c86fcf3580
Split the mkinitcpio-only remote-LUKS-unlock path into an InitramfsBackend ABC with a get_backend() dispatch, and add the initramfs-tools backend for Debian / Raspberry Pi OS. - base.py: six-step backend contract; encryption.py becomes a thin, distro-neutral sequencer (get_backend by distribution). - initramfs_tools.py: crypttab `none luks,initramfs`, cmdline rewritten to root=/dev/mapper + ip=::::host:eth0:dhcp, dropbear-initramfs authorized_keys, update-initramfs -k all (no build-host uname leak). - shipped hooks (configuration/initramfs-tools/*): single-hop non-anonymous onion, libnss DNS baking, sed-not-source DHCP, kill-tor-before-pivot. - shared offline onion keygen in keygen.py; tor.py removed (logic moved to mkinitcpio.py). - raspios added to the apt distro family (session.py, raspberry.py). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
38 lines
1.3 KiB
Python
38 lines
1.3 KiB
Python
"""Remote-unlockable LUKS boot configuration.
|
|
|
|
Distro-agnostic orchestration; the init-system-specific steps live in the
|
|
initramfs backends (mkinitcpio for Arch/Manjaro, initramfs-tools for
|
|
Debian/Raspberry Pi OS). See lim/image/initramfs/.
|
|
"""
|
|
|
|
from pathlib import Path
|
|
|
|
from lim import packages, ui
|
|
from lim.image.initramfs import get_backend
|
|
from lim.image.plan import ImagePlan
|
|
from lim.image.session import ImageSession, install_packages
|
|
|
|
|
|
def configure_encryption(plan: ImagePlan, session: ImageSession, authorized_keys: Path) -> None:
|
|
root = session.root_mount_path
|
|
backend = get_backend(plan.distribution)
|
|
ui.info("Setup encryption...")
|
|
ui.info("Installing neccessary software...")
|
|
install_packages(
|
|
plan.distribution,
|
|
root,
|
|
" ".join(packages.get_packages(backend.luks_package_collection())),
|
|
)
|
|
|
|
backend.install_authorized_key(root, authorized_keys)
|
|
|
|
if plan.tor_unlock:
|
|
# Hook files and onion keys must exist before the initramfs is baked.
|
|
backend.install_tor_unlock(plan, root)
|
|
|
|
# crypttab must be written before the initramfs is (re)generated so the
|
|
# Debian cryptsetup hook can bake the mapping in.
|
|
backend.register_encrypted_root(plan, session, root)
|
|
backend.configure_initramfs(plan, root)
|
|
backend.configure_bootloader(plan, session, root)
|