# Generated by Anaconda 40.22.3.46
# Generated by pykickstart v3.52.12
#version=OL10
# Unattended reinstall of point.saenko.net (Firefly III VPS). ERASES vda.
# Boot: inst.ks=https://config.saenko.net/point.ks.txt ip=185.238.74.104::185.238.74.1:255.255.254.0:point.saenko.net:ens3:none nameserver=1.1.1.1 inst.text

text

%addon com_redhat_kdump --enable --reserve-mb='auto'

%end

# Keyboard layouts
keyboard --vckeymap=us --xlayouts='us'
# System language
lang en_US.UTF-8

# Network information
network  --bootproto=static --device=ens3 --gateway=185.238.74.1 --ip=185.238.74.104 --nameserver=1.1.1.1,8.8.8.8 --netmask=255.255.254.0 --ipv6=auto --activate
network  --hostname=point.saenko.net

# Use network installation
url --url="https://yum.oracle.com/repo/OracleLinux/OL10/baseos/latest/x86_64/"
# rsyslog and policycoreutils-python-utils live in AppStream
repo --name=appstream --baseurl="https://yum.oracle.com/repo/OracleLinux/OL10/appstream/x86_64/"

%packages
@^minimal-environment
chrony
rsyslog
policycoreutils-python-utils

%end

firstboot --disable
selinux --enforcing
# SSH only on 65022 (ssh_port / ansible_port in the automation inventory)
firewall --enabled --port=65022:tcp
services --enabled=chronyd,rsyslog,sshd

# Generated using Blivet version 3.13.0
ignoredisk --only-use=vda
# Partition clearing information
zerombr
clearpart --all --initlabel --drives=vda
# Disk partitioning information
part /boot --fstype="xfs" --ondisk=vda --size=2048
part pv.227 --fstype="lvmpv" --ondisk=vda --size=36865 --grow
part biosboot --fstype="biosboot" --ondisk=vda --size=1
volgroup ol --pesize=4096 pv.227
logvol /tmp --fstype="xfs" --size=2048 --name=tmp --vgname=ol
logvol / --fstype="xfs" --size=28672 --name=root --vgname=ol
logvol /var/log --fstype="xfs" --size=3072 --name=var_log --vgname=ol
logvol swap --fstype="swap" --size=3068 --name=swap --vgname=ol


# System timezone
timezone Europe/Warsaw --utc

#Root password
rootpw --lock
user --groups=wheel --name=ans --password=$y$j9T$H8dpNvlYzjk2kKo917wxA76z$DTTT4is2vrhIV2tsjUldbf0XiKatf.ICmU4iUES4zQ/ --iscrypted --gecos="ans"

reboot

%post --log=/root/ks-post.log
# no -e: one failing step must not skip the SSH key and sudo setup below
set -ux

# sshd on 65022 only; same hardening drop-in as roles/firefly_base writes (no diff later)
semanage port -a -t ssh_port_t -p tcp 65022 || semanage port -m -t ssh_port_t -p tcp 65022
echo "Port 65022" > /etc/ssh/sshd_config.d/10-port.conf
chmod 600 /etc/ssh/sshd_config.d/10-port.conf
printf 'PermitRootLogin no\nPasswordAuthentication no\nX11Forwarding no\nMaxAuthTries 3\n' > /etc/ssh/sshd_config.d/00-hardening.conf
chmod 600 /etc/ssh/sshd_config.d/00-hardening.conf

# Ansible controller key for ans (~/.ssh/id_ed25519 on the Mac)
install -d -m 700 -o ans -g ans /home/ans/.ssh
echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDFqZYNKIauvvh3rMLmv2gaWG47l5DI+jl3/b9ShqMXB sergei@macbook15" > /home/ans/.ssh/authorized_keys
chown ans:ans /home/ans/.ssh/authorized_keys
chmod 600 /home/ans/.ssh/authorized_keys
restorecon -R /home/ans/.ssh

# Passwordless sudo for Ansible (become without -K)
echo "ans ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/ans
chmod 440 /etc/sudoers.d/ans
visudo -cf /etc/sudoers.d/ans
# no sshd -t here: host keys are generated on first boot
%end