#!/usr/bin/env bash # # kvmx-create virtual machine installer # # Copyright (C) 2017 Silvio Rhatto - rhatto at riseup.net # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published # by the Free Software Foundation, either version 3 of the License, # or any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # # Parameters BASENAME="`basename $0`" DIRNAME="`dirname $0`" GLOBAL_USER_CONFIG_FILE="$HOME/.config/kvmxconfig" # Load basic functions export APP_BASE="`$DIRNAME/kvmx app_base`" source $APP_BASE/lib/kvmx/functions || exit 1 # Load configuration function kvmx_config_load { if [ ! -z "$1" ] && [ -e "$1" ]; then source $1 fi } # Read a parameter from user function kvmx_user_input { local input local param="$1" local default="$2" shift 2 if echo $param | grep -q 'passwd'; then read -s -rep "$* (defaults to $default): " input else read -rep "$* (defaults to $default): " input fi if [ -z "$input" ]; then export $param="$default" else export $param="$input" fi } # Get a configuration parameter if not previously defined by a sourced file function kvmx_user_config { local param="$1" local default="$2" shift 2 if [ -z "`eval echo '$'$param`" ]; then kvmx_user_input $param $default $* fi } # Install a package function kvmx_install_package { if [ -z "$1" ]; then return fi dpkg -s $1 &> /dev/null if [ "$?" == "1" ]; then echo "Installing package $1..." DEBIAN_FRONTEND=noninteractive $SUDO apt-get install $1 -y || exit 1 fi } # Abort on error function kvmx_exit_on_error { if [ "$?" != "0" ]; then echo "Error: $*" exit 1 fi } # Run a command using sudo and abort on error function kvmx_sudo_run { if [ "`whoami`" != 'root' ]; then SUDO="sudo" fi $SUDO $* kvmx_exit_on_error $* } # Make sure there is provision config. function kvmx_config { if [ -e "$GLOBAL_USER_CONFIG_FILE" ]; then source $GLOBAL_USER_CONFIG_FILE fi local default_password="`head -c 20 /dev/urandom | base64`" kvmx_user_config hostname machine "Hostname" kvmx_user_config domain example.org "Domain" kvmx_user_config arch amd64 "System arch" kvmx_user_config version bookworm "Distro version" kvmx_user_config mirror https://deb.debian.org/debian/ "Debian mirror" #kvmx_user_config ssh_support y "Administration using passwordless SSH (y/n)" kvmx_user_config ssh_custom y "Setup a custom SSH keypair (y/n)" kvmx_user_config user user "Initial user name" kvmx_user_config password $default_password "Initial user password" kvmx_user_config net user "Networking config (user or tap)" if [ "$net" == "tap" ]; then kvmx_user_config net_ip 10.1.1.2 "IP address" kvmx_user_config net_mask 255.255.0 "Netmask" kvmx_user_config net_gateway 10.1.1.1 "Gateway" kvmx_user_config net_dns 192.168.1.1 "DNS" fi if [ ! -z "$image_base" ]; then image="$image_base/$hostname/box.img" else image_base="$HOME/.local/share/kvmx" kvmx_user_config image $image_base/$hostname/box.img "Destination image (ending in .img)" fi kvmx_user_config size 3G "Image size" kvmx_user_config format qcow2 "Image format: raw or qcow2" if [ "$format" == "qcow2" ]; then kvmx_user_config qcow2_compression y "Image compression (y/n)" fi kvmx_user_config bootloader grub "Bootloader: grub or extlinux" } # # Custom version # function kvmx_create_custom { # Next debian release NEXT_DEBIAN_RELEASE="trixie" # Check dependencies DEPENDENCIES="sudo apt qemu-img sed awk tr head debootstrap chroot" __kvmx_check_dependencies echo "This script requires sudo to: install dependencies into your system, mount the imagem and chroot into it." echo "So it assumes your currente user $USER has superuser access through sudo" echo "Also, you might be prompted for your passphrase a number of times if that's the way your sudo access is configured." echo "Creating virtual machine guest image $image..." # Check for package requirements #for req in debootstrap parted apt-transport-https; do for req in debootstrap parted; do kvmx_install_package $req done if [ -z "$TMP" ]; then TMP="/tmp" fi WORK="`mktemp -d $TMP/kvmx-create.XXXXXXXXXX`" # Determine kernel architecture if [ "$arch" == "i386" ]; then kernel_arch="686" else kernel_arch="$arch" fi # Check the host distro host_distro="`head -n 1 /etc/issue | cut -d ' ' -f 1 | tr '[:upper:]' '[:lower:]'`" # Determine distro and kernel package name if echo $mirror | grep -q 'ubuntu'; then distro="ubuntu" kernel_package="linux-image-generic" if [ "$host_distro" == "debian" ]; then kvmx_install_package ubuntu-keyring fi else #elif echo $mirror | grep 'debian'; then distro="debian" kernel_package="linux-image-$kernel_arch" if [ "$host_distro" == "ubuntu" ]; then kvmx_install_package debian-archive-keyring fi fi if [ -z "$image_type" ] || [ "$image_type" == "file" ]; then echo "Creating image file..." #kvmx_sudo_run dd if=/dev/zero of=$image bs=$size count=1 kvmx_sudo_run qemu-img create -f raw $image $size device="`sudo losetup --find --show $image`" partition_prefix="p" elif [ -e "$image" ]; then device="`readlink $image || echo $image`" else echo "$BASENAME: image device $image does not exist" exit 1 fi echo "Partitioning image at $device..." kvmx_sudo_run parted -s -- $device mklabel gpt kvmx_sudo_run parted -s -- $device unit MB mkpart non-fs 2 3 kvmx_sudo_run parted -s -- $device set 1 bios_grub on kvmx_sudo_run parted -s -- $device unit MB mkpart ext2 3 -1 kvmx_sudo_run parted -s -- $device set 2 boot on kvmx_sudo_run mkfs.ext4 ${device}${partition_prefix}2 kvmx_sudo_run mount ${device}${partition_prefix}2 $WORK/ # Trap $WORK umount trap 'if [ -e "$WORK" ]; then umount $WORK/{proc,sys,run,dev/pts,dev} &> /dev/null; umount $WORK &> /dev/null; rmdir $WORK; fi' INT TERM EXIT # Non-interactive installation #APT_INSTALL="LC_ALL=C DEBIAN_FRONTEND=noninteractive kvmx_sudo_run chroot $WORK/ apt-get install -y" #APT_INSTALL="kvmx_sudo_run LC_ALL=C DEBIAN_FRONTEND=noninteractive chroot $WORK/ apt-get install -y" APT_INSTALL="kvmx_sudo_run chroot $WORK/ /usr/bin/env LC_ALL=C DEBIAN_FRONTEND=noninteractive /usr/bin/apt-get install -y" # Initial system install. echo "Installing base system..." LC_ALL=C DEBIAN_FRONTEND=noninteractive kvmx_sudo_run debootstrap \ --force-check-gpg --arch=$arch $version $WORK/ $mirror # Initial configuration. echo "Applying initial configuration..." # Hostname configuration. echo $hostname.$domain | $SUDO tee $WORK/etc/hostname > /dev/null echo "127.0.0.1 localhost" | $SUDO tee -a $WORK/etc/hosts > /dev/null # This ordering is important for facter correctly guess the domain name echo "127.0.0.1 $hostname.$domain $hostname" | $SUDO tee -a $WORK/etc/hosts > /dev/null # Invert hostname contents to avoid http://projects.puppetlabs.com/issues/2533 tac $WORK/etc/hosts | $SUDO tee $WORK/etc/hosts.new > /dev/null kvmx_sudo_run mv $WORK/etc/hosts.new $WORK/etc/hosts # Systems using netplan needs this temporary fix so we can continue #if [ "$distro" == "ubuntu" ]; then if [ -d "$WORK/etc/netplan" ]; then # Points to ../run/systemd/resolve/stub-resolv.conf kvmx_sudo_run mv $WORK/etc/resolv.conf $WORK/etc/resolv.conf.dist # Temporary resolver: OpenNIC cat <<-EOF | $SUDO tee $WORK/etc/resolv.conf > /dev/null nameserver 45.71.185.100 nameserver 172.98.193.42 EOF fi # Fstab echo "/dev/vda2 / ext4 errors=remount-ro 0 1" | $SUDO tee $WORK/etc/fstab > /dev/null # Apt if [ "$distro" == "debian" ]; then if [ "$version" != "sid" ] && [ "$version" != "experimental" ] && [ "$version" != "$NEXT_DEBIAN_RELEASE" ]; then echo "deb http://security.debian.org/debian-security $version-security main contrib non-free" | $SUDO tee -a $WORK/etc/apt/sources.list > /dev/null echo "deb-src http://security.debian.org/debian-security $version-security main contrib non-free" | $SUDO tee -a $WORK/etc/apt/sources.list > /dev/null echo "deb https://deb.debian.org/debian/ $version-backports main contrib non-free" | $SUDO tee -a $WORK/etc/apt/sources.list > /dev/null echo "deb-src https://deb.debian.org/debian/ $version-backports main contrib non-free" | $SUDO tee -a $WORK/etc/apt/sources.list > /dev/null fi elif [ "$distro" == "ubuntu" ]; then $SUDO sed -i -e 's/main/main restricted universe multiverse/' $WORK/etc/apt/sources.list echo "deb http://archive.ubuntu.com/ubuntu/ ${version}-updates main restricted universe multiverse" | $SUDO tee -a $WORK/etc/apt/sources.list > /dev/null echo "deb-src http://archive.ubuntu.com/ubuntu/ ${version}-updates main restricted universe multiverse" | $SUDO tee -a $WORK/etc/apt/sources.list > /dev/null echo "deb http://archive.ubuntu.com/ubuntu/ ${version}-backports main restricted universe multiverse" | $SUDO tee -a $WORK/etc/apt/sources.list > /dev/null echo "#deb-src http://archive.ubuntu.com/ubuntu/ ${version}-backports main restricted universe multiverse" | $SUDO tee -a $WORK/etc/apt/sources.list > /dev/null echo "deb http://security.ubuntu.com/ubuntu ${version}-security main restricted universe multiverse" | $SUDO tee -a $WORK/etc/apt/sources.list > /dev/null echo "#deb-src http://security.ubuntu.com/ubuntu ${version}-security main restricted universe multivers" | $SUDO tee -a $WORK/etc/apt/sources.list > /dev/null echo "#deb http://archive.canonical.com/ubuntu ${version} partner" | $SUDO tee -a $WORK/etc/apt/sources.list > /dev/null echo "#deb-src http://archive.canonical.com/ubuntu ${version} partner" | $SUDO tee -a $WORK/etc/apt/sources.list > /dev/null echo "#deb http://extras.ubuntu.com/ubuntu ${version} main" | $SUDO tee -a $WORK/etc/apt/sources.list > /dev/null fi # Mount auxiliary filesystems needed by the bootloader kvmx_sudo_run mount none -t proc $WORK/proc kvmx_sudo_run mount none -t sysfs $WORK/sys kvmx_sudo_run mount -o bind /run/ $WORK/run kvmx_sudo_run mount -o bind /dev/ $WORK/dev kvmx_sudo_run mount -o bind /dev/pts $WORK/dev/pts # Initial upgrade echo "Updating list of packages..." kvmx_sudo_run chroot $WORK/ apt-get update kvmx_sudo_run chroot $WORK/ apt-get dist-upgrade -y # Install kernel after mounting /proc $APT_INSTALL $kernel_package if [ "$bootloader" == "grub" ]; then $APT_INSTALL grub-pc # Serial console support echo '' | $SUDO tee -a $WORK/etc/default/grub > /dev/null echo '# Custom configuration' | $SUDO tee -a $WORK/etc/default/grub > /dev/null echo 'GRUB_TERMINAL=serial' | $SUDO tee -a $WORK/etc/default/grub > /dev/null echo 'GRUB_SERIAL_COMMAND="serial --speed=115200"' | $SUDO tee -a $WORK/etc/default/grub > /dev/null echo 'GRUB_CMDLINE_LINUX="console=ttyS0,115200n8"' | $SUDO tee -a $WORK/etc/default/grub > /dev/null kvmx_sudo_run chroot $WORK/ update-grub kvmx_sudo_run chroot $WORK/ grub-install $device # Possible alternatives: # https://packages.debian.org/jessie/grub-firmware-qemu # https://superuser.com/questions/130955/how-to-install-grub-into-an-img-file #kvmx_sudo_run grub-install --boot-directory=$WORK/boot $image elif [ "$bootloader" == "extlinux" ]; then # http://www.grulic.org.ar/~mdione/glob/posts/create-a-disk-image-with-a-booting-running-debian/ # http://www.syslinux.org/wiki/index.php?title=EXTLINUX # http://www.syslinux.org/wiki/index.php?title=Mbr $APT_INSTALL extlinux kvmx_sudo_run chroot $WORK/ extlinux --install /boot kvmx_sudo_run dd bs=440 count=1 conv=notrunc if=$WORK/usr/lib/EXTLINUX/gptmbr.bin of=$device cat <<-EOF | $SUDO tee $WORK/boot/syslinux.cfg > /dev/null default linux timeout 1 label linux say Booting linux... linux /vmlinuz append root=/dev/vda1 ro initrd /initrd.img EOF fi # Umount auxiliary filesystems kvmx_sudo_run umount $WORK/proc kvmx_sudo_run umount $WORK/sys kvmx_sudo_run umount $WORK/run kvmx_sudo_run umount $WORK/dev/pts kvmx_sudo_run umount $WORK/dev # Give some time to Ubuntu if [ "$distro" == "ubuntu" ]; then sleep 10 fi # Run basic provision __kvmx_create_custom_second_stage # Umount image kvmx_sudo_run umount $WORK kvmx_sudo_run rmdir $WORK # Pack guest image if [ -z "$image_type" ] || [ "$image_type" == "file" ]; then kvmx_sudo_run losetup -d $device # Image conversion if [ "$format" == "qcow2" ]; then echo "Converting raw image to qcow2..." kvmx_sudo_run mv $image $image.raw kvmx_sudo_run qemu-img convert -O qcow2 -p $compression ${image}.raw $image kvmx_sudo_run rm ${image}.raw fi fi # Fix permissions if [ "`whoami`" != "root" ]; then kvmx_sudo_run chown -R `whoami`: `dirname $image` fi } # Second stage procedure function __kvmx_create_custom_second_stage { if [ ! -z "$net_ip" ] && [ ! -z "$net_mask" ] && [ ! -z "$net_gateway" ]; then if [ -d "$WORK/etc/network/interfaces.d" ]; then # Networking # See #799253 - virtio ens3 network interface # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=799253 for net_dev in eth0 ens3 ens4; do cat <<-EOF | $SUDO tee $WORK/etc/network/interfaces.d/$net_dev > /dev/null auto $net_dev iface $net_dev inet static address $net_ip netmask $net_mask gateway $net_gateway EOF done elif [ -d "$WORK/etc/netplan" ]; then cat <<-EOF | $SUDO tee $WORK/etc/netplan/99_config.yaml > /dev/null network: version: 2 renderer: networkd ethernets: EOF # Using OpenNIC for net_dev in eth0 ens3 ens4; do cat <<-EOF | $SUDO tee -a $WORK/etc/netplan/99_config.yaml > /dev/null $net_dev: addresses: - $net_ip gateway4: $net_gateway nameservers: addresses: [172.98.193.42, 142.4.204.111] EOF done fi else if [ -d "$WORK/etc/network/interfaces.d" ]; then # Networking # See #799253 - virtio ens3 network interface # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=799253 for net_dev in eth0 ens3 ens4; do cat <<-EOF | $SUDO tee $WORK/etc/network/interfaces.d/$net_dev > /dev/null allow-hotplug $net_dev iface $net_dev inet dhcp EOF done elif [ -d "$WORK/etc/netplan" ]; then cat <<-EOF | $SUDO tee $WORK/etc/netplan/99_config.yaml > /dev/null network: version: 2 renderer: networkd ethernets: EOF for net_dev in eth0 ens3 ens4; do cat <<-EOF | $SUDO tee -a $WORK/etc/netplan/99_config.yaml > /dev/null $net_dev: dhcp4: true EOF done fi fi # DNS config if [ ! -z "$net_dns" ]; then if [ "$net_dns" == "host" ]; then cp /etc/resolv.conf $WORK/etc/resolv.conf else echo "nameserver $net_dns" > $WORK/etc/resolv.conf fi fi # Locale $APT_INSTALL locales echo "LANG=$LANG" | $SUDO tee $WORK/etc/default/locale > /dev/null echo "$LANG UTF-8" | $SUDO tee -a $WORK/etc/locale.gen > /dev/null kvmx_sudo_run chroot $WORK/ locale-gen # Basic packages $APT_INSTALL screen cron lsb-release openssl rsync # Guest agent $APT_INSTALL qemu-guest-agent if [ "$spice" == "1" ]; then $APT_INSTALL spice-vdagent fi # OpenSSH $APT_INSTALL openssh-server -y kvmx_sudo_run chroot $WORK/ service ssh stop # Fix hostname in keys kvmx_sudo_run sed -i -e "s/root@.*$/root@$hostname.$domain/" $WORK/etc/ssh/*.pub # SSH dir sshdir="`dirname $image`/ssh/" mkdir -p $sshdir # Save host SSH key fingerprints for key in $WORK/etc/ssh/*pub; do ssh-keygen -l -f $key > $sshdir/`basename $key`.sha256 ssh-keygen -l -E md5 -f $key > $sshdir/`basename $key`.md5 done # Sudo echo "Installing sudo..." $APT_INSTALL sudo -y echo "%sudo ALL=NOPASSWD: ALL" | $SUDO tee $WORK/etc/sudoers.d/local > /dev/null # Scrambled root password #echo 'root:root' | kvmx_sudo_run chroot $WORK/ chpasswd echo "root:$(head -c 40 /dev/urandom | base64)" | kvmx_sudo_run chroot $WORK/ chpasswd # Initial user if ! grep -q "^$user:" $WORK/etc/passwd; then kvmx_sudo_run chroot $WORK/ useradd $user -G sudo -s /bin/bash fi # Initial user homedir kvmx_sudo_run mkdir -p $WORK/home/$user # There might be trouble managing the guest SSH keys when project folder name is different from # hostname: while kvmx-create uses $hostname to guess the pubkey file name, kvmx uses $VM. # Here we hope that # the user is not messing that much ;) #if [ "$ssh_support" == "y" ]; then if [ "$ssh_custom" == "y" ]; then if [ ! -z "$ssh_custom_pubkey" ]; then pubkey="$sshdir/$hostname.key.pub" if [ -e "$ssh_custom_pubkey" ]; then cp $ssh_custom_pubkey $pubkey else echo $ssh_custom_pubkey > $pubkey fi else privkey="$sshdir/$hostname.key" pubkey="${privkey}.pub" __kvmx_ssh_keygen $privkey "$user@$hostname" fi else pubkey="$DIRNAME/share/ssh/insecure_private_key.pub" fi kvmx_sudo_run chroot $WORK/ mkdir -p /home/$user/.ssh kvmx_sudo_run chroot $WORK/ chmod 700 /home/$user/.ssh kvmx_sudo_run cp $pubkey $WORK/home/$user/.ssh/authorized_keys kvmx_sudo_run chroot $WORK/ chmod 600 /home/$user/.ssh/authorized_keys kvmx_sudo_run touch $WORK/home/$user/.hushlogin # Cleanup temporary file if needed if [ ! -z "$ssh_custom_pubkey" ]; then rm $pubkey fi #fi kvmx_sudo_run chroot $WORK/ chown -R $user:$user /home/$user echo "$user:$password" | kvmx_sudo_run chroot $WORK/ chpasswd # Restore /etc/resolv.conf if [ -e "$WORK/etc/resolv.conf.dist" ]; then kvmx_sudo_run rm -f "$WORK/etc/resolv.conf" kvmx_sudo_run mv "$WORK/etc/resolv.conf.dist" "$WORK/etc/resolv.conf" fi } # Load config file kvmx_config_load $1 # Get config parameters kvmx_config # Check if [ -e "$image" ]; then kvmx_user_config overwrite n "WARNING: $image already exists. Overwrite the installation? (y/n)" if [ "$overwrite" != "y" ]; then exit 1 fi fi # Ensure base folder exists kvmx_sudo_run mkdir -p `dirname $image` # Dispatch kvmx_create_custom