Add encryption, collect same argument for vg name, boot label and LUKS mapper.

diff --git a/install_debian.sh b/install_debian.sh
index d7de2c0274a8e20fb619a90b7633db867ecc110e..998f0d7bd12b2067852dae686790119bdf817c15 100755 (executable)
--- a/install_debian.sh
+++ b/install_debian.sh
@@ -3,11 +3,14 @@ set -Ceu
 SCRIPT_NAME=$0
 
 # constants unlikely to change
-PATH_DEV=/dev
-PATH_EFI=/boot/efi
-PATH_FSTAB=/etc/fstab
+NAME_DEV=dev
 NAME_INITRD=initrd.img
 NAME_VMLINUZ=vmlinuz
+PATH_CRYPTTAB=/etc/crypttab
+PATH_DEV="/${NAME_DEV}"
+PATH_EFI=/boot/efi
+PATH_FSTAB=/etc/fstab
+TO_RBIND="${NAME_DEV} proc sys"
 
 # constants we might want to change at some point
 DEB_SUITE=trixie
@@ -47,20 +50,24 @@ chroot_sh() {
 }
 
 # inputs to confirm
-[ $# -eq 3 ]\
-    || die "usage: $0 <partition> <volume-group-name> <boot-label>"
+[ $# -eq 2 ]\
+    || die "usage: $0 <partition> <volume-group-name>"
 PARTITION=$1
 NAME_VOLGROUP=$2
-BOOT_LABEL=$3
+NAME_BOOT="${NAME_VOLGROUP}"
+NAME_LUKS="${NAME_VOLGROUP}"
 
 # constants derived from changeables
 LOGVOL_ROOT="${PATH_DEV}/${NAME_VOLGROUP}/${NAME_ROOT}"
-PATH_EFI_BOOT_LABEL="${PATH_EFI}/${BOOT_LABEL}"
-DEV_SLAVE="${PATH_MNT}${PATH_DEV}"
+PATH_EFI_NAME_BOOT="${PATH_EFI}/${NAME_BOOT}"
+PATH_LUKS_MAPPER="${PATH_DEV}/mapper/${NAME_LUKS}"
+PATH_MNT_CRYPTTAB="${PATH_MNT}${PATH_CRYPTTAB}"
 PATH_MNT_FSTAB="${PATH_MNT}${PATH_FSTAB}"
 
 # sanity checks: required tools
-for CMD in debootstrap efibootmgr lvcreate pvcreate vgcreate vgs; do
+for CMD in \
+    cryptsetup debootstrap efibootmgr lvcreate pvcreate vgcreate vgs \
+; do
     try_quiet command -v "${CMD}" ||\
         error "required tool not found: ${CMD}"
 done
@@ -70,33 +77,44 @@ done
     error "${PARTITION} is not a block device"
 try_quiet findmnt --source "${PARTITION}" &&\
     error "${PARTITION} is already mounted"
+try_quiet cryptsetup isLuks "${PARTITION}" &&\
+    error "${PARTITION} is already a LUKS container"
 # inputs sanity check: NAME_VOLGROUP
 check_chars_legality "${NAME_VOLGROUP}" "volume group name"
 try_quiet vgs "${NAME_VOLGROUP}" &&\
     error "volume group '${NAME_VOLGROUP}' already exists"
-# inputs sanity check: BOOT_LABEL
-check_chars_legality "${BOOT_LABEL}" "boot label"
-[ -e "${PATH_EFI}/${BOOT_LABEL}" ] &&\
-    error "${PATH_EFI}/${BOOT_LABEL} already exists"
+# inputs sanity check: NAME_LUKS
+[ -e "${PATH_LUKS_MAPPER}" ] &&\
+    error "${PATH_LUKS_MAPPER} already exists"
+# inputs sanity check: NAME_BOOT
+check_chars_legality "${NAME_BOOT}" "boot label"
+[ -e "${PATH_EFI}/${NAME_BOOT}" ] &&\
+    error "${PATH_EFI}/${NAME_BOOT} already exists"
 efibootmgr \
     | sed -n 's/^Boot[0-9A-Fa-f]\{4\}[* ] //p' \
     | awk '{print $1}' \
-    | grep -Fxq "${BOOT_LABEL}" &&\
-    error "an EFI boot entry named '${BOOT_LABEL}' already exists"
+    | grep -Fxq "${NAME_BOOT}" &&\
+    error "an EFI boot entry named '${NAME_BOOT}' already exists"
 
 # run inputs by user and ask for confirmation
 msg 'Your installation setup choices:'
 msg '- target partition (WILL BE ERASED!): [ %s ]' "${PARTITION}"
-msg '- how to name new volume group: [ %s ]' "${NAME_VOLGROUP}"
-msg '- boot label to register with EFI: [ %s ]' "${BOOT_LABEL}"
+msg '- how to name new volume group, boot option, LUKS mapper: [ %s ]' \
+    "${NAME_VOLGROUP}"
 msg_nonl 'To continue, type "YES!" (all caps, exclamation mark, no quotes): '
 read -r CONFIRM
 [ "${CONFIRM}" = 'YES!' ] ||\
     die 'ABORTED: expected confirmation not given.'
 
+# encrypt partition
+msg 'Formatting %s as LUKS container …' "${PARTITION}"
+cryptsetup luksFormat "${PARTITION}"
+msg 'Opening LUKS container as "%s" …' "${NAME_LUKS}"
+cryptsetup luksOpen "${PARTITION}" "${NAME_LUKS}"
+
 # set up LVM and filesystem
 msg 'Creating volume group "%s" there …' "${NAME_VOLGROUP}"
-vgcreate "${NAME_VOLGROUP}" "${PARTITION}"
+vgcreate "${NAME_VOLGROUP}" "${PATH_LUKS_MAPPER}"
 msg 'Creating logical volume "%s" there …' "${NAME_ROOT}"
 lvcreate -l '100%FREE' -n "${NAME_ROOT}" "${NAME_VOLGROUP}"
 msg 'Creating EXT4 filesystem …'
@@ -108,35 +126,48 @@ mkdir -p "${PATH_MNT}"
 mount "${LOGVOL_ROOT}" "${PATH_MNT}"
 msg 'Installing Debian Suite "%s" there via debootstrap …' "${DEB_SUITE}"
 debootstrap "${DEB_SUITE}" "${PATH_MNT}"
-msg 'For chroot environment also mounting %s into there …' "${PATH_DEV}"
-mount --rbind "${PATH_DEV}" "${DEV_SLAVE}"
-mount --make-rslave "${DEV_SLAVE}"
+for NAME in ${TO_RBIND}; do
+    PATH_NAME="/${NAME}"
+    SLAVE="${PATH_MNT}${PATH_NAME}"
+    msg 'For chroot environment also mounting %s into there …' "${PATH_NAME}"
+    mount --rbind "${PATH_NAME}" "${SLAVE}"
+    mount --make-rslave "${SLAVE}"
+done
 
 # set up minimal fstab
 msg 'Writing fstab …'
 printf '%s / ext4 errors=remount-ro 0 1\n' "${LOGVOL_ROOT}"\
         >| "${PATH_MNT_FSTAB}"
 
+# set up crypttab
+msg 'Writing crypttab …'
+printf '%s UUID=%s none luks\n' \
+    "${NAME_LUKS}" "$(cryptsetup luksUUID "${PARTITION}")" \
+    >| "${PATH_MNT_CRYPTTAB}"
+cat "${PATH_MNT_CRYPTTAB}"
+
 # set up kernel, initrd
 msg 'Into chroot environment installing LVM tools, kernel, initrd …'
 chroot_sh "apt-get -qq update"
-chroot_sh "apt-get -qq install -y lvm2 linux-image-amd64"
+chroot_sh \
+    "DEBIAN_FRONTEND=noninteractive apt-get -qq install -y \
+    cryptsetup cryptsetup-initramfs lvm2 linux-image-amd64"
 
 # install kernel and initrd into EFI tree/vars
-msg 'EFI setup: copying kernel and initrd into %s …' "${PATH_EFI_BOOT_LABEL}"
-mkdir "${PATH_EFI_BOOT_LABEL}"
+msg 'EFI setup: copying kernel and initrd into %s …' "${PATH_EFI_NAME_BOOT}"
+mkdir "${PATH_EFI_NAME_BOOT}"
 for FILENAME in "${NAME_INITRD}" "${NAME_VMLINUZ}"; do
-    cp "${PATH_MNT}/${FILENAME}" "${PATH_EFI_BOOT_LABEL}/"
+    cp "${PATH_MNT}/${FILENAME}" "${PATH_EFI_NAME_BOOT}/"
 done
-msg 'EFI setup: adding boot entry %s …' "${BOOT_LABEL}"
+msg 'EFI setup: adding boot entry %s …' "${NAME_BOOT}"
 efibootmgr \
     --create \
     --quiet \
     --disk "${PATH_BOOT_DEVICE}" \
     --part "${IDX_BOOT_PARTITION}" \
-    --label "${BOOT_LABEL}" \
-    --loader "${BOOT_LABEL}/${NAME_VMLINUZ}" \
-    --unicode "root=${LOGVOL_ROOT} ro initrd=${BOOT_LABEL}\\${NAME_INITRD}"
+    --label "${NAME_BOOT}" \
+    --loader "${NAME_BOOT}/${NAME_VMLINUZ}" \
+    --unicode "root=${LOGVOL_ROOT} ro initrd=${NAME_BOOT}\\${NAME_INITRD}"
 
 # ask root login at latest possible moment, so that on fails: less left undone
 msg 'Setting up root login …'
@@ -144,6 +175,11 @@ chroot_sh "passwd"
 
 # clean up mounts
 msg 'Mostly done! Now unmounting chroot environment …'
-umount -R "${DEV_SLAVE}"
+for NAME in ${TO_RBIND}; do
+    umount -R "${PATH_MNT}/${NAME}"
+done
 umount "${PATH_MNT}"
+msg 'Deactivating volume group and closing LUKS container …'
+vgchange -an "${NAME_VOLGROUP}"
+cryptsetup luksClose "${NAME_LUKS}"
 msg 'Finished!'