Hi Jim,
I’m always a big fan of Infrastructure As Code (IAC)
To avoid a lot of clicking and possible mistakes I always deploy my fedora installations with kickstart.
- finegrained control of partitions and drives
- all encrypted with luks2
- finegrained control of which packages are installed
- no complex error prone manual actions
cons:
- need to manually reset luks password on both drives because of plaintext password
- manually reset passwords for user and root because of plaintext password/hash
Which is actually rather simple to do and requires only a ks.cfg file on an additional usb drive with the label ‘OEMDRV’
place the file ks.cfg in the root of the usb-drive with the label OEMDRV
use the fedora server installation media (because it wont work with the gnome workstation media)
ensure the OEMDRV usb stick is in the laptop.
ensure you boot from the fedora server installation media (usually another usb stick )
This kickstart will wipe all your drives!!!
ks.cfg:
# Use network installation
# network is required, because the server dvd does not containe the workstation environment
url --mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=fedora-44&arch=x86_64
repo --name="updates" --mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=updates-released-f44&arch=x86_64
# use cdrom installation
# cdrom
# Use Text install
# graphical
text
# Do Not Run the Setup Agent on first boot
firstboot --disable
# Keyboard layouts
keyboard --vckeymap=us --xlayouts='us'
# System language
lang en_US.UTF-8
# accept eula
eula --agreed
# reboot after installation
reboot
# poweroff
# System authorization information
authselect enable-feature with-fingerprint
# Network information
network --bootproto=dhcp --ipv6=auto --activate --device=bootif
network --hostname=laptop.example.com
# Services to explicitly enable (use --disable to disable)
services --enable=sshd
# Root password, remove '--allow-ssh' if you don't want remote root access
# The --iscrypted option is debateable as it puts the hash in plain text here which is not secure.
# Just make sure first thing you do is change the password
rootpw --plaintext --allow-ssh secret
# root authorized key
sshkey --username=root 'ssh-rsa xxxxxxxxxxxxxx'
# Your user account
# Again, reset the password after installation is done.
user --groups=wheel --name=myname --gecos="myname" --plaintext --password=secret
# System timezone
timezone Europe/Amsterdam --utc
# Partition clearing information
clearpart --all --initlabel --drives=nvme0n1,sda
# Clear the Master Boot Record
zerombr
# Bootloader configuration
bootloader --location=mbr --boot-drive=nvme0n1
# Anaconda does not support encryption of the luks password, so make sure you reset it after the install
# Disk auto partitioning information
# autopart --type=btrfs --hibernation --encrypted --passphrase=secret
# Disk manual partitioning information
part btrfs.1 --fstype="btrfs" --size=1 --grow --encrypted --luks-version=luks2 --passphrase=secret --ondisk=nvme0n1
part btrfs.2 --fstype="btrfs" --size=1 --grow --encrypted --luks-version=luks2 --passphrase=secret --ondisk=sda
btrfs none --label=fedora btrfs.1 btrfs.2
btrfs / --subvol --name=root LABEL=fedora
btrfs /home --subvol --name=home LABEL=fedora
# efi boot partitiions
part /boot --fstype="ext4" --size=1024 --ondisk=nvme0n1
part /boot/efi --fstype="efi" --size=600 --fsoptions="umask=0077,shortname=winnt" --ondisk=nvme0n1
# swap
# The hibernation option creates a larger swap partition to facilitate hybernating
# Usually it's best to store the swap partition on the fastest drive
part swap --hibernation --ondisk=nvme0n1
%packages
@workstation-product
%end
%post
cd /etc/systemd/system
ln -sf /usr/lib/systemd/system/graphical.target default.target
%end