anaconda-ks.cfg

#
#  Author: Hari Sekhon
#  Date: 2023-05-31 00:15:17 +0100 (Wed, 31 May 2023)
#  Originally circa 2008 - 2013
#
#  vim:ts=4:sts=4:sw=4:et
#
#  https://github.com/HariSekhon/Packer
#
#  License: see accompanying Hari Sekhon LICENSE file
#
#  If you're using my code you're welcome to connect with me on LinkedIn and optionally send me feedback to help steer this or other code I publish
#
#  https://www.linkedin.com/in/HariSekhon
#

# ============================================================================ #
#               R e d h a t   A n a c o n d a   K i c k s t a r t
# ============================================================================ #

# I used Kickstart in production on hundreds of CentOS servers circa 2008 - 2013 but CentOS is EOL now, so tested on Fedora instead

# https://docs.fedoraproject.org/en-US/fedora/f36/install-guide/appendixes/Kickstart_Syntax_Reference/
#
# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/system_design_guide/kickstart-script-file-format-reference_system-design-guide

# Find differences between kickstart versions Fedora 35 and 36 (must run on the later version of the OS so that pykickstart has the right info):
#
#   ksverdiff -f F35 -t F36

# ============================================================================ #

##platform=x86, AMD64, or Intel EM64T

#%include /path/to/file
#%ksappend <url>

# 'install' was deprecated in Fedora 29 and removed in Fedora 34 - you may need this on older RHEL / CentOS installs
#install

text  # default: graphical
# phone home to a listening VNC client to monitor the install graphically
#vnc [--host=hostname] [--port=port] [--password=password]
reboot  # or halt or poweroff, but hands off to Packer to continue over SSH here
firstboot --disable  # don't go into initial setup after install

#network --bootproto=dhcp --device=eth0 --onboot=on
firewall --disabled

#keyboard uk  # unrecognized keymap breaks Rocky 9.2 installation
keyboard gb
#keyboard gb-mac  # for VMs on Mac to get the pipe | symbol to work, although the backtick symbol then doesn't. 'localectl set-keymap gb-mac' if you want to do this later on a live running VM
lang en_GB

# install from a network location - eg. Cobbler
#url=https://server:443
#url --url=$tree  # populated in Cobbler
#
#cdrom  # for Packer

# don't install X - gets overridden if selected in %packages
skipx

#services --disable="avahi-daemon,avahi-dnsconfd,cups,gpm,pcscd,smb,snmpd,yum-updatesd"
#services --enable="ntpd"

selinux --permissive

#timezone Europe/London --utc
timezone UTC

# XXX: Edit
# python -c 'import crypt; print(crypt.crypt("My Password", "$6$My Salt"))'
#rootpw --plaintext packer
rootpw --iscrypted $y$j9T$9i1krngZEaM9H1GLrQ5H598i$cjag2PXFsglrA7vSC54kmwhvyyo2zCp/mREpYg2HUo7
#user --name=packer --groups=wheel --password=packer  # Used by Packer's provisioners over SSH
user --name=packer --groups=wheel --password=$y$j9T$OHKJf5AaoFO8b2hZHhNZ8vlV$lHzQQf5c690oQpJkcHrNp28bzDwAcLkG40k6hg54/f1 --iscrypted

# Steps through every screen and takes screenshots to /root/anaconda-screenshots
#autostep --autoscreenshot

# 'auth' / 'authconfig' are deprecated - use 'authselect' instead - see:
#
#   https://docs.fedoraproject.org/en-US/fedora/f36/install-guide/appendixes/Kickstart_Syntax_Reference/#sect-kickstart-commands-authconfig
#
#auth  --useshadow  --enablemd5
#
#pwpolicy name --minlen=10 --minquality=50 --strict --noempty --nochanges
#
#group mynewgroup
#
# Join an AD or IP domain - https://docs.fedoraproject.org/en-US/fedora/f36/install-guide/appendixes/Kickstart_Syntax_Reference/#sect-kickstart-commands-realm
#realm join domain ...

# ============================================================================ #
# Disk

#%include /tmp/part-include

# Not using ignoredisk or specifying disks to avoid having to duplicate configs for different VM builds. On bare-metal you may want to do this protect data disks though
#
# cannot specify multiple because results in this error:
#
# An error occurred during reading the kickstart file:
# Disk "sda" given in ignoredisk command does not exist.
#
# The installer will now terminate.
#
#ignoredisk --only-use=sda,vda
# sda on typical SCSI/Sata/Sas hardware or VIrtualBox
#ignoredisk --only-use=sda
# vda on Tart (arm)
#ignoredisk --only-use=vda

zerombr
bootloader --location=mbr  # --boot-drive=sda
clearpart --all --initlabel  # --drives=sda
autopart
#part /boot --fstype ext4 --size=100 --ondisk=sda
#part pv.0 --size=1024 --grow --ondisk=sda
#volgroup VolGroup00 pv.0
## percent causes logvol to not respect --maxsize at all... -h
#logvol /    --fstype ext3 --name=LogVol00 --vgname=VolGroup00 --grow --size=1024 --maxsize=51400 --recommended
#logvol /tmp --fstype ext3 --name=LogVol01 --vgname=VolGroup00 --grow --size=256  --maxsize=2048  --recommended --fsoptions=noexec,nodev,nosuid
#logvol swap --fstype swap --name=LogVol02 --vgname=VolGroup00 --grow --size=256  --maxsize=1024  --recommended

# ============================================================================ #
%packages

#@^server-product-environment

# @core
# @server-policy
# # pkgs not in core that are useful
# bind-utils
# mlocate
# parted # for partprobe
# traceroute
# wget
#
#-@core
#-@clustering
#-@cluster-storage
#-@dns-server
#-@development-libs
#-@openfabrics-enterprise-distribution
#-@development-tools
#-@dialup
#-@editors
#-@emacs
#-@engineering-and-scientific
#-@ftp-server
#-@gnome-desktop
#-@gnome-software-development
#-@games
#-@graphical-internet
#-@graphics
#-@java
#-@java-development
#-@kde-desktop
#-@kde-software-development
#-@legacy-network-server
#-@legacy-software-development
#-@mail-server
#-@miscallvars
#-@mysql
#-@network-server
#-@news-server
#-@office
#-@sql-server
#-@printing
#-@ruby
#-@server-cfg
#-@sound-and-video
#-@system-tools
#-@text-internet
#-@web-server
#-@smb-server
#-@x-software-development
#-@base-x
#-@xen
#-@kvm
#-@clustering
#-@cluster-storage
#-@base-system
#-@desktops
#-@apps
#-@servers
#-@development
#-@virtualization
#-@clustering
#-@cluster-storage

#epel-release

bc
binutils    # contains old C tools like 'strings'
bind-utils  # host / nslookup / dig commands
bzip2
curl
#direnv
dos2unix
#dstat  # now pcp-system-tools
#emacs-nox
#ethtool
#gcc
#git
#golang
findutils  # find and xargs
hostname
lsof
iptables
iputils  # ping, arping, tracepath
#jq  # not found
#make
net-tools  # ifconfig, netstat, route, arp
#ntp  # old package
#ntpsec  # not found at kickstart installer time, despite being available later
open-vm-tools
openssh-clients
openssh-server
#parallel  # not found any more
#pcp-system-tools  # contains 'dstat' - not found at kickstart installer time, despite being available later
#perl
#python3
#python3-pip
procps-ng
#screen   # was removed, which sucks, use tmux
#sysstat  # contains 'sar' - not found at kickstart installer time, despite being available later
tar
tcpdump
#tmux  # not found
vim-enhanced
wget
which
#yum-security
zip
unzip
unix2dos

-Deployment_Guide-en-US
#-acl  # required by Systemd, breaks Rocky 9.2 installation
-aspell
-aspell-en
-atk
-authconfig
-autofs
-avahi
-bluez
-bluez-utils
-ccid
-conman
-coolkey
-crash
-cups
-dhcpv6-client
-dosfstools
-dump
-ecryptfs-utils
-eject
-fbset
-finger
-firstboot-tui
-ftp
-gnupg
-gtk2
-hal
-hicolor-icon-theme
-htmlview
-ifd-egate
-ipsec-tools
-iptables-ipv6
-iptstate
-irda-utils
-jwhois
-keyutils
-krb5-workstation
-ksh
-kudzu
-lftp
-logwatch
-mailcap
-mcelog
-mkbootdisk
-mtools
-mtr
-nano
-nc
#-newt  # required by NetworkManager-tui, breaks Rocky 9.2 installation
-nfs-utils
-nscd
-nss_db
-nss_ldap
-ntsysv
-numactl
-oddjob
-oddjob-libs
-pam_krb5
-pam_pkcs11
-pam_smb
-pango.i386
-parted
-pcmciautils
-pcsc-lite
-pcsc-lite-libs
-pinfo
-pkinit-nss
-pm-utils
-portmap
-ppp
-rdate
-rdist
-rmt
-rp-pppoe
-rsh
-rsyslog
-setuptool
#-slang  # required by newt, breaks Rock 9.2 installation
-stunnel
-symlinks
-sysfsutils
-syslinux
-system-config-network-tui
-system-config-securitylevel-tui
-talk
-telnet
-telnet-server
-trousers
-udftools
-usbutils
-wireless-tools.i386
-words
-wpa_supplicant
-xinetd
-xorg-x11-filesystem
-yp-tools
-ypbind
-yum-updatesd

%end

# ============================================================================ #
#%pre --interpreter=/usr/bin/python
%pre --log=/root/ks-pre.log
#!/bin/bash

set -euxo pipefail

echo

%end

# ============================================================================ #
#%post --interpreter=/usr/bin/python
%post --log=/root/ks-post.log
#!/bin/bash

set -euxo pipefail

export BUILD_RELEASE=${BUILD_RELEASE:-/etc/build_release}
printf "%s %s\n" "Build Date:" "`date`" >> "$BUILD_RELEASE"
#printf "%-30s %s\n" "Build Date:" "`date`" >> "$BUILD_RELEASE"
#sort -t ":" -k1 -u "$BUILD_RELEASE" > $BUILD_RELEASE.tmp
#grep "^Build Date:" "$BUILD_RELEASE".tmp > "$BUILD_RELEASE".tmp2 &&
#grep "^Base Build Revision:" "$BUILD_RELEASE".tmp >> "$BUILD_RELEASE".tmp2 &&
#grep -v -e "^Build Date:" -e "^Base Build Revision:" "$BUILD_RELEASE".tmp | sort -u >> "$BUILD_RELEASE".tmp2 &&
#mv -f "$BUILD_RELEASE".tmp2 "$BUILD_RELEASE" && rm -f "$BUILD_RELEASE".tmp

# =============================
# Import my SSH key from GitHub
# not present, works on ubuntu but not fedora
#ssh-import-id gh:harisekhon

authorized_keys="/root/.ssh/authorized_keys"
mkdir -pv "${authorized_keys%/*}"
touch "$authorized_keys"
chmod 0600 "$authorized_keys"

# add other admins public github users here
for user in harisekhon; do
    echo "Fetching SSH public keys for user '$user' from GitHub" >&2
    curl -sS --fail "https://github.com/$user.keys" |
    sed "s|$| github.com/$user|"
done >> "$authorized_keys"
# =============================

# disable Ctrl-Alt-Del reboot behaviour on servers
sed -i 's/^ca:/#ca:/' /etc/inittab

%end