Login
ergosteur

ergosteur / Debian Preseed for MCP Control

Last active 1 month ago

Like 0

Debian 13 (trixie) unattended netinst preseed Generic base-OS bootstrap — gets a blank VM to "Debian installed, SSH + sudo reachable" so provision-satellite.sh can take over from there. Not satellite-specific beyond that; hostname/domain are passed as separate boot params (hostname=... domain=...), not hardcoded here, so this file is reusable for any future from-scratch rebuild. Usage: serve this file over HTTP reachable from the VM's network, then at the installer's boot menu (Tab to edit on isolinux/BIOS boot): auto=true priority=critical url=http://<host>:<port>/debian-preseed.cfg hostname=<name> domain=<domain> See ../provision-satellite.sh and ../docs/ for the rest of the setup this hands off to.

debian install linux mcp preseed vnc

ergosteur revised this gist 1 month ago · b4ccd21

1 file changed, 28 insertions, 16 deletions

debian-preseed.cfg
@@ -8,9 +8,6 @@
8 8 #### Usage: serve this file over HTTP reachable from the VM's network, then
9 9 #### at the installer's boot menu (Tab to edit on isolinux/BIOS boot):
10 10 #### auto=true priority=critical url=http://<host>:<port>/debian-preseed.cfg hostname=<name> domain=<domain>
11 - ####
12 - #### See ../provision-satellite.sh and ../docs/ for the rest of the setup
13 - #### this hands off to.
14 11
15 12 ### Localization
16 13 d-i debian-installer/locale string en_CA.UTF-8
@@ -34,19 +31,17 @@ d-i time/zone string America/Toronto
34 31 d-i clock-setup/ntp boolean true
35 32
36 33 ### Account setup — normal user only, root login disabled (sudo instead).
37 - ### Password is a KNOWN TEMPORARY VALUE, not a secret — rotate/remove once
38 - ### provision-satellite.sh's SSH key step confirms key-only access works.
34 + ### Initial password is a dummy placeholder, overwritten in late_command to preseed-<MAC>.
39 35 d-i passwd/root-login boolean false
40 - d-i passwd/user-fullname string evie
41 - d-i passwd/username string evie
36 + d-i passwd/user-fullname string debian
37 + d-i passwd/username string debian
42 38 d-i passwd/user-password password bootstrap-temp-pw
43 39 d-i passwd/user-password-again password bootstrap-temp-pw
44 40 d-i user-setup/allow-password-weak boolean true
45 41 d-i passwd/user-default-groups string sudo
46 42
47 - ### Partitioning — single disk, guided, no LVM (simple automation-box disk,
48 - ### provision-satellite.sh doesn't expect or need LVM).
49 - d-i partman-auto/disk string /dev/sda
43 + ### Partitioning — dynamic first disk selection, guided layout, UEFI & BIOS safe
44 + d-i partman/early_command string debconf-set partman-auto/disk "$(list-devices disk | head -n1)"
50 45 d-i partman-auto/method string regular
51 46 d-i partman-auto/choose_recipe select atomic
52 47 d-i partman-partitioning/confirm_write_new_label boolean true
@@ -54,17 +49,34 @@ d-i partman/choose_partition select finish
54 49 d-i partman/confirm boolean true
55 50 d-i partman/confirm_nooverwrite boolean true
56 51
57 - ### Package selection — minimal + SSH only. Desktop/XFCE/automation tooling
58 - ### all comes from provision-satellite.sh step 2 onward — don't duplicate.
52 + ### Package selection — minimal + SSH only + ca-certificates for HTTPS key fetch
59 53 tasksel tasksel/first multiselect standard, ssh-server
60 - d-i pkgsel/include string sudo
54 + d-i pkgsel/include string sudo ca-certificates
61 55 d-i pkgsel/upgrade select safe-upgrade
62 56 popularity-contest popularity-contest/participate boolean false
63 57
64 - ### Boot loader
58 + ### Boot loader — dynamic device target for BIOS (MBR) and UEFI
65 59 d-i grub-installer/only_debian boolean true
66 - d-i grub-installer/bootdev string /dev/sda
60 + d-i grub-installer/with_other_os boolean true
61 + d-i grub-installer/bootdev string default
62 +
63 + ### Post-install setup — MAC fallback hostname, MAC password, and SSH key pull
64 + d-i preseed/late_command string \
65 + MAC=$(ip link | awk '/ether/ {print $2; exit}'); \
66 + HN=$(cat /target/etc/hostname 2>/dev/null); \
67 + if [ "$HN" = "unassigned-hostname" ] || [ -z "$HN" ]; then \
68 + SHORT_MAC=$(echo "$MAC" | tr -d ':'); \
69 + HN="vm-${SHORT_MAC: -6}"; \
70 + echo "$HN" > /target/etc/hostname; \
71 + sed -i "s/unassigned-hostname/$HN/g" /target/etc/hosts; \
72 + fi; \
73 + in-target sh -c "echo debian:preseed-$MAC | chpasswd"; \
74 + in-target mkdir -p /home/debian/.ssh; \
75 + in-target wget -O /home/debian/.ssh/authorized_keys https://git.ergosteur.com/ergosteur.keys; \
76 + in-target chown -R debian:debian /home/debian/.ssh; \
77 + in-target chmod 700 /home/debian/.ssh; \
78 + in-target chmod 600 /home/debian/.ssh/authorized_keys
67 79
68 80 ### Finish installation
69 81 d-i finish-install/reboot_in_progress note
70 - d-i cdrom-detect/eject boolean true
82 + d-i cdrom-detect/eject boolean true

ergosteur revised this gist 1 month ago · 3af4602

1 file changed, 70 insertions

debian-preseed.cfg (file created)
@@ -0,0 +1,70 @@
1 + #### Debian 13 (trixie) unattended netinst preseed
2 + #### Generic base-OS bootstrap — gets a blank VM to "Debian installed, SSH +
3 + #### sudo reachable" so provision-satellite.sh can take over from there.
4 + #### Not satellite-specific beyond that; hostname/domain are passed as
5 + #### separate boot params (hostname=... domain=...), not hardcoded here, so
6 + #### this file is reusable for any future from-scratch rebuild.
7 + ####
8 + #### Usage: serve this file over HTTP reachable from the VM's network, then
9 + #### at the installer's boot menu (Tab to edit on isolinux/BIOS boot):
10 + #### auto=true priority=critical url=http://<host>:<port>/debian-preseed.cfg hostname=<name> domain=<domain>
11 + ####
12 + #### See ../provision-satellite.sh and ../docs/ for the rest of the setup
13 + #### this hands off to.
14 +
15 + ### Localization
16 + d-i debian-installer/locale string en_CA.UTF-8
17 + d-i keyboard-configuration/xkb-keymap select us
18 +
19 + ### Network
20 + d-i netcfg/choose_interface select auto
21 + d-i netcfg/get_hostname string unassigned-hostname
22 + d-i netcfg/get_domain string unassigned-domain
23 + d-i netcfg/wireless_wep string
24 +
25 + ### Mirror
26 + d-i mirror/country string manual
27 + d-i mirror/http/hostname string deb.debian.org
28 + d-i mirror/http/directory string /debian
29 + d-i mirror/http/proxy string
30 +
31 + ### Clock and time zone
32 + d-i clock-setup/utc boolean true
33 + d-i time/zone string America/Toronto
34 + d-i clock-setup/ntp boolean true
35 +
36 + ### Account setup — normal user only, root login disabled (sudo instead).
37 + ### Password is a KNOWN TEMPORARY VALUE, not a secret — rotate/remove once
38 + ### provision-satellite.sh's SSH key step confirms key-only access works.
39 + d-i passwd/root-login boolean false
40 + d-i passwd/user-fullname string evie
41 + d-i passwd/username string evie
42 + d-i passwd/user-password password bootstrap-temp-pw
43 + d-i passwd/user-password-again password bootstrap-temp-pw
44 + d-i user-setup/allow-password-weak boolean true
45 + d-i passwd/user-default-groups string sudo
46 +
47 + ### Partitioning — single disk, guided, no LVM (simple automation-box disk,
48 + ### provision-satellite.sh doesn't expect or need LVM).
49 + d-i partman-auto/disk string /dev/sda
50 + d-i partman-auto/method string regular
51 + d-i partman-auto/choose_recipe select atomic
52 + d-i partman-partitioning/confirm_write_new_label boolean true
53 + d-i partman/choose_partition select finish
54 + d-i partman/confirm boolean true
55 + d-i partman/confirm_nooverwrite boolean true
56 +
57 + ### Package selection — minimal + SSH only. Desktop/XFCE/automation tooling
58 + ### all comes from provision-satellite.sh step 2 onward — don't duplicate.
59 + tasksel tasksel/first multiselect standard, ssh-server
60 + d-i pkgsel/include string sudo
61 + d-i pkgsel/upgrade select safe-upgrade
62 + popularity-contest popularity-contest/participate boolean false
63 +
64 + ### Boot loader
65 + d-i grub-installer/only_debian boolean true
66 + d-i grub-installer/bootdev string /dev/sda
67 +
68 + ### Finish installation
69 + d-i finish-install/reboot_in_progress note
70 + d-i cdrom-detect/eject boolean true