110 lines
2.9 KiB
Bash
Executable File
110 lines
2.9 KiB
Bash
Executable File
#!/bin/sh
|
|
set -v
|
|
|
|
# Based on
|
|
# https://wiki.alpinelinux.org/wiki/LVM_on_LUKS
|
|
|
|
# Prerequisites for this script
|
|
# setup-interfaces
|
|
# ifup eth0
|
|
|
|
# Ask for passwords
|
|
read -sp 'Encryption password:' ENCPWD
|
|
echo
|
|
|
|
# Set up repositories
|
|
cat <<EOF >/etc/apk/repositories
|
|
http://dl-cdn.alpinelinux.org/alpine/v3.15/main
|
|
http://dl-cdn.alpinelinux.org/alpine/v3.15/community
|
|
EOF
|
|
|
|
# Install disk management tools
|
|
apk --no-cache add lvm2 cryptsetup e2fsprogs syslinux
|
|
|
|
# Create disk partitions
|
|
cat <<EOF | fdisk /dev/sda
|
|
n
|
|
p
|
|
1
|
|
|
|
+50m
|
|
a
|
|
1
|
|
n
|
|
p
|
|
2
|
|
|
|
|
|
EOF
|
|
|
|
# Set up partition encryption
|
|
echo -n "${ENCPWD}" | cryptsetup -q luksFormat /dev/sda2
|
|
echo -n "${ENCPWD}" | cryptsetup open --type luks /dev/sda2 system
|
|
|
|
# Set up LVM
|
|
pvcreate /dev/mapper/system
|
|
vgcreate vg0 /dev/mapper/system
|
|
lvcreate -l 100%FREE vg0 -n root
|
|
|
|
# Format
|
|
mkfs.ext4 -m0 /dev/sda1
|
|
mkfs.ext4 -m1 /dev/vg0/root
|
|
|
|
# Mount
|
|
mount -t ext4 /dev/vg0/root /mnt
|
|
mkdir /mnt/boot
|
|
mount -t ext4 /dev/sda1 /mnt/boot
|
|
|
|
# Install Alpine linux
|
|
setup-disk -m sys /mnt
|
|
|
|
# Update boot-time volume information
|
|
export BOOT_UUID=$(blkid -s UUID -o value /dev/sda1)
|
|
export CRYPT_UUID=$(blkid -s UUID -o value /dev/sda2)
|
|
cat <<EOF >/mnt/etc/fstab
|
|
/dev/vg0/root / ext4 rw,noatime,data=ordered 0 1
|
|
UUID=${BOOT_UUID} /boot ext4 rw,noatime,data=ordered 0 2
|
|
/dev/vg0/swap swap swap defaults 0 0
|
|
EOF
|
|
echo "system UUID=${CRYPT_UUID} none luks" >/mnt/etc/crypttab
|
|
|
|
# Update extlinux (ignore the errors)
|
|
sed -i "s/crypdm=root/cryptdm=system/" /mnt/etc/update-extlinux.conf
|
|
chroot /mnt update-extlinux
|
|
sed -i 's/overwrite=1/overwrite=0/' /mnt/etc/update-extlinux.conf
|
|
|
|
# Set time zone
|
|
chroot /mnt setup-timezone -z Europe/Prague
|
|
|
|
# Install basic system
|
|
apk --no-cache add apache2-utils gettext
|
|
wget https://repo.spotter.cz/vm.tar.gz -O - | tar xzf - -C /mnt
|
|
envsubst </mnt/boot/extlinux.conf >/mnt/boot/extlinux.conf.new
|
|
mv /mnt/boot/extlinux.conf.new /mnt/boot/extlinux.conf
|
|
chroot /mnt apk --no-cache add ca-certificates curl e2fsprogs-extra gettext kbd-misc logrotate postfix nginx openssh-server openssh-sftp-server util-linux podman spoc@spotter vmmgr@spotter
|
|
chroot /mnt newaliases
|
|
|
|
# Enable services
|
|
for SERVICE in cgroups consolefont crond networking nginx ntpd postfix spoc swap urandom vmmgr; do
|
|
ln -s /etc/init.d/${SERVICE} /mnt/etc/runlevels/boot
|
|
done
|
|
|
|
# Configure spoc and vmmgr
|
|
chroot /mnt adduser -D spoc
|
|
ADMINPWD=$(htpasswd -bnBC 10 '' "${ENCPWD}" | tr -d ':\n' | sed 's/$2y/$2b/') envsubst </mnt/etc/vmmgr/config.json >/mnt/etc/vmmgr/config.json.new
|
|
mv /mnt/etc/vmmgr/config.json.new /mnt/etc/vmmgr/config.json
|
|
|
|
# Cleanup
|
|
rm -rf /mnt/root
|
|
mkdir -p /mnt/root/.ssh
|
|
|
|
# Install bootloader to MBR
|
|
dd bs=440 count=1 conv=notrunc if=/mnt/usr/share/syslinux/mbr.bin of=/dev/sda
|
|
|
|
# Unmount and shut down
|
|
umount /mnt/boot
|
|
umount /mnt
|
|
vgchange -a n
|
|
cryptsetup luksClose system
|
|
poweroff
|