# Bootstrap monouso per Fedora CoreOS su Aegis.
# Sostituire le chiavi SSH prima di generare Ignition con butane --strict.
variant: fcos
version: 1.6.0
passwd:
  users:
    - name: core
      ssh_authorized_keys:
        - "ssh-ed25519 CHANGEME_AEGIS_SSH_PUBLIC_KEY"
    - name: pi
      ssh_authorized_keys:
        - "ssh-ed25519 CHANGEME_AEGIS_SSH_PUBLIC_KEY"
storage:
  disks:
    - device: /dev/mmcblk0
      wipe_table: false
      partitions:
        - label: aegis-data
          number: 5
          size_mib: 0
  files:
    - path: /etc/hostname
      mode: 0644
      contents:
        inline: |
          aegis
    - path: /etc/crypttab
      mode: 0644
      contents:
        inline: |
          aegis-data /dev/disk/by-partlabel/aegis-data - tpm2-device=auto
    - path: /etc/fstab
      mode: 0644
      contents:
        inline: |
          /dev/mapper/aegis-data /var/lib btrfs defaults,compress=zstd 0 0
    - path: /usr/local/sbin/aegis-storage-init
      mode: 0750
      user:
        name: root
      group:
        name: root
      contents:
        inline: |
          #!/bin/bash
          set -euo pipefail

          device=/dev/disk/by-partlabel/aegis-data
          mapper=aegis-data
          key_file=/run/aegis-storage/key
          marker=/etc/aegis-storage.initialized

          if [[ -e "$marker" ]]; then
            exit 0
          fi

          trap 'rm -f "$key_file"' EXIT
          install -d -m 0700 /run/aegis-storage
          dd if=/dev/urandom of="$key_file" bs=64 count=1 status=none
          chmod 0600 "$key_file"

          cryptsetup luksFormat --batch-mode --type luks2 --key-file="$key_file" "$device"
          systemd-cryptenroll --tpm2-device=auto --unlock-key-file="$key_file" "$device"
          cryptsetup open --key-file="$key_file" "$device" "$mapper"
          mkfs.btrfs -L aegis-data "/dev/mapper/$mapper"
          mount "/dev/mapper/$mapper" /var/lib
          touch "$marker"

    - path: /etc/systemd/system/aegis-storage-init.service
      mode: 0644
      contents:
        inline: |
          [Unit]
          Description=Initialize the TPM-backed Aegis data volume
          Wants=systemd-udev-settle.service
          After=systemd-udev-settle.service
          Before=local-fs.target
          ConditionPathExists=!/etc/aegis-storage.initialized

          [Service]
          Type=oneshot
          ExecStart=/usr/local/sbin/aegis-storage-init

          [Install]
          WantedBy=local-fs-pre.target
  systemd:
    units:
      - name: aegis-storage-init.service
        enabled: true