From: Plom Heller Date: Fri, 28 Aug 2026 12:23:18 +0000 (+0200) Subject: Add encryption, collect same argument for vg name, boot label and LUKS mapper. X-Git-Url: https://plomlompom.com/repos/booking/%22https:/validator.w3.org/processes?a=commitdiff_plain;h=5398b43713d3aff36b9bef9a6516dc464ad5c5eb;p=confplom Add encryption, collect same argument for vg name, boot label and LUKS mapper. --- diff --git a/install_debian.sh b/install_debian.sh index d7de2c0..998f0d7 100755 --- a/install_debian.sh +++ b/install_debian.sh @@ -3,11 +3,14 @@ set -Ceu SCRIPT_NAME=$0 # constants unlikely to change -PATH_DEV=/dev -PATH_EFI=/boot/efi -PATH_FSTAB=/etc/fstab +NAME_DEV=dev NAME_INITRD=initrd.img NAME_VMLINUZ=vmlinuz +PATH_CRYPTTAB=/etc/crypttab +PATH_DEV="/${NAME_DEV}" +PATH_EFI=/boot/efi +PATH_FSTAB=/etc/fstab +TO_RBIND="${NAME_DEV} proc sys" # constants we might want to change at some point DEB_SUITE=trixie @@ -47,20 +50,24 @@ chroot_sh() { } # inputs to confirm -[ $# -eq 3 ]\ - || die "usage: $0 " +[ $# -eq 2 ]\ + || die "usage: $0 " PARTITION=$1 NAME_VOLGROUP=$2 -BOOT_LABEL=$3 +NAME_BOOT="${NAME_VOLGROUP}" +NAME_LUKS="${NAME_VOLGROUP}" # constants derived from changeables LOGVOL_ROOT="${PATH_DEV}/${NAME_VOLGROUP}/${NAME_ROOT}" -PATH_EFI_BOOT_LABEL="${PATH_EFI}/${BOOT_LABEL}" -DEV_SLAVE="${PATH_MNT}${PATH_DEV}" +PATH_EFI_NAME_BOOT="${PATH_EFI}/${NAME_BOOT}" +PATH_LUKS_MAPPER="${PATH_DEV}/mapper/${NAME_LUKS}" +PATH_MNT_CRYPTTAB="${PATH_MNT}${PATH_CRYPTTAB}" PATH_MNT_FSTAB="${PATH_MNT}${PATH_FSTAB}" # sanity checks: required tools -for CMD in debootstrap efibootmgr lvcreate pvcreate vgcreate vgs; do +for CMD in \ + cryptsetup debootstrap efibootmgr lvcreate pvcreate vgcreate vgs \ +; do try_quiet command -v "${CMD}" ||\ error "required tool not found: ${CMD}" done @@ -70,33 +77,44 @@ done error "${PARTITION} is not a block device" try_quiet findmnt --source "${PARTITION}" &&\ error "${PARTITION} is already mounted" +try_quiet cryptsetup isLuks "${PARTITION}" &&\ + error "${PARTITION} is already a LUKS container" # inputs sanity check: NAME_VOLGROUP check_chars_legality "${NAME_VOLGROUP}" "volume group name" try_quiet vgs "${NAME_VOLGROUP}" &&\ error "volume group '${NAME_VOLGROUP}' already exists" -# inputs sanity check: BOOT_LABEL -check_chars_legality "${BOOT_LABEL}" "boot label" -[ -e "${PATH_EFI}/${BOOT_LABEL}" ] &&\ - error "${PATH_EFI}/${BOOT_LABEL} already exists" +# inputs sanity check: NAME_LUKS +[ -e "${PATH_LUKS_MAPPER}" ] &&\ + error "${PATH_LUKS_MAPPER} already exists" +# inputs sanity check: NAME_BOOT +check_chars_legality "${NAME_BOOT}" "boot label" +[ -e "${PATH_EFI}/${NAME_BOOT}" ] &&\ + error "${PATH_EFI}/${NAME_BOOT} already exists" efibootmgr \ | sed -n 's/^Boot[0-9A-Fa-f]\{4\}[* ] //p' \ | awk '{print $1}' \ - | grep -Fxq "${BOOT_LABEL}" &&\ - error "an EFI boot entry named '${BOOT_LABEL}' already exists" + | grep -Fxq "${NAME_BOOT}" &&\ + error "an EFI boot entry named '${NAME_BOOT}' already exists" # run inputs by user and ask for confirmation msg 'Your installation setup choices:' msg '- target partition (WILL BE ERASED!): [ %s ]' "${PARTITION}" -msg '- how to name new volume group: [ %s ]' "${NAME_VOLGROUP}" -msg '- boot label to register with EFI: [ %s ]' "${BOOT_LABEL}" +msg '- how to name new volume group, boot option, LUKS mapper: [ %s ]' \ + "${NAME_VOLGROUP}" msg_nonl 'To continue, type "YES!" (all caps, exclamation mark, no quotes): ' read -r CONFIRM [ "${CONFIRM}" = 'YES!' ] ||\ die 'ABORTED: expected confirmation not given.' +# encrypt partition +msg 'Formatting %s as LUKS container …' "${PARTITION}" +cryptsetup luksFormat "${PARTITION}" +msg 'Opening LUKS container as "%s" …' "${NAME_LUKS}" +cryptsetup luksOpen "${PARTITION}" "${NAME_LUKS}" + # set up LVM and filesystem msg 'Creating volume group "%s" there …' "${NAME_VOLGROUP}" -vgcreate "${NAME_VOLGROUP}" "${PARTITION}" +vgcreate "${NAME_VOLGROUP}" "${PATH_LUKS_MAPPER}" msg 'Creating logical volume "%s" there …' "${NAME_ROOT}" lvcreate -l '100%FREE' -n "${NAME_ROOT}" "${NAME_VOLGROUP}" msg 'Creating EXT4 filesystem …' @@ -108,35 +126,48 @@ mkdir -p "${PATH_MNT}" mount "${LOGVOL_ROOT}" "${PATH_MNT}" msg 'Installing Debian Suite "%s" there via debootstrap …' "${DEB_SUITE}" debootstrap "${DEB_SUITE}" "${PATH_MNT}" -msg 'For chroot environment also mounting %s into there …' "${PATH_DEV}" -mount --rbind "${PATH_DEV}" "${DEV_SLAVE}" -mount --make-rslave "${DEV_SLAVE}" +for NAME in ${TO_RBIND}; do + PATH_NAME="/${NAME}" + SLAVE="${PATH_MNT}${PATH_NAME}" + msg 'For chroot environment also mounting %s into there …' "${PATH_NAME}" + mount --rbind "${PATH_NAME}" "${SLAVE}" + mount --make-rslave "${SLAVE}" +done # set up minimal fstab msg 'Writing fstab …' printf '%s / ext4 errors=remount-ro 0 1\n' "${LOGVOL_ROOT}"\ >| "${PATH_MNT_FSTAB}" +# set up crypttab +msg 'Writing crypttab …' +printf '%s UUID=%s none luks\n' \ + "${NAME_LUKS}" "$(cryptsetup luksUUID "${PARTITION}")" \ + >| "${PATH_MNT_CRYPTTAB}" +cat "${PATH_MNT_CRYPTTAB}" + # set up kernel, initrd msg 'Into chroot environment installing LVM tools, kernel, initrd …' chroot_sh "apt-get -qq update" -chroot_sh "apt-get -qq install -y lvm2 linux-image-amd64" +chroot_sh \ + "DEBIAN_FRONTEND=noninteractive apt-get -qq install -y \ + cryptsetup cryptsetup-initramfs lvm2 linux-image-amd64" # install kernel and initrd into EFI tree/vars -msg 'EFI setup: copying kernel and initrd into %s …' "${PATH_EFI_BOOT_LABEL}" -mkdir "${PATH_EFI_BOOT_LABEL}" +msg 'EFI setup: copying kernel and initrd into %s …' "${PATH_EFI_NAME_BOOT}" +mkdir "${PATH_EFI_NAME_BOOT}" for FILENAME in "${NAME_INITRD}" "${NAME_VMLINUZ}"; do - cp "${PATH_MNT}/${FILENAME}" "${PATH_EFI_BOOT_LABEL}/" + cp "${PATH_MNT}/${FILENAME}" "${PATH_EFI_NAME_BOOT}/" done -msg 'EFI setup: adding boot entry %s …' "${BOOT_LABEL}" +msg 'EFI setup: adding boot entry %s …' "${NAME_BOOT}" efibootmgr \ --create \ --quiet \ --disk "${PATH_BOOT_DEVICE}" \ --part "${IDX_BOOT_PARTITION}" \ - --label "${BOOT_LABEL}" \ - --loader "${BOOT_LABEL}/${NAME_VMLINUZ}" \ - --unicode "root=${LOGVOL_ROOT} ro initrd=${BOOT_LABEL}\\${NAME_INITRD}" + --label "${NAME_BOOT}" \ + --loader "${NAME_BOOT}/${NAME_VMLINUZ}" \ + --unicode "root=${LOGVOL_ROOT} ro initrd=${NAME_BOOT}\\${NAME_INITRD}" # ask root login at latest possible moment, so that on fails: less left undone msg 'Setting up root login …' @@ -144,6 +175,11 @@ chroot_sh "passwd" # clean up mounts msg 'Mostly done! Now unmounting chroot environment …' -umount -R "${DEV_SLAVE}" +for NAME in ${TO_RBIND}; do + umount -R "${PATH_MNT}/${NAME}" +done umount "${PATH_MNT}" +msg 'Deactivating volume group and closing LUKS container …' +vgchange -an "${NAME_VOLGROUP}" +cryptsetup luksClose "${NAME_LUKS}" msg 'Finished!'