🐛 Switch back to NetworkManager

We must not rely on DHCP and use installimage's static NetworkManager
configuration.  While we could try to read the NM configuration and
configure systemd-networkd, we decided against it, as NetworkManager is
the default on Rocky Linux.

Configure dracut/the initramfs to a. include NetworkManager and b.
that we need networking in early boot (rd.neednet=1).

Closes gh-1.
Closes gh-3.

README.md

@@ -2,14 +2,33 @@
 
 🚧 **Work in progress** 🚧
 
-Post-install script for Hetzner's `installimage` that installs `dracut-sshd` to enable remote LUKS unlocking via SSH. Tested with Rocky Linux 10. It should also work with AlmaLinux 10 and possibly earlier releases, but these have not been tested.
+Post-install script for Hetzner's `installimage` that installs `dracut-sshd` to enable remote LUKS
+unlocking via SSH.
+
+This is tested with Rocky Linux 10. It should also work with AlmaLinux 10 and possibly earlier
+releases, but these have not been tested.
+
 
 ## Notes
 
-- The script assumes a setup with LVM on RAID1, but this is not a strict requirement. Other setups may require small changes to the script.
+- The script assumes a setup with LVM on LUKS on RAID1, but this is not a strict requirement. Other
-- Replaces NetworkManager with `systemd-networkd` and installs `systemd-resolved`
+  setups may require small changes to the script.
-  - `systemd-networkd` is configured to use DHCP on all Ethernet interfaces
+- Configures the initramfs to enable networking (e.g. NetworkManager) in early boot
-  - Although NetworkManager would probably also work with the implicitly installed `dracut-network`, we use `systemd-networkd` here because it’s our preferred option.
+  - `dracut-network`, NetworkManager in the initramfs and `rd.neednet=1` in the kernel cmdline
-- Enables EPEL (required for `dracut-sshd` and `systemd-networkd`)
+- Enables EPEL (required for `dracut-sshd`)
 - Installs `dracut-sshd`
   - Uses the SSH keys in `/root/.ssh/authorized_keys`, as previously installed by `installimage`
+- Always check `/root/postinstall_debug.txt` after `installimage` ran.
+
+### After rebooting out of the rescue system
+
+- The system reboots again after first boot due to SELinux autorelabeling. That means that you will
+  need to ssh into the initrd to unlock *twice* if it's the first time.
+
+### Troubleshooting
+
+- Always check `/root/postinstall_debug.txt` after `postinstall` ran.
+- It's not specific to this postintall script, but make sure you know how to mount an encrypted
+  system from the rescue disk using `mdadm`, `cryptsetup`, `lvscan` etc. Also remember to `touch
+  `/path-to/mounted-system/.autorelabel` to not break booting due to SELinux choking on unlabeled
+  files.

post-install.sh

@@ -23,35 +23,12 @@ install_storage_deps() {
   dnf -y install mdadm cryptsetup lvm2
 }
 
-write_network_file() {
+enable_resolved() {
-  mkdir -p /etc/systemd/network
+  dnf -y install systemd-resolved
-  local f="/etc/systemd/network/20-wired.network"
-  cat > "$f" <<'EOF'
-[Match]
-Type=ether
-
-[Network]
-DHCP=yes
-EOF
-  chmod 0644 "$f"
-  echo "Wrote $f"
-}
-
-disable_networkmanager() {
-  systemctl disable NetworkManager.service || true
-  systemctl disable NetworkManager-wait-online.service || true
-  systemctl mask NetworkManager.service || true
-  echo "NetworkManager disabled and masked."
-}
-
-enable_networkd_and_resolved() {
-  dnf -y install systemd-networkd systemd-resolved
-  systemctl enable systemd-networkd.service
   systemctl enable systemd-resolved.service
-  echo "Enabled systemd-networkd and systemd-resolved."
+  echo "Enabled systemd-resolved."
 }
 
-
 configure_dracut() {
   local f="/etc/dracut.conf.d/10-raid1-luks.conf"
   cat > "$f" <<'EOF'
@@ -61,21 +38,25 @@ EOF
   chmod 0644 "$f"
   echo "Wrote $f"
 
-  local f="/etc/dracut.conf.d/90-networkd.conf"
+  local f="/etc/dracut.conf.d/90-network-manager.conf"
   cat > "$f" <<'EOF'
-install_items+=" /etc/systemd/network/20-wired.network "
+hostonly="yes"
-add_dracutmodules+=" systemd-networkd "
+add_dracutmodules+=" network-manager "
-omit_dracutmodules+=" network-manager "
 EOF
   chmod 0644 "$f"
   echo "Wrote $f"
 
-  echo "Configured initrd for lvm on luks on raid1, systemd-networkd."
+  echo "Configured initrd for lvm on luks on raid1, network-manager."
+}
+
+configure_kernel_cmdline() {
+  # We need to tell the initramfs(= rd) that we need network during early boot
+  grubby --update-kernel=ALL --args="rd.neednet=1"
 }
 
 enable_dracut_sshd() {
-  dnf -y install dracut-sshd
+  dnf -y install dracut-network dracut-sshd
-  echo "Enabled dracut-sshd."
+  echo "Enabled dracut-network, dracut-sshd."
 }
 
 regenerate_initrd() {
@@ -99,7 +80,7 @@ check_initrd() {
     local tmpo=`mktemp`
     lsinitrd $initrd &>$tmpo
 
-    for should_be in root/.ssh/authorized_keys bin/sshd usr/lib/systemd/systemd-networkd\$ etc/systemd/network/20-wired.network raid1.ko.xz dm-crypt.ko.xz usr/lib/systemd/system/cryptsetup.target bin/lvm\$ bin/mdadm\$ etc/ssh/ssh_host_ed25519_key; do
+    for should_be in root/.ssh/authorized_keys bin/sshd raid1.ko.xz dm-crypt.ko.xz usr/lib/systemd/system/cryptsetup.target bin/lvm\$ bin/mdadm\$ etc/ssh/ssh_host_ed25519_key sbin/NetworkManager\$; do
       if grep -q "$should_be" $tmpo; then
         echo "${green}OK: $should_be${reset}"
       else
@@ -127,11 +108,10 @@ main() {
 
   install_storage_deps
 
-  write_network_file
+  enable_resolved
-  enable_networkd_and_resolved
-  disable_networkmanager
 
   configure_dracut
+  configure_kernel_cmdline
 
   enable_dracut_sshd