274 lines
13 KiB
XML
274 lines
13 KiB
XML
<?xml version="1.0" encoding="UTF-8" ?>
|
|
<aif xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xmlns="https://aif-ng.io/"
|
|
xsi:schemaLocation="https://aif-ng.io/ http://schema.xml.r00t2.io/projects/aif.xsd"
|
|
chrootPath="/mnt/aif"
|
|
reboot="false">
|
|
<bootstrap>
|
|
<tarball>
|
|
https://arch.mirror.square-r00t.net/iso/latest/archlinux-bootstrap-2020.03.01-x86_64.tar.gz
|
|
</tarball>
|
|
<!-- <tarball>-->
|
|
<!-- file:///tmp/archlinux-bootstrap-2020.01.01-x86_64.tar.gz-->
|
|
<!-- </tarball>-->
|
|
<verify>
|
|
<gpg>
|
|
<sigs>
|
|
<signatureFile>
|
|
https://arch.mirror.square-r00t.net/iso/latest/archlinux-bootstrap-2020.03.01-x86_64.tar.gz.sig
|
|
</signatureFile>
|
|
<!-- <signatureFile>-->
|
|
<!-- file:///tmp/archlinux-bootstrap-2020.01.01-x86_64.tar.gz.sig-->
|
|
<!-- </signatureFile>-->
|
|
</sigs>
|
|
<keys detect="false">
|
|
<keyID>0x4AA4767BBC9C4B1D18AE28B77F2D434B9741E8AC</keyID>
|
|
</keys>
|
|
</gpg>
|
|
<hash>
|
|
<checksumFile hashType="md5" fileType="gnu">
|
|
http://arch.mirror.square-r00t.net/iso/latest/md5sums.txt
|
|
</checksumFile>
|
|
<checksumFile hashType="sha1" fileType="gnu">
|
|
http://arch.mirror.square-r00t.net/iso/latest/sha1sums.txt
|
|
</checksumFile>
|
|
</hash>
|
|
</verify>
|
|
</bootstrap>
|
|
<storage>
|
|
<blockDevices>
|
|
<disk id="sda" device="/dev/sda" diskFormat="gpt">
|
|
<!-- Partitions are numbered *in the order they are specified*. -->
|
|
<!-- e.g. "boot" would be /dev/sda1, "secrets1" would be /dev/sda2, etc. -->
|
|
<part id="boot" name="BOOT" label="/boot" start="0%" stop="10%" fsType="fat32">
|
|
<partitionFlag>esp</partitionFlag>
|
|
</part>
|
|
<part id="secrets1" name="crypted" label="shh" start="10%" stop="20%" fsType="ext4">
|
|
<partitionFlag>root</partitionFlag>
|
|
</part>
|
|
<part id="lvm_member1" name="jbod" label="dynamic" start="20%" stop="30%" fsType="ext4">
|
|
<partitionFlag>lvm</partitionFlag>
|
|
</part>
|
|
<part id="raid1_d1" start="30%" stop="55%" fsType="ext4">
|
|
<partitionFlag>raid</partitionFlag>
|
|
</part>
|
|
<part id="raid1_d2" start="55%" stop="80%" fsType="ext4">
|
|
<partitionFlag>raid</partitionFlag>
|
|
</part>
|
|
<part id="swapdisk" start="80%" stop="90%" fsType="linux-swap(v1)">
|
|
<partitionFlag>swap</partitionFlag>
|
|
</part>
|
|
<!-- You can also create a partition with no flags (and not use). -->
|
|
<part id="grow" start="90%" stop="100%" fsType="ext4"/>
|
|
</disk>
|
|
</blockDevices>
|
|
<!-- "Special" devices are processed *in the order they are specified*. This is important if you wish to
|
|
e.g. layer LVM on top of LUKS - you would specify <lvm> before <luks> and reference the
|
|
<luksDev id="SOMETHING" ... > as <pv source="SOMETHING" ... />.
|
|
Of course, a limitation of this is you cannot e.g. first assemble a LUKS volume, then an LVM
|
|
group, and then another LUKS volume - so plan accordingly and/or perform that in
|
|
a <post> script instead. -->
|
|
<luks>
|
|
<luksDev id="luks_secrets" name="secrets" source="secrets1">
|
|
<!-- You can assign multiple secrets (or "keys") to a LUKS volume. -->
|
|
<secrets>
|
|
<!-- A simple passphrase. -->
|
|
<passphrase>secrets1</passphrase>
|
|
</secrets>
|
|
<secrets>
|
|
<!-- A key that uses a keyfile on a mounted path. This example uses the passphrase in
|
|
a plaintext file, which is in turn read by LUKS. -->
|
|
<passphrase>secrets1</passphrase>
|
|
<keyFile>/boot/.decrypt.plaintext</keyFile>
|
|
</secrets>
|
|
<secrets>
|
|
<!-- This will generate a 4096-byte file of random data. -->
|
|
<keyFile size="4096">/root/.decrypt.key</keyFile>
|
|
</secrets>
|
|
</luksDev>
|
|
</luks>
|
|
<lvm>
|
|
<volumeGroup id="vg1" name="group1" extentSize="4MiB">
|
|
<physicalVolumes>
|
|
<pv id="pv1" source="lvm_member1"/>
|
|
</physicalVolumes>
|
|
<logicalVolumes>
|
|
<!-- Default is to add all available PVs in PhysicalVolumes... -->
|
|
<lv id="lv1" name="logical1" size="80%"/>
|
|
<lv id="lv2" name="logical2" size="512MiB">
|
|
<!-- But you can also explicitly designate them. They have to still be in the same volumeGroup.
|
|
This is generally speaking a *terrible* idea, though, because it makes getting the
|
|
sizes right virtually *impossible*. If you do this, you should consistently ONLY use
|
|
bytes for each LV size and know the size of the PVs/VGs ahead of time. -->
|
|
<pvMember source="pv1"/>
|
|
</lv>
|
|
</logicalVolumes>
|
|
</volumeGroup>
|
|
</lvm>
|
|
<mdadm>
|
|
<!-- level can be 0, 1, 4, 5, 6, or 10. RAID 1+0 (which is different from mdadm RAID10) would be done by
|
|
creating an array with members of a previously defined array. -->
|
|
<array id="mdadm1" name="data" meta="1.2" level="1">
|
|
<member source="raid1_d1"/>
|
|
<member source="raid1_d2"/>
|
|
</array>
|
|
</mdadm>
|
|
<fileSystems>
|
|
<fs id="esp" source="boot" type="vfat">
|
|
<!-- Supports mkfs arguments. Leave off the filesystem type and device name, obviously;
|
|
those are handled by the above attributes. -->
|
|
<opt name="-F">32</opt>
|
|
<opt name="-n">ESP</opt>
|
|
</fs>
|
|
<fs id="luks" source="luks_secrets" type="ext4">
|
|
<opt name="-L">seekrit</opt>
|
|
</fs>
|
|
<fs id="swap" source="swap" type="swap"/>
|
|
<fs id="vg1-lv1" source="lv1" type="ext4"/>
|
|
<fs id="mdraid" source="mdadm1" type="ext4"/>
|
|
</fileSystems>
|
|
<mountPoints>
|
|
<!-- And you use the id to reference mountpoints as well. Important to note, we mount *filesystems*,
|
|
not partitions/disks/etc. -->
|
|
<!-- Note that targets should be *outside* of the chroot!
|
|
e.g. /aif/storage/mountPoints[@target="/mnt/aif/boot"]
|
|
and
|
|
/aif/system[@chrootPath="/mnt/aif"]
|
|
would lead to the filesystem being accessible *inside* the chroot (and thus the completed install)
|
|
at /boot. -->
|
|
<mount source="luks" target="/mnt/aif">
|
|
<opt name="rw"/>
|
|
<opt name="relatime"/>
|
|
<opt name="compress">lzo</opt>
|
|
<opt name="ssd"/>
|
|
<opt name="space_cache"/>
|
|
<opt name="subvolid">5</opt>
|
|
<opt name="subvol">/</opt>
|
|
</mount>
|
|
<mount source="esp" target="/mnt/aif/boot"/>
|
|
<mount source="swap" target="swap"/>
|
|
<mount source="vg1-lv1" target="/mnt/aif/mnt/pool"/>
|
|
<mount source="mdraid" target="/mnt/aif/mnt/raid"/>
|
|
</mountPoints>
|
|
</storage>
|
|
<network hostname="aiftest.square-r00t.net" provider="netctl">
|
|
<ethernet id="lan" device="auto" defroute="true" searchDomain="domain.tld">
|
|
<addresses>
|
|
<ipv4 auto="true">
|
|
<address gateway="192.168.1.1">192.168.1.5/24</address>
|
|
</ipv4>
|
|
<ipv6 auto="slaac">
|
|
<address>fde4:16b9:654b:bbfa::15/64</address>
|
|
</ipv6>
|
|
</addresses>
|
|
<routes>
|
|
<ipv4 auto="true">
|
|
<route gateway="192.168.1.1">10.1.1.0/24</route>
|
|
<route gateway="10.1.1.4">172.16.1.20/32</route>
|
|
</ipv4>
|
|
<ipv6 auto="true"/>
|
|
</routes>
|
|
<resolvers>
|
|
<ipv4 auto="false"/>
|
|
<ipv6 auto="false"/>
|
|
<resolver>64.6.64.6</resolver>
|
|
<resolver>4.2.2.1</resolver>
|
|
<resolver>8.8.8.8</resolver>
|
|
</resolvers>
|
|
</ethernet>
|
|
<wireless id="wlan" device="wlp2s0" essid="MyWirelessLan"
|
|
bssid="00-00-5E-00-53-00" defroute="false" searchDomain="wifi.lan">
|
|
<addresses>
|
|
<ipv4 auto="true"/>
|
|
</addresses>
|
|
<routes>
|
|
<ipv6 auto="true"/>
|
|
</routes>
|
|
<encryption>
|
|
<type>wpa2</type>
|
|
<creds>
|
|
<psk isKey="false">ABadWiFiPassword</psk>
|
|
<!-- Or the key itself. See the manual for ways to generate this. -->
|
|
<!-- <psk isKey="true">ca8981cbe55374c7408af0174604588111b4611832969f87fc5604fe4c36365c</psk> -->
|
|
</creds>
|
|
</encryption>
|
|
</wireless>
|
|
</network>
|
|
<system timezone="EST5EDT">
|
|
<rootPassword>
|
|
<passwordPlain>1ns3cur3p4ssw0rd</passwordPlain>
|
|
</rootPassword>
|
|
<locales>
|
|
<locale name="LANG">en_US.UTF-8</locale>
|
|
</locales>
|
|
<console>
|
|
<text>
|
|
<font>default8x16</font>
|
|
</text>
|
|
<keyboard>
|
|
<map>us</map>
|
|
</keyboard>
|
|
</console>
|
|
<!-- Note: The password hash below is "test"; don't waste your time trying to crack. :) -->
|
|
<users>
|
|
<user name="aifusr"
|
|
home="/opt/aifusr"
|
|
sudo="true"
|
|
comment="A test user for AIF.">
|
|
<password>
|
|
<passwordHash hashType="(detect)">
|
|
$6$WtxZKOyaahvvWQRG$TUys60kQhF0ffBdnDSJVTA.PovwCOajjMz8HEHL2H0ZMi0bFpDTQvKA7BqzM3nA.ZMAUxNjpJP1dG/eA78Zgw0
|
|
</passwordHash>
|
|
</password>
|
|
<xGroup name="admins" create="true"/>
|
|
<xGroup name="wheel"/>
|
|
<xGroup name="users"/>
|
|
</user>
|
|
</users>
|
|
<services>
|
|
<service status="true">sshd</service>
|
|
</services>
|
|
</system>
|
|
<pacman>
|
|
<mirrorList>
|
|
<mirror>http://arch.mirror.square-r00t.net/$repo/os/$arch</mirror>
|
|
<mirror>http://mirror.us.leaseweb.net/archlinux/$repo/os/$arch</mirror>
|
|
<mirror>http://ftp.osuosl.org/pub/archlinux/$repo/os/$arch</mirror>
|
|
<mirror>http://arch.mirrors.ionfish.org/$repo/os/$arch</mirror>
|
|
<mirror>http://mirrors.gigenet.com/archlinux/$repo/os/$arch</mirror>
|
|
<mirror>http://mirror.jmu.edu/pub/archlinux/$repo/os/$arch</mirror>
|
|
</mirrorList>
|
|
<repos>
|
|
<repo name="core" enabled="true" sigLevel="default">
|
|
<include>file:///etc/pacman.d/mirrorlist</include>
|
|
</repo>
|
|
<repo name="extra" enabled="true" sigLevel="default"/>
|
|
<repo name="community" enabled="true" sigLevel="default"/>
|
|
<repo name="multilib" enabled="true" sigLevel="default"/>
|
|
<repo name="testing" enabled="false" sigLevel="default"/>
|
|
<repo name="multilib-testing" enabled="false" sigLevel="default"/>
|
|
<repo name="sqrt" enabled="false" sigLevel="Required">
|
|
<mirror>https://$repo.arch.repo.square-r00t.net</mirror>
|
|
</repo>
|
|
</repos>
|
|
<software>
|
|
<package repo="core">sed</package>
|
|
<package>python</package>
|
|
<package>perl</package>
|
|
<package>openssh</package>
|
|
</software>
|
|
</pacman>
|
|
<bootloader type="grub" target="/boot" efi="true"/>
|
|
<scripts>
|
|
<pre>
|
|
<script>https://aif.square-r00t.net/sample-scripts/pre/first.sh</script>
|
|
<script>https://aif.square-r00t.net/sample-scripts/pre/second.pl</script>
|
|
</pre>
|
|
<post>
|
|
<script>https://aif.square-r00t.net/sample-scripts/post/first.sh</script>
|
|
<script>https://aif.square-r00t.net/sample-scripts/post/second.py</script>
|
|
</post>
|
|
</scripts>
|
|
</aif>
|
|
|