#!/bin/bash
echo <<THIS_IS_NOT_A_SCRIPT

   this is an alpine linux installation guide
   for full disk encryption on uefi hardware using grub
   
   with an additional section dealing with i915-based gear
   (apollo-lake / 2016+ intel CPUs) which freeze the display
   as the bootloader enters the initramfs
   
   the guide stops after getting the textmode OS running,
   Xfce4 installation will be added Soon™
   
   what we will NOT be using:
   -- lvm
   -- glibc
   -- systemd
   -- pulseaudio

   please don't actually run this as a script
   if you value the contents of your machine
   
   ver.1  2018-03-27  <ed@irc.rizon.net>
   https://ocv.me/doc/?alpine/uefi-fde.sh

THIS_IS_NOT_A_SCRIPT
exit 1


# dd if=alpine-extended-3.7.0-x86_64.iso of=/dev/sdX bs=8k conv=sync,noerror
http://dl-cdn.alpinelinux.org/alpine/v3.7/releases/x86_64/alpine-extended-3.7.0-x86_64.iso

# copy these to another (ext2) memstick:
#   grub-efi, gptfdisk, sgdisk, wget
https://mirror.leaseweb.com/alpine/v3.7/main/x86_64/grub-efi-2.02-r3.apk
https://mirror.leaseweb.com/alpine/v3.7/main/x86_64/gptfdisk-1.0.3-r0.apk
https://mirror.leaseweb.com/alpine/v3.7/main/x86_64/sgdisk-1.0.3-r0.apk
https://mirror.leaseweb.com/alpine/v3.7/main/x86_64/wget-1.19.2-r1.apk

# maybe these too (don't recall):
#   grub libpng freetype
https://mirror.leaseweb.com/alpine/v3.7/main/x86_64/grub-2.02-r3.apk
https://mirror.leaseweb.com/alpine/v3.7/main/x86_64/libpng-1.6.34-r1.apk
https://mirror.leaseweb.com/alpine/v3.7/main/x86_64/freetype-2.8.1-r2.apk


# boot the alpine livecd on target and...
apk add e2fsprogs dosfstools util-linux cryptsetup mkinitfs bash vim
bash
setup-apkcache /apks

# OPTION 1) install the extra packages from usb
mount -t ext2 /dev/sdb /media/floppy
apk add /media/floppy/pkgs/*.apk

# OPTION 2) or from LAN
apk add curl
setup-interfaces
ifup wlan0
curl -O http://192.168.1.137:8000/wget-1.19.2-r1.apk
apk add wget-*
wget -Krl 1 -npvc -erobots=off http://192.168.1.137:8000/
apk add 192.168.1.137\:8000/*.apk


# if you have a partial installation
# that you want to continue work on:
cryptsetup luksOpen /dev/mmcblk0p3 rv
mount /dev/mapper/rv /mnt/
mount /dev/mmcblk0p2 /mnt/boot/
mount /dev/mmcblk0p1 /mnt/boot/efi/
# stop reading at this point


# new install:  make partitions
echo <<MANUAL_INPUT_FOR_BELOW_COMMAND

	o         new empty guid partition
	y         yes

	n         create efi part
	[1]       part number
	[2048]    first sector
	+3M       last sector
	ef00      hex code (efi system)

	n         create boot part
	[2]       part number
	[8192]    first sector
	+92M      last sector
	[8300]    hex code (efi system)

	n         create sys part
	[3]       part number
	[196608]  first sector
	[61071326]
	[8300]    hex code (linux fs)
	
	w         write
	y         yes

MANUAL_INPUT_FOR_BELOW_COMMAND
gdisk /dev/mmcblk0


# p1 and p2 sometimes disappear, this fixes it
partprobe /dev/mmcblk0


# luks
cryptsetup -c aes-xts-essiv:sha256 \
	-h sha512 -s 512 -y -i 5000 luksFormat /dev/mmcblk0p3

cryptsetup luksOpen /dev/mmcblk0p3 rv


# filesystems
mkfs.vfat /dev/mmcblk0p1
mkfs.ext2 -T huge /dev/mmcblk0p2
mkfs.ext4 -T huge /dev/mapper/rv

mount -t ext4 /dev/mapper/rv /mnt
mkdir /mnt/boot
mount -t ext2 /dev/mmcblk0p2 /mnt/boot
mkdir /mnt/boot/efi
mount -t vfat /dev/mmcblk0p1 /mnt/boot/efi


# alpine config
echo <<MANUAL_INPUT_FOR_BELOW_COMMAND

	us               keyboard layout
	us-altgr-intl
	kvit             hostname
	done             configure entwork device
	[no]             additional network cfg
	[]               dns domain
	[]               dns nameserver
	*rootpwd*
	[UTC]            timezone
	[none]           proxy
	14               leaseweb
	none             sshd
	[chrony]         ntpd
	[none]           disk setup
	none             config store
	[/apks]          apk cache

MANUAL_INPUT_FOR_BELOW_COMMAND
setup-alpine

# write to disk
echo 'USE_EFI=1 DISKLABEL=gpt BOOTLOADER=grub setup-disk -m sys /mnt' | md5sum
# ea5a89da144a45cab8748418ae9e73f3
USE_EFI=1 DISKLABEL=gpt BOOTLOADER=grub setup-disk -m sys /mnt


# create crypttab
echo 'rv /dev/mmcblk0p3 none luks' > /mnt/etc/crypttab


# fix grub config
vi /boot/grub/grub.cfg
# linux /boot/vmlinuz-hardened modules=sd-mod,usb-storage,ext4 root=UUID=$THE_DECRYPTED_ROOTFS modeset noquiet rootfstype=ext4 cryptroot=/dev/mmcblk0p3 cryptdm=rv
# the important changes:  modeset noquiet cryptroot=/dev/mmcblk0p3 cryptdm=rv


# fix video dropping out while in the initramfs
# (minimal version of kms.modules for i915)
cd /mnt/etc/mkinitfs/features.d/

cat > apollokms.modules <<EOF
kernel/drivers/gpu/drm/drm.ko
kernel/drivers/gpu/drm/drm_kms_helper.ko
kernel/drivers/gpu/drm/i915
kernel/drivers/char/agp/agpgart.ko
kernel/drivers/char/agp/intel-gtt.ko
kernel/drivers/char/agp/intel-agp.ko
kernel/drivers/video/console
kernel/drivers/video/fbdev/intelfb
kernel/arch/x86/video/fbdev.ko
EOF

echo 'features="ata base ide scsi usb ext4 cryptsetup apollokms mmc"' > ../mkinitfs.conf
# stuff that I removed:
#   'virtio' is only needed for virtual machines
#
# stuff that I added:
#   'cryptsetup' is needed to decrypt the rootfs
#   'apollokms' is needed by some i915 gear
#   'mmc' is needed by netbooks with 32gb/64gb "SSD" storage


# create the initramfs
# (copying to live-env /etc below is not an error)
cp apollokms.modules /etc/mkinitfs/features.d/
mkinitfs -c /mnt/etc/mkinitfs/mkinitfs.conf -b /mnt


# shutdown
cd
umount /mnt/{boot/{efi,},}
cryptsetup luksClose rv
sync
poweroff
