mirror of
https://github.com/fscotto/infra.git
synced 2026-09-27 19:03:47 +00:00
ae1ca44aa7
* feat(aegis): add ARM image bootstrap workflow * feat(aegis): manage firewall and SSH hardening * feat(aegis): harden Fedora IoT services * chore(aegis): remove local TLS configuration * fix(aegis): restore supported Fedora IoT bootstrap
56 lines
1.9 KiB
Plaintext
56 lines
1.9 KiB
Plaintext
# One-time bootstrap for Fedora IoT on Aegis (Raspberry Pi 4).
|
|
# Generate only: ./generate-aegis-ign.sh
|
|
# Generate and write an SD card: ./generate-aegis-ign.sh --write IMAGE DEVICE
|
|
# The write mode uses arm-image-installer with the RPi4 target and embeds
|
|
# config.ign; it prompts for Wi-Fi credentials unless supplied through its
|
|
# WIFI_SSID and WIFI_PASS environment variables.
|
|
# For WiFi, the UEFI 'System Table Selection' must be DeviceTree (Esc at boot).
|
|
variant: fiot
|
|
version: 1.0.0
|
|
passwd:
|
|
users:
|
|
- name: pi
|
|
password_hash: "$6$bNDsU0XC5BxNJS5U$ENDGpdOUPJM3wcXBgNESCQkOqqQ9gN72/xEQoJsAI6QdsaY6mD4G5DBVIv7nHwHQOP35IH1oGRl.Uy3R2iUYQ1"
|
|
groups:
|
|
- wheel
|
|
ssh_authorized_keys:
|
|
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros"
|
|
systemd:
|
|
units:
|
|
- name: sshd.service
|
|
enabled: true
|
|
- name: rpm-ostree-install-wifi.service
|
|
enabled: true
|
|
contents: |
|
|
[Unit]
|
|
Description=Layer WiFi packages (driver, firmware, NetworkManager-wifi)
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
Before=zincati.service
|
|
ConditionPathExists=!/var/lib/%N.stamp
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
ExecStart=/usr/bin/rpm-ostree install -y --allow-inactive NetworkManager-wifi NetworkManager-wwan wpa_supplicant wireless-regdb iw brcmfmac-firmware
|
|
ExecStart=/bin/touch /var/lib/%N.stamp
|
|
ExecStart=/bin/systemctl --no-block reboot
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
storage:
|
|
files:
|
|
- path: /etc/hostname
|
|
mode: 0644
|
|
contents:
|
|
inline: |
|
|
aegis
|
|
- path: /etc/sysctl.d/99-ip-forward.conf
|
|
mode: 0644
|
|
contents:
|
|
inline: |
|
|
net.ipv4.ip_forward = 1
|
|
links:
|
|
- path: /etc/localtime
|
|
target: ../usr/share/zoneinfo/Europe/Rome
|