lf-ubuntu.cfg

# Ubuntu Autoinstall Configuration

# Author:  Linuxfabrik GmbH, Zurich, Switzerland
# Contact: info (at) linuxfabrik (dot) ch
#          https://www.linuxfabrik.ch/
# License: The Unlicense, see LICENSE file.

# This autoinstall file is the Ubuntu equivalent of lf-rhel.cfg.
# It provides a minimal Ubuntu Server installation with LVM partitioning.
#
# Note: Autoinstall only works with Ubuntu 20.04+ (subiquity installer).
#       It does NOT work with Debian (which uses preseed).
#
# Usage:
#   Serve this file as 'user-data' alongside an empty 'meta-data' file via HTTP,
#   then boot from an Ubuntu Server ISO and append to the kernel cmdline:
#     autoinstall ds=nocloud-net;s=http://<server>/<path>/
#
# This config targets UEFI systems. For BIOS, replace the EFI partition
# (part-efi, format-efi, mount-efi) with a bios_grub partition:
#   - id: part-bios
#     type: partition
#     device: disk0
#     size: 1M
#     flag: bios_grub
#
# Version stamp (YYYYMMDDNN): LF_KICKSTART_VERSION=2026041502
# See CONTRIBUTING "Versioning the Kickstart File" for the bump rules. The
# same literal must appear in the early-commands and late-commands blocks
# below; it is logged via logger(1) during early-commands (lands in the
# live installer journal → /var/log/installer/installer-journal.txt) and
# written to /root/lf-install-version on the installed system so any host
# can be traced back to a specific lf-ubuntu.cfg build.

#cloud-config
autoinstall:
  version: 1

  # Log the Linuxfabrik Kickstart version stamp into the installer journal
  # for fleet traceability. Must match the literal in the header and in
  # late-commands below.
  early-commands:
    - logger -t linuxfabrik-autoinstall "Linuxfabrik Kickstart version: 2026041502"

  locale: en_US.UTF-8

  keyboard:
    layout: us

  timezone: Europe/Zurich

  # Shutdown after installation
  shutdown: poweroff

  # Minimal server install
  source:
    id: ubuntu-server-minimal

  # Network: DHCP is the default.
  # Do not set explicit network options to allow kernel cmdline ip= and
  # nameserver= to take effect.

  # Partitioning: LVM with /boot, /, /backup and swap.
  # Uses the largest available disk.
  storage:
    config:
      - id: disk0
        type: disk
        ptable: gpt
        wipe: superblock-recursive
        grub_device: true
        match:
          size: largest

      # EFI System Partition (UEFI only, see header comment for BIOS)
      - id: part-efi
        type: partition
        device: disk0
        size: 512M
        flag: boot
        grub_device: true

      - id: format-efi
        type: format
        fstype: fat32
        volume: part-efi

      # /boot
      - id: part-boot
        type: partition
        device: disk0
        size: 1G

      - id: format-boot
        type: format
        fstype: ext4
        volume: part-boot

      # LVM physical volume (rest of disk)
      - id: part-lvm
        type: partition
        device: disk0
        size: -1

      - id: vg-rl
        type: lvm_volgroup
        name: rl
        devices:
          - part-lvm

      # /backup (1 GB, restricted mount options)
      - id: lv-backup
        type: lvm_partition
        volgroup: vg-rl
        name: backup
        size: 1G

      - id: format-backup
        type: format
        fstype: ext4
        volume: lv-backup

      # swap
      - id: lv-swap
        type: lvm_partition
        volgroup: vg-rl
        name: swap
        size: 2G

      - id: format-swap
        type: format
        fstype: swap
        volume: lv-swap

      # / (remaining space)
      - id: lv-root
        type: lvm_partition
        volgroup: vg-rl
        name: root
        size: -1

      - id: format-root
        type: format
        fstype: ext4
        volume: lv-root

      # Mount points
      - id: mount-root
        type: mount
        path: /
        device: format-root

      - id: mount-boot
        type: mount
        path: /boot
        device: format-boot

      - id: mount-efi
        type: mount
        path: /boot/efi
        device: format-efi

      - id: mount-backup
        type: mount
        path: /backup
        device: format-backup
        options: nodev,noexec,nosuid

      - id: mount-swap
        type: mount
        path: none
        device: format-swap

  # User setup
  # The linuxfabrik user has the password 'password' (change after first login).
  # Root account is locked in late-commands.
  identity:
    hostname: localhost
    username: linuxfabrik
    # SHA-512 hash of 'password'
    password: '$6$jUQz3dmHOgqKZ8By$mDSQTJ.DQiHnCvT2WUekXi/z6/mf8/lGrP2pHY0hgopg6QW6XULPebzYAhDbJ0PQ18IGpCuhTNbOHp2ZVJOxs1'

  # SSH server
  ssh:
    install-server: true
    authorized-keys:
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFnYvkLotqpRKOWyT06IC73nqfvUWxtPTPvFZOnWmUVH danyal.berchtold@linuxfabrik.ch'
      - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDaWaDOEGqhZy1XD3a0IJKPvuB0wz2Yzc7Y8b2E91PPDSfi2wczUjZ9T2f8J7fw46i6O8dUFdsle8HePlVt1f6P+SPr84KIvte4sCXPGjHO7UlP+0biPl1FJbe+LU6akGVgAhc37CTn7h10COim5TpIdmPfn8A1y0Y8G3GNTVELSC4GG6rJLgme++OTkNlenH+L7KSobQE1v+MS4mRjrg+qitgPzBv1VgTWJff4d3vdEtb9zwVdzZzyXcdP5/nWH54iDaZawLsyvPXG2VDQq9bUn4CbZ+/ldrVg+yi8Y5RlSLFlbaX2XKnqf8mC3fpszXrmZ93d/idvCLDQ2ijV1FQzYLNg9nstV6VHCek1+g0u3oQ17CyRRCuxSRf3kDagO/+FMGwIliQTSX8rTx0epYzj4vUKA0nYIHXhwklUTG2PFNgJ1Nfxllqblij/PbFfoJCCp+st7/ewYYiclV6jrAg01/bqAvrdS8PW6JQpTIeuJRZhkrvCxgzDsuYE+EqTHxyBs7Uxu9D8QvgZEYiwuClRE92xPNmuEk/BDpX9s8mcXtamp57AUESRFWPFUZoDFuHRjHz56lXJ0UIfDR7XDZHumdQRt6jh7Sj0YGVN3Es9UIqka9dZRiXLdZ9q/C0IReZKtcKDSIn/xB1Kt2qAIRLpSG3IX8JmONOa1h/Gns1NKw== markus.frei@linuxfabrik.ch'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM5DxWzuUlSfdHHE1c4oQ2cbC0TyjXkVCuNKBJvn7TvX navid.sassan@linuxfabrik.ch'
    allow-pw: true

  # Additional packages
  packages:
    - qemu-guest-agent

  # Post-installation commands
  # These run in the installer environment; use /target to access the installed system
  # or 'curtin in-target --' to run commands inside the installed system's chroot.
  late-commands:
    # Record the Linuxfabrik Kickstart version stamp on the installed system
    # for fleet traceability.
    - echo "2026041502" > /target/root/lf-install-version
    # Lock root account (no password)
    - curtin in-target -- passwd -l root
    # Allow password-less sudo for linuxfabrik
    - printf 'linuxfabrik ALL=(ALL) NOPASSWD: ALL\n' > /target/etc/sudoers.d/linuxfabrik
    - chmod 0440 /target/etc/sudoers.d/linuxfabrik
    # Disable firewall
    - curtin in-target -- ufw disable || true
    # Disable kdump
    - curtin in-target -- systemctl disable kdump || true