# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
recipe:
  guben0afx256r:               # g=GPT || m=MBR
                               # u=UEFI || b=BIOS
                               # b=btrfs || 4=ext4 only
                               # e=ephemeral "/tmp" and "SWAP" || n=non-ephemeral "/tmp" and "SWAP" (yet not supported)
                               # n0=non RAID || m6=mdadm RAID6 || m5=mdadm RAID5 || b1=btrfs RAID1 (yet not supported)
                               # a="/dev/sda" only setup || b="/dev/sdb" || c="/dev/sdc" and so forth
                               # f=fixed size || a=automatic size (yet not supported)
                               # x256=size of device in GiB
                               # r=rescue partition || n=no rescue partition
                               #######################################
                               # EFI System Partition | EF00 | UEFI Bootloader (ESP, FAT32) | filesystem.version: fat32
                               # BIOS Boot Partition  | EF02 | BIOS Bootloader area (GRUB)  | filesystem.version: BIOS
                               # Linux SWAP           | 8200 | Linux Swap                   | filesystem.version: SWAP
                               # Linux ext4/btrfs     | 8300 | Linux Filesystem (root, home)| filesystem.version: ext4 || btrfs
                               #######################################
    active: true               # Choose this recipe.
    control:
      description: "CISS 2025 - GPT - BTRFS - Ephemeral - non RAID - 256GiB - rescue"
      firmware: "UEFI"         # MUST be "UEFI" for "gpt" || "BIOS":
      id: "guben0afx256r"      # MUST be equal to the second part of the recipe-variables string.
      kdf:
        threads: 1             # Set the parallel cost for PBKDF (number of threads, up to 4).
        time: 256              # The number of milliseconds to spend with PBKDF passphrase processing.
      luks_backup: true        # Specify if LUKS Header backups should be created. If so, provide an external backup URL:
                               # luks_backup_url: "https://cloud.e2ee.li/" or leave empty for local backup.
                               # Also provide the cloud access token and access passwords via ./.preseed/password_luks_backup.txt
                               # Yet Nextcloud only is supported.
      luks_backup_url: "https://cloud.e2ee.li/"
      name: "ciss.2025.gpt.btrfs.ephemeral.non-raid.256GiB.rescue"
      nuke: true               # Activates Nuke-Mechanism in '/etc/crypttab' keyscript and via dropbear SSH forced command.
      nuke_rounds: 16384       # SHA512 KDF Rounds for Nuke Passphrase. If omitted, the default value is '8,388,608'.
      raid:                    # mdadm RAID settings only (not yet supported).
        enable: false
        disks:
          member: 4
          spare: 1
        level: 6               # Only Level "1", "5", "6" and "10" are supported.
        meta: 1.2              # Metadata Format. Default to '1.2'.
      recovery: false          # MUST be "true" for recovery partition in use.
      table: "gpt"             # MUST be "gpt" for "UEFI" || "msdos":
      syntax: true             # This is set to "false" by default, otherwise if the recipe is tested by the authors to "true".
      ### Version of the specific recipe.
      version: "1.3.0"
    dev:
      sda:
        1:                     # MUST be always 'ESP' for [UEFI|GPT] or 'BIOS' for [BIOS|GPT].
          begin: "min"
          end: "1024MiB"
          bootable: false
          encryption:
            enable: false      # MUST be "false" for "/boot/efi"
            ephemeral: false   # MUST be "false" for "/boot/efi"
            integrity: false   # MUST be "false" for "/boot/efi"
            cipher: ""
            hash: ""
            key: ""
            keyslotssize: ""
            metadatasize: ""
            pbkdf: ""
            rng: ""
          filesystem:
            btrfs:
              checksum: ""
              compress: ""
              level: ""
              mdup: ""
              snapshot: false
            format: true
            options: ""
            version: "fat32"
          mount:
            enable: true       # MUST be "true" for "/boot/efi"
            options: "umask=0077,uid=0,gid=0"
            optsnap: ""
            path: "/boot/efi"
          primary: primary
        2:
          begin: "1024MiB"
          end: "3GiB"
          bootable: false
          encryption:
            enable: true
            ephemeral: false   # MUST be "false" for "/boot"
            integrity: false   # MUST be "false" for "/boot"
            cipher: "aes-xts-plain64"
            hash: "sha512"
            key: "512"
            keyslotssize: "32M"
            metadatasize: "4096k"
            pbkdf: "pbkdf2"     # MUST be "pbkdf2" for "/boot"
            rng: "use-random"
          filesystem:
            btrfs:
              checksum: "sha256"
              compress: "zstd"
              level: "0"
              mdup: true
              snapshot: false
            format: true
            version: "btrfs"
            options: ""
          mount:
            enable: true
            options: "nodev,nosuid,noexec,noatime,compress=no,discard=async"
            optsnap: ""
            path: "/boot"
          primary: primary
        3:
          begin: "3GiB"
          end: "10GiB"
          bootable: false
          encryption:
            enable: true
            ephemeral: false
            integrity: false
            cipher: "aes-xts-plain64"
            hash: "sha512"
            key: "512"
            keyslotssize: "32M"
            metadatasize: "4096k"
            pbkdf: "argon2id"
            rng: "use-random"
          filesystem:
            btrfs:
              checksum: ""
              compress: ""
              level: ""
              mdup: ""
              snapshot: false
            format: true
            label: "ext4_rescue"
            options: ""
            version: "ext4"
          mount:
            enable: true
            options: "defaults,nodev"
            optsnap: ""
            path: "/recovery"
          primary: primary
        4:
          begin: "10GiB"
          end: "14GiB"
          bootable: false
          encryption:
            enable: true       # MUST be "true" for ephemeral "SWAP"
            ephemeral: true    # MUST be "true" for ephemeral "SWAP"
            integrity: false   # MUST be "false" for ephemeral "SWAP"
            cipher: "aes-xts-plain64"
            hash: "sha512"
            key: "512"
            keyslotssize: "32M"
            metadatasize: "4096k"
            pbkdf: "argon2id"
            rng: "use-random"
          filesystem:
            btrfs:
              checksum: ""
              compress: ""
              level: ""
              mdup: ""
              snapshot: false
            format: true
            label: "host_swap"
            options: ""
            version: "ext4"
          mount:
            enable: true
            options: "defaults"
            optsnap: ""
            path: "SWAP"
          primary: primary
        5:
          begin: "14GiB"
          end: "18GiB"
          bootable: false
          encryption:
            enable: true       # MUST be "true" for ephemeral "/tmp"
            ephemeral: true    # MUST be "true" for ephemeral "/tmp"
            integrity: false   # MUST be "false" for ephemeral "/tmp"
            cipher: "aes-xts-plain64"
            hash: "sha512"
            key: "512"
            keyslotssize: "32M"
            metadatasize: "4096k"
            pbkdf: "argon2id"
            rng: "use-random"
          filesystem:
            btrfs:
              checksum: ""
              compress: ""
              level: ""
              mdup: ""
              snapshot: false
            format: true
            options: ""
            version: "ext4"
          mount:
            enable: true
            options: "defaults,rw,nodev,noexec,nosuid,noatime,discard"
            optsnap: ""
            path: "/tmp"
          primary: primary
        6:
          begin: "18GiB"
          end: "42GiB"
          bootable: false
          encryption:
            enable: true
            ephemeral: false
            integrity: false
            cipher: "aes-xts-plain64"
            hash: "sha512"
            key: "512"
            keyslotssize: "32M"
            metadatasize: "4096k"
            pbkdf: "argon2id"
            rng: "use-random"
          filesystem:
            btrfs:
              checksum: "sha256"
              compress: "zstd"
              level: "7"
              mdup: true
              snapshot: true
            format: true
            options: ""
            version: "btrfs"
          mount:
            enable: true
                               # btrfs: errors=continue
                               # ext4 : errors=remount-ro
            options: "defaults,noatime,discard=async,autodefrag"
            optsnap: "nodev,nosuid,noexec"
            path: "/"
          primary: primary
        7:
          begin: "42GiB"
          end: "84GiB"
          bootable: false
          encryption:
            enable: true
            ephemeral: false
            integrity: false
            cipher: "aes-xts-plain64"
            hash: "sha512"
            key: "512"
            keyslotssize: "32M"
            metadatasize: "4096k"
            pbkdf: "argon2id"
            rng: "use-random"
          filesystem:
            btrfs:
              checksum: "sha256"
              compress: "zstd"
              level: "7"
              mdup: true
              snapshot: true
            format: true
            options: ""
            version: "btrfs"
          mount:
            enable: true
            options: "defaults,nodev,nosuid,relatime,discard=async,autodefrag"
            optsnap: "nodev,nosuid,noexec"
            path: "/home"
          primary: primary
        8:
          begin: "84GiB"
          end: "126GiB"
          bootable: false
          encryption:
            enable: true
            ephemeral: false
            integrity: false
            cipher: "aes-xts-plain64"
            hash: "sha512"
            key: "512"
            keyslotssize: "32M"
            metadatasize: "4096k"
            pbkdf: "argon2id"
            rng: "use-random"
          filesystem:
            btrfs:
              checksum: "sha256"
              compress: "zstd"
              level: "7"
              mdup: true
              snapshot: false
            format: true
            options: ""
            version: "btrfs"
          mount:
            enable: true
            options: "defaults,nodev,relatime,discard=async"
            optsnap: ""
            path: "/usr"
          primary: primary
        9:
          begin: "126GiB"
          end: "190GiB"
          bootable: false
          encryption:
            enable: true
            ephemeral: false
            integrity: false
            cipher: "aes-xts-plain64"
            hash: "sha512"
            key: "512"
            keyslotssize: "32M"
            metadatasize: "4096k"
            pbkdf: "argon2id"
            rng: "use-random"
          filesystem:
            btrfs:
              checksum: "sha256"
              compress: "zstd"
              level: "7"
              mdup: true
              snapshot: true
            format: true
            options: ""
            version: "btrfs"
          mount:
            enable: true
            options: "defaults,nodev,nosuid,relatime,discard=async"
            optsnap: "nodev,nosuid,noexec"
            path: "/var"
          primary: primary
        10:
          begin: "190GiB"
          end: "206GiB"
          bootable: false
          encryption:
            enable: true
            ephemeral: false
            integrity: false
            cipher: "aes-xts-plain64"
            hash: "sha512"
            key: "512"
            keyslotssize: "32M"
            metadatasize: "4096k"
            pbkdf: "argon2id"
            rng: "use-random"
          filesystem:
            btrfs:
              checksum: "sha256"
              compress: "zstd"
              level: "7"
              mdup: true
              snapshot: false
            format: true
            options: ""
            version: "btrfs"
          mount:
            enable: true
            options: "defaults,nodev,nosuid,noexec,noatime,discard=async"
            optsnap: ""
            path: "/var/log"
          primary: primary
        11:
          begin: "206GiB"
          end: "222GiB"
          bootable: false
          encryption:
            enable: true
            ephemeral: false
            integrity: false
            cipher: "aes-xts-plain64"
            hash: "sha512"
            key: "512"
            keyslotssize: "32M"
            metadatasize: "4096k"
            pbkdf: "argon2id"
            rng: "use-random"
          filesystem:
            btrfs:
              checksum: "sha256"
              compress: "zstd"
              level: "7"
              mdup: true
              snapshot: false
            format: true
            options: ""
            version: "btrfs"
          mount:
            enable: true
            options: "defaults,nodev,nosuid,noexec,noatime,discard=async"
            optsnap: ""
            path: "/var/log/audit"
          primary: primary
        12:
          begin: "222GiB"
          end: "238GiB"
          bootable: false
          encryption:
            enable: true
            ephemeral: false
            integrity: false
            cipher: "aes-xts-plain64"
            hash: "sha512"
            key: "512"
            keyslotssize: "32M"
            metadatasize: "4096k"
            pbkdf: "argon2id"
            rng: "use-random"
          filesystem:
            btrfs:
              checksum: "sha256"
              compress: "zstd"
              level: "7"
              mdup: true
              snapshot: false
            format: true
            options: ""
            version: "btrfs"
          mount:
            enable: true
            options: "defaults,nodev,nosuid,noatime,discard=async"
            optsnap: ""
            path: "/var/tmp"
          primary: primary
        13:
          begin: "238GiB"
          end: "max"            # The last 16 MiB will be reserved for GPT metadata.
          bootable: false
          encryption:
            enable: true
            ephemeral: false
            integrity: false
            cipher: "aes-xts-plain64"
            hash: "sha512"
            key: "512"
            keyslotssize: "32M"
            metadatasize: "4096k"
            pbkdf: "argon2id"
            rng: "use-random"
          filesystem:
            btrfs:
              checksum: "sha256"
              compress: "zstd"
              level: "7"
              mdup: true
              snapshot: false
            format: true
            options: ""
            version: "btrfs"
          mount:
            enable: true
            options: "defaults,nodev,nosuid,relatime,discard=async"
            optsnap: ""
            path: "/opt"
          primary: primary

# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml