ShadowArch/EtcFiles/shadowarch

219 lines
8.2 KiB
Plaintext
Raw Permalink Normal View History

2016-08-04 12:30:21 -05:00
#!/bin/bash
function header () {
tput setaf 1
tput bold
echo $@
2016-08-04 12:30:21 -05:00
tput sgr0
return
}
function help() {
cat <<EOM
Usage: ${0} [OPTIONS]
-A -- Audio optimizations from the Arch Wiki
-d DISK -- Use the disk.
-D diskspacer -- the disk spacer character, usually p for nvme
-e -- Encrypt the root partition
-h -- This helptext
-l FILE -- Log to a file
-m -- Skip disk operations and assume storage is mounted on /mnt. Use this to lay out LVM RAID.
-M -- Tell pacman to use your local AniNIX/Maat caching
-P -- Power saving for laptops
-s -- Increase the boot size to be able to accept ISOs
-v -- Verbose output.
Example default build for nvme local node:
$0 -M -d /dev/nvme0n1 -D p [ -e ]
EOM
2016-08-04 12:30:21 -05:00
exit 1;
}
disk="/dev/sda"
unset diskspacer
2018-02-14 03:20:12 -06:00
bootsize=500; # Size in MB for /boot
while getopts "Ad:D:el:pmMsv" OPTION
2016-08-04 12:30:21 -05:00
do
case $OPTION in
A) audio=1 ;;
2016-08-04 12:30:21 -05:00
d) disk=${OPTARG} ;;
D) diskspacer=${OPTARG} ;;
2016-11-16 16:23:52 -06:00
e) encrypt=1 ;;
2018-02-14 03:20:12 -06:00
l) exec script -e -f -c "/bin/bash $0 $(echo $@ | sed "s#-l ${OPTARG}##")" "${OPTARG}" ;;
m) nodiskbuild=1 ;;
P) powersave=1 ;;
M) echo "Server = http://Maat.MSN0.AniNIX.net:9129/repo/archlinux/\$repo/os/\$arch" > /etc/pacman.d/mirrorlist ;;
s) bootsize=10000 ;;
2018-02-14 03:20:12 -06:00
v) set -x ;;
2016-08-04 12:30:21 -05:00
*) help
esac
done
header Confirm options:
cat <<EOM
Boot size as ${bootsize}
Encryption set to: $encrypt
Disk to use: $disk \(Skip disk building? $nodiskbuild \)
EOM
read -p "Is this OK? Type YES to continue: " answer
2016-08-04 12:30:21 -05:00
if [ "$answer" != "YES" ]; then
echo User did not confirm.
exit 1;
fi
umount /mnt/boot; umount /mnt
2020-06-15 17:14:56 -05:00
2016-08-30 14:20:55 -05:00
pacman -Syy
2018-02-14 03:20:12 -06:00
if [ -z "$nodiskbuild" ]; then
2016-11-29 15:00:15 -06:00
header Allocating space
2018-02-14 03:20:12 -06:00
dd if=/dev/zero of="$disk" bs=1M count=1000
parted -s "$disk" mklabel gpt
parted -s "$disk" mkpart 1 fat32 1MiB ${bootsize}MiB
parted -s "$disk" toggle 1 boot
parted -s "$disk" mkpart 2 ext4 ${bootsize}MiB 100%FREE
2018-02-14 03:20:12 -06:00
header Making fat esp partition on "$disk""$diskspacer""1"
mkfs.fat -F32 "$disk""$diskspacer""1"
2016-08-04 12:30:21 -05:00
2016-11-29 15:00:15 -06:00
header Making root and mountpoints
header Making rootvg on "$disk""$diskspacer""2"
pvcreate "$disk""$diskspacer""2"
vgcreate rootvg "$disk""$diskspacer""2"
lvcreate -n rootlv -L5G rootvg
if [ ! -z "$encrypt" ]; then
header Making encrypted root on /dev/rootvg/rootlv
2016-11-29 15:00:15 -06:00
modprobe dm-crypt
modprobe serpent_generic
header Formatting root -- make sure to enter YES followed by a strong passphrase.
cryptsetup luksFormat -c serpent-xts-plain64 -h sha512 --key-size 512 /dev/rootvg/rootlv
2016-11-29 15:00:15 -06:00
header Unlocking root
cryptsetup luksOpen /dev/rootvg/rootlv cryptroot
mkfs.ext4 /dev/mapper/cryptroot
#mkfs.xfs -f /dev/mapper/cryptroot
#xfs_admin -L ROOT /dev/mapper/cryptroot
2016-11-29 15:00:15 -06:00
mount /dev/mapper/cryptroot /mnt
if [ $? -ne 0 ]; then header ERROR: Cannot continue; exit 1; fi
else
header Making root on /dev/rootvg/rootlv
mkfs.ext4 /dev/rootvg/rootlv
#mkfs.xfs -f /dev/mapper/cryptroot
#xfs_admin -L ROOT "$disk""$diskspacer""2"
mount /dev/rootvg/rootlv /mnt
2016-11-29 15:00:15 -06:00
if [ $? -ne 0 ]; then header ERROR: Cannot continue; exit 1; fi
fi
2016-08-04 12:30:21 -05:00
2016-11-29 15:00:15 -06:00
mkdir /mnt/boot
mount "$disk""$diskspacer""1" /mnt/boot
2018-02-14 03:20:12 -06:00
if [ "$?" -ne 0 ]; then header ERROR: Cannot continue; exit 1; fi
2016-11-29 15:00:15 -06:00
fi
2016-11-16 16:23:52 -06:00
# Backup the installer
mkdir -p /mnt/root
cp /root/shadowarch /mnt/root/shadowarch.installer."$(date +%F-%R)"
2016-08-04 12:30:21 -05:00
# Install ArchLinux with basic clients for the AniNIX Services.
2016-08-30 14:20:55 -05:00
# * git for Foundation
# * elinks for WebServer and Wiki
2016-08-04 12:30:21 -05:00
# * openssh for SSH/SFTP
# * weechat for IRC
2016-08-04 12:30:21 -05:00
# * make for source packages
2016-11-16 16:23:52 -06:00
header Installing ArchLinux to device\(s\) on /mnt
yes "" | pacstrap -K -i /mnt base base-devel linux linux-firmware parted net-tools bind-tools git openssh rsync make elinks weechat vim wget grub os-prober tmux efibootmgr xfsprogs chrony less lvm2 dmraid netctl dhcpcd openresolv python3 vim
2016-11-16 16:23:52 -06:00
if [ $? -ne 0 ]; then header ERROR: Cannot continue -- pacstrap failed; exit 1; fi
2016-11-29 15:00:15 -06:00
2016-08-04 12:30:21 -05:00
header Create FSTAB
genfstab -U /mnt >> /mnt/etc/fstab
header Set time
sed -i 's/#en_US.UTF-8/en_US.UTF-8/' /mnt/etc/locale.gen
arch-chroot /mnt locale-gen
2017-07-27 15:30:48 -05:00
ln -sf /usr/share/zoneinfo/America/Chicago /mnt/etc/localtime
2016-08-04 12:30:21 -05:00
arch-chroot /mnt hwclock --systohc --utc
header Setup bootloader
2018-02-14 03:20:12 -06:00
if [ -z "$nodiskbuild" ]; then
export rootuuid="$(blkid "$disk""$diskspacer""2" | cut -f 2 -d '"')"
export hookstring="$(grep 'HOOKS=' /mnt/etc/mkinitcpio.conf | grep -v '#')"
2018-02-14 03:20:12 -06:00
if [ ! -z "$encrypt" ]; then
sed -i 's#'"$hookstring"'#HOOKS="base udev autodetect modconf block lvm2 dmraid encrypt filesystems keyboard fsck"#' /mnt/etc/mkinitcpio.conf
2016-11-29 15:00:15 -06:00
sed -i 's#GRUB_CMDLINE_LINUX=""#GRUB_CMDLINE_LINUX="cryptdevice=UUID='$rootuuid':cryptroot"#' /mnt/etc/default/grub
else
sed -i 's#'"$hookstring"'#HOOKS="base udev autodetect modconf block lvm2 dmraid filesystems keyboard fsck"#' /mnt/etc/mkinitcpio.conf
2016-11-29 15:00:15 -06:00
fi
sed -i 's/GRUB_CMDLINE_LINUX_DEFAULT="/GRUB_CMDLINE_LINUX_DEFAULT="panic=5 /' /etc/default/grub # Fix for CVE-2016-4484
2018-02-14 03:20:12 -06:00
arch-chroot /mnt grub-install --target=x86_64-efi --removable --bootloader-id=grub --efi-directory /boot "$disk"
if [ $? -ne 0 ]; then header ERROR: Cannot continue; exit 1; fi
2016-11-16 16:23:52 -06:00
fi
# Remake initramfs for new changes.
arch-chroot /mnt mkinitcpio -P
2016-08-30 14:20:55 -05:00
arch-chroot /mnt grub-mkconfig -o /boot/grub/grub.cfg
if [ $? -ne 0 ]; then header ERROR: Cannot continue; exit 1; fi
2016-08-04 12:30:21 -05:00
header Set networking
arch-chroot /mnt systemctl enable chronyd
# This part may fail if there are multiple NICs. Given our hardware posture, this is rare.
export interface=$(ip link list | grep "state" | cut -f 2 -d ":" | cut -f 2 -d " " | grep -vE lo\|wlan)
2016-08-04 12:30:21 -05:00
cp /mnt/etc/netctl/examples/ethernet-dhcp /mnt/etc/netctl/$interface
sed -i 's/eth0/'$interface'/' /mnt/etc/netctl/$interface
echo 'DNSSearch="aninix.net"' >> /mnt/etc/netctl/$interface
arch-chroot /mnt systemctl enable netctl
arch-chroot /mnt netctl enable $interface
# Optimizations from https://wiki.archlinux.org/index.php/Power_management
2018-02-14 03:20:12 -06:00
if [ ! -z "$powersave" ]; then
if [ `lspci | grep -i intel | grep -ic audio` -eq 1 ]; then
echo 'options snd_hda_intel power_save=1' > /mnt/etc/modprobe.d/audio_powersave.conf
else
echo 'options snd_ac97_codec power_save=1' > /mnt/etc/modprobe.d/audio_powersave.conf
fi
arch-chroot /mnt pacman -S rfkill cpupower --noconfirm
arch-chroot /mnt systemctl enable rfkill-block@.service
echo 'kernel.nmi_watchdog = 0' > /mnt/etc/sysctl.d/disable_watchdog.conf
echo 'vm.dirty_writeback_centisecs = 6000' > /mnt/etc/sysctl.d/dirty_writes.conf
echo 'vm.laptop_mode = 5' > /mnt/etc/sysctl.d/laptop.conf
echo 'ACTION=="add", SUBSYSTEM=="net", KERNEL=="wlan*", RUN+="/usr/bin/iw dev %k set power_save on"' > /mnt/etc/udev/rules.d/70-wifi-powersave.rules
echo 'blacklist uvcvideo' > /mnt/etc/modprobe.d/no-camera.conf
fi
# Thanks to https://wiki.archlinux.org/index.php/Professional_audio
2018-02-14 03:20:12 -06:00
if [ ! -z "$audio" ]; then
sed -i 's#GRUB_CMDLINE_LINUX_DEFAULT="#GRUB_CMDLINE_LINUX_DEFAULT="threadirqs #' /mnt/etc/default/grub
arch-chroot /mnt grub-mkconfig -o /boot/grub/grub.cfg
printf 'vm.swappiness = 10\nfs.inotify.max_user_watches = 524288\n' > /mnt/etc/sysctl.d/99-audio-tuning.conf
setpci -v -d *:* latency_timer=b0
for SOUND_CARD_PCI_ID in `lspci | grep -i audio | cut -f 1 -d ' '`; do
setpci -v -s $SOUND_CARD_PCI_ID latency_timer=ff;
done
printf 'echo 2048 > /sys/class/rtc/rtc0/max_user_freq\necho 2048 > /proc/sys/dev/hpet/max-user-freq\n' >> /mnt/etc/rc.local
fi
2016-08-04 12:30:21 -05:00
# Set password
2016-11-16 16:23:52 -06:00
header Set new root passphrase and depriviledged user '(depriv)' password.
arch-chroot /mnt useradd depriv
2016-08-04 12:30:21 -05:00
arch-chroot /mnt passwd
2016-11-16 16:23:52 -06:00
arch-chroot /mnt passwd depriv
2016-08-04 12:30:21 -05:00
# Set SSH host keys
arch-chroot /mnt ssh-keygen -A
# Set hostname
header Set hostname
2020-06-15 17:14:56 -05:00
printf "What is your fully-qualified hostname? (i.e. host.site.example.com) "
read hostname
echo "$hostname" > /mnt/etc/hostname
header "Installed ShadowArch on $HOSTNAME!"
2018-02-14 03:20:12 -06:00
if [ ! -z "$nodiskbuild" ]; then
2016-11-16 16:23:52 -06:00
header Remember to run grub-install and set up your bootloader.
echo 'https://wiki.archlinux.org/index.php/Installation_guide#Boot_loader'
else
2016-11-29 15:00:15 -06:00
header Press enter to reboot.
read
2016-08-04 12:30:21 -05:00
2016-11-29 15:00:15 -06:00
# Reboot
shutdown -r now
2016-11-16 16:23:52 -06:00
fi