mount-generator

#!/bin/bash

# This script dynamically creates the correct mounts based on whether
# we are running system A or B -- we will not "know" at build time
# what we are going to be booted from because the same image could
# be placed into either system A or system B root partition during
# upgrades.
#
# The dynamically changing mounts depend on the OS type:
# HostOS:
#   - /boot is /dev/hostlvm/A_boot (system A) or /dev/hostlvm/B_boot (system B)
#   - /var is /dev/hostlvm/A_var (system A) or /dev/hostlvm/B_var (system B)
# GuestOS:
#   - /boot is /dev/vda4 (system A) or /dev/vda7 (system B)
#   - /var is /dev/vda6 (system A) or /dev/vda9 (system B)
#
# This is generated dynamically to avoid changing /etc/fstab (root
# filesystem might be read-only).
#
# systemd doc advises to "not use shell scripts" as generators --
# while I agree with that and the rationale behind it, this script
# is written carefully and works correctly, and is quicker to write
# than setting up a compiled binary (for now).

UNIT_DIR="$1"
OS_TYPE=$(cat /opt/ic/share/os-type)

function get_boot_arg_value() {
    local ARGNAME="$1"
    for ARG in $(cat /proc/cmdline); do
        echo "$ARG" | while IFS='=' read KEY VALUE; do
            if [ "$ARGNAME" == "$KEY" ]; then echo "$VALUE"; fi
        done
    done
}

function make_requires() {
    mkdir -p "${UNIT_DIR}"/$1.requires
    ln -s ../$2 "${UNIT_DIR}"/$1.requires/$2
}

function make_boot_mount() {
    if [ "$OS_TYPE" == "hostos" ]; then
        if [ "$1" == A ]; then
            local WHAT=/dev/hostlvm/A_boot
        else
            local WHAT=/dev/hostlvm/B_boot
        fi
    else
        if [ "$1" == A ]; then
            local PARTUUID="ddf618fe-7244-b446-a175-3296e6b9d02e"
        else
            local PARTUUID="d5214e4f-f7b0-b945-9a9b-52b9188df4c5"
        fi
        local WHAT=/dev/disk/by-partuuid/${PARTUUID}
    fi
    echo "# Automatically generated by /etc/systemd/system-generators/mount-generator"
    echo "[Unit]"
    echo "SourcePath=/etc/systemd/system-generators/mount-generator"
    echo "Before=local-fs.target"
    echo
    echo "[Mount]"
    echo "What=$WHAT"
    echo "Where=/boot"
    echo "Type=ext4"
    echo "Options=defaults"
}

# HostOS-specific: plain LVM-backed /var
function make_var_setup() {
    if [ "$1" == A ]; then
        local DEVICE=A_var
    else
        local DEVICE=B_var
    fi
    echo "# Automatically generated by /etc/systemd/system-generators/mount-generator"
    echo "[Unit]"
    echo "SourcePath=/etc/systemd/system-generators/mount-generator"
    echo "Description=Setup for var"
    echo "DefaultDependencies=no"
    echo "After=dev-hostlvm-${DEVICE}.device"
    echo "Requires=dev-hostlvm-${DEVICE}.device"
    echo "Before=var.mount"
    echo ""
    echo "[Service]"
    echo "Type=oneshot"
    echo "RemainAfterExit=yes"
    echo "ExecStart=/opt/ic/bin/setup-var.sh /dev/hostlvm/${DEVICE}"
}

function make_var_mount() {
    if [ "$1" == A ]; then
        local DEVICE=/dev/hostlvm/A_var
    else
        local DEVICE=/dev/hostlvm/B_var
    fi
    echo "# Automatically generated by /etc/systemd/system-generators/mount-generator"
    echo "[Unit]"
    echo "SourcePath=/etc/systemd/system-generators/mount-generator"
    echo "Before=local-fs.target"
    echo "Requires=var-setup.service"
    echo
    echo "[Mount]"
    echo "What=$DEVICE"
    echo "Where=/var"
    echo "Type=ext4"
    echo "Options=defaults"
}

# GuestOS-specific: encrypted /var via cryptsetup
function make_var_cryptsetup() {
    if [ "$1" == A ]; then
        local PARTUUID="22d2f5a6-1e39-d247-81cf-90c95c113e21"
        local ALT_PARTUUID="2237d1d1-ce96-584e-8ec5-8ae6661faae9"
    else
        local PARTUUID="2237d1d1-ce96-584e-8ec5-8ae6661faae9"
        local ALT_PARTUUID="22d2f5a6-1e39-d247-81cf-90c95c113e21"
    fi

    # Systemd uses weirdly-escaped unit names
    SYSTEMD_DEVICE=$(systemd-escape dev/disk/by-partuuid/${PARTUUID}.device)

    # Generate a unit that will set up the partition as encrypted storage.
    # The "mount" unit depends on the "blockdev@dev-mapper-var_crypt.target"
    # and will simply mount the properly prepared /dev/mapper/var_crypt.
    #
    # The unit file below is an adapted version of what the built-in systemd
    # crypttab generator creates for crypttab entries.
    echo "[Unit]"
    echo "Description=Cryptography Setup for var_crypt"
    echo "DefaultDependencies=no"
    echo "IgnoreOnIsolate=true"
    echo "After=cryptsetup-pre.target systemd-udevd-kernel.socket"
    echo "Before=blockdev@dev-mapper-var_crypt.target"
    echo "Wants=blockdev@dev-mapper-var_crypt.target"
    echo "Before=var.mount"
    # Run fsck after we are done, since we also create the FS in this generated unit
    echo "Before=systemd-fsck@dev-mapper-var_crypt.service"
    echo "Conflicts=umount.target"
    echo "Before=cryptsetup.target"
    echo "Requires=init-config.service"
    echo "After=init-config.service"
    echo "Wants=ic-node-tmpfiles.service"
    echo "After=ic-node-tmpfiles.service" # needed for metrics
    # We need /boot/config for the decryption key (unless SEV is enabled)
    echo "RequiresMountsFor=/boot/config/store.keyfile"
    echo "BindsTo=${SYSTEMD_DEVICE}"
    echo "After=${SYSTEMD_DEVICE}"
    echo "Before=umount.target"
    echo ""
    echo "[Service]"
    echo "Type=oneshot"
    echo "RemainAfterExit=yes"
    echo "TimeoutSec=infinity"
    echo "KeyringMode=shared"
    echo "OOMScoreAdjust=500"
    echo "ExecStart=/opt/ic/bin/setup-var-encryption.sh /dev/disk/by-partuuid/${PARTUUID} /dev/disk/by-partuuid/${ALT_PARTUUID}"
    echo "ExecStop=/lib/systemd/systemd-cryptsetup detach var_crypt"
}

CURRENT_SYSTEM=$(get_boot_arg_value dfinity.system)

make_boot_mount "$CURRENT_SYSTEM" >"$UNIT_DIR"/boot.mount
make_requires local-fs.target boot.mount
make_requires boot-efi.mount boot.mount
make_requires boot-grub.mount boot.mount

if [ "$OS_TYPE" == "hostos" ]; then
    make_var_setup "$CURRENT_SYSTEM" >"$UNIT_DIR"/var-setup.service
    make_var_mount "$CURRENT_SYSTEM" >"$UNIT_DIR"/var.mount
else
    make_var_cryptsetup "$CURRENT_SYSTEM" >"$UNIT_DIR"/systemd-cryptsetup@var_crypt.service
    make_requires dev-mapper-var_crypt.device systemd-cryptsetup@var_crypt.service
    make_requires cryptsetup.target systemd-cryptsetup@var_crypt.service
fi