debian.cfg

#_preseed_V1
# shellcheck disable=SC1091,SC2148
# https://www.debian.org/releases/stable/amd64/apbs04.zh-cn.html
# https://www.debian.org/releases/stable/example-preseed.txt
# https://preseed.debian.net/debian-preseed/trixie/amd64-main-full.txt
# 需要留意 kali initrd 自带的 /preseed.cfg

  # 下面这行语句无效，因为本行后面有反斜杠，前面有空格（安装器认为不算注释）\
d-i debian-installer/locale string en_US.UTF-8

# B.4.1. 本地化
d-i debian-installer/locale string en_US.UTF-8
d-i keyboard-configuration/xkb-keymap select us

# B.4.2. 网络设置
d-i netcfg/get_hostname string unassigned-hostname
d-i netcfg/get_domain string unassigned-domain
d-i netcfg/hostname string localhost

# B.4.3. 网络控制台

# B.4.4. 镜像设置
d-i mirror/country string manual
# d-i mirror/http/hostname string deb.debian.org

# B.4.5. 帐号设置
d-i passwd/make-user boolean false
# 注意如果用 ssh key 后面还要删除密码
# d-i passwd/root-password password ''
# d-i passwd/root-password-again password ''
# d-i passwd/root-password-crypted password ''
# kali 需要下面这行，否则会提示输入用户名
d-i passwd/root-login boolean true

# B.4.6. 时钟与时区设置
d-i time/zone string Asia/Shanghai

# B.4.7. 分区
d-i partman-auto/method string regular
d-i partman-lvm/device_remove_lvm boolean true
d-i partman-md/device_remove_md boolean true
d-i partman-partitioning/confirm_write_new_label boolean true
d-i partman/choose_partition select finish
d-i partman/confirm boolean true
d-i partman/confirm_nooverwrite boolean true

# vm 原有系统是 bios + gpt，切换成 efi，用 iso 重装，需要确认此项
# 用脚本重装的话，强制安装在第二个硬盘上也可能会遇到？
d-i partman-efi/non_efi_system boolean true

### Description: Do you want to return to the partitioning menu?
#   You have not selected any partitions for use as swap space. Enabling swap
#   space is recommended so that the system can make better use of the
#   available physical memory, and so that it behaves better when physical
#   memory is scarce. You may experience installation problems if you do not
#   have enough physical memory.
#   .
#   If you do not go back to the partitioning menu and assign a swap partition,
#   the installation will continue without swap space.
# 坑的一比
# 不是确认是否 no_swap
# 而是 recipe no_swap 时，确认是否返回上一级重新分区
# 选择 true 就一直死循环
d-i partman-basicfilesystems/no_swap boolean false

# 分区大小计算
# https://salsa.debian.org/installer-team/partman-base/-/blob/master/lib/base.sh

# 最小值 膨胀权重 最大值
# https://salsa.debian.org/installer-team/partman-auto/-/blob/master/recipes/atomic?ref_type=heads
# https://salsa.debian.org/installer-team/partman-auto/-/blob/master/recipes-amd64-efi/atomic?ref_type=heads
# shellcheck disable=SC1083,SC2086,SC2154
d-i partman-auto/expert_recipe_efi string efi :: \
    106 1 106 free \
    $iflabel{ gpt } method{ efi } format{ } . \
    1 1 -1 $default_filesystem \
    method{ format } format{ } use_filesystem{ } $default_filesystem{ } mountpoint{ / } .

# 大于 2T 会自动用 gpt
# shellcheck disable=SC1083,SC2086,SC2154
d-i partman-auto/expert_recipe_bios string bios :: \
    1 1 1 free \
    $iflabel{ gpt } method{ biosgrub } . \
    1 1 -1 $default_filesystem \
    method{ format } format{ } use_filesystem{ } $default_filesystem{ } mountpoint{ / } .

# B.4.8. 基本系统安装

# B.4.9. 设置 apt
d-i apt-setup/non-free boolean true
d-i apt-setup/non-free-firmware boolean true
d-i apt-setup/contrib boolean true
d-i apt-setup/enable-source-repositories boolean false
# kali 不要设置
# d-i apt-setup/security_host string security.debian.org

# B.4.10. 选择软件包
tasksel tasksel/first multiselect ssh-server
d-i pkgsel/upgrade select none

# B.4.11. 安装 bootloader
# 添加 bootx64.efi
d-i grub-installer/force-efi-extra-removable boolean true

# B.4.12. 完成安装
# 由下面的 hold 2 设置
# d-i finish-install/reboot_in_progress note

# B.4.13. 预置其他的软件包

# 其他设置
# d-i anna/standard_modules boolean false
# d-i anna/choose_modules string network-console
# d-i network-console/password password ''
# d-i network-console/password-again password ''

# B.5.1. 安装过程中运行用户命令
# 注意所有命令都会合并成一行命令

# 最后的 true; \ 没什么用，只是让 vscode 代码高亮不报错误

# debian 11+ 才有 websocketd

# 有 /cdrom/simple-cdd 才安装 simple-cdd-profiles
# 不然安装时 control 脚本会报错：
# Loading simple-cdd-profiles failed for unknown reasons

# 未下载的组件，无法用 debconf-set，需要用 debconf-set-selections

# https://salsa.debian.org/installer-team/network-console/-/blob/master/debian/network-console.postinst?ref_type=heads
# https://salsa.debian.org/installer-team/user-setup/-/blob/master/user-setup-apply?ref_type=heads

# 此时还没有配置源，anna-install 会在配置完源后再安装
d-i preseed/early_command string true; \
    for str in $(grep -wo "extra_[^ ]*" /proc/cmdline | sed 's/^extra_//'); do eval "$str"; done; \

    di(){ \
        echo "d-i $*" >/tmp/selections.cfg; \
        echo "d-i $*" >>/tmp/selections.cfg.all; \
        debconf-set-selections /tmp/selections.cfg; \
        rm -f /tmp/selections.cfg; \
    }; \

    run_as_service_with_screen() { \
        if ! [ -f /etc/screenrc.bak ]; then \
            cp /etc/screenrc /etc/screenrc.bak; \
        fi; \
        true >/etc/screenrc; \
        screen sh -c 'while true; do pidof ${1##*/} || "$@"; sleep 5; done' _ "$@"; \
        cp -f /etc/screenrc.bak /etc/screenrc; \
    }; \

    if [ "$hold" = 1 ]; then \
        di auto-install/enable boolean false; \
        di debconf/priority select low; \
        di partman/early_command string; \
    else \
        { \
            echo 'Reinstalling...'; \
            echo 'Option 1. View logs:'; \
            echo '    tail -fn+1 /var/log/syslog'; \
            echo 'Option 2. Attach to the installer:'; \
            echo '    TERM=screen screen -xp1'; \
        } >>/etc/motd; \
        mem=$(grep ^MemTotal: /proc/meminfo | { read -r _ y _; echo "$((y / 1024))"; }); \
        if command -v websocketd && [ "$mem" -ge 400 ]; then \
            for _ in {1..10}; do \
                if wget "$confhome/logviewer.html" -O /tmp/index.html; then \
                    break; \
                fi; \
                sleep 5; \
            done; \
            if [ -z "$web_port" ]; then \
                web_port=80; \
            fi; \
            run_as_service_with_screen websocketd --port 80 --loglevel=fatal --staticdir=/tmp \
                sh -c "tail -fn+0 /var/log/syslog | tr '\r' '\n' | grep -Fiv -e password -e token" ; \
        fi; \
    fi; \

    if ! [ "$hold" = 2 ]; then \
        di finish-install/reboot_in_progress note; \
    fi; \

    if [ -s /configs/ssh_keys ]; then \
        di passwd/root-password-crypted password "''"; \
    else \
        di passwd/root-password-crypted password "$(cat /configs/password-linux-sha512)"; \
    fi; \

    mkdir -p /etc/ssh; \
    true >/etc/ssh/sshd_config; \
    if [ -s /configs/ssh_keys ]; then \
        (umask 077; mkdir -p /.ssh; cat /configs/ssh_keys >/.ssh/authorized_keys); \
    else \
        echo "PermitRootLogin yes" >>/etc/ssh/sshd_config; \
    fi; \
    if [ -n "$ssh_port" ] && ! [ "$ssh_port" = 22 ]; then \
        echo "Port $ssh_port" >>/etc/ssh/sshd_config; \
    fi; \
    grep -qs ^root: /etc/shadow || echo "root:$(cat /configs/password-linux-sha512):1:0:99999:7:::" >>/etc/shadow; \
    grep -qs ^nogroup: /etc/group || echo "nogroup:*:65534:" >>/etc/group; \
    grep -qs ^sshd: /etc/passwd || echo "sshd:*:100:65534::/run/sshd:/bin/false" >>/etc/passwd; \
    mkdir -p /run/sshd; \
    chmod 0755 /run/sshd; \
    ssh-keygen -A; \
    run_as_service_with_screen /usr/sbin/sshd -D; \

    if [ -s /configs/frpc.toml ]; then \
        url=$(sh /get-frpc-url.sh linux); \
        mkdir -p /usr/local/bin; \
        mkdir -p /usr/local/etc/frpc; \
        for _ in {1..10}; do \
            if wget -O- "$url" | tar xz "*/frpc" -O >/usr/local/bin/frpc; then \
                break; \
            fi; \
            sleep 5; \
        done; \
        chmod a+x /usr/local/bin/frpc; \
        cp /configs/frpc.toml /usr/local/etc/frpc/; \
        run_as_service_with_screen /usr/local/bin/frpc -c /usr/local/etc/frpc/frpc.toml; \
    fi; \

    if [ -d /cdrom/simple-cdd ]; then \
        anna-install simple-cdd-profiles; \
    fi

# debian 11 initrd 没有 xargs awk
# debian 12 initrd 没有 xargs
# efi 分区大小未改变时，不会被格式化，因此需要手动删除旧系统的 efi 文件
# os-prober 卡太久，因此跳过
d-i partman/early_command string true; \
    eval "$(grep -o 'extra_confhome=[^ ]*' /proc/cmdline | sed 's/^extra_//')"; \

    postinst=/var/lib/dpkg/info/bootstrap-base.postinst; \
    cp $postinst $postinst.orig; \
    true >$postinst; \

    swapfile=/target/swapfile; \
    mem=$(grep ^MemTotal: /proc/meminfo | { read -r _ y _; echo "$((y / 1024))"; }); \
    swap_size=$((512 - mem)); \
    if [ $swap_size -gt 0 ]; then \
       echo "fallocate -l ${swap_size}M $swapfile; mkswap $swapfile; swapon $swapfile" >>$postinst; \
    fi; \

    echo "swapoff -a; rm -f $swapfile" >/usr/lib/finish-install.d/95swapoff; \
    chmod a+x /usr/lib/finish-install.d/95swapoff; \

    echo "rm -rf /target/boot/efi/*; $postinst.orig" >>$postinst; \

    xda=$(sh /get-xda.sh); \
    debconf-set partman-auto/disk "/dev/$xda"; \
    debconf-set grub-installer/bootdev "/dev/$xda"; \
    rm -rf /usr/sbin/fdisk /usr/sbin/sfdisk; \

    ttys=$(sh /ttys.sh console=); \
    debconf-set debian-installer/add-kernel-opts "$ttys"; \

    eths=$(cd /dev/netconf/ && ls); \

    if ! sh /can_use_cloud_kernel.sh "$xda" $eths; then \
        debconf-set base-installer/kernel/image "$(debconf-get base-installer/kernel/image | sed 's/-cloud//')"; \
    fi; \

    if [ -d /sys/firmware/efi ]; then \
        debconf-set partman-auto/expert_recipe "$(debconf-get partman-auto/expert_recipe_efi)"; \
    else \
        debconf-set partman-auto/expert_recipe "$(debconf-get partman-auto/expert_recipe_bios)"; \
    fi; \

    true >/bin/os-prober

# kali ssh 默认关闭
# 另一种方法处理 cloudcone
# if [ "$link_grub_dir" = 1 ]; then mkdir /target/boot/grub2; echo 'chainloader (hd0)+1' >/target/boot/grub2/grub.cfg; fi; \
# debian 9 tar 不支持 --strip-components
d-i preseed/late_command string true; \
    for str in $(grep -wo "extra_[^ ]*" /proc/cmdline | sed 's/^extra_//'); do eval "$str"; done; \

    if [ "$elts" = 1 ]; then sed -i "s|deb\.freexian\.com/extended-lts|$deb_mirror|" /target/etc/apt/sources.list; fi; \

    if [ "$link_grub_dir" = 1 ]; then ln -s grub /target/boot/grub2; fi; \

    in-target systemctl enable ssh; \

    if [ -s /configs/ssh_keys ]; then \
        (umask 077; mkdir -p /target/root/.ssh; cat /configs/ssh_keys >/target/root/.ssh/authorized_keys); \
        in-target passwd -d root; \
    else \
        echo "PermitRootLogin yes" >/target/etc/ssh/sshd_config.d/01-permitrootlogin.conf || \
        echo "PermitRootLogin yes" >>/target/etc/ssh/sshd_config; \
    fi; \

    if [ -n "$ssh_port" ] && ! [ "$ssh_port" = 22 ]; then \
        echo "Port $ssh_port" >/target/etc/ssh/sshd_config.d/01-change-ssh-port.conf || \
        echo "Port $ssh_port" >>/target/etc/ssh/sshd_config; \
    fi; \

    if [ -s /configs/frpc.toml ]; then \
        mkdir -p /target/usr/local/bin; \
        mkdir -p /target/usr/local/etc/frpc; \
        cp /usr/local/bin/frpc /target/usr/local/bin/; \
        cp /usr/local/etc/frpc/frpc.toml /target/usr/local/etc/frpc/; \
        chmod a+x /target/usr/local/bin/frpc; \
        cp /frpc.service /target/etc/systemd/system/; \
        in-target systemctl enable frpc; \
    fi; \

    cp /fix-eth-name.sh /target/; \
    cp /fix-eth-name.service /target/etc/systemd/system/; \
    in-target systemctl enable fix-eth-name