msw/CISS.debian.installer
SHA256
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
a3fbf294e621a43175a60a461767dd7a1cb9f5adc2ac74dca051da25026091df
CISS.debian.installer/.preseed/partitioning.yaml
Marc S. Weidner e782f3d966
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m48s
Details
V8.00.000.2025.06.17 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
2025-10-08 20:40:19 +01:00

466 lines
16 KiB
YAML
Raw Blame History

# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
recipe:
guben0afx256r: # g=GPT || m=MBR
# u=UEFI || b=BIOS
# b=btrfs || 4=ext4 only
# e=ephemeral "/tmp" and "SWAP" || n=non-ephemeral "/tmp" and "SWAP" (yet not supported)
# n0=non RAID || m6=mdadm RAID6 || m5=mdadm RAID5 || b1=btrfs RAID1 (yet not supported)
# a="/dev/sda" only setup || b="/dev/sdb" || c="/dev/sdc" and so forth
# f=fixed size || a=automatic size (yet not supported)
# x256=size of device in GiB
# r=rescue partition || n=no rescue partition
#######################################
# EFI System Partition | EF00 | UEFI Bootloader (ESP, FAT32) | filesystem.version: fat32
# BIOS Boot Partition | EF02 | BIOS Bootloader area (GRUB) | filesystem.version: BIOS
# Linux SWAP | 8200 | Linux Swap | filesystem.version: SWAP
# Linux ext4/btrfs | 8300 | Linux Filesystem (root, home)| filesystem.version: ext4 || btrfs
#######################################
active: true # Choose this recipe.
control:
description: "CISS 2025 - GPT - BTRFS - Ephemeral - non RAID - 256GiB - rescue"
firmware: "UEFI" # MUST be "UEFI" for "gpt" || "BIOS":
id: "guben0afx256r" # MUST be equal to the second part of the recipe-variables string.
kdf:
threads: 1 # Set the parallel cost for PBKDF (number of threads, up to 4).
time: 256 # The number of milliseconds to spend with PBKDF passphrase processing.
luks_backup: true # Specify if LUKS Header backups should be created. If so, provide an external backup URL:
# luks_backup_url: "https://cloud.e2ee.li/" or leave empty for local backup.
# Also provide the cloud access token and access passwords via ./.preseed/password_luks_backup.txt
# Yet Nextcloud only is supported.
luks_backup_url: "https://cloud.e2ee.li/"
name: "ciss.2025.gpt.btrfs.ephemeral.non-raid.256GiB.rescue"
nuke: true # Activates Nuke-Mechanism in '/etc/crypttab' keyscript and via dropbear SSH forced command.
nuke_rounds: 16384 # SHA512 KDF Rounds for Nuke Passphrase. If omitted, the default value is '8,388,608'.
raid: # mdadm RAID settings only (not yet supported).
enable: false
disks:
member: 4
spare: 1
level: 6 # Only Level "1", "5", "6" and "10" are supported.
meta: 1.2 # Metadata Format. Default to '1.2'.
recovery: false # MUST be "true" for recovery partition in use.
table: "gpt" # MUST be "gpt" for "UEFI" || "msdos":
syntax: true # This is set to "false" by default, otherwise if the recipe is tested by the authors to "true".
### Version of the specific recipe.
version: "1.3.0"
dev:
sda:
1: # MUST be always 'ESP' for [UEFI|GPT] or 'BIOS' for [BIOS|GPT].
begin: "min"
end: "1024MiB"
bootable: false
encryption:
enable: false # MUST be "false" for "/boot/efi"
ephemeral: false # MUST be "false" for "/boot/efi"
integrity: false # MUST be "false" for "/boot/efi"
cipher: ""
hash: ""
key: ""
keyslotssize: ""
metadatasize: ""
pbkdf: ""
rng: ""
filesystem:
btrfs:
checksum: ""
compress: ""
level: ""
mdup: ""
snapshot: false
format: true
options: ""
version: "fat32"
mount:
enable: true # MUST be "true" for "/boot/efi"
options: "umask=0077,uid=0,gid=0"
optsnap: ""
path: "/boot/efi"
primary: primary
2:
begin: "1024MiB"
end: "3GiB"
bootable: false
encryption:
enable: true
ephemeral: false # MUST be "false" for "/boot"
integrity: false # MUST be "false" for "/boot"
cipher: "aes-xts-plain64"
hash: "sha512"
key: "512"
keyslotssize: "32M"
metadatasize: "4096k"
pbkdf: "pbkdf2" # MUST be "pbkdf2" for "/boot"
rng: "use-random"
filesystem:
btrfs:
checksum: "sha256"
compress: "zstd"
level: "0"
mdup: true
snapshot: false
format: true
version: "btrfs"
options: ""
mount:
enable: true
options: "nodev,nosuid,noexec,noatime,compress=no,discard=async"
optsnap: ""
path: "/boot"
primary: primary
3:
begin: "3GiB"
end: "10GiB"
bootable: false
encryption:
enable: true
ephemeral: false
integrity: false
cipher: "aes-xts-plain64"
hash: "sha512"
key: "512"
keyslotssize: "32M"
metadatasize: "4096k"
pbkdf: "argon2id"
rng: "use-random"
filesystem:
btrfs:
checksum: ""
compress: ""
level: ""
mdup: ""
snapshot: false
format: true
label: "ext4_rescue"
options: ""
version: "ext4"
mount:
enable: true
options: "defaults,nodev"
optsnap: ""
path: "/recovery"
primary: primary
4:
begin: "10GiB"
end: "14GiB"
bootable: false
encryption:
enable: true # MUST be "true" for ephemeral "SWAP"
ephemeral: true # MUST be "true" for ephemeral "SWAP"
integrity: false # MUST be "false" for ephemeral "SWAP"
cipher: "aes-xts-plain64"
hash: "sha512"
key: "512"
keyslotssize: "32M"
metadatasize: "4096k"
pbkdf: "argon2id"
rng: "use-random"
filesystem:
btrfs:
checksum: ""
compress: ""
level: ""
mdup: ""
snapshot: false
format: true
label: "host_swap"
options: ""
version: "ext4"
mount:
enable: true
options: "defaults,discard"
optsnap: ""
path: "SWAP"
primary: primary
5:
begin: "14GiB"
end: "18GiB"
bootable: false
encryption:
enable: true # MUST be "true" for ephemeral "/tmp"
ephemeral: true # MUST be "true" for ephemeral "/tmp"
integrity: false # MUST be "false" for ephemeral "/tmp"
cipher: "aes-xts-plain64"
hash: "sha512"
key: "512"
keyslotssize: "32M"
metadatasize: "4096k"
pbkdf: "argon2id"
rng: "use-random"
filesystem:
btrfs:
checksum: ""
compress: ""
level: ""
mdup: ""
snapshot: false
format: true
options: ""
version: "ext4"
mount:
enable: true
options: "defaults,rw,nodev,noexec,nosuid,noatime,discard"
optsnap: ""
path: "/tmp"
primary: primary
6:
begin: "18GiB"
end: "42GiB"
bootable: false
encryption:
enable: true
ephemeral: false
integrity: false
cipher: "aes-xts-plain64"
hash: "sha512"
key: "512"
keyslotssize: "32M"
metadatasize: "4096k"
pbkdf: "argon2id"
rng: "use-random"
filesystem:
btrfs:
checksum: "sha256"
compress: "zstd"
level: "7"
mdup: true
snapshot: true
format: true
options: ""
version: "btrfs"
mount:
enable: true
# btrfs: errors=continue
# ext4 : errors=remount-ro
options: "defaults,noatime,discard=async,autodefrag"
optsnap: "nodev,nosuid,noexec"
path: "/"
primary: primary
7:
begin: "42GiB"
end: "84GiB"
bootable: false
encryption:
enable: true
ephemeral: false
integrity: false
cipher: "aes-xts-plain64"
hash: "sha512"
key: "512"
keyslotssize: "32M"
metadatasize: "4096k"
pbkdf: "argon2id"
rng: "use-random"
filesystem:
btrfs:
checksum: "sha256"
compress: "zstd"
level: "7"
mdup: true
snapshot: true
format: true
options: ""
version: "btrfs"
mount:
enable: true
options: "defaults,nodev,nosuid,relatime,discard=async,autodefrag"
optsnap: "nodev,nosuid,noexec"
path: "/home"
primary: primary
8:
begin: "84GiB"
end: "126GiB"
bootable: false
encryption:
enable: true
ephemeral: false
integrity: false
cipher: "aes-xts-plain64"
hash: "sha512"
key: "512"
keyslotssize: "32M"
metadatasize: "4096k"
pbkdf: "argon2id"
rng: "use-random"
filesystem:
btrfs:
checksum: "sha256"
compress: "zstd"
level: "7"
mdup: true
snapshot: false
format: true
options: ""
version: "btrfs"
mount:
enable: true
options: "defaults,nodev,relatime,discard=async"
optsnap: ""
path: "/usr"
primary: primary
9:
begin: "126GiB"
end: "190GiB"
bootable: false
encryption:
enable: true
ephemeral: false
integrity: false
cipher: "aes-xts-plain64"
hash: "sha512"
key: "512"
keyslotssize: "32M"
metadatasize: "4096k"
pbkdf: "argon2id"
rng: "use-random"
filesystem:
btrfs:
checksum: "sha256"
compress: "zstd"
level: "7"
mdup: true
snapshot: true
format: true
options: ""
version: "btrfs"
mount:
enable: true
options: "defaults,nodev,nosuid,relatime,discard=async"
optsnap: "nodev,nosuid,noexec"
path: "/var"
primary: primary
10:
begin: "190GiB"
end: "206GiB"
bootable: false
encryption:
enable: true
ephemeral: false
integrity: false
cipher: "aes-xts-plain64"
hash: "sha512"
key: "512"
keyslotssize: "32M"
metadatasize: "4096k"
pbkdf: "argon2id"
rng: "use-random"
filesystem:
btrfs:
checksum: "sha256"
compress: "zstd"
level: "7"
mdup: true
snapshot: false
format: true
options: ""
version: "btrfs"
mount:
enable: true
options: "defaults,nodev,nosuid,noexec,noatime,discard=async"
optsnap: ""
path: "/var/log"
primary: primary
11:
begin: "206GiB"
end: "222GiB"
bootable: false
encryption:
enable: true
ephemeral: false
integrity: false
cipher: "aes-xts-plain64"
hash: "sha512"
key: "512"
keyslotssize: "32M"
metadatasize: "4096k"
pbkdf: "argon2id"
rng: "use-random"
filesystem:
btrfs:
checksum: "sha256"
compress: "zstd"
level: "7"
mdup: true
snapshot: false
format: true
options: ""
version: "btrfs"
mount:
enable: true
options: "defaults,nodev,nosuid,noexec,noatime,discard=async"
optsnap: ""
path: "/var/log/audit"
primary: primary
12:
begin: "222GiB"
end: "238GiB"
bootable: false
encryption:
enable: true
ephemeral: false
integrity: false
cipher: "aes-xts-plain64"
hash: "sha512"
key: "512"
keyslotssize: "32M"
metadatasize: "4096k"
pbkdf: "argon2id"
rng: "use-random"
filesystem:
btrfs:
checksum: "sha256"
compress: "zstd"
level: "7"
mdup: true
snapshot: false
format: true
options: ""
version: "btrfs"
mount:
enable: true
options: "defaults,nodev,nosuid,noatime,discard=async"
optsnap: ""
path: "/var/tmp"
primary: primary
13:
begin: "238GiB"
end: "max" # The last 16 MiB will be reserved for GPT metadata.
bootable: false
encryption:
enable: true
ephemeral: false
integrity: false
cipher: "aes-xts-plain64"
hash: "sha512"
key: "512"
keyslotssize: "32M"
metadatasize: "4096k"
pbkdf: "argon2id"
rng: "use-random"
filesystem:
btrfs:
checksum: "sha256"
compress: "zstd"
level: "7"
mdup: true
snapshot: false
format: true
options: ""
version: "btrfs"
mount:
enable: true
options: "defaults,nodev,nosuid,relatime,discard=async"
optsnap: ""
path: "/opt"
primary: primary
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml
Reference in New Issue View Git Blame Copy Permalink