aboutsummaryrefslogtreecommitdiff
path: root/kvmx-create
blob: 70812ff52d50794224518b2f9e111f005a83535a (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
#!/usr/bin/env bash
#
# kvmx-create virtual machine installer
#
# Copyright (C) 2017 Silvio Rhatto - rhatto at riseup.net
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published
# by the Free Software Foundation, either version 3 of the License,
# or any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
#

# Parameters
BASENAME="`basename $0`"
DIRNAME="`dirname $0`"
GLOBAL_USER_CONFIG_FILE="$HOME/.config/kvmxconfig"

# Load basic functions
export APP_BASE="`$DIRNAME/kvmx app_base`"
source $APP_BASE/lib/kvmx/functions || exit 1

# Load configuration
function kvmx_config_load {
  if [ ! -z "$1" ] && [ -e "$1" ]; then
    source $1
  fi
}

# Read a parameter from user
function kvmx_user_input {
  local input
  local param="$1"
  local default="$2"
  shift 2

  if echo $param | grep -q 'passwd'; then
    read -s -rep "$* (defaults to $default): " input
  else
    read -rep "$* (defaults to $default): " input
  fi

  if [ -z "$input" ]; then
    export $param="$default"
  else
    export $param="$input"
  fi
}

# Get a configuration parameter if not previously defined by a sourced file
function kvmx_user_config {
  local param="$1"
  local default="$2"
  shift 2

  if [ -z "`eval echo '$'$param`" ]; then
    kvmx_user_input $param $default $*
  fi
}

# Install a package
function kvmx_install_package {
  if [ -z "$1" ]; then
    return
  fi

  dpkg -s $1 &> /dev/null

  if [ "$?" == "1" ]; then
    echo "Installing package $1..."
    DEBIAN_FRONTEND=noninteractive $SUDO apt-get install $1 -y || exit 1
  fi
}

# Abort on error
function kvmx_exit_on_error {
  if [ "$?" != "0" ]; then
    echo "Error: $*"
    exit 1
  fi
}

# Run a command using sudo and abort on error
function kvmx_sudo_run {
  if [ "`whoami`" != 'root' ]; then
    SUDO="sudo"
  fi

  $SUDO $*
  kvmx_exit_on_error $*
}

# Make sure there is provision config.
function kvmx_config {
  if [ -e "$GLOBAL_USER_CONFIG_FILE" ]; then
    source $GLOBAL_USER_CONFIG_FILE
  fi

  local default_password="`head -c 20 /dev/urandom | base64`"

  kvmx_user_config   hostname          machine                          "Hostname"
  kvmx_user_config   domain            example.org                      "Domain"
  kvmx_user_config   arch              amd64                            "System arch"
  kvmx_user_config   version           stretch                          "Distro version"
  kvmx_user_config   mirror            https://deb.debian.org/debian/   "Debian mirror"
  #kvmx_user_config  ssh_support       y                                "Administration using passwordless SSH (y/n)"
  kvmx_user_config   ssh_custom        y                                "Setup a custom SSH keypair (y/n)"
  kvmx_user_config   user              user                             "Initial user name"
  kvmx_user_config   password          $default_password                "Initial user password"
  kvmx_user_config   net               user                             "Networking config (user or tap)"

  if [ "$net" == "tap" ]; then
    kvmx_user_config net_ip            10.1.1.2                         "IP address"
    kvmx_user_config net_mask          255.255.0                        "Netmask"
    kvmx_user_config net_gateway       10.1.1.1                         "Gateway"
    kvmx_user_config net_dns           192.168.1.1                      "DNS"
  fi

  if [ ! -z "$image_base" ]; then
    image="$image_base/$hostname/box.img"
  else
    image_base="$HOME/.local/share/kvmx"
    kvmx_user_config image             $image_base/$hostname/box.img    "Destination image (ending in .img)"
  fi

  kvmx_user_config   size              3G                               "Image size"
  kvmx_user_config   format            qcow2                            "Image format: raw or qcow2"

  if [ "$format" == "qcow2" ]; then
    kvmx_user_config qcow2_compression y                                "Image compression (y/n)"
  fi

  kvmx_user_config   method            custom                           "Bootstrap method: custom or vmdeboostrap"
  kvmx_user_config   bootloader        grub                             "Bootloader: grub or extlinux"
}

# Load config file
kvmx_config_load $1

# Get config parameters
kvmx_config

# Check
if [ -e "$image" ]; then
  kvmx_user_config overwrite n "WARNING: $image already exists. Overwrite the installation? (y/n)"

  if [ "$overwrite" != "y" ]; then
    exit 1
  fi
fi

# Ensure base folder exists
kvmx_sudo_run mkdir -p `dirname $image`

#
# vmdebootstrap version
#
function kvmx_create_vmdebootstrap {
  # Check for requirements
  for req in vmdebootstrap; do
    kvmx_install_package $req
  done

  # Image format
  if [ "$format" == "qcow2" ]; then
    format="--convert-qcow2"

    if [ "$qcow2_compression" == "y" ]; then
      compression="-c"
    fi
  fi

  if [ "$booloader" == "grub" ]; then
    boot_option="--grub"
  fi

  # Run
  kvmx_sudo_run vmdebootstrap --verbose --image=$image --size=$size --distribution=$version \
                              --mirror=$mirror --arch=$arch --hostname=$hostname.$domain $boot_option $format

  # Fix permissions
  kvmx_sudo_run chown -R `whoami`. `dirname $image`

  # Cleanup
  kvmx_sudo_run rm debootstrap.log
  kvmx_sudo_run rm ${image}.raw
}

#
# Custom version
#
function kvmx_create_custom {
  # Check dependencies
  DEPENDENCIES="sudo apt qemu-img sed awk tr head debootstrap chroot"
  __kvmx_check_dependencies

  # Check for package requirements
  #for req in debootstrap parted apt-transport-https; do
  for req in debootstrap parted; do
    kvmx_install_package $req
  done

  if [ -z "$TMP" ]; then
    TMP="/tmp"
  fi

  WORK="`mktemp -d $TMP/kvmx-create.XXXXXXXXXX`"

  # Determine kernel architecture
  if [ "$arch" == "i386" ]; then
    kernel_arch="686"
  else
    kernel_arch="$arch"
  fi

  # Check the host distro
  host_distro="`head -n 1 /etc/issue | cut -d ' ' -f 1 | tr '[:upper:]' '[:lower:]'`"

  # Determine distro and kernel package name
  if echo $mirror | grep 'ubuntu'; then
    distro="ubuntu"
    kernel_package="linux-image-generic"

    if [ "$host_distro" == "debian" ]; then
      kvmx_install_package ubuntu-archive-keyring
    fi
  else
  #elif echo $mirror | grep 'debian'; then
    distro="debian"
    kernel_package="linux-image-$kernel_arch"

    if [ "$host_distro" == "ubuntu" ]; then
      kvmx_install_package debian-archive-keyring
    fi
  fi

  if [ -z "$image_type" ] || [ "$image_type" == "file" ]; then
    echo "Creating image file..."
    #kvmx_sudo_run dd if=/dev/zero of=$image bs=$size count=1
    kvmx_sudo_run qemu-img create -f raw $image $size
    device="`sudo losetup --find --show $image`"
    partition_prefix="p"
  elif [ -e "$image" ]; then
    device="`readlink $image || echo $image`"
  else
    echo "$BASENAME: image device $image does not exist"
    exit 1
  fi

  echo "Partitioning image at $device..."
  kvmx_sudo_run parted -s -- $device mklabel gpt
  kvmx_sudo_run parted -s -- $device unit    MB mkpart    non-fs 2  3
  kvmx_sudo_run parted -s -- $device set     1  bios_grub on
  kvmx_sudo_run parted -s -- $device unit    MB mkpart    ext2   3 -1
  kvmx_sudo_run parted -s -- $device set     2  boot on
  kvmx_sudo_run mkfs.ext4 ${device}${partition_prefix}2
  kvmx_sudo_run mount ${device}${partition_prefix}2 $WORK/

  # Trap $WORK umount
  trap 'if [ -e "$WORK" ]; then umount $WORK/{sys,proc,dev} &> /dev/null; umount $WORK &> /dev/null; rmdir $WORK; fi' INT TERM EXIT

  # Non-interactive installation
  #APT_INSTALL="LC_ALL=C DEBIAN_FRONTEND=noninteractive kvmx_sudo_run chroot $WORK/ apt-get install -y"
  #APT_INSTALL="kvmx_sudo_run LC_ALL=C DEBIAN_FRONTEND=noninteractive chroot $WORK/ apt-get install -y"
  APT_INSTALL="kvmx_sudo_run chroot $WORK/ /usr/bin/env LC_ALL=C DEBIAN_FRONTEND=noninteractive /usr/bin/apt-get install -y"

  # Initial system install.
  echo "Installing base system..."
  LC_ALL=C DEBIAN_FRONTEND=noninteractive kvmx_sudo_run debootstrap \
    --force-check-gpg --arch=$arch $version $WORK/ $mirror

  # Initial configuration.
  echo "Applying initial configuration..."

  # Hostname configuration.
  echo $hostname.$domain     | $SUDO tee    $WORK/etc/hostname > /dev/null
  echo "127.0.0.1 localhost" | $SUDO tee -a $WORK/etc/hosts    > /dev/null

  # This ordering is important for facter correctly guess the domain name
  echo "127.0.0.1 $hostname.$domain $hostname" | $SUDO tee -a $WORK/etc/hosts > /dev/null

  # Invert hostname contents to avoid http://projects.puppetlabs.com/issues/2533
  tac $WORK/etc/hosts | $SUDO tee $WORK/etc/hosts.new > /dev/null
  kvmx_sudo_run mv $WORK/etc/hosts.new $WORK/etc/hosts

  # Fstab
  echo "/dev/vda2 / ext4 errors=remount-ro 0 1" | $SUDO tee $WORK/etc/fstab > /dev/null

  # Apt
  if [ "$distro" == "debian" ]; then
    if [ "$version" != "sid" ]; then
      echo "deb http://security.debian.org/ $version/updates main contrib non-free"     | $SUDO tee -a $WORK/etc/apt/sources.list > /dev/null
      echo "deb-src http://security.debian.org/ $version/updates main contrib non-free" | $SUDO tee -a $WORK/etc/apt/sources.list > /dev/null
    fi
  elif [ "$distro" == "ubuntu" ]; then
    $SUDO sed -i -e 's/main/main restricted universe multiverse/' $WORK/etc/apt/sources.list

    echo "deb http://archive.ubuntu.com/ubuntu/ ${version}-updates main restricted universe multiverse"        | $SUDO tee -a $WORK/etc/apt/sources.list > /dev/null
    echo "deb-src http://archive.ubuntu.com/ubuntu/ ${version}-updates main restricted universe multiverse"    | $SUDO tee -a $WORK/etc/apt/sources.list > /dev/null
    echo "deb http://archive.ubuntu.com/ubuntu/ ${version}-backports main restricted universe multiverse"      | $SUDO tee -a $WORK/etc/apt/sources.list > /dev/null
    echo "#deb-src http://archive.ubuntu.com/ubuntu/ ${version}-backports main restricted universe multiverse" | $SUDO tee -a $WORK/etc/apt/sources.list > /dev/null
    echo "deb http://security.ubuntu.com/ubuntu ${version}-security main restricted universe multiverse"       | $SUDO tee -a $WORK/etc/apt/sources.list > /dev/null
    echo "#deb-src http://security.ubuntu.com/ubuntu ${version}-security main restricted universe multivers"   | $SUDO tee -a $WORK/etc/apt/sources.list > /dev/null
    echo "#deb http://archive.canonical.com/ubuntu ${version} partner"     | $SUDO tee -a $WORK/etc/apt/sources.list > /dev/null
    echo "#deb-src http://archive.canonical.com/ubuntu ${version} partner" | $SUDO tee -a $WORK/etc/apt/sources.list > /dev/null
    echo "#deb http://extras.ubuntu.com/ubuntu ${version} main"            | $SUDO tee -a $WORK/etc/apt/sources.list > /dev/null
  fi

  # Mount auxiliary filesystems needed by the bootloader
  kvmx_sudo_run mount none -t proc  $WORK/proc
  kvmx_sudo_run mount none -t sysfs $WORK/sys
  kvmx_sudo_run mount -o bind /dev/ $WORK/dev

  # Initial upgrade
  echo "Updating list of packages..."
  kvmx_sudo_run chroot $WORK/ apt-get update
  kvmx_sudo_run chroot $WORK/ apt-get dist-upgrade -y

  # Install kernel after mounting /proc
  $APT_INSTALL $kernel_package

  if [ "$bootloader" == "grub" ]; then
    $APT_INSTALL grub-pc

    # Serial console support
    echo ''                                            | $SUDO tee -a $WORK/etc/default/grub > /dev/null
    echo '# Custom configuration'                      | $SUDO tee -a $WORK/etc/default/grub > /dev/null
    echo 'GRUB_TERMINAL=serial'                        | $SUDO tee -a $WORK/etc/default/grub > /dev/null
    echo 'GRUB_SERIAL_COMMAND="serial --speed=115200"' | $SUDO tee -a $WORK/etc/default/grub > /dev/null
    echo 'GRUB_CMDLINE_LINUX="console=ttyS0,115200n8"' | $SUDO tee -a $WORK/etc/default/grub > /dev/null

    kvmx_sudo_run chroot $WORK/ update-grub
    kvmx_sudo_run chroot $WORK/ grub-install $device
    # Possible alternatives:
    # https://packages.debian.org/jessie/grub-firmware-qemu
    # https://superuser.com/questions/130955/how-to-install-grub-into-an-img-file
    #kvmx_sudo_run grub-install --boot-directory=$WORK/boot $image
  elif [ "$bootloader" == "extlinux" ]; then
    # http://www.grulic.org.ar/~mdione/glob/posts/create-a-disk-image-with-a-booting-running-debian/
    # http://www.syslinux.org/wiki/index.php?title=EXTLINUX
    # http://www.syslinux.org/wiki/index.php?title=Mbr
    $APT_INSTALL extlinux
    kvmx_sudo_run chroot $WORK/ extlinux --install /boot
    kvmx_sudo_run dd bs=440 count=1 conv=notrunc if=$WORK/usr/lib/EXTLINUX/gptmbr.bin of=$device
    cat <<-EOF | $SUDO tee $WORK/boot/syslinux.cfg > /dev/null
default linux
timeout 1

label   linux
say     Booting linux...
linux   /vmlinuz
append  root=/dev/vda1 ro
initrd  /initrd.img
EOF
  fi

  # Umount auxiliary filesystems
  kvmx_sudo_run umount $WORK/proc
  kvmx_sudo_run umount $WORK/sys
  kvmx_sudo_run umount $WORK/dev

  # Run basic provision
  __kvmx_create_custom_second_stage

  # Umount image
  kvmx_sudo_run umount $WORK
  kvmx_sudo_run rmdir  $WORK

  # Pack guest image
  if [ -z "$image_type" ] || [ "$image_type" == "file" ]; then
    kvmx_sudo_run losetup -d $device

    # Image conversion
    if [ "$format" == "qcow2" ]; then
      echo "Converting raw image to qcow2..."
      kvmx_sudo_run mv $image $image.raw
      kvmx_sudo_run qemu-img convert -O qcow2 -p $compression ${image}.raw $image
      kvmx_sudo_run rm ${image}.raw
    fi
  fi

  # Fix permissions
  if [ "`whoami`" != "root" ]; then
    kvmx_sudo_run chown -R `whoami`. `dirname $image`
  fi
}

# Second stage procedure
function __kvmx_create_custom_second_stage {
  if [ ! -z "$net_ip" ] && [ ! -z "$net_mask" ] && [ ! -z "$net_gateway" ]; then
    # Networking
    # See #799253 - virtio ens3 network interface
    #     https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=799253
    for net_dev in eth0 ens3 ens4; do
      cat <<-EOF | $SUDO tee $WORK/etc/network/interfaces.d/$net_dev > /dev/null
auto $net_dev
iface $net_dev inet static
  address $net_ip
  netmask $net_mask
  gateway $net_gateway
EOF
    done
  else
    # Networking
    # See #799253 - virtio ens3 network interface
    #     https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=799253
    for net_dev in eth0 ens3 ens4; do
      cat <<-EOF | $SUDO tee $WORK/etc/network/interfaces.d/$net_dev > /dev/null
allow-hotplug $net_dev
iface $net_dev inet dhcp
EOF
    done
  fi

  # DNS config
  if [ ! -z "$net_dns" ]; then
    if [ "$net_dns" == "host" ]; then
      cp /etc/resolv.conf $WORK/etc/resolv.conf
    else
      echo "nameserver $net_dns" > $WORK/etc/resolv.conf
    fi
  fi

  # Locale
  $APT_INSTALL locales
  echo "LANG=$LANG"  | $SUDO tee    $WORK/etc/default/locale > /dev/null
  echo "$LANG UTF-8" | $SUDO tee -a $WORK/etc/locale.gen     > /dev/null
  kvmx_sudo_run chroot $WORK/ locale-gen

  # Basic packages
  $APT_INSTALL screen cron lsb-release openssl rsync
  $APT_INSTALL spice-vdagent qemu-guest-agent

  # OpenSSH
  $APT_INSTALL openssh-server -y
  kvmx_sudo_run chroot $WORK/ service ssh stop

  # Fix hostname in keys
  kvmx_sudo_run sed -i -e "s/root@.*$/root@$hostname.$domain/" $WORK/etc/ssh/*.pub

  # SSH dir
  sshdir="`dirname $image`/ssh/"
  mkdir -p $sshdir

  # Save host SSH key fingerprints
  for key in $WORK/etc/ssh/*pub; do
    ssh-keygen -l        -f $key > $sshdir/`basename $key`.sha256
    ssh-keygen -l -E md5 -f $key > $sshdir/`basename $key`.md5
  done

  # Sudo
  echo "Installing sudo..."
  $APT_INSTALL sudo -y
  echo "%sudo ALL=NOPASSWD: ALL" | $SUDO tee $WORK/etc/sudoers.d/local > /dev/null

  # Scrambled root password
  #echo 'root:root'                               | kvmx_sudo_run chroot $WORK/ chpasswd
  echo "root:$(head -c 40 /dev/urandom | base64)" | kvmx_sudo_run chroot $WORK/ chpasswd

  # Initial user
  if ! grep -q "^$user:" $WORK/etc/passwd; then
    kvmx_sudo_run chroot $WORK/ useradd $user -G sudo -s /bin/bash
  fi

  # Initial user homedir
  kvmx_sudo_run mkdir -p $WORK/home/$user

  #if [ "$ssh_support" == "y" ]; then
  if [ "$ssh_custom" == "y" ]; then
    if [ ! -z "$ssh_custom_pubkey" ]; then
      pubkey="$sshdir/$hostname.key.pub"

      if [ -e "$ssh_custom_pubkey" ]; then
        cp $ssh_custom_pubkey $pubkey
      else
        echo $ssh_custom_pubkey > $pubkey
      fi
    else
      privkey="$sshdir/$hostname.key"
      pubkey="${privkey}.pub"
      __kvmx_ssh_keygen $privkey "$user@$hostname"
    fi
  else
    pubkey="$DIRNAME/share/ssh/insecure_private_key.pub"
  fi

  kvmx_sudo_run chroot $WORK/ mkdir -p /home/$user/.ssh
  kvmx_sudo_run chroot $WORK/ chmod 700 /home/$user/.ssh
  kvmx_sudo_run cp $pubkey $WORK/home/$user/.ssh/authorized_keys
  kvmx_sudo_run chroot $WORK/ chmod 600 /home/$user/.ssh/authorized_keys
  kvmx_sudo_run touch  $WORK/home/$user/.hushlogin

  # Cleanup temporary file if needed
  if [ ! -z "$ssh_custom_pubkey" ]; then
    rm $pubkey
  fi
  #fi

  kvmx_sudo_run chroot $WORK/ chown -R $user.$user /home/$user
  echo "$user:$password" | kvmx_sudo_run chroot $WORK/ chpasswd
}

# Dispatch
if [ "$method" == "custom" ]; then
  kvmx_create_custom
elif [ "$method" == "vmdebootstrap" ]; then
  kvmx_create_vmdebootstrap
else
  echo "$BASENAME: invalid method $method"
  exit 1
fi