#!/bin/bash
echo <<THIS_IS_NOT_A_SCRIPT

   this is an alpine linux installation guide
   for full disk encryption on bios hardware using syslinux
   
   textmode install guide stops at line 294,
   graphical install guide stops at line 382,
   remainder is convenience and visual tweaks which
   turns into https://ocv.me/doc/alpine/res/xfce.png
   
   what we will NOT be using:
   -- lvm
   -- glibc
   -- systemd
   -- pulseaudio

   if you value the contents on your machine
   please don't actually run this as a script

   https://ocv.me/doc/?alpine/bios-fde.sh  <ed@irc.rizon.net>
   
THIS_IS_NOT_A_SCRIPT
exit 1


# dd if=alpine-extended-3.8.0-x86_64.iso of=/dev/sdX bs=8k conv=sync,noerror
http://dl-cdn.alpinelinux.org/alpine/v3.8/releases/x86_64/alpine-extended-3.8.0-x86_64.iso


# boot the alpine livecd on target and...
apk add util-linux e2fsprogs btrfs-progs \
	cryptsetup mkinitfs syslinux bash vim

bash


# if you have a partial installation
# that you want to continue work on:
cryptsetup luksOpen /dev/sda2 rv
mount /dev/mapper/rv /mnt/
mount /dev/sda1 /mnt/boot/
# stop reading at this point


# new install:  make partitions
echo <<MANUAL_INPUT_FOR_BELOW_COMMAND

	o         new empty dos part table

	n         create boot part
	[p]       primary
	[1]       first partition
	[2048]    first sector
	+95M      last sector
	a         set bootable flag

	n         create sys part
	[p]       primary
	[2]       part number
	[196608]  first sector
	[468862127]
	
	w         write and quit

MANUAL_INPUT_FOR_BELOW_COMMAND
fdisk /dev/sda


# partitions sometimes disappear, this fixes it
partprobe /dev/sda


# luks
cryptsetup -c aes-xts-essiv:sha256 \
	-h sha512 -s 512 -y -i 5000 luksFormat /dev/sda2

cryptsetup luksOpen /dev/sda2 rv


# filesystems
mkfs.ext2 /dev/sda1
mkfs.btrfs /dev/mapper/rv

mount /dev/mapper/rv /mnt
mkdir /mnt/boot
mount /dev/sda1 /mnt/boot


# alpine config
echo <<MANUAL_INPUT_FOR_BELOW_COMMAND

	us               keyboard layout
	us-altgr-intl    altgr+zlw = æøå
	kvit             hostname
	done             configure entwork device
	[no]             additional network cfg
	[]               dns domain
	[]               dns nameserver
	*rootpwd*
	[UTC]            timezone
	[none]           proxy
	[chrony]         ntpd
	done             do not setup repo, can break mkinitfs
	none             sshd
	[none]           disk setup
	none             config store
	[/var/cache/apk] apk cache

MANUAL_INPUT_FOR_BELOW_COMMAND
setup-alpine

# write to disk
setup-disk -m sys /mnt


# create crypttab
echo 'rv /dev/sda2 none luks' > /mnt/etc/crypttab


echo 'features="ata base ide scsi usb ext4 btrfs cryptsetup"' > /mnt/etc/mkinitfs/mkinitfs.conf
# stuff that I removed:
#   'virtio' is only needed for virtual machines
#
# stuff that I added:
#   'cryptsetup' is needed to decrypt the rootfs


# create the initramfs
mkinitfs -c /mnt/etc/mkinitfs/mkinitfs.conf -b /mnt
dd bs=440 count=1 conv=notrunc if=/mnt/usr/share/syslinux/mbr.bin of=/dev/sda


# syslinux config
vim /mnt/etc/update-extlinux.conf
# default_kernel_opts -= nomodeset quiet
# default_kernel_opts += modeset cryptroot=/dev/sda2 cryptdm=rv


# set syslinux config in /boot as well
grep el_opts= /mnt/etc/update-extlinux.conf >> /mnt/boot/extlinux.conf
vim /mnt/boot/extlinux.conf


# shutdown
cd
umount /mnt/boot
umount /mnt
cryptsetup luksClose rv
sync
poweroff


##
## unplug the usb sticks and power back up
## then see xfce.sh
##


# optionally, if you wish to setup wifi before continuing,
# plug in usb stick after bootup and...
mount /dev/sdbX /media/cdrom
sed -ri 's/#//' /etc/apk/repositories
setup-interfaces
# setup wlan0 however

rc-update add wpa_supplicant
ifup wlan0
umount /media/cdrom
setup-apkrepos
# choose leaseweb's int

vim /etc/apk/repositories
# comment everything but:
#   v3.9/main
#   v3.9/community

