#!/bin/bash
echo <<THIS_IS_NOT_A_SCRIPT

   this is an alpine linux installation guide
   for full disk encryption on bios hardware using syslinux
   with /boot stored on a usb stick rather than the SSD
   
   what we will NOT be using:
   -- lvm
   -- glibc
   -- systemd
   -- pulseaudio

   if you value the contents on your machine
   please don't actually run this as a script

   https://ocv.me/doc/?alpine/bios-fde-usb.sh  <ed@irc.rizon.net>
   
THIS_IS_NOT_A_SCRIPT
exit 1


# dd if=alpine-extended-3.8.0-x86_64.iso of=/dev/sdX bs=8k conv=sync,noerror
http://dl-cdn.alpinelinux.org/alpine/v3.8/releases/x86_64/alpine-extended-3.8.0-x86_64.iso


# boot the alpine livecd on target and...
apk add e2fsprogs util-linux \
	cryptsetup mkinitfs syslinux bash vim

bash


# luks rootfs on internal ssd
cryptsetup -c aes-xts-essiv:sha256 \
	-h sha512 -s 512 -y -i 5000 luksFormat /dev/sda

cryptsetup luksOpen /dev/sda rv


# make a partition on the /boot usb stick
echo <<MANUAL_INPUT_FOR_BELOW_COMMAND

	o         new empty dos part table

	n         create boot part
	[p]       primary
	[1]       first partition
	[2048]    first sector
	+95M      last sector
	a         set bootable flag
	
	w         write and quit

MANUAL_INPUT_FOR_BELOW_COMMAND
fdisk /dev/sdc


# discover the new partitions
partprobe /dev/sda /dev/sdc


# filesystems
mkfs.ext2 /dev/sdc1
mkfs.ext4 -T huge /dev/mapper/rv

mount -t ext4 /dev/mapper/rv /mnt
mkdir /mnt/boot
mount -t ext2 /dev/sdc1 /mnt/boot


# alpine config
echo <<MANUAL_INPUT_FOR_BELOW_COMMAND

	us               keyboard layout
	us-altgr-intl    altgr+zlw = æøå
	kvit             hostname
	done             configure entwork device
	[no]             additional network cfg
	[]               dns domain
	[]               dns nameserver
	*rootpwd*
	[UTC]            timezone
	[none]           proxy
	12               leaseweb
	none             sshd
	none             ntpd
	[none]           disk setup
	none             config store
	none             apk cache

MANUAL_INPUT_FOR_BELOW_COMMAND
setup-alpine

# write to disk
setup-disk -m sys /mnt


# get partition UUIDs
part() { blkid | grep $1 | sed -r 's/.* UUID="//;s/".*//' | tee /dev/stderr; }
rv=$(part /dev/mapper/rv)
sda=$(part /dev/sda)
sdc1=$(part /dev/sdc1)


# create crypttab
echo "rv UUID=$sda none luks" | tee /mnt/etc/crypttab


echo 'features="ata base ide scsi usb ext4 cryptsetup"' > /mnt/etc/mkinitfs/mkinitfs.conf
# stuff that I removed:
#   'virtio' is only needed for virtual machines
#
# stuff that I added:
#   'cryptsetup' is needed to decrypt the rootfs


# create the initramfs
mkinitfs -c /mnt/etc/mkinitfs/mkinitfs.conf -b /mnt


# write bootloader to usb stick
dd bs=440 count=1 conv=notrunc if=/mnt/usr/share/syslinux/mbr.bin of=/dev/sdc


# syslinux config
vim /mnt/etc/update-extlinux.conf
# default_kernel_opts += cryptroot=sda cryptdm=rv grsec_sysfs_restrict=0
sed -ri "s/=sda /=UUID=$sda /" /mnt/etc/update-extlinux.conf


# set syslinux config in /boot as well
grep el_opts= /mnt/etc/update-extlinux.conf >> /mnt/boot/extlinux.conf
vim /mnt/boot/extlinux.conf
# (replace modified kernel arguments with the appended ones)


# shutdown
cd
umount /mnt/boot /mnt
cryptsetup luksClose rv
poweroff


##
## unplug the usb sticks and power back up
## then see xfce.sh
##
