Aquilenet

# Autoinstall OpenBSD !

* What ?

You want to build a full automated OpenBSD in 3 minuts, here is the cookbook.

I used it to deploy various PC Engines APU routers/firewalls.

* How ?

PXE Boot from the OpenBSD Builder

#### Packages

~~~

pkg_add bash colorls curl git gmake gnuwatch go jq python-3.6

~~~

#### PXE Interface

~~~

builder# cat /etc/hostname.em1                                                                                                                                         

172.16.16.254/24 description "PXE"

~~~

#### dhcpd

~~~

    filename "auto_install";

    next-server 172.16.16.254;

subnet 172.16.16.0 netmask 255.255.255.0 {

    range 172.16.16.1 172.16.16.2;

    option subnet-mask 255.255.255.0;

    option broadcast-address 172.16.16.255;

    option routers 172.16.16.254;

    }

~~~

~~~

echo "dhcpd_flags=em1">> /etc/rc.conf.local

~~~

#### PXE

~~~ 

mkdir -p /tftp/etc && chown _tftpd:_tftpd /tftp

cd /tftp

ftp http://mirrors.ircam.fr/pub/OpenBSD/6.5/amd64/pxeboot

ftp http://mirrors.ircam.fr/pub/OpenBSD/6.5/amd64/bsd.mp

ln -s pxeboot auto_install

ln -s bsd.rd bsd

 echo "

  stty com0 115200

  boot bsd

  " > /tftp/etc/boot.conf

 echo 'tftpd_flags="-4 /tftp"' >> /etc/rc.conf.local

 /etc/rc.d/dhcpd start

 /etc/rc.d/tftpd start

~~~ 

#### Copy sources

~~~

$ cd /var/www/htdocs

$ mkdir -p pub/OpenBSD/6.5/amd64/

$ cd pub/OpenBSD/6.5/amd64/

$ ftp 'ftp://ftp.nluug.nl/pub/OpenBSD/6.5/amd64/*'

~~~

~~~

signify -C -p /etc/signify/openbsd-65-base.pub -x SHA256.sig

~~~

#### /etc/httpd.conf

~~~

server "*" {

        listen on * port 80

        directory auto index

}

#### builder

~~~

#!/usr/local/bin/bash

#####################################

# Builder - v1.0

#####################################

echo "=========================================="

echo "=  OpenBSD Configuration builder - V1.1  ="

echo "=  sacha at aquilenet.fr -=o=- 20190722  ="

echo "=========================================="

BPATH="/builder"

SKEL="$BPATH/skel"

WWW="$BPATH/www"

TGZ="$BPATH/siteXX.tgz"

VERSION="$(uname -r)"

VER="$(uname -r |tr -d '.')"

ok="n"

until [ $ok == "o" ]; do

read -p "Nom  du site: " SITE

#read -p "Departement: " DEP

read -p "Code Postal: " CP

read -p "infos OSM:" OSM

read -p "pppoe user: " PPPOEU

read -p "pppoe pass: " PPPOEP

DEP=${CP:0:2}

echo "----------------------------------"

echo "Site              : $SITE"

echo "Departement       : $DEP"

echo "Code Postal       : $CP"

echo "Infos OSM         : $OSM"

echo "pppoe user        : $PPPOEU"

echo "pppoe pass        : $PPPOEP"

read -p "ok ? (o/n):" ok

done

SITEPATH="$BPATH/site/$SITE"

mkdir -p $SITEPATH/{root,etc,var/unbound/etc/,home,usr/local/bin}

cp -R $SKEL/* $SITEPATH/

#-------------------

#  myname 

#-------------------

echo "cerbere.$SITE.mydomain.fr" > $SITEPATH/etc/myname

#-------------------

#  dhcpd.conf

#-------------------

sed -e "s/DEP/$DEP/g" -e "s/SITE/$SITE/g"  $SKEL/etc/dhcpd.conf > $SITEPATH/etc/dhcpd.conf

#-------------------

#  hostname.pppoe0

#-------------------

sed -e "s/PPPOEU/$PPPOEU/g" -e "s/PPPOEP/$PPPOEP/g" $SKEL/etc/hostname.pppoe0 > $SITEPATH/etc/hostname.pppoe0

#-------------------

#  hostname.em2

#-------------------

sed -e "s/DEP/$DEP/g" $SKEL/etc/hostname.em2 > $SITEPATH/etc/hostname.em2

#-------------------

# unbound.conf

#-------------------

sed -e "s/DEP/$DEP/g" $SKEL/var/unbound/etc/unbound.conf > $SITEPATH/var/unbound/etc/unbound.conf

#-------------------

# prometheus geoash 

#-------------------

preposition=$(curl -Ls  "https://nominatim.openstreetmap.org/search/$CP $OSM?format=geojson&limit=1" |jq '.features[].geometry.coordinates| .[]')

position=$(echo $preposition | awk '{ for (i=NF; i>1; i--) printf("%s ",$i); print $1; }')

position=${position/ /,}

pregeoash=$(curl -Ls -w %{url_effective} -o /dev/null "http://geohash.org?q=$position")

geoash=${pregeoash#"http://geohash.org/"}

echo $geoash 

echo 'loc{geohash="$geoash",place="'$SITE'"} 10' > $SKEL/var/node_exporter/site_location.prom

#=====================================================================================================

# FIN

cd $SITEPATH && tar czvf  $TGZ/$SITE-site$VER.tgz .

rm -f $WWW/pub/OpenBSD/$VERSION/amd64/site.tgz

cp $TGZ/$SITE-site$VER.tgz $WWW/pub/OpenBSD/$VERSION/amd64/site$VER.tgz

~~~

~~~

builder|02:37:51|:/builder#ls -alh /builder/

total 32

drwxr-xr-x   6 root  wheel   512B Jul 22 02:37 .

drwxr-xr-x  15 root  wheel   512B Jul 21 18:24 ..

-rwxr-xr-x   1 root  wheel   1.8K Jul 22 02:32 builder.sh

lrwxr-xr-x   1 root  wheel    54B Jul 21 21:35 prometheus-build -> /home/sacha/go/src/github.com/prometheus/node_exporter

drwxr-xr-x   3 root  wheel   512B Jul 22 01:35 site

drwxr-xr-x   2 root  wheel   512B Jul 22 01:35 siteXX.tgz

drwxr-xr-x   7 root  wheel   512B Jul 22 01:30 skel

-rw-r--r--   1 root  wheel   1.2K Jul 22 01:07 test.tgz

lrwxr-xr-x   1 root  wheel     5B Jul 21 18:24 tftp -> /tftp

drwxr-xr-x   2 root  wheel   512B Jul 22 00:05 tmp

lrwxr-xr-x   1 root  wheel    16B Jul 21 18:24 www -> /var/www/htdocs/

~~~

~~~

#### /tmp/i/install.resp

printf '%s' 'yourpassword' | encrypt

#### install.conf

~~~

System hostname = cerbere

Which network interface do you wish to configure = em0

IPv4 address for em0 = dhcp

IPv6 address for em0 = none

Which network interface do you wish to configure = done

DNS domain name = SITE.mydomain.fr

DNS nameservers = none

Start sshd(8) by default = yes

Do you expect to run the X Window System = no

Change the default console to com0 = yes

Which speed should com0 use = 115200

Password for root account = $2b$10$V2wkDaLWTc0jmdPEMOW5VOPeg.nS9YbJOsj6LYZMrXdRiDCGoo6yu 

Password for user sacha = $2b$09$GWtR24VPpbZTdKyu5MZStOlyiNn2IKUy2trMI1rOJh1YjEjjNZKJa

Setup a user = sacha

Full name for user sacha = sacha

Public ssh key for user sacha = ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAgEA4y0oNSz3pvt2WVY/kBnlciuKoO8Nhxc+zsiaA7EOw+MRaysGZ6tymgMBpwuOCwMA8oBdgOzzlZOk7oIM1AUVjykrcrS3JPW1AOp0rjHJSDQKc8x2jBZTM8VIt1GoDTvfxoO6WTjaPJwwOxZlcS1zT6nW1y5IvO0Apz4MVKKNUZaZNa7x7MBfV59nXvWORddf3zJD/lHpK8WxfRVgYRJoLrNiqUe26GaDCKPge5fAmtgJMLvKGSzdsoCxtrY04tZw3fsdb/hJl7/Ov7dyX9NXJEU0dveFXZnLhYwKVhUa0CRxawCez202HInhp3LttYptwoX8jCjuRMlPL4+rhKtnDnze4Q81hU08xTV+TmNOzdPpVs0hY9wkQXyYrBlAGMjLQS0JQVL0hnI5FBB90GhwxzxzvD7HYLjipXXyOpdn/GZeSEG9ayjxc8kgXesT9Ogwo0GiXxPOjHz32NEJbDXXktMJZJuSqM6zD3KroB4qB6gLFZRnklqiedRTOMYJLYhC1MtdXqN/wpdlFQemYvCCGr44FJKLMDBYch4AiChVnr8VmnMzs+3ZE/3cP6tzDwgjotZc3uKN9nbEQt6SamlxW68P35ScODT1tED0JHep4qRxa5wQjYbLFQNwlWU1Vj7SxNDW0ahyZO5OZiuqtUjYzthhGECFqCtJwc/y2NTstFM= nobody@nowhere

Allow root ssh login = no

Which disk is the root disk = sd0

Use (W)hole disk MBR, whole disk (G)PT, (O)penBSD area or (E)dit = O 

Use (A)uto layout, (E)dit auto layout, or create (C)ustom layout = a 

Which disk do you wish to initialize = done

Location of sets = http 

HTTP proxy URL = none

HTTP Server = 172.16.16.254

Pathname to the sets = pub/OpenBSD/6.5/amd64 

Unable to connect using https. Use http instead = yes

Set name(s) = -x*

Set name(s) = -g*

Set name(s) = site65.tgz

Checksum test for site65.tgz failed. Continue anyway = yes

Unverified sets: site65.tgz. Continue without verification = yes

Set name(s) = done

Directory does not contain SHA256.sig. Continue without verification = yes

Location of sets = done

What timezone are you in = Europe/Paris

Exit to (S)hell, (H)alt or (R)eboot = R

~~~

#### build siteXX.tgz

exemple copier le site65.tgz dans www/pub/OpenBSD/6.5/amd64 puis ls -al > www/pub/OpenBSD/6.5/amd64/index.txt

script install: install.site https://undeadly.org/cgi?action=article;sid=20080111200305

#### install.site 

~~~

usermod -G wheel sacha

echo 'node_exporter:\

        :tc=daemon: '>> /etc/login.conf

cap_mkdb /etc/login.conf

groupadd _node_exporter

useradd -u _node_exporter -c "Prometheus Node Exporter agent" -d /var/empty -s /sbin/nologin -L node_exporter _node_exporter

~~~

* Sources

http://eradman.com/posts/autoinstall-openbsd.html

http://149.210.185.89/openbsd-autoinstall.html

http://www.openbsd.org/faq/faq4.html#site

https://man.openbsd.org/autoinstall.8