ccdef065df
Bash scripts were untestable and duplicated device/LUKS/mount logic; the lim/ package centralizes it behind one subprocess wrapper and a YAML image catalog (single point of truth). BREAKING CHANGE: scripts/*.sh removed. Use `lim --type <cmd>`; new types mount/umount/single-boot/raid1-boot/lock/unlock/import/export replace direct script calls. --extra is deprecated and ignored. - distributions.yml + lim/catalog.py hold the image catalog (PyYAML) - pytest suite: 102 tests with mocked subprocess (tests/unit) and a 250-line max file-length guard (tests/lint) - ruff strict (select ALL), GitHub Actions CI, Dependabot; Travis gone - Makefile: install (symlink ~/.local/bin/lim) and test targets - fixes over bash: SUDO_USER-aware chown, mmcblk/nvme partition paths, sha512 checksum support, whole-pipeline failure detection, blkid UUID fallback for pre-mounted images, conditional fstab seeding for PARTUUID/LABEL images, clean errors for missing binaries
69 lines
2.2 KiB
Python
69 lines
2.2 KiB
Python
"""Encrypted Btrfs RAID1 across two drives.
|
|
|
|
See https://balaskas.gr/btrfs/raid1.html and
|
|
https://mutschler.eu/linux/install-guides/ubuntu-btrfs-raid1/
|
|
"""
|
|
|
|
from lim import luks, runner, ui
|
|
from lim.storage.common import StorageTarget, select_storage_target
|
|
|
|
|
|
def _select_pair() -> tuple[StorageTarget, StorageTarget]:
|
|
ui.info("RAID1 partition 1...")
|
|
first = select_storage_target()
|
|
ui.info("RAID1 partition 2...")
|
|
second = select_storage_target()
|
|
return first, second
|
|
|
|
|
|
def setup() -> None:
|
|
first, second = _select_pair()
|
|
|
|
ui.info(f"Encrypting {first.device.path}...")
|
|
runner.run(["cryptsetup", "luksFormat", first.device.path], sudo=True)
|
|
ui.info(f"Encrypting {second.device.path}...")
|
|
runner.run(["cryptsetup", "luksFormat", second.device.path], sudo=True)
|
|
|
|
runner.run(["cryptsetup", "luksOpen", first.device.path, first.mapper_name], sudo=True)
|
|
runner.run(
|
|
["cryptsetup", "luksOpen", second.device.path, second.mapper_name], sudo=True
|
|
)
|
|
runner.run(["cryptsetup", "status", first.mapper_path], sudo=True)
|
|
runner.run(["cryptsetup", "status", second.mapper_path], sudo=True)
|
|
|
|
runner.run(
|
|
[
|
|
"mkfs.btrfs",
|
|
"-m",
|
|
"raid1",
|
|
"-d",
|
|
"raid1",
|
|
first.mapper_path,
|
|
second.mapper_path,
|
|
],
|
|
sudo=True,
|
|
)
|
|
|
|
ui.success("Encryption successfull :)")
|
|
|
|
|
|
def _show_luks_devices() -> None:
|
|
for name in runner.output(["lsblk", "-dno", "NAME"], check=False).split():
|
|
if runner.succeeds(["cryptsetup", "isLuks", f"/dev/{name}"], sudo=True):
|
|
ui.info(f"/dev/{name} is a LUKS encrypted storage device.")
|
|
|
|
|
|
def mount_on_boot() -> None:
|
|
ui.info("Activate Automount raid1 encrypted storages...")
|
|
_show_luks_devices()
|
|
|
|
first, second = _select_pair()
|
|
|
|
luks.create_luks_key_and_update_crypttab(first.mapper_name, first.device.path)
|
|
ui.info(f'Creating mount folder under "{first.mount_path}"...')
|
|
runner.run(["mkdir", "-vp", first.mount_path], sudo=True)
|
|
luks.create_luks_key_and_update_crypttab(second.mapper_name, second.device.path)
|
|
luks.update_fstab(first.mapper_path, first.mount_path)
|
|
|
|
ui.success("Installation finished. Please restart :)")
|