sandwich/Ansible-Bootstrap
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Normalize LUKS boot layout and partitioning defaults

Browse Source
This commit is contained in:
Sandwich
2025-12-28 16:00:49 +01:00
parent 2be6117aac
commit cc77f646d7
6 changed files with 196 additions and 91 deletions
Download Patch File Download Diff File Expand all files Collapse all files

133
roles/partitioning/tasks/main.yml
View File

@@ -1,46 +1,8 @@
---
- name: Set partitioning defaults
ansible.builtin.set_fact:
partitioning_luks_enabled: "{{ partitioning_luks_enabled | default(luks_enabled | default(false)) | bool }}"
partitioning_luks_mapper_name: "{{ partitioning_luks_mapper_name | default(luks_mapper_name | default('SYSTEM_DECRYPTED')) }}"
partitioning_luks_type: "{{ partitioning_luks_type | default(luks_type | default('luks2')) }}"
partitioning_luks_cipher: "{{ partitioning_luks_cipher | default(luks_cipher | default('aes-xts-plain64')) }}"
partitioning_luks_hash: "{{ partitioning_luks_hash | default(luks_hash | default('sha512')) }}"
partitioning_luks_iter_time: "{{ partitioning_luks_iter_time | default(luks_iter_time | default(4000)) }}"
partitioning_luks_key_size: "{{ partitioning_luks_key_size | default(luks_key_size | default(512)) }}"
partitioning_luks_pbkdf: "{{ partitioning_luks_pbkdf | default(luks_pbkdf | default('argon2id')) }}"
partitioning_luks_use_urandom: "{{ partitioning_luks_use_urandom | default(luks_use_urandom | default(true)) | bool }}"
partitioning_luks_verify_passphrase: "{{ partitioning_luks_verify_passphrase | default(luks_verify_passphrase | default(true)) | bool }}"
partitioning_luks_auto_decrypt: "{{ partitioning_luks_auto_decrypt | default(luks_auto_decrypt | default(true)) | bool }}"
partitioning_luks_auto_decrypt_method: "{{ partitioning_luks_auto_decrypt_method | default(luks_auto_decrypt_method | default('tpm2')) }}"
partitioning_luks_tpm2_device: "{{ partitioning_luks_tpm2_device | default(luks_tpm2_device | default('auto')) }}"
partitioning_luks_tpm2_pcrs: "{{ partitioning_luks_tpm2_pcrs | default(luks_tpm2_pcrs | default('')) }}"
partitioning_luks_keyfile_size: "{{ partitioning_luks_keyfile_size | default(luks_keyfile_size | default(64)) }}"
partitioning_luks_options: "{{ partitioning_luks_options | default(luks_options | default('discard,tries=3')) }}"
partitioning_luks_device: >-
{{ install_drive ~ (partitioning_main_partition_suffix | string) }}
- name: Set partitioning root device
ansible.builtin.set_fact:
partitioning_root_device: >-
{{
'/dev/mapper/' + partitioning_luks_mapper_name
if partitioning_luks_enabled | bool
else install_drive ~ (partitioning_main_partition_suffix | string)
}}
- name: Set partitioning vm_size from input
when: vm_size is defined or partitioning_vm_size is defined
ansible.builtin.set_fact:
partitioning_vm_size: "{{ (partitioning_vm_size | default(vm_size)) | float }}"
- name: Set partitioning vm memory from input
when: vm_memory is defined or partitioning_vm_memory is defined
ansible.builtin.set_fact:
partitioning_vm_memory: "{{ (partitioning_vm_memory | default(vm_memory)) | float }}"
- name: Detect system memory for swap sizing
when: partitioning_vm_memory is not defined
when:
- partitioning_vm_memory is not defined
- vm_memory is not defined
block:
- name: Read system memory
ansible.builtin.command: awk '/MemTotal/ {print int($2/1024)}' /proc/meminfo
@@ -52,21 +14,11 @@
ansible.builtin.set_fact:
partitioning_vm_memory: "{{ (partitioning_memtotal_mb.stdout | default('4096') | int) | float }}"
- name: Calculate swap size
ansible.builtin.set_fact:
partitioning_swap_size_gb: >-
{{
((partitioning_vm_memory | float / 1024) >= 16.0)
| ternary(
(partitioning_vm_memory | float / 2048) | int,
[partitioning_vm_memory | float / 1024, 4.0] | max | int
)
}}
- name: Set partitioning vm_size for physical installs
when:
- install_type == "physical"
- partitioning_vm_size is not defined
- vm_size is not defined
- install_drive is defined
block:
- name: Detect install drive size
@@ -168,9 +120,7 @@
name: "{{ item.name }}"
flags: "{{ item.flags | default(omit) }}"
state: present
loop:
- {number: 1, part_end: 500MiB, name: boot, flags: [boot, esp]}
- {number: 2, part_start: 500MiB, name: root}
loop: "{{ partitioning_layout }}"
rescue:
- name: Refresh kernel partition table after failure
ansible.builtin.command: "{{ item }}"
@@ -192,9 +142,7 @@
name: "{{ item.name }}"
flags: "{{ item.flags | default(omit) }}"
state: present
loop:
- {number: 1, part_end: 500MiB, name: boot, flags: [boot, esp]}
- {number: 2, part_start: 500MiB, name: root}
loop: "{{ partitioning_layout }}"
- name: Settle partition table
ansible.builtin.command: "{{ item }}"
@@ -318,28 +266,28 @@
loop:
- lv: root
size: >-
{{ [(((((partitioning_vm_size | float) - 0.5 - ((cis | bool) | ternary(7.5, 0)) - (((partitioning_vm_memory | float / 1024) > 16.0)
| ternary(((partitioning_vm_memory | float / 2048) | int), (partitioning_vm_memory | float / 1024)))) < 4)
| ternary(4,((((partitioning_vm_size | float) - 0.5 - ((cis | bool) | ternary(7.5, 0)) -
(((partitioning_vm_memory | float / 1024) > 16.0)
{{ [(((((partitioning_vm_size_effective | float) - (partitioning_reserved_gb | float) - ((cis | bool) | ternary(7.5, 0)) - (((partitioning_vm_memory_effective | float / 1024) > 16.0)
| ternary(((partitioning_vm_memory_effective | float / 2048) | int), (partitioning_vm_memory_effective | float / 1024)))) < 4)
| ternary(4,((((partitioning_vm_size_effective | float) - (partitioning_reserved_gb | float) - ((cis | bool) | ternary(7.5, 0)) -
(((partitioning_vm_memory_effective | float / 1024) > 16.0)
| ternary(
((partitioning_vm_memory | float / 2048) | int),
(partitioning_vm_memory | float / 1024)
((partitioning_vm_memory_effective | float / 2048) | int),
(partitioning_vm_memory_effective | float / 1024)
)))
> 12)
| ternary(((partitioning_vm_size | float) * 0.4) | round(0, 'ceil'),((partitioning_vm_size | float) - 0.5 - ((cis | bool)
| ternary(7.5, 0)) - (((partitioning_vm_memory | float / 1024) > 16.0)
| ternary(((partitioning_vm_memory | float / 2048) | int), (partitioning_vm_memory | float / 1024))))))))), 4 ] | max | string +
| ternary(((partitioning_vm_size_effective | float) * 0.4) | round(0, 'ceil'),((partitioning_vm_size_effective | float) - (partitioning_reserved_gb | float) - ((cis | bool)
| ternary(7.5, 0)) - (((partitioning_vm_memory_effective | float / 1024) > 16.0)
| ternary(((partitioning_vm_memory_effective | float / 2048) | int), (partitioning_vm_memory_effective | float / 1024))))))))), 4 ] | max | string +
'G' }}
- lv: swap
size: >-
{{ ((((partitioning_vm_size | float) - 0.5 - ((cis | bool) | ternary(7.5, 0))) - (((partitioning_vm_memory | float / 1024) > 16.0)
| ternary(((partitioning_vm_memory | float / 2048) | int), (partitioning_vm_memory | float / 1024)))) < 4)
| ternary((((partitioning_vm_size | float) - 0.5 - ((cis | bool) | ternary(7.5, 0))) - 4), (((partitioning_vm_memory | float / 1024)
{{ ((((partitioning_vm_size_effective | float) - (partitioning_reserved_gb | float) - ((cis | bool) | ternary(7.5, 0))) - (((partitioning_vm_memory_effective | float / 1024) > 16.0)
| ternary(((partitioning_vm_memory_effective | float / 2048) | int), (partitioning_vm_memory_effective | float / 1024)))) < 4)
| ternary((((partitioning_vm_size_effective | float) - (partitioning_reserved_gb | float) - ((cis | bool) | ternary(7.5, 0))) - 4), (((partitioning_vm_memory_effective | float / 1024)
> 16.0)
| ternary(((partitioning_vm_memory | float / 2048) | int), (partitioning_vm_memory | float / 1024)))) | string + 'G' }}
| ternary(((partitioning_vm_memory_effective | float / 2048) | int), (partitioning_vm_memory_effective | float / 1024)))) | string + 'G' }}
- lv: home
size: "{{ ([([(((partitioning_vm_size | float) - 20) * 0.1), 2] | max), 20] | min) | string + 'G' }}"
size: "{{ ([([(((partitioning_vm_size_effective | float) - 20) * 0.1), 2] | max), 20] | min) | string + 'G' }}"
- {lv: var, size: "2G"}
- {lv: var_log, size: "2G"}
- {lv: var_log_audit, size: "1.5G"}
@@ -353,6 +301,24 @@
opts: -F32 -n BOOT
force: true
- name: Create filesystem for /boot partition
when: partitioning_separate_boot | bool
community.general.filesystem:
dev: "{{ install_drive }}{{ partitioning_boot_fs_partition_suffix }}"
fstype: "{{ partitioning_boot_fs_fstype }}"
force: true
- name: Remove unsupported ext4 features from /boot
when:
- partitioning_separate_boot | bool
- partitioning_boot_fs_fstype == 'ext4'
- os | lower in ['almalinux', 'debian11', 'rhel8', 'rhel9', 'rocky']
ansible.builtin.command: >-
tune2fs -O "^orphan_file,^metadata_csum_seed"
"{{ install_drive }}{{ partitioning_boot_fs_partition_suffix }}"
register: partitioning_boot_ext4_tune_result
changed_when: partitioning_boot_ext4_tune_result.rc == 0
- name: Create swap filesystem
when: filesystem != 'btrfs'
community.general.filesystem:
@@ -367,6 +333,13 @@
register: partitioning_boot_uuid
changed_when: false
- name: Get UUID for /boot filesystem
when: partitioning_separate_boot | bool
ansible.builtin.command: >-
blkid -s UUID -o value '{{ install_drive }}{{ partitioning_boot_fs_partition_suffix }}'
register: partitioning_boot_fs_uuid
changed_when: false
- name: Get UUID for main filesystem
ansible.builtin.command: blkid -s UUID -o value '{{ partitioning_root_device }}'
register: partitioning_main_uuid
@@ -490,14 +463,18 @@
] | join(',')
}}
- name: Mount /boot filesystem
when: partitioning_separate_boot | bool
ansible.posix.mount:
path: /mnt/boot
src: "UUID={{ partitioning_boot_fs_uuid.stdout }}"
fstype: "{{ partitioning_boot_fs_fstype }}"
opts: defaults
state: mounted
- name: Mount boot filesystem
ansible.posix.mount:
path: >-
{{
'/mnt/boot/efi'
if (is_rhel | default(false)) or (os | lower in ['ubuntu', 'ubuntu-lts'])
else '/mnt/boot'
}}
path: "/mnt{{ partitioning_efi_mountpoint }}"
src: UUID={{ partitioning_boot_uuid.stdout }}
fstype: vfat
state: mounted