mirror of
https://github.com/fscotto/infra.git
synced 2026-09-27 11:02:47 +00:00
92 lines
2.6 KiB
Plaintext
92 lines
2.6 KiB
Plaintext
# Bootstrap monouso per Fedora CoreOS su Aegis.
|
|
# Sostituire le chiavi SSH prima di generare Ignition con butane --strict.
|
|
variant: fcos
|
|
version: 1.6.0
|
|
passwd:
|
|
users:
|
|
- name: core
|
|
ssh_authorized_keys:
|
|
- "ssh-ed25519 CHANGEME_AEGIS_SSH_PUBLIC_KEY"
|
|
- name: pi
|
|
ssh_authorized_keys:
|
|
- "ssh-ed25519 CHANGEME_AEGIS_SSH_PUBLIC_KEY"
|
|
storage:
|
|
disks:
|
|
- device: /dev/mmcblk0
|
|
wipe_table: false
|
|
partitions:
|
|
- label: aegis-data
|
|
number: 5
|
|
size_mib: 0
|
|
files:
|
|
- path: /etc/hostname
|
|
mode: 0644
|
|
contents:
|
|
inline: |
|
|
aegis
|
|
- path: /etc/crypttab
|
|
mode: 0644
|
|
contents:
|
|
append:
|
|
- inline: |
|
|
aegis-data /dev/disk/by-partlabel/aegis-data - tpm2-device=auto
|
|
- path: /etc/fstab
|
|
mode: 0644
|
|
contents:
|
|
append:
|
|
- inline: |
|
|
/dev/mapper/aegis-data /var/lib btrfs defaults,compress=zstd 0 0
|
|
- path: /usr/local/sbin/aegis-storage-init
|
|
mode: 0750
|
|
user:
|
|
name: root
|
|
group:
|
|
name: root
|
|
contents:
|
|
inline: |
|
|
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
device=/dev/disk/by-partlabel/aegis-data
|
|
mapper=aegis-data
|
|
key_file=/run/aegis-storage/key
|
|
marker=/etc/aegis-storage.initialized
|
|
|
|
if [[ -e "$marker" ]]; then
|
|
exit 0
|
|
fi
|
|
|
|
trap 'rm -f "$key_file"' EXIT
|
|
install -d -m 0700 /run/aegis-storage
|
|
dd if=/dev/urandom of="$key_file" bs=64 count=1 status=none
|
|
chmod 0600 "$key_file"
|
|
|
|
cryptsetup luksFormat --batch-mode --type luks2 --key-file="$key_file" "$device"
|
|
systemd-cryptenroll --tpm2-device=auto --unlock-key-file="$key_file" "$device"
|
|
cryptsetup open --key-file="$key_file" "$device" "$mapper"
|
|
mkfs.btrfs -L aegis-data "/dev/mapper/$mapper"
|
|
mount "/dev/mapper/$mapper" /var/lib
|
|
touch "$marker"
|
|
|
|
- path: /etc/systemd/system/aegis-storage-init.service
|
|
mode: 0644
|
|
contents:
|
|
inline: |
|
|
[Unit]
|
|
Description=Initialize the TPM-backed Aegis data volume
|
|
Wants=systemd-udev-settle.service
|
|
After=systemd-udev-settle.service
|
|
Before=local-fs.target
|
|
ConditionPathExists=!/etc/aegis-storage.initialized
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/sbin/aegis-storage-init
|
|
|
|
[Install]
|
|
WantedBy=local-fs-pre.target
|
|
systemd:
|
|
units:
|
|
- name: aegis-storage-init.service
|
|
enabled: true
|