ungleich-tools/opennebula-images/centos7-build-luks-opennebula-image.sh

#!/bin/sh

# This script generates CentOS images for OpenNebula. Expected to run on CentOS 7.

# Depends on the following packages:
#   qemu-img util-linux coreutils dnf curl e2fsprogs cryptsetup parted

# Run locally (without network) with:
#   qemu-system-x86_64 -enable-kvm -m 1G -drive file=$IMAGE,format=raw

set -e
set -x

RELEASE=7
ARCH=x86_64
IMAGE_PATH=centos-luks-$RELEASE-$(date --iso-8601).img
IMAGE_SIZE=10G
LOOPBACK_DEVICE=/dev/loop0
LUKS_DEVICE_NAME=cryptroot
LUKS_DEVICE="/dev/mapper/$LUKS_DEVICE_NAME"
DISABLED_ONE_SCRIPTS="loc-20-set-username-password loc-22-ssh_public_key"

ONE_CONTEXT_RPM_URL="https://github.com/OpenNebula/addon-context-linux/releases/download/v5.10.0/one-context-5.10.0-1.el$RELEASE.noarch.rpm"
ONE_CONTEXT_RPM_PATH=/root/one-context.rpm

# Get LUKS passphrase.
if [ -z "$1" ]; then
	echo "Usage: centos7-build-luks-opennebula-image.sh LUKS_PASSPHRASE"
	exit 1
fi
LUKS_PASSPHRASE="$1"

cleanup() {
	# The order here is important.
	umount /mnt/dev/pts 2>/dev/null || true
	umount /mnt/dev/shm 2>/dev/null || true
	umount /mnt/dev 2>/dev/null || true
	umount /mnt/proc 2>/dev/null || true
	umount /mnt/run 2>/dev/null || true
	umount /mnt/sys 2>/dev/null || true
	umount /mnt/boot 2>/dev/null || true
	umount /mnt 2>/dev/null || true
	losetup -d "$LOOPBACK_DEVICE"
}

run_root() {
	chroot /mnt /usr/bin/env \
		PATH=/sbin:/usr/sbin:/bin:/usr/bin \
		sh -c "$*"
}

if [ "$(whoami)" != 'root' ]; then
	echo "This script must be run as root." >&2
	exit 1
fi

if [ ! -f '/etc/centos-release' ]; then
	echo "WARNING: this script has been designed to run on a CentOS system." >&2
	echo "WARNING: Not running CentOS. Giving you 5 seconds to abort." >&2
	sleep 5
fi

# Install requirements
yum install -y qemu cryptsetup dnf

# Create base RAW image (no LOOPBACK support in RHEL/CentOS).
qemu-img create -f raw "$IMAGE_PATH" "$IMAGE_SIZE"
losetup "$LOOPBACK_DEVICE" "$IMAGE_PATH"

# Don't forget to cleanup, even if the script crash.
trap cleanup EXIT

# Create partition table, format partitions.
parted --script "$LOOPBACK_DEVICE" \
	mklabel msdos \
	mkpart primary ext4 1M 500M \
	mkpart primary ext4 500M 100%

partprobe "$LOOPBACK_DEVICE"

mkfs.ext4 "${LOOPBACK_DEVICE}p1"
echo -n "$LUKS_PASSPHRASE" | cryptsetup luksFormat -v -d - "${LOOPBACK_DEVICE}p2"
echo -n "$LUKS_PASSPHRASE" | cryptsetup open -v -d - "${LOOPBACK_DEVICE}p2" "$LUKS_DEVICE_NAME"
mkfs.ext4 "$LUKS_DEVICE"

# Mount partitions, install base OS.
mount "${LUKS_DEVICE}" /mnt
mkdir /mnt/boot
mount "${LOOPBACK_DEVICE}p1" /mnt/boot

# Add --setopt=reposdir=rpm-repositories if you do not run on CentOS 7.
dnf -y \
	--releasever=$RELEASE \
	--installroot=/mnt \
	--disablerepo='*' \
	--enablerepo=base \
	--enablerepo=extras \
	--setopt=install_weak_deps=False install \
	bash basesystem systemd dnf centos-release cryptsetup dnf

mount --bind /dev /mnt/dev
mount --bind /dev/pts /mnt/dev/pts
mount --bind /dev/shm /mnt/dev/shm
mount --bind /proc /mnt/proc
mount --bind /run /mnt/run
mount --bind /sys /mnt/sys

# Guest networking is to be handled by the one-context package.
# See https://github.com/OpenNebula/addon-context-linux for details.
# Note: as of writing, one-context does not support NetworkManager or
# systemd-networkd.

# Required to resolve package mirror in chroot.
cp /etc/resolv.conf /mnt/etc/resolv.conf

# Initialize /etc/hosts.
cat > /mnt/etc/hosts << EOF
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
EOF

# Install one-context RPM and hope things works as expected.
curl -L "$ONE_CONTEXT_RPM_URL" > "/mnt$ONE_CONTEXT_RPM_PATH"
run_root dnf -y install "$ONE_CONTEXT_RPM_PATH"
run_root rm "$ONE_CONTEXT_RPM_PATH"
for script in $DISABLED_ONE_SCRIPTS; do
	run_root rm "/etc/one-context.d/$script"
done

# Install resize2fs, which is required to resize the root file-system.
run_root dnf -y install e2fsprogs

# Initalize base services.
run_root systemd-machine-id-setup
run_root ln -sf /usr/share/zoneinfo/UTC /etc/localtime

# Install and configure NTP client.
run_root dnf install -y chrony
run_root systemctl enable chronyd.service

# Install kernel and bootloader.
# Note: linux-firmware is not required our environment and takes almost 200M
# uncompressed but is a direct dependency of kernel-core...
run_root dnf -y install kernel grub2

# Add support for virtio block devices at boot time, configure bootloader.
cat > /mnt/etc/dracut.conf.d/virtio-blk.conf <<EOF
add_drivers="virtio-blk"
EOF
kernel_version=$(ls /mnt/boot | grep "vmlinuz.*.$ARCH" | cut -d- -f2-)
luks_uuid=$(blkid -o value "${LOOPBACK_DEVICE}p2" | head -n 1)
echo "cryptroot  UUID=$luks_uuid  luks,timeout=30" >> /mnt/etc/crypttab

run_root dracut -v --force --kver $kernel_version
run_root grub2-install --target=i386-pc "${LOOPBACK_DEVICE}"
run_root grub2-mkconfig -o /boot/grub2/grub.cfg

# Install en configure SSH daemon.
run_root dnf -y install openssh-server
run_root systemctl enable sshd

# Generate fstab file.
boot_uuid=$(blkid -o value "${LOOPBACK_DEVICE}p1" | head -n 1)
root_uuid=$(blkid -o value "$LUKS_DEVICE" | head -n 1)
cat >>/mnt/etc/fstab <<EOF
UUID=$boot_uuid /boot ext4 rw,relatime,data=ordered 0 2
UUID=$root_uuid /     ext4 rw,relatime,data=ordered 0 1
EOF

# Reset systemd's environment.
run_root rm -f /etc/machine-id
run_root touch /etc/machine-id
rm -f /var/lib/systemd/random-seed

# Remove temporary files and reclaim freed disk space.
# Note: build logs could be removed as well.
run_root dnf clean all

# Make sure everything is written to disk before exiting.
sync

# Cleanup!
cleanup