blob: d32ca9c50c95ecd4692f006a5b4774491d4693c5 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
|
#! /bin/bash
set -e
function get_cmdline {
sed -r 's/[[:alnum:]]+=/\n&/g' /proc/cmdline | awk -F= "\$1==\"$1\"{print \$2}"
}
# cmdline options
TIMEZONE=$(get_cmdline tz)
KEYMAP=$(get_cmdline keytable)
DRIVE=$1
PART_PREFIX=$2
TARGET=$3
if [[ -z "${DRIVE}" ]] | [[ -z "${PART_PREFIX}" ]] | [[ -z "${TARGET" ]]; then
echo -e "\e[1m\e[1;31mUsage: mkcryptartix <drive> <partition prefix> <target>\e[0m"
exit 1
fi
ln -sf "/usr/share/zoneinfo/${TIMEZONE}" /etc/localtime
hwclock --systohc
sed -i "s/#en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/" /etc/locale.gen
locale-gen
cat <<EOT > /etc/locale.conf
export LANG="en_US.UTF-8"
export LC_COLLATE="C"
EOT
sed -i "s/HOOKS=(base udev autodetect modconf block filesystems keyboard fsck)/HOOKS=(base udev autodetect modconf block keyboard keymap encrypt filesystems fsck)/" /etc/mkinitcpio.conf
pacman -S --needed --noconfirm btrfs-progs grub os-prober device-mapper-openrc cryptsetup-openrc
BOOT_UUID=$(blkid -s UUID -o value ${PART_PREFIX}1)
dd bs=512 count=4 if=/dev/random of=/crypto_boot.bin iflag=fullblock
chmod 600 /crypto_boot.bin
echo "artix" | cryptsetup -q luksAddKey ${PART_PREFIX}1 /crypto_boot.bin
cat <<EOT >> /etc/conf.d/dmcrypt
target='boot_crypt'
source='/dev/disk/by-uuid/${BOOT_UUID}'
key='/crypto_boot.bin'
EOT
rc-update add dmcrypt boot
UUID=$(blkid -s UUID -o value ${PART_PREFIX}2)
sed -i "s/GRUB_CMDLINE_LINUX_DEFAULT=\"loglevel=3 quiet\"/GRUB_CMDLINE_LINUX_DEFAULT=\"loglevel=3 quiet cryptdevice=UUID=${UUID}:root_crypt\"/" /etc/default/grub
sed -i "s/#GRUB_ENABLE_CRYPTODISK=y/GRUB_ENABLE_CRYPTODISK=y/" /etc/default/grub
sed -i "s/GRUB_TERMINAL_INPUT=console/GRUB_TERMINAL_INPUT=at_keyboard/" /etc/default/grub
dd bs=512 count=4 if=/dev/random of=/crypto_keyfile.bin iflag=fullblock
chmod 600 /crypto_keyfile.bin
echo "artix" | cryptsetup -q luksAddKey ${PART_PREFIX}2 /crypto_keyfile.bin
sed -i "s/FILES=()/FILES=(\/crypto_keyfile.bin)/" /etc/mkinitcpio.conf
grub-install --recheck --target=${TARGET} ${DRIVE}
grub-mkconfig -o /boot/grub/grub.cfg
mkinitcpio -p linux
# Enable GRUB to unlock /boot
CRYPTO_UUID=$(blkid -s UUID -o value ${PART_PREFIX}1 | tr -d -)
cat <<EOT > /boot/grub/grub-pre.cfg
set root=(memdisk)
set prefix=(\$root)/
terminal_input at_keyboard
keymap /keymap.gkb
set crypto_uuid=${CRYPTO_UUID}
cryptomount -u \$crypto_uuid
set root=crypto0
set prefix=(\$root)/grub
insmod normal
normal
EOT
pacman -S --needed --noconfirm libxkbcommon-x11 # XKB layouts
useradd ckbcomp
echo -en 'ckbcomp\nckbcomp' | passwd ckbcomp
git clone https://aur.archlinux.org/ckbcomp-bin.git /tmp/ckbcomp-bin
chown -R ckbcomp:ckbcomp /tmp/ckbcomp-bin
(cd /tmp/ckbcomp-bin && su ckbcomp -c 'makepkg')
userdel ckbcomp
cp -p /tmp/ckbcomp-bin/pkg/ckbcomp-bin/usr/bin/ckbcomp /usr/local/bin/ckbcomp
grub-kbdcomp -o /boot/grub/keymap.gkb ${KEYMAP}
(cd /boot/grub && tar cf memdisk.tar keymap.gkb)
grub-mkimage -p /boot/grub -c /boot/grub/grub-pre.cfg -o /boot/grub/${TARGET}/core.img -O ${TARGET} -m /boot/grub/memdisk.tar disk biosdisk diskfilter luks2 part_msdos cryptodisk gcry_rijndael pbkdf2 gcry_sha256 ext2 memdisk tar at_keyboard keylayouts terminal
grub-bios-setup -d /boot/grub/${TARGET} ${DRIVE}
pacman -Rns --noconfirm libxkbcommon-x11 # Not needed by all users
echo -en 'artix\nartix' | passwd
echo artix > /etc/hostname
cat <<EOT > /etc/hosts
# Static table lookup for hostnames.
# See hosts(5) for details.
127.0.0.1 localhost
127.0.1.1 artix.local artix
# IPv6
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
EOT
sed -i 's/hostname="localhost"/hostname="artix"/' /etc/conf.d/hostname
sed -i 's/keymap="us"/keymap="de"/' /etc/conf.d/keymaps
# Repositories
## Artix
cat <<EOT >> /etc/pacman.conf
#
# Custom
#
# Artix
[universe]
Server = https://universe.artixlinux.org/\$arch
Server = https://mirror1.artixlinux.org/universe/\$arch
Server = https://mirror.pascalpuffke.de/artix-universe/\$arch
Server = https://artixlinux.qontinuum.space/artixlinux/universe/os/\$arch
Server = https://mirror1.cl.netactuate.com/artix/universe/\$arch
Server = https://ftp.crifo.org/artix-universe/
EOT
## Arch
pacman -Sy --needed --noconfirm artix-archlinux-support
cat <<EOT >> /etc/pacman.conf
# Arch
#[testing]
#Include = /etc/pacman.d/mirrorlist-arch
[extra]
Include = /etc/pacman.d/mirrorlist-arch
#[community-testing]
#Include = /etc/pacman.d/mirrorlist-arch
[community]
Include = /etc/pacman.d/mirrorlist-arch
#[multilib-testing]
#Include = /etc/pacman.d/mirrorlist-arch
#[multilib]
#Include = /etc/pacman.d/mirrorlist-arch
EOT
pacman-key --populate archlinux
pacman -Sy
pacman -R --noconfirm sudo
rc-update add ntpd default
exit 0
|
