mirror of
https://github.com/tommytran732/Arch-Setup-Script
synced 2024-11-23 01:51:33 -05:00
Compare commits
6 Commits
5cbef759f4
...
3821fe08f3
Author | SHA1 | Date | |
---|---|---|---|
3821fe08f3 | |||
870ccdef4d | |||
12949fa0dc | |||
15a1502a64 | |||
013417d7f4 | |||
9718199d29 |
88
install.sh
88
install.sh
@ -65,21 +65,21 @@ luks_prompt(){
|
|||||||
fi
|
fi
|
||||||
}
|
}
|
||||||
|
|
||||||
luks_password_prompt () {
|
luks_passphrase_prompt () {
|
||||||
if [ "${use_luks}" = '1' ]; then
|
if [ "${use_luks}" = '1' ]; then
|
||||||
output 'Enter your encryption password (the password will not be shown on the screen):'
|
output 'Enter your encryption passphrase (the password will not be shown on the screen):'
|
||||||
read -r -s luks_password
|
read -r -s luks_passphrase
|
||||||
|
|
||||||
if [ -z "${luks_password}" ]; then
|
if [ -z "${luks_passphrase}" ]; then
|
||||||
output 'You need to enter a password.'
|
output 'You need to enter a passphrase.'
|
||||||
luks_password_prompt
|
luks_passphrase_prompt
|
||||||
fi
|
fi
|
||||||
|
|
||||||
output 'Confirm your encryption password (the password will not be shown on the screen):'
|
output 'Confirm your encryption passphrase (the passphrase will not be shown on the screen):'
|
||||||
read -r -s luks_password2
|
read -r -s luks_passphrase2
|
||||||
if [ "${luks_password}" != "${luks_password2}" ]; then
|
if [ "${luks_passphrase}" != "${luks_passphrase2}" ]; then
|
||||||
output 'Passwords do not match, please try again.'
|
output 'Passphrases do not match, please try again.'
|
||||||
luks_password_prompt
|
luks_passphrase_prompt
|
||||||
fi
|
fi
|
||||||
fi
|
fi
|
||||||
}
|
}
|
||||||
@ -170,13 +170,13 @@ network_daemon_prompt(){
|
|||||||
locale=en_US
|
locale=en_US
|
||||||
kblayout=us
|
kblayout=us
|
||||||
|
|
||||||
# Cleaning the TTY.
|
# Cleaning the TTY
|
||||||
clear
|
clear
|
||||||
|
|
||||||
# Initial prompts
|
# Initial prompts
|
||||||
install_mode_selector
|
install_mode_selector
|
||||||
luks_prompt
|
luks_prompt
|
||||||
luks_password_prompt
|
luks_passphrase_prompt
|
||||||
disk_prompt
|
disk_prompt
|
||||||
username_prompt
|
username_prompt
|
||||||
fullname_prompt
|
fullname_prompt
|
||||||
@ -186,7 +186,7 @@ network_daemon_prompt
|
|||||||
|
|
||||||
# Installation
|
# Installation
|
||||||
|
|
||||||
## Updating the live environment usually causes more problems than its worth, and quite often can't be done without remounting cowspace with more capacity, especially at the end of any given month.
|
## Updating the live environment usually causes more problems than its worth, and quite often can't be done without remounting cowspace with more capacity
|
||||||
pacman -Sy
|
pacman -Sy
|
||||||
|
|
||||||
## Installing curl
|
## Installing curl
|
||||||
@ -195,7 +195,7 @@ pacman -S --noconfirm curl
|
|||||||
## Wipe the disk
|
## Wipe the disk
|
||||||
sgdisk --zap-all "${disk}"
|
sgdisk --zap-all "${disk}"
|
||||||
|
|
||||||
## Creating a new partition scheme.
|
## Creating a new partition scheme
|
||||||
output "Creating new partition scheme on ${disk}."
|
output "Creating new partition scheme on ${disk}."
|
||||||
sgdisk -g "${disk}"
|
sgdisk -g "${disk}"
|
||||||
sgdisk -I -n 1:0:+512M -t 1:ef00 -c 1:'ESP' "${disk}"
|
sgdisk -I -n 1:0:+512M -t 1:ef00 -c 1:'ESP' "${disk}"
|
||||||
@ -207,30 +207,30 @@ if [ "${use_luks}" = '1' ]; then
|
|||||||
cryptroot='/dev/disk/by-partlabel/rootfs'
|
cryptroot='/dev/disk/by-partlabel/rootfs'
|
||||||
fi
|
fi
|
||||||
|
|
||||||
## Informing the Kernel of the changes.
|
## Informing the Kernel of the changes
|
||||||
output 'Informing the Kernel about the disk changes.'
|
output 'Informing the Kernel about the disk changes.'
|
||||||
partprobe "${disk}"
|
partprobe "${disk}"
|
||||||
|
|
||||||
## Formatting the ESP as FAT32.
|
## Formatting the ESP as FAT32
|
||||||
output 'Formatting the EFI Partition as FAT32.'
|
output 'Formatting the EFI Partition as FAT32.'
|
||||||
mkfs.fat -F 32 -s 2 "${ESP}"
|
mkfs.fat -F 32 -s 2 "${ESP}"
|
||||||
|
|
||||||
## Creating a LUKS Container for the root partition.
|
## Creating a LUKS Container for the root partition
|
||||||
if [ "${use_luks}" = '1' ]; then
|
if [ "${use_luks}" = '1' ]; then
|
||||||
output 'Creating LUKS Container for the root partition.'
|
output 'Creating LUKS Container for the root partition.'
|
||||||
echo -n "${luks_password}" | cryptsetup luksFormat --pbkdf pbkdf2 "${cryptroot}" -d -
|
echo -n "${luks_passphrase}" | cryptsetup luksFormat --pbkdf pbkdf2 "${cryptroot}" -d -
|
||||||
echo -n "${luks_password}" | cryptsetup open "${cryptroot}" cryptroot -d -
|
echo -n "${luks_passphrase}" | cryptsetup open "${cryptroot}" cryptroot -d -
|
||||||
BTRFS='/dev/mapper/cryptroot'
|
BTRFS='/dev/mapper/cryptroot'
|
||||||
else
|
else
|
||||||
BTRFS='/dev/disk/by-partlabel/rootfs'
|
BTRFS='/dev/disk/by-partlabel/rootfs'
|
||||||
fi
|
fi
|
||||||
|
|
||||||
## Formatting the partition as BTRFS.
|
## Formatting the partition as BTRFS
|
||||||
output 'Formatting the rootfs as BTRFS.'
|
output 'Formatting the rootfs as BTRFS.'
|
||||||
mkfs.btrfs --force "${BTRFS}"
|
mkfs.btrfs -f "${BTRFS}"
|
||||||
mount "${BTRFS}" /mnt
|
mount "${BTRFS}" /mnt
|
||||||
|
|
||||||
## Creating BTRFS subvolumes.
|
## Creating BTRFS subvolumes
|
||||||
output 'Creating BTRFS subvolumes.'
|
output 'Creating BTRFS subvolumes.'
|
||||||
|
|
||||||
btrfs su cr /mnt/@
|
btrfs su cr /mnt/@
|
||||||
@ -292,7 +292,7 @@ echo "<?xml version=\"1.0\"?>
|
|||||||
|
|
||||||
chmod 600 /mnt/@/.snapshots/1/info.xml
|
chmod 600 /mnt/@/.snapshots/1/info.xml
|
||||||
|
|
||||||
## Mounting the newly created subvolumes.
|
## Mounting the newly created subvolumes
|
||||||
umount /mnt
|
umount /mnt
|
||||||
output 'Mounting the newly created subvolumes.'
|
output 'Mounting the newly created subvolumes.'
|
||||||
mount -o ssd,noatime,compress=zstd "${BTRFS}" /mnt
|
mount -o ssd,noatime,compress=zstd "${BTRFS}" /mnt
|
||||||
@ -318,7 +318,7 @@ mount -o ssd,noatime,compress=zstd,nodatacow,nodev,nosuid,noexec,subvol=@/var_sp
|
|||||||
mount -o ssd,noatime,compress=zstd,nodatacow,nodev,nosuid,noexec,subvol=@/var_lib_libvirt_images "${BTRFS}" /mnt/var/lib/libvirt/images
|
mount -o ssd,noatime,compress=zstd,nodatacow,nodev,nosuid,noexec,subvol=@/var_lib_libvirt_images "${BTRFS}" /mnt/var/lib/libvirt/images
|
||||||
mount -o ssd,noatime,compress=zstd,nodatacow,nodev,nosuid,noexec,subvol=@/var_lib_machines "${BTRFS}" /mnt/var/lib/machines
|
mount -o ssd,noatime,compress=zstd,nodatacow,nodev,nosuid,noexec,subvol=@/var_lib_machines "${BTRFS}" /mnt/var/lib/machines
|
||||||
|
|
||||||
# GNOME requires /var/lib/gdm and /var/lib/AccountsService to be writeable when booting into a readonly snapshot. Thus we sadly have to split them.
|
# GNOME requires /var/lib/gdm and /var/lib/AccountsService to be writeable when booting into a readonly snapshot
|
||||||
if [ "${install_mode}" = 'desktop' ]; then
|
if [ "${install_mode}" = 'desktop' ]; then
|
||||||
mount -o ssd,noatime,compress=zstd,nodatacow,nodev,nosuid,noexec,subvol=@/var_lib_gdm $BTRFS /mnt/var/lib/gdm
|
mount -o ssd,noatime,compress=zstd,nodatacow,nodev,nosuid,noexec,subvol=@/var_lib_gdm $BTRFS /mnt/var/lib/gdm
|
||||||
mount -o ssd,noatime,compress=zstd,nodatacow,nodev,nosuid,noexec,subvol=@/var_lib_AccountsService $BTRFS /mnt/var/lib/AccountsService
|
mount -o ssd,noatime,compress=zstd,nodatacow,nodev,nosuid,noexec,subvol=@/var_lib_AccountsService $BTRFS /mnt/var/lib/AccountsService
|
||||||
@ -356,7 +356,7 @@ if [ "${network_daemon}" = 'networkmanager' ]; then
|
|||||||
fi
|
fi
|
||||||
|
|
||||||
if [ "${install_mode}" = 'desktop' ]; then
|
if [ "${install_mode}" = 'desktop' ]; then
|
||||||
pacstrap /mnt nautilus gdm gnome-console gnome-control-center flatpak pipewire-alsa pipewire-pulse pipewire-jack
|
pacstrap /mnt flatpak gdm gnome-console gnome-control-center nautilus pipewire-alsa pipewire-pulse pipewire-jack
|
||||||
elif [ "${install_mode}" = 'server' ]; then
|
elif [ "${install_mode}" = 'server' ]; then
|
||||||
pacstrap /mnt openssh unbound
|
pacstrap /mnt openssh unbound
|
||||||
fi
|
fi
|
||||||
@ -374,27 +374,31 @@ fi
|
|||||||
## Install snap-pac list otherwise we will have problems
|
## Install snap-pac list otherwise we will have problems
|
||||||
pacstrap /mnt snap-pac
|
pacstrap /mnt snap-pac
|
||||||
|
|
||||||
## Generate /etc/fstab.
|
## Generate /etc/fstab
|
||||||
output 'Generating a new fstab.'
|
output 'Generating a new fstab.'
|
||||||
genfstab -U /mnt >> /mnt/etc/fstab
|
genfstab -U /mnt >> /mnt/etc/fstab
|
||||||
sed -i 's#,subvolid=258,subvol=/@/.snapshots/1/snapshot,subvol=@/.snapshots/1/snapshot##g' /mnt/etc/fstab
|
sed -i 's#,subvolid=258,subvol=/@/.snapshots/1/snapshot,subvol=@/.snapshots/1/snapshot##g' /mnt/etc/fstab
|
||||||
|
|
||||||
output 'Setting up hostname, locale and keyboard layout'
|
output 'Setting up hostname, locale and keyboard layout'
|
||||||
|
|
||||||
## Set hostname.
|
## Set hostname
|
||||||
echo "$hostname" > /mnt/etc/hostname
|
echo "$hostname" > /mnt/etc/hostname
|
||||||
|
|
||||||
## Setting hosts file.
|
## Setting hosts file
|
||||||
echo 'Setting hosts file.'
|
echo 'Setting hosts file.'
|
||||||
echo "127.0.0.1 localhost
|
echo '# Loopback entries; do not change.
|
||||||
::1 localhost
|
# For historical reasons, localhost precedes localhost.localdomain:
|
||||||
127.0.1.1 $hostname.localdomain $hostname" > /mnt/etc/hosts
|
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
|
||||||
|
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
|
||||||
|
# See hosts(5) for proper format and other examples:
|
||||||
|
# 192.168.1.10 foo.example.org foo
|
||||||
|
# 192.168.1.13 bar.example.org bar' > /mnt/etc/hosts
|
||||||
|
|
||||||
## Setup locales.
|
## Setup locales
|
||||||
echo "$locale.UTF-8 UTF-8" > /mnt/etc/locale.gen
|
echo "$locale.UTF-8 UTF-8" > /mnt/etc/locale.gen
|
||||||
echo "LANG=$locale.UTF-8" > /mnt/etc/locale.conf
|
echo "LANG=$locale.UTF-8" > /mnt/etc/locale.conf
|
||||||
|
|
||||||
## Setup keyboard layout.
|
## Setup keyboard layout
|
||||||
echo "KEYMAP=$kblayout" > /mnt/etc/vconsole.conf
|
echo "KEYMAP=$kblayout" > /mnt/etc/vconsole.conf
|
||||||
|
|
||||||
## Configure /etc/mkinitcpio.conf
|
## Configure /etc/mkinitcpio.conf
|
||||||
@ -407,7 +411,7 @@ else
|
|||||||
sed -i 's/^HOOKS=.*/HOOKS=(systemd autodetect microcode modconf keyboard sd-vconsole block)/g' /mnt/etc/mkinitcpio.conf
|
sed -i 's/^HOOKS=.*/HOOKS=(systemd autodetect microcode modconf keyboard sd-vconsole block)/g' /mnt/etc/mkinitcpio.conf
|
||||||
fi
|
fi
|
||||||
|
|
||||||
## Enable LUKS in GRUB and setting the UUID of the LUKS container.
|
## Enable LUKS in GRUB and setting the UUID of the LUKS container
|
||||||
if [ "${use_luks}" = '1' ]; then
|
if [ "${use_luks}" = '1' ]; then
|
||||||
sed -i 's/#GRUB_ENABLE_CRYPTODISK=.*/GRUB_ENABLE_CRYPTODISK=y/g' /mnt/etc/default/grub
|
sed -i 's/#GRUB_ENABLE_CRYPTODISK=.*/GRUB_ENABLE_CRYPTODISK=y/g' /mnt/etc/default/grub
|
||||||
fi
|
fi
|
||||||
@ -423,8 +427,8 @@ GRUB_DEFAULT="1>2"
|
|||||||
# Booting with BTRFS subvolume
|
# Booting with BTRFS subvolume
|
||||||
GRUB_BTRFS_OVERRIDE_BOOT_PARTITION_DETECTION=true' >> /mnt/etc/default/grub
|
GRUB_BTRFS_OVERRIDE_BOOT_PARTITION_DETECTION=true' >> /mnt/etc/default/grub
|
||||||
|
|
||||||
## Disable root subvol pinning.
|
## Disable root subvol pinning
|
||||||
## This is **extremely** important, as snapper expects to be able to set the default btrfs subvol.
|
## This is **extremely** important, as snapper expects to be able to set the default btrfs subvol
|
||||||
# shellcheck disable=SC2016
|
# shellcheck disable=SC2016
|
||||||
sed -i 's/rootflags=subvol=${rootsubvol}//g' /mnt/etc/grub.d/10_linux
|
sed -i 's/rootflags=subvol=${rootsubvol}//g' /mnt/etc/grub.d/10_linux
|
||||||
# shellcheck disable=SC2016
|
# shellcheck disable=SC2016
|
||||||
@ -439,11 +443,11 @@ else
|
|||||||
sed -i "s#quiet#root=${BTRFS} lsm=landlock,lockdown,yama,integrity,apparmor,bpf mitigations=auto,nosmt spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret gather_data_sampling=force reg_file_data_sampling=on random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=force_isolation efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off lockdown=confidentiality module.sig_enforce=1#g" /mnt/etc/default/grub
|
sed -i "s#quiet#root=${BTRFS} lsm=landlock,lockdown,yama,integrity,apparmor,bpf mitigations=auto,nosmt spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret gather_data_sampling=force reg_file_data_sampling=on random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=force_isolation efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off lockdown=confidentiality module.sig_enforce=1#g" /mnt/etc/default/grub
|
||||||
fi
|
fi
|
||||||
|
|
||||||
## Add keyfile to the initramfs to avoid double password.
|
## Add keyfile to the initramfs to avoid double password
|
||||||
if [ "${use_luks}" = '1' ]; then
|
if [ "${use_luks}" = '1' ]; then
|
||||||
dd bs=512 count=4 if=/dev/random of=/mnt/cryptkey/.root.key iflag=fullblock
|
dd bs=512 count=4 if=/dev/random of=/mnt/cryptkey/.root.key iflag=fullblock
|
||||||
chmod 000 /mnt/cryptkey/.root.key
|
chmod 000 /mnt/cryptkey/.root.key
|
||||||
echo -n "${luks_password}" | cryptsetup luksAddKey /dev/disk/by-partlabel/rootfs /mnt/cryptkey/.root.key -d -
|
echo -n "${luks_passphrase}" | cryptsetup luksAddKey /dev/disk/by-partlabel/rootfs /mnt/cryptkey/.root.key -d -
|
||||||
sed -i 's#FILES=()#FILES=(/cryptkey/.root.key)#g' /mnt/etc/mkinitcpio.conf
|
sed -i 's#FILES=()#FILES=(/cryptkey/.root.key)#g' /mnt/etc/mkinitcpio.conf
|
||||||
sed -i "s#module\.sig_enforce=1#module.sig_enforce=1 rd.luks.key=/cryptkey/.root.key#g" /mnt/etc/default/grub
|
sed -i "s#module\.sig_enforce=1#module.sig_enforce=1 rd.luks.key=/cryptkey/.root.key#g" /mnt/etc/default/grub
|
||||||
fi
|
fi
|
||||||
@ -465,7 +469,7 @@ unpriv curl -s https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Script
|
|||||||
sed -i 's/nullok//g' /mnt/etc/pam.d/system-auth
|
sed -i 's/nullok//g' /mnt/etc/pam.d/system-auth
|
||||||
|
|
||||||
## Harden SSH
|
## Harden SSH
|
||||||
## Arch annoyingly does not split openssh-server out so even desktop Arch will have the daemon.
|
## Arch annoyingly does not split openssh-server out so even desktop Arch will have the daemon
|
||||||
|
|
||||||
unpriv curl -s https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf | tee /mnt/etc/ssh/ssh_config.d/10-custom.conf > /dev/null
|
unpriv curl -s https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf | tee /mnt/etc/ssh/ssh_config.d/10-custom.conf > /dev/null
|
||||||
unpriv curl -s https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config.d/10-custom.conf | tee /mnt/etc/ssh/sshd_config.d/10-custom.conf > /dev/null
|
unpriv curl -s https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config.d/10-custom.conf | tee /mnt/etc/ssh/sshd_config.d/10-custom.conf > /dev/null
|
||||||
@ -525,11 +529,11 @@ if [ "${network_daemon}" = 'networkmanager' ]; then
|
|||||||
fi
|
fi
|
||||||
|
|
||||||
if [ "${network_daemon}" = 'systemd-networkd' ]; then
|
if [ "${network_daemon}" = 'systemd-networkd' ]; then
|
||||||
# arch-iso has working networking, booted does not.
|
# arch-iso has working networking, booted does not
|
||||||
cp -ap /etc/systemd/network/20* /mnt/etc/systemd/network/ > /dev/null
|
cp -ap /etc/systemd/network/20* /mnt/etc/systemd/network/ > /dev/null
|
||||||
fi
|
fi
|
||||||
|
|
||||||
## Configuring the system.
|
## Configuring the system
|
||||||
arch-chroot /mnt /bin/bash -e <<EOF
|
arch-chroot /mnt /bin/bash -e <<EOF
|
||||||
|
|
||||||
# Setting up timezone
|
# Setting up timezone
|
||||||
|
Loading…
Reference in New Issue
Block a user