147 lines
3.4 KiB
Bash
Executable file
147 lines
3.4 KiB
Bash
Executable file
#!/usr/bin/bash
|
|
|
|
set -euo pipefail
|
|
|
|
|
|
have_cmd() { command -v "$1" &>/dev/null; }
|
|
|
|
enable_epel() {
|
|
echo "Enable CodeReady Builder repository..."
|
|
dnf config-manager --set-enabled crb
|
|
|
|
echo "Checking for EPEL repository..."
|
|
if ! dnf repolist enabled | grep -qE '^epel'; then
|
|
echo "EPEL repository not found — enabling it now."
|
|
dnf -y install epel-release || {
|
|
echo "Failed to install epel-release. Attempting manual enable..."
|
|
dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-$(rpm -E %rhel).noarch.rpm
|
|
}
|
|
else
|
|
echo "EPEL is already enabled."
|
|
fi
|
|
}
|
|
|
|
install_storage_deps() {
|
|
dnf -y install mdadm cryptsetup lvm2
|
|
}
|
|
|
|
write_network_file() {
|
|
mkdir -p /etc/systemd/network
|
|
local f="/etc/systemd/network/20-wired.network"
|
|
cat > "$f" <<'EOF'
|
|
[Match]
|
|
Type=ether
|
|
|
|
[Network]
|
|
DHCP=yes
|
|
EOF
|
|
chmod 0644 "$f"
|
|
echo "Wrote $f"
|
|
}
|
|
|
|
disable_networkmanager() {
|
|
systemctl disable NetworkManager.service || true
|
|
systemctl disable NetworkManager-wait-online.service || true
|
|
systemctl mask NetworkManager.service || true
|
|
echo "NetworkManager disabled and masked."
|
|
}
|
|
|
|
enable_networkd_and_resolved() {
|
|
dnf -y install systemd-networkd systemd-resolved
|
|
systemctl enable systemd-networkd.service
|
|
systemctl enable systemd-resolved.service
|
|
echo "Enabled systemd-networkd and systemd-resolved."
|
|
}
|
|
|
|
|
|
configure_dracut() {
|
|
local f="/etc/dracut.conf.d/10-raid1-luks.conf"
|
|
cat > "$f" <<'EOF'
|
|
add_drivers+=" raid1 dm_crypt "
|
|
add_dracutmodules+=" mdraid crypt lvm "
|
|
EOF
|
|
chmod 0644 "$f"
|
|
echo "Wrote $f"
|
|
|
|
local f="/etc/dracut.conf.d/90-networkd.conf"
|
|
cat > "$f" <<'EOF'
|
|
install_items+=" /etc/systemd/network/20-wired.network "
|
|
add_dracutmodules+=" systemd-networkd "
|
|
omit_dracutmodules+=" network-manager "
|
|
EOF
|
|
chmod 0644 "$f"
|
|
echo "Wrote $f"
|
|
|
|
echo "Configured initrd for lvm on luks on raid1, systemd-networkd."
|
|
}
|
|
|
|
enable_dracut_sshd() {
|
|
dnf -y install dracut-sshd
|
|
echo "Enabled dracut-sshd."
|
|
}
|
|
|
|
regenerate_initrd() {
|
|
dracut --regenerate-all --force
|
|
}
|
|
|
|
check_initrd() {
|
|
local red=$(tput setaf 1)
|
|
local green=$(tput setaf 2)
|
|
local reset=$(tput sgr0)
|
|
local ret=0
|
|
|
|
for initrd in /boot/initramfs*; do
|
|
# Skip over kdump and rescue image
|
|
if [[ $initrd == *_64kdump.img ]] || [[ $initrd == /boot/initramfs-0-rescue* ]]; then
|
|
continue
|
|
fi
|
|
|
|
echo "== $initrd"
|
|
|
|
local tmpo=`mktemp`
|
|
lsinitrd $initrd &>$tmpo
|
|
|
|
for should_be in root/.ssh/authorized_keys bin/sshd usr/lib/systemd/systemd-networkd\$ etc/systemd/network/20-wired.network raid1.ko.xz dm-crypt.ko.xz usr/lib/systemd/system/cryptsetup.target bin/lvm\$ bin/mdadm\$ etc/ssh/ssh_host_ed25519_key; do
|
|
if grep -q "$should_be" $tmpo; then
|
|
echo "${green}OK: $should_be${reset}"
|
|
else
|
|
echo "${red}MISSING: $should_be${reset}"
|
|
ret=1
|
|
fi
|
|
done
|
|
done
|
|
return $ret
|
|
}
|
|
|
|
setup_resolv_conf() {
|
|
local target="/run/systemd/resolve/stub-resolv.conf"
|
|
[[ -e "$target" ]] || target="/run/systemd/resolve/resolv.conf"
|
|
|
|
if [[ -e /etc/resolv.conf && ! -L /etc/resolv.conf ]]; then
|
|
cp -a /etc/resolv.conf /etc/resolv.conf.backup.$(date +%s)
|
|
fi
|
|
ln -snf "$target" /etc/resolv.conf
|
|
echo "Linked /etc/resolv.conf -> $target"
|
|
}
|
|
|
|
main() {
|
|
enable_epel
|
|
|
|
install_storage_deps
|
|
|
|
write_network_file
|
|
enable_networkd_and_resolved
|
|
disable_networkmanager
|
|
|
|
configure_dracut
|
|
|
|
enable_dracut_sshd
|
|
|
|
regenerate_initrd
|
|
check_initrd
|
|
|
|
# Must be last to not break DNS before installs are finished:
|
|
setup_resolv_conf
|
|
}
|
|
|
|
main "$@"
|