2023年8月15日 星期二

git repo migraton

 git clone <source_repo> <folder>

cd <folder>

git remote set-url origin <new_repo>

git push --all

git push --tags

or

git clone --mirror <source_repo>

git push --mirror <dest_repo>

2023年7月4日 星期二

encrypt disk using tpm

#!/bin/sh
mdadm --stop /dev/md125
mdadm --stop /dev/md126
mdadm --stop /dev/md127
mdadm --zero-superblock /dev/nvme0n1p1
mdadm --zero-superblock /dev/nvme0n1p2
mdadm --zero-superblock /dev/nvme1n1p1
mdadm --zero-superblock /dev/nvme1n1p2

sgdisk -Z /dev/nvme0n1
sgdisk -n 1::1024MiB /dev/nvme0n1
sgdisk -n 2:: /dev/nvme0n1
sgdisk -Z /dev/nvme1n1
sleep 5
for i in {1..5};do
  partprobe /dev/nvme0n1
  partprobe /dev/nvme1n1
  sleep 1
done
cat << EOF >/etc/yum.repos.d/local.repo
[BaseOS]
name=BaseOS
enabled=1
gpgcheck=0
baseurl=file:///run/install/repo/BaseOS
[AppStream]
enabled=1
gpgcheck=0
baseurl=file:///run/install/repo/AppStream
EOF
dnf install -y clevis clevis-dracut clevis-luks clevis-systemd clevis-udisks2 tpm-tools tpm2-tools >/dev/null 2>&1

mkfs.vfat -i 72D5B376 -n boot /dev/nvme0n1p1
echo "callmedaddy"|cryptsetup -q luksFormat /dev/nvme0n1p2 --uuid=2503da23-fdce-47c1-8f55-d1608edfb532
cryptsetup luksOpen /dev/nvme0n1p2 root <<< 'callmedaddy'
mkfs.xfs -f -m uuid=ced49972-bd15-400b-b130-babc43008ec0 -L rootfs /dev/mapper/root
sleep 5
mkdir /dev/shm/boot
mkdir /dev/shm/root
umount /dev/shm/boot
umount /dev/shm/root
mount -L boot /dev/shm/boot
mount -L rootfs /dev/shm/root
curl http://deploy.kido.idv.tw/encryt_disk/boot.tar.gz|tar zxf - -C /dev/shm/boot
curl http://deploy.kido.idv.tw/encryt_disk/root.tar.gz|tar zxf - -C /dev/shm/root
sync
tpm2_dictionarylockout -c
clevis luks bind -d /dev/nvme0n1p2 tpm2 '{"pcr_bank":"sha1","pcr_ids":"0,7"}' <<< 'callmedaddy'

manually create Linux software raid system

1: stop md 
mdadm --stop /dev/md124

2: zap disk
sgdisk -Z /dev/sda

3: creat partition
sgdisk -n 1::1024MiB /dev/sda
sgdisk -n 2:: /dev/sda

4: update partition information
partprobe /dev/sda

5: zero-superbolock
mdadm --zero-superblock /dev/sda1

6: create sw raid -> use metadata 1.2 for data, 0.9 for boot
echo yes| mdadm --create /dev/md127 --force --level=1 --raid-devices=2 --name=root--uuid=1f975454:e7eb215d:e5a8a80e:43d5a964 --metadata=1.2 /dev/sda2 /dev/sdb2
echo yes| mdadm --create /dev/md/boot --force --level=1 --raid-devices=2 --uuid=2fd35b47:0866ab39:7a1ebdb9:dcc7dd0f --metadata=0.90 --name=boot-efi /dev/sda1 /dev/sdb1

7: wait resync to be ready
while [ 1 ];do
  sts_resync=$(cat /proc/mdstat|grep resync|wc -l)
  if [ $sts_resync -ne 0 ];then
    echo "syncing"
  else
    echo "rsync ready"
    break
  fi
  sleep 5
done