philpep's wiki

User Tools

Site Tools

Trace: • bare_metal_server_provisioning
proc:bare_metal_server_provisioning

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
proc:bare_metal_server_provisioning [2026/05/16 20:40] – [17. First boot and unlock] philproc:bare_metal_server_provisioning [2026/07/23 15:10] (current) – [18. (EXTRA) hugepage & swap configuration] phil
Line 7: Line 7:
   * RAID1 on two NVMe disks   * RAID1 on two NVMe disks
   * LVM on LUKS   * LVM on LUKS
-  * Boot UEFI with ESP on both disks+  * Boot UEFI **or** legacy/BIOS (auto-detected)
   * Remote cryptroot unlock with ''dropbear-initramfs''   * Remote cryptroot unlock with ''dropbear-initramfs''
  
Line 17: Line 17:
 <code> <code>
 nvme0n1 (419 Go)              nvme1n1 (419 Go) nvme0n1 (419 Go)              nvme1n1 (419 Go)
-├── p1 : 512 Mo ESP           ├── p1 : 512 Mo ESP (copy)+├── p1 : see note below       ├── p1 : see note below
 ├── p2 : 512 Mo ────┐         ├── p2 : 512 Mo ────┐ ├── p2 : 512 Mo ────┐         ├── p2 : 512 Mo ────┐
 │                   ├── md0 (RAID1) → /boot (ext4) │                   ├── md0 (RAID1) → /boot (ext4)
Line 24: Line 24:
                                                  ├── root (10 Go, ext4)                                                  ├── root (10 Go, ext4)
                                                  └── thin pool                                                  └── thin pool
 +
 +p1 depends on boot mode:
 +  * UEFI   : 512 Mo ESP (ef00, vfat, mounted /boot/efi), one per disk
 +  * legacy : 1 Mo BIOS boot partition (ef02, raw), one per disk
 </code> </code>
    
Line 31: Line 35:
 ==== 1. Boot in rescue mode ==== ==== 1. Boot in rescue mode ====
  
 + 
 +Detect the rescue boot mode once, everything downstream branches on $MODE.
 +The mode is imposed by the rescue boot (Hetzner PXE), not locally adjustable.
 +
 +<code bash>
 +$ if [ -d /sys/firmware/efi ]; then MODE=uefi; else MODE=legacy; fi
 +$ echo "Boot mode: $MODE"
 +</code>
    
 ==== 2. Disk setup ==== ==== 2. Disk setup ====
Line 49: Line 61:
    
 # GPT partitioning on both disks # GPT partitioning on both disks
 +# p1 differs by mode:
 +#   uefi   -> ESP       (ef00, 512M, vfat, mounted /boot/efi)
 +#   legacy -> BIOS boot (ef02, 1M, raw, used by grub-install)
 $ for D in /dev/nvme0n1 /dev/nvme1n1; do $ for D in /dev/nvme0n1 /dev/nvme1n1; do
-  sgdisk -n 1:0:+512M -t 1:ef00 -c 1:"EFI"       $D+  if [ "$MODE" = uefi ]; then 
 +    sgdisk -n 1:0:+512M -t 1:ef00 -c 1:"EFI"       $D 
 +  else 
 +    sgdisk -n 1:0:+1M   -t 1:ef02 -c 1:"BIOS boot" $D 
 +  fi
   sgdisk -n 2:0:+512M -t 2:fd00 -c 2:"boot RAID" $D   sgdisk -n 2:0:+512M -t 2:fd00 -c 2:"boot RAID" $D
   sgdisk -n 3:0:0     -t 3:fd00 -c 3:"luks RAID" $D   sgdisk -n 3:0:0     -t 3:fd00 -c 3:"luks RAID" $D
Line 98: Line 117:
    
 <code bash> <code bash>
-$ mkfs.vfat -F32 -n EFI0 /dev/nvme0n1p1 +# ESP only in UEFI mode; in legacy p1 is a raw BIOS boot partition (no fs) 
-$ mkfs.vfat -F32 -n EFI1 /dev/nvme1n1p1+$ if [ "$MODE" = uefi ]; then 
 +  mkfs.vfat -F32 -n EFI0 /dev/nvme0n1p1 
 +  mkfs.vfat -F32 -n EFI1 /dev/nvme1n1p1 
 +fi
 $ mkfs.ext4 -L boot /dev/md0 $ mkfs.ext4 -L boot /dev/md0
 $ mkfs.ext4 -L root /dev/vg0/root $ mkfs.ext4 -L root /dev/vg0/root
Line 106: Line 128:
 $ mkdir -p /mnt/boot $ mkdir -p /mnt/boot
 $ mount /dev/md0 /mnt/boot $ mount /dev/md0 /mnt/boot
-$ mkdir -p /mnt/boot/efi +$ if [ "$MODE" = uefi ]; then 
-$ mount /dev/nvme0n1p1 /mnt/boot/efi+  mkdir -p /mnt/boot/efi 
 +  mount /dev/nvme0n1p1 /mnt/boot/efi 
 +fi
 </code> </code>
    
Line 124: Line 148:
   mount --bind /$d /mnt/$d   mount --bind /$d /mnt/$d
 done done
-$ mount --bind /sys/firmware/efi/efivars /mnt/sys/firmware/efi/efivars+# efivars only exists (and is only needed) in UEFI mode 
 +$ if [ "$MODE" = uefi ]; then 
 +  mount --bind /sys/firmware/efi/efivars /mnt/sys/firmware/efi/efivars 
 +fi
 $ cp /etc/resolv.conf /mnt/etc/resolv.conf $ cp /etc/resolv.conf /mnt/etc/resolv.conf
    
Line 131: Line 158:
 $ blkid -s UUID -o value /dev/vg0/root     # ROOT_UUID $ blkid -s UUID -o value /dev/vg0/root     # ROOT_UUID
 $ blkid -s UUID -o value /dev/md1          # LUKS_UUID $ blkid -s UUID -o value /dev/md1          # LUKS_UUID
-$ blkid -s UUID -o value /dev/nvme0n1p1    # EFI0_UUID +# EFI UUIDs only relevant in UEFI mode: 
-$ blkid -s UUID -o value /dev/nvme1n1p1    # EFI1_UUID+$ if [ "$MODE" = uefi ]; then 
 +  blkid -s UUID -o value /dev/nvme0n1p1    # EFI0_UUID 
 +  blkid -s UUID -o value /dev/nvme1n1p1    # EFI1_UUID 
 +fi
    
 $ chroot /mnt /bin/bash $ chroot /mnt /bin/bash
Line 139: Line 169:
 ==== 9. Base configuration (in chroot) ==== ==== 9. Base configuration (in chroot) ====
  
 + 
 +Re-evaluate the mode inside the chroot (the rescue variable is not inherited).
 +/sys/firmware/efi is still visible here because /sys is bind-mounted from the
 +rescue, so the detection stays consistent with section 1.
 +
 +<code bash>
 +$ if [ -d /sys/firmware/efi ]; then MODE=uefi; else MODE=legacy; fi
 +</code>
    
 <code bash> <code bash>
 # Hostname # Hostname
 $ echo "schwartz" > /etc/hostname $ echo "schwartz" > /etc/hostname
-$ cat > /etc/hosts <<EOF +$ sed -i "2i 127.0.1.1\tschwartz" /etc/hosts
-127.0.0.1   localhost +
-127.0.1.1   schwartz +
-::1         localhost ip6-localhost ip6-loopback +
-ff02::1     ip6-allnodes +
-ff02::2     ip6-allrouters +
-EOF+
  
-  
 # Locales / timezone # Locales / timezone
 $ apt update && apt install -y locales $ apt update && apt install -y locales
Line 199: Line 230:
 UUID=$ROOT_UUID  /          ext4  defaults,noatime,errors=remount-ro  0  1 UUID=$ROOT_UUID  /          ext4  defaults,noatime,errors=remount-ro  0  1
 UUID=$BOOT_UUID  /boot      ext4  defaults                            0  2 UUID=$BOOT_UUID  /boot      ext4  defaults                            0  2
-UUID=$EFI0_UUID  /boot/efi  vfat  umask=0077,defaults                 0  2 
 EOF EOF
 +# ESP entry only in UEFI mode
 +$ if [ "$MODE" = uefi ]; then
 +  echo "UUID=$EFI0_UUID  /boot/efi  vfat  umask=0077,defaults  0  2" >> /etc/fstab
 +fi
    
 # mdadm.conf # mdadm.conf
Line 226: Line 260:
 </code> </code>
    
-==== 13. GRUB UEFI ====+==== 13. GRUB (UEFI or legacy) ====
  
    
 <code bash> <code bash>
-$ apt install -y grub-efi-amd64 efibootmgr 
-  
 $ echo 'GRUB_ENABLE_CRYPTODISK=y' >> /etc/default/grub $ echo 'GRUB_ENABLE_CRYPTODISK=y' >> /etc/default/grub
    
-$ grub-install --target=x86_64-efi \ +$ if [ "$MODE" = uefi ]; then 
-             --efi-directory=/boot/efi \ +  ## --- UEFI --- 
-             --bootloader-id=debian \ +  apt install -y grub-efi-amd64 efibootmgr 
-             --recheck + 
-  +  grub-install --target=x86_64-efi \ 
-$ update-grub +               --efi-directory=/boot/efi \ 
-  +               --bootloader-id=debian \ 
-# Sync ESP2 +               --recheck 
-$ mkdir -p /tmp/efi2 +  update-grub 
-$ mount /dev/nvme1n1p1 /tmp/efi2 + 
-$ cp -av /boot/efi/* /tmp/efi2/ +  # Sync ESP2 
-$ umount /tmp/efi2 +  mkdir -p /tmp/efi2 
-  +  mount /dev/nvme1n1p1 /tmp/efi2 
-# UEFI fallback for ESP2 +  cp -av /boot/efi/* /tmp/efi2/ 
-$ efibootmgr --create \ +  umount /tmp/efi2 
-  --disk /dev/nvme1n1 --part 1 \ + 
-  --label "debian-backup" \ +  # UEFI fallback for ESP2 
-  --loader '\EFI\debian\shimx64.efi' +  efibootmgr --create \ 
-  +    --disk /dev/nvme1n1 --part 1 \ 
-# Reorder to make debian (ESP1) as priority +    --label "debian-backup" \ 
-$ efibootmgr -o 000A,000B,0003,0006,0007,0004,0005,0000,0001,0002 +    --loader '\EFI\debian\shimx64.efi' 
-# (adapt IDs from `efibootmgr`)+ 
 +  # Reorder to make debian (ESP1) as priority 
 +  # efibootmgr -o 000A,000B,...   (adapt IDs from `efibootmgr`) 
 + 
 +else 
 +  ## --- legacy/BIOS --- 
 +  apt install -y grub-pc 
 + 
 +  # Install GRUB core into the BIOS boot partition (ef02) of BOTH disks 
 +  # for redundancy: if nvme0 fails, the machine still boots on nvme1. 
 +  grub-install --target=i386-pc --recheck /dev/nvme0n1 
 +  grub-install --target=i386-pc --recheck /dev/nvme1n1 
 +  update-grub 
 +fi
 </code> </code>
    
Line 293: Line 338:
 $ apt install -y dropbear-initramfs busybox $ apt install -y dropbear-initramfs busybox
    
-# Config dropbear : port 2222 and force cryptroot-unlock command+# Config dropbear : port 4222 and force cryptroot-unlock command
 $ cat > /etc/dropbear/initramfs/dropbear.conf <<'EOF' $ cat > /etc/dropbear/initramfs/dropbear.conf <<'EOF'
-DROPBEAR_OPTIONS="-p 2222 -s -j -k -I 60 -c cryptroot-unlock"+DROPBEAR_OPTIONS="-p 4222 -s -j -k -I 60 -c cryptroot-unlock"
 EOF EOF
    
Line 318: Line 363:
 $ exit  # exit chroot $ exit  # exit chroot
    
-$ umount /mnt/sys/firmware/efi/efivars +# $MODE from section 1 is still set in the rescue shell here 
-$ umount /mnt/boot/efi+$ if [ "$MODE" = uefi ]; then 
 +  umount /mnt/sys/firmware/efi/efivars 
 +  umount /mnt/boot/efi 
 +fi
 $ umount /mnt/boot $ umount /mnt/boot
 $ umount /mnt/run $ umount /mnt/run
Line 340: Line 388:
 <code bash> <code bash>
 # Wait dropbear to be up # Wait dropbear to be up
-nc -zv xx.xx.xx.xx 2222+nc -zv xx.xx.xx.xx 4222
    
 # remote unlocking oneliner: # remote unlocking oneliner:
-pass show luks/schwartz | tr -d '\n' | ssh -p 2222 root@xx.xx.xx.xx cryptroot-unlock+pass show luks/schwartz | tr -d '\n' | ssh -p 4222 root@xx.xx.xx.xx cryptroot-unlock
 </code> </code>
    
 After few seconds, normal SSD become available. After few seconds, normal SSD become available.
 +
 +==== 18. (EXTRA) hugepage & swap & LVM thin configuration ====
 +
 +<code bash>
 +sudo lvcreate -L 4G -n swap vg0
 +sudo mkswap /dev/vg0/swap
 +sudo swapon /dev/vg0/swap
 +echo "/dev/vg0/swap none swap sw 0 0" | sudo tee -a /etc/fstab
 +</code>
 +
 +If you want to configure hugepage for a qemu hypervisor:
 +
 +<code bash>
 +sudo tee /etc/sysctl.d/10-hugepages.conf > /dev/null <<'EOF'
 +vm.nr_hugepages = 13312 # EXAMPLE FOR 26GB/32GB
 +EOF
 +</code>
 +
 +LVM Thin initialization to store VM storage
 +
 +<code bash>
 +sudo lvcreate --type thin-pool -L 250G -n thin vg0
 +</code>
proc/bare_metal_server_provisioning.1778964048.txt.gz · Last modified: by phil