bootstrap.yml

# Copyright © 2019 4km3
# https://github.com/orgs/4km3/people

#   This file is part of archify.

#   archify is free software: you can redistribute it and/or modify
#   it under the terms of the GNU General Public License as published by
#   the Free Software Foundation, either version 3 of the License, or
#   (at your option) any later version.

#   archify is distributed in the hope that it will be useful,
#   but WITHOUT ANY WARRANTY; without even the implied warranty of
#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#   GNU General Public License for more details.

#   You should have received a copy of the GNU General Public License
#   along with archify.  If not, see <https://www.gnu.org/licenses/>.

# SPDX-License-Identifier: GPL-3.0-or-later
---
- name: Bootstrap Arch Linux
  tags: bootstrap
  hosts: bootstrap
  gather_facts: no
  vars:
    sudoers_config: "%wheel ALL=(ALL) NOPASSWD: ALL"
    home: "{{ lookup('env', 'HOME') }}"
    user: "{{ lookup('env', 'USER') }}"
    pubkey: "{{ home }}/.ssh/keys.d/id_ed25519-{{ user }}@{{ ansible_host }}.pub"
    key: "{{ lookup('file', pubkey) }}"

  pre_tasks:
    - name: Fix .ssh/known_hosts
      local_action:
        module: known_hosts
        name: "{{ item }}"
        state: absent
      loop:
        - "{{ ansible_host }}"
        - "{{ lookup('dig', ansible_host) }}"

    - name: Add target host ssh pubkey fingerprint to our known_hosts
      local_action:
        module: known_hosts
        name: "{{ ansible_host }}"
        key: "{{ lookup('pipe', 'ssh-keyscan -t ed25519 ' + ansible_host) }}"

    - name: Ensure time is set correctly
      shell: timedatectl set-ntp true

    - name: Identify main block device
      shell: >
        lsblk --nodeps --exclude 7 --sort HOTPLUG --output NAME,HOTPLUG --noheadings | awk '/0$/ { print $1; exit }'
        # Note: use the following line instead to force a specific device
        #echo -n sdb
      register: lsblk_output

    - name: Determine if p prefix is needed for main block device parts
      set_fact:
        target_block_device_part_prefix: p
      when: "'nvme' in lsblk_output.stdout"

    - name: Export main block device as a fact
      set_fact:
        target_block_device: /dev/{{ lsblk_output.stdout }}
        target_block_device_base: /dev/{{ lsblk_output.stdout }}{{ target_block_device_part_prefix | default() }}

    - name: Export volumes as a fact
      set_fact:
        esp_volume: "{{ target_block_device_base }}1"
        swap_volume: "{{ target_block_device_base }}2"
        root_volume: "{{ target_block_device_base }}3"

    - name: Clear stale EFI boot entries
      command:
        efibootmgr -B -b "{{ item }}"
      loop: "{{ range(0, 6)|list }}"
      ignore_errors: yes

    - name: Ensure no container is running on /mnt
      ignore_errors: yes
      command:
        machinectl poweroff target-on-mnt
      args:
        warn: false

    - name: Ensure no fs is mounted
      ignore_errors: yes
      command:
        umount -R /mnt

    - name: Ensure no crypto device is open
      ignore_errors: yes
      command:
        cryptsetup luksClose arch
      when: want_fde is defined and want_fde

  roles:
    - pacman
    - role: partition
      main_block_device: "{{ target_block_device }}"
      main_block_device_base: "{{ target_block_device_base }}"
    - role: encryption
      when: want_fde is defined and want_fde
      main_block_device_base: "{{ root_volume }}"
    - role: filesystems
      filesystems_esp_volume: "{{ esp_volume }}"
      filesystems_swap_volume: "{{ swap_volume }}"
      filesystems_root_volume: "{{ root_volume }}"

  tasks:
    - name: Mount main block device on /mnt
      mount:
        name: /mnt
        src: "{{ root_volume }}"
        fstype: btrfs
        #opts: noatime,discard,ssd,autodefrag,compress=lzo,space_cache
        opts: noatime,ssd,autodefrag,compress=lzo,space_cache
        state: mounted

    - name: Create btrfs subvolumes
      command:
        btrfs subvolume create {{ item }}
      args:
        chdir: /mnt
        creates: /mnt/{{ item }}
      loop:
        - '@'
        - '@home'

    - name: Umount /mnt
      mount:
        path: /mnt
        src: "{{ root_volume }}"
        fstype: btrfs
        state: unmounted

    - name: Mount root subvolume on /mnt
      mount:
        path: /mnt
        src: "{{ root_volume }}"
        fstype: btrfs
        #opts: noatime,discard,ssd,autodefrag,compress=lzo,space_cache,subvol=@
        opts: noatime,ssd,nodiscard,autodefrag,compress=lzo,space_cache,subvol=@
        state: mounted

    - name: Mount boot subvolume on /mnt/boot
      mount:
        path: /mnt/boot
        src: "{{ esp_volume }}"
        fstype: vfat
        opts: rw,noatime,fmask=0133,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro
        state: mounted

    - name: Mount home subvolume on /mnt/home
      mount:
        path: /mnt/home
        src: "{{ root_volume }}"
        fstype: btrfs
        #opts: noatime,discard,ssd,autodefrag,compress=lzo,space_cache,subvol=@home
        opts: noatime,ssd,nodiscard,autodefrag,compress=lzo,space_cache,subvol=@home
        state: mounted

    - name: pacstrap, create main user
      command: "{{ item }}"
      loop:
        - pacstrap /mnt base base-devel intel-ucode linux linux-lts linux-firmware python openssh btrfs-progs fish vi
        - rm -f /mnt/etc/localtime /mnt/etc/locale.conf
        - systemd-firstboot --root=/mnt --locale=en_US.UTF-8 --timezone=Europe/Madrid --hostname={{ hostvars[inventory_hostname]['ansible_host'] }} --setup-machine-id
        - bootctl --path /mnt/boot install
        - cp -a /mnt/etc/fstab /mnt/etc/fstab.orig
        - arch-chroot /mnt useradd -m -G wheel,log -s /usr/bin/fish {{ user }}
      ignore_errors: yes
      args:
        warn: no

    - name: Populate /mnt/etc/fstab
      shell: genfstab -t PARTUUID -p /mnt >> /mnt/etc/fstab

    - name: Enable no-password sudo for users in wheel group
      lineinfile:
        dest: /mnt/etc/sudoers.d/wheel-nopasswd
        line: "{{ sudoers_config }}"
        create: yes
        state: present

    - name: Create main user on the live instance, so that subsequent call to authorized_key will work under /mnt
      user:
        name: "{{ user }}"
        createhome: no

    - name: Add main user pubkey to its ~/.ssh/authorized_keys
      authorized_key:
        user: "{{ user }}"
        key: "{{ key }}"
        path: "/mnt/home/{{ user }}/.ssh/authorized_keys"
        manage_dir: yes

    - name: Copy OpenSSH server keys to /mnt
      shell: cp -a /etc/ssh/ssh_host_* /mnt/etc/ssh

- name: Bootstrap Arch Linux | Configure systemd-boot
  hosts: bootstrap
  tags: bootstrap
  gather_facts: no
  roles:
    - role: systemd-boot
      systemd_boot_main_block_device: "{{ target_block_device }}"

- name: Bootstrap Arch Linux | Run new system in a container
  tags: bootstrap
  hosts: bootstrap
  gather_facts: no
# accelerate: true
  tasks:
    - name: Install tmux
      pacman:
        name: tmux
        update_cache: yes

    - name: Disable sshd
      systemd:
        name: sshd
        state: stopped

    - name: Enable sshd on /mnt
      command:
        arch-chroot /mnt systemctl enable sshd

    - name: Boot new system on /mnt on a container
      command:
        /usr/bin/tmux new-session -s local -n container -d systemd-nspawn --boot --directory=/mnt --machine=target-on-mnt

# Terminate:
#        "/usr/bin/tmux send-keys -t local:container C-] C-] C-]"

- name: Setup Arch Linux
  tags: bootstrap
  hosts: all:!bootstrap
  gather_facts: yes
  vars_prompt:
    - name: main_user_password
      prompt: Enter your password
      encrypt: "sha512_crypt"
      private: yes
      confirm: yes

    - name: main_user_passphrase
      prompt: Enter your passphrase
      private: yes
      confirm: yes

  pre_tasks:
    - name: Wait for container to become reachable
      wait_for_connection:

    - name: Gather facts
      setup:

  roles:
    - role: credentials
      user_password: "{{ main_user_password }}"
      user_passphrase: "{{ main_user_passphrase }}"
    - base

- name: Reboot host
  tags: bootstrap
  hosts: bootstrap
  gather_facts: no
  tasks:
    - name: Terminate container on /mnt
      command:
        machinectl poweroff target-on-mnt
      args:
        warn: false

    - name: Ensure no fs is mounted
      ignore_errors: yes
      command:
        umount -R /mnt

    - name: Close crypto device
      ignore_errors: yes
      command:
        cryptsetup luksClose arch
      when: want_fde is defined and want_fde

    - name: Reboot server
      reboot:
        reboot_timeout: 0
      ignore_errors: yes

- name: Wait for host to become reachable
  tags: bootstrap
  hosts: all:!bootstrap
  gather_facts: no
  tasks:
    - name: Wait for connection
      wait_for_connection: