Alpine Linux - User contributions [en]

User:Jlo/Replacing Debian Jessie with Alpine remotely

2017-11-08T15:04:56Z

Jlo: /* Stage 1 */

I want to "upgrade" 200 remote Debian Jessie embedded boxes to AlpineLinux in ''run-from-ram'' mode.
I have already successfully and happily validated the second stage as this is a minor variation around the "setup-ownbox" script I have added to a standard PXE apkovl.
Those box are remotely sshable via openVPN. We need to keep network settings as is because some boxes have ad-hoc network config is restricted zones.

== Stage 0 ==

we need to prepare or a cache with reduced set of package or maybe some local repo with all needed packages needed for first stage and use that repo with no-cache option...

[[How_to_make_a_custom_ISO_image_with_mkimage]]

<pre>
sh mkimage.sh --tag 3.6.2 --outdir ~/iso --arch x86_64 --repository http://my.own.repo/alpine/v3.6/main --profile jessie
</pre>

<pre>
profile_jessie() {
profile_standard
title="AL debian"
desc="Packages included.
Suitable for Local install script."
apks="$apks openvpn wpa_supplicant wireless-tools"
#apks="$apks linux-firmware"
}
</pre>

==> '''alpine-jessie-3.6.2-x86_64.iso'''

== Stage 1 ==

prepare-jessie-for-alpine <pre>
#!/bin/sh
# this must be fully automatic
export DEBIAN_FRONTEND=noninteractive
apt-get -y install rsync extlinux
# /boot is a separate partition
rm -fr /boot/boot
ln -sf . /boot/boot
# let's get system file from our install server
cd /tmp
wget http://my.server.home/alpine/alpine-jessie-3.6.2-x86_64.iso
wget http://my.server.home/alpine/debian.apkovl.tar.gz
mount -o loop /tmp/alpine-jessie-3.6.2-x86_64.iso /mnt
rsync -a /mnt/ /boot/
sync
umount /mnt
# prepare the config overlay
rm -fr /tmp/apkovl
mkdir /tmp/apkovl
tar xzf /tmp/debian.apkovl.tar.gz -C /tmp/apkovl
# keep current active network connection(s) and identity
cp /etc/hostname /tmp/apkovl/etc/
cp /etc/network/interfaces /tmp/apkovl/etc/network/
cp -r /etc/openvpn /tmp/apkovl/etc/
cp -r /etc/ssh /tmp/apkovl/etc/
cd /tmp/apkovl
# be sure active VPN connections are preserved
mkdir -p /tmp/apkovl/etc/init.d
for v in /tmp/apkovl/etc/openvpn/*.conf ; do
vn=$(basename $v|cut -d. -f1)
ln -fs openvpn /tmp/apkovl/etc/init.d/openvpn.$vn
ln -fs /etc/init.d/openvpn.$vn /tmp/apkovl/etc/runlevels/default/openvpn.$vn
done
# config done ; commit
tar czf /boot/$(hostname).apkovl.tar.gz .
# now the booltoader ; this will kill the active grub...
cat > /boot/extlinux.conf << EOF
timeout 20
prompt 1
default hardened
label hardened
kernel /boot/vmlinuz-hardened
initrd /boot/initramfs-hardened
append alpine_dev=sda1:ext2 modloop=modloop-hardened modules=loop,cramfs,sd-mod,usb-storage,ext2 quiet
EOF
dd if=/usr/lib/syslinux/mbr/mbr.bin of=/dev/sda
extlinux -i /boot
# done
sync
reboot
</pre>

usage: <pre>~:# prepare-jessie-for-alpine</pre>

== Stage 2 ==

not tested yet in this procedure but used successfully (a small variant) to prepare new AL boxes.

setup-albox-from-debian <pre>
#!/bin/sh
BEGIN=$(date +%s)
name=$1
D=sda
echo "Manufacturing box named *${name}*..."
rc-service modloop stop
umount /media/${D}* || (echo "Unable to unmount ${D}. Aborting..." ; exit 1)
### Partition the SSD $D
# f2fs want partition of type ext2 in parted
parted -a cylinder -s /dev/${D} -- \
mklabel msdos \
mkpart primary fat32 0% 1% \
mkpart primary ext2 1% 2% \
mkpart primary ext2 2% 7% \
mkpart extended 7% 100% \
mkpart logical ext2 7% 9% \
mkpart logical ext2 9% 15% \
mkpart logical ext2 15% 20% \
mkpart logical ext2 21% 22% \
mkpart logical ext2 22% 23% \
mkpart logical ext2 23% 24% \
mkpart logical ext2 24% 25% \
mkpart logical ext2 25% 26% \
mkpart logical ext2 26% 27% \
mkpart logical ext2 27% 28% \
mkpart logical ext2 28% 29% \
mkpart logical ext2 29% 30% \
set 1 boot on \
|| exit 1
### prepare boot partition
mkfs.vfat /dev/${D}1 || exit 1
mkdir -p /media/${D}1
setup-bootable /media/${B} /dev/${D}1 || exit 1
mount -t vfat /dev/${D}1 /media/${D}1 || exit 1
### format partition to hold apkovl and apk/cache; it must be of ext? type
mkfs.ext4 -F -q /dev/${D}2 || exit 1
mkdir -p /media/${D}2
mount -t ext4 /dev/${D}2 /media/${D}2 || exit 1
### format remaining partitions with f2fs
for i in $(seq 3 16);do
[ $i -eq 4 ] && continue
mkfs.f2fs -q /dev/${D}$i || exit 1
mkdir -p /media/${D}$i
mount -t f2fs /dev/${D}$i /media/${D}$i || exit 1
done
### copy apkovl and apk/cache and stuff
rsync -azur --numeric-ids root@my.server.home:sda* /media/ || exit 1
### prepare new apkovl
rm -fr /tmp/template
mkdir -p /tmp/template
tar xzf /media/${S}2/$(hostname).apkovl.tar.gz -C /tmp/template || exit 1
rm /media/${D}2/$(hostname).apkovl.tar.gz
cd /tmp/template
rm -f etc/ssh/ssh_host_*
for f in $(grep -r $(hostname) etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/$(hostname)/${name}/g $f;done
for f in $(grep -r ${S} etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/${S}/${D}/g $f;done
echo "/dev/sdb2 /media/sdb2 ext4 ro,relatime,errors=continue,user_xattr,acl 0 2" > etc/fstab
# remaining partitions are for own stuff
# partition 4 is the extended one
# (we maybe could just skip 3 and directly jump to extended for own stuff to simplify install script)
echo "/dev/sda3 /media/sda3 f2fs defaults,ro 0 2" >> etc/fstab
for i in $(seq 5 16);do echo "/dev/sda$i /media/sda$i f2fs defaults 0 2" >> etc/fstab;done
# partition 2 will hold apkovl and apk/cache
rm etc/apk/cache
ln -s /media/${D}2/cache etc/apk/cache
ln -s /etc/init.d/local etc/runlevels/default/local
tar czf /media/${D}2/${name}.apkovl.tar.gz . || exit 1
### done
sync
umount /media/${D}*
END=$(date +%s)
DURATION=$(($END-$BEGIN))
echo "Manufacture process took $DURATION seconds to complete."
logger "Manufacture process took $DURATION seconds to complete."
reboot
</pre>

Usage: <pre>~:# setup-albox-from-debian mynewbox</pre>

User:Jlo/Replacing Debian Jessie with Alpine remotely

2017-11-08T15:04:12Z

Jlo: /* Stage 1 */

I want to "upgrade" 200 remote Debian Jessie embedded boxes to AlpineLinux in ''run-from-ram'' mode.
I have already successfully and happily validated the second stage as this is a minor variation around the "setup-ownbox" script I have added to a standard PXE apkovl.
Those box are remotely sshable via openVPN. We need to keep network settings as is because some boxes have ad-hoc network config is restricted zones.

== Stage 0 ==

we need to prepare or a cache with reduced set of package or maybe some local repo with all needed packages needed for first stage and use that repo with no-cache option...

[[How_to_make_a_custom_ISO_image_with_mkimage]]

<pre>
sh mkimage.sh --tag 3.6.2 --outdir ~/iso --arch x86_64 --repository http://my.own.repo/alpine/v3.6/main --profile jessie
</pre>

<pre>
profile_jessie() {
profile_standard
title="AL debian"
desc="Packages included.
Suitable for Local install script."
apks="$apks openvpn wpa_supplicant wireless-tools"
#apks="$apks linux-firmware"
}
</pre>

==> '''alpine-jessie-3.6.2-x86_64.iso'''

== Stage 1 ==

prepare-jessie-for-alpine <pre>
#!/bin/sh
# this must be fully automatic
export DEBIAN_FRONTEND=noninteractive
apt-get -y install rsync extlinux
# /boot is a separate partition
rm -fr /boot/boot
ln -sf . /boot/boot
# let's get system file from our install server
cd /tmp
wget http://my.server.home/alpine/alpine-jessie-3.6.2-x86_64.iso
wget http://my.server.home/alpine/debian.apkovl.tar.gz
mount -o loop /tmp/alpine-jessie-3.6.2-x86_64.iso /mnt
rsync -a /mnt/ /boot/
sync
umount /mnt
# prepare the config overlay
rm -fr /tmp/apkovl
mkdir /tmp/apkovl
tar xzf /tmp/debian.apkovl.tar.gz -C /tmp/apkovl
# keep current active network connection(s) and identity
cp /etc/hostname /tmp/apkovl/etc/
cp /etc/network/interfaces /tmp/apkovl/etc/network/
cp -r /etc/openvpn /tmp/apkovl/etc/
cp -r /etc/ssh /tmp/apkovl/etc/
cd /tmp/apkovl
# be sure the install media was not already customized for own apps
unlink etc/runlevels/default/local
# be sure active VPN connections are preserved
mkdir -p /tmp/apkovl/etc/init.d
for v in /tmp/apkovl/etc/openvpn/*.conf ; do
vn=$(basename $v|cut -d. -f1)
ln -fs openvpn /tmp/apkovl/etc/init.d/openvpn.$vn
ln -fs /etc/init.d/openvpn.$vn /tmp/apkovl/etc/runlevels/default/openvpn.$vn
done
# config done ; commit
tar czf /boot/$(hostname).apkovl.tar.gz .
# now the booltoader ; this will kill the active grub...
cat > /boot/extlinux.conf << EOF
timeout 20
prompt 1
default hardened
label hardened
kernel /boot/vmlinuz-hardened
initrd /boot/initramfs-hardened
append alpine_dev=sda1:ext2 modloop=modloop-hardened modules=loop,cramfs,sd-mod,usb-storage,ext2 quiet
EOF
dd if=/usr/lib/syslinux/mbr/mbr.bin of=/dev/sda
extlinux -i /boot
# done
sync
reboot
</pre>

usage: <pre>~:# prepare-jessie-for-alpine</pre>

== Stage 2 ==

not tested yet in this procedure but used successfully (a small variant) to prepare new AL boxes.

setup-albox-from-debian <pre>
#!/bin/sh
BEGIN=$(date +%s)
name=$1
D=sda
echo "Manufacturing box named *${name}*..."
rc-service modloop stop
umount /media/${D}* || (echo "Unable to unmount ${D}. Aborting..." ; exit 1)
### Partition the SSD $D
# f2fs want partition of type ext2 in parted
parted -a cylinder -s /dev/${D} -- \
mklabel msdos \
mkpart primary fat32 0% 1% \
mkpart primary ext2 1% 2% \
mkpart primary ext2 2% 7% \
mkpart extended 7% 100% \
mkpart logical ext2 7% 9% \
mkpart logical ext2 9% 15% \
mkpart logical ext2 15% 20% \
mkpart logical ext2 21% 22% \
mkpart logical ext2 22% 23% \
mkpart logical ext2 23% 24% \
mkpart logical ext2 24% 25% \
mkpart logical ext2 25% 26% \
mkpart logical ext2 26% 27% \
mkpart logical ext2 27% 28% \
mkpart logical ext2 28% 29% \
mkpart logical ext2 29% 30% \
set 1 boot on \
|| exit 1
### prepare boot partition
mkfs.vfat /dev/${D}1 || exit 1
mkdir -p /media/${D}1
setup-bootable /media/${B} /dev/${D}1 || exit 1
mount -t vfat /dev/${D}1 /media/${D}1 || exit 1
### format partition to hold apkovl and apk/cache; it must be of ext? type
mkfs.ext4 -F -q /dev/${D}2 || exit 1
mkdir -p /media/${D}2
mount -t ext4 /dev/${D}2 /media/${D}2 || exit 1
### format remaining partitions with f2fs
for i in $(seq 3 16);do
[ $i -eq 4 ] && continue
mkfs.f2fs -q /dev/${D}$i || exit 1
mkdir -p /media/${D}$i
mount -t f2fs /dev/${D}$i /media/${D}$i || exit 1
done
### copy apkovl and apk/cache and stuff
rsync -azur --numeric-ids root@my.server.home:sda* /media/ || exit 1
### prepare new apkovl
rm -fr /tmp/template
mkdir -p /tmp/template
tar xzf /media/${S}2/$(hostname).apkovl.tar.gz -C /tmp/template || exit 1
rm /media/${D}2/$(hostname).apkovl.tar.gz
cd /tmp/template
rm -f etc/ssh/ssh_host_*
for f in $(grep -r $(hostname) etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/$(hostname)/${name}/g $f;done
for f in $(grep -r ${S} etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/${S}/${D}/g $f;done
echo "/dev/sdb2 /media/sdb2 ext4 ro,relatime,errors=continue,user_xattr,acl 0 2" > etc/fstab
# remaining partitions are for own stuff
# partition 4 is the extended one
# (we maybe could just skip 3 and directly jump to extended for own stuff to simplify install script)
echo "/dev/sda3 /media/sda3 f2fs defaults,ro 0 2" >> etc/fstab
for i in $(seq 5 16);do echo "/dev/sda$i /media/sda$i f2fs defaults 0 2" >> etc/fstab;done
# partition 2 will hold apkovl and apk/cache
rm etc/apk/cache
ln -s /media/${D}2/cache etc/apk/cache
ln -s /etc/init.d/local etc/runlevels/default/local
tar czf /media/${D}2/${name}.apkovl.tar.gz . || exit 1
### done
sync
umount /media/${D}*
END=$(date +%s)
DURATION=$(($END-$BEGIN))
echo "Manufacture process took $DURATION seconds to complete."
logger "Manufacture process took $DURATION seconds to complete."
reboot
</pre>

Usage: <pre>~:# setup-albox-from-debian mynewbox</pre>

User:Jlo/Replacing Debian Jessie with Alpine remotely

2017-11-08T15:03:50Z

Jlo:

I want to "upgrade" 200 remote Debian Jessie embedded boxes to AlpineLinux in ''run-from-ram'' mode.
I have already successfully and happily validated the second stage as this is a minor variation around the "setup-ownbox" script I have added to a standard PXE apkovl.
Those box are remotely sshable via openVPN. We need to keep network settings as is because some boxes have ad-hoc network config is restricted zones.

== Stage 0 ==

we need to prepare or a cache with reduced set of package or maybe some local repo with all needed packages needed for first stage and use that repo with no-cache option...

[[How_to_make_a_custom_ISO_image_with_mkimage]]

<pre>
sh mkimage.sh --tag 3.6.2 --outdir ~/iso --arch x86_64 --repository http://my.own.repo/alpine/v3.6/main --profile jessie
</pre>

<pre>
profile_jessie() {
profile_standard
title="AL debian"
desc="Packages included.
Suitable for Local install script."
apks="$apks openvpn wpa_supplicant wireless-tools"
#apks="$apks linux-firmware"
}
</pre>

==> '''alpine-jessie-3.6.2-x86_64.iso'''

== Stage 1 ==

prepare-jessie-for-alpine <pre>
#!/bin/sh
# this must be fully automatic
export DEBIAN_FRONTEND=noninteractive
apt-get -y install rsync extlinux
# /boot is a separate partition
rm -fr /boot/boot
ln -sf . /boot/boot
# let's get system file from our install server
cd /tmp
wget http://my.server.home/alpine/alpine-jessie-3.6.2-x86_64.iso
wget http://my.server.home/alpine/debian.apkovl.tar.gz
mount -o loop /tmp/alpine-jessie-3.6.2-x86_64.iso /mnt
rsync -a /mnt/ /boot/
cp /mnt/.alpine-release /boot/
sync
umount /mnt
# prepare the config overlay
rm -fr /tmp/apkovl
mkdir /tmp/apkovl
tar xzf /tmp/debian.apkovl.tar.gz -C /tmp/apkovl
# keep current active network connection(s) and identity
cp /etc/hostname /tmp/apkovl/etc/
cp /etc/network/interfaces /tmp/apkovl/etc/network/
cp -r /etc/openvpn /tmp/apkovl/etc/
cp -r /etc/ssh /tmp/apkovl/etc/
cd /tmp/apkovl
# be sure the install media was not already customized for own apps
unlink etc/runlevels/default/local
# be sure active VPN connections are preserved
mkdir -p /tmp/apkovl/etc/init.d
for v in /tmp/apkovl/etc/openvpn/*.conf ; do
vn=$(basename $v|cut -d. -f1)
ln -fs openvpn /tmp/apkovl/etc/init.d/openvpn.$vn
ln -fs /etc/init.d/openvpn.$vn /tmp/apkovl/etc/runlevels/default/openvpn.$vn
done
# config done ; commit
tar czf /boot/$(hostname).apkovl.tar.gz .
# now the booltoader ; this will kill the active grub...
cat > /boot/extlinux.conf << EOF
timeout 20
prompt 1
default hardened
label hardened
kernel /boot/vmlinuz-hardened
initrd /boot/initramfs-hardened
append alpine_dev=sda1:ext2 modloop=modloop-hardened modules=loop,cramfs,sd-mod,usb-storage,ext2 quiet
EOF
dd if=/usr/lib/syslinux/mbr/mbr.bin of=/dev/sda
extlinux -i /boot
# done
sync
reboot
</pre>

usage: <pre>~:# prepare-jessie-for-alpine</pre>

== Stage 2 ==

not tested yet in this procedure but used successfully (a small variant) to prepare new AL boxes.

setup-albox-from-debian <pre>
#!/bin/sh
BEGIN=$(date +%s)
name=$1
D=sda
echo "Manufacturing box named *${name}*..."
rc-service modloop stop
umount /media/${D}* || (echo "Unable to unmount ${D}. Aborting..." ; exit 1)
### Partition the SSD $D
# f2fs want partition of type ext2 in parted
parted -a cylinder -s /dev/${D} -- \
mklabel msdos \
mkpart primary fat32 0% 1% \
mkpart primary ext2 1% 2% \
mkpart primary ext2 2% 7% \
mkpart extended 7% 100% \
mkpart logical ext2 7% 9% \
mkpart logical ext2 9% 15% \
mkpart logical ext2 15% 20% \
mkpart logical ext2 21% 22% \
mkpart logical ext2 22% 23% \
mkpart logical ext2 23% 24% \
mkpart logical ext2 24% 25% \
mkpart logical ext2 25% 26% \
mkpart logical ext2 26% 27% \
mkpart logical ext2 27% 28% \
mkpart logical ext2 28% 29% \
mkpart logical ext2 29% 30% \
set 1 boot on \
|| exit 1
### prepare boot partition
mkfs.vfat /dev/${D}1 || exit 1
mkdir -p /media/${D}1
setup-bootable /media/${B} /dev/${D}1 || exit 1
mount -t vfat /dev/${D}1 /media/${D}1 || exit 1
### format partition to hold apkovl and apk/cache; it must be of ext? type
mkfs.ext4 -F -q /dev/${D}2 || exit 1
mkdir -p /media/${D}2
mount -t ext4 /dev/${D}2 /media/${D}2 || exit 1
### format remaining partitions with f2fs
for i in $(seq 3 16);do
[ $i -eq 4 ] && continue
mkfs.f2fs -q /dev/${D}$i || exit 1
mkdir -p /media/${D}$i
mount -t f2fs /dev/${D}$i /media/${D}$i || exit 1
done
### copy apkovl and apk/cache and stuff
rsync -azur --numeric-ids root@my.server.home:sda* /media/ || exit 1
### prepare new apkovl
rm -fr /tmp/template
mkdir -p /tmp/template
tar xzf /media/${S}2/$(hostname).apkovl.tar.gz -C /tmp/template || exit 1
rm /media/${D}2/$(hostname).apkovl.tar.gz
cd /tmp/template
rm -f etc/ssh/ssh_host_*
for f in $(grep -r $(hostname) etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/$(hostname)/${name}/g $f;done
for f in $(grep -r ${S} etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/${S}/${D}/g $f;done
echo "/dev/sdb2 /media/sdb2 ext4 ro,relatime,errors=continue,user_xattr,acl 0 2" > etc/fstab
# remaining partitions are for own stuff
# partition 4 is the extended one
# (we maybe could just skip 3 and directly jump to extended for own stuff to simplify install script)
echo "/dev/sda3 /media/sda3 f2fs defaults,ro 0 2" >> etc/fstab
for i in $(seq 5 16);do echo "/dev/sda$i /media/sda$i f2fs defaults 0 2" >> etc/fstab;done
# partition 2 will hold apkovl and apk/cache
rm etc/apk/cache
ln -s /media/${D}2/cache etc/apk/cache
ln -s /etc/init.d/local etc/runlevels/default/local
tar czf /media/${D}2/${name}.apkovl.tar.gz . || exit 1
### done
sync
umount /media/${D}*
END=$(date +%s)
DURATION=$(($END-$BEGIN))
echo "Manufacture process took $DURATION seconds to complete."
logger "Manufacture process took $DURATION seconds to complete."
reboot
</pre>

Usage: <pre>~:# setup-albox-from-debian mynewbox</pre>

User:Jlo/Replacing Debian Jessie with Alpine remotely

2017-11-07T13:09:51Z

Jlo:

I want to "upgrade" 200 remote Debian Jessie embedded boxes to AlpineLinux in ''run-from-ram'' mode.
I have already successfully and happily validated the second stage as this is a minor variation around the "setup-ownbox" script I have added to a standard PXE apkovl.

== Stage 0 ==

we need to prepare or a cache with reduced set of package or maybe some local repo with all needed packages needed for first stage and use that repo with no-cache option...

[[How_to_make_a_custom_ISO_image_with_mkimage]]

<pre>
sh mkimage.sh --tag 3.6.2 --outdir ~/iso --arch x86_64 --repository http://my.own.repo/alpine/v3.6/main --profile jessie
</pre>

<pre>
profile_jessie() {
profile_standard
title="AL debian"
desc="Packages included.
Suitable for Local install script."
apks="$apks openvpn wpa_supplicant wireless-tools"
#apks="$apks linux-firmware"
}
</pre>

==> '''alpine-jessie-3.6.2-x86_64.iso'''

== Stage 1 ==

something is wrong about init at reboot time :(

prepare-jessie-for-alpine <pre>
#!/bin/sh
# this must be fully automatic
export DEBIAN_FRONTEND=noninteractive
apt-get -y install rsync extlinux
# /boot is a separate partition
rm -fr /boot/boot
ln -sf . /boot/boot
# let's get system file from our install server
cd /tmp
wget http://my.server.home/alpine/alpine-jessie-3.6.2-x86_64.iso
wget http://my.server.home/alpine/debian.apkovl.tar.gz
mount -o loop /tmp/alpine-jessie-3.6.2-x86_64.iso /mnt
rsync -a /mnt/ /boot/
cp /mnt/.alpine-release /boot/
sync
umount /mnt
# prepare the config overlay
rm -fr /tmp/apkovl
mkdir /tmp/apkovl
tar xzf /tmp/debian.apkovl.tar.gz -C /tmp/apkovl
# keep current active network connection(s) and identity
cp /etc/hostname /tmp/apkovl/etc/
cp /etc/network/interfaces /tmp/apkovl/etc/network/
cp -r /etc/openvpn /tmp/apkovl/etc/
cp -r /etc/ssh /tmp/apkovl/etc/
cd /tmp/apkovl
# be sure the install media was not already customized for own apps
unlink etc/runlevels/default/local
# be sure active VPN connections are preserved
mkdir -p /tmp/apkovl/etc/init.d
for v in /tmp/apkovl/etc/openvpn/*.conf ; do
vn=$(basename $v|cut -d. -f1)
ln -fs openvpn /tmp/apkovl/etc/init.d/openvpn.$vn
ln -fs /etc/init.d/openvpn.$vn /tmp/apkovl/etc/runlevels/default/openvpn.$vn
done
# config done ; commit
tar czf /boot/$(hostname).apkovl.tar.gz .
# now the booltoader ; this will kill the active grub...
cat > /boot/extlinux.conf << EOF
timeout 20
prompt 1
default hardened
label hardened
kernel /boot/vmlinuz-hardened
initrd /boot/initramfs-hardened
append alpine_dev=sda1:ext2 modloop=modloop-hardened modules=loop,cramfs,sd-mod,usb-storage,ext2 quiet
EOF
dd if=/usr/lib/syslinux/mbr/mbr.bin of=/dev/sda
extlinux -i /boot
# done
sync
reboot
</pre>

usage: <pre>~:# prepare-jessie-for-alpine</pre>

== Stage 2 ==

not tested yet in this procedure but used successfully (a small variant) to prepare new AL boxes.

setup-albox-from-debian <pre>
#!/bin/sh
BEGIN=$(date +%s)
name=$1
D=sda
echo "Manufacturing box named *${name}*..."
rc-service modloop stop
umount /media/${D}* || (echo "Unable to unmount ${D}. Aborting..." ; exit 1)
### Partition the SSD $D
# f2fs want partition of type ext2 in parted
parted -a cylinder -s /dev/${D} -- \
mklabel msdos \
mkpart primary fat32 0% 1% \
mkpart primary ext2 1% 2% \
mkpart primary ext2 2% 7% \
mkpart extended 7% 100% \
mkpart logical ext2 7% 9% \
mkpart logical ext2 9% 15% \
mkpart logical ext2 15% 20% \
mkpart logical ext2 21% 22% \
mkpart logical ext2 22% 23% \
mkpart logical ext2 23% 24% \
mkpart logical ext2 24% 25% \
mkpart logical ext2 25% 26% \
mkpart logical ext2 26% 27% \
mkpart logical ext2 27% 28% \
mkpart logical ext2 28% 29% \
mkpart logical ext2 29% 30% \
set 1 boot on \
|| exit 1
### prepare boot partition
mkfs.vfat /dev/${D}1 || exit 1
mkdir -p /media/${D}1
setup-bootable /media/${B} /dev/${D}1 || exit 1
mount -t vfat /dev/${D}1 /media/${D}1 || exit 1
### format partition to hold apkovl and apk/cache; it must be of ext? type
mkfs.ext4 -F -q /dev/${D}2 || exit 1
mkdir -p /media/${D}2
mount -t ext4 /dev/${D}2 /media/${D}2 || exit 1
### format remaining partitions with f2fs
for i in $(seq 3 16);do
[ $i -eq 4 ] && continue
mkfs.f2fs -q /dev/${D}$i || exit 1
mkdir -p /media/${D}$i
mount -t f2fs /dev/${D}$i /media/${D}$i || exit 1
done
### copy apkovl and apk/cache and stuff
rsync -azur --numeric-ids root@my.server.home:sda* /media/ || exit 1
### prepare new apkovl
rm -fr /tmp/template
mkdir -p /tmp/template
tar xzf /media/${S}2/$(hostname).apkovl.tar.gz -C /tmp/template || exit 1
rm /media/${D}2/$(hostname).apkovl.tar.gz
cd /tmp/template
rm -f etc/ssh/ssh_host_*
for f in $(grep -r $(hostname) etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/$(hostname)/${name}/g $f;done
for f in $(grep -r ${S} etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/${S}/${D}/g $f;done
echo "/dev/sdb2 /media/sdb2 ext4 ro,relatime,errors=continue,user_xattr,acl 0 2" > etc/fstab
# remaining partitions are for own stuff
# partition 4 is the extended one
# (we maybe could just skip 3 and directly jump to extended for own stuff to simplify install script)
echo "/dev/sda3 /media/sda3 f2fs defaults,ro 0 2" >> etc/fstab
for i in $(seq 5 16);do echo "/dev/sda$i /media/sda$i f2fs defaults 0 2" >> etc/fstab;done
# partition 2 will hold apkovl and apk/cache
rm etc/apk/cache
ln -s /media/${D}2/cache etc/apk/cache
ln -s /etc/init.d/local etc/runlevels/default/local
tar czf /media/${D}2/${name}.apkovl.tar.gz . || exit 1
### done
sync
umount /media/${D}*
END=$(date +%s)
DURATION=$(($END-$BEGIN))
echo "Manufacture process took $DURATION seconds to complete."
logger "Manufacture process took $DURATION seconds to complete."
reboot
</pre>

Usage: <pre>~:# setup-albox-from-debian mynewbox</pre>

User:Jlo/Replacing Debian Jessie with Alpine remotely

2017-11-07T13:01:42Z

Jlo: /* Stage 1 */

I want to "upgrade" 200 remote Debian Jessie embedded boxes to AlpineLinux in ''run-from-ram'' mode.
I have already successfully and happily validated the second stage as this is a minor variation around the "setup-ownbox" script I have added to a standard PXE apkovl.

== Stage 0 ==

we need to prepare or a cache with reduced set of package or maybe some local repo with all needed packages needed for first stage and use that repo with no-cache option...

[[How_to_make_a_custom_ISO_image_with_mkimage]]

<pre>
sh mkimage.sh --tag 3.6.2 --outdir ~/iso --arch x86_64 --repository http://my.own.repo/alpine/v3.6/main --profile jessie
</pre>

<pre>
profile_jessie() {
profile_standard
title="AL debian"
desc="Packages included.
Suitable for Local install script."
apks="$apks openvpn wpa_supplicant wireless-tools"
#apks="$apks linux-firmware"
}
</pre>

== Stage 1 ==

something is wrong about init at reboot time :(

prepare-jessie-for-alpine <pre>
#!/bin/sh
# this must be fully automatic
export DEBIAN_FRONTEND=noninteractive
apt-get -y install rsync extlinux
# /boot is a separate partition
rm -fr /boot/boot
ln -sf . /boot/boot
# let's get system file from our install server
rsync -avzur my.server.home:debian/boot/* /boot/
rsync -avzur my.server.home:debian/apks /boot/
rsync -avzu my.server.home:debian/debian.apkovl.tar.gz /boot/
rsync -auv my.server.home:debian/.alpine-release /boot/
# prepare the config overlay
rm -fr /tmp/apkovl
mkdir /tmp/apkovl
tar xzf /boot/debian.apkovl.tar.gz -C /tmp/apkovl
# keep current active network connection(s) and identity
cp /etc/hostname /tmp/apkovl/etc/
cp /etc/network/interfaces /tmp/apkovl/etc/network/
cp -r /etc/openvpn /tmp/apkovl/etc/
cp -r /etc/ssh /tmp/apkovl/etc/
cd /tmp/apkovl
# be sure the install media was not already customized for own apps
unlink etc/runlevels/default/local
# be sure active VPN connections are preserved
mkdir -p /tmp/apkovl/etc/init.d
for v in /tmp/apkovl/etc/openvpn/*.conf ; do
vn=$(basename $v|cut -d. -f1)
ln -fs openvpn /tmp/apkovl/etc/init.d/openvpn.$vn
ln -fs /etc/init.d/openvpn.$vn /tmp/apkovl/etc/runlevels/default/openvpn.$vn
done
# config done ; commit
tar czf /boot/debian.apkovl.tar.gz .
# now the booltoader ; this will kill the active grub...
cat > /boot/extlinux.conf << EOF
timeout 20
prompt 1
default hardened
label hardened
kernel /boot/vmlinuz-hardened
initrd /boot/initramfs-hardened
append alpine_dev=sda1:ext2 modloop=modloop-hardened modules=loop,cramfs,sd-mod,usb-storage,ext2 quiet
EOF
dd if=/usr/lib/syslinux/mbr/mbr.bin of=/dev/sda
extlinux -i /boot
# done
sync
reboot
</pre>

usage: <pre>~:# prepare-jessie-for-alpine</pre>

== Stage 2 ==

not tested yet in this procedure but used successfully (a small variant) to prepare new AL boxes.

setup-albox-from-debian <pre>
#!/bin/sh
BEGIN=$(date +%s)
name=$1
D=sda
echo "Manufacturing box named *${name}*..."
rc-service modloop stop
umount /media/${D}* || (echo "Unable to unmount ${D}. Aborting..." ; exit 1)
### Partition the SSD $D
# f2fs want partition of type ext2 in parted
parted -a cylinder -s /dev/${D} -- \
mklabel msdos \
mkpart primary fat32 0% 1% \
mkpart primary ext2 1% 2% \
mkpart primary ext2 2% 7% \
mkpart extended 7% 100% \
mkpart logical ext2 7% 9% \
mkpart logical ext2 9% 15% \
mkpart logical ext2 15% 20% \
mkpart logical ext2 21% 22% \
mkpart logical ext2 22% 23% \
mkpart logical ext2 23% 24% \
mkpart logical ext2 24% 25% \
mkpart logical ext2 25% 26% \
mkpart logical ext2 26% 27% \
mkpart logical ext2 27% 28% \
mkpart logical ext2 28% 29% \
mkpart logical ext2 29% 30% \
set 1 boot on \
|| exit 1
### prepare boot partition
mkfs.vfat /dev/${D}1 || exit 1
mkdir -p /media/${D}1
setup-bootable /media/${B} /dev/${D}1 || exit 1
mount -t vfat /dev/${D}1 /media/${D}1 || exit 1
### format partition to hold apkovl and apk/cache; it must be of ext? type
mkfs.ext4 -F -q /dev/${D}2 || exit 1
mkdir -p /media/${D}2
mount -t ext4 /dev/${D}2 /media/${D}2 || exit 1
### format remaining partitions with f2fs
for i in $(seq 3 16);do
[ $i -eq 4 ] && continue
mkfs.f2fs -q /dev/${D}$i || exit 1
mkdir -p /media/${D}$i
mount -t f2fs /dev/${D}$i /media/${D}$i || exit 1
done
### copy apkovl and apk/cache and stuff
rsync -azur --numeric-ids root@my.server.home:sda* /media/ || exit 1
### prepare new apkovl
rm -fr /tmp/template
mkdir -p /tmp/template
tar xzf /media/${S}2/$(hostname).apkovl.tar.gz -C /tmp/template || exit 1
rm /media/${D}2/$(hostname).apkovl.tar.gz
cd /tmp/template
rm -f etc/ssh/ssh_host_*
for f in $(grep -r $(hostname) etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/$(hostname)/${name}/g $f;done
for f in $(grep -r ${S} etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/${S}/${D}/g $f;done
echo "/dev/sdb2 /media/sdb2 ext4 ro,relatime,errors=continue,user_xattr,acl 0 2" > etc/fstab
# remaining partitions are for own stuff
# partition 4 is the extended one
# (we maybe could just skip 3 and directly jump to extended for own stuff to simplify install script)
echo "/dev/sda3 /media/sda3 f2fs defaults,ro 0 2" >> etc/fstab
for i in $(seq 5 16);do echo "/dev/sda$i /media/sda$i f2fs defaults 0 2" >> etc/fstab;done
# partition 2 will hold apkovl and apk/cache
rm etc/apk/cache
ln -s /media/${D}2/cache etc/apk/cache
ln -s /etc/init.d/local etc/runlevels/default/local
tar czf /media/${D}2/${name}.apkovl.tar.gz . || exit 1
### done
sync
umount /media/${D}*
END=$(date +%s)
DURATION=$(($END-$BEGIN))
echo "Manufacture process took $DURATION seconds to complete."
logger "Manufacture process took $DURATION seconds to complete."
reboot
</pre>

Usage: <pre>~:# setup-albox-from-debian mynewbox</pre>

User:Jlo/Replacing Debian Jessie with Alpine remotely

2017-11-07T12:58:58Z

Jlo: /* Stage 0 */

I want to "upgrade" 200 remote Debian Jessie embedded boxes to AlpineLinux in ''run-from-ram'' mode.
I have already successfully and happily validated the second stage as this is a minor variation around the "setup-ownbox" script I have added to a standard PXE apkovl.

== Stage 0 ==

we need to prepare or a cache with reduced set of package or maybe some local repo with all needed packages needed for first stage and use that repo with no-cache option...

[[How_to_make_a_custom_ISO_image_with_mkimage]]

<pre>
sh mkimage.sh --tag 3.6.2 --outdir ~/iso --arch x86_64 --repository http://my.own.repo/alpine/v3.6/main --profile jessie
</pre>

<pre>
profile_jessie() {
profile_standard
title="AL debian"
desc="Packages included.
Suitable for Local install script."
apks="$apks openvpn wpa_supplicant wireless-tools"
#apks="$apks linux-firmware"
}
</pre>

== Stage 1 ==

something is wrong about init at reboot time :(

prepare-jessie-for-alpine <pre>
#!/bin/sh
# this must be fully automatic
export DEBIAN_FRONTEND=noninteractive
apt-get -y install rsync extlinux
# /boot is a separate partition
rm -fr /boot/boot
ln -sf . /boot/boot
# let's get system file from our install server
rsync -avzur my.server.home:debian/boot/* /boot/
rsync -avzur my.server.home:debian/apks /boot/
rsync -avzu my.server.home:debian/debian.apkovl.tar.gz /boot/
rsync -auv my.server.home:debian/.alpine-release /boot/
# prepare the config overlay
rm -fr /tmp/apkovl
mkdir /tmp/apkovl
tar xzf /boot/debian.apkovl.tar.gz -C /tmp/apkovl
# keep current active network connection(s) and identity
cp /etc/network/interfaces /tmp/apkovl/etc/network/
cp -r /etc/openvpn /tmp/apkovl/etc/
cp -r /etc/ssh /tmp/apkovl/etc/
cd /tmp/apkovl
# be sure the install media was not already customized for own apps
unlink etc/runlevels/default/local
# be sure active VPN connections are preserved
mkdir -p /tmp/apkovl/etc/init.d
for v in /tmp/apkovl/etc/openvpn/*.conf ; do
vn=$(basename $v|cut -d. -f1)
ln -fs openvpn /tmp/apkovl/etc/init.d/openvpn.$vn
ln -fs /etc/init.d/openvpn.$vn /tmp/apkovl/etc/runlevels/default/openvpn.$vn
done
# config done ; commit
tar czf /boot/debian.apkovl.tar.gz .
# now the booltoader ; this will kill the active grub...
cat > /boot/extlinux.conf << EOF
timeout 20
prompt 1
default hardened
label hardened
kernel /boot/vmlinuz-hardened
initrd /boot/initramfs-hardened
append alpine_dev=sda1:ext2 modloop=modloop-hardened modules=loop,cramfs,sd-mod,usb-storage,ext2 quiet
EOF
dd if=/usr/lib/syslinux/mbr/mbr.bin of=/dev/sda
extlinux -i /boot
# done
sync
reboot
</pre>

usage: <pre>~:# prepare-jessie-for-alpine</pre>

== Stage 2 ==

not tested yet in this procedure but used successfully (a small variant) to prepare new AL boxes.

setup-albox-from-debian <pre>
#!/bin/sh
BEGIN=$(date +%s)
name=$1
D=sda
echo "Manufacturing box named *${name}*..."
rc-service modloop stop
umount /media/${D}* || (echo "Unable to unmount ${D}. Aborting..." ; exit 1)
### Partition the SSD $D
# f2fs want partition of type ext2 in parted
parted -a cylinder -s /dev/${D} -- \
mklabel msdos \
mkpart primary fat32 0% 1% \
mkpart primary ext2 1% 2% \
mkpart primary ext2 2% 7% \
mkpart extended 7% 100% \
mkpart logical ext2 7% 9% \
mkpart logical ext2 9% 15% \
mkpart logical ext2 15% 20% \
mkpart logical ext2 21% 22% \
mkpart logical ext2 22% 23% \
mkpart logical ext2 23% 24% \
mkpart logical ext2 24% 25% \
mkpart logical ext2 25% 26% \
mkpart logical ext2 26% 27% \
mkpart logical ext2 27% 28% \
mkpart logical ext2 28% 29% \
mkpart logical ext2 29% 30% \
set 1 boot on \
|| exit 1
### prepare boot partition
mkfs.vfat /dev/${D}1 || exit 1
mkdir -p /media/${D}1
setup-bootable /media/${B} /dev/${D}1 || exit 1
mount -t vfat /dev/${D}1 /media/${D}1 || exit 1
### format partition to hold apkovl and apk/cache; it must be of ext? type
mkfs.ext4 -F -q /dev/${D}2 || exit 1
mkdir -p /media/${D}2
mount -t ext4 /dev/${D}2 /media/${D}2 || exit 1
### format remaining partitions with f2fs
for i in $(seq 3 16);do
[ $i -eq 4 ] && continue
mkfs.f2fs -q /dev/${D}$i || exit 1
mkdir -p /media/${D}$i
mount -t f2fs /dev/${D}$i /media/${D}$i || exit 1
done
### copy apkovl and apk/cache and stuff
rsync -azur --numeric-ids root@my.server.home:sda* /media/ || exit 1
### prepare new apkovl
rm -fr /tmp/template
mkdir -p /tmp/template
tar xzf /media/${S}2/$(hostname).apkovl.tar.gz -C /tmp/template || exit 1
rm /media/${D}2/$(hostname).apkovl.tar.gz
cd /tmp/template
rm -f etc/ssh/ssh_host_*
for f in $(grep -r $(hostname) etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/$(hostname)/${name}/g $f;done
for f in $(grep -r ${S} etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/${S}/${D}/g $f;done
echo "/dev/sdb2 /media/sdb2 ext4 ro,relatime,errors=continue,user_xattr,acl 0 2" > etc/fstab
# remaining partitions are for own stuff
# partition 4 is the extended one
# (we maybe could just skip 3 and directly jump to extended for own stuff to simplify install script)
echo "/dev/sda3 /media/sda3 f2fs defaults,ro 0 2" >> etc/fstab
for i in $(seq 5 16);do echo "/dev/sda$i /media/sda$i f2fs defaults 0 2" >> etc/fstab;done
# partition 2 will hold apkovl and apk/cache
rm etc/apk/cache
ln -s /media/${D}2/cache etc/apk/cache
ln -s /etc/init.d/local etc/runlevels/default/local
tar czf /media/${D}2/${name}.apkovl.tar.gz . || exit 1
### done
sync
umount /media/${D}*
END=$(date +%s)
DURATION=$(($END-$BEGIN))
echo "Manufacture process took $DURATION seconds to complete."
logger "Manufacture process took $DURATION seconds to complete."
reboot
</pre>

Usage: <pre>~:# setup-albox-from-debian mynewbox</pre>

User:Jlo/Replacing Debian Jessie with Alpine remotely

2017-11-07T08:18:17Z

Jlo:

I want to "upgrade" 200 remote Debian Jessie embedded boxes to AlpineLinux in ''run-from-ram'' mode.
I have already successfully and happily validated the second stage as this is a minor variation around the "setup-ownbox" script I have added to a standard PXE apkovl.

== Stage 0 ==

we need to prepare or a cache with reduced set of package or maybe some local repo with all needed packages needed for first stage and use that repo with no-cache option...

== Stage 1 ==

something is wrong about init at reboot time :(

prepare-jessie-for-alpine <pre>
#!/bin/sh
# this must be fully automatic
export DEBIAN_FRONTEND=noninteractive
apt-get -y install rsync extlinux
# /boot is a separate partition
rm -fr /boot/boot
ln -sf . /boot/boot
# let's get system file from our install server
rsync -avzur my.server.home:debian/boot/* /boot/
rsync -avzur my.server.home:debian/apks /boot/
rsync -avzu my.server.home:debian/debian.apkovl.tar.gz /boot/
rsync -auv my.server.home:debian/.alpine-release /boot/
# prepare the config overlay
rm -fr /tmp/apkovl
mkdir /tmp/apkovl
tar xzf /boot/debian.apkovl.tar.gz -C /tmp/apkovl
# keep current active network connection(s) and identity
cp /etc/network/interfaces /tmp/apkovl/etc/network/
cp -r /etc/openvpn /tmp/apkovl/etc/
cp -r /etc/ssh /tmp/apkovl/etc/
cd /tmp/apkovl
# be sure the install media was not already customized for own apps
unlink etc/runlevels/default/local
# be sure active VPN connections are preserved
mkdir -p /tmp/apkovl/etc/init.d
for v in /tmp/apkovl/etc/openvpn/*.conf ; do
vn=$(basename $v|cut -d. -f1)
ln -fs openvpn /tmp/apkovl/etc/init.d/openvpn.$vn
ln -fs /etc/init.d/openvpn.$vn /tmp/apkovl/etc/runlevels/default/openvpn.$vn
done
# config done ; commit
tar czf /boot/debian.apkovl.tar.gz .
# now the booltoader ; this will kill the active grub...
cat > /boot/extlinux.conf << EOF
timeout 20
prompt 1
default hardened
label hardened
kernel /boot/vmlinuz-hardened
initrd /boot/initramfs-hardened
append alpine_dev=sda1:ext2 modloop=modloop-hardened modules=loop,cramfs,sd-mod,usb-storage,ext2 quiet
EOF
dd if=/usr/lib/syslinux/mbr/mbr.bin of=/dev/sda
extlinux -i /boot
# done
sync
reboot
</pre>

usage: <pre>~:# prepare-jessie-for-alpine</pre>

== Stage 2 ==

not tested yet in this procedure but used successfully (a small variant) to prepare new AL boxes.

setup-albox-from-debian <pre>
#!/bin/sh
BEGIN=$(date +%s)
name=$1
D=sda
echo "Manufacturing box named *${name}*..."
rc-service modloop stop
umount /media/${D}* || (echo "Unable to unmount ${D}. Aborting..." ; exit 1)
### Partition the SSD $D
# f2fs want partition of type ext2 in parted
parted -a cylinder -s /dev/${D} -- \
mklabel msdos \
mkpart primary fat32 0% 1% \
mkpart primary ext2 1% 2% \
mkpart primary ext2 2% 7% \
mkpart extended 7% 100% \
mkpart logical ext2 7% 9% \
mkpart logical ext2 9% 15% \
mkpart logical ext2 15% 20% \
mkpart logical ext2 21% 22% \
mkpart logical ext2 22% 23% \
mkpart logical ext2 23% 24% \
mkpart logical ext2 24% 25% \
mkpart logical ext2 25% 26% \
mkpart logical ext2 26% 27% \
mkpart logical ext2 27% 28% \
mkpart logical ext2 28% 29% \
mkpart logical ext2 29% 30% \
set 1 boot on \
|| exit 1
### prepare boot partition
mkfs.vfat /dev/${D}1 || exit 1
mkdir -p /media/${D}1
setup-bootable /media/${B} /dev/${D}1 || exit 1
mount -t vfat /dev/${D}1 /media/${D}1 || exit 1
### format partition to hold apkovl and apk/cache; it must be of ext? type
mkfs.ext4 -F -q /dev/${D}2 || exit 1
mkdir -p /media/${D}2
mount -t ext4 /dev/${D}2 /media/${D}2 || exit 1
### format remaining partitions with f2fs
for i in $(seq 3 16);do
[ $i -eq 4 ] && continue
mkfs.f2fs -q /dev/${D}$i || exit 1
mkdir -p /media/${D}$i
mount -t f2fs /dev/${D}$i /media/${D}$i || exit 1
done
### copy apkovl and apk/cache and stuff
rsync -azur --numeric-ids root@my.server.home:sda* /media/ || exit 1
### prepare new apkovl
rm -fr /tmp/template
mkdir -p /tmp/template
tar xzf /media/${S}2/$(hostname).apkovl.tar.gz -C /tmp/template || exit 1
rm /media/${D}2/$(hostname).apkovl.tar.gz
cd /tmp/template
rm -f etc/ssh/ssh_host_*
for f in $(grep -r $(hostname) etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/$(hostname)/${name}/g $f;done
for f in $(grep -r ${S} etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/${S}/${D}/g $f;done
echo "/dev/sdb2 /media/sdb2 ext4 ro,relatime,errors=continue,user_xattr,acl 0 2" > etc/fstab
# remaining partitions are for own stuff
# partition 4 is the extended one
# (we maybe could just skip 3 and directly jump to extended for own stuff to simplify install script)
echo "/dev/sda3 /media/sda3 f2fs defaults,ro 0 2" >> etc/fstab
for i in $(seq 5 16);do echo "/dev/sda$i /media/sda$i f2fs defaults 0 2" >> etc/fstab;done
# partition 2 will hold apkovl and apk/cache
rm etc/apk/cache
ln -s /media/${D}2/cache etc/apk/cache
ln -s /etc/init.d/local etc/runlevels/default/local
tar czf /media/${D}2/${name}.apkovl.tar.gz . || exit 1
### done
sync
umount /media/${D}*
END=$(date +%s)
DURATION=$(($END-$BEGIN))
echo "Manufacture process took $DURATION seconds to complete."
logger "Manufacture process took $DURATION seconds to complete."
reboot
</pre>

Usage: <pre>~:# setup-albox-from-debian mynewbox</pre>

User:Jlo/Replacing Debian Jessie with Alpine remotely

2017-11-07T07:51:41Z

Jlo:

I want to "upgrade" 130 remote Debian Jessie embedded boxes to AlpineLinux in ''run-from-ram'' mode.
I have already successfully and happily validated the second stage as this is a minor variation around the "setup-ownbox" script I have added to a standard USB-KEY apkovl.

== Stage 0 ==

we need to prepare or a cache with reduced set of package or maybe some local repo with all needed packages needed for first stage and use that repo with no-cache option...

== Stage 1 ==

something is wrong about init at reboot time :(

prepare-jessie-for-alpine <pre>
#!/bin/sh
# this must be fully automatic
export DEBIAN_FRONTEND=noninteractive
apt-get -y install rsync extlinux
# /boot is a separate partition
rm -fr /boot/boot
ln -sf . /boot/boot
# let's get system file from our install server
rsync -avzur my.server.home:debian/boot/* /boot/
rsync -avzur my.server.home:debian/apks /boot/
rsync -avzu my.server.home:debian/debian.apkovl.tar.gz /boot/
rsync -auv my.server.home:debian/.alpine-release /boot/
# prepare the config overlay
rm -fr /tmp/apkovl
mkdir /tmp/apkovl
tar xzf /boot/debian.apkovl.tar.gz -C /tmp/apkovl
# keep current active network connection(s) and identity
cp /etc/network/interfaces /tmp/apkovl/etc/network/
cp -r /etc/openvpn /tmp/apkovl/etc/
cp -r /etc/ssh /tmp/apkovl/etc/
cd /tmp/apkovl
# be sure the install media was not already customized for own apps
unlink etc/runlevels/default/local
# be sure active VPN connections are preserved
mkdir -p /tmp/apkovl/etc/init.d
for v in /tmp/apkovl/etc/openvpn/*.conf ; do
vn=$(basename $v|cut -d. -f1)
ln -fs openvpn /tmp/apkovl/etc/init.d/openvpn.$vn
ln -fs /etc/init.d/openvpn.$vn /tmp/apkovl/etc/runlevels/default/openvpn.$vn
done
# config done ; commit
tar czf /boot/debian.apkovl.tar.gz .
# now the booltoader ; this will kill the active grub...
cat > /boot/extlinux.conf << EOF
timeout 20
prompt 1
default hardened
label hardened
kernel /boot/vmlinuz-hardened
initrd /boot/initramfs-hardened
append alpine_dev=sda1:ext2 modloop=modloop-hardened modules=loop,cramfs,sd-mod,usb-storage,ext2 quiet
EOF
dd if=/usr/lib/syslinux/mbr/mbr.bin of=/dev/sda
extlinux -i /boot
# done
sync
reboot
</pre>

usage: <pre>~:# prepare-jessie-for-alpine</pre>

== Stage 2 ==

not tested yet in this procedure but used successfully (a small variant) to prepare new AL boxes.

setup-albox-from-debian <pre>
#!/bin/sh
BEGIN=$(date +%s)
name=$1
D=sda
echo "Manufacturing box named *${name}*..."
rc-service modloop stop
umount /media/${D}* || (echo "Unable to unmount ${D}. Aborting..." ; exit 1)
### Partition the SSD $D
# f2fs want partition of type ext2 in parted
parted -a cylinder -s /dev/${D} -- \
mklabel msdos \
mkpart primary fat32 0% 1% \
mkpart primary ext2 1% 2% \
mkpart primary ext2 2% 7% \
mkpart extended 7% 100% \
mkpart logical ext2 7% 9% \
mkpart logical ext2 9% 15% \
mkpart logical ext2 15% 20% \
mkpart logical ext2 21% 22% \
mkpart logical ext2 22% 23% \
mkpart logical ext2 23% 24% \
mkpart logical ext2 24% 25% \
mkpart logical ext2 25% 26% \
mkpart logical ext2 26% 27% \
mkpart logical ext2 27% 28% \
mkpart logical ext2 28% 29% \
mkpart logical ext2 29% 30% \
set 1 boot on \
|| exit 1
### prepare boot partition
mkfs.vfat /dev/${D}1 || exit 1
mkdir -p /media/${D}1
setup-bootable /media/${B} /dev/${D}1 || exit 1
mount -t vfat /dev/${D}1 /media/${D}1 || exit 1
### format partition to hold apkovl and apk/cache; it must be of ext? type
mkfs.ext4 -F -q /dev/${D}2 || exit 1
mkdir -p /media/${D}2
mount -t ext4 /dev/${D}2 /media/${D}2 || exit 1
### format remaining partitions with f2fs
for i in $(seq 3 16);do
[ $i -eq 4 ] && continue
mkfs.f2fs -q /dev/${D}$i || exit 1
mkdir -p /media/${D}$i
mount -t f2fs /dev/${D}$i /media/${D}$i || exit 1
done
### copy apkovl and apk/cache and stuff
rsync -azur --numeric-ids root@my.server.home:sda* /media/ || exit 1
### prepare new apkovl
rm -fr /tmp/template
mkdir -p /tmp/template
tar xzf /media/${S}2/$(hostname).apkovl.tar.gz -C /tmp/template || exit 1
rm /media/${D}2/$(hostname).apkovl.tar.gz
cd /tmp/template
rm -f etc/ssh/ssh_host_*
for f in $(grep -r $(hostname) etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/$(hostname)/${name}/g $f;done
for f in $(grep -r ${S} etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/${S}/${D}/g $f;done
echo "/dev/sdb2 /media/sdb2 ext4 ro,relatime,errors=continue,user_xattr,acl 0 2" > etc/fstab
# remaining partitions are for own stuff
# partition 4 is the extended one
# (we maybe could just skip 3 and directly jump to extended for own stuff to simplify install script)
echo "/dev/sda3 /media/sda3 f2fs defaults,ro 0 2" >> etc/fstab
for i in $(seq 5 16);do echo "/dev/sda$i /media/sda$i f2fs defaults 0 2" >> etc/fstab;done
# partition 2 will hold apkovl and apk/cache
rm etc/apk/cache
ln -s /media/${D}2/cache etc/apk/cache
ln -s /etc/init.d/local etc/runlevels/default/local
tar czf /media/${D}2/${name}.apkovl.tar.gz . || exit 1
### done
sync
umount /media/${D}*
END=$(date +%s)
DURATION=$(($END-$BEGIN))
echo "Manufacture process took $DURATION seconds to complete."
logger "Manufacture process took $DURATION seconds to complete."
reboot
</pre>

Usage: <pre>~:# setup-albox-from-debian mynewbox</pre>

How to make a custom ISO image with mkimage

2017-09-21T12:42:45Z

Jlo: /* Create the ISO */ add usage

This document explains how to build a custom ISO image using the new mkimage scripts located in aports directory.

== Prerequisite ==

First make sure we have the needed tools
{{Cmd|apk add alpine-sdk build-base apk-tools alpine-conf busybox fakeroot syslinux xorriso}}
For efi you shoud add
{{Cmd|mtools dosfstools grub-efi}}

Create a user (e.g. build) and add it to abuild group:
{{Cmd|adduser build -G abuild}}

Then create signing keys (-i installs them in /etc/apk/keys which is required for later)
{{Cmd|abuild-keygen -i -a}}

{{Tip| Make sure your public keys are placed in /etc/apk/keys/ (example: build-xxxxxxxx.rsa.pub):
{{Cmd|ls /etc/apk/keys/}}

Clone (or update) the [http://git.alpinelinux.org/cgit/aports/ git repository].
{{Cmd|git clone git://git.alpinelinux.org/aports}}

Make sure the apk index is up to date (so apk finds the packages):
{{Cmd|apk update}}

== Configuration ==

The mkimg scripts are shipped with pre-configured profiles.

The format is '''mkimg.$PROFILENAME.sh'''

So, in order to have a custom ISO, you should create your own '''mkimg.$PROFILENAME.sh''' script.

This is an example used to have ZFS module, overlayfs (which allows to have /lib/modules in r/w), a serial console output and some other useful apks to build a simple NAS:

<pre>export PROFILENAME=nas</pre>

<pre>
cat << EOF > ~/aports/scripts/mkimg.$PROFILENAME.sh
profile_$PROFILENAME() {
profile_standard
kernel_cmdline="unionfs_size=512M console=tty0 console=ttyS0,115200"
syslinux_serial="0 115200"
kernel_addons="zfs spl"
apks="\$apks iscsi-scst zfs-scripts zfs zfs-utils-py
cciss_vol_status lvm2 mdadm mkinitfs mtools nfs-utils
parted rsync sfdisk syslinux unrar util-linux xfsprogs
dosfstools ntfs-3g
"
local _k _a
for _k in \$kernel_flavors; do
apks="\$apks linux-\$_k"
for _a in \$kernel_addons; do
apks="\$apks \$_a-\$_k"
done
done
apks="\$apks linux-firmware"
}
EOF
</pre>

Set the script as executable:
{{Cmd|chmod +x mkimg.$PROFILENAME.sh}}

== Create the ISO ==

{{Cmd|mkimage.sh [--tag RELEASE] [--outdir OUTDIR] [--workdir WORKDIR]
[--arch ARCH] [--profile PROFILE] [--hostkeys] [--simulate]
[--repository REPO] [--extra-repository REPO] [--yaml FILE]
mkimage.sh --help

options:
--arch Specify which architecture images to build
(default: x86_64)
--hostkeys Copy system apk signing keys to created images
--outdir Specify directory for the created images
--profile Specify which profiles to build
--repository Package repository to use for the image create
--extra-repository Add repository to search packages from
--simulate Don't execute commands
--tag Build images for tag RELEASE
--workdir Specify temporary working directory (cache)
--yaml

known profiles: ali rpi uboot base minirootfs standard vanilla extended virt xen}}

Create a iso directory in your home dir:

{{Cmd|mkdir -p ~/iso}}

Then create the actual ISO.
In this example we will use the edge version x86_64:
{{Cmd|sh mkimage.sh --tag edge \
--outdir ~/iso \
--arch x86_64 \
--repository http://dl-cdn.alpinelinux.org/alpine/edge/main \
--profile $PROFILENAME
}}

'''Notes:'''

Of course, several passages of this doc can be automated with a script, like the repository/arch/outdir settings.
This steps are left to you and to your imagination :)

== Testing your ISO image ==

[[Qemu#Live_mode| Qemu]] is useful for a quick test of your created ISO image.

[[Category:Package Manager]]
[[Category:ISO]]

User:Jlo

2017-09-20T07:00:54Z

Jlo:

I was [[User:Jch]] but I forgot my passwd and the email used to suscribe is not valid anymore...

I'm today senior system architect at some startup. 
We are building a network of embedded devices controlling hardware stuff. 
I'm stepping it as the product is transitioning from prototype phase to industrial phase.

The main app is written for Oracle Java8 and running in Apache/Karaf environment.

The proto was done with Debian Jessie boxes managed with salt stack (about 100).

I would like to see the boxes running AL in ''run-from-ram'' mode pulling the apkovl tarball (or at least some tarball to be applied in the /etc/local.d sequence) from a remote server somewhere in the cloud. 
To upgrade would just to rsync the normally read-only SSD and reboot.

To achieve this with AlpineLinux, one has to:

* deploy [[User:Jlo/java8|Oracle Java 7 with glibc]]
* deploy [[User:Jlo/java8|Oracle Java 8 with glibc]]
* deploy [[User:Jlo/python27|python2.7 with needed libs]]
* deploy [[User:Jlo/python3|python3 with needed libs]]
* deploy [[User:Jlo/watchdog|hardware watchdog]]
* deploy [[User:Jlo/network|network drivers]] (eth, usb-eth, wlan, 3g, lte)
* deploy [[User:Jlo/usb|USB drivers]]
* rewrite [[User:Jlo/init|init scripts]]
* prepare a [[User:Jlo/image|custom image]] with every needed packages locally present in disk repo
* adapt [[User:Jlo/packages|custom packages]] from deb to apk ones

To configure a box is done in two parts:

* the network. done locally
* the app layer. done via a webinterface; commited to a server and download by the box at each boot.

The advantages of such architecture are:

* power failure resilient as the system runs from ram The only PoF here is when an upgrade of the read-only medium is done
* boxes use a pull mechanism to stay up-to-date ensuring the right version at any next reboot This protect us against out-of-sync boxes arraising often with push architecture (salt, ansible, ...)
* the two steps boot sequence allows us to temporary take control over a box for maintenance with a totally different setup and as we always keep an ssh access via the VPN, we can force that anytime we want (hardware watchdog being our friend here)
* easy to reproduce in VM for testing (including load tests)

Disadvantages are:

* need own repo with access control to distribute Oracle Java internally without breach of license (but it is the same situation for any distro)
* some used packages are distributed as deb only (from artifactory between others) will need to script part of the CI towards apk generation... will need to check every deb to see if sources are available...

----

See also [[User:Jlo/Replacing_Debian_Jessie_with_Alpine_remotely|Replacing Debian Jessie with Alpine remotely]]

Talk:PXE boot

2017-09-18T16:16:06Z

Jlo: /* Running Alpine PXE server in sys mode */ new section

== Details for generating pxerd ==

This is how I do it to prepare a PXEboot for qemu machines from a ''run-from-ram-from-cdrom'' <pre>
setup-interfaces
/etc/init.d/networking start
setup-proxy
. /etc/profile.d/proxy.sh
setup-apkrepos
apk update
apk add mkinitfs openssh-client
cd /etc/mkinitfs/features.d/
echo "kernel/drivers/net/virtio_net.ko" >> network.modules
echo "/usr/share/udhcpc/default.script" > dhcp.files
echo "kernel/net/packet/af_packet.ko" > dhcp.modules
echo "kernel/fs/nfs/*" > nfs.modules
cd /etc/mkinitfs/
echo 'features="ata base bootchart cdrom cramfs ext2 ext3 ext4 xfs floppy keymap kms raid scsi usb virtio squashfs network dhcp nfs"' > mkinitfs.conf
mkinitfs -o /root/pxerd
scp /root/pxerd $TFTPSERVER:$TFTPPATH
scp /media/cdrom/boot/vmlinuz-grsec $TFTPSERVER:$TFTPPATH
scp -r /media/cdrom/* $NFSSERVER:$NFSPATH
</pre>

For your specific setup, adjust the network.modules with needed kernel drivers.

--[[User:Jch|Jch]] ([[User talk:Jch|talk]]) 09:00, 16 March 2015 (UTC)

== Packages not in the initial ISO ==

Be sure to have a local repo on the LAN with all needed package and to specify (alpine_repo=http://...) it the APPEND line of the pxelinux.cfg/config_file!

== Running Alpine PXE server in sys mode ==

<pre>
pxeal:~# cat /etc/apk/world
acct
alpine-base
dnsmasq
e2fsprogs
iptables
lighttpd
linux-hardened
nfs-utils
openssh
syslinux
</pre>

<pre>
pxeal:~# lbu ls
etc/fstab
etc/conf.d/keymaps
etc/mkinitfs/mkinitfs.conf
etc/mkinitfs/features.d/dhcp.files
etc/mkinitfs/features.d/dhcp.modules
etc/mkinitfs/features.d/network.modules
etc/mkinitfs/features.d/nfs.modules
etc/runlevels/shutdown/savecache
etc/runlevels/shutdown/killprocs
etc/runlevels/shutdown/mount-ro
etc/runlevels/sysinit/hwdrivers
etc/runlevels/sysinit/mdev
etc/runlevels/sysinit/dmesg
etc/runlevels/sysinit/devfs
etc/runlevels/default/lighttpd
etc/runlevels/default/sshd
etc/runlevels/default/iptables
etc/runlevels/default/nfs
etc/runlevels/default/crond
etc/runlevels/default/dnsmasq
etc/runlevels/default/acpid
etc/runlevels/boot/keymaps
etc/runlevels/boot/sysctl
etc/runlevels/boot/bootmisc
etc/runlevels/boot/syslog
etc/runlevels/boot/modules
etc/runlevels/boot/swap
etc/runlevels/boot/networking
etc/runlevels/boot/urandom
etc/runlevels/boot/hostname
etc/runlevels/boot/hwclock
etc/resolv.conf
etc/update-extlinux.conf
etc/iptables/rules-save
etc/shadow
etc/network/interfaces
etc/keymap/
etc/keymap/be.bmap.gz
etc/dnsmasq.d/pxeboot.conf
etc/passwd-
etc/group-
etc/hosts
etc/sysctl.d/01-manufacture.conf
etc/shadow-
etc/group
etc/passwd
etc/ssh/ssh_host_ed25519_key
etc/ssh/ssh_host_rsa_key.pub
etc/ssh/ssh_host_ecdsa_key.pub
etc/ssh/ssh_host_dsa_key.pub
etc/ssh/ssh_host_rsa_key
etc/ssh/ssh_host_ed25519_key.pub
etc/ssh/ssh_host_dsa_key
etc/ssh/ssh_host_ecdsa_key
etc/fstab.old
etc/apk/arch
etc/apk/protected_paths.d/lbu.list
etc/apk/keys/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub
etc/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub
etc/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub
etc/apk/repositories
etc/apk/world
etc/zoneinfo/
etc/zoneinfo/Europe/
etc/zoneinfo/Europe/Zurich
etc/localtime
etc/hostname
etc/exports
var/www/localhost/htdocs/pxe-default.apkovl.tar.gz
var/www/localhost/htdocs/modloop-hardened
var/lib/tftpboot/pxelinux/pxelinux.cfg/default
var/lib/tftpboot/pxelinux/pxelinux.0
var/lib/tftpboot/pxelinux/initramfs-hardened
var/lib/tftpboot/pxelinux/ldlinux.c32
var/lib/tftpboot/pxelinux/vmlinuz-hardened
root/.ssh/authorized_keys
</pre > 114.8M '''pxeal.apkovl.tar.gz'''

with custom made initramfs along first note.

Dualbooting

2017-09-07T11:19:25Z

Jlo: /* Installing bootloader manually */

Assume you have a box where you run Ubuntu or your favourite distro. Now you would like to be able to boot either your already installed system or Alpine.

= Prepare your hardware =
You will need a partition for your Alpine installation. If you don't already have one free, you need to create a primary partition with enough space for your Alpine installation. The tools you use for managing your partitions might differ, so you need to figure out your self how to use them. <tt>fdisk</tt> can help.

Make notes of what partition you will use for your Alpine installation. In this example we are going to install Alpine on '''/dev/sda3'''.

= Installing Alpine on HDD =

Now it's time to install Alpine. Boot your system with a CD containing the latest Alpine Standard from [http://alpinelinux.org/downloads Downloads].

== Format and mount HDD partition ==

First format your partition. We will need some tools for doing the formatting. After you are done those tools can be removed.

{{Cmd|apk add e2fsprogs
mkfs.ext3 /dev/sda3
apk del e2fsprogs}}

{{Warning|Make sure you format the right partition! The {{Path|/dev/sda3}} is only a example. If you choose the wrong partition your data will be gone. Make a backup first when you are unsure.}}

Mount the newly formatted partition. After the mounting the partition will be available at {{Path|/mnt}}.
{{Cmd|mount -t ext3 /dev/sda3 /mnt}}

== Basic setup ==

Next, do some basic setup for your Alpine system.

In Alpine 2.2.3 or newer, type:
{{Cmd|setup-timezone
setup-alpine -q
setup-sshd
setup-ntp}}

See [[setup-alpine]] for more details. (If you omit the <code>-q</code> flag to <code>setup-alpine</code>, you'll be prompted "Which disks yous you like to use?" Answer "none", and also answer "none" to the remaining prompts, about storing configs and an apk cache directory.)



== Install Alpine ==

Now it's time to put our files on the partition.

If using Alpine Linux 2.2.3 or higher, just type:
{{Cmd|setup-disk -m sys /mnt}}

{{Tip|If you use extlinux and you didn't create a separate boot partition ({{Path|/boot}} is on the root partition {{Path|/}}), you might need to update the path to vmlinuz in {{Path|/boot/extlinux.conf}}, eg.:
<pre>[...]
LABEL grsec
MENU DEFAULT
MENU LABEL Linux grsec
LINUX /boot/vmlinuz-grsec
[...]</pre>
}}

If using an earlier version of Alpine Linux, you'll need to install the files and bootloader manually, as described below.

=== Installing files manually ===

{{Tip|If using a version of Alpine Linux older than 2.2.0, replace {{Path|/etc/apk/world}} in the last line with {{Path|/var/lib/apk/world}}}}

{{Cmd|lbu package - {{!}} tar -C /mnt -xzf -
apk add --root /mnt --initdb --repositories-file /etc/apk/repositores --keys-dir \
/etc/apk/keys $(cat /etc/apk/world) acct linux-grsec alpine-base}}

Your system is now on {{Path|/dev/sda3}}. Next thing is to be able to boot on it.

=== Installing bootloader manually ===

On your system you already have a bootloader of some kind. The bootloaders vary, so you need to figure out how to make it boot your Alpine distro. Hopefully you get some ideas by looking at the following example below.

In my case I have Grub2 so I will describe what I did to boot Alpine.

Reboot your system ''(start Ubuntu)''.

Start a 'terminal' ''(ALT-F2 + "terminal" + [Run])''

Take notes of the UUID of the partition you are planning to use:
{{Cmd|sudo blkid /dev/sda3}}

Start editing grub2 configuration
{{Cmd|gksudo gedit /etc/grub.d/40_custom}}

I edited the file so it looks something like this:
<pre>#!/bin/sh
echo "Adding Alpine" >&2
cat << EOF
menuentry "Alpine Linux" {
set root=(hd0,3)
linux /boot/vmlinuz-grsec root=UUID=8de6973a-4a8c-40ed-b710-c4e2b42d6b7a modules=sd-mod,usb-storage,ext3 quiet
initrd /boot/initramfs-grsec
}
EOF</pre>
{{Note|The UUID-value mentioned above '8de6973a-4a8c-40ed-b710-c4e2b42d6b7a' should be replaced with the UUID you got when running your 'blkid' command.}}
We need to tell grub2 that the config has changed
{{Cmd|update-grub2}}

Now it's time to test. Reboot your box.
{{Note|You might need to press SHIFT when booting up your box in order to see the grub-menu.}}

[[Category:Installation]]

User:Jlo/Replacing Debian Jessie with Alpine remotely

2017-08-18T14:50:12Z

Jlo: /* Stage 2 */

I want to "upgrade" 130 remote Debian Jessie embedded boxes to AlpineLinux in ''run-from-ram'' mode.
I have already successfully and happily validated the second stage as this is a minor variation around the "setup-ownbox" script I have added to a standard USB-KEY apkovl.

== Stage 1 ==

something is wrong about init at reboot time :(

prepare-jessie-for-alpine <pre>
#!/bin/sh
# this must be fully automatic
export DEBIAN_FRONTEND=noninteractive
apt-get -y install rsync extlinux
# /boot is a separate partition
rm -fr /boot/boot
ln -sf . /boot/boot
# let's get system file from our install server
rsync -avzur my.server.home:debian/boot/* /boot/
rsync -avzur my.server.home:debian/apks /boot/
rsync -avzu my.server.home:debian/debian.apkovl.tar.gz /boot/
rsync -auv my.server.home:debian/.alpine-release /boot/
# prepare the config overlay
rm -fr /tmp/apkovl
mkdir /tmp/apkovl
tar xzf /boot/debian.apkovl.tar.gz -C /tmp/apkovl
# keep current active network connection(s) and identity
cp /etc/network/interfaces /tmp/apkovl/etc/network/
cp -r /etc/openvpn /tmp/apkovl/etc/
cp -r /etc/ssh /tmp/apkovl/etc/
cd /tmp/apkovl
# be sure the install media was not already customized for own apps
unlink etc/runlevels/default/local
# be sure active VPN connections are preserved
mkdir -p /tmp/apkovl/etc/init.d
for v in /tmp/apkovl/etc/openvpn/*.conf ; do
vn=$(basename $v|cut -d. -f1)
ln -fs openvpn /tmp/apkovl/etc/init.d/openvpn.$vn
ln -fs /etc/init.d/openvpn.$vn /tmp/apkovl/etc/runlevels/default/openvpn.$vn
done
# config done ; commit
tar czf /boot/debian.apkovl.tar.gz .
# now the booltoader ; this will kill the active grub...
cat > /boot/extlinux.conf << EOF
timeout 20
prompt 1
default hardened
label hardened
kernel /boot/vmlinuz-hardened
initrd /boot/initramfs-hardened
append alpine_dev=sda1:ext2 modloop=modloop-hardened modules=loop,cramfs,sd-mod,usb-storage,ext2 quiet
EOF
dd if=/usr/lib/syslinux/mbr/mbr.bin of=/dev/sda
extlinux -i /boot
# done
sync
reboot
</pre>

usage: <pre>~:# prepare-jessie-for-alpine</pre>

== Stage 2 ==

not tested yet in this procedure but used successfully (a small variant) to prepare new AL boxes.

setup-albox-from-debian <pre>
#!/bin/sh
BEGIN=$(date +%s)
name=$1
D=sda
echo "Manufacturing box named *${name}*..."
rc-service modloop stop
umount /media/${D}* || (echo "Unable to unmount ${D}. Aborting..." ; exit 1)
### Partition the SSD $D
# f2fs want partition of type ext2 in parted
parted -a cylinder -s /dev/${D} -- \
mklabel msdos \
mkpart primary fat32 0% 1% \
mkpart primary ext2 1% 2% \
mkpart primary ext2 2% 7% \
mkpart extended 7% 100% \
mkpart logical ext2 7% 9% \
mkpart logical ext2 9% 15% \
mkpart logical ext2 15% 20% \
mkpart logical ext2 21% 22% \
mkpart logical ext2 22% 23% \
mkpart logical ext2 23% 24% \
mkpart logical ext2 24% 25% \
mkpart logical ext2 25% 26% \
mkpart logical ext2 26% 27% \
mkpart logical ext2 27% 28% \
mkpart logical ext2 28% 29% \
mkpart logical ext2 29% 30% \
set 1 boot on \
|| exit 1
### prepare boot partition
mkfs.vfat /dev/${D}1 || exit 1
mkdir -p /media/${D}1
setup-bootable /media/${B} /dev/${D}1 || exit 1
mount -t vfat /dev/${D}1 /media/${D}1 || exit 1
### format partition to hold apkovl and apk/cache; it must be of ext? type
mkfs.ext4 -F -q /dev/${D}2 || exit 1
mkdir -p /media/${D}2
mount -t ext4 /dev/${D}2 /media/${D}2 || exit 1
### format remaining partitions with f2fs
for i in $(seq 3 16);do
[ $i -eq 4 ] && continue
mkfs.f2fs -q /dev/${D}$i || exit 1
mkdir -p /media/${D}$i
mount -t f2fs /dev/${D}$i /media/${D}$i || exit 1
done
### copy apkovl and apk/cache and stuff
rsync -azur --numeric-ids root@my.server.home:sda* /media/ || exit 1
### prepare new apkovl
rm -fr /tmp/template
mkdir -p /tmp/template
tar xzf /media/${S}2/$(hostname).apkovl.tar.gz -C /tmp/template || exit 1
rm /media/${D}2/$(hostname).apkovl.tar.gz
cd /tmp/template
rm -f etc/ssh/ssh_host_*
for f in $(grep -r $(hostname) etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/$(hostname)/${name}/g $f;done
for f in $(grep -r ${S} etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/${S}/${D}/g $f;done
echo "/dev/sdb2 /media/sdb2 ext4 ro,relatime,errors=continue,user_xattr,acl 0 2" > etc/fstab
# remaining partitions are for own stuff
# partition 4 is the extended one
# (we maybe could just skip 3 and directly jump to extended for own stuff to simplify install script)
echo "/dev/sda3 /media/sda3 f2fs defaults,ro 0 2" >> etc/fstab
for i in $(seq 5 16);do echo "/dev/sda$i /media/sda$i f2fs defaults 0 2" >> etc/fstab;done
# partition 2 will hold apkovl and apk/cache
rm etc/apk/cache
ln -s /media/${D}2/cache etc/apk/cache
ln -s /etc/init.d/local etc/runlevels/default/local
tar czf /media/${D}2/${name}.apkovl.tar.gz . || exit 1
### done
sync
umount /media/${D}*
END=$(date +%s)
DURATION=$(($END-$BEGIN))
echo "Manufacture process took $DURATION seconds to complete."
logger "Manufacture process took $DURATION seconds to complete."
reboot
</pre>

Usage: <pre>~:# setup-albox-from-debian mynewbox</pre>

User:Jlo/Replacing Debian Jessie with Alpine remotely

2017-08-18T14:42:37Z

Jlo:

I want to "upgrade" 130 remote Debian Jessie embedded boxes to AlpineLinux in ''run-from-ram'' mode.
I have already successfully and happily validated the second stage as this is a minor variation around the "setup-ownbox" script I have added to a standard USB-KEY apkovl.

== Stage 1 ==

something is wrong about init at reboot time :(

prepare-jessie-for-alpine <pre>
#!/bin/sh
# this must be fully automatic
export DEBIAN_FRONTEND=noninteractive
apt-get -y install rsync extlinux
# /boot is a separate partition
rm -fr /boot/boot
ln -sf . /boot/boot
# let's get system file from our install server
rsync -avzur my.server.home:debian/boot/* /boot/
rsync -avzur my.server.home:debian/apks /boot/
rsync -avzu my.server.home:debian/debian.apkovl.tar.gz /boot/
rsync -auv my.server.home:debian/.alpine-release /boot/
# prepare the config overlay
rm -fr /tmp/apkovl
mkdir /tmp/apkovl
tar xzf /boot/debian.apkovl.tar.gz -C /tmp/apkovl
# keep current active network connection(s) and identity
cp /etc/network/interfaces /tmp/apkovl/etc/network/
cp -r /etc/openvpn /tmp/apkovl/etc/
cp -r /etc/ssh /tmp/apkovl/etc/
cd /tmp/apkovl
# be sure the install media was not already customized for own apps
unlink etc/runlevels/default/local
# be sure active VPN connections are preserved
mkdir -p /tmp/apkovl/etc/init.d
for v in /tmp/apkovl/etc/openvpn/*.conf ; do
vn=$(basename $v|cut -d. -f1)
ln -fs openvpn /tmp/apkovl/etc/init.d/openvpn.$vn
ln -fs /etc/init.d/openvpn.$vn /tmp/apkovl/etc/runlevels/default/openvpn.$vn
done
# config done ; commit
tar czf /boot/debian.apkovl.tar.gz .
# now the booltoader ; this will kill the active grub...
cat > /boot/extlinux.conf << EOF
timeout 20
prompt 1
default hardened
label hardened
kernel /boot/vmlinuz-hardened
initrd /boot/initramfs-hardened
append alpine_dev=sda1:ext2 modloop=modloop-hardened modules=loop,cramfs,sd-mod,usb-storage,ext2 quiet
EOF
dd if=/usr/lib/syslinux/mbr/mbr.bin of=/dev/sda
extlinux -i /boot
# done
sync
reboot
</pre>

usage: <pre>~:# prepare-jessie-for-alpine</pre>

== Stage 2 ==

not tested yet in this procedure but used successfully (a small variant) to prepare new AL boxes.

setup-albox-from-debian <pre>
#!/bin/sh
BEGIN=$(date +%s)
name=$1
D=sda
echo "Manufacturing box named *${name}*..."
rc-service modloop stop
umount /media/${D}* || (echo "Unable to unmount ${D}. Aborting..." ; exit 1)
### Partition the SSD $D
# f2fs want partition of type ext2 in parted
parted -a cylinder -s /dev/${D} -- \
mklabel msdos \
mkpart primary fat32 0% 1% \
mkpart primary ext2 1% 2% \
mkpart primary ext2 2% 7% \
mkpart extended 7% 100% \
mkpart logical ext2 7% 9% \
mkpart logical ext2 9% 15% \
mkpart logical ext2 15% 20% \
mkpart logical ext2 21% 22% \
mkpart logical ext2 22% 23% \
mkpart logical ext2 23% 24% \
mkpart logical ext2 24% 25% \
mkpart logical ext2 25% 26% \
mkpart logical ext2 26% 27% \
mkpart logical ext2 27% 28% \
mkpart logical ext2 28% 29% \
mkpart logical ext2 29% 30% \
set 1 boot on \
|| exit 1
### prepare boot partition
mkfs.vfat /dev/${D}1 || exit 1
mkdir -p /media/${D}1
setup-bootable /media/${B} /dev/${D}1 || exit 1
mount -t vfat /dev/${D}1 /media/${D}1 || exit 1
### format partition to hold apkovl and apk/cache; it must be of ext? type
mkfs.ext4 -F -q /dev/${D}2 || exit 1
mkdir -p /media/${D}2
mount -t ext4 /dev/${D}2 /media/${D}2 || exit 1
### format remaining partitions with f2fs
for i in $(seq 3 16);do
[ $i -eq 4 ] && continue
mkfs.f2fs -q /dev/${D}$i || exit 1
mkdir -p /media/${D}$i
mount -t f2fs /dev/${D}$i /media/${D}$i || exit 1
mkdir -p /media/${D}$i/.wd
chmod 777 /media/${D}$i/.wd
chmod +t /media/${D}$i/.wd
done
### copy apkovl and apk/cache and stuff
rsync -azur --numeric-ids root@my.server.home:sda* /media/ || exit 1
### prepare new apkovl
rm -fr /tmp/template
mkdir -p /tmp/template
tar xzf /media/${S}2/$(hostname).apkovl.tar.gz -C /tmp/template || exit 1
rm /media/${D}2/$(hostname).apkovl.tar.gz
cd /tmp/template
rm -f etc/ssh/ssh_host_*
for f in $(grep -r $(hostname) etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/$(hostname)/${name}/g $f;done
for f in $(grep -r ${S} etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/${S}/${D}/g $f;done
echo "/dev/sdb2 /media/sdb2 ext4 ro,relatime,errors=continue,user_xattr,acl 0 2" > etc/fstab
echo "/dev/sda3 /media/sda3 f2fs defaults,ro 0 2" >> etc/fstab
for i in $(seq 5 16);do echo "/dev/sda$i /media/sda$i f2fs defaults 0 2" >> etc/fstab;done
echo "With great power comes great responsibility!" > etc/motd
mkdir -p etc/manufacture
date +%s > etc/manufacture/manufactured
date >> etc/manufacture/manufactured
rm etc/apk/cache
ln -s /media/${D}2/cache etc/apk/cache
ln -s /etc/init.d/local etc/runlevels/default/local
tar czf /media/${D}2/${name}.apkovl.tar.gz . || exit 1
### copy installed system to proxy partition
rsync -aur --numeric-ids /media/${D}1 /media/${D}5/ || exit 1
### done
sync
umount /media/${D}*
END=$(date +%s)
DURATION=$(($END-$BEGIN))
echo "Manufacture process took $DURATION seconds to complete."
logger "Manufacture process took $DURATION seconds to complete."
reboot
</pre>

Usage: <pre>~:# setup-albox-from-debian mynewbox</pre>

User:Jlo/Replacing Debian Jessie with Alpine remotely

2017-08-18T14:41:23Z

Jlo:

I want to "upgrade" 130 remote Debian Jessie embedded boxes with AlpineLinux in ''run-from-ram'' mode.
I have already successfully and happily validated the second stage as this is a minor variation around the "setup-ownbox" script I have added to a standard USB-KEY apkovl.

== Stage 1 ==

something is wrong about init at reboot time :(

prepare-jessie-for-alpine <pre>
#!/bin/sh
# this must be fully automatic
export DEBIAN_FRONTEND=noninteractive
apt-get -y install rsync extlinux
# /boot is a separate partition
rm -fr /boot/boot
ln -sf . /boot/boot
# let's get system file from our install server
rsync -avzur my.server.home:debian/boot/* /boot/
rsync -avzur my.server.home:debian/apks /boot/
rsync -avzu my.server.home:debian/debian.apkovl.tar.gz /boot/
rsync -auv my.server.home:debian/.alpine-release /boot/
# prepare the config overlay
rm -fr /tmp/apkovl
mkdir /tmp/apkovl
tar xzf /boot/debian.apkovl.tar.gz -C /tmp/apkovl
# keep current active network connection(s) and identity
cp /etc/network/interfaces /tmp/apkovl/etc/network/
cp -r /etc/openvpn /tmp/apkovl/etc/
cp -r /etc/ssh /tmp/apkovl/etc/
cd /tmp/apkovl
# be sure the install media was not already customized for own apps
unlink etc/runlevels/default/local
# be sure active VPN connections are preserved
mkdir -p /tmp/apkovl/etc/init.d
for v in /tmp/apkovl/etc/openvpn/*.conf ; do
vn=$(basename $v|cut -d. -f1)
ln -fs openvpn /tmp/apkovl/etc/init.d/openvpn.$vn
ln -fs /etc/init.d/openvpn.$vn /tmp/apkovl/etc/runlevels/default/openvpn.$vn
done
# config done ; commit
tar czf /boot/debian.apkovl.tar.gz .
# now the booltoader ; this will kill the active grub...
cat > /boot/extlinux.conf << EOF
timeout 20
prompt 1
default hardened
label hardened
kernel /boot/vmlinuz-hardened
initrd /boot/initramfs-hardened
append alpine_dev=sda1:ext2 modloop=modloop-hardened modules=loop,cramfs,sd-mod,usb-storage,ext2 quiet
EOF
dd if=/usr/lib/syslinux/mbr/mbr.bin of=/dev/sda
extlinux -i /boot
# done
sync
reboot
</pre>

usage: <pre>~:# prepare-jessie-for-alpine</pre>

== Stage 2 ==

not tested yet in this procedure but used successfully (a small variant) to prepare new AL boxes.

setup-albox-from-debian <pre>
#!/bin/sh
BEGIN=$(date +%s)
name=$1
D=sda
echo "Manufacturing box named *${name}*..."
rc-service modloop stop
umount /media/${D}* || (echo "Unable to unmount ${D}. Aborting..." ; exit 1)
### Partition the SSD $D
# f2fs want partition of type ext2 in parted
parted -a cylinder -s /dev/${D} -- \
mklabel msdos \
mkpart primary fat32 0% 1% \
mkpart primary ext2 1% 2% \
mkpart primary ext2 2% 7% \
mkpart extended 7% 100% \
mkpart logical ext2 7% 9% \
mkpart logical ext2 9% 15% \
mkpart logical ext2 15% 20% \
mkpart logical ext2 21% 22% \
mkpart logical ext2 22% 23% \
mkpart logical ext2 23% 24% \
mkpart logical ext2 24% 25% \
mkpart logical ext2 25% 26% \
mkpart logical ext2 26% 27% \
mkpart logical ext2 27% 28% \
mkpart logical ext2 28% 29% \
mkpart logical ext2 29% 30% \
set 1 boot on \
|| exit 1
### prepare boot partition
mkfs.vfat /dev/${D}1 || exit 1
mkdir -p /media/${D}1
setup-bootable /media/${B} /dev/${D}1 || exit 1
mount -t vfat /dev/${D}1 /media/${D}1 || exit 1
### format partition to hold apkovl and apk/cache; it must be of ext? type
mkfs.ext4 -F -q /dev/${D}2 || exit 1
mkdir -p /media/${D}2
mount -t ext4 /dev/${D}2 /media/${D}2 || exit 1
### format remaining partitions with f2fs
for i in $(seq 3 16);do
[ $i -eq 4 ] && continue
mkfs.f2fs -q /dev/${D}$i || exit 1
mkdir -p /media/${D}$i
mount -t f2fs /dev/${D}$i /media/${D}$i || exit 1
mkdir -p /media/${D}$i/.wd
chmod 777 /media/${D}$i/.wd
chmod +t /media/${D}$i/.wd
done
### copy apkovl and apk/cache and stuff
rsync -azur --numeric-ids root@my.server.home:sda* /media/ || exit 1
### prepare new apkovl
rm -fr /tmp/template
mkdir -p /tmp/template
tar xzf /media/${S}2/$(hostname).apkovl.tar.gz -C /tmp/template || exit 1
rm /media/${D}2/$(hostname).apkovl.tar.gz
cd /tmp/template
rm -f etc/ssh/ssh_host_*
for f in $(grep -r $(hostname) etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/$(hostname)/${name}/g $f;done
for f in $(grep -r ${S} etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/${S}/${D}/g $f;done
echo "/dev/sdb2 /media/sdb2 ext4 ro,relatime,errors=continue,user_xattr,acl 0 2" > etc/fstab
echo "/dev/sda3 /media/sda3 f2fs defaults,ro 0 2" >> etc/fstab
for i in $(seq 5 16);do echo "/dev/sda$i /media/sda$i f2fs defaults 0 2" >> etc/fstab;done
echo "With great power comes great responsibility!" > etc/motd
mkdir -p etc/manufacture
date +%s > etc/manufacture/manufactured
date >> etc/manufacture/manufactured
rm etc/apk/cache
ln -s /media/${D}2/cache etc/apk/cache
ln -s /etc/init.d/local etc/runlevels/default/local
tar czf /media/${D}2/${name}.apkovl.tar.gz . || exit 1
### copy installed system to proxy partition
rsync -aur --numeric-ids /media/${D}1 /media/${D}5/ || exit 1
### done
sync
umount /media/${D}*
END=$(date +%s)
DURATION=$(($END-$BEGIN))
echo "Manufacture process took $DURATION seconds to complete."
logger "Manufacture process took $DURATION seconds to complete."
reboot
</pre>

Usage: <pre>~:# setup-albox-from-debian mynewbox</pre>

User:Jlo/Replacing Debian Jessie with Alpine remotely

2017-08-18T14:36:23Z

Jlo: /* Stage 1 */ typo

== Stage 1 ==

something is wrong about init at reboot time :(

prepare-jessie-for-alpine <pre>
#!/bin/sh
# this must be fully automatic
export DEBIAN_FRONTEND=noninteractive
apt-get -y install rsync extlinux
# /boot is a separate partition
rm -fr /boot/boot
ln -sf . /boot/boot
# let's get system file from our install server
rsync -avzur my.server.home:debian/boot/* /boot/
rsync -avzur my.server.home:debian/apks /boot/
rsync -avzu my.server.home:debian/debian.apkovl.tar.gz /boot/
rsync -auv my.server.home:debian/.alpine-release /boot/
# prepare the config overlay
rm -fr /tmp/apkovl
mkdir /tmp/apkovl
tar xzf /boot/debian.apkovl.tar.gz -C /tmp/apkovl
# keep current active network connection(s) and identity
cp /etc/network/interfaces /tmp/apkovl/etc/network/
cp -r /etc/openvpn /tmp/apkovl/etc/
cp -r /etc/ssh /tmp/apkovl/etc/
cd /tmp/apkovl
# be sure the install media was not already customized for own apps
unlink etc/runlevels/default/local
# be sure active VPN connections are preserved
mkdir -p /tmp/apkovl/etc/init.d
for v in /tmp/apkovl/etc/openvpn/*.conf ; do
vn=$(basename $v|cut -d. -f1)
ln -fs openvpn /tmp/apkovl/etc/init.d/openvpn.$vn
ln -fs /etc/init.d/openvpn.$vn /tmp/apkovl/etc/runlevels/default/openvpn.$vn
done
# config done ; commit
tar czf /boot/debian.apkovl.tar.gz .
# now the booltoader ; this will kill the active grub...
cat > /boot/extlinux.conf << EOF
timeout 20
prompt 1
default hardened
label hardened
kernel /boot/vmlinuz-hardened
initrd /boot/initramfs-hardened
append alpine_dev=sda1:ext2 modloop=modloop-hardened modules=loop,cramfs,sd-mod,usb-storage,ext2 quiet
EOF
dd if=/usr/lib/syslinux/mbr/mbr.bin of=/dev/sda
extlinux -i /boot
# done
sync
reboot
</pre>

usage: <pre>~:# prepare-jessie-for-alpine</pre>

== Stage 2 ==

not tested yet in this procedure but used successfully (a small variant) to prepare new AL boxes.

setup-albox-from-debian <pre>
#!/bin/sh
BEGIN=$(date +%s)
name=$1
D=sda
echo "Manufacturing box named *${name}*..."
rc-service modloop stop
umount /media/${D}* || (echo "Unable to unmount ${D}. Aborting..." ; exit 1)
### Partition the SSD $D
# f2fs want partition of type ext2 in parted
parted -a cylinder -s /dev/${D} -- \
mklabel msdos \
mkpart primary fat32 0% 1% \
mkpart primary ext2 1% 2% \
mkpart primary ext2 2% 7% \
mkpart extended 7% 100% \
mkpart logical ext2 7% 9% \
mkpart logical ext2 9% 15% \
mkpart logical ext2 15% 20% \
mkpart logical ext2 21% 22% \
mkpart logical ext2 22% 23% \
mkpart logical ext2 23% 24% \
mkpart logical ext2 24% 25% \
mkpart logical ext2 25% 26% \
mkpart logical ext2 26% 27% \
mkpart logical ext2 27% 28% \
mkpart logical ext2 28% 29% \
mkpart logical ext2 29% 30% \
set 1 boot on \
|| exit 1
### prepare boot partition
mkfs.vfat /dev/${D}1 || exit 1
mkdir -p /media/${D}1
setup-bootable /media/${B} /dev/${D}1 || exit 1
mount -t vfat /dev/${D}1 /media/${D}1 || exit 1
### format partition to hold apkovl and apk/cache; it must be of ext? type
mkfs.ext4 -F -q /dev/${D}2 || exit 1
mkdir -p /media/${D}2
mount -t ext4 /dev/${D}2 /media/${D}2 || exit 1
### format remaining partitions with f2fs
for i in $(seq 3 16);do
[ $i -eq 4 ] && continue
mkfs.f2fs -q /dev/${D}$i || exit 1
mkdir -p /media/${D}$i
mount -t f2fs /dev/${D}$i /media/${D}$i || exit 1
mkdir -p /media/${D}$i/.wd
chmod 777 /media/${D}$i/.wd
chmod +t /media/${D}$i/.wd
done
### copy apkovl and apk/cache and stuff
rsync -azur --numeric-ids root@my.server.home:sda* /media/ || exit 1
### prepare new apkovl
rm -fr /tmp/template
mkdir -p /tmp/template
tar xzf /media/${S}2/$(hostname).apkovl.tar.gz -C /tmp/template || exit 1
rm /media/${D}2/$(hostname).apkovl.tar.gz
cd /tmp/template
rm -f etc/ssh/ssh_host_*
for f in $(grep -r $(hostname) etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/$(hostname)/${name}/g $f;done
for f in $(grep -r ${S} etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/${S}/${D}/g $f;done
echo "/dev/sdb2 /media/sdb2 ext4 ro,relatime,errors=continue,user_xattr,acl 0 2" > etc/fstab
echo "/dev/sda3 /media/sda3 f2fs defaults,ro 0 2" >> etc/fstab
for i in $(seq 5 16);do echo "/dev/sda$i /media/sda$i f2fs defaults 0 2" >> etc/fstab;done
echo "With great power comes great responsibility!" > etc/motd
mkdir -p etc/manufacture
date +%s > etc/manufacture/manufactured
date >> etc/manufacture/manufactured
rm etc/apk/cache
ln -s /media/${D}2/cache etc/apk/cache
ln -s /etc/init.d/local etc/runlevels/default/local
tar czf /media/${D}2/${name}.apkovl.tar.gz . || exit 1
### copy installed system to proxy partition
rsync -aur --numeric-ids /media/${D}1 /media/${D}5/ || exit 1
### done
sync
umount /media/${D}*
END=$(date +%s)
DURATION=$(($END-$BEGIN))
echo "Manufacture process took $DURATION seconds to complete."
logger "Manufacture process took $DURATION seconds to complete."
reboot
</pre>

Usage: <pre>~:# setup-albox-from-debian mynewbox</pre>

User:Jlo/Replacing Debian Jessie with Alpine remotely

2017-08-18T14:35:23Z

Jlo: /* Stage 1 */

== Stage 1 ==

something is wrong about init at reboot time :(

prepare-jessie-for-alpine <pre>
#!/bin/sh
# this must be fully automatic
export DEBIAN_FRONTEND=noninteractive
apt-get -y install rsync extlinux
# /boot is a separate partition
rm -fr /boot/boot
ln -sf . /boot/boot
# let's get system file out of our install server
rsync -avzur my.server.home:debian/boot/* /boot/
rsync -avzur my.server.home:debian/apks /boot/
rsync -avzu my.server.home:debian/debian.apkovl.tar.gz /boot/
rsync -auv my.server.home:debian/.alpine-release /boot/
# prepare the config overlay
rm -fr /tmp/apkovl
mkdir /tmp/apkovl
tar xzf /boot/debian.apkovl.tar.gz -C /tmp/apkovl
# keep current active network connection(s) and identity
cp /etc/network/interfaces /tmp/apkovl/etc/network/
cp -r /etc/openvpn /tmp/apkovl/etc/
cp -r /etc/ssh /tmp/apkovl/etc/
cd /tmp/apkovl
# be sure the install media was not already customized for own apps
unlink etc/runlevels/default/local
# be sure ctive VPN connection are preserved
mkdir -p /tmp/apkovl/etc/init.d
for v in /tmp/apkovl/etc/openvpn/*.conf ; do
vn=$(basename $v|cut -d. -f1)
ln -fs openvpn /tmp/apkovl/etc/init.d/openvpn.$vn
ln -fs /etc/init.d/openvpn.$vn /tmp/apkovl/etc/runlevels/default/openvpn.$vn
done
# config done
tar czf /boot/debian.apkovl.tar.gz .
# now the booltoader ; this will kill the active grub...
cat > /boot/extlinux.conf << EOF
timeout 20
prompt 1
default hardened
label hardened
kernel /boot/vmlinuz-hardened
initrd /boot/initramfs-hardened
append alpine_dev=sda1:ext2 modloop=modloop-hardened modules=loop,cramfs,sd-mod,usb-storage,ext2 quiet
EOF
dd if=/usr/lib/syslinux/mbr/mbr.bin of=/dev/sda
extlinux -i /boot
# done
sync
reboot
</pre>

usage: <pre>~:# prepare-jessie-for-alpine</pre>

== Stage 2 ==

not tested yet in this procedure but used successfully (a small variant) to prepare new AL boxes.

setup-albox-from-debian <pre>
#!/bin/sh
BEGIN=$(date +%s)
name=$1
D=sda
echo "Manufacturing box named *${name}*..."
rc-service modloop stop
umount /media/${D}* || (echo "Unable to unmount ${D}. Aborting..." ; exit 1)
### Partition the SSD $D
# f2fs want partition of type ext2 in parted
parted -a cylinder -s /dev/${D} -- \
mklabel msdos \
mkpart primary fat32 0% 1% \
mkpart primary ext2 1% 2% \
mkpart primary ext2 2% 7% \
mkpart extended 7% 100% \
mkpart logical ext2 7% 9% \
mkpart logical ext2 9% 15% \
mkpart logical ext2 15% 20% \
mkpart logical ext2 21% 22% \
mkpart logical ext2 22% 23% \
mkpart logical ext2 23% 24% \
mkpart logical ext2 24% 25% \
mkpart logical ext2 25% 26% \
mkpart logical ext2 26% 27% \
mkpart logical ext2 27% 28% \
mkpart logical ext2 28% 29% \
mkpart logical ext2 29% 30% \
set 1 boot on \
|| exit 1
### prepare boot partition
mkfs.vfat /dev/${D}1 || exit 1
mkdir -p /media/${D}1
setup-bootable /media/${B} /dev/${D}1 || exit 1
mount -t vfat /dev/${D}1 /media/${D}1 || exit 1
### format partition to hold apkovl and apk/cache; it must be of ext? type
mkfs.ext4 -F -q /dev/${D}2 || exit 1
mkdir -p /media/${D}2
mount -t ext4 /dev/${D}2 /media/${D}2 || exit 1
### format remaining partitions with f2fs
for i in $(seq 3 16);do
[ $i -eq 4 ] && continue
mkfs.f2fs -q /dev/${D}$i || exit 1
mkdir -p /media/${D}$i
mount -t f2fs /dev/${D}$i /media/${D}$i || exit 1
mkdir -p /media/${D}$i/.wd
chmod 777 /media/${D}$i/.wd
chmod +t /media/${D}$i/.wd
done
### copy apkovl and apk/cache and stuff
rsync -azur --numeric-ids root@my.server.home:sda* /media/ || exit 1
### prepare new apkovl
rm -fr /tmp/template
mkdir -p /tmp/template
tar xzf /media/${S}2/$(hostname).apkovl.tar.gz -C /tmp/template || exit 1
rm /media/${D}2/$(hostname).apkovl.tar.gz
cd /tmp/template
rm -f etc/ssh/ssh_host_*
for f in $(grep -r $(hostname) etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/$(hostname)/${name}/g $f;done
for f in $(grep -r ${S} etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/${S}/${D}/g $f;done
echo "/dev/sdb2 /media/sdb2 ext4 ro,relatime,errors=continue,user_xattr,acl 0 2" > etc/fstab
echo "/dev/sda3 /media/sda3 f2fs defaults,ro 0 2" >> etc/fstab
for i in $(seq 5 16);do echo "/dev/sda$i /media/sda$i f2fs defaults 0 2" >> etc/fstab;done
echo "With great power comes great responsibility!" > etc/motd
mkdir -p etc/manufacture
date +%s > etc/manufacture/manufactured
date >> etc/manufacture/manufactured
rm etc/apk/cache
ln -s /media/${D}2/cache etc/apk/cache
ln -s /etc/init.d/local etc/runlevels/default/local
tar czf /media/${D}2/${name}.apkovl.tar.gz . || exit 1
### copy installed system to proxy partition
rsync -aur --numeric-ids /media/${D}1 /media/${D}5/ || exit 1
### done
sync
umount /media/${D}*
END=$(date +%s)
DURATION=$(($END-$BEGIN))
echo "Manufacture process took $DURATION seconds to complete."
logger "Manufacture process took $DURATION seconds to complete."
reboot
</pre>

Usage: <pre>~:# setup-albox-from-debian mynewbox</pre>

User:Jlo/Replacing Debian Jessie with Alpine remotely

2017-08-18T14:31:19Z

Jlo: /* Stage 1 */

== Stage 1 ==

something is wrong about init at reboot time :(

prepare-jessie-for-alpine <pre>
#!/bin/sh
export DEBIAN_FRONTEND=noninteractive
apt-get -y install rsync extlinux
rm -fr /boot/boot
ln -sf . /boot/boot
rsync -avzur my.server.home:debian/boot/* /boot/
rsync -avzur my.server.home:debian/apks /boot/
rsync -avzu my.server.home:debian/debian.apkovl.tar.gz /boot/
rsync -auv my.server.home:debian/.alpine-release /boot/
rm -fr /tmp/apkovl
mkdir /tmp/apkovl
tar xzf /boot/debian.apkovl.tar.gz -C /tmp/apkovl
cp /etc/network/interfaces /tmp/apkovl/etc/network/
cp -r /etc/openvpn /tmp/apkovl/etc/
cp -r /etc/ssh /tmp/apkovl/etc/
cd /tmp/apkovl
unlink etc/runlevels/default/local
mkdir -p /tmp/apkovl/etc/init.d
for v in /tmp/apkovl/etc/openvpn/*.conf ; do
vn=$(basename $v|cut -d. -f1)
ln -fs openvpn /tmp/apkovl/etc/init.d/openvpn.$vn
ln -fs /etc/init.d/openvpn.$vn /tmp/apkovl/etc/runlevels/default/openvpn.$vn
done
tar czf /boot/debian.apkovl.tar.gz .
cat > /boot/extlinux.conf << EOF
timeout 20
prompt 1
default hardened
label hardened
kernel /boot/vmlinuz-hardened
initrd /boot/initramfs-hardened
append alpine_dev=sda1:ext2 modloop=modloop-hardened modules=loop,cramfs,sd-mod,usb-storage,ext2 quiet
EOF
dd if=/usr/lib/syslinux/mbr/mbr.bin of=/dev/sda
extlinux -i /boot
sync
reboot
</pre>

usage: <pre>prepare-jessie-for-alpine</pre>

== Stage 2 ==

not tested yet in this procedure but used successfully (a small variant) to prepare new AL boxes.

setup-albox-from-debian <pre>
#!/bin/sh
BEGIN=$(date +%s)
name=$1
D=sda
echo "Manufacturing box named *${name}*..."
rc-service modloop stop
umount /media/${D}* || (echo "Unable to unmount ${D}. Aborting..." ; exit 1)
### Partition the SSD $D
# f2fs want partition of type ext2 in parted
parted -a cylinder -s /dev/${D} -- \
mklabel msdos \
mkpart primary fat32 0% 1% \
mkpart primary ext2 1% 2% \
mkpart primary ext2 2% 7% \
mkpart extended 7% 100% \
mkpart logical ext2 7% 9% \
mkpart logical ext2 9% 15% \
mkpart logical ext2 15% 20% \
mkpart logical ext2 21% 22% \
mkpart logical ext2 22% 23% \
mkpart logical ext2 23% 24% \
mkpart logical ext2 24% 25% \
mkpart logical ext2 25% 26% \
mkpart logical ext2 26% 27% \
mkpart logical ext2 27% 28% \
mkpart logical ext2 28% 29% \
mkpart logical ext2 29% 30% \
set 1 boot on \
|| exit 1
### prepare boot partition
mkfs.vfat /dev/${D}1 || exit 1
mkdir -p /media/${D}1
setup-bootable /media/${B} /dev/${D}1 || exit 1
mount -t vfat /dev/${D}1 /media/${D}1 || exit 1
### format partition to hold apkovl and apk/cache; it must be of ext? type
mkfs.ext4 -F -q /dev/${D}2 || exit 1
mkdir -p /media/${D}2
mount -t ext4 /dev/${D}2 /media/${D}2 || exit 1
### format remaining partitions with f2fs
for i in $(seq 3 16);do
[ $i -eq 4 ] && continue
mkfs.f2fs -q /dev/${D}$i || exit 1
mkdir -p /media/${D}$i
mount -t f2fs /dev/${D}$i /media/${D}$i || exit 1
mkdir -p /media/${D}$i/.wd
chmod 777 /media/${D}$i/.wd
chmod +t /media/${D}$i/.wd
done
### copy apkovl and apk/cache and stuff
rsync -azur --numeric-ids root@my.server.home:sda* /media/ || exit 1
### prepare new apkovl
rm -fr /tmp/template
mkdir -p /tmp/template
tar xzf /media/${S}2/$(hostname).apkovl.tar.gz -C /tmp/template || exit 1
rm /media/${D}2/$(hostname).apkovl.tar.gz
cd /tmp/template
rm -f etc/ssh/ssh_host_*
for f in $(grep -r $(hostname) etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/$(hostname)/${name}/g $f;done
for f in $(grep -r ${S} etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/${S}/${D}/g $f;done
echo "/dev/sdb2 /media/sdb2 ext4 ro,relatime,errors=continue,user_xattr,acl 0 2" > etc/fstab
echo "/dev/sda3 /media/sda3 f2fs defaults,ro 0 2" >> etc/fstab
for i in $(seq 5 16);do echo "/dev/sda$i /media/sda$i f2fs defaults 0 2" >> etc/fstab;done
echo "With great power comes great responsibility!" > etc/motd
mkdir -p etc/manufacture
date +%s > etc/manufacture/manufactured
date >> etc/manufacture/manufactured
rm etc/apk/cache
ln -s /media/${D}2/cache etc/apk/cache
ln -s /etc/init.d/local etc/runlevels/default/local
tar czf /media/${D}2/${name}.apkovl.tar.gz . || exit 1
### copy installed system to proxy partition
rsync -aur --numeric-ids /media/${D}1 /media/${D}5/ || exit 1
### done
sync
umount /media/${D}*
END=$(date +%s)
DURATION=$(($END-$BEGIN))
echo "Manufacture process took $DURATION seconds to complete."
logger "Manufacture process took $DURATION seconds to complete."
reboot
</pre>

Usage: <pre>~:# setup-albox-from-debian mynewbox</pre>

User:Jlo/Replacing Debian Jessie with Alpine remotely

2017-08-18T14:30:19Z

Jlo: /* Stage 2 */

== Stage 1 ==

something is wrong about init at reboot time :(

<pre>
#!/bin/sh
export DEBIAN_FRONTEND=noninteractive
apt-get -y install rsync extlinux
rm -fr /boot/boot
ln -sf . /boot/boot
rsync -avzur my.server.home:debian/boot/* /boot/
rsync -avzur my.server.home:debian/apks /boot/
rsync -avzu my.server.home:debian/debian.apkovl.tar.gz /boot/
rsync -auv my.server.home:debian/.alpine-release /boot/
rm -fr /tmp/apkovl
mkdir /tmp/apkovl
tar xzf /boot/debian.apkovl.tar.gz -C /tmp/apkovl
cp /etc/network/interfaces /tmp/apkovl/etc/network/
cp -r /etc/openvpn /tmp/apkovl/etc/
cp -r /etc/ssh /tmp/apkovl/etc/
cd /tmp/apkovl
unlink etc/runlevels/default/local
mkdir -p /tmp/apkovl/etc/init.d
for v in /tmp/apkovl/etc/openvpn/*.conf ; do
vn=$(basename $v|cut -d. -f1)
ln -fs openvpn /tmp/apkovl/etc/init.d/openvpn.$vn
ln -fs /etc/init.d/openvpn.$vn /tmp/apkovl/etc/runlevels/default/openvpn.$vn
done
tar czf /boot/debian.apkovl.tar.gz .
cat > /boot/extlinux.conf << EOF
timeout 20
prompt 1
default hardened
label hardened
kernel /boot/vmlinuz-hardened
initrd /boot/initramfs-hardened
append alpine_dev=sda1:ext2 modloop=modloop-hardened modules=loop,cramfs,sd-mod,usb-storage,ext2 quiet
EOF
dd if=/usr/lib/syslinux/mbr/mbr.bin of=/dev/sda
extlinux -i /boot
sync
reboot
</pre>

== Stage 2 ==

not tested yet in this procedure but used successfully (a small variant) to prepare new AL boxes.

setup-albox-from-debian <pre>
#!/bin/sh
BEGIN=$(date +%s)
name=$1
D=sda
echo "Manufacturing box named *${name}*..."
rc-service modloop stop
umount /media/${D}* || (echo "Unable to unmount ${D}. Aborting..." ; exit 1)
### Partition the SSD $D
# f2fs want partition of type ext2 in parted
parted -a cylinder -s /dev/${D} -- \
mklabel msdos \
mkpart primary fat32 0% 1% \
mkpart primary ext2 1% 2% \
mkpart primary ext2 2% 7% \
mkpart extended 7% 100% \
mkpart logical ext2 7% 9% \
mkpart logical ext2 9% 15% \
mkpart logical ext2 15% 20% \
mkpart logical ext2 21% 22% \
mkpart logical ext2 22% 23% \
mkpart logical ext2 23% 24% \
mkpart logical ext2 24% 25% \
mkpart logical ext2 25% 26% \
mkpart logical ext2 26% 27% \
mkpart logical ext2 27% 28% \
mkpart logical ext2 28% 29% \
mkpart logical ext2 29% 30% \
set 1 boot on \
|| exit 1
### prepare boot partition
mkfs.vfat /dev/${D}1 || exit 1
mkdir -p /media/${D}1
setup-bootable /media/${B} /dev/${D}1 || exit 1
mount -t vfat /dev/${D}1 /media/${D}1 || exit 1
### format partition to hold apkovl and apk/cache; it must be of ext? type
mkfs.ext4 -F -q /dev/${D}2 || exit 1
mkdir -p /media/${D}2
mount -t ext4 /dev/${D}2 /media/${D}2 || exit 1
### format remaining partitions with f2fs
for i in $(seq 3 16);do
[ $i -eq 4 ] && continue
mkfs.f2fs -q /dev/${D}$i || exit 1
mkdir -p /media/${D}$i
mount -t f2fs /dev/${D}$i /media/${D}$i || exit 1
mkdir -p /media/${D}$i/.wd
chmod 777 /media/${D}$i/.wd
chmod +t /media/${D}$i/.wd
done
### copy apkovl and apk/cache and stuff
rsync -azur --numeric-ids root@my.server.home:sda* /media/ || exit 1
### prepare new apkovl
rm -fr /tmp/template
mkdir -p /tmp/template
tar xzf /media/${S}2/$(hostname).apkovl.tar.gz -C /tmp/template || exit 1
rm /media/${D}2/$(hostname).apkovl.tar.gz
cd /tmp/template
rm -f etc/ssh/ssh_host_*
for f in $(grep -r $(hostname) etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/$(hostname)/${name}/g $f;done
for f in $(grep -r ${S} etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/${S}/${D}/g $f;done
echo "/dev/sdb2 /media/sdb2 ext4 ro,relatime,errors=continue,user_xattr,acl 0 2" > etc/fstab
echo "/dev/sda3 /media/sda3 f2fs defaults,ro 0 2" >> etc/fstab
for i in $(seq 5 16);do echo "/dev/sda$i /media/sda$i f2fs defaults 0 2" >> etc/fstab;done
echo "With great power comes great responsibility!" > etc/motd
mkdir -p etc/manufacture
date +%s > etc/manufacture/manufactured
date >> etc/manufacture/manufactured
rm etc/apk/cache
ln -s /media/${D}2/cache etc/apk/cache
ln -s /etc/init.d/local etc/runlevels/default/local
tar czf /media/${D}2/${name}.apkovl.tar.gz . || exit 1
### copy installed system to proxy partition
rsync -aur --numeric-ids /media/${D}1 /media/${D}5/ || exit 1
### done
sync
umount /media/${D}*
END=$(date +%s)
DURATION=$(($END-$BEGIN))
echo "Manufacture process took $DURATION seconds to complete."
logger "Manufacture process took $DURATION seconds to complete."
reboot
</pre>

Usage: <pre>~:# setup-albox-from-debian mynewbox</pre>

User:Jlo/Replacing Debian Jessie with Alpine remotely

2017-08-18T14:24:12Z

Jlo: /* Stage 2 */

== Stage 1 ==

something is wrong about init at reboot time :(

<pre>
#!/bin/sh
export DEBIAN_FRONTEND=noninteractive
apt-get -y install rsync extlinux
rm -fr /boot/boot
ln -sf . /boot/boot
rsync -avzur my.server.home:debian/boot/* /boot/
rsync -avzur my.server.home:debian/apks /boot/
rsync -avzu my.server.home:debian/debian.apkovl.tar.gz /boot/
rsync -auv my.server.home:debian/.alpine-release /boot/
rm -fr /tmp/apkovl
mkdir /tmp/apkovl
tar xzf /boot/debian.apkovl.tar.gz -C /tmp/apkovl
cp /etc/network/interfaces /tmp/apkovl/etc/network/
cp -r /etc/openvpn /tmp/apkovl/etc/
cp -r /etc/ssh /tmp/apkovl/etc/
cd /tmp/apkovl
unlink etc/runlevels/default/local
mkdir -p /tmp/apkovl/etc/init.d
for v in /tmp/apkovl/etc/openvpn/*.conf ; do
vn=$(basename $v|cut -d. -f1)
ln -fs openvpn /tmp/apkovl/etc/init.d/openvpn.$vn
ln -fs /etc/init.d/openvpn.$vn /tmp/apkovl/etc/runlevels/default/openvpn.$vn
done
tar czf /boot/debian.apkovl.tar.gz .
cat > /boot/extlinux.conf << EOF
timeout 20
prompt 1
default hardened
label hardened
kernel /boot/vmlinuz-hardened
initrd /boot/initramfs-hardened
append alpine_dev=sda1:ext2 modloop=modloop-hardened modules=loop,cramfs,sd-mod,usb-storage,ext2 quiet
EOF
dd if=/usr/lib/syslinux/mbr/mbr.bin of=/dev/sda
extlinux -i /boot
sync
reboot
</pre>

== Stage 2 ==

not tested yet in this procedure but used successfully (a small variant) to prepare new AL boxes.

<pre>
#!/bin/sh
BEGIN=$(date +%s)
name=$1
D=sda
echo "Manufacturing box named *${name}*..."
rc-service modloop stop
umount /media/sda* || (echo "Unable to umount sda. Aborting..." ; exit 1)
### Partition the SSD $D
parted -a cylinder -s /dev/${D} -- \
mklabel msdos \
mkpart primary fat32 0% 1% \
mkpart primary ext2 1% 2% \
mkpart primary ext2 2% 7% \
mkpart extended 7% 100% \
mkpart logical ext2 7% 9% \
mkpart logical ext2 9% 15% \
mkpart logical ext2 15% 20% \
mkpart logical ext2 21% 22% \
mkpart logical ext2 22% 23% \
mkpart logical ext2 23% 24% \
mkpart logical ext2 24% 25% \
mkpart logical ext2 25% 26% \
mkpart logical ext2 26% 27% \
mkpart logical ext2 27% 28% \
mkpart logical ext2 28% 29% \
mkpart logical ext2 29% 30% \
set 1 boot on \
|| exit 1
### prepare boot partition
mkfs.vfat /dev/${D}1 || exit 1
mkdir -p /media/${D}1
setup-bootable /media/${B} /dev/${D}1 || exit 1
mount -t vfat /dev/${D}1 /media/${D}1 || exit 1
### format partition to hold apkovl and apk/cache; it must be of ext? type
mkfs.ext4 -F -q /dev/${D}2 || exit 1
mkdir -p /media/${D}2
mount -t ext4 /dev/${D}2 /media/${D}2 || exit 1
### format remaining partitions with f2fs
for i in $(seq 3 16);do
[ $i -eq 4 ] && continue
mkfs.f2fs -q /dev/${D}$i || exit 1
mkdir -p /media/${D}$i
mount -t f2fs /dev/${D}$i /media/${D}$i || exit 1
mkdir -p /media/${D}$i/.wd
chmod 777 /media/${D}$i/.wd
chmod +t /media/${D}$i/.wd
done
### copy apkovl and apk/cache and stuff
rsync -azur --numeric-ids root@my.server.home:sda* /media/ || exit 1
### prepare new apkovl
rm -fr /tmp/template
mkdir -p /tmp/template
tar xzf /media/${S}2/$(hostname).apkovl.tar.gz -C /tmp/template || exit 1
rm /media/${D}2/$(hostname).apkovl.tar.gz
cd /tmp/template
rm -f etc/ssh/ssh_host_*
for f in $(grep -r $(hostname) etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/$(hostname)/${name}/g $f;done
for f in $(grep -r ${S} etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/${S}/${D}/g $f;done
echo "/dev/sdb2 /media/sdb2 ext4 ro,relatime,errors=continue,user_xattr,acl 0 2" > etc/fstab
echo "/dev/sda3 /media/sda3 f2fs defaults,ro 0 2" >> etc/fstab
for i in $(seq 5 16);do echo "/dev/sda$i /media/sda$i f2fs defaults 0 2" >> etc/fstab;done
echo "With great power comes great responsibility!" > etc/motd
mkdir -p etc/manufacture
date +%s > etc/manufacture/manufactured
date >> etc/manufacture/manufactured
rm etc/apk/cache
ln -s /media/${D}2/cache etc/apk/cache
ln -s /etc/init.d/local etc/runlevels/default/local
tar czf /media/${D}2/${name}.apkovl.tar.gz . || exit 1
### copy installed system to proxy partition
rsync -aur --numeric-ids /media/${D}1 /media/${D}5/ || exit 1
### done
sync
umount /media/${D}*
END=$(date +%s)
DURATION=$(($END-$BEGIN))
echo "Manufacture process took $DURATION seconds to complete."
logger "Manufacture process took $DURATION seconds to complete."
reboot
</pre>

User:Jlo/Replacing Debian Jessie with Alpine remotely

2017-08-18T14:20:39Z

Jlo: /* Stage 2 */

== Stage 1 ==

something is wrong about init at reboot time :(

<pre>
#!/bin/sh
export DEBIAN_FRONTEND=noninteractive
apt-get -y install rsync extlinux
rm -fr /boot/boot
ln -sf . /boot/boot
rsync -avzur my.server.home:debian/boot/* /boot/
rsync -avzur my.server.home:debian/apks /boot/
rsync -avzu my.server.home:debian/debian.apkovl.tar.gz /boot/
rsync -auv my.server.home:debian/.alpine-release /boot/
rm -fr /tmp/apkovl
mkdir /tmp/apkovl
tar xzf /boot/debian.apkovl.tar.gz -C /tmp/apkovl
cp /etc/network/interfaces /tmp/apkovl/etc/network/
cp -r /etc/openvpn /tmp/apkovl/etc/
cp -r /etc/ssh /tmp/apkovl/etc/
cd /tmp/apkovl
unlink etc/runlevels/default/local
mkdir -p /tmp/apkovl/etc/init.d
for v in /tmp/apkovl/etc/openvpn/*.conf ; do
vn=$(basename $v|cut -d. -f1)
ln -fs openvpn /tmp/apkovl/etc/init.d/openvpn.$vn
ln -fs /etc/init.d/openvpn.$vn /tmp/apkovl/etc/runlevels/default/openvpn.$vn
done
tar czf /boot/debian.apkovl.tar.gz .
cat > /boot/extlinux.conf << EOF
timeout 20
prompt 1
default hardened
label hardened
kernel /boot/vmlinuz-hardened
initrd /boot/initramfs-hardened
append alpine_dev=sda1:ext2 modloop=modloop-hardened modules=loop,cramfs,sd-mod,usb-storage,ext2 quiet
EOF
dd if=/usr/lib/syslinux/mbr/mbr.bin of=/dev/sda
extlinux -i /boot
sync
reboot
</pre>

== Stage 2 ==

not tested yet

<pre>
#!/bin/sh
BEGIN=$(date +%s)
name=$1
D=sda
echo "Manufacturing box named *${name}*..."
rc-service modloop stop
umount /media/sda* || (echo "Unable to umount sda. Aborting..." ; exit 1)
### Partition the SSD $D
parted -a cylinder -s /dev/${D} -- \
mklabel msdos \
mkpart primary fat32 0% 1% \
mkpart primary ext2 1% 2% \
mkpart primary ext2 2% 7% \
mkpart extended 7% 100% \
mkpart logical ext2 7% 9% \
mkpart logical ext2 9% 15% \
mkpart logical ext2 15% 20% \
mkpart logical ext2 21% 22% \
mkpart logical ext2 22% 23% \
mkpart logical ext2 23% 24% \
mkpart logical ext2 24% 25% \
mkpart logical ext2 25% 26% \
mkpart logical ext2 26% 27% \
mkpart logical ext2 27% 28% \
mkpart logical ext2 28% 29% \
mkpart logical ext2 29% 30% \
set 1 boot on \
|| exit 1
### prepare boot partition
mkfs.vfat /dev/${D}1 || exit 1
mkdir -p /media/${D}1
setup-bootable /media/${B} /dev/${D}1 || exit 1
mount -t vfat /dev/${D}1 /media/${D}1 || exit 1
### format partition to hold apkovl and apk/cache; it must be of ext? type
mkfs.ext4 -F -q /dev/${D}2 || exit 1
mkdir -p /media/${D}2
mount -t ext4 /dev/${D}2 /media/${D}2 || exit 1
### format remaining partitions with f2fs
for i in $(seq 3 16);do
[ $i -eq 4 ] && continue
mkfs.f2fs -q /dev/${D}$i || exit 1
mkdir -p /media/${D}$i
mount -t f2fs /dev/${D}$i /media/${D}$i || exit 1
mkdir -p /media/${D}$i/.wd
chmod 777 /media/${D}$i/.wd
chmod +t /media/${D}$i/.wd
done
### copy apkovl and apk/cache and stuff
rsync -azur --numeric-ids root@my.server.home:sda* /media/ || exit 1
### prepare new apkovl
rm -fr /tmp/template
mkdir -p /tmp/template
tar xzf /media/${S}2/$(hostname).apkovl.tar.gz -C /tmp/template || exit 1
rm /media/${D}2/$(hostname).apkovl.tar.gz
cd /tmp/template
rm -f etc/ssh/ssh_host_*
for f in $(grep -r $(hostname) etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/$(hostname)/${name}/g $f;done
for f in $(grep -r ${S} etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/${S}/${D}/g $f;done
echo "/dev/sdb2 /media/sdb2 ext4 ro,relatime,errors=continue,user_xattr,acl 0 2" > etc/fstab
echo "/dev/sda3 /media/sda3 f2fs defaults,ro 0 2" >> etc/fstab
for i in $(seq 5 16);do echo "/dev/sda$i /media/sda$i f2fs defaults 0 2" >> etc/fstab;done
echo "With great power comes great responsibility!" > etc/motd
mkdir -p etc/manufacture
date +%s > etc/manufacture/manufactured
date >> etc/manufacture/manufactured
rm etc/apk/cache
ln -s /media/${D}2/cache etc/apk/cache
ln -s /etc/init.d/local etc/runlevels/default/local
tar czf /media/${D}2/${name}.apkovl.tar.gz . || exit 1
### copy installed system to proxy partition
rsync -aur --numeric-ids /media/${D}1 /media/${D}5/ || exit 1
### done
sync
umount /media/${D}*
END=$(date +%s)
DURATION=$(($END-$BEGIN))
echo "Manufacture process took $DURATION seconds to complete."
logger "Manufacture process took $DURATION seconds to complete."
reboot
</pre>

User:Jlo/Replacing Debian Jessie with Alpine remotely

2017-08-18T14:07:07Z

Jlo: Created page with "== Stage 1 == something is wrong about init at reboot time :( <pre> #!/bin/sh export DEBIAN_FRONTEND=noninteractive apt-get -y install rsync extlinux rm -fr /boot/boot ln -s..."

== Stage 1 ==

something is wrong about init at reboot time :(

<pre>
#!/bin/sh
export DEBIAN_FRONTEND=noninteractive
apt-get -y install rsync extlinux
rm -fr /boot/boot
ln -sf . /boot/boot
rsync -avzur my.server.home:debian/boot/* /boot/
rsync -avzur my.server.home:debian/apks /boot/
rsync -avzu my.server.home:debian/debian.apkovl.tar.gz /boot/
rsync -auv my.server.home:debian/.alpine-release /boot/
rm -fr /tmp/apkovl
mkdir /tmp/apkovl
tar xzf /boot/debian.apkovl.tar.gz -C /tmp/apkovl
cp /etc/network/interfaces /tmp/apkovl/etc/network/
cp -r /etc/openvpn /tmp/apkovl/etc/
cp -r /etc/ssh /tmp/apkovl/etc/
cd /tmp/apkovl
unlink etc/runlevels/default/local
mkdir -p /tmp/apkovl/etc/init.d
for v in /tmp/apkovl/etc/openvpn/*.conf ; do
vn=$(basename $v|cut -d. -f1)
ln -fs openvpn /tmp/apkovl/etc/init.d/openvpn.$vn
ln -fs /etc/init.d/openvpn.$vn /tmp/apkovl/etc/runlevels/default/openvpn.$vn
done
tar czf /boot/debian.apkovl.tar.gz .
cat > /boot/extlinux.conf << EOF
timeout 20
prompt 1
default hardened
label hardened
kernel /boot/vmlinuz-hardened
initrd /boot/initramfs-hardened
append alpine_dev=sda1:ext2 modloop=modloop-hardened modules=loop,cramfs,sd-mod,usb-storage,ext2 quiet
EOF
dd if=/usr/lib/syslinux/mbr/mbr.bin of=/dev/sda
extlinux -i /boot
sync
reboot
</pre>

== Stage 2 ==

not tested yet

<pre>
#!/bin/sh
BEGIN=$(date +%s)
name=$1
D=sda
echo "Manufacturing box named *${name}*..."
rc-service modloop stop
umount /media/sda* || (echo "Unable to umount sda. Aborting..." ; exit 1)
### Partition the SSD $D
parted -a cylinder -s /dev/${D} -- \
mklabel msdos \
mkpart primary fat32 0% 1% \
mkpart primary ext2 1% 2% \
mkpart primary ext2 2% 7% \
mkpart extended 7% 100% \
mkpart logical ext2 7% 9% \
mkpart logical ext2 9% 15% \
mkpart logical ext2 15% 20% \
mkpart logical ext2 21% 22% \
mkpart logical ext2 22% 23% \
mkpart logical ext2 23% 24% \
mkpart logical ext2 24% 25% \
mkpart logical ext2 25% 26% \
mkpart logical ext2 26% 27% \
mkpart logical ext2 27% 28% \
mkpart logical ext2 28% 29% \
mkpart logical ext2 29% 30% \
set 1 boot on \
|| exit 1
### prepare boot partition
mkfs.vfat /dev/${D}1 || exit 1
mkdir -p /media/${D}1
setup-bootable /media/${B} /dev/${D}1 || exit 1
mount -t vfat /dev/${D}1 /media/${D}1 || exit 1
### format partition to hold apkovl and apk/cache; it must be of ext? type
mkfs.ext4 -F -q /dev/${D}2 || exit 1
mkdir -p /media/${D}2
mount -t ext4 /dev/${D}2 /media/${D}2 || exit 1
### format remaining partitions with f2fs
for i in $(seq 3 16);do
[ $i -eq 4 ] && continue
mkfs.f2fs -q /dev/${D}$i || exit 1
mkdir -p /media/${D}$i
mount -t f2fs /dev/${D}$i /media/${D}$i || exit 1
mkdir -p /media/${D}$i/.wd
chmod 777 /media/${D}$i/.wd
chmod +t /media/${D}$i/.wd
done
### copy apkovl and apk/cache and stuff
rsync -azur --numeric-ids root@my.server.home:sda* /media/ || exit 1
### prepare new apkovl
rm -fr /tmp/template
mkdir -p /tmp/template
tar xzf /media/${S}2/$(hostname).apkovl.tar.gz -C /tmp/template || exit 1
rm /media/${D}2/$(hostname).apkovl.tar.gz
cd /tmp/template
rm -f etc/ssh/ssh_host_*
for f in $(grep -r $(hostname) etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/$(hostname)/${name}/g
$f;done
for f in $(grep -r ${S} etc 2> /dev/null | cut -d: -f1|sort -u);do sed -i -e s/${S}/${D}/g $f;done
echo "/dev/sdb2 /media/sdb2 ext4 ro,relatime,errors=continue,user_xattr,acl 0 2" > etc/fstab
echo "/dev/sda3 /media/sda3 f2fs defaults,ro 0 2" >> etc/fstab
for i in $(seq 5 16);do echo "/dev/sda$i /media/sda$i f2fs defaults 0 2" >> etc/fstab;done
echo "With great power comes great responsibility!" > etc/motd
date +%s > etc/manufacture/manufactured
date >> etc/manufacture/manufactured
rm etc/apk/cache
ln -s /media/${D}2/cache etc/apk/cache
ln -s /etc/init.d/local etc/runlevels/default/local
tar czf /media/${D}2/${name}.apkovl.tar.gz . || exit 1
### copy installed system to proxy partition
rsync -aur --numeric-ids /media/${D}1 /media/${D}5/ || exit 1
### done
sync
umount /media/${D}*
END=$(date +%s)
DURATION=$(($END-$BEGIN))
echo "Manufacture process took $DURATION seconds to complete."
logger "Manufacture process took $DURATION seconds to complete."
reboot
</pre>

User:Jlo

2017-08-18T14:00:23Z

Jlo:

I was [[User:Jch]] but I forgot my passwd and the email used to suscribe is not valid anymore...

I'm today senior system architect at some startup. 
We are building a network of embedded devices controlling hardware stuff. 
I'm stepping it as the product is transitioning from prototype phase to industrial phase.

The main app is written for Oracle Java8 and running in Apache/Karaf environment.

The proto was done with Debian boxes managed with salt stack (about 100 of those with a mix of Wheezy and Jessie).

I would like to see the boxes running AL in ''run-from-ram'' mode pulling the apkovl tarball (or at least some tarball to be applied in the /etc/local.d sequence) from a remote server somewhere in the cloud. 
To upgrade would just to rsync the normally read-only SSD and reboot.

To achieve this with AlpineLinux, one has to:

* deploy [[User:Jlo/java8|Oracle Java 7 with glibc]]
* deploy [[User:Jlo/java8|Oracle Java 8 with glibc]]
* deploy [[User:Jlo/python27|python2.7 with needed libs]]
* deploy [[User:Jlo/watchdog|hardware watchdog]]
* deploy [[User:Jlo/network|network drivers]] (eth, usb-eth, wlan, 3g, lte)
* deploy [[User:Jlo/usb|USB drivers]]
* rewrite [[User:Jlo/init|init scripts]]
* prepare a [[User:Jlo/image|custom image]] with every needed packages locally present in disk repo
* adapt [[User:Jlo/packages|custom packages]] from deb to apk ones

To configure a box is done in two parts:

* the network. done locally
* the app layer. done via a webinterface; commited to a server and download by the box at each boot.

The advantages of such architecture are:

* power failure resilient as the system runs from ram The only PoF here is when an upgrade of the read-only medium is done
* boxes use a pull mechanism to stay up-to-date ensuring the right version at any next reboot This protect us against out-of-sync boxes arraising often with push architecture (salt, ansible, ...)
* the two steps boot sequence allows us to temporary take control over a box for maintenance with a totally different setup and as we always keep an ssh access via the VPN, we can force that anytime we want (hardware watchdog being our friend here)
* easy to reproduce in VM for testing (including load tests)

Disadvantages are:

* need own repo with access control to distribute Oracle Java internally without breach of license (but it is the same situation for any distro)
* some used packages are distributed as deb only (from artifactory between others) will need to script part of the CI towards apk generation... will need to check every deb to see if sources are available...

----

See also [[User:Jlo/Replacing_Debian_Jessie_with_Alpine_remotely|Replacing Debian Jessie with Alpine remotely]]

User:Jlo/watchdog

2017-08-02T14:32:06Z

Jlo:

need to find the right source for the needed kernel module then to compile it and expose it as a custom APK... 
all I now yet is that it is a hardware watchdog called something like '''it8772'''

maybe this is the right source code: https://code.woboq.org/linux/linux/drivers/watchdog/it87_wdt.c.html ? 
no lusk, it supports chips: IT8620, IT8702, IT8712, IT8716, IT8718, IT8720, IT8721, IT8726, IT8728 and IT8783

<pre>~# modprobe it87_wdt
it87_wdt: Unknown Chip found, Chip 8772 Revision 0001</pre>

To monitor the CPU we have
<pre>~# modprobe it87
it87: Found IT8772E chip at 0xa40, revision 1
it87: Beeping is supported
</pre>

User:Jlo/watchdog

2017-08-02T14:04:54Z

Jlo:

User:Jlo/watchdog

2017-08-02T14:03:01Z

Jlo:

User:Jlo/watchdog

2017-08-02T14:00:19Z

Jlo: correct a typo

need to find the right source for the needed kernel module then to compile it and expose it as a custom APK... 
all I now yet is that it is a hardware watchdog called something like '''it8772'''

User:Jlo/watchdog

2017-08-02T13:59:51Z

Jlo: Created page with "need to find the right source for the needed kernel module then to compile it and expose it as a custom APK... all I now yet is that it is a hardware watchdog called someting..."

need to find the right source for the needed kernel module then to compile it and expose it as a custom APK...
all I now yet is that it is a hardware watchdog called someting like '''it8772'''

User:Jlo/usb

2017-08-02T13:32:10Z

Jlo: Created page with "all needed ones are present out-of-the-box"

all needed ones are present out-of-the-box

User:Jlo/network

2017-08-02T13:31:48Z

Jlo: Created page with "all needed ones are present out-of-the box ;)"

all needed ones are present out-of-the box ;)

User:Jlo

2017-08-02T13:31:10Z

Jlo:

I was [[User:Jch]] but I forgot my passwd and the email used to suscribe is not valid anymore...

I'm today senior system architect at some startup. 
We are building a network of embedded devices controlling hardware stuff. 
I'm stepping it as the product is transitioning from prototype phase to industrial phase.

The main app is written for Oracle Java8 and running in Apache/Karaf environment.

The proto was done with Debian boxes managed with salt stack (about 100 of those with a mix of Wheezy and Jessie).

I would like to see the boxes running AL in ''run-from-ram'' mode pulling the apkovl tarball (or at least some tarball to be applied in the /etc/local.d sequence) from a remote server somewhere in the cloud. 
To upgrade would just to rsync the normally read-only SSD and reboot.

To achieve this with AlpineLinux, one has to:

* deploy [[User:Jlo/java8|Oracle Java 7 with glibc]]
* deploy [[User:Jlo/java8|Oracle Java 8 with glibc]]
* deploy [[User:Jlo/python27|python2.7 with needed libs]]
* deploy [[User:Jlo/watchdog|hardware watchdog]]
* deploy [[User:Jlo/network|network drivers]] (eth, usb-eth, wlan, 3g, lte)
* deploy [[User:Jlo/usb|USB drivers]]
* rewrite [[User:Jlo/init|init scripts]]
* prepare a [[User:Jlo/image|custom image]] with every needed packages locally present in disk repo
* adapt [[User:Jlo/packages|custom packages]] from deb to apk ones

To configure a box is done in two parts:

* the network. done locally
* the app layer. done via a webinterface; commited to a server and download by the box at each boot.

The advantages of such architecture are:

* power failure resilient as the system runs from ram The only PoF here is when an upgrade of the read-only medium is done
* boxes use a pull mechanism to stay up-to-date ensuring the right version at any next reboot This protect us against out-of-sync boxes arraising often with push architecture (salt, ansible, ...)
* the two steps boot sequence allows us to temporary take control over a box for maintenance with a totally different setup and as we always keep an ssh access via the VPN, we can force that anytime we want (hardware watchdog being our friend here)
* easy to reproduce in VM for testing (including load tests)

Disadvantages are:

* need own repo with access control to distribute Oracle Java internally without breach of license (but it is the same situation for any distro)
* some used packages are distributed as deb only (from artifactory between others) will need to script part of the CI towards apk generation... will need to check every deb to see if sources are available...

Udhcpc

2017-08-02T13:23:51Z

Jlo: correct a typo

You may want to customize behavior of default dhcp client (udhcpc from busybox).

The default behavior is drived by the script /usr/share/udhcpc/default.script

It's default configuration may be overwritten by a /etc/udhcpc/udhcpc.conf file.

Authorized key:value pair are available:

{| cellpadding="15" border="1" class="wikitable"
|-
! key
| default value
| possible values
|-
| NO_GATEWAY
| -
| <list of iface names>
|-
| IF_METRIC
| -
| <metric value>
|-
| IF_PEER_DNS
| yes
| <anything but yes>
|-
| RESOLV_CONF
| /etc/resolv.conf
| no ; NO ; -
|-
| NO_DNS
| -
| <list of iface names>
|}

You may also add custom scripts /etc/udhcpc/pre-* and /etc/udhcpc/post-* to be run before and after deconfig|renew|bound dhcp events.

Udhcpc

2017-08-02T13:23:07Z

Jlo: Created page with "You may want to customize behavior of default dhcp client (udhcpc from busybox). The default behavior is drived by the script /usr/share/udhcpc/default.script It's default c..."

You may want to customize behavior of default dhcp client (udhcpc from busybox).

The default behavior is drived by the script /usr/share/udhcpc/default.script

It's default configuration may be overwritten by a /etc/udhcpc/udhcpc.conf file.

Authorized key:value pair are available:

{| cellpadding="15" border="1" class="wikitable"
|-
! key
| default value
| possible values
|-
| NO_GATEWAY
| -
| <list of iface names>
|-
| IF_METRIC
| -
| <metric value>
|-
| IF_PEER_DNS
| yes
| <anything but yes>
|-
| RESOLV_CONF
| /etc/resolv.conf
| no ; NO ; -
|-
| NO_DNS
| -
| <list of iface names>
|}

You may also add custom scripts /etc/udgcpc.pre-* and /etc/udgcpc.post-* to be run before and after deconfig|renew|bound dhcp events.

Configure Networking

2017-08-02T13:00:08Z

Jlo: /* Related articles */

This page will assist you in setting up networking on Alpine Linux.
{{Note|You must be logged in as root in order to perform the actions on this page.}}

= Setting System Hostname =
To set the system hostname, do something like the following:
{{Cmd|echo "shortname" > /etc/hostname}}

Then, to activate the change, do the following:
{{Cmd|hostname -F /etc/hostname}}

If you're using IPv6, you should also add the following special IPv6 addresses to your <code>/etc/hosts</code> file:
<pre>::1 localhost ipv6-localhost ipv6-loopback
fe00::0 ipv6-localnet
ff00::0 ipv6-mcastprefix
ff02::1 ipv6-allnodes
ff02::2 ipv6-allrouters
ff02::3 ipv6-allhosts</pre>

{{Tip|If you are going to use automatic IP configuration, such as IPv4 DHCP or IPv6 Stateless Autoconfiguration, you can skip ahead to [[#Configuring_DNS|Configuring DNS]]. Otherwise, if you are going to use a static IPv4 or IPv6 address, continue below.}}

For a static IP configuration, it's common to also add the machine's hostname you just set (above) to the <code>/etc/hosts</code> file.

Here's an IPv4 example:
<pre>192.168.1.150 shortname.domain.com</pre>

And here's an IPv6 example:
<pre>2001:470:ffff:ff::2 shortname.domain.com</pre>

= Configuring DNS =
{{Tip|'''For users of IPv4 DHCP:''' Please note that <code>/etc/resolv.conf</code> will be completely overwritten with any nameservers provided by DHCP. Also, if DHCP does not provide any nameservers, then <code>/etc/resolv.conf</code> will still be overwritten, but will not contain any nameservers!}}

For using a static IP and static nameservers, use one of the following examples.

For IPv4 nameservers, edit your <code>/etc/resolv.conf</code> file to look like this: 
The following example uses [http://en.wikipedia.org/wiki/Google_Public_DNS Google's Public DNS servers].
nameserver 8.8.8.8
nameserver 8.8.4.4

For IPv6 nameservers, edit your <code>/etc/resolv.conf</code> file to look like this: 
The following example uses [http://www.he.net/ Hurricane Electric's] public DNS server.
nameserver 2001:470:20::2
You can also use Hurricane Electric's public DNS server via IPv4:
nameserver 74.82.42.42

{{Tip|If you decide to use Hurricane Electric's nameserver, be aware that it is 'Google-whitelisted'. What does this mean? It allows you access to many of Google's services via IPv6. (Just don't add other, non-whitelisted, nameservers to <code>/etc/resolv.conf</code> — ironically, such as Google's Public DNS Servers.) Read [http://www.google.com/intl/en/ipv6/ here] for more information.}}

= Enabling IPv6 (Optional) =

If you use IPv6, do the following to enable IPv6 for now and at each boot:
{{Cmd|modprobe ipv6
echo "ipv6" >> /etc/modules}}

= Interface Configuration =

== Loopback Configuration (Required) ==
{{Note|The loopback configuration must appear first in <code>/etc/network/interfaces</code> to prevent networking issues.}}
To configure loopback, add the following to a new file <code>/etc/network/interfaces</code>:
<pre>auto lo
iface lo inet loopback</pre>

The above works to setup the IPv4 loopback address (127.0.0.1), and the IPv6 loopback address (<code>::1</code>) — if you enabled IPv6.

== Wireless Configuration ==

See [[Connecting to a wireless access point]].

== Ethernet Configuration ==
For the following Ethernet configuration examples, we will assume that you are using Ethernet device <code>eth0</code>.

=== Initial Configuration ===
Add the following to the file <code>/etc/network/interfaces</code>, above any IP configuration for <code>eth0</code>:
<pre>auto eth0</pre>

=== IPv4 DHCP Configuration ===
Add the following to the file <code>/etc/network/interfaces</code>, below the <code>auto eth0</code> definition:
<pre>iface eth0 inet dhcp</pre>

=== IPv4 Static Address Configuration ===
Add the following to the file <code>/etc/network/interfaces</code>, below the <code>auto eth0</code> definition:
<pre>iface eth0 inet static
address 192.168.1.150
netmask 255.255.255.0
gateway 192.168.1.1</pre>

=== IPv6 Stateless Autoconfiguration ===
Add the following to the file <code>/etc/network/interfaces</code>, below the <code>auto eth0</code> definition:
<pre>iface eth0 inet6 manual
pre-up echo 1 > /proc/sys/net/ipv6/conf/eth0/accept_ra</pre>

{{Tip|The "inet6 manual" method is available in busybox 1.17.3-r3 and later.}}

=== IPv6 Static Address Configuration ===
Add the following to the file <code>/etc/network/interfaces</code>, below the <code>auto eth0</code> definition:
<pre>iface eth0 inet6 static
address 2001:470:ffff:ff::2
netmask 64
gateway 2001:470:ffff:ff::1
pre-up echo 0 > /proc/sys/net/ipv6/conf/eth0/accept_ra</pre>

== Example: Dual-Stack Configuration ==
This example shows a dual-stack configuration.
<pre>auto lo
iface lo inet loopback

auto eth0

iface eth0 inet static
address 192.168.1.150
netmask 255.255.255.0
gateway 192.168.1.1

iface eth0 inet6 static
address 2001:470:ffff:ff::2
netmask 64
gateway 2001:470:ffff:ff::1
pre-up echo 0 > /proc/sys/net/ipv6/conf/eth0/accept_ra</pre>

= Firewalling with iptables and ip6tables =

See also: [[Alpine Wall]] - [[How-To Alpine Wall]] - [[Alpine Wall User's Guide]]

== Install iptables/ip6tables ==
* To install iptables:
: {{Cmd|apk add iptables}}

* To install ip6tables:
: {{Cmd|apk add ip6tables}}

* To install the man pages for iptables and ip6tables:
: {{Cmd|apk add iptables-doc}}

== Configure iptables/ip6tables ==
{{ Tip| Good examples of how to write iptables rules can be found at the Linux Home Networking Wiki http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch14_:_Linux_Firewalls_Using_iptables }}

== Save Firewall Rules ==

=== For iptables ===
# Set iptables to start on reboot
#* {{ Cmd| rc-update add iptables }}
# Write the firewall rules to disk
#* {{ Cmd| /etc/init.d/iptables save}}
# If you use Alpine Local Backup:

## Save the configuration
##* {{ Cmd| lbu ci }}

=== For ip6tables ===
# Set ip6tables to start on reboot
#* {{ Cmd| rc-update add ip6tables }}
# Write the firewall rules to disk
#* {{ Cmd| /etc/init.d/ip6tables save}}
# If you use Alpine Local Backup:

## Save the configuration
##* {{ Cmd| lbu ci }}

= Activating Changes and Testing Connectivity =
Changes made to <code>/etc/network/interfaces</code> can be activated by running:
{{Cmd|/etc/init.d/networking restart}}
If you did not get any errors, you can now test that networking is configured properly by attempting to ping out:
{{Cmd|ping www.google.com}}
<pre>PING www.l.google.com (74.125.47.103) 56(84) bytes of data.
64 bytes from yw-in-f103.1e100.net (74.125.47.103): icmp_seq=1 ttl=48 time=58.5 ms
64 bytes from yw-in-f103.1e100.net (74.125.47.103): icmp_seq=2 ttl=48 time=56.4 ms
64 bytes from yw-in-f103.1e100.net (74.125.47.103): icmp_seq=3 ttl=48 time=57.0 ms
64 bytes from yw-in-f103.1e100.net (74.125.47.103): icmp_seq=4 ttl=48 time=60.2 ms
^C
--- www.l.google.com ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3007ms
rtt min/avg/max/mdev = 56.411/58.069/60.256/1.501 ms</pre>

For an IPv6 traceroute (<code>traceroute6</code>), you will first need to install the <code>iputils</code> package:
{{Cmd|apk add iputils}}

Then run <code>traceroute6</code>:
{{Cmd|traceroute6 ipv6.google.com}}
<pre>traceroute to ipv6.l.google.com (2001:4860:8009::67) from 2001:470:ffff:ff::2, 30 hops max, 16 byte packets
1 2001:470:ffff:ff::1 (2001:470:ffff:ff::1) 3.49 ms 0.62 ms 0.607 ms
2 * * *
3 * * *
4 pr61.iad07.net.google.com (2001:504:0:2:0:1:5169:1) 134.313 ms 95.342 ms 88.425 ms
5 2001:4860::1:0:9ff (2001:4860::1:0:9ff) 100.759 ms 100.537 ms 89.907 ms
6 2001:4860::1:0:5db (2001:4860::1:0:5db) 115.563 ms 102.946 ms 106.191 ms
7 2001:4860::2:0:a7 (2001:4860::2:0:a7) 101.754 ms 100.475 ms 100.512 ms
8 2001:4860:0:1::c3 (2001:4860:0:1::c3) 99.272 ms 111.989 ms 99.835 ms
9 yw-in-x67.1e100.net (2001:4860:8009::67) 101.545 ms 109.675 ms 99.431 ms</pre>

= Additional Utilities =

== iproute2 ==

You may wish to install the 'iproute2' package (note that this will also install iptables if not yet installed)

{{Cmd|apk add iproute2}}

This provides the 'ss' command which is IMHO a 'better' version of netstat.

Show listening tcp ports:
{{Cmd|ss -tl}}

Show listening tcp ports and associated processes:
{{Cmd|ss -ptl}}

Show listening and established tcp connections:
{{Cmd|ss -ta}}

Show socket usage summary:
{{Cmd|ss -s}}

Show more options:
{{Cmd|ss -h}}

== drill ==

You may also wish to install 'drill' (it will also install the 'ldns' package) which is a superior (IMHO) replacement for nslookup and dig etc:

{{Cmd|apk add drill}}

Then use it as you would for dig:

{{Cmd|drill alpinelinux.org @8.8.8.8}}

To perform a reverse lookup (get a name from an IP) use the following syntax:

{{Cmd|drill -x 8.8.8.8 @208.67.222.222}}

= Related articles =

You may also wish to review the following network related articles:

[[Vlan|VLAN setup]]

[[Bonding|Bonding setup]]

[[Bridge|Network bridge setup]]

[[udhcpc|udhcpc configuration]]

[[Category:Networking]]

User talk:Jlo

2017-07-22T09:12:24Z

Jlo: /* permanent pip install in run-from-ram with overlayFS */

== Oracle Java ==

Let's adapt one (or more) famous docker files
(credit to https://hub.docker.com/r/anapsix/alpine-java/)

<pre>
apk --update add curl ca-certificates tar
curl -Ls https://circle-artifacts.com/gh/andyshinn/alpine-pkg-glibc/6/artifacts/0/home/ubuntu/alpine-pkg-glibc/packages/x86_64/glibc-2.21-r2.apk > /tmp/glibc-2.21-r2.apk
apk add --allow-untrusted /tmp/glibc-2.21-r2.apk

# Java Version
ENV JAVA_VERSION_MAJOR 8
ENV JAVA_VERSION_MINOR 45
ENV JAVA_VERSION_BUILD 14
ENV JAVA_PACKAGE jdk

# Download and unarchive Java
mkdir /opt
curl -jksSLH "Cookie: oraclelicense=accept-securebackup-cookie"\
http://download.oracle.com/otn-pub/java/jdk/${JAVA_VERSION_MAJOR}u${JAVA_VERSION_MINOR}-b${JAVA_VERSION_BUILD}/${JAVA_PACKAGE}-${JAVA_VERSION_MAJOR}u${JAVA_VERSION_MINOR}-linux-x64.tar.gz \
| tar -xzf - -C /opt
ln -s /opt/jdk1.${JAVA_VERSION_MAJOR}.0_${JAVA_VERSION_MINOR} /opt/jdk
rm -rf /opt/jdk/*src.zip \
/opt/jdk/lib/missioncontrol \
/opt/jdk/lib/visualvm \
/opt/jdk/lib/*javafx* \
/opt/jdk/jre/lib/plugin.jar \
/opt/jdk/jre/lib/ext/jfxrt.jar \
/opt/jdk/jre/bin/javaws \
/opt/jdk/jre/lib/javaws.jar \
/opt/jdk/jre/lib/desktop \
/opt/jdk/jre/plugin \
/opt/jdk/jre/lib/deploy* \
/opt/jdk/jre/lib/*javafx* \
/opt/jdk/jre/lib/*jfx* \
/opt/jdk/jre/lib/amd64/libdecora_sse.so \
/opt/jdk/jre/lib/amd64/libprism_*.so \
/opt/jdk/jre/lib/amd64/libfxplugins.so \
/opt/jdk/jre/lib/amd64/libglass.so \
/opt/jdk/jre/lib/amd64/libgstreamer-lite.so \
/opt/jdk/jre/lib/amd64/libjavafx*.so \
/opt/jdk/jre/lib/amd64/libjfx*.so

# Set environment
ENV JAVA_HOME /opt/jdk
ENV PATH ${PATH}:${JAVA_HOME}/bin
</pre>

=== Other sources===

https://blogs.oracle.com/developers/official-docker-image-for-oracle-java-and-the-openjdk-roadmap-for-containers
https://wiki.alpinelinux.org/wiki/Installing_Oracle_Java

== permanent pip install in run-from-ram with overlayFS ==

For an embedded system, I wanted to have a few python tools installed from pip to be present at boot time without needing network to rebuild.

<pre>
mv /usr /usr.dist
mkdir /usr
mount -t overlay overlay -o lowerdir=/usr.dist,upperdir=/usr,workdir=/tmp/usr /usr
pip install --upgrade pip
pip install semantic_version
pip install incremental
pip install pymodbus
umount /usr
mount -o remount,rw /media/sda1
mv /usr /media/sda1/usr.post
mount -o remount,ro /media/sda1
mv /usr.dist /usr
mkdir -p /tmp/usr
mount -t overlay overlay -o lowerdir=/media/sda1/usr.post,upperdir=/usr,workdir=/tmp/usr /usr
</pre>

I use this technique to also have Oracle Java 8 and Apache Karaf running cleanly in run-from-ram mode without overloading the memory with storage.
The embedded box has a read-only memory chip and system is clean and brand new at each reboot.

To update, we remount media rw, rsync then remount ro again.

User talk:Jlo

2017-07-22T08:59:32Z

Jlo: /* permanent pip install in run-from-ram with overlayFS */ new section

User:Jlo/image

2017-06-13T06:46:13Z

Jlo: Created page with "<pre> apk add ca-certificates curl openvpn paxctl screen python2 glibc wget java </pre>"

<pre>
apk add ca-certificates curl openvpn paxctl screen python2 glibc
wget java
</pre>

User:Jlo/python27

2017-06-13T06:38:20Z

Jlo: Created page with "<pre> apk add python2 screen </pre>"

<pre>
apk add python2 screen
</pre>

User:Jlo/java8

2017-06-13T06:31:10Z

Jlo: Created page with "on a data install <pre> URL=http://download.oracle.com/otn-pub/java/jdk/8u131-b11/d54c1d3a095b4ff2b6607d096fa80163/server-jre-8u131-linux-x64.tar.gz JDK=jdk1-8.0_131 FILE=serv..."

on a data install
<pre>
URL=http://download.oracle.com/otn-pub/java/jdk/8u131-b11/d54c1d3a095b4ff2b6607d096fa80163/server-jre-8u131-linux-x64.tar.gz
JDK=jdk1-8.0_131
FILE=server-jre-8u131-linux-x64.tar.gz
cd /var
apk update
apk add ca-certificates curl paxctl
wget -q -O /etc/apk/keys/sgerrand.rsa.pub https://raw.githubusercontent.com/sgerrand/alpine-pkg-glibc/master/sgerrand.rsa.pub
wget https://github.com/sgerrand/alpine-pkg-glibc/releases/download/2.25-r0/glibc-2.25-r0.apk
apk add glibc-2.25-r0.apk
wget $URL
tar xzf $FILE
rm $FILE
ln -s $JDK java
echo 'export JAVA_HOME=/var/java' > /etc/profile.d/java.sh
echo 'export PATH=$JAVA_HOME/bin:$PATH' >> /etc/profile.d/java.sh
. /etc/profile.d/java.sh
paxctl -c /var/java/bin/java
paxctl -m /var/java/bin/java
paxctl -c /var/java/bin/javac
paxctl -m /var/java/bin/javac
java -version
</pre>

Installing Oracle Java

2017-06-13T05:02:24Z

Jlo: typo

Using java requires having grsec play nice with the binaries. You may also want to install the JDK instead of the JRE depending on your use case.

This guide assumes you're running as root.

Download XXX-XXX-linux-x64.tar.gz from either the JRE or JDK section here:
https://www.oracle.com/technetwork/java/javase/downloads/index.html

mkdir -p /opt/java
cd /opt/java
sudo tar -zxvf XXX-XXX-linux-x64.tar.gz

Note down the directory, e.g. /opt/java/jdk1.8.0_121, create a symbol link as the current version:

ln -s /opt/java/jdk1.8.0_121 /opt/java/current

Create a file in '''/etc/profile.d/java.sh''':
export JAVA_HOME=/opt/java/current
export PATH=$PATH:$JAVA_HOME/bin

Execute this script or restart your shell:
sh /etc/profile.d/java.sh

Now we need manage grsec with paxctl use this command to check if its installed:
which paxctl

If nothing comes up install it:

apk add paxctl

Now in your /opt/java/XXX/bin folder let it execute:
paxctl -c java
paxctl -m java

If you have the JDK, you need to do the same to javac:
paxctl -c javac
paxctl -m javac

You can do this for any other binary you need to use.

NOTE: I read online that some people required using this command to get it working (and it may be a better alternative):

setfattr -n user.pax.flags -v "mr" java
setfattr -n user.pax.flags -v "mr" javac

User:Jlo

2017-06-10T10:31:58Z

Jlo: Disadvantages

I was [[User:Jch]] but I forgot my passwd and the email used to suscribe is not valid anymore...

I'm today senior system architect at some startup. 
We are building a network of embedded devices controlling hardware stuff. 
I'm stepping it as the product is transitioning from prototype phase to industrial phase.

The main app is written for Oracle Java8 and running in Apache/Karaf environment.

The proto was done with Debian boxes managed with salt stack (about 100 of those with a mix of Wheezy and Jessie).

I would like to see the boxes running AL in ''run-from-ram'' mode pulling the apkovl tarball (or at least some tarball to be applied in the /etc/local.d sequence) from a remote server somewhere in the cloud. 
To upgrade would just to rsync the normally read-only SSD and reboot.

To achieve this with AlpineLinux, one has to:

* deploy [[User:Jlo/java7|Oracle Java 7 with glibc]]
* deploy [[User:Jlo/java8|Oracle Java 8 with glibc]]
* deploy [[User:Jlo/python27|python2.7 with needed libs]]
* deploy [[User:Jlo/watchdog|hardware watchdog]]
* deploy [[User:Jlo/network|network drivers]] (eth, usb-eth, wlan, 3g, lte)
* deploy [[User:Jlo/usb|USB drivers]]
* rewrite [[User:Jlo/init|init scripts]]
* prepare a [[User:Jlo/image|custom image]] with every needed packages locally present in disk repo
* adapt [[User:Jlo/packages|custom packages]] from deb to apk ones

To configure a box is done in two parts:

* the network. done locally
* the app layer. done via a webinterface; commited to a server and download by the box at each boot.

The advantages of such architecture are:

* power failure resilient as the system runs from ram The only PoF here is when an upgrade of the read-only medium is done
* boxes use a pull mechanism to stay up-to-date ensuring the right version at any next reboot This protect us against out-of-sync boxes arraising often with push architecture (salt, ansible, ...)
* the two steps boot sequence allows us to temporary take control over a box for maintenance with a totally different setup and as we always keep an ssh access via the VPN, we can force that anytime we want (hardware watchdog being our friend here)
* easy to reproduce in VM for testing (including load tests)

Disadvantages are:

* need own repo with access control to distribute Oracle Java internally without breach of license (but it is the same situation for any distro)
* some used packages are distributed as deb only (from artifactory between others) will need to script part of the CI towards apk generation... will need to check every deb to see if sources are available...

User:Jlo

2017-06-10T10:27:34Z

Jlo:

I was [[User:Jch]] but I forgot my passwd and the email used to suscribe is not valid anymore...

I'm today senior system architect at some startup. 
We are building a network of embedded devices controlling hardware stuff. 
I'm stepping it as the product is transitioning from prototype phase to industrial phase.

The main app is written for Oracle Java8 and running in Apache/Karaf environment.

The proto was done with Debian boxes managed with salt stack (about 100 of those with a mix of Wheezy and Jessie).

I would like to see the boxes running AL in ''run-from-ram'' mode pulling the apkovl tarball (or at least some tarball to be applied in the /etc/local.d sequence) from a remote server somewhere in the cloud. 
To upgrade would just to rsync the normally read-only SSD and reboot.

To achieve this with AlpineLinux, one has to:

* deploy [[User:Jlo/java7|Oracle Java 7 with glibc]]
* deploy [[User:Jlo/java8|Oracle Java 8 with glibc]]
* deploy [[User:Jlo/python27|python2.7 with needed libs]]
* deploy [[User:Jlo/watchdog|hardware watchdog]]
* deploy [[User:Jlo/network|network drivers]] (eth, usb-eth, wlan, 3g, lte)
* deploy [[User:Jlo/usb|USB drivers]]
* rewrite [[User:Jlo/init|init scripts]]
* prepare a [[User:Jlo/image|custom image]] with every needed packages locally present in disk repo
* adapt [[User:Jlo/packages|custom packages]] from deb to apk ones

To configure a box is done in two parts:

* the network. done locally
* the app layer. done via a webinterface; commited to a server and download by the box at each boot.

The advantage of such architecture are:

* power failure resilient as the system runs from ram The only PoF here is when an upgrade of the read-only medium is done
* boxes use a pull mechanism to stay up-to-date ensuring the right version at any next reboot This protect us against out-of-sync boxes arraising often with push architecture (salt, ansible, ...)
* the two steps boot sequence allows us to temporary take control over a box for maintenance with a totally different setup and as we always keep an ssh access via the VPN, we can force that anytime we want (hardware watchdog being our friend here)
* easy to reproduce in VM for testing (including load tests)

User talk:Jlo

2017-06-10T09:51:06Z

Jlo: Created page with " == Oracle Java == Let's adapt one (or more) famous docker files (credit to https://hub.docker.com/r/anapsix/alpine-java/) <pre> apk --update add curl ca-certificates tar cu..."

User:Jlo

2017-06-10T09:11:41Z

Jlo: add links to future studies

User:Jlo

2017-06-10T07:45:56Z

Jlo:

User:Jlo

2017-06-09T14:33:53Z

Jlo: Created page with "I was User:Jch but I forgot my passwd and the email used to suscribe is not valid anymore..."

I was [[User:Jch]] but I forgot my passwd and the email used to suscribe is not valid anymore...