shred --size=1M /dev/sda* /dev/sdb*

cat > postinstall.sh <<EOF
mkdir -p /home/{muelli,teythoon,russell,vollkorn,mms}


echo "termcapinfo xterm* ti@:te@" | tee -a /etc/screenrc
sed "s/UMASK[[:space:]]\+022/UMASK 027/" -i /etc/login.defs
echo "blacklist floppy" | tee /etc/modprobe.d/blacklist-floppy.conf


apt-get update
apt-get install -y cryptsetup
apt-get install -y dropbear-initramfs cryptsetup-initramfs


cat /root/.ssh/authorized_keys > /etc/dropbear-initramfs/authorized_keys


## For some weird reason, Hetzner puts swap space in the RAID.
mdadm --remove /dev/md0
mdadm --stop /dev/md0
mkswap /dev/sda1
mkswap /dev/sdb1

apt install -y podman virtinst uvtool-libvirt libvirt-daemon-system-systemd libvirt-daemon-driver-qemu libnss-libvirt libvirt-clients qemu-kvm


blkid -o export /dev/md3 | grep UUID=
mount /dev/md3 /mnt
btrfs subvolume snapshot -r /mnt/ /mnt/@root-initial-snapshot-ro

mkdir /tmp/disk
mount /dev/md2 /tmp/disk
btrfs send /mnt/@root-initial-snapshot-ro | btrfs receive -v /tmp/disk/
umount /mnt/

EOF
chmod a+x postinstall.sh

installimage -a -n newhost -r yes -l 1 -p swap:swap:32G,/boot:ext3:1G,/mnt/disk:btrfs:64G,/:btrfs:all -K /root/.ssh/robot_user_keys -t yes -s en -x ./postinstall.sh -i /root/.oldroot/nfs/install/../images/Ubuntu-2604-resolute-amd64-base.tar.zst


echo -n "Better provide the passphrase interactively or change later with cryptsetup luksChangeKey /dev/md3" | cryptsetup luksFormat /dev/md3 -
echo -n "Better provide the passphrase interactively or change later with cryptsetup luksChangeKey /dev/md3" | cryptsetup luksOpen /dev/md3 cryptedmd3 -
mkfs.btrfs /dev/mapper/cryptedmd3

mount /dev/mapper/cryptedmd3 /mnt/

mkdir /tmp/disk
mount /dev/md2 /tmp/disk
btrfs send /tmp/disk/@root-initial-snapshot-ro | btrfs receive -v /mnt/
btrfs subvolume snapshot /mnt/@root-initial-snapshot-ro /mnt/@

btrfs subvolume create /mnt/@home
btrfs subvolume create /mnt/@var
btrfs subvolume create /mnt/@images
btrfs subvolume create /mnt/@userfoo
btrfs subvolume create /mnt/@userbar
btrfs subvolume create /mnt/@mails

blkid -o export /dev/mapper/cryptedmd3 | grep UUID=
# The following deletes the root partition, which used to be on the unencrypted drive.
sed -i 's,.* / .*,,' /mnt/@/etc/fstab
sed -i 's,.* swap .*,,' /mnt/@/etc/fstab
echo /dev/sda1 none swap sw 0 0 | tee -a /mnt/@/etc/fstab
echo /dev/sdb1 none swap sw 0 0 | tee -a /mnt/@/etc/fstab
echo /dev/mapper/cryptedmd3 / btrfs defaults,subvol=@,noatime,compress=lzo 0 0 | tee -a /mnt/@/etc/fstab
echo /dev/mapper/cryptedmd3 /home btrfs defaults,subvol=@home,compress=lzo,relatime,nodiratime 0 0 | tee -a /mnt/@/etc/fstab
echo /dev/mapper/cryptedmd3 /home/userfoo btrfs defaults,subvol=@userfoo,compress=lzo,relatime,nodiratime 0 0 | tee -a /mnt/@/etc/fstab
echo /dev/mapper/cryptedmd3 /home/uesrbar btrfs defaults,subvol=@userbar,compress=lzo,relatime,nodiratime 0 0 | tee -a /mnt/@/etc/fstab

umount /mnt/

mount /dev/mapper/cryptedmd3 -osubvol=@ /mnt/

mount /dev/md1 /mnt/boot


chroot-prepare /mnt/; chroot /mnt


passwd







echo cryptedmd3 $(blkid -o export /dev/md3 | grep UUID=) none luks | tee -a /etc/crypttab
echo swap /dev/sda1 /dev/urandom swap,cipher=aes-cbc-essiv:sha256 | tee -a /etc/crypttab
echo swap /dev/sdb1 /dev/urandom swap,cipher=aes-cbc-essiv:sha256 | tee -a /etc/crypttab

cp /root/.ssh/authorized_keys /etc/dropbear/initramfs/

update-initramfs -u -k all
update-grub2

sed -i s,ENABLED=1,ENABLED=0,g /etc/default/motd-news

exit


umount -l /mnt
mount /dev/mapper/cryptedmd3 /mnt/
btrfs subvolume snapshot -r /mnt/@ /mnt/@root-after-install
umount -l /mnt

cat ~/.ssh/boot_key | ssh -o UserKnownHostsFile=~/.ssh/newhost.known -i ~/.ssh/id_newhost_boot root@yourip  "cat - >/lib/cryptsetup/passfifo"