147 lines
6.2 KiB
Bash
147 lines
6.2 KiB
Bash
#!/usr/bin/env bash
|
|
# build-iso.sh — decrypt secrets → envsubst template → build autoinstall ISO
|
|
#
|
|
# DEPENDENCIES:
|
|
# sudo apt install sops age xorriso gettext-base
|
|
# OR macOS: brew install sops age xorriso gettext
|
|
#
|
|
# FIRST TIME SETUP:
|
|
# 1. age-keygen -o ~/.config/sops/age/keys.txt
|
|
# 2. Paste the public key (age1...) into .sops.yaml
|
|
# 3. Fill in secrets.yaml, then encrypt:
|
|
# sops -e secrets.yaml > secrets.sops.yaml && rm secrets.yaml
|
|
# 4. git add .sops.yaml secrets.sops.yaml user-data.tmpl build-iso.sh .gitignore scripts/
|
|
#
|
|
# USAGE:
|
|
# ./build-iso.sh
|
|
# ./build-iso.sh --ubuntu-iso ~/Downloads/ubuntu-24.04-live-server-amd64.iso
|
|
|
|
set -euo pipefail
|
|
|
|
UBUNTU_ISO="${UBUNTU_ISO:-}"
|
|
UBUNTU_VERSION="24.04"
|
|
UBUNTU_ISO_URL="https://releases.ubuntu.com/${UBUNTU_VERSION}/ubuntu-${UBUNTU_VERSION}-live-server-amd64.iso"
|
|
WORK_DIR="$(mktemp -d /tmp/autoinstall-build.XXXXXX)"
|
|
OUTPUT_ISO="autoinstall-$(date +%Y%m%d-%H%M).iso"
|
|
SOPS_FILE="secrets.sops.yaml"
|
|
TEMPLATE_FILE="user-data.tmpl"
|
|
RENDERED_FILE="user-data.yaml"
|
|
POST_INSTALL_SCRIPT="scripts/post-install.sh"
|
|
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
RED='\033[0;31m'
|
|
NC='\033[0m'
|
|
info() { echo -e "${GREEN}[+]${NC} $*"; }
|
|
warn() { echo -e "${YELLOW}[!]${NC} $*"; }
|
|
error() {
|
|
echo -e "${RED}[✗]${NC} $*"
|
|
exit 1
|
|
}
|
|
|
|
while [[ $# -gt 0 ]]; do
|
|
case $1 in
|
|
--ubuntu-iso)
|
|
UBUNTU_ISO="$2"
|
|
shift 2
|
|
;;
|
|
*) error "Unknown argument: $1" ;;
|
|
esac
|
|
done
|
|
|
|
cleanup() {
|
|
info "Cleaning up..."
|
|
rm -rf "$WORK_DIR"
|
|
if [[ -f "$RENDERED_FILE" ]]; then
|
|
rm -f "$RENDERED_FILE"
|
|
info "Deleted plaintext $RENDERED_FILE"
|
|
fi
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
for cmd in sops envsubst xorriso; do
|
|
command -v "$cmd" &>/dev/null || error "'$cmd' not found. Install it first."
|
|
done
|
|
[[ -f "$SOPS_FILE" ]] || error "Secrets file '$SOPS_FILE' not found."
|
|
[[ -f "$TEMPLATE_FILE" ]] || error "Template '$TEMPLATE_FILE' not found."
|
|
[[ -f "$POST_INSTALL_SCRIPT" ]] || error "Post-install script '$POST_INSTALL_SCRIPT' not found."
|
|
[[ -f ".sops.yaml" ]] || error ".sops.yaml not found in current directory."
|
|
|
|
export SOPS_AGE_KEY_FILE="${SOPS_AGE_KEY_FILE:-$HOME/.config/sops/age/keys.txt}"
|
|
[[ -f "$SOPS_AGE_KEY_FILE" ]] || error "age key not found at $SOPS_AGE_KEY_FILE"
|
|
|
|
# ── Decrypt secrets → render template ─────────────────────────────────────────
|
|
info "Decrypting secrets and rendering template..."
|
|
sops exec-env "$SOPS_FILE" "envsubst < $TEMPLATE_FILE > $RENDERED_FILE"
|
|
|
|
if grep -qE '\$\{[A-Z_]+\}' "$RENDERED_FILE"; then
|
|
warn "Some variables were NOT substituted:"
|
|
grep -oE '\$\{[A-Z_]+\}' "$RENDERED_FILE" | sort -u | sed 's/^/ /'
|
|
error "Add the missing keys to secrets.yaml and re-encrypt."
|
|
fi
|
|
info "Template rendered."
|
|
|
|
# ── Get Ubuntu ISO ─────────────────────────────────────────────────────────────
|
|
if [[ -z "$UBUNTU_ISO" ]]; then
|
|
UBUNTU_ISO="ubuntu-${UBUNTU_VERSION}-live-server-amd64.iso"
|
|
if [[ ! -f "$UBUNTU_ISO" ]]; then
|
|
info "Downloading Ubuntu ${UBUNTU_VERSION} server ISO..."
|
|
curl -L --progress-bar -o "$UBUNTU_ISO" "$UBUNTU_ISO_URL"
|
|
else
|
|
info "Found cached ISO: $UBUNTU_ISO"
|
|
fi
|
|
fi
|
|
[[ -f "$UBUNTU_ISO" ]] || error "ISO not found: $UBUNTU_ISO"
|
|
|
|
# ── Extract ISO ────────────────────────────────────────────────────────────────
|
|
info "Extracting ISO..."
|
|
xorriso -osirrox on -indev "$UBUNTU_ISO" -extract / "$WORK_DIR/iso" 2>/dev/null
|
|
chmod -R u+w "$WORK_DIR/iso"
|
|
|
|
# ── Inject autoinstall files ───────────────────────────────────────────────────
|
|
info "Injecting autoinstall config and post-install script..."
|
|
NOCLOUD_DIR="$WORK_DIR/iso/nocloud"
|
|
mkdir -p "$NOCLOUD_DIR"
|
|
cp "$RENDERED_FILE" "$NOCLOUD_DIR/user-data"
|
|
cp "$POST_INSTALL_SCRIPT" "$NOCLOUD_DIR/post-install.sh"
|
|
touch "$NOCLOUD_DIR/meta-data"
|
|
|
|
# The installer runs in a live env where the ISO is mounted at /cdrom.
|
|
# post-install.sh lands at /cdrom/nocloud/post-install.sh but curtin in-target
|
|
# runs inside the installed system chroot, so we copy it to /target first.
|
|
# We add a prep command to late-commands via a second write — easier to just
|
|
# add a copy step before the main script call in user-data. We handle it here
|
|
# by prepending a cp command as an additional late-command note:
|
|
# (already handled in user-data.tmpl with: curtin in-target -- bash /post-install.sh
|
|
# which works because the file is written to /target by the nocloud datasource)
|
|
|
|
# ── Patch GRUB ────────────────────────────────────────────────────────────────
|
|
GRUB_CFG="$WORK_DIR/iso/boot/grub/grub.cfg"
|
|
if [[ -f "$GRUB_CFG" ]]; then
|
|
info "Patching GRUB for unattended boot..."
|
|
sed -i 's|linux\s*/casper/vmlinuz\(.*\)|linux /casper/vmlinuz\1 autoinstall ds=nocloud;s=/cdrom/nocloud/|' "$GRUB_CFG"
|
|
sed -i 's/set timeout=.*/set timeout=0/' "$GRUB_CFG"
|
|
fi
|
|
|
|
# ── Repack ISO ─────────────────────────────────────────────────────────────────
|
|
info "Repacking ISO → $OUTPUT_ISO ..."
|
|
xorriso -as mkisofs \
|
|
-r -V "Ubuntu-AutoInstall" -o "$OUTPUT_ISO" \
|
|
-J -joliet-long \
|
|
-b boot/grub/i386-pc/eltorito.img -c boot.catalog \
|
|
-no-emul-boot -boot-load-size 4 -boot-info-table \
|
|
--grub2-boot-info \
|
|
--grub2-mbr "$WORK_DIR/iso/boot/grub/i386-pc/boot_hybrid.img" \
|
|
-eltorito-alt-boot \
|
|
-e --interval:appended_partition_2:all:: -no-emul-boot \
|
|
-append_partition 2 28732ac11ff8d211ba4b00a0c93ec93b "$WORK_DIR/iso/boot/grub/efi.img" \
|
|
-iso_mbr_part_type a2a0d0ebe5b9334487c068b6b72699c7 \
|
|
"$WORK_DIR/iso" 2>/dev/null
|
|
|
|
info "Done! ✓"
|
|
echo ""
|
|
echo -e " Output: ${GREEN}${OUTPUT_ISO}${NC}"
|
|
echo -e " Flash: sudo dd if=${OUTPUT_ISO} of=/dev/sdX bs=4M status=progress oflag=sync"
|
|
echo ""
|
|
warn "Plaintext user-data.yaml deleted. secrets.yaml never hit disk."
|