From: Plom Heller Date: Wed, 2 Sep 2026 14:20:55 +0000 (+0200) Subject: Add rump system-setup scripts. X-Git-Url: https://plomlompom.com/repos/task?a=commitdiff_plain;h=6dff42c21ea203248a3fb97d735f3828eb57e082;p=confplom Add rump system-setup scripts. --- diff --git a/_lib.sh b/_lib.sh index 2e24cc7..0e8c1ca 100644 --- a/_lib.sh +++ b/_lib.sh @@ -4,12 +4,13 @@ SCRIPT_NAME=$0 # constants unlikely to change NAME_DEV=dev PATH_DEV="/${NAME_DEV}" +PATH_MNT=/mnt TO_RBIND="${NAME_DEV} proc sys" # constants we might want to change at some point NAME_DATA=data NAME_SWAP=swap -PATH_MNT=/mnt/debinst +PATH_MNT_ROOT="${PATH_MNT}/root" # path constructors path_luks_mapper() { @@ -97,6 +98,7 @@ close_luksvg () { # helpers: mount/unmount root mount_privately() { local TO_MOUNT=$1 + local DEST=$2 # to facilitate later unmounting of the chrooted system: isolate our mounts # against propagation to services sandboxed with PrivateMounts=yes (e.g. # systemd-udevd), into whose private namespaces our later umount might fail @@ -104,11 +106,11 @@ mount_privately() { # vgchange -an, only to be blocked by referenced devices claimed as "busy" msg "Privatize script's process' mount namespace …" mount --make-rprivate / - + # mount and install base - msg 'Mounting %s at %s …' "${TO_MOUNT}" "${PATH_MNT}" - mkdir -p "${PATH_MNT}" - mount "${TO_MOUNT}" "${PATH_MNT}" + msg 'Mounting %s at %s …' "${TO_MOUNT}" "${DEST}" + mkdir -p "${DEST}" + mount "${TO_MOUNT}" "${DEST}" } await_path() { local TO_AWAIT=$1 @@ -122,7 +124,7 @@ await_path() { rbind_mnt() { for NAME in ${TO_RBIND}; do local PATH_NAME="/${NAME}" - local SLAVE="${PATH_MNT}${PATH_NAME}" + local SLAVE="${PATH_MNT_ROOT}${PATH_NAME}" msg 'For working chroot also mounting %s into there …' "${PATH_NAME}" mount --rbind "${PATH_NAME}" "${SLAVE}" mount --make-rslave "${SLAVE}" @@ -131,14 +133,14 @@ rbind_mnt() { unmount_unrbind() { msg 'Unmounting chroot environment …' for NAME in ${TO_RBIND}; do - umount -R "${PATH_MNT}/${NAME}" + umount -R "${PATH_MNT_ROOT}/${NAME}" done - umount "${PATH_MNT}" + umount "${PATH_MNT_ROOT}" } # helpers: miscellaneous chroot_sh() { - LANG=C.UTF-8 chroot "${PATH_MNT}" /bin/sh -c "$@" + LANG=C.UTF-8 chroot "${PATH_MNT_ROOT}" /bin/sh -c "$@" } create_lv() { local VG=$1 diff --git a/chrooted_command.sh b/chrooted_command.sh index e90665c..bcee658 100755 --- a/chrooted_command.sh +++ b/chrooted_command.sh @@ -19,7 +19,7 @@ check_input_openable_luksvg "${PARTITION}" "${NAME_LUKSVG}" # mount open_luksvg "${PARTITION}" "${NAME_LUKSVG}" await_path "${PATH_VG_ROOT}" -mount_privately "${PATH_VG_ROOT}" +mount_privately "${PATH_VG_ROOT}" "${PATH_MNT_ROOT}" rbind_mnt # enact command diff --git a/install_debian.sh b/install_debian.sh index c212aef..e723d3a 100755 --- a/install_debian.sh +++ b/install_debian.sh @@ -25,10 +25,11 @@ NAME_ROOT="${NAME_BOOT}" # constants derived from changeables PATH_EFI_NAME_BOOT="${PATH_EFI}/${NAME_BOOT}" -PATH_MNT_CRYPTTAB="${PATH_MNT}${PATH_CRYPTTAB}" -PATH_MNT_FSTAB="${PATH_MNT}${PATH_FSTAB}" -PATH_MNT_NM_CONN="${PATH_MNT}${PATH_NM_CONNECTIONS}/${FNAME_NM_CONN}" -PATH_MNT_NM_CONNECTIONS="${PATH_MNT}${PATH_NM_CONNECTIONS}" +PATH_MNT_APT_SOURCES="${PATH_MNT_ROOT}/etc/apt/sources.list" +PATH_MNT_CRYPTTAB="${PATH_MNT_ROOT}${PATH_CRYPTTAB}" +PATH_MNT_FSTAB="${PATH_MNT_ROOT}${PATH_FSTAB}" +PATH_MNT_NM_CONN="${PATH_MNT_ROOT}${PATH_NM_CONNECTIONS}/${FNAME_NM_CONN}" +PATH_MNT_NM_CONNECTIONS="${PATH_MNT_ROOT}${PATH_NM_CONNECTIONS}" PATH_VG=$(path_vg "${NAME_LUKSVG}") PATH_VG_DATA=${PATH_VG}/${NAME_DATA} PATH_VG_ROOT=${PATH_VG}/${NAME_ROOT} @@ -61,9 +62,9 @@ msg 'Creating EXT4 filesystem …' mkfs.ext4 -q "${PATH_VG_ROOT}" # mount and install base -mount_privately "${PATH_VG_ROOT}" +mount_privately "${PATH_VG_ROOT}" "${PATH_MNT_ROOT}" msg 'Installing Debian Suite "%s" there via debootstrap …' "${DEB_SUITE}" -debootstrap "${DEB_SUITE}" "${PATH_MNT}" +debootstrap "${DEB_SUITE}" "${PATH_MNT_ROOT}" rbind_mnt # set up minimal fstab @@ -83,7 +84,7 @@ printf '%s UUID=%s none luks\n' \ # enable non-free-firmware component for firmware-iwlwifi below (as debootstrap # only enables "main" by default) msg 'Enabling non-free-firmware component in target sources.list …' -sed -i 's/ main$/ main non-free-firmware/' "${PATH_MNT}/etc/apt/sources.list" +sed -i 's/ main$/ main non-free-firmware/' "${PATH_MNT_APT_SOURCES}" # set up kernel, initrd etc. msg 'Into chroot environment installing LVM tools, kernel, initrd etc. …' @@ -133,7 +134,7 @@ chmod 600 "${PATH_MNT_NM_CONN}" msg 'EFI setup: copying kernel and initrd into %s …' "${PATH_EFI_NAME_BOOT}" mkdir "${PATH_EFI_NAME_BOOT}" for FILENAME in "${FNAME_INITRD}" "${FNAME_VMLINUZ}"; do - cp "${PATH_MNT}/${FILENAME}" "${PATH_EFI_NAME_BOOT}/" + cp "${PATH_MNT_ROOT}/${FILENAME}" "${PATH_EFI_NAME_BOOT}/" done msg 'EFI setup: adding boot entry %s …' "${NAME_BOOT}" efibootmgr \ diff --git a/make_luksvg.sh b/make_luksvg.sh deleted file mode 100755 index 8db13dc..0000000 --- a/make_luksvg.sh +++ /dev/null @@ -1,47 +0,0 @@ -#!/bin/sh -. ./_lib.sh - -# inputs to confirm -usage $# "partition" "volume-group-name" -PARTITION=$1 -NAME_LUKSVG=$2 - -# constants derived from changeables -PATH_LUKS_MAPPER=$(path_luks_mapper "${NAME_LUKSVG}") -PATH_VG=$(path_vg "${NAME_LUKSVG}") -PATH_VG_DATA=${PATH_VG}/${NAME_DATA} -PATH_VG_SWAP=${PATH_VG}/${NAME_SWAP} - -# sanity checks -check_tools cryptsetup lvcreate mkfs.ext4 mkswap pvcreate vgcreate vgs -check_input_partition_mountable "${PARTITION}" -check_input_new_luksvg "${NAME_LUKSVG}" -try_quiet cryptsetup isLuks "${PARTITION}"\ - && error "${PARTITION} is already a LUKS container" - -# run inputs by user and ask for confirmation -msg 'Your formatting choices:' -msg '- target partition (WILL BE ERASED!): [ %s ]' "${PARTITION}" -msg '- name for new volume group and its LUKS mapper: [ %s ]' "${NAME_LUKSVG}" -msg_nonl 'To continue, type "YES!" (all caps, exclamation mark, no quotes): ' -read -r CONFIRM; [ "${CONFIRM}" = 'YES!' ]\ - || die 'ABORTED: expected confirmation not given.' - -# encrypt partition -msg 'Formatting %s as LUKS container …' "${PARTITION}" -cryptsetup luksFormat --batch-mode "${PARTITION}" -open_luksvg "${PARTITION}" "${NAME_LUKSVG}" - -# set up LVM and filesystems -msg 'Creating volume group "%s" inside LUKS container …' "${NAME_LUKSVG}" -vgcreate "${NAME_LUKSVG}" "${PATH_LUKS_MAPPER}" -create_lv "${NAME_LUKSVG}" "${NAME_SWAP}" 64G -msg 'Configuring as swap area …' -mkswap "${PATH_VG_SWAP}" -create_lv "${NAME_LUKSVG}" "${NAME_DATA}" 256G -msg 'Creating EXT4 filesystem …' -mkfs.ext4 -q "${PATH_VG_DATA}" - -# clean-up -close_luksvg "${NAME_LUKSVG}" -msg 'Finished!' diff --git a/setup_luksvg.sh b/setup_luksvg.sh new file mode 100755 index 0000000..432c87e --- /dev/null +++ b/setup_luksvg.sh @@ -0,0 +1,62 @@ +#!/bin/sh +. ./_lib.sh + +# inputs to confirm +usage $# "partition" "volume-group-name" +PARTITION=$1 +NAME_LUKSVG=$2 + +# constants we might want to change at some point +CONFIG_FILES_TO_COPY="start_root.sh start_home.sh _lib.sh" + +# constants derived from changeables +PATH_LUKS_MAPPER=$(path_luks_mapper "${NAME_LUKSVG}") +PATH_MNT_DATA="${PATH_MNT}/${NAME_DATA}" +PATH_MNT_DATA_CONFIG="${PATH_MNT_DATA}/config" +PATH_VG=$(path_vg "${NAME_LUKSVG}") +PATH_VG_DATA=${PATH_VG}/${NAME_DATA} +PATH_VG_SWAP=${PATH_VG}/${NAME_SWAP} + +# sanity checks +check_tools cryptsetup lvcreate mkfs.ext4 mkswap pvcreate vgcreate vgs +check_input_partition_mountable "${PARTITION}" +check_input_new_luksvg "${NAME_LUKSVG}" +try_quiet cryptsetup isLuks "${PARTITION}"\ + && error "${PARTITION} is already a LUKS container" + +# run inputs by user and ask for confirmation +msg 'Your formatting choices:' +msg '- target partition (WILL BE ERASED!): [ %s ]' "${PARTITION}" +msg '- name for new volume group and its LUKS mapper: [ %s ]' "${NAME_LUKSVG}" +msg_nonl 'To continue, type "YES!" (all caps, exclamation mark, no quotes): ' +read -r CONFIRM; [ "${CONFIRM}" = 'YES!' ]\ + || die 'ABORTED: expected confirmation not given.' + +# encrypt partition +msg 'Formatting %s as LUKS container …' "${PARTITION}" +cryptsetup luksFormat --batch-mode "${PARTITION}" +open_luksvg "${PARTITION}" "${NAME_LUKSVG}" + +# set up LVM and filesystems +msg 'Creating volume group "%s" inside LUKS container …' "${NAME_LUKSVG}" +vgcreate "${NAME_LUKSVG}" "${PATH_LUKS_MAPPER}" +create_lv "${NAME_LUKSVG}" "${NAME_SWAP}" 64G +msg 'Configuring as swap area …' +mkswap "${PATH_VG_SWAP}" +create_lv "${NAME_LUKSVG}" "${NAME_DATA}" 256G +msg 'Creating EXT4 filesystem …' +mkfs.ext4 -q "${PATH_VG_DATA}" + +# place config setup scripts +mount_privately "${PATH_VG_DATA}" "${PATH_MNT_DATA}" +mkdir "${PATH_MNT_DATA_CONFIG}" +msg 'Copying config setup scripts …' +for FNAME in ${CONFIG_FILES_TO_COPY}; do + cp "${FNAME}" "${PATH_MNT_DATA_CONFIG}/" +done +msg 'Unmounting …' +umount "${PATH_MNT_DATA}" + +# clean-up +close_luksvg "${NAME_LUKSVG}" +msg 'Finished!' diff --git a/start_home.sh b/start_home.sh new file mode 100755 index 0000000..c4c838f --- /dev/null +++ b/start_home.sh @@ -0,0 +1,12 @@ +#!/bin/sh +cd "$(dirname "$0")" || exit +. ./_lib.sh + +# constants unlikely to change +FNAME_PROFILE=.profile + +# constants derived from changeables +PATH_PROFILE="${HOME}/${FNAME_PROFILE}" + +msg 'Augmenting user %s …' "${FNAME_PROFILE}" +echo 'alias ls="ls --color=auto"' >> "${PATH_PROFILE}" diff --git a/start_root.sh b/start_root.sh new file mode 100755 index 0000000..eb57d1c --- /dev/null +++ b/start_root.sh @@ -0,0 +1,24 @@ +#!/bin/sh +cd "$(dirname "$0")" || exit +. ./_lib.sh + +# constants unlikely to change +FNAME_START_HOME=start_home.sh + +# constants we might want to change at some point +TO_INSTALL="man-db ntpsec-ntpdate sudo vim" +USERNAME=plom + +msg 'Calling %s …' "${FNAME_START_HOME}" +"./${FNAME_START_HOME}" + +msg 'Ensuring packages: %s' "${TO_INSTALL}" +apt-get -y update +apt-get -y install ${TO_INSTALL} + +msg 'Setting up user: %s' "${USERNAME}" +adduser --comment "" "${USERNAME}" +usermod -a -G sudo "${USERNAME}" + +msg 'Synchronizing clock …' +ntpsec-ntpdate