encrypted.sh
· 3.1 KiB · Bash
Originalformat
#! /usr/bin/env bash
# adapted from https://docs.zfsbootmenu.org/en/v2.3.x/guides/ubuntu/uefi.html
# script is not meant to be run non-interactively. read and understand before executing
sudo -i
source /etc/os-release
export ID
export POOL_DISK="/dev/sdg"
export POOL_PART="3"
export POOL_DEVICE="${POOL_DISK}${POOL_PART}"
echo 'passphrase' > /etc/zfs/zroot.key
chmod 000 /etc/zfs/zroot.key
zpool create -f -o ashift=12 \
-O compression=zstd \
-O acltype=posixacl \
-O xattr=sa \
-O relatime=on \
-O encryption=aes-256-gcm \
-O keylocation=file:///etc/zfs/zroot.key \
-O keyformat=passphrase \
-o autotrim=on \
-o compatibility=openzfs-2.1-linux \
-m none zroot "$POOL_DEVICE"
zfs create -o mountpoint=none zroot/ROOT
zfs create -o mountpoint=/ -o canmount=noauto zroot/ROOT/${ID}
zfs create -o mountpoint=/home zroot/home
zpool set bootfs=zroot/ROOT/${ID} zroot
zpool export zroot
zpool import -N -R /mnt zroot
zfs load-key -L prompt zroot
zfs mount zroot/ROOT/${ID}
zfs mount zroot/home
udevadm trigger
rsync -avAHXx --numeric-ids --exclude='/home' --exclude='/timeshift' /media/curiouser/5b30118c-3837-4895-9c60-70ea27dd36d9/ mnt/
rsync -av --numeric-ids /media/curiouser/5b30118c-3837-4895-9c60-70ea27dd36d9/home/ mnt/home/
mount -t proc proc mnt/proc
mount -t sysfs sys mnt/sys
mount -B /dev mnt/dev
mount -t devpts pts mnt/dev/pts
chroot mnt /bin/bash
source /etc/os-release
export ID
apt update
apt install zfs-initramfs zfsutils-linux
systemctl enable zfs.target
systemctl enable zfs-import-cache
systemctl enable zfs-mount
systemctl enable zfs-import.target
echo "UMASK=0077" > /etc/initramfs-tools/conf.d/umask.conf
update-initramfs -c -k all
zfs set org.zfsbootmenu:commandline="systemd.show_status=false splash loglevel=0 quiet resume=UUID=9a4e4168-0964-4895-8d40-0e1ee0bf5d9a" zroot/ROOT
zfs set org.zfsbootmenu:keysource="zroot/ROOT/${ID}" zroot
exit
umount -n -R /mnt
zpool export zroot
sudo -i
apt remove kernelstub
apt-mark hold efibootmgr \
grub-common grub-common:i386 \
grub-efi-amd64-signed grub-efi-amd64:i386 grub-efi-amd64-bin grub-efi-ia32 grub-efi-amd64 grub-efi-amd64-bin:i386 \
grub-pc grub2-common kernelstub lilo
# next time you have a kernel update, you'll likely have to upgrade with flags since we've held back dependencies
sudo apt upgrade --with-new-pkgs linux-generic
# assumes your ESP is mounted at /boot/efi
# copy zbm boot files
wget -qO- https://get.zfsboot.menu/components/release | tar xvz -C /boot/efi/EFI
# ignore ownership errors
mv /boot/efi/EFI/zfsbootmenu-release-x86_64-v* /boot/efi/EFI/zbm
# add entries
cat << EOF > /boot/efi/loader/entries/pop.conf
title Pop!_OS
linux /EFI/zbm/vmlinuz-bootmenu
initrd /EFI/zbm/initramfs-bootmenu.img
options zbm.skip systemd.show_status=false splash loglevel=0 quiet
EOF
cat << EOF > /boot/efi/loader/entries/zbm.conf
title ZFSBootMenu
linux /EFI/zbm/vmlinuz-bootmenu
initrd /EFI/zbm/initramfs-bootmenu.img
options zbm.show
EOF
echo 'default pop' > /boot/efi/loader/loader.conf
# removing kernelstub entries and boot files
rm /boot/efi/loader/entries/Pop-*
rm -r /boot/efi/EFI/Pop*
# reboot into system
systemctl reboot
| 1 | #! /usr/bin/env bash |
| 2 | # adapted from https://docs.zfsbootmenu.org/en/v2.3.x/guides/ubuntu/uefi.html |
| 3 | # script is not meant to be run non-interactively. read and understand before executing |
| 4 | |
| 5 | sudo -i |
| 6 | |
| 7 | source /etc/os-release |
| 8 | export ID |
| 9 | |
| 10 | export POOL_DISK="/dev/sdg" |
| 11 | export POOL_PART="3" |
| 12 | export POOL_DEVICE="${POOL_DISK}${POOL_PART}" |
| 13 | |
| 14 | echo 'passphrase' > /etc/zfs/zroot.key |
| 15 | chmod 000 /etc/zfs/zroot.key |
| 16 | |
| 17 | zpool create -f -o ashift=12 \ |
| 18 | -O compression=zstd \ |
| 19 | -O acltype=posixacl \ |
| 20 | -O xattr=sa \ |
| 21 | -O relatime=on \ |
| 22 | -O encryption=aes-256-gcm \ |
| 23 | -O keylocation=file:///etc/zfs/zroot.key \ |
| 24 | -O keyformat=passphrase \ |
| 25 | -o autotrim=on \ |
| 26 | -o compatibility=openzfs-2.1-linux \ |
| 27 | -m none zroot "$POOL_DEVICE" |
| 28 | |
| 29 | zfs create -o mountpoint=none zroot/ROOT |
| 30 | zfs create -o mountpoint=/ -o canmount=noauto zroot/ROOT/${ID} |
| 31 | zfs create -o mountpoint=/home zroot/home |
| 32 | |
| 33 | zpool set bootfs=zroot/ROOT/${ID} zroot |
| 34 | |
| 35 | zpool export zroot |
| 36 | zpool import -N -R /mnt zroot |
| 37 | zfs load-key -L prompt zroot |
| 38 | |
| 39 | zfs mount zroot/ROOT/${ID} |
| 40 | zfs mount zroot/home |
| 41 | |
| 42 | udevadm trigger |
| 43 | |
| 44 | rsync -avAHXx --numeric-ids --exclude='/home' --exclude='/timeshift' /media/curiouser/5b30118c-3837-4895-9c60-70ea27dd36d9/ mnt/ |
| 45 | rsync -av --numeric-ids /media/curiouser/5b30118c-3837-4895-9c60-70ea27dd36d9/home/ mnt/home/ |
| 46 | |
| 47 | mount -t proc proc mnt/proc |
| 48 | mount -t sysfs sys mnt/sys |
| 49 | mount -B /dev mnt/dev |
| 50 | mount -t devpts pts mnt/dev/pts |
| 51 | chroot mnt /bin/bash |
| 52 | |
| 53 | source /etc/os-release |
| 54 | export ID |
| 55 | |
| 56 | apt update |
| 57 | apt install zfs-initramfs zfsutils-linux |
| 58 | |
| 59 | systemctl enable zfs.target |
| 60 | systemctl enable zfs-import-cache |
| 61 | systemctl enable zfs-mount |
| 62 | systemctl enable zfs-import.target |
| 63 | |
| 64 | echo "UMASK=0077" > /etc/initramfs-tools/conf.d/umask.conf |
| 65 | |
| 66 | update-initramfs -c -k all |
| 67 | |
| 68 | zfs set org.zfsbootmenu:commandline="systemd.show_status=false splash loglevel=0 quiet resume=UUID=9a4e4168-0964-4895-8d40-0e1ee0bf5d9a" zroot/ROOT |
| 69 | zfs set org.zfsbootmenu:keysource="zroot/ROOT/${ID}" zroot |
| 70 | |
| 71 | exit |
| 72 | |
| 73 | umount -n -R /mnt |
| 74 | zpool export zroot |
| 75 | |
| 76 | sudo -i |
| 77 | apt remove kernelstub |
| 78 | apt-mark hold efibootmgr \ |
| 79 | grub-common grub-common:i386 \ |
| 80 | grub-efi-amd64-signed grub-efi-amd64:i386 grub-efi-amd64-bin grub-efi-ia32 grub-efi-amd64 grub-efi-amd64-bin:i386 \ |
| 81 | grub-pc grub2-common kernelstub lilo |
| 82 | # next time you have a kernel update, you'll likely have to upgrade with flags since we've held back dependencies |
| 83 | sudo apt upgrade --with-new-pkgs linux-generic |
| 84 | |
| 85 | # assumes your ESP is mounted at /boot/efi |
| 86 | |
| 87 | # copy zbm boot files |
| 88 | wget -qO- https://get.zfsboot.menu/components/release | tar xvz -C /boot/efi/EFI |
| 89 | # ignore ownership errors |
| 90 | mv /boot/efi/EFI/zfsbootmenu-release-x86_64-v* /boot/efi/EFI/zbm |
| 91 | |
| 92 | # add entries |
| 93 | cat << EOF > /boot/efi/loader/entries/pop.conf |
| 94 | title Pop!_OS |
| 95 | linux /EFI/zbm/vmlinuz-bootmenu |
| 96 | initrd /EFI/zbm/initramfs-bootmenu.img |
| 97 | options zbm.skip systemd.show_status=false splash loglevel=0 quiet |
| 98 | EOF |
| 99 | |
| 100 | cat << EOF > /boot/efi/loader/entries/zbm.conf |
| 101 | title ZFSBootMenu |
| 102 | linux /EFI/zbm/vmlinuz-bootmenu |
| 103 | initrd /EFI/zbm/initramfs-bootmenu.img |
| 104 | options zbm.show |
| 105 | EOF |
| 106 | |
| 107 | echo 'default pop' > /boot/efi/loader/loader.conf |
| 108 | |
| 109 | # removing kernelstub entries and boot files |
| 110 | rm /boot/efi/loader/entries/Pop-* |
| 111 | rm -r /boot/efi/EFI/Pop* |
| 112 | |
| 113 | # reboot into system |
| 114 | systemctl reboot |
unencrypted.sh
· 2.9 KiB · Bash
Originalformat
#! /usr/bin/env bash
# adapted from https://docs.zfsbootmenu.org/en/v2.3.x/guides/ubuntu/uefi.html
# script is not meant to be run non-interactively. read and understand before executing
sudo -i
source /etc/os-release
export ID
export POOL_DEVICE="/dev/nvme1n1p3"
zpool create -f -o ashift=12 \
-O compression=zstd \
-O acltype=posixacl \
-O xattr=sa \
-O relatime=on \
-o autotrim=on \
-o compatibility=openzfs-2.1-linux \
-m none zroot "$POOL_DEVICE"
zfs create -o mountpoint=none zroot/ROOT
zfs create -o mountpoint=/ -o canmount=noauto zroot/ROOT/${ID}
zfs create -o mountpoint=/home zroot/home
zpool set bootfs=zroot/ROOT/${ID} zroot
zpool export zroot
zpool import -N -R /mnt/shredder-zfs zroot
zfs mount zroot/ROOT/${ID}
zfs mount zroot/home
udevadm trigger
rsync -avAHXx --numeric-ids --exclude='/home' --exclude='/timeshift' /mnt/shredder/ /mnt/shredder-zfs/
rsync -av --numeric-ids /mnt/shredder/home/ /mnt/shredder-zfs/home/
umount /mnt/shredder
mount -t proc /proc /mnt/shredder-zfs/proc
mount -t sysfs /sys /mnt/shredder-zfs/sys
mount -B /dev /mnt/shredder-zfs/dev
mount -t devpts pts /mnt/shredder-zfs/dev/pts
mount /dev/nvme1n1p1 /mnt/shredder-zfs/boot/efi
chroot /mnt/shredder-zfs /bin/bash
### now in zroot
source /etc/os-release
export ID
apt update
apt remove kernelstub
apt-mark hold efibootmgr \
grub-common grub-common:i386 \
grub-efi-amd64-signed grub-efi-amd64:i386 grub-efi-amd64-bin grub-efi-ia32 grub-efi-amd64 grub-efi-amd64-bin:i386 \
grub-pc grub2-common kernelstub lilo
apt install zfs-initramfs zfsutils-linux zfs-dkms
# next time you have a kernel update, you'll likely have to upgrade with flags since we've held back dependencies
sudo apt upgrade --with-new-pkgs linux-generic
systemctl enable zfs.target
systemctl enable zfs-import-cache
systemctl enable zfs-mount
systemctl enable zfs-import.target
echo "UMASK=0077" > /etc/initramfs-tools/conf.d/umask.conf
update-initramfs -c -k all
zfs set org.zfsbootmenu:commandline="systemd.show_status=false splash loglevel=0 quiet" zroot/ROOT
# assumes your ESP is mounted at /boot/efi
# removing kernelstub entries and boot files
rm /boot/efi/loader/entries/Pop*
rm -r /boot/efi/EFI/Pop*
# copy zbm boot files
wget -qO- https://get.zfsboot.menu/components/release | tar xvz -C /boot/efi/EFI
# ignore ownership errors
mv /boot/efi/EFI/zfsbootmenu-release-x86_64-v* /boot/efi/EFI/zbm
# add entries
cat << EOF > /boot/efi/loader/entries/pop.conf
title Pop!_OS
linux /EFI/zbm/vmlinuz-bootmenu
initrd /EFI/zbm/initramfs-bootmenu.img
options zbm.skip systemd.show_status=false splash loglevel=0 quiet
EOF
cat << EOF > /boot/efi/loader/entries/zbm.conf
title ZFSBootMenu
linux /EFI/zbm/vmlinuz-bootmenu
initrd /EFI/zbm/initramfs-bootmenu.img
options zbm.show
EOF
echo 'default pop' > /boot/efi/loader/loader.conf
exit
### out of zroot
umount -n -R /mnt/shredder-zfs
zpool export zroot
# reboot into system
systemctl reboot
| 1 | #! /usr/bin/env bash |
| 2 | # adapted from https://docs.zfsbootmenu.org/en/v2.3.x/guides/ubuntu/uefi.html |
| 3 | # script is not meant to be run non-interactively. read and understand before executing |
| 4 | |
| 5 | sudo -i |
| 6 | |
| 7 | source /etc/os-release |
| 8 | export ID |
| 9 | |
| 10 | export POOL_DEVICE="/dev/nvme1n1p3" |
| 11 | |
| 12 | zpool create -f -o ashift=12 \ |
| 13 | -O compression=zstd \ |
| 14 | -O acltype=posixacl \ |
| 15 | -O xattr=sa \ |
| 16 | -O relatime=on \ |
| 17 | -o autotrim=on \ |
| 18 | -o compatibility=openzfs-2.1-linux \ |
| 19 | -m none zroot "$POOL_DEVICE" |
| 20 | |
| 21 | zfs create -o mountpoint=none zroot/ROOT |
| 22 | zfs create -o mountpoint=/ -o canmount=noauto zroot/ROOT/${ID} |
| 23 | zfs create -o mountpoint=/home zroot/home |
| 24 | |
| 25 | zpool set bootfs=zroot/ROOT/${ID} zroot |
| 26 | |
| 27 | zpool export zroot |
| 28 | zpool import -N -R /mnt/shredder-zfs zroot |
| 29 | |
| 30 | zfs mount zroot/ROOT/${ID} |
| 31 | zfs mount zroot/home |
| 32 | |
| 33 | udevadm trigger |
| 34 | |
| 35 | rsync -avAHXx --numeric-ids --exclude='/home' --exclude='/timeshift' /mnt/shredder/ /mnt/shredder-zfs/ |
| 36 | rsync -av --numeric-ids /mnt/shredder/home/ /mnt/shredder-zfs/home/ |
| 37 | umount /mnt/shredder |
| 38 | |
| 39 | mount -t proc /proc /mnt/shredder-zfs/proc |
| 40 | mount -t sysfs /sys /mnt/shredder-zfs/sys |
| 41 | mount -B /dev /mnt/shredder-zfs/dev |
| 42 | mount -t devpts pts /mnt/shredder-zfs/dev/pts |
| 43 | mount /dev/nvme1n1p1 /mnt/shredder-zfs/boot/efi |
| 44 | chroot /mnt/shredder-zfs /bin/bash |
| 45 | |
| 46 | |
| 47 | |
| 48 | ### now in zroot |
| 49 | |
| 50 | |
| 51 | |
| 52 | source /etc/os-release |
| 53 | export ID |
| 54 | |
| 55 | apt update |
| 56 | apt remove kernelstub |
| 57 | apt-mark hold efibootmgr \ |
| 58 | grub-common grub-common:i386 \ |
| 59 | grub-efi-amd64-signed grub-efi-amd64:i386 grub-efi-amd64-bin grub-efi-ia32 grub-efi-amd64 grub-efi-amd64-bin:i386 \ |
| 60 | grub-pc grub2-common kernelstub lilo |
| 61 | apt install zfs-initramfs zfsutils-linux zfs-dkms |
| 62 | # next time you have a kernel update, you'll likely have to upgrade with flags since we've held back dependencies |
| 63 | sudo apt upgrade --with-new-pkgs linux-generic |
| 64 | |
| 65 | systemctl enable zfs.target |
| 66 | systemctl enable zfs-import-cache |
| 67 | systemctl enable zfs-mount |
| 68 | systemctl enable zfs-import.target |
| 69 | |
| 70 | echo "UMASK=0077" > /etc/initramfs-tools/conf.d/umask.conf |
| 71 | |
| 72 | update-initramfs -c -k all |
| 73 | |
| 74 | zfs set org.zfsbootmenu:commandline="systemd.show_status=false splash loglevel=0 quiet" zroot/ROOT |
| 75 | |
| 76 | # assumes your ESP is mounted at /boot/efi |
| 77 | |
| 78 | # removing kernelstub entries and boot files |
| 79 | rm /boot/efi/loader/entries/Pop* |
| 80 | rm -r /boot/efi/EFI/Pop* |
| 81 | |
| 82 | # copy zbm boot files |
| 83 | wget -qO- https://get.zfsboot.menu/components/release | tar xvz -C /boot/efi/EFI |
| 84 | # ignore ownership errors |
| 85 | mv /boot/efi/EFI/zfsbootmenu-release-x86_64-v* /boot/efi/EFI/zbm |
| 86 | |
| 87 | # add entries |
| 88 | cat << EOF > /boot/efi/loader/entries/pop.conf |
| 89 | title Pop!_OS |
| 90 | linux /EFI/zbm/vmlinuz-bootmenu |
| 91 | initrd /EFI/zbm/initramfs-bootmenu.img |
| 92 | options zbm.skip systemd.show_status=false splash loglevel=0 quiet |
| 93 | EOF |
| 94 | |
| 95 | cat << EOF > /boot/efi/loader/entries/zbm.conf |
| 96 | title ZFSBootMenu |
| 97 | linux /EFI/zbm/vmlinuz-bootmenu |
| 98 | initrd /EFI/zbm/initramfs-bootmenu.img |
| 99 | options zbm.show |
| 100 | EOF |
| 101 | |
| 102 | echo 'default pop' > /boot/efi/loader/loader.conf |
| 103 | |
| 104 | exit |
| 105 | |
| 106 | |
| 107 | |
| 108 | ### out of zroot |
| 109 | |
| 110 | |
| 111 | |
| 112 | umount -n -R /mnt/shredder-zfs |
| 113 | zpool export zroot |
| 114 | |
| 115 | # reboot into system |
| 116 | systemctl reboot |