v0.5.0-alpha: TTY1 installer (omarchy/archinstall-style)
Adds: - overlay/usr/local/sbin/veilor-installer — bash+whiptail TUI - overlay/etc/systemd/system/getty@tty1.service.d/veilor-installer.conf → replaces tty1 login with installer - ks: newt + parted + cryptsetup + lvm2 + btrfs-progs packages - ks: systemctl set-default multi-user.target (TTY1 lands first; user picks "Try live — desktop" from menu to isolate graphical.target) - ks: chmod +x veilor-installer in chroot %post Flow: 1. Boot ISO → TTY1 → ASCII banner + menu: 1) Install to disk 2) Try live — desktop 3) Try live — shell 4) Reboot 5) Power off 2. Install path: collects disk/hostname/LUKS/admin pw/locale via whiptail, generates /run/install/veilor-generated.ks, execs anaconda --kickstart= 3. Reboots into hardened install with full init_on_alloc/free cmdline Known limitations (v0.5.0-alpha): - Generated ks doesn't yet copy overlay/scripts into target (anaconda installs base Fedora, missing veilor branding/hardening). Fix in v0.5.1. - whiptail = ugly. v0.5.1 swaps to gum (Go TUI) for omarchy-tier UX. - No mid-install progress bar; anaconda runs unattended in same tty.
This commit is contained in:
veilor-org
parent
ebf0032559
commit
3328ffb460
3 changed files with 297 additions and 1 deletions
|
|
@ -92,6 +92,13 @@ syslinux
|
||||||
isomd5sum
|
isomd5sum
|
||||||
xorriso
|
xorriso
|
||||||
|
|
||||||
|
# veilor-installer dependencies (TTY1 TUI installer wrapping anaconda)
|
||||||
|
newt
|
||||||
|
parted
|
||||||
|
cryptsetup
|
||||||
|
lvm2
|
||||||
|
btrfs-progs
|
||||||
|
|
||||||
|
|
||||||
# core hardening tools
|
# core hardening tools
|
||||||
fail2ban
|
fail2ban
|
||||||
|
|
@ -198,7 +205,7 @@ echo " veilor-os install — %post"
|
||||||
echo "════════════════════════════════════════════════════════"
|
echo "════════════════════════════════════════════════════════"
|
||||||
|
|
||||||
REPO=/usr/share/veilor-os
|
REPO=/usr/share/veilor-os
|
||||||
chmod +x $REPO/scripts/*.sh $REPO/scripts/selinux/*.sh /usr/local/bin/veilor-power /usr/local/sbin/veilor-firstboot
|
chmod +x $REPO/scripts/*.sh $REPO/scripts/selinux/*.sh /usr/local/bin/veilor-power /usr/local/sbin/veilor-firstboot /usr/local/sbin/veilor-installer
|
||||||
|
|
||||||
# Live image plumbing (matches upstream Fedora live ks). Without these the
|
# Live image plumbing (matches upstream Fedora live ks). Without these the
|
||||||
# squashfs/EFI build fails — livesys-scripts ships systemd units lorax expects.
|
# squashfs/EFI build fails — livesys-scripts ships systemd units lorax expects.
|
||||||
|
|
@ -236,6 +243,11 @@ fi
|
||||||
# Without this, sddm stays inactive even though enabled.
|
# Without this, sddm stays inactive even though enabled.
|
||||||
ln -sf /usr/lib/systemd/system/sddm.service /etc/systemd/system/display-manager.service
|
ln -sf /usr/lib/systemd/system/sddm.service /etc/systemd/system/display-manager.service
|
||||||
|
|
||||||
|
# Live ISO default target: multi-user (TTY1 = veilor-installer TUI lands first).
|
||||||
|
# User picks "Try live — desktop" from menu → systemctl isolate graphical.target.
|
||||||
|
# Real installs land on graphical.target by default (set by anaconda).
|
||||||
|
systemctl set-default multi-user.target
|
||||||
|
|
||||||
# zram swap (no disk swap; keys never leak to platter)
|
# zram swap (no disk swap; keys never leak to platter)
|
||||||
dnf install -y zram-generator || true
|
dnf install -y zram-generator || true
|
||||||
cat > /etc/systemd/zram-generator.conf << 'EOF'
|
cat > /etc/systemd/zram-generator.conf << 'EOF'
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,16 @@
|
||||||
|
# veilor-os: replace tty1 login prompt with installer TUI.
|
||||||
|
# Live ISO ONLY. Removed by anaconda during real install (this overlay
|
||||||
|
# isn't copied into target system — see kickstart/install.ks).
|
||||||
|
[Service]
|
||||||
|
ExecStart=
|
||||||
|
ExecStart=-/usr/local/sbin/veilor-installer
|
||||||
|
StandardInput=tty
|
||||||
|
StandardOutput=tty
|
||||||
|
StandardError=tty
|
||||||
|
TTYPath=/dev/tty1
|
||||||
|
TTYReset=yes
|
||||||
|
TTYVHangup=yes
|
||||||
|
TTYVTDisallocate=yes
|
||||||
|
Type=idle
|
||||||
|
Restart=always
|
||||||
|
RestartSec=2
|
||||||
268
overlay/usr/local/sbin/veilor-installer
Normal file
268
overlay/usr/local/sbin/veilor-installer
Normal file
|
|
@ -0,0 +1,268 @@
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
# veilor-os installer — TUI wrapper around anaconda kickstart install.
|
||||||
|
# Runs on tty1 in place of getty (live ISO boot path).
|
||||||
|
#
|
||||||
|
# Flow:
|
||||||
|
# 1. ASCII banner
|
||||||
|
# 2. Menu: Install / Live shell / Reboot / Power off
|
||||||
|
# 3. If Install: collect answers via whiptail (disk, hostname, LUKS pw,
|
||||||
|
# admin pw, locale)
|
||||||
|
# 4. Generate /run/install/veilor-generated.ks from template + answers
|
||||||
|
# 5. Exec anaconda --kickstart=/run/install/veilor-generated.ks
|
||||||
|
# 6. On finish: reboot into installed system
|
||||||
|
#
|
||||||
|
# v0.5.0 — first cut. v0.5.1 swaps whiptail for gum (Go TUI, prettier).
|
||||||
|
|
||||||
|
set -uo pipefail
|
||||||
|
export TERM="${TERM:-linux}"
|
||||||
|
LOG=/var/log/veilor-installer.log
|
||||||
|
exec > >(tee -a "$LOG") 2>&1
|
||||||
|
|
||||||
|
banner() {
|
||||||
|
clear
|
||||||
|
cat << 'EOF'
|
||||||
|
|
||||||
|
▌ ▌▙▀▖▌ ▐▌▛▀▖▌ ▖▙▀▖▖▖
|
||||||
|
▙▖▌█ ▐▖▟▘▙▄▘▌ ▌▌ ▙▟
|
||||||
|
▘
|
||||||
|
veilor-os installer
|
||||||
|
hardened. branded. yours.
|
||||||
|
|
||||||
|
EOF
|
||||||
|
echo "──────────────────────────────────────────"
|
||||||
|
echo
|
||||||
|
}
|
||||||
|
|
||||||
|
require_tty() {
|
||||||
|
if ! [[ -t 0 && -t 1 ]]; then
|
||||||
|
echo "[ERR] veilor-installer must run on a real tty" >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
main_menu() {
|
||||||
|
local choice
|
||||||
|
choice=$(whiptail --title "veilor-os" \
|
||||||
|
--menu "Welcome. What would you like to do?" 16 60 5 \
|
||||||
|
"1" "Install veilor-os to disk" \
|
||||||
|
"2" "Try live — desktop (KDE Plasma)" \
|
||||||
|
"3" "Try live — shell" \
|
||||||
|
"4" "Reboot" \
|
||||||
|
"5" "Power off" \
|
||||||
|
3>&1 1>&2 2>&3)
|
||||||
|
echo "$choice"
|
||||||
|
}
|
||||||
|
|
||||||
|
collect_answers() {
|
||||||
|
local disk hostname luks_pw admin_pw locale
|
||||||
|
local disks_list
|
||||||
|
|
||||||
|
# ── Disk ──
|
||||||
|
disks_list=$(lsblk -dpno NAME,SIZE,MODEL | grep -E '^/dev/(sd|nvme|vd)' | awk '{print $1, $2"_"$3}')
|
||||||
|
if [[ -z $disks_list ]]; then
|
||||||
|
whiptail --title "veilor-os" --msgbox "No installable disks found." 8 50
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
disk=$(whiptail --title "Select install disk" \
|
||||||
|
--menu "WARNING: selected disk will be ERASED." 18 70 8 \
|
||||||
|
$disks_list 3>&1 1>&2 2>&3) || return 1
|
||||||
|
|
||||||
|
# ── Hostname ──
|
||||||
|
hostname=$(whiptail --title "Hostname" \
|
||||||
|
--inputbox "Set hostname:" 10 60 "veilor" \
|
||||||
|
3>&1 1>&2 2>&3) || return 1
|
||||||
|
|
||||||
|
# ── LUKS passphrase ──
|
||||||
|
luks_pw=$(whiptail --title "Disk encryption" \
|
||||||
|
--passwordbox "LUKS passphrase (full-disk encryption):" 10 60 \
|
||||||
|
3>&1 1>&2 2>&3) || return 1
|
||||||
|
[[ ${#luks_pw} -lt 8 ]] && {
|
||||||
|
whiptail --title "Weak passphrase" --msgbox "Min 8 chars." 8 40
|
||||||
|
return 1
|
||||||
|
}
|
||||||
|
|
||||||
|
# ── Admin password ──
|
||||||
|
admin_pw=$(whiptail --title "Admin password" \
|
||||||
|
--passwordbox "Admin user password (login after install):" 10 60 \
|
||||||
|
3>&1 1>&2 2>&3) || return 1
|
||||||
|
[[ ${#admin_pw} -lt 8 ]] && {
|
||||||
|
whiptail --title "Weak password" --msgbox "Min 8 chars." 8 40
|
||||||
|
return 1
|
||||||
|
}
|
||||||
|
|
||||||
|
# ── Locale ──
|
||||||
|
locale=$(whiptail --title "Locale" \
|
||||||
|
--menu "Choose locale:" 14 50 4 \
|
||||||
|
"en_GB.UTF-8" "English (UK)" \
|
||||||
|
"en_US.UTF-8" "English (US)" \
|
||||||
|
"de_DE.UTF-8" "Deutsch" \
|
||||||
|
"fr_FR.UTF-8" "Francais" \
|
||||||
|
3>&1 1>&2 2>&3) || return 1
|
||||||
|
|
||||||
|
# ── Confirmation ──
|
||||||
|
whiptail --title "Confirm install" --yesno \
|
||||||
|
"About to install veilor-os:
|
||||||
|
|
||||||
|
Disk: $disk (will be ERASED)
|
||||||
|
Hostname: $hostname
|
||||||
|
Locale: $locale
|
||||||
|
LUKS: set
|
||||||
|
Admin pw: set
|
||||||
|
|
||||||
|
Proceed?" 16 60 || return 1
|
||||||
|
|
||||||
|
# Export to caller via globals
|
||||||
|
SEL_DISK=$disk
|
||||||
|
SEL_HOSTNAME=$hostname
|
||||||
|
SEL_LUKS_PW=$luks_pw
|
||||||
|
SEL_ADMIN_PW=$admin_pw
|
||||||
|
SEL_LOCALE=$locale
|
||||||
|
return 0
|
||||||
|
}
|
||||||
|
|
||||||
|
generate_ks() {
|
||||||
|
# Build kickstart for actual disk install.
|
||||||
|
# NOTE: passwords go in via --plaintext to avoid storing crypted hash
|
||||||
|
# collisions; anaconda hashes per /etc/login.defs at install time.
|
||||||
|
local out=/run/install/veilor-generated.ks
|
||||||
|
mkdir -p /run/install
|
||||||
|
cat > "$out" << EOF
|
||||||
|
# veilor-os installer-generated kickstart
|
||||||
|
# DO NOT commit this file — secrets inline.
|
||||||
|
url --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64"
|
||||||
|
repo --name=fedora --baseurl="https://download.fedoraproject.org/pub/fedora/linux/releases/43/Everything/x86_64/os/" --install
|
||||||
|
repo --name=updates --baseurl="https://download.fedoraproject.org/pub/fedora/linux/updates/43/Everything/x86_64/" --install
|
||||||
|
|
||||||
|
keyboard --xlayouts='us'
|
||||||
|
lang $SEL_LOCALE
|
||||||
|
timezone Europe/London --utc
|
||||||
|
|
||||||
|
firstboot --disable
|
||||||
|
eula --agreed
|
||||||
|
selinux --enforcing
|
||||||
|
services --enabled=sshd,fail2ban,usbguard,tuned,auditd,firewalld,chronyd,sddm
|
||||||
|
|
||||||
|
network --bootproto=dhcp --device=link --activate --hostname=$SEL_HOSTNAME
|
||||||
|
firewall --enabled --service=ssh
|
||||||
|
|
||||||
|
rootpw --lock
|
||||||
|
user --name=admin --groups=wheel --gecos="veilor admin" --password="$SEL_ADMIN_PW" --plaintext
|
||||||
|
|
||||||
|
# Full hardening cmdline (installed system, not live):
|
||||||
|
bootloader --location=mbr --append="lockdown=integrity slab_nomerge init_on_alloc=1 init_on_free=1 randomize_kstack_offset=on vsyscall=none"
|
||||||
|
|
||||||
|
# Disk: zero, LUKS2 (argon2id), btrfs subvolumes
|
||||||
|
zerombr
|
||||||
|
clearpart --all --initlabel --drives=$(basename "$SEL_DISK")
|
||||||
|
part /boot/efi --fstype=efi --size=600 --asprimary
|
||||||
|
part /boot --fstype=ext4 --size=1024 --asprimary
|
||||||
|
part pv.veilor --grow --encrypted --luks-version=luks2 --pbkdf=argon2id --passphrase="$SEL_LUKS_PW"
|
||||||
|
volgroup veilor pv.veilor
|
||||||
|
logvol / --vgname=veilor --name=root --fstype=btrfs --grow
|
||||||
|
|
||||||
|
%packages --excludedocs
|
||||||
|
@^kde-desktop-environment
|
||||||
|
@kde-apps
|
||||||
|
@core
|
||||||
|
@hardware-support
|
||||||
|
@standard
|
||||||
|
fail2ban
|
||||||
|
fail2ban-firewalld
|
||||||
|
usbguard
|
||||||
|
usbguard-tools
|
||||||
|
audit
|
||||||
|
policycoreutils-python-utils
|
||||||
|
tuned
|
||||||
|
chrony
|
||||||
|
firewalld
|
||||||
|
plymouth
|
||||||
|
git
|
||||||
|
vim-enhanced
|
||||||
|
tmux
|
||||||
|
htop
|
||||||
|
podman
|
||||||
|
NetworkManager
|
||||||
|
NetworkManager-wifi
|
||||||
|
fontconfig
|
||||||
|
fira-code-fonts
|
||||||
|
zram-generator
|
||||||
|
-abrt*
|
||||||
|
-snapd
|
||||||
|
-kde-connect
|
||||||
|
-mlocate
|
||||||
|
%end
|
||||||
|
|
||||||
|
# Reboot when done
|
||||||
|
reboot
|
||||||
|
EOF
|
||||||
|
echo "[INFO] generated kickstart at $out"
|
||||||
|
return 0
|
||||||
|
}
|
||||||
|
|
||||||
|
run_install() {
|
||||||
|
whiptail --title "Installing" --infobox \
|
||||||
|
"Installing veilor-os to $SEL_DISK ...
|
||||||
|
This will take 10-30 minutes.
|
||||||
|
Logs: /var/log/veilor-installer.log + /tmp/anaconda.log" 10 60
|
||||||
|
sleep 2
|
||||||
|
# Hand off to anaconda. --kickstart runs unattended.
|
||||||
|
if anaconda --kickstart=/run/install/veilor-generated.ks; then
|
||||||
|
whiptail --title "Done" --msgbox \
|
||||||
|
"Install complete. System will reboot.
|
||||||
|
Remove the install media after shutdown." 10 50
|
||||||
|
sleep 3
|
||||||
|
systemctl reboot
|
||||||
|
else
|
||||||
|
whiptail --title "Install failed" --msgbox \
|
||||||
|
"Anaconda exited non-zero.
|
||||||
|
Logs at /tmp/anaconda.log + /var/log/veilor-installer.log.
|
||||||
|
Press OK to drop to shell." 12 60
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
drop_to_shell() {
|
||||||
|
clear
|
||||||
|
cat << 'EOF'
|
||||||
|
═══════════════════════════════════════════════════
|
||||||
|
veilor-os live shell
|
||||||
|
═══════════════════════════════════════════════════
|
||||||
|
|
||||||
|
You are in a live, in-memory environment.
|
||||||
|
Nothing persists across reboot.
|
||||||
|
|
||||||
|
Re-run the installer: sudo veilor-installer
|
||||||
|
Reboot: sudo systemctl reboot
|
||||||
|
Power off: sudo systemctl poweroff
|
||||||
|
|
||||||
|
EOF
|
||||||
|
exec /bin/bash --login
|
||||||
|
}
|
||||||
|
|
||||||
|
# ── Entry ──
|
||||||
|
require_tty
|
||||||
|
banner
|
||||||
|
|
||||||
|
launch_desktop() {
|
||||||
|
clear
|
||||||
|
echo "Launching KDE Plasma..."
|
||||||
|
sleep 1
|
||||||
|
systemctl isolate graphical.target
|
||||||
|
# systemd-isolate switches target; sddm spawns on tty1.
|
||||||
|
# If user logs out, they come back here. Loop continues.
|
||||||
|
}
|
||||||
|
|
||||||
|
while true; do
|
||||||
|
case "$(main_menu)" in
|
||||||
|
1)
|
||||||
|
if collect_answers && generate_ks; then
|
||||||
|
run_install || continue
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
2) launch_desktop ;;
|
||||||
|
3) drop_to_shell ;;
|
||||||
|
4) systemctl reboot ;;
|
||||||
|
5) systemctl poweroff ;;
|
||||||
|
*) drop_to_shell ;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
Loading…
Reference in a new issue