|
sudo sleep 2
|
||||||
|
sudo rm -f "${zedpidfile}"
|
||||||
|
#sudo cp -a /etc/zfs/zfs-list.cache/* /mnt/etc/zfs/zfs-list.cache/
|
||||||
|
# Fix paths to eliminate /mnt
|
||||||
|
sudo sed -Ei "s|/mnt/?|/|" "/mnt/etc/zfs/zfs-list.cache/$rpool"
|
||||||
|
|
||||||
|
# configure networking
|
||||||
|
|
||||||
|
# nicht funktionierend:
|
||||||
|
# sudo tee /mnt/etc/netplan/eth0.yaml <<"EOF"
|
||||||
|
# network:
|
||||||
|
# version: 2
|
||||||
|
# ethernets:
|
||||||
|
# eth0:
|
||||||
|
# dhcp4: true
|
||||||
|
# EOF
|
||||||
|
|
||||||
|
# online.net:
|
||||||
|
# sudo tee /mnt/etc/network/interfaces <<"EOF"
|
||||||
|
# auto lo
|
||||||
|
# iface lo inet loopback
|
||||||
|
#
|
||||||
|
# auto eno1
|
||||||
|
# iface eno1 inet static
|
||||||
|
# address 51.15.19.177
|
||||||
|
# netmask 255.255.255.0
|
||||||
|
# gateway 51.15.19.1
|
||||||
|
# EOF
|
||||||
|
|
||||||
|
# hetzner:
|
||||||
|
sudo mkdir -p /mnt/etc/systemd/network
|
||||||
|
gateway="$(ip -br r s default | awk '{print $3}')"
|
||||||
|
dev="$(ip -br r s default | awk '{print $5}')"
|
||||||
|
ip=$(ip -br a s dev "$dev" | awk '{print $3}')
|
||||||
|
mac="$(ip -br link show "$dev" | awk '{print $3}')"
|
||||||
|
dnssection=""
|
||||||
|
grep -Po '\d+.\d+.\d+.\d+' /etc/resolv.conf | while read -r ip
|
||||||
|
do
|
||||||
|
dnssection="$dnssection"$'\n'"DNS=$ip"
|
||||||
|
done
|
||||||
|
sudo tee /mnt/etc/systemd/network/10-ethernet.network <<EOF
|
||||||
|
[Match]
|
||||||
|
MACAddress=${mac}
|
||||||
|
|
||||||
|
[Network]
|
||||||
|
Gateway=${gateway}
|
||||||
|
#Address=[IP RANGE]::2/64
|
||||||
|
#Gateway=fe80::1
|
||||||
|
${dnssection}
|
||||||
|
|
||||||
|
[Address]
|
||||||
|
Address=${ip}
|
||||||
|
Peer=${gateway}/32
|
||||||
|
EOF
|
||||||
|
sudo chroot /mnt systemctl enable systemd-networkd
|
||||||
|
#sudo chroot /mnt systemctl enable systemd-resolved
|
||||||
|
#sudo tee /mnt/etc/netplan/01-netcfg.yaml <<"EOF"
|
||||||
|
## network is managed by systemd-networkd
|
||||||
|
#EOF
|
||||||
|
sudo tee /mnt/etc/default/cpufrequtils <<"EOF"
|
||||||
|
# cpu frequency scaling
|
||||||
|
ENABLE="true"
|
||||||
|
GOVENOR="ondemand"
|
||||||
|
MAX_SPEED="0"
|
||||||
|
MIN_SPEED="0"
|
||||||
|
EOF
|
||||||
|
sudo tee /mnt/etc/sysctl.d/99-hetzner.conf <<"EOF"
|
||||||
|
# sysctl config
|
||||||
|
#net.ipv4.ip_forward=1
|
||||||
|
net.ipv4.conf.all.rp_filter=1
|
||||||
|
net.ipv4.icmp_echo_ignore_broadcasts=1
|
||||||
|
# ipv6 settings (no autoconfiguration)
|
||||||
|
net.ipv6.conf.default.autoconf=0
|
||||||
|
net.ipv6.conf.default.accept_dad=0
|
||||||
|
net.ipv6.conf.default.accept_ra=0
|
||||||
|
net.ipv6.conf.default.accept_ra_defrtr=0
|
||||||
|
net.ipv6.conf.default.accept_ra_rtr_pref=0
|
||||||
|
net.ipv6.conf.default.accept_ra_pinfo=0
|
||||||
|
net.ipv6.conf.default.accept_source_route=0
|
||||||
|
net.ipv6.conf.default.accept_redirects=0
|
||||||
|
net.ipv6.conf.all.autoconf=0
|
||||||
|
net.ipv6.conf.all.accept_dad=0
|
||||||
|
net.ipv6.conf.all.accept_ra=0
|
||||||
|
net.ipv6.conf.all.accept_ra_defrtr=0
|
||||||
|
net.ipv6.conf.all.accept_ra_rtr_pref=0
|
||||||
|
net.ipv6.conf.all.accept_ra_pinfo=0
|
||||||
|
net.ipv6.conf.all.accept_source_route=0
|
||||||
|
net.ipv6.conf.all.accept_redirects=0
|
||||||
|
EOF
|
||||||
|
sudo tee /mnt/etc/modprobe.d/blacklist-hetzner.conf <<"EOF"
|
||||||
|
### silence any onboard speaker
|
||||||
|
blacklist pcspkr
|
||||||
|
blacklist snd_pcsp
|
||||||
|
### i915 driver blacklisted due to various bugs
|
||||||
|
### especially in combination with nomodeset
|
||||||
|
blacklist i915
|
||||||
|
blacklist i915_bdw
|
||||||
|
### mei driver blacklisted due to serious bugs
|
||||||
|
blacklist mei
|
||||||
|
blacklist mei-me
|
||||||
|
blacklist sm750fb
|
||||||
|
EOF
|
||||||
|
#sudo chroot /mnt rm -f /etc/resolv.conf
|
||||||
|
sudo chroot /mnt tee /etc/resolv.conf < /etc/resolv.conf > /dev/null
|
||||||
|
#sudo chroot /mnt ln -s /run/systemd/resolve/resolv.conf /etc/resolv.conf
|
||||||
|
#sudo chroot /mnt systemctl enable systemd-resolved.service
|
||||||
|
|
||||||
|
sudo chroot /mnt zfs snapshot "$bpool/BOOT/operating_system@install"
|
||||||
|
sudo chroot /mnt zfs snapshot "$rpool/ROOT/operating_system@install"
|
||||||
|
|
||||||
|
sudo chroot /mnt hostnamectl set-hostname "${hostname}" ||\
|
||||||
|
(printf "%s" "${hostname}" | sudo chroot /mnt tee /etc/hostname >/dev/null)
|
||||||
|
|
||||||
|
sudo chroot /mnt bash -i
|
||||||
|
|
||||||
|
# unmount
|
||||||
|
sudo umount -l /mnt/dev
|
||||||
|
sudo umount -l /mnt/proc
|
||||||
|
sudo umount -l /mnt/sys
|
||||||
|
#mount | grep -v zfs | tac | awk '/\/mnt/ {print $3}' | xargs -i{} sudo umount -lf {}
|
||||||
|
sudo zpool export "$bpool"
|
||||||
|
sudo zpool export "$rpool"
|
||||||
|
|
||||||
|
echo "Installation done."
|
||||||
Loading…
Reference in New Issue