From b5764ed82a7325999fda6154f9a58a74f6d21767 2015-12-15 16:58:51
From: Jan Wagner <mail@jwagner.eu>
Date: 2015-12-15 16:58:51
Subject: [PATCH] Added: ENABLE_MINBASE, Fix: Use systemd-networkd

---

diff --git a/README.md b/README.md
index b46c742..6ded691 100644
--- a/README.md
+++ b/README.md
@@ -16,6 +16,7 @@ ENABLE_UBOOT=true ./rpi2-gen-image.sh
 ENABLE_CONSOLE=false ENABLE_IPV6=false ./rpi2-gen-image.sh
 ENABLE_HARDNET=true ENABLE_IPTABLES=true /rpi2-gen-image.sh
 APT_SERVER=ftp.de.debian.org APT_PROXY="http://127.0.0.1:3142/" ./rpi2-gen-image.sh
+ENABLE_MINBASE=true ./rpi2-gen-image.sh
  ```
 
 #### APT settings:
@@ -27,54 +28,57 @@ Set Proxy server address. Using a local Proxy-Cache like `apt-cacher-ng` will sp
 
 #### General system settings:
 ##### `HOSTNAME`="rpi2-jessie"
-Set system host name. It is recommended that the host name is unique in the corresponding subnet.  
+Set system host name. It's recommended that the host name is unique in the corresponding subnet.
 
 ##### `PASSWORD`="raspberry"
-Set system root password. It is **STRONGLY** recommended that you choose a custom password. 
+Set system `root` password. The same password is used for the created user `pi`. It's **STRONGLY** recommended that you choose a custom password.
 
 ##### `DEFLOCAL`="en_US.UTF-8"
-Set default system locale and keyboard layout. This setting can also be changed inside the running OS using the `dpkg-reconfigure locales` command.  
+Set default system locale and keyboard layout. This setting can also be changed inside the running OS using the `dpkg-reconfigure locales` command. The script variant `minbase` (ENABLE_MINBASE=true) doesn't install `locales`.
 
 ##### `TIMEZONE`="Europe/Berlin"
 Set default system timezone. All available timezones can be found in the `/usr/share/zoneinfo/` directory. This setting can also be changed inside the running OS using the `dpkg-reconfigure tzdata` command.
 
 #### Basic system features:
 ##### `ENABLE_CONSOLE`=true
-Enable console output
+Enable serial console interface. Recommended if no monitor or keyboard is connected to the RPi2. In case of problems fe. if the network (auto) configuration failed - the serial console can be used to access the system.
 
 ##### `ENABLE_IPV6`=true
-Enable IPv6 support
+Enable IPv6 support. The network interface configuration is managed via systemd-networkd.
 
 ##### `ENABLE_SSHD`=true
-Install and enable OpenSSH service
+Install and enable OpenSSH service. The default configuration of the service doesn't allow `root` to login. Please use the user `pi` instead and `su -` or `sudo` to execute commands as root.
 
 ##### `ENABLE_SOUND`=true
-Enable sound hardware and install Advanced Linux Sound Architecture
+Enable sound hardware and install Advanced Linux Sound Architecture.
 
 ##### `ENABLE_HWRANDOM`=true
-Enable Hardware Random Number Generator
+Enable Hardware Random Number Generator. Strong random numbers are important for most network based communications that use encryption. It's recommended to be enabled.
 
 ##### `ENABLE_MINGPU`=false
-Minimize the amount of shared memory reserverd for the GPU
+Minimize the amount of shared memory reserverd for the GPU. It doesn't seem to be possible to fully disable the GPU.
 
 ##### `ENABLE_DBUS`=true
-Install and enable D-Bus message bus
+Install and enable D-Bus message bus. Please note that systemd should work without D-bus but it's recommended to be enabled.
 
 ##### `ENABLE_XORG`=false
-Install Xorg open-source X Window System
+Install Xorg open-source X Window System.
 
 ##### `ENABLE_FLUXBOX`=false
-Install Fluxbox window manager for the X Window System
+Install Fluxbox window manager for the X Window System.
 
 #### Advanced sytem features:
+##### `ENABLE_MINBASE`=false
+Use debootstrap script variant `minbase` which only includes essential packages and apt. This will reduce the disk usage by about 65 MB.
+
 ##### `ENABLE_UBOOT`=false
-Replace default RPi bootloader with U-Boot bootloader
+Replace default RPi bootloader with U-Boot bootloader. U-Boot can boot images via the network using the BOOTP/TFTP protocol.
 
 ##### `ENABLE_IPTABLES`=false
-Enable iptables IPv4/IPv6 firewall
+Enable iptables IPv4/IPv6 firewall. Simplified ruleset: Allow all outgoing connections. Block all incoming connections except to OpenSSH service.
 
 ##### `ENABLE_HARDNET`=false
-Enable IPv4/IPv6 network stack hardening settings
+Enable IPv4/IPv6 network stack hardening settings.
 
 ## Logging of the bootstrapping process
 All information related to the bootstrapping process and the commands executed by the `rpi2-gen-image.sh` script can easily be saved into a logfile. The common shell command `script` can be used for this purpose:
diff --git a/rpi2-gen-image.sh b/rpi2-gen-image.sh
index cc0a968..5b6a2ff 100755
--- a/rpi2-gen-image.sh
+++ b/rpi2-gen-image.sh
@@ -60,6 +60,7 @@ ENABLE_XORG=${ENABLE_XORG:=false}
 ENABLE_FLUXBOX=${ENABLE_FLUXBOX:=false}
 
 # Advanced settings
+ENABLE_MINBASE=${ENABLE_MINBASE:=false}
 ENABLE_UBOOT=${ENABLE_UBOOT:=false}
 ENABLE_HARDNET=${ENABLE_HARDNET:=false}
 ENABLE_IPTABLES=${ENABLE_IPTABLES:=false}
@@ -74,7 +75,7 @@ REQUIRED_PACKAGES="debootstrap debian-archive-keyring qemu-user-static dosfstool
 MISSING_PACKAGES=""
 
 # Packages required in the chroot build enviroment
-APT_INCLUDES="apt-transport-https,ca-certificates,debian-archive-keyring,dialog,locales"
+APT_INCLUDES="apt-transport-https,ca-certificates,debian-archive-keyring,dialog,sudo"
 
 set +x
 
@@ -120,6 +121,13 @@ trap cleanup 0 1 2 3 6
 # Set up chroot directory
 mkdir -p $R
 
+# Add required packages for the minbase installation
+if [ "$ENABLE_MINBASE" = true ] ; then
+  APT_INCLUDES="${APT_INCLUDES},vim-tiny,net-tools"
+else
+  APT_INCLUDES="${APT_INCLUDES},locales"
+fi
+
 # Add dbus package, recommended if using systemd
 if [ "$ENABLE_DBUS" = true ] ; then
   APT_INCLUDES="${APT_INCLUDES},dbus"
@@ -145,12 +153,19 @@ if [ "$ENABLE_FLUXBOX" = true ] ; then
   APT_INCLUDES="${APT_INCLUDES},fluxbox,eterm"
 fi
 
+# Set empty proxy string
 if [ -z "$APT_PROXY" ] ; then
   APT_PROXY="http://"
 fi
 
 # Base debootstrap (unpack only)
-debootstrap --arch=armhf --foreign --include=${APT_INCLUDES} $RELEASE $R ${APT_PROXY}${APT_SERVER}/debian
+if [ "$ENABLE_MINBASE" = true ] ; then
+  debootstrap --arch=armhf --variant=minbase --foreign --include=${APT_INCLUDES} $RELEASE $R ${APT_PROXY}${APT_SERVER}/debian
+else
+  debootstrap --arch=armhf --foreign --include=${APT_INCLUDES} $RELEASE $R ${APT_PROXY}${APT_SERVER}/debian
+fi
+
+# Copy qemu emulator binary to chroot
 cp /usr/bin/qemu-arm-static $R/usr/bin
 
 # Copy debian-archive-keyring.pgp
@@ -182,8 +197,10 @@ echo ${TIMEZONE} >$R/etc/timezone
 LANG=C chroot $R dpkg-reconfigure -f noninteractive tzdata
 
 # Set up default locales to "en_US.UTF-8" default
-LANG=C chroot $R sed -i '/${DEFLOCAL}/s/^#//' /etc/locale.gen
-LANG=C chroot $R locale-gen ${DEFLOCAL}
+if [ "$ENABLE_MINBASE" = false ] ; then
+  LANG=C chroot $R sed -i '/${DEFLOCAL}/s/^#//' /etc/locale.gen
+  LANG=C chroot $R locale-gen ${DEFLOCAL}
+fi
 
 # Upgrade collabora package index and install collabora keyring
 echo "deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2" >$R/etc/apt/sources.list
@@ -679,9 +696,26 @@ EOM
   LANG=C chroot $R mkimage -A arm -O linux -T script -C none -a 0x00000000 -e 0x00000000 -n "RPi2 Boot Script" -d /boot/firmware/uboot.mkimage /boot/firmware/boot.scr
 
   # Remove gcc/c++ build enviroment
-  LANG=C chroot $R apt-get purge -y bc binutils cpp cpp-4.9 g++ g++-4.9 gcc gcc-4.9 libasan1 libatomic1 libc-dev-bin libc6-dev libcloog-isl4 libgcc-4.9-dev libgomp1 libisl10 libmpc3 libmpfr4 libstdc++-4.9-dev libubsan0 linux-compiler-gcc-4.9-arm linux-libc-dev make
+  LANG=C chroot $R apt-get -y -q purge --auto-remove bc binutils cpp cpp-4.9 g++ g++-4.9 gcc gcc-4.9 libasan1 libatomic1 libc-dev-bin libc6-dev libcloog-isl4 libgcc-4.9-dev libgomp1 libisl10 libmpc3 libmpfr4 libstdc++-4.9-dev libubsan0 linux-compiler-gcc-4.9-arm linux-libc-dev make
 fi
 
+# Enable systemd-networkd DHCP configuration for the eth0 interface
+printf "[Match]\nName=eth0\n\n[Network]\nDHCP=yes\n" > $R/etc/systemd/network/eth.network
+
+# Set DHCP configuration to IPv4 only
+if [ "$ENABLE_IPV6" = false ] ; then
+  sed -i "s/=yes/=v4/" $R/etc/systemd/network/eth.network
+fi
+
+# Enable systemd-networkd service
+LANG=C chroot $R systemctl enable systemd-networkd
+
+# Place hint about netowrk configuration
+cat <<EOM >$R/etc/network/interfaces
+# Debian switched to systemd-networkd configuration files.
+# please configure your networks in '/etc/systemd/network/'
+EOM
+
 # Clean cached downloads
 LANG=C chroot $R apt-get -y clean
 LANG=C chroot $R apt-get -y autoclean