# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
recipe:
  guben0afx256r:
    active: true
    control:
      # g=GPT || m=MBR
      # u=UEFI || b=BIOS
      # b=btrfs || 4=ext4 only
      # e=ephemeral "/tmp" and "SWAP" || n=non-ephemeral "/tmp" and "SWAP" (yet not supported)
      # n0=non RAID || m6=mdadm RAID6 || m5=mdadm RAID5 || b1=btrfs RAID1
      # a="/dev/sda" only setup || b="/dev/sdb" || c="/dev/sdc" and so forth
      # f=fixed size || a=automatic size
      # x256=size of device in GiB
      # r=rescue partition || n=no rescue partition
      description: "Default: CISS 2025 - GPT - BTRFS - Ephemeral - non RAID - 256GiB - rescue"
      # MUST be "UEFI" for "gpt" || "BIOS":
      firmware: "UEFI"
      # MUST be equal to the second part of the recipe-variables string.
      id: "guben0afx256r"
      name: "ciss.2025.gpt.btrfs.ephemeral.non-raid.256GiB.rescue"
      # mdadm RAID settings only (not yet supported)
      raid:
        enable: false
        disks:
          member: 4
          spare: 1
        # Only Level "1", "5", "6" and "10" are supported
        level: 6
      # MUST be "gpt" for "UEFI" || "msdos":
      table: "gpt"
      # Only set to "true" if the recipe is tested by the authors. Otherwise, this is set to "false" by default.
      syntax: true
      # Version of the specific recipe.
      version: "1.0.0"
    dev:
      sda:
        1:
          begin: "2MiB"
          end: "512MiB"
          bootable: true
          encryption:
            # MUST be "false" for "/boot/efi":
            enable: false
            # MUST be "false" for "/boot/efi":
            ephemeral: false
            # MUST be "false" for "/boot/efi":
            integrity: false
            # MUST be "false" for "/boot/efi":
            nuke: false
            cipher: ""
            hash: ""
            itertime: ""
            key: ""
            label: ""
            metadatasize: ""
            pbkdf: ""
            rng: ""
          filesystem:
            # btrfs only
            btrfs:
              checksum: ""
              compress: ""
              level: ""
              dedup: true
            format: true
            label: "ESP"
            options: ""
            version: "fat32"
          mount:
            # MUST be "true" for "/boot/efi":
            enable: true
            options: ""
            path: "/boot/efi"
            # Only valid for filesystem version "btrfs":
            subvolume: ""
          primary: primary
        2:
          begin: "512MiB"
          end: "2GiB"
          bootable: false
          encryption:
            enable: true
            # MUST be "false" for "/boot":
            ephemeral: false
            # MUST be "false" for "/boot":
            integrity: false
            # MUST be "false" for "/boot":
            nuke: false
            cipher: "aes-xts-plain64"
            hash: "sha512"
            itertime: "3000"
            key: "512"
            label: "crypt_boot"
            metadatasize: "32MiB"
            # MUST be "pbkdf" for "/boot":
            pbkdf: "pbkdf"
            rng: "use-random"
          filesystem:
            # btrfs only
            btrfs:
              checksum: ""
              compress: ""
              level: ""
              dedup: true
            format: true
            version: "ext4"
            label: "ext4_boot"
            options: ""
          mount:
            # MUST be "true" for "/boot":
            enable: true
            options: "defaults,nodev,noexec,nosuid,noatime"
            path: "/boot"
            # Only valid for filesystem version "btrfs":
            subvolume: ""
          primary: primary
        3:
          begin: "2GiB"
          end: "6GiB"
          bootable: true
          encryption:
            enable: true
            ephemeral: false
            integrity: false
            nuke: false
            cipher: "aes-xts-plain64"
            hash: "sha512"
            itertime: "3000"
            key: "512"
            label: "crypt_rescue"
            metadatasize: "32MiB"
            pbkdf: "argon2id"
            rng: "use-random"
          filesystem:
            # btrfs only
            btrfs:
              checksum: ""
              compress: ""
              level: ""
              dedup: true
            format: true
            label: "ext4_rescue"
            options: ""
            version: "ext4"
          mount:
            enable: true
            options: "defaults,nodev"
            path: "/recovery"
            # Only valid for filesystem version "btrfs":
            subvolume: ""
          primary: primary
        4:
          begin: "6GiB"
          end: "8GiB"
          bootable: false
          encryption:
            # MUST be "true" for ephemeral "SWAP":
            enable: true
            # MUST be "true" for ephemeral "SWAP":
            ephemeral: true
            # MUST be "false" for ephemeral "SWAP":
            integrity: false
            # MUST be "false" for ephemeral "SWAP":
            nuke: false
            cipher: "aes-xts-plain64"
            hash: "sha512"
            itertime: "3000"
            key: "512"
            label: "crypt_ephemeral_SWAP"
            metadatasize: "32MiB"
            pbkdf: "argon2id"
            rng: "use-random"
          filesystem:
            # btrfs only
            btrfs:
              checksum: ""
              compress: ""
              level: ""
              dedup: true
            format: true
            # MUST be "crypt_swap_ephem" for "SWAP":
            label: "crypt_swap_ephem"
            options: ""
            # MUST be "ext4" for ephemeral "SWAP":
            version: "ext4"
          mount:
            enable: true
            options: ""
            path: "SWAP"
            # Only valid for filesystem version "btrfs":
            subvolume: ""
          primary: primary
        5:
          begin: "8GiB"
          end: "10GiB"
          bootable: false
          encryption:
            # MUST be "true" for ephemeral "/tmp":
            enable: true
            # MUST be "true" for ephemeral "/tmp":
            ephemeral: true
            # MUST be "false" for ephemeral "/tmp":
            integrity: false
            # MUST be "false" for ephemeral "/tmp":
            nuke: false
            cipher: "aes-xts-plain64"
            hash: "sha512"
            itertime: "3000"
            key: "512"
            label: "crypt_ephemeral_tmp"
            metadatasize: "32MiB"
            pbkdf: "argon2id"
            rng: "use-random"
          filesystem:
            # btrfs only
            btrfs:
              checksum: ""
              compress: ""
              level: ""
              dedup: true
            format: true
            # MUST be "crypt_tmp_ephem" for ephemeral "/tmp"
            label: "crypt_tmp_ephem"
            options: ""
            # MUST be "ext4" for ephemeral "/tmp"
            version: "ext4"
          mount:
            enable: true
            options: "defaults,rw,nodev,noexec,nosuid,noatime,mode=1777"
            path: "/tmp"
            # Only valid for filesystem version "btrfs":
            subvolume: ""
          primary: primary
        6:
          begin: "10GiB"
          end: "42GiB"
          bootable: false
          encryption:
            enable: true
            ephemeral: false
            integrity: true
            nuke: true
            cipher: "aes-xts-plain64"
            hash: "sha512"
            itertime: "3000"
            key: "512"
            label: "crypt_root"
            metadatasize: "32MiB"
            pbkdf: "argon2id"
            rng: "use-random"
          filesystem:
            # btrfs only
            btrfs:
              checksum: "sha256"
              compress: "zstd"
              level: "7"
              dedup: true
            format: true
            label: "btrfs_root"
            options: ""
            version: "btrfs"
          mount:
            # MUST be "true" for "/":
            enable: true
            options: "defaults,errors=remount-ro,noatime"
            path: "/"
            # Only valid for filesystem version "btrfs":
            subvolume: "@"
          primary: primary
        7:
          begin: "42GiB"
          end: "84GiB"
          bootable: false
          encryption:
            enable: true
            ephemeral: false
            integrity: true
            nuke: true
            cipher: "aes-xts-plain64"
            hash: "sha512"
            itertime: "3000"
            key: "512"
            label: "crypt_home"
            metadatasize: "32MiB"
            pbkdf: "argon2id"
            rng: "use-random"
          filesystem:
            # btrfs only
            btrfs:
              checksum: "sha256"
              compress: "zstd"
              level: "7"
              dedup: true
            format: true
            label: "btrfs_home"
            options: ""
            version: "btrfs"
          mount:
            enable: true
            options: "defaults,rw,nodev,nosuid,noatime"
            path: "/home"
            # Only valid for filesystem version "btrfs":
            subvolume: "@home"
          primary: primary
        8:
          begin: "42GiB"
          end: "84GiB"
          bootable: false
          encryption:
            enable: true
            ephemeral: false
            integrity: true
            nuke: true
            cipher: "aes-xts-plain64"
            hash: "sha512"
            itertime: "3000"
            key: "512"
            label: "crypt_usr"
            metadatasize: "32MiB"
            pbkdf: "argon2id"
            rng: "use-random"
          filesystem:
            # btrfs only
            btrfs:
              checksum: "sha256"
              compress: "zstd"
              level: "7"
              dedup: true
            format: true
            label: "btrfs_usr"
            options: ""
            version: "btrfs"
          mount:
            enable: true
            options: "defaults,rw,nodev,noatime"
            path: "/usr"
            # Only valid for filesystem version "btrfs":
            subvolume: "@usr"
          primary: primary
        9:
          begin: "126GiB"
          end: "190GiB"
          bootable: false
          encryption:
            enable: true
            ephemeral: false
            integrity: true
            nuke: true
            cipher: "aes-xts-plain64"
            hash: "sha512"
            itertime: "3000"
            key: "512"
            label: "crypt_var"
            metadatasize: "32MiB"
            pbkdf: "argon2id"
            rng: "use-random"
          filesystem:
            # btrfs only
            btrfs:
              checksum: "sha256"
              compress: "zstd"
              level: "7"
              dedup: true
            format: true
            label: "btrfs_var"
            options: ""
            version: "btrfs"
          mount:
            enable: true
            options: "defaults,rw,nodev,nosuid,noatime"
            path: "/var"
            # Only valid for filesystem version "btrfs":
            subvolume: "@var"
          primary: primary
        10:
          begin: "190GiB"
          end: "206GiB"
          bootable: false
          encryption:
            enable: true
            ephemeral: false
            integrity: true
            nuke: true
            cipher: "aes-xts-plain64"
            hash: "sha512"
            itertime: "3000"
            key: "512"
            label: "crypt_var_log"
            metadatasize: "32MiB"
            pbkdf: "argon2id"
            rng: "use-random"
          filesystem:
            # btrfs only
            btrfs:
              checksum: "sha256"
              compress: "zstd"
              level: "7"
              dedup: true
            format: true
            label: "btrfs_var_log"
            options: ""
            version: "btrfs"
          mount:
            enable: true
            options: "defaults,rw,nodev,noexec,nosuid,noatime"
            path: "/var/log"
            # Only valid for filesystem version "btrfs":
            subvolume: "@var_log"
          primary: primary
        11:
          begin: "206GiB"
          end: "222GiB"
          bootable: false
          encryption:
            enable: true
            ephemeral: false
            integrity: true
            nuke: true
            cipher: "aes-xts-plain64"
            hash: "sha512"
            itertime: "3000"
            key: "512"
            label: "crypt_var_log_audit"
            metadatasize: "32MiB"
            pbkdf: "argon2id"
            rng: "use-random"
          filesystem:
            # btrfs only
            btrfs:
              checksum: "sha256"
              compress: "zstd"
              level: "7"
              dedup: true
            format: true
            label: "btrfs_var_log_audit"
            options: ""
            version: "btrfs"
          mount:
            enable: true
            options: "defaults,rw,nodev,noexec,nosuid,noatime"
            path: "/var/log/audit"
            # Only valid for filesystem version "btrfs":
            subvolume: "@var_log_audit"
          primary: primary
        12:
          begin: "222GiB"
          end: "238GiB"
          bootable: false
          encryption:
            enable: true
            ephemeral: false
            integrity: false
            nuke: true
            cipher: "aes-xts-plain64"
            hash: "sha512"
            itertime: "3000"
            key: "512"
            label: "crypt_var_tmp"
            metadatasize: "32MiB"
            pbkdf: "argon2id"
            rng: "use-random"
          filesystem:
            # btrfs only
            btrfs:
              checksum: "sha256"
              compress: "zstd"
              level: "7"
              dedup: true
            format: true
            label: "btrfs_var_tmp"
            options: ""
            version: "btrfs"
          mount:
            enable: true
            options: "defaults,rw,nodev,noexec,nosuid,noatime"
            path: "/var/tmp"
            # Only valid for filesystem version "btrfs":
            subvolume: "@var_tmp"
          primary: primary
        13:
          begin: "238GiB"
          end: "-1"
          bootable: false
          encryption:
            enable: true
            ephemeral: false
            integrity: false
            nuke: true
            cipher: ""
            hash: ""
            itertime: ""
            key: ""
            label: ""
            metadatasize: ""
            pbkdf: ""
            rng: ""
          filesystem:
            # btrfs only
            btrfs:
              checksum: ""
              compress: ""
              level: ""
              dedup: true
            format: false
            label: ""
            options: ""
            version: ""
          mount:
            enable: false
            options: ""
            path: ""
            # Only valid for filesystem version "btrfs":
            subvolume: ""
          primary: primary

# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml: