msw/CISS.debian.installer
SHA256
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V8.00.000.2025.06.17
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m51s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-10-23 14:32:55 +01:00
parent 551bd95d80
commit 081533db2a
1 changed files with 72 additions and 88 deletions
Download Patch File Download Diff File Expand all files Collapse all files

160
.preseed/SECRETS.yaml
View File

@@ -21,101 +21,85 @@ secrets:
version: "V8.00.000.2025.06.17" version: "V8.00.000.2025.06.17"
description: "Secrets for automated installation of encrypted systems on this host via primordial-workflow™." description: "Secrets for automated installation of encrypted systems on this host via primordial-workflow™."
user:
root:
password:
hashed: "$y$jFT$7pQlcZrgTEGrzkEm7UQW/.$QoCamalYEAV5mN4QWIE.xpHo8kvXa9sym2Uz.9oELwA"
description: "Password-hash, YESCRYPT only, for the root user. Leave value empty if disabled password authentication."
scope: "auth"
type: "user-password"
note: "Used to unlock the root user."
sshpubkey:
value: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAYZDAqVZUk3LwJsqeVHKvLn8UKkFx642VBbiSS8uSY 2025_ciss.debian.live.ISO_PUBLIC_ONLY"
description: "SSH public key for the root user."
scope: "auth"
type: "user-sshpubkey"
note: "Used to unlock the root user."
user0:
password:
hashed: "$y$jFT$OGeZONH5ho2JSXvAbyIBQ1$5OhyHqOaMZ9BZcfMOYEwF.nMLFKd9ceiW2oNksPCHVB"
description: "Password-hash, YESCRYPT only, for the specified user. Leave value empty if disabled password authentication."
scope: "auth"
type: "user-password"
note: "Used to unlock the specified user."
sshpubkey:
value: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAYZDAqVZUk3LwJsqeVHKvLn8UKkFx642VBbiSS8uSY 2025_ciss.debian.live.ISO_PUBLIC_ONLY"
description: "SSH public key for the specified user."
scope: "auth"
type: "user-sshpubkey"
note: "Used to unlock the specified user."
user1:
password:
hashed: ""
description: "Password-hash, YESCRYPT only, for the specified user. Leave value empty if disabled password authentication."
scope: "auth"
type: "user-password"
note: "Used to unlock the specified user."
sshpubkey:
value: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAYZDAqVZUk3LwJsqeVHKvLn8UKkFx642VBbiSS8uSY 2025_ciss.debian.live.ISO_PUBLIC_ONLY"
description: "SSH public key for the specified user."
scope: "auth"
type: "user-sshpubkey"
note: "Used to unlock the specified user."
passwords:
grub: grub:
plain: "PleASE_CHan3e_M!" note: "Password used to unlock the GRUB bootloader before system initialization."
description: "Password used to unlock the GRUB bootloader before system initialization." scope: "grub"
scope: "boot" type: "plain"
type: "grub-password" value: "PleASE_CHan3e_M!"
notes: "Used to unlock the GRUB bootloader during early system initialization on encrypted systems."
boot:
plain: "Ceterum_censeo_Bruxellam_et_Berolinum_delenda_esse!"
description: "LUKS passphrase used to decrypt the /boot partition during system boot."
scope: "boot"
type: "luks-passphrase"
notes: "Dedicated passphrase for the /boot partition; chosen for easy manual input via the VPS web console."
luks: luks:
backup: backup:
plain: "NextcloudFolderNameOrShareID:SuperSecurePassword123!" note: "The value is '<share-identifier>:<password>' (colon-separated). Use the same dedicated destination and credentials across servers."
description: "Credentials for the Nextcloud folder that stores encrypted LUKS header backups"
scope: "offsite-backup" scope: "offsite-backup"
type: "nextcloud-share-credentials" type: "plain"
notes: "The value is '<share-identifier>:<password>' (colon-separated). Use the same dedicated destination and credentials across servers." value: "NextcloudFolderNameOrShareID:SuperSecurePassword123!"
boot:
note: "Dedicated passphrase for the '/boot' partition; chosen for easy manual input via the VPS web console."
scope: "luks"
type: "plain"
value: "Ceterum_censeo_Bruxellam_et_Berolinum_delenda_esse!"
common: common:
plain: "Ceterum_censeo_Bruxellam_et_Berolinum_delenda_esse!" note: "Main LUKS passphrase baked into the installer for automated setup. For dropbear SSH input method only."
description: "Primary shared LUKS passphrase used by encrypted partitions during installation." scope: "luks"
scope: "installer" type: "plain"
type: "luks-passphrase" value: "Ceterum_censeo_Bruxellam_et_Berolinum_delenda_esse!"
notes: "Main LUKS passphrase baked into the installer for automated setup. For dropbear SSH input method only."
nuke: nuke:
plain: "THIS_IS_THE_NUKE_PASSWORD!" note: "Special LUKS passphrase that triggers secure wipe of all volumes when entered."
description: "Special LUKS passphrase that triggers secure wipe of all volumes when entered." scope: "luks"
scope: "emergency" type: "plain"
type: "luks-passphrase-nuke" value: "THIS_IS_THE_NUKE_PASSWORD!"
notes: "Use only to irreversibly destroy all encrypted volumes."
seeds: seeds:
mfa: mfa:
info: info:
plain: "totp:v1" note: "MFA version identifier (e.g., 'totp:v1') for seamless mfa secrets rollover."
description: "MFA version identifier (e.g., 'totp:v1') for seamless mfa secrets rollover." scope: "mfa"
scope: "auth" type: "plain"
type: "mfa" value: "totp:v1"
notes: "Used to add version identifier to the MFA seed to derive per-host MFA secrets for remote unlock authentication." salt:
salt: note: "Used to add a salt to the MFA seed to derive per-host MFA secrets for remote unlock authentication."
plain: "CISS:CDI:OTP" scope: "mfa"
description: "Combination of <plain> and (Server_FQDN/Username)" type: "plain"
scope: "auth" value: "CISS:CDI:OTP"
type: "mfa" secret:
notes: "Used to add salt to the MFA seed to derive per-host MFA secrets for remote unlock authentication." note: "Master seed (hex) used to derive per-machine MFA secrets for remote unlock authentication."
secret: scope: "mfa"
hex: "7cad63da408c27b5121c89cdd0cf878b8f8df1f34bcc0a944152261ee1481fda" type: "plain"
description: "Master seed (hex) used to derive per-machine MFA secrets for remote unlock authentication." value: "7cad63da408c27b5121c89cdd0cf878b8f8df1f34bcc0a944152261ee1481fda"
scope: "auth"
type: "mfa" user:
notes: "Used solely for generating per-host one-time passwords (OTPs) utilized by MFA mechanisms for SSH, TTY, su, and sudo authentication" root:
password:
note: "Password-hash, YESCRYPT only, for the root user. Leave value empty if disabled password authentication."
scope: "auth"
type: "hash"
value: "$y$jFT$7pQlcZrgTEGrzkEm7UQW/.$QoCamalYEAV5mN4QWIE.xpHo8kvXa9sym2Uz.9oELwA"
sshpubkey:
note: "SSH public key for the root user. This key is also used for dropbear SSH authentication."
scope: "auth"
type: "sshpubkey"
value: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAYZDAqVZUk3LwJsqeVHKvLn8UKkFx642VBbiSS8uSY 2025_ciss.debian.live.ISO_PUBLIC_ONLY"
user0:
password:
note: "Password-hash, YESCRYPT only, for the specified user. Leave value empty if disabled password authentication."
scope: "auth"
type: "hash"
value: "$y$jFT$OGeZONH5ho2JSXvAbyIBQ1$5OhyHqOaMZ9BZcfMOYEwF.nMLFKd9ceiW2oNksPCHVB"
sshpubkey:
note: "SSH public key for the specified user."
scope: "auth"
type: "sshpubkey"
value: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAYZDAqVZUk3LwJsqeVHKvLn8UKkFx642VBbiSS8uSY 2025_ciss.debian.live.ISO_PUBLIC_ONLY"
user1:
password:
note: "Password-hash, YESCRYPT only, for the specified user. Leave value empty if disabled password authentication."
scope: "auth"
type: "hash"
value: ""
sshpubkey:
note: "SSH public key for the specified user."
scope: "auth"
type: "sshpubkey"
value: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAYZDAqVZUk3LwJsqeVHKvLn8UKkFx642VBbiSS8uSY 2025_ciss.debian.live.ISO_PUBLIC_ONLY"
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml