V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

.archive/0000_partitioning.yaml

@@ -0,0 +1,503 @@
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+recipe:
+  guben0afx256r:               # g=GPT || m=MBR
+                               # u=UEFI || b=BIOS
+                               # b=btrfs || 4=ext4 only
+                               # e=ephemeral "/tmp" and "SWAP" || n=non-ephemeral "/tmp" and "SWAP" (yet not supported)
+                               # n0=non RAID || m6=mdadm RAID6 || m5=mdadm RAID5 || b1=btrfs RAID1 (yet not supported)
+                               # a="/dev/sda" only setup || b="/dev/sdb" || c="/dev/sdc" and so forth
+                               # f=fixed size || a=automatic size (yet not supported)
+                               # x256=size of device in GiB
+                               # r=rescue partition || n=no rescue partition
+                               #######################################
+                               # EFI System Partition | EF00 | UEFI Bootloader (ESP, FAT32) | filesystem.version: fat32
+                               # BIOS Boot Partition  | EF02 | BIOS Bootloader area (GRUB)  | filesystem.version: BIOS
+                               # Linux SWAP           | 8200 | Linux Swap                   | filesystem.version: SWAP
+                               # Linux ext4/btrfs     | 8300 | Linux Filesystem (root, home)| filesystem.version: ext4 || btrfs
+                               #######################################
+    active: true               # Choose this recipe.
+    control:
+      description: "CISS 2025 - GPT - BTRFS - Ephemeral - non RAID - 256GiB - rescue"
+      firmware: "UEFI"         # MUST be "UEFI" for "gpt" || "BIOS":
+      id: "guben0afx256r"      # MUST be equal to the second part of the recipe-variables string.
+      name: "ciss.2025.gpt.btrfs.ephemeral.non-raid.256GiB.rescue"
+      nuke: true               # Activates Nuke-Mechanism in '/etc/crypttab' keyscript and via dropbear SSH forced command.
+      raid:                    # mdadm RAID settings only (not yet supported).
+        enable: false
+        disks:
+          member: 4
+          spare: 1
+        level: 6               # Only Level "1", "5", "6" and "10" are supported.
+        meta: 1.2              # Metadata Format. Default to '1.2'.
+      table: "gpt"             # MUST be "gpt" for "UEFI" || "msdos":
+      syntax: true             # This is set to "false" by default, otherwise if the recipe is tested by the authors to "true".
+      ### Version of the specific recipe.
+      version: "1.1.7"
+    dev:
+      sda:
+        1:
+          begin: "2MiB"
+          end: "1024MiB"
+          bootable: false
+          encryption:
+            enable: false      # MUST be "false" for "/boot/efi"
+            ephemeral: false   # MUST be "false" for "/boot/efi"
+            integrity: false   # MUST be "false" for "/boot/efi"
+            cipher: ""
+            hash: ""
+            itertime: ""
+            key: ""
+            label: ""
+            metadatasize: ""
+            pbkdf: ""
+            rng: ""
+          filesystem:
+            btrfs:
+              checksum: ""
+              compress: ""
+              level: ""
+              mdup: ""
+              subvolume: ""
+              snapshot: ""
+            format: true
+            label: "ESP"
+            options: ""
+            version: "fat32"
+          label: ""
+          mount:
+            enable: true       # MUST be "true" for "/boot/efi"
+            options: "umask=0077,uid=0,gid=0"
+            optsnap: ""
+            path: "/boot/efi"
+          primary: primary
+        2:
+          begin: "1024MiB"
+          end: "2GiB"
+          bootable: false
+          encryption:
+            enable: true
+            ephemeral: false   # MUST be "false" for "/boot"
+            integrity: false   # MUST be "false" for "/boot"
+            cipher: "aes-xts-plain64"
+            hash: "sha512"
+            itertime: "3000"
+            key: "512"
+            label: "crypt_boot"
+            metadatasize: "4096k"
+            pbkdf: "pbkdf2"     # MUST be "pbkdf2" for "/boot"
+            rng: "use-random"
+          filesystem:
+            btrfs:
+              checksum: "sha256"
+              compress: "zstd"
+              level: "0"
+              mdup: true
+              subvolume: "@boot"
+              snapshot: ""
+            format: true
+            version: "btrfs"
+            label: "btrfs_boot"
+            options: ""
+          label: "part_boot"
+          mount:
+            enable: true       # MUST be "true" for "/boot"
+            options: "defaults,nodev,nosuid,noexec,noatime,compress=no,discard=async,subvol=@boot"
+            optsnap: ""
+            path: "/boot"
+          primary: primary
+        3:
+          begin: "2GiB"
+          end: "10GiB"
+          bootable: false
+          encryption:
+            enable: true
+            ephemeral: false
+            integrity: false
+            cipher: "aes-xts-plain64"
+            hash: "sha512"
+            itertime: "3000"
+            key: "512"
+            label: "crypt_rescue"
+            metadatasize: "4096k"
+            pbkdf: "argon2id"
+            rng: "use-random"
+          filesystem:
+            btrfs:
+              checksum: ""
+              compress: ""
+              level: ""
+              mdup: ""
+              subvolume: ""
+              snapshot: ""
+            format: true
+            label: "ext4_rescue"
+            options: ""
+            version: "ext4"
+          label: "part_recovery"
+          mount:
+            enable: true
+            options: "defaults,nodev"
+            optsnap: ""
+            path: "/recovery"
+          primary: primary
+        4:
+          begin: "10GiB"
+          end: "14GiB"
+          bootable: false
+          encryption:
+            enable: true       # MUST be "true" for ephemeral "SWAP"
+            ephemeral: true    # MUST be "true" for ephemeral "SWAP"
+            integrity: false   # MUST be "false" for ephemeral "SWAP"
+            cipher: "aes-xts-plain64"
+            hash: "sha512"
+            itertime: "3000"
+            key: "512"
+            label: "crypt_ephemeral_swap"
+            metadatasize: "4096k"
+            pbkdf: "argon2id"
+            rng: "use-random"
+          filesystem:
+            btrfs:
+              checksum: ""
+              compress: ""
+              level: ""
+              mdup: ""
+              subvolume: ""
+              snapshot: ""
+            format: true
+            label: "host_swap" # MUST be "host_swap" for ephemeral "SWAP"
+            options: ""
+            version: "ext4"    # MUST be "ext4" for ephemeral "SWAP"
+          label: "part_ephem_swap"
+          mount:
+            enable: true
+            options: "defaults,discard"
+            optsnap: ""
+            path: "SWAP"
+          primary: primary
+        5:
+          begin: "14GiB"
+          end: "18GiB"
+          bootable: false
+          encryption:
+            enable: true       # MUST be "true" for ephemeral "/tmp"
+            ephemeral: true    # MUST be "true" for ephemeral "/tmp"
+            integrity: false   # MUST be "false" for ephemeral "/tmp"
+            cipher: "aes-xts-plain64"
+            hash: "sha512"
+            itertime: "3000"
+            key: "512"
+            label: "crypt_ephemeral_tmp"
+            metadatasize: "4096k"
+            pbkdf: "argon2id"
+            rng: "use-random"
+          filesystem:
+            btrfs:
+              checksum: ""
+              compress: ""
+              level: ""
+              mdup: ""
+              subvolume: ""
+              snapshot: ""
+            format: true
+            label: "host_tmp"  # MUST be "host_tmp" for ephemeral "/tmp"
+            options: ""
+            version: "ext4"    # MUST be "ext4" for ephemeral "/tmp"
+          label: "part_ephem_tmp"
+          mount:
+            enable: true
+            options: "defaults,rw,nodev,nosuid,noatime,discard,mode=1777"
+            optsnap: ""
+            path: "/tmp"
+          primary: primary
+        6:
+          begin: "18GiB"
+          end: "42GiB"
+          bootable: false
+          encryption:
+            enable: true
+            ephemeral: false
+            integrity: false
+            cipher: "aes-xts-plain64"
+            hash: "sha512"
+            itertime: "3000"
+            key: "512"
+            label: "crypt_root"
+            metadatasize: "4096k"
+            pbkdf: "argon2id"
+            rng: "use-random"
+          filesystem:
+            btrfs:
+              checksum: "sha256"
+              compress: "zstd"
+              level: "7"
+              mdup: true
+              subvolume: "@root"
+              snapshot: "@root_snap"
+            format: true
+            label: "btrfs_root"
+            options: ""
+            version: "btrfs"
+          label: "part_root"
+          mount:
+            enable: true
+            options: "defaults,errors=remount-ro,noatime,discard=async,autodefrag,subvol=@root"
+            optsnap: "ro,nodev,nosuid,noexec,nodatacow,subvol=@root_snap"
+            path: "/"
+          primary: primary
+        7:
+          begin: "42GiB"
+          end: "84GiB"
+          bootable: false
+          encryption:
+            enable: true
+            ephemeral: false
+            integrity: false
+            cipher: "aes-xts-plain64"
+            hash: "sha512"
+            itertime: "3000"
+            key: "512"
+            label: "crypt_home"
+            metadatasize: "4096k"
+            pbkdf: "argon2id"
+            rng: "use-random"
+          filesystem:
+            btrfs:
+              checksum: "sha256"
+              compress: "zstd"
+              level: "7"
+              mdup: true
+              subvolume: "@home"
+              snapshot: "@home_snap"
+            format: true
+            label: "btrfs_home"
+            options: ""
+            version: "btrfs"
+          label: "part_home"
+          mount:
+            enable: true
+            options: "defaults,nodev,nosuid,relatime,discard=async,autodefrag,subvol=@home"
+            optsnap: "ro,nodev,nosuid,noexec,nodatacow,subvol=@home_snap"
+            path: "/home"
+          primary: primary
+        8:
+          begin: "84GiB"
+          end: "126GiB"
+          bootable: false
+          encryption:
+            enable: true
+            ephemeral: false
+            integrity: false
+            cipher: "aes-xts-plain64"
+            hash: "sha512"
+            itertime: "3000"
+            key: "512"
+            label: "crypt_usr"
+            metadatasize: "4096k"
+            pbkdf: "argon2id"
+            rng: "use-random"
+          filesystem:
+            btrfs:
+              checksum: "sha256"
+              compress: "zstd"
+              level: "7"
+              mdup: true
+              subvolume: "@usr"
+              snapshot: ""
+            format: true
+            label: "btrfs_usr"
+            options: ""
+            version: "btrfs"
+          label: "part_usr"
+          mount:
+            enable: true
+            options: "defaults,nodev,relatime,discard=async,subvol=@usr"
+            optsnap: ""
+            path: "/usr"
+          primary: primary
+        9:
+          begin: "126GiB"
+          end: "190GiB"
+          bootable: false
+          encryption:
+            enable: true
+            ephemeral: false
+            integrity: false
+            cipher: "aes-xts-plain64"
+            hash: "sha512"
+            itertime: "3000"
+            key: "512"
+            label: "crypt_var"
+            metadatasize: "4096k"
+            pbkdf: "argon2id"
+            rng: "use-random"
+          filesystem:
+            btrfs:
+              checksum: "sha256"
+              compress: "zstd"
+              level: "7"
+              mdup: true
+              subvolume: "@var"
+              snapshot: "@var_snap"
+            format: true
+            label: "btrfs_var"
+            options: ""
+            version: "btrfs"
+          label: "part_var"
+          mount:
+            enable: true
+            options: "defaults,nodev,nosuid,relatime,discard=async,subvol=@var"
+            optsnap: "ro,nodev,nosuid,noexec,nodatacow,subvol=@var_snap"
+            path: "/var"
+          primary: primary
+        10:
+          begin: "190GiB"
+          end: "206GiB"
+          bootable: false
+          encryption:
+            enable: true
+            ephemeral: false
+            integrity: false
+            cipher: "aes-xts-plain64"
+            hash: "sha512"
+            itertime: "3000"
+            key: "512"
+            label: "crypt_var_log"
+            metadatasize: "4096k"
+            pbkdf: "argon2id"
+            rng: "use-random"
+          filesystem:
+            btrfs:
+              checksum: "sha256"
+              compress: "zstd"
+              level: "7"
+              mdup: true
+              subvolume: "@var_log"
+              snapshot: ""
+            format: true
+            label: "btrfs_var_log"
+            options: ""
+            version: "btrfs"
+          label: "part_var_log"
+          mount:
+            enable: true
+            options: "defaults,nodev,nosuid,noexec,noatime,nodatacow,discard=async,subvol=@var_log"
+            optsnap: ""
+            path: "/var/log"
+          primary: primary
+        11:
+          begin: "206GiB"
+          end: "222GiB"
+          bootable: false
+          encryption:
+            enable: true
+            ephemeral: false
+            integrity: false
+            cipher: "aes-xts-plain64"
+            hash: "sha512"
+            itertime: "3000"
+            key: "512"
+            label: "crypt_var_log_audit"
+            metadatasize: "4096k"
+            pbkdf: "argon2id"
+            rng: "use-random"
+          filesystem:
+            btrfs:
+              checksum: "sha256"
+              compress: "zstd"
+              level: "7"
+              mdup: true
+              subvolume: "@var_log_audit"
+              snapshot: ""
+            format: true
+            label: "btrfs_var_log_audit"
+            options: ""
+            version: "btrfs"
+          label: "part_var_log_audit"
+          mount:
+            enable: true
+            options: "defaults,nodev,nosuid,noexec,noatime,nodatacow,discard=async,subvol=@var_log_audit"
+            optsnap: ""
+            path: "/var/log/audit"
+          primary: primary
+        12:
+          begin: "222GiB"
+          end: "238GiB"
+          bootable: false
+          encryption:
+            enable: true
+            ephemeral: false
+            integrity: false
+            cipher: "aes-xts-plain64"
+            hash: "sha512"
+            itertime: "3000"
+            key: "512"
+            label: "crypt_var_tmp"
+            metadatasize: "4096k"
+            pbkdf: "argon2id"
+            rng: "use-random"
+          filesystem:
+            btrfs:
+              checksum: "sha256"
+              compress: "zstd"
+              level: "7"
+              mdup: true
+              subvolume: "@var_tmp"
+              snapshot: ""
+            format: true
+            label: "btrfs_var_tmp"
+            options: ""
+            version: "btrfs"
+          label: "part_var_tmp"
+          mount:
+            enable: true
+            options: "defaults,nodev,nosuid,noatime,nodatacow,discard=async,subvol=@var_tmp"
+            optsnap: ""
+            path: "/var/tmp"
+          primary: primary
+        13:
+          begin: "238GiB"
+          end: "max"            # The last 16 MiB will be reserved for GPT metadata.
+          bootable: false
+          encryption:
+            enable: true
+            ephemeral: false
+            integrity: false
+            cipher: "aes-xts-plain64"
+            hash: "sha512"
+            itertime: "3000"
+            key: "512"
+            label: "crypt_opt"
+            metadatasize: "4096k"
+            pbkdf: "argon2id"
+            rng: "use-random"
+          filesystem:
+            btrfs:
+              checksum: "sha256"
+              compress: "zstd"
+              level: "7"
+              mdup: true
+              subvolume: "@opt"
+              snapshot: ""
+            format: true
+            label: "btrfs_opt"
+            options: ""
+            version: "btrfs"
+          label: "part_opt"
+          mount:
+            enable: true
+            options: "defaults,nodev,nosuid,relatime,discard=async,subvol=@opt"
+            optsnap: ""
+            path: "/opt"
+          primary: primary
+
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml

.preseed/partitioning.yaml

@@ -41,11 +41,11 @@ recipe:
       table: "gpt"             # MUST be "gpt" for "UEFI" || "msdos":
       syntax: true             # This is set to "false" by default, otherwise if the recipe is tested by the authors to "true".
       ### Version of the specific recipe.
-      version: "1.1.7"
+      version: "1.1.8b"
     dev:
       sda:
         1:
-          begin: "2MiB"
+          begin: "min"
           end: "1024MiB"
           bootable: false
           encryption:
@@ -56,9 +56,10 @@ recipe:
             hash: ""
             itertime: ""
             key: ""
-            label: ""
+            keyslotssize: ""
             metadatasize: ""
             pbkdf: ""
+            pbkdfparallel: ""
             rng: ""
           filesystem:
             btrfs:
@@ -66,13 +67,10 @@ recipe:
               compress: ""
               level: ""
               mdup: ""
-              subvolume: ""
+              snapshot: false
-              snapshot: ""
             format: true
-            label: "ESP"
             options: ""
             version: "fat32"
-          label: ""
           mount:
             enable: true       # MUST be "true" for "/boot/efi"
             options: "umask=0077,uid=0,gid=0"
@@ -91,9 +89,10 @@ recipe:
             hash: "sha512"
             itertime: "3000"
             key: "512"
-            label: "crypt_boot"
+            keyslotssize: "32MB"
             metadatasize: "4096k"
             pbkdf: "pbkdf2"     # MUST be "pbkdf2" for "/boot"
+            pbkdfparallel: 1
             rng: "use-random"
           filesystem:
             btrfs:
@@ -101,16 +100,13 @@ recipe:
               compress: "zstd"
               level: "0"
               mdup: true
-              subvolume: "@boot"
+              snapshot: false
-              snapshot: ""
             format: true
             version: "btrfs"
-            label: "btrfs_boot"
             options: ""
-          label: "part_boot"
           mount:
             enable: true       # MUST be "true" for "/boot"
-            options: "defaults,nodev,nosuid,noexec,noatime,compress=no,discard=async,subvol=@boot"
+            options: "defaults,nodev,nosuid,noexec,noatime,compress=no,discard=async"
             optsnap: ""
             path: "/boot"
           primary: primary
@@ -126,9 +122,10 @@ recipe:
             hash: "sha512"
             itertime: "3000"
             key: "512"
-            label: "crypt_rescue"
+            keyslotssize: "32MB"
             metadatasize: "4096k"
             pbkdf: "argon2id"
+            pbkdfparallel: 1
             rng: "use-random"
           filesystem:
             btrfs:
@@ -136,13 +133,11 @@ recipe:
               compress: ""
               level: ""
               mdup: ""
-              subvolume: ""
+              snapshot: false
-              snapshot: ""
             format: true
             label: "ext4_rescue"
             options: ""
             version: "ext4"
-          label: "part_recovery"
           mount:
             enable: true
             options: "defaults,nodev"
@@ -161,9 +156,10 @@ recipe:
             hash: "sha512"
             itertime: "3000"
             key: "512"
-            label: "crypt_ephemeral_swap"
+            keyslotssize: "32MB"
             metadatasize: "4096k"
             pbkdf: "argon2id"
+            pbkdfparallel: 1
             rng: "use-random"
           filesystem:
             btrfs:
@@ -171,13 +167,11 @@ recipe:
               compress: ""
               level: ""
               mdup: ""
-              subvolume: ""
+              snapshot: false
-              snapshot: ""
             format: true
             label: "host_swap" # MUST be "host_swap" for ephemeral "SWAP"
             options: ""
             version: "ext4"    # MUST be "ext4" for ephemeral "SWAP"
-          label: "part_ephem_swap"
           mount:
             enable: true
             options: "defaults,discard"
@@ -196,9 +190,10 @@ recipe:
             hash: "sha512"
             itertime: "3000"
             key: "512"
-            label: "crypt_ephemeral_tmp"
+            keyslotssize: "32MB"
             metadatasize: "4096k"
             pbkdf: "argon2id"
+            pbkdfparallel: 1
             rng: "use-random"
           filesystem:
             btrfs:
@@ -206,13 +201,10 @@ recipe:
               compress: ""
               level: ""
               mdup: ""
-              subvolume: ""
+              snapshot: false
-              snapshot: ""
             format: true
-            label: "host_tmp"  # MUST be "host_tmp" for ephemeral "/tmp"
             options: ""
             version: "ext4"    # MUST be "ext4" for ephemeral "/tmp"
-          label: "part_ephem_tmp"
           mount:
             enable: true
             options: "defaults,rw,nodev,nosuid,noatime,discard,mode=1777"
@@ -231,9 +223,10 @@ recipe:
             hash: "sha512"
             itertime: "3000"
             key: "512"
-            label: "crypt_root"
+            keyslotssize: "32MB"
             metadatasize: "4096k"
             pbkdf: "argon2id"
+            pbkdfparallel: 1
             rng: "use-random"
           filesystem:
             btrfs:
@@ -241,17 +234,14 @@ recipe:
               compress: "zstd"
               level: "7"
               mdup: true
-              subvolume: "@root"
+              snapshot: true
-              snapshot: "@root_snap"
             format: true
-            label: "btrfs_root"
             options: ""
             version: "btrfs"
-          label: "part_root"
           mount:
             enable: true
-            options: "defaults,errors=remount-ro,noatime,discard=async,autodefrag,subvol=@root"
+            options: "defaults,errors=remount-ro,noatime,discard=async,autodefrag"
-            optsnap: "ro,nodev,nosuid,noexec,nodatacow,subvol=@root_snap"
+            optsnap: "nodev,nosuid,noexec,nodatacow"
             path: "/"
           primary: primary
         7:
@@ -266,9 +256,10 @@ recipe:
             hash: "sha512"
             itertime: "3000"
             key: "512"
-            label: "crypt_home"
+            keyslotssize: "32MB"
             metadatasize: "4096k"
             pbkdf: "argon2id"
+            pbkdfparallel: 1
             rng: "use-random"
           filesystem:
             btrfs:
@@ -276,17 +267,14 @@ recipe:
               compress: "zstd"
               level: "7"
               mdup: true
-              subvolume: "@home"
+              snapshot: true
-              snapshot: "@home_snap"
             format: true
-            label: "btrfs_home"
             options: ""
             version: "btrfs"
-          label: "part_home"
           mount:
             enable: true
-            options: "defaults,nodev,nosuid,relatime,discard=async,autodefrag,subvol=@home"
+            options: "defaults,nodev,nosuid,relatime,discard=async,autodefrag"
-            optsnap: "ro,nodev,nosuid,noexec,nodatacow,subvol=@home_snap"
+            optsnap: "nodev,nosuid,noexec,nodatacow"
             path: "/home"
           primary: primary
         8:
@@ -301,9 +289,10 @@ recipe:
             hash: "sha512"
             itertime: "3000"
             key: "512"
-            label: "crypt_usr"
+            keyslotssize: "32MB"
             metadatasize: "4096k"
             pbkdf: "argon2id"
+            pbkdfparallel: 1
             rng: "use-random"
           filesystem:
             btrfs:
@@ -311,16 +300,13 @@ recipe:
               compress: "zstd"
               level: "7"
               mdup: true
-              subvolume: "@usr"
+              snapshot: false
-              snapshot: ""
             format: true
-            label: "btrfs_usr"
             options: ""
             version: "btrfs"
-          label: "part_usr"
           mount:
             enable: true
-            options: "defaults,nodev,relatime,discard=async,subvol=@usr"
+            options: "defaults,nodev,relatime,discard=async"
             optsnap: ""
             path: "/usr"
           primary: primary
@@ -336,9 +322,10 @@ recipe:
             hash: "sha512"
             itertime: "3000"
             key: "512"
-            label: "crypt_var"
+            keyslotssize: "32MB"
             metadatasize: "4096k"
             pbkdf: "argon2id"
+            pbkdfparallel: 1
             rng: "use-random"
           filesystem:
             btrfs:
@@ -346,17 +333,14 @@ recipe:
               compress: "zstd"
               level: "7"
               mdup: true
-              subvolume: "@var"
+              snapshot: true
-              snapshot: "@var_snap"
             format: true
-            label: "btrfs_var"
             options: ""
             version: "btrfs"
-          label: "part_var"
           mount:
             enable: true
-            options: "defaults,nodev,nosuid,relatime,discard=async,subvol=@var"
+            options: "defaults,nodev,nosuid,relatime,discard=async"
-            optsnap: "ro,nodev,nosuid,noexec,nodatacow,subvol=@var_snap"
+            optsnap: "nodev,nosuid,noexec,nodatacow"
             path: "/var"
           primary: primary
         10:
@@ -371,9 +355,10 @@ recipe:
             hash: "sha512"
             itertime: "3000"
             key: "512"
-            label: "crypt_var_log"
+            keyslotssize: "32MB"
             metadatasize: "4096k"
             pbkdf: "argon2id"
+            pbkdfparallel: 1
             rng: "use-random"
           filesystem:
             btrfs:
@@ -381,16 +366,13 @@ recipe:
               compress: "zstd"
               level: "7"
               mdup: true
-              subvolume: "@var_log"
+              snapshot: false
-              snapshot: ""
             format: true
-            label: "btrfs_var_log"
             options: ""
             version: "btrfs"
-          label: "part_var_log"
           mount:
             enable: true
-            options: "defaults,nodev,nosuid,noexec,noatime,nodatacow,discard=async,subvol=@var_log"
+            options: "defaults,nodev,nosuid,noexec,noatime,nodatacow,discard=async"
             optsnap: ""
             path: "/var/log"
           primary: primary
@@ -406,9 +388,10 @@ recipe:
             hash: "sha512"
             itertime: "3000"
             key: "512"
-            label: "crypt_var_log_audit"
+            keyslotssize: "32MB"
             metadatasize: "4096k"
             pbkdf: "argon2id"
+            pbkdfparallel: 1
             rng: "use-random"
           filesystem:
             btrfs:
@@ -416,16 +399,13 @@ recipe:
               compress: "zstd"
               level: "7"
               mdup: true
-              subvolume: "@var_log_audit"
+              snapshot: false
-              snapshot: ""
             format: true
-            label: "btrfs_var_log_audit"
             options: ""
             version: "btrfs"
-          label: "part_var_log_audit"
           mount:
             enable: true
-            options: "defaults,nodev,nosuid,noexec,noatime,nodatacow,discard=async,subvol=@var_log_audit"
+            options: "defaults,nodev,nosuid,noexec,noatime,nodatacow,discard=async"
             optsnap: ""
             path: "/var/log/audit"
           primary: primary
@@ -441,9 +421,10 @@ recipe:
             hash: "sha512"
             itertime: "3000"
             key: "512"
-            label: "crypt_var_tmp"
+            keyslotssize: "32MB"
             metadatasize: "4096k"
             pbkdf: "argon2id"
+            pbkdfparallel: 1
             rng: "use-random"
           filesystem:
             btrfs:
@@ -451,16 +432,13 @@ recipe:
               compress: "zstd"
               level: "7"
               mdup: true
-              subvolume: "@var_tmp"
+              snapshot: false
-              snapshot: ""
             format: true
-            label: "btrfs_var_tmp"
             options: ""
             version: "btrfs"
-          label: "part_var_tmp"
           mount:
             enable: true
-            options: "defaults,nodev,nosuid,noatime,nodatacow,discard=async,subvol=@var_tmp"
+            options: "defaults,nodev,nosuid,noatime,nodatacow,discard=async"
             optsnap: ""
             path: "/var/tmp"
           primary: primary
@@ -476,9 +454,10 @@ recipe:
             hash: "sha512"
             itertime: "3000"
             key: "512"
-            label: "crypt_opt"
+            keyslotssize: "32MB"
             metadatasize: "4096k"
             pbkdf: "argon2id"
+            pbkdfparallel: 1
             rng: "use-random"
           filesystem:
             btrfs:
@@ -486,16 +465,13 @@ recipe:
               compress: "zstd"
               level: "7"
               mdup: true
-              subvolume: "@opt"
+              snapshot: false
-              snapshot: ""
             format: true
-            label: "btrfs_opt"
             options: ""
             version: "btrfs"
-          label: "part_opt"
           mount:
             enable: true
-            options: "defaults,nodev,nosuid,relatime,discard=async,subvol=@opt"
+            options: "defaults,nodev,nosuid,relatime,discard=async"
             optsnap: ""
             path: "/opt"
           primary: primary

ciss_debian_installer.sh

@@ -33,14 +33,14 @@ declare -grx VAR_SETUP_FULL="$(cd "$(dirname "${0}")" && pwd)/${0##*/}" # '/opt/
   ### No ash, dash, ksh, sh, zsh.
   # shellcheck disable=2292
   [ -z "${BASH_VERSINFO[0]}" ] && {
-    . /../../meta_loader_early.sh
+    . ./meta_loader_early.sh
     printf "%b❌ Please make sure you are using 'bash'! Bye... %b%b" "${RED}" "${RES}" "${NL}" >&2
     exit "${ERR_UNSUPPORTED_BASH}"
     }
 
   ### Not root.
   [[ ${EUID} -ne 0 ]] && {
-    . /../../meta_loader_early.sh
+    . ./meta_loader_early.sh
     printf "%b❌ Please make sure you are 'root'! Bye... %b%b" "${RED}" "${RES}" "${NL}" >&2
     exit "${ERR_USER_IS_NOT_ROOT}"
     }
@@ -48,35 +48,35 @@ declare -grx VAR_SETUP_FULL="$(cd "$(dirname "${0}")" && pwd)/${0##*/}" # '/opt/
   ### Not called by sh.
   # shellcheck disable=2312
   [[ $(kill -l | grep -c SIG) -eq 0 ]] && {
-    . /../../meta_loader_early.sh
+    . ./meta_loader_early.sh
     printf "%b❌ Please make sure you are calling the script without leading 'sh'! Bye... %b%b" "${RED}" "${RES}" "${NL}" >&2
     exit "${ERR_UNSUPPORTED_BASH}"
     }
 
   ### Not sourced.
   [[ "${BASH_SOURCE[0]}" != "$0" ]] && {
-    . /../../meta_loader_early.sh
+    . ./meta_loader_early.sh
     printf "%b❌ This script must be executed, not sourced. Please run './setup.sh' directly. %b%b" "${RED}" "${RES}" "${NL}" >&2
     exit "${ERR_UNSUPPORTED_BASH}"
     }
 
   ### Minimum Bash version 5.
   [[ ${BASH_VERSINFO[0]} -lt 5 ]] && {
-    . /../../meta_loader_early.sh
+    . ./meta_loader_early.sh
     printf "%b❌ Minimum requirement is bash 5.1. You are using '%s'! Bye... %b%b" "${RED}" "${BASH_VERSION}" "${RES}" "${NL}" >&2
     exit "${ERR_UNSUPPORTED_BASH}"
     }
 
   ### Minimum Bash version 5.1.
   [[ ${BASH_VERSINFO[0]} -le 5 ]] && [[ ${BASH_VERSINFO[1]} -le 1 ]] && {
-    . /../../meta_loader_early.sh
+    . ./meta_loader_early.sh
     printf "%b❌ Minimum requirement is bash 5.1. You are using '%s'! Bye... %b%b" "${RED}" "${BASH_VERSION}" "${RES}" "${NL}" >&2
     exit "${ERR_UNSUPPORTED_BASH}"
     }
 
   ### No arguments.
   [[ ${#} -eq 0 ]] && {
-    . . /../../meta_loader_early.sh
+    . ./meta_loader_early.sh
     usage >&2
     exit 1
     }

func/partitioning/3200_partitioning.sh

@@ -109,9 +109,13 @@ partitioning() {
       var_boot=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.bootable"         "${VAR_SETUP_PART}")
       var_pri=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.primary"           "${VAR_SETUP_PART}")
       var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path" "${VAR_SETUP_PART}")
-      var_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.label"           "${VAR_SETUP_PART}")
 
-      ### Assign the landing zone of each partition.
+      ### Assign the start zone of the first partition and skip the first 2 MiB as best practice.
+      if [[ "${var_begin,,}" == "min" ]]; then
+        var_begin="2MiB"
+      fi
+
+      ### Assign the landing zone of the last partition and reserve 16 MiB for GPT and mdadm binary metadata.
       if [[ "${var_end,,}" == "max" ]]; then
         var_dev_size=$(blockdev --getsize64 "/dev/${var_dev}")
         var_dev_end=$(( var_dev_size - 16 * 1024 * 1024 ))
@@ -124,6 +128,9 @@ partitioning() {
       case "${VAR_RECIPE_TABLE,,}" in
 
         gpt)
+
+          var_label=$(get_label "${var_mount_path}" "${var_fs}" "part")
+
           if ! parted -s "/dev/${var_dev}" mkpart "${var_label}" "${var_fs}" "${var_begin}" "${var_end_arg}"; then
 
             do_log "fatal" "file_only" "3200() [parted -s /dev/${var_dev} mkpart ${var_label} ${var_fs} ${var_begin} ${var_end_arg}] failed."

func/partitioning/3220_partition_encryption.sh

@@ -35,8 +35,8 @@ partition_encryption() {
   declare -Ag HMP_EPHEMERAL_DEV HMP_EPHEMERAL_ENCLABEL HMP_EPHEMERAL_FS_LABEL HMP_PATH_LUKSUUID HMP_PATH_ENCLABEL
   declare var_dev var_part \
     var_encryption_enable var_encryption_ephemeral var_encryption_integrity var_encryption_cipher \
-    var_encryption_hash var_encryption_iter var_encryption_key var_encryption_label var_encryption_meta \
+    var_encryption_hash var_encryption_iter var_encryption_key var_encryption_label var_encryption_meta var_encryption_cores \
-    var_encryption_pbkdf var_encryption_rng var_filesystem_label var_mount_path var_uuid
+    var_encryption_slot var_encryption_pbkdf var_encryption_rng var_filesystem_label var_mount_path var_uuid var_fs
   declare -a ary_devs=() ary_parts=() ary_luks_opts=()
 
   ### Iterate over all devices in the recipe.
@@ -60,17 +60,20 @@ partition_encryption() {
       var_encryption_hash=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.hash"           "${VAR_SETUP_PART}")
       var_encryption_iter=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.itertime"       "${VAR_SETUP_PART}")
       var_encryption_key=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.key"             "${VAR_SETUP_PART}")
-      var_encryption_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.label"         "${VAR_SETUP_PART}")
+      var_encryption_slot=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.keyslotssize"   "${VAR_SETUP_PART}")
       var_encryption_meta=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.metadatasize"   "${VAR_SETUP_PART}")
       var_encryption_pbkdf=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.pbkdf"         "${VAR_SETUP_PART}")
+      var_encryption_cores=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.pbkdfparallel" "${VAR_SETUP_PART}")
       var_encryption_rng=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.rng"             "${VAR_SETUP_PART}")
-      var_filesystem_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.label"         "${VAR_SETUP_PART}")
+      var_fs=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version"                     "${VAR_SETUP_PART}")
       var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path"                     "${VAR_SETUP_PART}")
 
       if [[ "${var_encryption_enable,,}" != "true" ]]; then
         continue
       fi
 
+      var_encryption_label=$(get_label "${var_mount_path}" "${var_fs}" "luks")
+
       if [[ "${var_mount_path,,}" == "/boot" ]]; then
         ary_luks_opts=( --key-file "${DIR_CNF}/password_luks_boot.txt" )
       else
@@ -79,13 +82,15 @@ partition_encryption() {
 
       ary_luks_opts+=(
         --type luks2
-        --cipher "${var_encryption_cipher}"
+        --cipher "${var_encryption_cipher:-aes-xts-plain64}"
-        --hash "${var_encryption_hash}"
+        --hash "${var_encryption_hash:-sha512}"
-        --iter-time "${var_encryption_iter}"
+        --iter-time "${var_encryption_iter:-3000}"
-        --key-size "${var_encryption_key}"
+        --key-size "${var_encryption_key:-512}"
         --label "${var_encryption_label}"
-        --luks2-metadata-size "${var_encryption_meta}"
+        --luks2-keyslots-size "${var_encryption_slot:-16777216}"
-        --pbkdf "${var_encryption_pbkdf}"
+        --luks2-metadata-size "${var_encryption_meta:-4194304}"
+        --pbkdf "${var_encryption_pbkdf:-argon2id}"
+        --pbkdf-parallel "${var_encryption_cores:-1}"
         "--${var_encryption_rng}"
         --batch-mode
         --verbose
@@ -99,6 +104,8 @@ partition_encryption() {
 
           SWAP|/tmp)
 
+            var_filesystem_label=$(get_label "${var_mount_path}" "${var_fs}" "file")
+
             mkfs.ext4 -L "${var_filesystem_label}" "/dev/${var_dev}${var_part}" 1M
             do_log "info" "file_only" "3220() Ephemeral: '${var_mount_path}' prepared on: '/dev/${var_dev}${var_part}'."
 
@@ -106,9 +113,9 @@ partition_encryption() {
             HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]="${var_encryption_label}"
             HMP_EPHEMERAL_FS_LABEL["${var_mount_path}"]="${var_filesystem_label}"
 
-            do_log "info" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_DEV]     : '${var_mount_path}' -> '${HMP_EPHEMERAL_DEV["${var_mount_path}"]}'"
+            do_log "debug" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_DEV]     : '${var_mount_path}' -> '${HMP_EPHEMERAL_DEV["${var_mount_path}"]}'"
-            do_log "info" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_ENCLABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]}'"
+            do_log "debug" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_ENCLABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]}'"
-            do_log "info" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_FS_LABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_FS_LABEL["${var_mount_path}"]}'"
+            do_log "debug" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_FS_LABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_FS_LABEL["${var_mount_path}"]}'"
             continue
             ;;
 

func/partitioning/3240_partition_formatting.sh

@@ -26,7 +26,7 @@ guard_sourcing
 #######################################
 partition_formatting() {
   ### Declare Arrays and Variables.
-  declare -Agx HMP_PATH_FSUUID
+  declare -Ag HMP_PATH_FSUUID
   declare var_dev var_part \
     var_encryption_enable var_encryption_label var_fs_btrfs_checksum var_fs_btrfs_compress var_fs_btrfs_mdup \
     var_fs_format var_fs_label var_fs_options var_fs_version var_mount_path var_node var_fs_uuid
@@ -44,12 +44,10 @@ partition_formatting() {
 
       ### Extract parameters from YAML.
       var_encryption_enable=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable"         "${VAR_SETUP_PART}")
-      var_encryption_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.label"           "${VAR_SETUP_PART}")
       var_fs_btrfs_checksum=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.checksum" "${VAR_SETUP_PART}")
       var_fs_btrfs_compress=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.compress" "${VAR_SETUP_PART}")
       var_fs_btrfs_mdup=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.mdup"         "${VAR_SETUP_PART}")
       var_fs_format=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.format"                 "${VAR_SETUP_PART}")
-      var_fs_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.label"                   "${VAR_SETUP_PART}")
       var_fs_options=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.options"               "${VAR_SETUP_PART}")
       var_fs_version=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version"               "${VAR_SETUP_PART}")
       var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path"                       "${VAR_SETUP_PART}")
@@ -59,24 +57,27 @@ partition_formatting() {
       ### Preparation of Ephemeral 'SWAP' and '/tmp' as per https://wiki.archlinux.org/title/Dm-crypt/Swap_encryption#UUID_and_LABEL
       case "${var_mount_path,,}" in
         swap|/tmp)
-          # mkfs.ext4 -L "${var_fs_label}" "/dev/${var_dev}${var_part}" 1M
           do_log "info" "file_only" "3240() Partition: '/dev/${var_dev}${var_part}' ephemeral encryption already prepared in 3220(): '${var_mount_path}'."
           continue
           ;;
       esac
 
       if [[ "${var_encryption_enable,,}" == "true" ]]; then
+        var_encryption_label=$(get_label "${var_mount_path}" "${var_fs_version}" "luks")
         var_node="/dev/mapper/${var_encryption_label}"
       else
         var_node="/dev/${var_dev}${var_part}"
       fi
 
+      var_fs_label=$(get_label "${var_mount_path}" "${var_fs_version}" "file")
+
       case "${var_fs_version,,}" in
 
         btrfs)
           ary_opts=( -L "${var_fs_label}" -f --csum "${var_fs_btrfs_checksum}" )
           [[ "${var_fs_btrfs_mdup,,}" == "true" ]] && ary_opts+=( -m dup )
           mkfs.btrfs "${ary_opts[@]}" "${var_node}"
+          do_log "debug" "file_only" "3240() [mkfs.btrfs ${ary_opts[*]} ${var_node}]."
           do_log "info" "file_only" "3240() Partition: '${var_node}' formatted: 'btrfs' options: '${ary_opts[*]}'."
           echo "Partition: '${var_node}':" >> "${DIR_LOG}/btrfs.log"
           btrfs filesystem show "${var_node}" >> "${DIR_LOG}/btrfs.log"
@@ -87,6 +88,7 @@ partition_formatting() {
         ext4)
           read -r -a ary_fmt_opts <<< "${var_fs_options}"
           mkfs.ext4 -L "${var_fs_label}" "${ary_fmt_opts[@]}" "${var_node}"
+          do_log "debug" "file_only" "3240() [mkfs.ext4 -L ${var_fs_label} ${ary_fmt_opts[*]} ${var_node}]."
           do_log "info" "file_only" "3240() Partition: '${var_node}' formatted: 'ext4' options: '${ary_fmt_opts[*]}'."
           echo "Partition: '${var_node}':" >> "${DIR_LOG}/ext4.log"
           tune2fs -l "${var_node}" >> "${DIR_LOG}/ext4.log"
@@ -96,6 +98,7 @@ partition_formatting() {
 
         fat32)
           mkfs.fat -F 32 -n "${var_fs_label}" "${var_node}"
+          do_log "debug" "file_only" "3240() [mkfs.fat -F 32 -n ${var_fs_label} ${var_node}]."
           do_log "info" "file_only" "3240() Partition: '${var_node}' formatted: 'FAT32'."
           var_fs_uuid=$(blkid -s UUID -o value "${var_node}")
           HMP_PATH_FSUUID["UUID_${var_mount_path}"]="${var_fs_uuid}"

func/partitioning/3260_setup_filesystem.sh

@@ -26,7 +26,7 @@ guard_sourcing
 setup_filesystem() {
   ### Declare Arrays and Variables.
   declare -Ag HMP_MOUNTPATH_DEV
-  declare var_dev var_part var_encryption_enable var_encryption_label var_mount_enable var_mount_path var_node
+  declare var_dev var_part var_encryption_enable var_encryption_label var_fs_version var_mount_enable var_mount_path var_node
   declare -a ary_devs ary_parts
 
   ### Iterate over all devices in the recipe.
@@ -41,7 +41,7 @@ setup_filesystem() {
 
       ### Extract parameters from YAML.
       var_encryption_enable=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable" "${VAR_SETUP_PART}")
-      var_encryption_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.label"   "${VAR_SETUP_PART}")
+      var_fs_version=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version"       "${VAR_SETUP_PART}")
       var_mount_enable=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.enable"           "${VAR_SETUP_PART}")
       var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path"               "${VAR_SETUP_PART}")
 
@@ -53,6 +53,7 @@ setup_filesystem() {
 
       if [[ "${var_encryption_enable}" == "true" ]]; then
 
+        var_encryption_label=$(get_label "${var_mount_path}" "${var_fs_version}" "luks")
         var_node="/dev/mapper/${var_encryption_label}"
 
       elif [[ "${var_encryption_enable}" == "false" ]]; then

func/partitioning/3280_mount_partition.sh

@@ -113,7 +113,7 @@ mount_partition() {
 
   else
 
-    do_log "error" "file_only" "3280() Root-filesystem '${var_mount_path_root}' not found in Hashmap."
+    do_log "error" "file_only" "3280() Root-filesystem '${var_mount_path_root}' not found in Hashmap: 'HMP_MOUNTPATH_DEV'."
     return "${ERR_MOUNTING_ROOT}"
 
   fi
@@ -129,7 +129,7 @@ mount_partition() {
 
     else
 
-      do_log "info" "file_only" "3280() Entry '${var_path}' not found in Hashmap."
+      do_log "info" "file_only" "3280() Entry '${var_path}' not found in Hashmap: 'HMP_MOUNTPATH_DEV'."
 
     fi
 
@@ -138,7 +138,7 @@ mount_partition() {
   declare var_dev var_part \
     var_fs_btrfs_compress var_fs_btrfs_level var_fs_btrfs_subvolume var_fs_btrfs_snapshot \
     var_encryption_enable var_encryption_label \
-    var_fs_label var_fs_options var_fs_version var_mount_path var_mount_options var_mount_optsnap
+    var_fs_label var_fs_options var_fs_version var_mount_path var_mount_options var_snapshot var_mount_optsnap
   declare -a ary_devs ary_parts
 
   ### Iterate over all devices in the recipe.
@@ -154,11 +154,8 @@ mount_partition() {
       ### Extract parameters from YAML.
       var_fs_btrfs_compress=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.compress"   "${VAR_SETUP_PART}")
       var_fs_btrfs_level=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.level"         "${VAR_SETUP_PART}")
-      var_fs_btrfs_subvolume=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.subvolume" "${VAR_SETUP_PART}")
       var_fs_btrfs_snapshot=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.snapshot"   "${VAR_SETUP_PART}")
       var_encryption_enable=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable"           "${VAR_SETUP_PART}")
-      var_encryption_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.label"             "${VAR_SETUP_PART}")
-      var_fs_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.label"                     "${VAR_SETUP_PART}")
       var_fs_options=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.options"                 "${VAR_SETUP_PART}")
       var_fs_version=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version"                 "${VAR_SETUP_PART}")
       var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path"                         "${VAR_SETUP_PART}")
@@ -168,21 +165,34 @@ mount_partition() {
       ### Skip already mounted paths ("/", "/boot", "/boot/efi") and skip ("/recovery")
       skip_path "${var_mount_path}" && continue
 
+      var_encryption_label=$(get_label "${var_mount_path}" "${var_fs_version}" "luks")
+
       if [[ "${var_mount_path}" == "SWAP" ]]; then
 
+        var_fs_label=$(get_label "${var_mount_path}" "${var_fs_version}" "file")
+
         cryptsetup open --type plain --key-file /dev/random \
           --offset 2048 --cipher aes-xts-plain64 --key-size 512 \
           --sector-size 4096 "/dev/disk/by-label/${var_fs_label}" "${var_encryption_label}"
+
         mkswap "/dev/mapper/${var_encryption_label}"
-        swapon "/dev/mapper/${var_encryption_label}"
+        do_log "debug" "file_only" "3280() [mkswap /dev/mapper/${var_encryption_label}]."
         do_log "info" "file_only" "3280() Mounted: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
+
+        swapon "/dev/mapper/${var_encryption_label}"
+        do_log "debug" "file_only" "3280() [swapon /dev/mapper/${var_encryption_label}]."
+        do_log "info" "file_only" "3280() Mounted: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
+
         continue
 
       elif [[ "${var_mount_path}" == "/tmp" ]]; then
 
+        var_fs_label=$(get_label "${var_mount_path}" "${var_fs_version}" "file")
+
         cryptsetup open --type plain --key-file /dev/random \
           --offset 2048 --cipher aes-xts-plain64 --key-size 512 \
           --sector-size 4096 "/dev/disk/by-label/${var_fs_label}" "${var_encryption_label}"
+
         mkdir -p "${TARGET}/tmp"
 
         # TODO: Remove Debug
@@ -190,10 +200,10 @@ mount_partition() {
         [[ -b "/dev/mapper/${var_encryption_label}" ]] || {
           do_log "error" "file_only" "Mapper-Device: '/dev/mapper/${var_encryption_label}' non-existing."
         }
+
         echo "lsblk -o NAME,SIZE,TYPE,FSTYPE,LABEL /dev/mapper/${var_encryption_label}"
         lsblk -o NAME,SIZE,TYPE,FSTYPE,LABEL /dev/mapper/"${var_encryption_label}"
-        echo "/dev/mapper/${var_encryption_label}"
+
-        blkid /dev/mapper/"${var_encryption_label}"
         echo "safe_exec mkfs.ext4 -E nodiscard,lazy_itable_init=1,lazy_journal_init=1 /dev/mapper/${var_encryption_label} ${ERR_MOUNTING_DEV}"
         safe_exec mkfs.ext4 -E nodiscard,lazy_itable_init=1,lazy_journal_init=1 "/dev/mapper/${var_encryption_label}" "${ERR_MOUNTING_DEV}" || return "${ERR_MOUNTING_DEV}"
         #mkfs.ext4 -E nodiscard,lazy_itable_init=1,lazy_journal_init=1 "/dev/mapper/${var_encryption_label}"
@@ -203,11 +213,13 @@ mount_partition() {
 
         ### Build the command in an array to keep word boundaries intact
         declare -a ary_cmd2=(mount)
-        [[ -n "${var_mount_options}" ]] && ary_cmd2+=("-o" "${var_mount_options}")
+
+        #[[ -n "${var_mount_options}" ]] && ary_cmd2+=("-o" "${var_mount_options}")
         ary_cmd2+=("/dev/mapper/${var_encryption_label}" "${TARGET}${var_mount_path}")
 
         safe_exec "${ary_cmd2[@]}" "${ERR_MOUNTING_DEV}" || return "${ERR_MOUNTING_DEV}"
         do_log "info" "file_only" "3280() Mounted: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
+
         continue
 
       fi
@@ -217,16 +229,23 @@ mount_partition() {
 
       if [[ "${var_fs_version,,}" == "btrfs" ]]; then
 
+        var_fs_btrfs_subvolume=$(get_label "${var_mount_path}" "${var_fs_version}" "sub")
+
         ### Mount toplevel (subvolid=0) without extra options.
         declare -a ary_cmd_mount=(mount -o "subvolid=0" "${var_resolved_dev}" "${VAR_SAFE_MNT_BASE}")
         safe_exec "${ary_cmd_mount[@]}" "${ERR_BTRFS_INITPH}" || return "${ERR_BTRFS_INITPH}"
 
-        btrfs subvolume create "${VAR_SAFE_MNT_BASE}"/"${var_fs_btrfs_subvolume}"
+        btrfs subvolume create "${VAR_SAFE_MNT_BASE}/${var_fs_btrfs_subvolume}"
+        do_log "debug" "file_only" "3280() [btrfs subvolume create ${VAR_SAFE_MNT_BASE}/${var_fs_btrfs_subvolume}]."
         do_log "info" "file_only" "3280() btrfs subvolid=0 created: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
 
-        if [[ -n "${var_fs_btrfs_snapshot}" ]]; then
+        if [[ "${var_fs_btrfs_snapshot}" == "true" ]]; then
-          btrfs subvolume create "${VAR_SAFE_MNT_BASE}"/"${var_fs_btrfs_snapshot}" || return "${ERR_BTRFS_SUBVOL}"
+
-          do_log "info" "file_only" "3280() btrfs subvolid=${var_fs_btrfs_snapshot} created: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
+          var_snapshot=$(get_label "${var_mount_path}" "${var_fs_version}" "snap")
+
+          btrfs subvolume create "${VAR_SAFE_MNT_BASE}/${var_snapshot}" || return "${ERR_BTRFS_SUBVOL}"
+          do_log "debug" "file_only" "3280() [btrfs subvolume create ${VAR_SAFE_MNT_BASE}/${var_snapshot}]."
+          do_log "info" "file_only" "3280() btrfs subvolid=${var_snapshot} created: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
         fi
 
         umount "${VAR_SAFE_MNT_BASE}"
@@ -237,19 +256,32 @@ mount_partition() {
       case "${var_fs_version,,}:${var_encryption_enable,,}" in
 
         btrfs:*)
+
           validate_btrfs_compression "${var_fs_btrfs_compress}" "${var_fs_btrfs_level}" || return "${ERR_BTRFS_OPTION}"
+
           declare var_btrfs_compression_options="compress=${var_fs_btrfs_compress}:${var_fs_btrfs_level}"
-          [[ -n "${var_mount_options}" ]] && var_btrfs_compression_options+=",${var_mount_options}"
+
+          [[ -n "${var_mount_options}" ]] && var_btrfs_compression_options+=",${var_mount_options},subvol=${var_fs_btrfs_subvolume}"
+
           mount_with_dir "${var_mount_path}" "${var_resolved_dev}" "${var_btrfs_compression_options}" || return "${ERR_MOUNTING_DEV}"
-          if [[ -n "${var_fs_btrfs_snapshot}" ]]; then
+
+          if [[ "${var_fs_btrfs_snapshot}" == "true" ]]; then
+
             mkdir -p "${TARGET}${var_mount_path}/.snapshots"
+
             do_log "info" "file_only" "3280() Created: '${TARGET}${var_mount_path}/.snapshots'."
-            mount -o "${var_mount_optsnap}" "${var_resolved_dev}" "${TARGET}${var_mount_path}/.snapshots"
+
+            var_mount_optsnap="${var_mount_optsnap},subvol=${var_snapshot}"
+
+            mount_with_dir "${var_mount_path}/.snapshots" "${var_resolved_dev}" "${var_mount_optsnap}"
+
             do_log "info" "file_only" "3280() Mounted: '${var_resolved_dev}' on: '${TARGET}${var_mount_path}/.snapshots' (Options='${var_mount_optsnap}')."
+
           fi
           ;;
 
         ext4:*)
+
           mount_with_dir "${var_mount_path}" "${var_resolved_dev}" "${var_mount_options}" || return "${ERR_MOUNTING_DEV}"
           ;;
 
@@ -260,6 +292,8 @@ mount_partition() {
 
     done
 
+    lsblk -o NAME,MAJ:MIN,FSTYPE,FSVER,SIZE,UUID,MOUNTPOINT,PATH "/dev/${var_dev}" >| "${DIR_LOG}/${var_dev}_overview_full.log"
+
   done
 
   return 0

func/partitioning/3295_get_label.sh

@@ -0,0 +1,118 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+guard_sourcing
+
+#######################################
+# Returns standardized labels for the provided mount path depending on filesystem and art of label.
+# Globals:
+#   None
+# Arguments:
+#   1: Mount path (e.g., '/' '/boot' '/var/log/audit' 'SWAP' '/boot/efi')
+#   2: Filesystem type: one of: [BIOS, btrfs ext4 fat32, swap]
+#   3: Desired return label: one of: [part, luks, file, sub, snap]
+# Returns:
+#   Prints resulting label to stdout.
+#######################################
+get_label() {
+  declare -r var_path="${1}"
+  declare -r var_file="${2,,}"
+  declare -r var_kind="${3,,}"
+
+  ### Normalize 'mount.path': remove leading slash and replace slashes with underscore.
+  declare var_return_label=""
+  declare var_normalized="${var_path#/}"                # Strip leading "/".
+  var_normalized="${var_normalized//\//_}"              # Replace "/" with "_"
+  [[ -z "${var_normalized}" ]] && var_normalized="root" # Edge case "/".
+
+  case "${var_kind}" in
+
+    part)
+
+      case "${var_path}" in
+
+        SWAP)                var_return_label="part_ephem_swap" ;;
+        /tmp)                var_return_label="part_ephem_tmp" ;;
+        /boot/efi)           var_return_label="part_esp" ;;
+        /)                   var_return_label="part_root" ;;
+        *)                   var_return_label="part_${var_normalized}" ;;
+
+      esac
+      ;;
+
+    luks)
+
+      case "${var_path}" in
+
+        /tmp)                var_return_label="crypt_ephem_tmp" ;;
+        SWAP)                var_return_label="crypt_ephem_swap" ;;
+        /boot/efi)           var_return_label="" ;;
+        /)                   var_return_label="crypt_root" ;;
+        *)                   var_return_label="crypt_${var_normalized}" ;;
+
+      esac
+      ;;
+
+    file)
+
+      case "${var_path}:${var_file}" in
+
+        SWAP:*)              var_return_label="host_swap" ;;
+        /tmp:*)              var_return_label="host_tmp" ;;
+        /boot/efi:*)         var_return_label="ESP" ;;
+        /var/log/audit:ext4) var_return_label="ext4_var_audit" ;;
+        *:ext4)              var_return_label="ext4_${var_normalized}"
+                             var_return_label="${var_return_label:0:16}"
+                             do_log "warn" "file_only" "3295() Label: '${var_return_label}' of type: '${var_kind}' created for: '${var_path}' exceeds 16 chars, truncating."
+                             ;;
+        *:btrfs)             var_return_label="btrfs_${var_normalized}" ;;
+        *:*)                 var_return_label="${var_file}_${var_normalized}" ;;
+
+      esac
+      ;;
+
+    sub)
+
+      if [[ "${var_file}" == "btrfs" ]]; then
+        var_return_label="@${var_normalized}"
+      fi
+      ;;
+
+    snap)
+
+      if [[ "${var_file}" == "btrfs" ]]; then
+        var_return_label="@${var_normalized}_snap"
+      fi
+      ;;
+
+    *)
+
+      do_log "warn" "3295() File_only" "Unknown kind: ${var_kind}"
+      return 0
+      ;;
+
+  esac
+
+  if [[ -n "${var_return_label}" ]]; then
+
+    do_log "info" "file_only" "3295() Label: '${var_return_label}' of type: '${var_kind}' created for: '${var_path}'."
+    printf "%s\n" "${var_return_label}"
+    return 0
+
+  else
+
+    do_log "warn" "file_only" "3295() Label not resolved: of type: '${var_kind}' for: '${var_path}' and FS: '${var_file}'."
+    return 0
+
+  fi
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

func/system/4150_setup_grub.sh

@@ -39,7 +39,6 @@ setup_grub() {
   declare -gx var_update_grub_required="false"
   get_all_boot_devs
 
-
   if [[ "${grub_skip,,}" != "true" ]]; then
 
     ### Install GRUB2 package

lib/0002_usage.sh

@@ -75,6 +75,7 @@ usage() {
      echo
     echo -e "\e[97m  --log, -l <LEVEL> \e[0m"
     echo "    This changes the default log level from 'info' to one of the following values:"
+    echo "      debug"
     echo "      info"
     echo "      notice"
     echo "      warn"

lib/0102_arg_parser.sh

@@ -53,7 +53,7 @@ arg_parser() {
 
         -l | --log)
           case "${2,,}" in
-            info|notice|warn|error|emergency) declare -gx VAR_DEFAULT_LOG_LEVEL="$2"; shift 2 ;;
+            debug|info|notice|warn|error|critical|fatal|emergency) declare -gx VAR_DEFAULT_LOG_LEVEL="$2"; shift 2 ;;
             *)
               if [[ "${VAR_AUTO_INSTALL}" == "false" && "${VAR_IN_DIALOG_WR}" == true ]]; then dialog_box_cleaner; fi
               usage

meta_loader_func.sh

@@ -29,6 +29,7 @@ source_guard "./func/partitioning/3240_partition_formatting.sh"
 source_guard "./func/partitioning/3260_setup_filesystem.sh"
 source_guard "./func/partitioning/3280_mount_partition.sh"
 source_guard "./func/partitioning/3290_uuid_logger.sh"
+source_guard "./func/partitioning/3295_get_label.sh"
 
 source_guard "./func/system/4000_debootstrap.sh"
 source_guard "./func/system/4020_configure_system.sh"