blob: 10760f9932db8404b655ef90b16994faf5c8666f (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
|
#! /bin/bash
set -e
function get_cmdline {
sed -r 's/[[:alnum:]]+=/\n&/g' /proc/cmdline | awk -F= "\$1==\"$1\"{print \$2}" | sed 's/.\{1\}$//'
}
# cmdline options
TIMEZONE=$(get_cmdline tz)
KEYMAP=$(get_cmdline keytable)
DRIVE=$1
PART_PREFIX=$2
TARGET=$3
if [[ -z "${DRIVE}" ]] | [[ -z "${PART_PREFIX}" ]] | [[ -z "${TARGET}" ]]; then
echo -e "\e[1m\e[1;31mUsage: mkcryptartix <drive> <partition prefix> <target>\e[0m"
exit 1
fi
ln -sf "/usr/share/zoneinfo/${TIMEZONE}" /etc/localtime
hwclock --systohc
sed -i "s/#en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/" /etc/locale.gen
locale-gen
cat <<EOT > /etc/locale.conf
export LANG="en_US.UTF-8"
export LC_COLLATE="C"
EOT
sed -i "s/keymap=\"us\"/keymap=\"${KEYMAP}\"/" /etc/conf.d/keymaps
sed -i 's/^HOOKS=(\(.*\)block filesystems\(.*\))/HOOKS=(\1block encrypt filesystems\2)/g' /etc/mkinitcpio.conf
pacman -S --needed --noconfirm btrfs-progs grub os-prober device-mapper-openrc cryptsetup-openrc
BOOT_UUID=$(blkid -s UUID -o value ${PART_PREFIX}1)
dd bs=512 count=4 if=/dev/random of=/crypto_boot.bin iflag=fullblock
chmod 600 /crypto_boot.bin
echo "artix" | cryptsetup -q luksAddKey ${PART_PREFIX}1 /crypto_boot.bin
cat <<EOT >> /etc/conf.d/dmcrypt
target='boot_crypt'
source='/dev/disk/by-uuid/${BOOT_UUID}'
key='/crypto_boot.bin'
EOT
rc-update add dmcrypt boot
UUID=$(blkid -s UUID -o value ${PART_PREFIX}2)
sed -i "s/GRUB_CMDLINE_LINUX_DEFAULT=\"loglevel=3 quiet\"/GRUB_CMDLINE_LINUX_DEFAULT=\"loglevel=3 quiet cryptdevice=UUID=${UUID}:root_crypt\"/" /etc/default/grub
sed -i "s/#GRUB_ENABLE_CRYPTODISK=y/GRUB_ENABLE_CRYPTODISK=y/" /etc/default/grub
dd bs=512 count=4 if=/dev/random of=/crypto_keyfile.bin iflag=fullblock
chmod 600 /crypto_keyfile.bin
echo "artix" | cryptsetup -q luksAddKey ${PART_PREFIX}2 /crypto_keyfile.bin
sed -i "s/FILES=()/FILES=(\/crypto_keyfile.bin)/" /etc/mkinitcpio.conf
grub-install --recheck --target=${TARGET} ${DRIVE}
grub-mkconfig -o /boot/grub/grub.cfg
mkinitcpio -p linux-hardened
mkinitcpio -p linux-lts
# Enable GRUB to unlock /boot
CRYPTO_UUID=$(blkid -s UUID -o value ${PART_PREFIX}1 | tr -d -)
cat <<EOT > /boot/grub/grub-pre.cfg
set crypto_uuid=${CRYPTO_UUID}
cryptomount -u \$crypto_uuid
set root=crypto0
set prefix=(\$root)/grub
insmod normal
normal
EOT
grub-mkimage -p /boot/grub -c /boot/grub/grub-pre.cfg -o /boot/grub/${TARGET}/core.img -O ${TARGET} disk biosdisk diskfilter luks2 part_msdos cryptodisk gcry_rijndael pbkdf2 gcry_sha256 ext2
grub-bios-setup -d /boot/grub/${TARGET} ${DRIVE}
echo -en 'artix\nartix' | passwd
# Network
## Hostname
echo artix > /etc/hostname
cat <<EOT > /etc/hosts
# Static table lookup for hostnames.
# See hosts(5) for details.
127.0.0.1 localhost
127.0.1.1 artix.local artix
# IPv6
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
EOT
sed -i 's/hostname="localhost"/hostname="artix"/' /etc/conf.d/hostname
## Networking essentials
pacman -S --noconfirm dhcpcd wpa_supplicant
# Repositories
## Arch
pacman -Sy --needed --noconfirm artix-archlinux-support
cat <<EOT >> /etc/pacman.conf
# Arch
#[testing]
#Include = /etc/pacman.d/mirrorlist-arch
[extra]
Include = /etc/pacman.d/mirrorlist-arch
#[multilib-testing]
#Include = /etc/pacman.d/mirrorlist-arch
#[multilib]
#Include = /etc/pacman.d/mirrorlist-arch
EOT
pacman-key --populate archlinux
pacman -Sy
rc-update add ntpd default
exit 0
|
