hetzner-dracut-sshd/post-install.sh

#!/usr/bin/bash

set -euo pipefail


enable_epel() {
  echo "Enable CodeReady Builder repository..."
  dnf config-manager --set-enabled crb

  echo "Checking for EPEL repository..."
  if ! dnf repolist enabled | grep -qE '^epel'; then
    echo "EPEL repository not found — enabling it now."
    dnf -y install epel-release || {
      echo "Failed to install epel-release. Attempting manual enable..."
      dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-$(rpm -E %rhel).noarch.rpm
    }
  else
    echo "EPEL is already enabled."
  fi
}

install_storage_deps() {
  dnf -y install mdadm cryptsetup lvm2
}

enable_resolved() {
  dnf -y install systemd-resolved
  systemctl enable systemd-resolved.service
  echo "Enabled systemd-resolved."
}

configure_dracut() {
  local f="/etc/dracut.conf.d/10-raid1-luks.conf"
  cat > "$f" <<'EOF'
add_drivers+=" raid1 dm_crypt "
add_dracutmodules+=" mdraid crypt lvm "
EOF
  chmod 0644 "$f"
  echo "Wrote $f"

  local f="/etc/dracut.conf.d/90-network-manager.conf"
  cat > "$f" <<'EOF'
hostonly="yes"
add_dracutmodules+=" network-manager "
EOF
  chmod 0644 "$f"
  echo "Wrote $f"

  echo "Configured initrd for lvm on luks on raid1, network-manager."
}

configure_kernel_cmdline() {
  # We need to tell the initramfs(= rd) that we need network during early boot
  grubby --update-kernel=ALL --args="rd.neednet=1"
}

enable_dracut_sshd() {
  dnf -y install dracut-network dracut-sshd
  echo "Enabled dracut-network, dracut-sshd."
}

regenerate_initrd() {
  dracut --regenerate-all --force
}

check_initrd() {
  local red=$(tput setaf 1)
  local green=$(tput setaf 2)
  local reset=$(tput sgr0)
  local ret=0

  for initrd in /boot/initramfs*; do
    # Skip over kdump and rescue image
    if [[ $initrd == *_64kdump.img ]] || [[ $initrd == /boot/initramfs-0-rescue* ]]; then
      continue
    fi

    echo "== $initrd"

    local tmpo=`mktemp`
    lsinitrd $initrd &>$tmpo

    for should_be in root/.ssh/authorized_keys bin/sshd raid1.ko.xz dm-crypt.ko.xz usr/lib/systemd/system/cryptsetup.target bin/lvm\$ bin/mdadm\$ etc/ssh/ssh_host_ed25519_key sbin/NetworkManager\$; do
      if grep -q "$should_be" $tmpo; then
        echo "${green}OK: $should_be${reset}"
      else
        echo "${red}MISSING: $should_be${reset}"
        ret=1
      fi
    done
  done
  return $ret
}

setup_resolv_conf() {
  local target="/run/systemd/resolve/stub-resolv.conf"
  [[ -e "$target" ]] || target="/run/systemd/resolve/resolv.conf"

  if [[ -e /etc/resolv.conf && ! -L /etc/resolv.conf ]]; then
    cp -a /etc/resolv.conf /etc/resolv.conf.backup.$(date +%s)
  fi
  ln -snf "$target" /etc/resolv.conf
  echo "Linked /etc/resolv.conf -> $target"
}

main() {
  enable_epel

  install_storage_deps

  enable_resolved

  configure_dracut
  configure_kernel_cmdline

  enable_dracut_sshd

  regenerate_initrd
  check_initrd

  # Must be last to not break DNS before installs are finished:
  setup_resolv_conf
}

main "$@"