1 files changed, 212 insertions, 211 deletions

diff --git a/make_ami.sh b/make_ami.sh
index 2917445..6218694 100755
--- a/make_ami.sh
+++ b/make_ami.sh
@@ -1,5 +1,5 @@
 #!/bin/sh
-# vim: set ts=4 noet:
+# vim: set ts=4 et:
 
 set -eu
 
@@ -10,308 +10,309 @@ set -eu
 : ${ALPINE_KEYS_SHA256:="f7832b848cedca482b145011cf516e82392f02a10713875cb09f39c7221c6f17"}
 
 die() {
-        printf '\033[1;31mERROR:\033[0m %s\n' "$@" >&2  # bold red
-        exit 1
+    printf '\033[1;31mERROR:\033[0m %s\n' "$@" >&2  # bold red
+    exit 1
 }
 
 einfo() {
-        printf '\n\033[1;36m> %s\033[0m\n' "$@" >&2  # bold cyan
+    printf '\n\033[1;36m> %s\033[0m\n' "$@" >&2  # bold cyan
 }
 
 rc_add() {
-        local target="$1"; shift    # target directory
-        local runlevel="$1"; shift  # runlevel name
-        local services="$*"         # names of services
-
-        local svc; for svc in $services; do
-                mkdir -p "$target"/etc/runlevels/$runlevel
-                ln -s /etc/init.d/$svc "$target"/etc/runlevels/$runlevel/$svc
-                echo " * service $svc added to runlevel $runlevel"
-        done
+    local target="$1"; shift    # target directory
+    local runlevel="$1"; shift  # runlevel name
+    local services="$*"         # names of services
+
+    local svc; for svc in $services; do
+        mkdir -p "$target"/etc/runlevels/$runlevel
+        ln -s /etc/init.d/$svc "$target"/etc/runlevels/$runlevel/$svc
+        echo " * service $svc added to runlevel $runlevel"
+    done
 }
 
 wgets() (
-        local url="$1"     # url to fetch
-        local sha256="$2"  # expected SHA256 sum of output
-        local dest="$3"    # output path and filename
+    local url="$1"     # url to fetch
+    local sha256="$2"  # expected SHA256 sum of output
+    local dest="$3"    # output path and filename
 
-        wget -T 10 -q -O "$dest" "$url"
-        echo "$sha256  $dest" | sha256sum -c > /dev/null
+    wget -T 10 -q -O "$dest" "$url"
+    echo "$sha256  $dest" | sha256sum -c > /dev/null
 )
 
 
 validate_block_device() {
-        local dev="$1"  # target directory
+    local dev="$1"  # target directory
 
-        lsblk -P --fs "$dev" >/dev/null 2>&1 || \
-                die "'$dev' is not a valid block device"
+    lsblk -P --fs "$dev" >/dev/null 2>&1 || \
+        die "'$dev' is not a valid block device"
 
-        if lsblk -P --fs "$dev" | grep -vq 'FSTYPE=""'; then
-                die "Block device '$dev' is not blank"
-        fi
+    if lsblk -P --fs "$dev" | grep -vq 'FSTYPE=""'; then
+        die "Block device '$dev' is not blank"
+    fi
 }
 
 fetch_apk_tools() {
-        local store="$(mktemp -d)"
-        local tarball="$(basename $APK_TOOLS_URI)"
+    local store="$(mktemp -d)"
+    local tarball="$(basename $APK_TOOLS_URI)"
 
-        wgets "$APK_TOOLS_URI" "$APK_TOOLS_SHA256" "$store/$tarball"
-        tar -C "$store" -xf "$store/$tarball"
+    wgets "$APK_TOOLS_URI" "$APK_TOOLS_SHA256" "$store/$tarball"
+    tar -C "$store" -xf "$store/$tarball"
 
-        find "$store" -name apk
+    find "$store" -name apk
 }
 
 make_filesystem() {
-        local device="$1"  # target device path
-        local target="$2"  # mount target
+    local device="$1"  # target device path
+    local target="$2"  # mount target
 
-        mkfs.ext4 "$device"
-        e2label "$device" /
-        mount "$device" "$target"
+    mkfs.ext4 "$device"
+    e2label "$device" /
+    mount "$device" "$target"
 }
 
 setup_repositories() {
-        local target="$1"     # target directory
-        local add_repos="$2"  # extra repo lines, comma separated
-
-        mkdir -p "$target"/etc/apk/keys
-        cat > "$target"/etc/apk/repositories <<-EOF
-        http://dl-cdn.alpinelinux.org/alpine/v$ALPINE_RELEASE/main
-        http://dl-cdn.alpinelinux.org/alpine/v$ALPINE_RELEASE/community
-        EOF
-        echo "$add_repos" | tr , "\012" >> "$target"/etc/apk/repositories
+    local target="$1"     # target directory
+    local add_repos="$2"  # extra repo lines, comma separated
+
+    mkdir -p "$target"/etc/apk/keys
+    cat > "$target"/etc/apk/repositories <<EOF
+http://dl-cdn.alpinelinux.org/alpine/v$ALPINE_RELEASE/main
+http://dl-cdn.alpinelinux.org/alpine/v$ALPINE_RELEASE/community
+@edge-main http://dl-cdn.alpinelinux.org/alpine/edge/main
+@edge-community http://dl-cdn.alpinelinux.org/alpine/edge/community
+@edge-testing http://dl-cdn.alpinelinux.org/alpine/edge/testing
+EOF
+    echo "$add_repos" | tr , "\012" >> "$target"/etc/apk/repositories
 }
 
 fetch_keys() {
-        local target="$1"
-        local tmp="$(mktemp -d)"
+    local target="$1"
+    local tmp="$(mktemp -d)"
 
-        wgets "$ALPINE_KEYS" "$ALPINE_KEYS_SHA256" "$tmp/alpine-keys.apk"
-        tar -C "$target" -xvf "$tmp"/alpine-keys.apk etc/apk/keys
-        rm -rf "$tmp"
+    wgets "$ALPINE_KEYS" "$ALPINE_KEYS_SHA256" "$tmp/alpine-keys.apk"
+    tar -C "$target" -xvf "$tmp"/alpine-keys.apk etc/apk/keys
+    rm -rf "$tmp"
 }
 
 setup_chroot() {
-        local target="$1"
+    local target="$1"
 
-        mount -t proc none "$target"/proc
-        mount --bind /dev "$target"/dev
-        mount --bind /sys "$target"/sys
+    mount -t proc none "$target"/proc
+    mount --bind /dev "$target"/dev
+    mount --bind /sys "$target"/sys
 
-        # Don't want to ship this but it's needed for bootstrap. Will be removed in
-        # the cleanup stage.
-        install -Dm644 /etc/resolv.conf "$target"/etc/resolv.conf
+    # Don't want to ship this but it's needed for bootstrap. Will be removed in
+    # the cleanup stage.
+    install -Dm644 /etc/resolv.conf "$target"/etc/resolv.conf
 }
 
 install_core_packages() {
-        local target="$1"    # target directory
-        local flavor="$2"    # kernel flavor
-        local add_pkgs="$3"  # extra packages, space separated
-
-        # Most from: https://git.alpinelinux.org/cgit/alpine-iso/tree/alpine-virt.packages
-        #
-        # linux-$flavor - linux kernel flavor to install
-        # e2fsprogs - required by init scripts to maintain ext4 volumes
-        # mkinitfs - required to build custom initfs
-        # sudo - to allow alpine user to become root, disallow root SSH logins
-        # tiny-ec2-bootstrap - to bootstrap system from EC2 metadata
-        chroot "$target" apk --no-cache add \
-                linux-"$flavor" \
-                alpine-mirrors \
-                chrony \
-                e2fsprogs \
-                mkinitfs \
-                openssh \
-                sudo \
-                tiny-ec2-bootstrap \
-                tzdata \
-                $add_pkgs
-
-        chroot "$target" apk --no-cache add --no-scripts syslinux
-
-        # Disable starting getty for physical ttys because they're all inaccessible
-        # anyhow. With this configuration boot messages will still display in the
-        # EC2 console.
-        sed -Ei '/^tty\d/s/^/#/' "$target"/etc/inittab
-
-        # Make it a little more obvious who is logged in by adding username to the
-        # prompt
-        sed -i "s/^export PS1='/&\\\\u@/" "$target"/etc/profile
+    local target="$1"    # target directory
+    local flavor="$2"    # kernel flavor
+    local add_pkgs="$3"  # extra packages, space separated
+
+    # Most from: https://git.alpinelinux.org/cgit/alpine-iso/tree/alpine-virt.packages
+    #
+    # sudo - to allow alpine user to become root, disallow root SSH logins
+    # tiny-ec2-bootstrap - to bootstrap system from EC2 metadata
+    #
+    chroot "$target" apk --no-cache add \
+        linux-"$flavor" \
+        alpine-mirrors \
+        chrony \
+        e2fsprogs \
+        openssh \
+        sudo \
+        tiny-ec2-bootstrap \
+        tzdata \
+        $add_pkgs
+
+    chroot "$target" apk --no-cache add --no-scripts syslinux
+
+    # Disable starting getty for physical ttys because they're all inaccessible
+    # anyhow. With this configuration boot messages will still display in the
+    # EC2 console.
+    sed -Ei '/^tty[0-9]/s/^/#/' \
+        "$target"/etc/inittab
+
+    # Make it a little more obvious who is logged in by adding username to the
+    # prompt
+    sed -i "s/^export PS1='/&\\\\u@/" "$target"/etc/profile
 }
 
 create_initfs() {
-        local target="$1"
+    local target="$1"
 
-        # Create ENA feature for mkinitfs
-        echo "kernel/drivers/net/ethernet/amazon" > \
-                "$target"/etc/mkinitfs/features.d/ena.modules
+    # Create ENA feature for mkinitfs
+    echo "kernel/drivers/net/ethernet/amazon" > \
+        "$target"/etc/mkinitfs/features.d/ena.modules
 
-        # Enable ENA and NVME features these don't hurt for any instance and are
-        # hard requirements of the 5 series and i3 series of instances
-        sed -Ei 's/^features="([^"]+)"/features="\1 nvme ena"/' \
-                "$target"/etc/mkinitfs/mkinitfs.conf
+    # Enable ENA and NVME features these don't hurt for any instance and are
+    # hard requirements of the 5 series and i3 series of instances
+    sed -Ei 's/^features="([^"]+)"/features="\1 nvme ena"/' \
+        "$target"/etc/mkinitfs/mkinitfs.conf
 
-        chroot "$target" /sbin/mkinitfs $(basename $(find "$target"/lib/modules/* -maxdepth 0))
+    chroot "$target" /sbin/mkinitfs $(basename $(find "$target"/lib/modules/* -maxdepth 0))
 }
 
 setup_extlinux() {
-        local target="$1"
-
-        # Must use disk labels instead of UUID or devices paths so that this works
-        # across instance familes. UUID works for many instances but breaks on the
-        # NVME ones because EBS volumes are hidden behind NVME devices.
-        #
-        # Enable ext4 because the root device is formatted ext4
-        #
-        # Shorten timeout because EC2 has no way to interact with instance console
-        #
-        # ttyS0 is the target for EC2s "Get System Log" feature whereas tty0 is the
-        # target for EC2s "Get Instance Screenshot" feature. Enabling the serial
-        # port early in extlinux gives the most complete output in the system log.
-        sed -Ei -e "s|^[# ]*(root)=.*|\1=LABEL=/|" \
-                -e "s|^[# ]*(default_kernel_opts)=.*|\1=\"console=ttyS0 console=tty0\"|" \
-                -e "s|^[# ]*(serial_port)=.*|\1=ttyS0|" \
-                -e "s|^[# ]*(modules)=.*|\1=sd-mod,usb-storage,ext4|" \
-                -e "s|^[# ]*(default)=.*|\1=hardened|" \
-                -e "s|^[# ]*(timeout)=.*|\1=1|" \
-                "$target"/etc/update-extlinux.conf
+    local target="$1"
+
+    # Must use disk labels instead of UUID or devices paths so that this works
+    # across instance familes. UUID works for many instances but breaks on the
+    # NVME ones because EBS volumes are hidden behind NVME devices.
+    #
+    # Enable ext4 because the root device is formatted ext4
+    #
+    # Shorten timeout because EC2 has no way to interact with instance console
+    #
+    # ttyS0 is the target for EC2s "Get System Log" feature whereas tty0 is the
+    # target for EC2s "Get Instance Screenshot" feature. Enabling the serial
+    # port early in extlinux gives the most complete output in the system log.
+    sed -Ei -e "s|^[# ]*(root)=.*|\1=LABEL=/|" \
+        -e "s|^[# ]*(default_kernel_opts)=.*|\1=\"console=ttyS0 console=tty0\"|" \
+        -e "s|^[# ]*(serial_port)=.*|\1=ttyS0|" \
+        -e "s|^[# ]*(modules)=.*|\1=sd-mod,usb-storage,ext4|" \
+        -e "s|^[# ]*(default)=.*|\1=hardened|" \
+        -e "s|^[# ]*(timeout)=.*|\1=1|" \
+        "$target"/etc/update-extlinux.conf
 }
 
 install_extlinux() {
-        local target="$1"
+    local target="$1"
 
-        chroot "$target" /sbin/extlinux --install /boot
-        chroot "$target" /sbin/update-extlinux --warn-only
+    chroot "$target" /sbin/extlinux --install /boot
+    chroot "$target" /sbin/update-extlinux --warn-only
 }
 
 setup_fstab() {
-        local target="$1"
+    local target="$1"
 
-        cat > "$target"/etc/fstab <<-EOF
-        # <fs>      <mountpoint>   <type>   <opts>              <dump/pass>
-        LABEL=/     /              ext4     defaults,noatime    1 1
-        EOF
+    cat > "$target"/etc/fstab <<EOF
+# <fs>      <mountpoint>   <type>   <opts>              <dump/pass>
+LABEL=/     /              ext4     defaults,noatime    1 1
+EOF
 }
 
 setup_networking() {
-        local target="$1"
+    local target="$1"
 
-        cat > "$target"/etc/network/interfaces <<-EOF
-        auto lo
-        iface lo inet loopback
+    cat > "$target"/etc/network/interfaces <<EOF
+auto lo
+iface lo inet loopback
 
-        auto eth0
-        iface eth0 inet dhcp
-        EOF
+auto eth0
+iface eth0 inet dhcp
+EOF
 }
 
 enable_services() {
-        local target="$1"
+    local target="$1"
 
-        rc_add "$target" default sshd chronyd networking tiny-ec2-bootstrap
-        rc_add "$target" sysinit devfs dmesg mdev hwdrivers
-        rc_add "$target" boot modules hwclock swap hostname sysctl bootmisc syslog acpid
-        rc_add "$target" shutdown killprocs savecache mount-ro
+    rc_add "$target" default sshd chronyd networking tiny-ec2-bootstrap
+    rc_add "$target" sysinit devfs dmesg mdev hwdrivers
+    rc_add "$target" boot modules hwclock swap hostname sysctl bootmisc syslog acpid
+    rc_add "$target" shutdown killprocs savecache mount-ro
 }
 
 create_alpine_user() {
-        local target="$1"
-
-        # Allow members of the wheel group to sudo without a password. By default
-        # this will only be the alpine user. This allows us to ship an AMI that is
-        # accessible via SSH using the user's configured SSH keys (thanks to
-        # tiny-ec2-bootstrap) but does not allow remote root access which is the
-        # best-practice.
-        sed -i '/%wheel .* NOPASSWD: .*/s/^# //' "$target"/etc/sudoers
-
-        # There is no real standard ec2 username across AMIs, Amazon uses ec2-user
-        # for their Amazon Linux AMIs but Ubuntu uses ubuntu, Fedora uses fedora,
-        # etc... (see: https://alestic.com/2014/01/ec2-ssh-username/). So our user
-        # and group are alpine because this is Alpine Linux. On instance bootstrap
-        # the user can create whatever users they want and delete this one.
-        chroot "$target" /usr/sbin/addgroup alpine
-        chroot "$target" /usr/sbin/adduser -h /home/alpine -s /bin/sh -G alpine -D alpine
-        chroot "$target" /usr/sbin/addgroup alpine wheel
-        chroot "$target" /usr/bin/passwd -u alpine
+    local target="$1"
+
+    # Allow members of the wheel group to sudo without a password. By default
+    # this will only be the alpine user. This allows us to ship an AMI that is
+    # accessible via SSH using the user's configured SSH keys (thanks to
+    # tiny-ec2-bootstrap) but does not allow remote root access which is the
+    # best-practice.
+    sed -i '/%wheel .* NOPASSWD: .*/s/^# //' "$target"/etc/sudoers
+
+    # There is no real standard ec2 username across AMIs, Amazon uses ec2-user
+    # for their Amazon Linux AMIs but Ubuntu uses ubuntu, Fedora uses fedora,
+    # etc... (see: https://alestic.com/2014/01/ec2-ssh-username/). So our user
+    # and group are alpine because this is Alpine Linux. On instance bootstrap
+    # the user can create whatever users they want and delete this one.
+    chroot "$target" /usr/sbin/addgroup alpine
+    chroot "$target" /usr/sbin/adduser -h /home/alpine -s /bin/sh -G alpine -D alpine
+    chroot "$target" /usr/sbin/addgroup alpine wheel
+    chroot "$target" /usr/bin/passwd -u alpine
 }
 
 configure_ntp() {
-        local target="$1"
-
-        # EC2 provides an instance-local NTP service syncronized with GPS and
-        # atomic clocks in-region. Prefer this over external NTP hosts when running
-        # in EC2.
-        #
-        # See: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/set-time.html
-        sed -i 's/^server .*/server 169.254.169.123/' "$target"/etc/chrony/chrony.conf
+    local target="$1"
+
+    # EC2 provides an instance-local NTP service syncronized with GPS and
+    # atomic clocks in-region. Prefer this over external NTP hosts when running
+    # in EC2.
+    #
+    # See: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/set-time.html
+    sed -i 's/^pool .*/server 169.254.169.123 iburst/' "$target"/etc/chrony/chrony.conf
 }
 
 cleanup() {
-        local target="$1"
-
-        # Sweep cruft out of the image that doesn't need to ship or will be
-        # re-generated when the image boots
-        rm -f \
-                "$target"/var/cache/apk/* \
-                "$target"/etc/resolv.conf \
-                "$target"/root/.ash_history \
-                "$target"/etc/*-
-
-        umount \
-                "$target"/dev \
-                "$target"/proc \
-                "$target"/sys
-
-        umount "$target"
+    local target="$1"
+
+    # Sweep cruft out of the image that doesn't need to ship or will be
+    # re-generated when the image boots
+    rm -f \
+        "$target"/var/cache/apk/* \
+        "$target"/etc/resolv.conf \
+        "$target"/root/.ash_history \
+        "$target"/etc/*-
+
+    umount \
+        "$target"/dev \
+        "$target"/proc \
+        "$target"/sys
+
+    umount "$target"
 }
 
 main() {
-        [ "$#" -ne 4 ] && { echo "usage: $0 <block-device> <kernel-flavor> '<repo>[,<repo>]' '<pkg>[ <pkg>]'"; exit 1; }
+    [ "$#" -ne 3 ] && { echo "usage: $0 <kernel-flavor> '<repo>[,<repo>]' '<pkg>[ <pkg>]'"; exit 1; }
 
-        device="$1"
-        flavor="$2"
-        add_repos="$3"
-        add_pkgs="$4"
+    local flavor="$1"
+    local add_repos="$2"
+    local add_pkgs="$3"
 
-        target="/mnt/target"
+    local device="/dev/xvdf"
+    local target="/mnt/target"
 
-        validate_block_device "$device"
+    validate_block_device "$device"
 
-        [ -d "$target" ] || mkdir "$target"
+    [ -d "$target" ] || mkdir "$target"
 
-        einfo "Fetching static APK tools"
-        apk="$(fetch_apk_tools)"
+    einfo "Fetching static APK tools"
+    apk="$(fetch_apk_tools)"
 
-        einfo "Creating root filesystem"
-        make_filesystem "$device" "$target"
+    einfo "Creating root filesystem"
+    make_filesystem "$device" "$target"
 
-        setup_repositories "$target" "$add_repos"
+    setup_repositories "$target" "$add_repos"
 
-        einfo "Fetching Alpine signing keys"
-        fetch_keys "$target"
+    einfo "Fetching Alpine signing keys"
+    fetch_keys "$target"
 
-        einfo "Installing base system"
-        $apk add --root "$target" --update-cache --initdb alpine-base
+    einfo "Installing base system"
+    $apk add --root "$target" --update-cache --initdb alpine-base
 
-        setup_chroot "$target"
+    setup_chroot "$target"
 
-        einfo "Installing core packages"
-        install_core_packages "$target" "$flavor" "$add_pkgs"
+    einfo "Installing core packages"
+    install_core_packages "$target" "$flavor" "$add_pkgs"
 
-        einfo "Configuring and enabling boot loader"
-        create_initfs "$target"
-        setup_extlinux "$target"
-        install_extlinux "$target"
+    einfo "Configuring and enabling boot loader"
+    create_initfs "$target"
+    setup_extlinux "$target"
+    install_extlinux "$target"
 
-        einfo "Configuring system"
-        setup_fstab "$target"
-        setup_networking "$target"
-        enable_services "$target"
-        create_alpine_user "$target"
-        configure_ntp "$target"
+    einfo "Configuring system"
+    setup_fstab "$target"
+    setup_networking "$target"
+    enable_services "$target"
+    create_alpine_user "$target"
+    configure_ntp "$target"
 
-        einfo "All done, cleaning up"
-        cleanup "$target"
+    einfo "All done, cleaning up"
+    cleanup "$target"
 }
 
 main "$@"