Initial commit

2026-08-26 12:36:30 +08:00
commit 58a0a2d1ff
@@ -0,0 +1,14 @@
+# Cloud-init seed images
+
+Each operating system has an independent NoCloud configuration and generated
+`seed.iso`:
+
+```text
+seediso/
+├── debian13/
+└── almalinux10/
+```
+
+Keeping per-OS metadata separate allows each VM to use a distinct hostname and
+cloud-init `instance-id`. Generated ISO files are ignored by Git and are built
+automatically by the corresponding launcher when missing.
@@ -0,0 +1,2 @@
+seed.iso
+*.iso
@@ -0,0 +1,13 @@
+# AlmaLinux 10 seed.iso
+
+This directory contains the cloud-init NoCloud configuration used by
+`run-almalinux10.sh`.
+
+After changing `user-data`, `meta-data`, or `network-config`, remove the old
+`seed.iso` and rebuild it:
+
+```bash
+./seediso/almalinux10/build-seed.sh
+```
+
+Use a unique `instance-id` when cloning this configuration for another VM.
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+output="${1:-${script_dir}/seed.iso}"
+files=(user-data meta-data)
+
+mkdir -p "$(dirname -- "$output")"
+
+if [[ -f "${script_dir}/network-config" ]]; then
+  files+=(network-config)
+fi
+
+if command -v cloud-localds >/dev/null 2>&1; then
+  args=()
+  if [[ -f "${script_dir}/network-config" ]]; then
+    args+=(--network-config="${script_dir}/network-config")
+  fi
+  cloud-localds "${args[@]}" "$output" \
+    "${script_dir}/user-data" "${script_dir}/meta-data"
+elif command -v xorriso >/dev/null 2>&1; then
+  xorriso -as mkisofs -quiet -volid cidata -joliet -rock \
+    -output "$output" "${files[@]/#/${script_dir}/}"
+elif command -v genisoimage >/dev/null 2>&1; then
+  genisoimage -quiet -output "$output" -volid cidata -joliet -rock \
+    "${files[@]/#/${script_dir}/}"
+elif command -v mkisofs >/dev/null 2>&1; then
+  mkisofs -quiet -output "$output" -volid cidata -joliet -rock \
+    "${files[@]/#/${script_dir}/}"
+else
+  printf 'Error: install cloud-image-utils, xorriso, genisoimage, or mkisofs.\n' >&2
+  exit 1
+fi
+
+printf 'Created %s\n' "$output"
@@ -0,0 +1,2 @@
+instance-id: almalinux10-host-001
+local-hostname: almalinux10-host
@@ -0,0 +1,10 @@
+version: 2
+ethernets:
+  all-en:
+    match:
+      name: "en*"
+    dhcp4: true
+  all-eth:
+    match:
+      name: "eth*"
+    dhcp4: true
@@ -0,0 +1,16 @@
+#cloud-config
+preserve_hostname: false
+manage_etc_hosts: true
+ssh_pwauth: true
+
+users:
+  - name: guofang
+    gecos: Guofang
+    groups: [wheel]
+    shell: /bin/bash
+    sudo: "ALL=(ALL) NOPASSWD: ALL"
+    lock_passwd: false
+    hashed_passwd: $6$0NtCERV3eO12t9oJ$nlFE2sSc66nFfuD5X0xMnOla1cuzOnHfeGNRY5X7dCDHg.WzWVmuRe7M17Puj44.eCWLnJAWt4WNjd9vP9X0D0
+
+chpasswd:
+  expire: false
@@ -0,0 +1,2 @@
+seed.iso
+*.iso
@@ -0,0 +1,21 @@
+# Debian 13 seed.iso
+
+This directory contains the cloud-init NoCloud configuration used by
+`run-debian13.sh`.
+
+1. Edit `user-data`, `meta-data`, and (if needed) `network-config`.
+2. Build the image:
+
+   ```bash
+   ./seediso/debian13/build-seed.sh
+   ```
+
+   To choose another output path:
+
+   ```bash
+   ./seediso/debian13/build-seed.sh /path/to/seed.iso
+   ```
+
+The script uses `cloud-localds` when available, then falls back to `xorriso`,
+`genisoimage`, or `mkisofs`. Attach the resulting ISO as a CD-ROM when booting
+a cloud-init-enabled virtual machine.
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+output="${1:-${script_dir}/seed.iso}"
+files=(user-data meta-data)
+
+mkdir -p "$(dirname -- "$output")"
+
+if [[ -f "${script_dir}/network-config" ]]; then
+  files+=(network-config)
+fi
+
+if command -v cloud-localds >/dev/null 2>&1; then
+  args=()
+  if [[ -f "${script_dir}/network-config" ]]; then
+    args+=(--network-config="${script_dir}/network-config")
+  fi
+  cloud-localds "${args[@]}" "${output}" \
+    "${script_dir}/user-data" "${script_dir}/meta-data"
+elif command -v xorriso >/dev/null 2>&1; then
+  xorriso -as mkisofs -quiet -volid cidata -joliet -rock \
+    -output "${output}" "${files[@]/#/${script_dir}/}"
+elif command -v genisoimage >/dev/null 2>&1; then
+  genisoimage -quiet -output "${output}" -volid cidata -joliet -rock \
+    "${files[@]/#/${script_dir}/}"
+elif command -v mkisofs >/dev/null 2>&1; then
+  mkisofs -quiet -output "${output}" -volid cidata -joliet -rock \
+    "${files[@]/#/${script_dir}/}"
+else
+  printf 'Error: install cloud-image-utils, xorriso, genisoimage, or mkisofs.\n' >&2
+  exit 1
+fi
+
+printf 'Created %s\n' "${output}"
@@ -0,0 +1,2 @@
+instance-id: debian13-host-001
+local-hostname: debian13-host
@@ -0,0 +1,10 @@
+version: 2
+ethernets:
+  all-en:
+    match:
+      name: "en*"
+    dhcp4: true
+  all-eth:
+    match:
+      name: "eth*"
+    dhcp4: true
@@ -0,0 +1,45 @@
+#cloud-config
+preserve_hostname: false
+manage_etc_hosts: true
+ssh_pwauth: true
+
+users:
+  - name: guofang
+    gecos: Guofang
+    groups: [sudo]
+    shell: /bin/bash
+    sudo: "ALL=(ALL) NOPASSWD: ALL"
+    lock_passwd: false
+    ssh_authorized_keys:
+      - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCwsF2ZDSHDaXM9BdDq3Vxkp6T+DJEakKaVZQJUEHexS34mbrxYAxmGBUPCrddfE01dS31kGS4XHVBa+wGUYodY+nPwnrfD1Q4phKVSzXr65K1Y/sCcjSiANBPWpv2Xd7IMOfLlrdLtmf5QcKWroIqO2LaIDGECwzUUHrfprgeaF9N0FGcmrgbmm23JUk+f6guRQ4br88L4rWIWEBvL9bTdwErNkdfsYE2F/U8aIFpMcVy2eJIOgy8ZjZvkGdm4r730YkTDL1VmAjiHH3/m2R1EOvwLzFhyWKoa4ULk/IQW+8iNnG42QEcaWRM+hMwlVdnNhPJP6WzS+fAEbibD3zM0q2X/4ex+cXRNOCd2/0KhnD2+3p1BM5QeFTzDappkk8W2meQkDE3hvTjtIQCzygFO6LNWtEEa7BTvvlMqF3CZWh88J9XiP750SjESe3Ge5o9A0T2hcJa+KZ1LxVEmNt4nD6E/OD4EymoaLIJZ1fH5ksSFjHzJ+mJouSVjc/H/VSE= guofang@GUOFANG-OFFICE
+    hashed_passwd: $6$0NtCERV3eO12t9oJ$nlFE2sSc66nFfuD5X0xMnOla1cuzOnHfeGNRY5X7dCDHg.WzWVmuRe7M17Puj44.eCWLnJAWt4WNjd9vP9X0D0
+
+chpasswd:
+  expire: false
+
+apt:
+  primary:
+    - arches: [default]
+      uri: "https://mirrors.ustc.edu.cn/debian"
+  security:
+    - arches: [default]
+      uri: "https://mirrors.ustc.edu.cn/debian-security"
+  # http_proxy: "http://10.15.112.151:3128/"
+  # https_proxy: "http://10.15.112.151:3128/"
+  # http_proxy: "socks5h://10.0.2.2:1080/"
+  # https_proxy: "socks5h://10.0.2.2:1080/"
+
+# package_update: true
+
+# packages:
+#   - task-gnome-desktop
+
+# runcmd:
+#   - systemctl set-default graphical.target
+#   - systemctl enable gdm3.service
+
+# power_state:
+#   delay: now
+#   mode: reboot
+#   message: "Cloud-init configuration completed; rebooting."
+#   condition: true
@@ -0,0 +1 @@
+seed.iso
@@ -0,0 +1,171 @@
+<?xml version="1.0" encoding="utf-8"?>
+<unattend xmlns="urn:schemas-microsoft-com:unattend">
+  <settings pass="windowsPE">
+    <component name="Microsoft-Windows-International-Core-WinPE" processorArchitecture="amd64"
+      publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS"
+      xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
+      <SetupUILanguage>
+        <UILanguage>en-US</UILanguage>
+      </SetupUILanguage>
+      <InputLocale>en-US</InputLocale>
+      <SystemLocale>en-US</SystemLocale>
+      <UILanguage>en-US</UILanguage>
+      <UserLocale>en-US</UserLocale>
+    </component>
+    <component name="Microsoft-Windows-Setup" processorArchitecture="amd64"
+      publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS"
+      xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
+      <DynamicUpdate>
+        <Enable>false</Enable>
+        <WillShowUI>Never</WillShowUI>
+      </DynamicUpdate>
+      <DiskConfiguration>
+        <Disk wcm:action="add">
+          <DiskID>0</DiskID>
+          <WillWipeDisk>true</WillWipeDisk>
+          <CreatePartitions>
+            <CreatePartition wcm:action="add">
+              <Order>1</Order>
+              <Type>EFI</Type>
+              <Size>100</Size>
+            </CreatePartition>
+            <CreatePartition wcm:action="add">
+              <Order>2</Order>
+              <Type>MSR</Type>
+              <Size>16</Size>
+            </CreatePartition>
+            <CreatePartition wcm:action="add">
+              <Order>3</Order>
+              <Type>Primary</Type>
+              <Extend>true</Extend>
+            </CreatePartition>
+          </CreatePartitions>
+          <ModifyPartitions>
+            <ModifyPartition wcm:action="add">
+              <Order>1</Order>
+              <PartitionID>1</PartitionID>
+              <Format>FAT32</Format>
+              <Label>System</Label>
+            </ModifyPartition>
+            <ModifyPartition wcm:action="add">
+              <Order>2</Order>
+              <PartitionID>3</PartitionID>
+              <Format>NTFS</Format>
+              <Label>Windows</Label>
+              <Letter>C</Letter>
+            </ModifyPartition>
+          </ModifyPartitions>
+        </Disk>
+        <WillShowUI>OnError</WillShowUI>
+      </DiskConfiguration>
+      <ImageInstall>
+        <OSImage>
+          <InstallFrom>
+            <MetaData wcm:action="add">
+              <Key>/IMAGE/INDEX</Key>
+              <Value>6</Value>
+            </MetaData>
+          </InstallFrom>
+          <InstallTo>
+            <DiskID>0</DiskID>
+            <PartitionID>3</PartitionID>
+          </InstallTo>
+          <WillShowUI>OnError</WillShowUI>
+        </OSImage>
+      </ImageInstall>
+      <UserData>
+        <AcceptEula>true</AcceptEula>
+        <ProductKey>
+          <Key>W269N-WFGWX-YVC9B-4J6C9-T83GX</Key>
+          <WillShowUI>Never</WillShowUI>
+        </ProductKey>
+      </UserData>
+      <RunSynchronous>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>1</Order>
+          <Path>reg add HKLM\SYSTEM\Setup\LabConfig /v BypassTPMCheck /t REG_DWORD /d 1 /f</Path>
+        </RunSynchronousCommand>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>2</Order>
+          <Path>reg add HKLM\SYSTEM\Setup\LabConfig /v BypassSecureBootCheck /t REG_DWORD /d 1 /f</Path>
+        </RunSynchronousCommand>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>3</Order>
+          <Path>reg add HKLM\SYSTEM\Setup\LabConfig /v BypassRAMCheck /t REG_DWORD /d 1 /f</Path>
+        </RunSynchronousCommand>
+      </RunSynchronous>
+    </component>
+  </settings>
+  <settings pass="specialize">
+    <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64"
+      publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
+      <ComputerName>WIN11</ComputerName>
+      <TimeZone>China Standard Time</TimeZone>
+    </component>
+    <component name="Microsoft-Windows-TerminalServices-LocalSessionManager"
+      processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral"
+      versionScope="nonSxS">
+      <fDenyTSConnections>false</fDenyTSConnections>
+    </component>
+    <component name="Networking-MPSSVC-Svc" processorArchitecture="amd64"
+      publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
+      <FirewallGroups>
+        <FirewallGroup xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State"
+          wcm:action="add" wcm:keyValue="RemoteDesktop">
+          <Active>true</Active>
+          <Group>Remote Desktop</Group>
+          <Profile>all</Profile>
+        </FirewallGroup>
+      </FirewallGroups>
+    </component>
+  </settings>
+  <settings pass="oobeSystem">
+    <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64"
+      publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
+      <InputLocale>en-US</InputLocale>
+      <SystemLocale>en-US</SystemLocale>
+      <UILanguage>en-US</UILanguage>
+      <UserLocale>en-US</UserLocale>
+    </component>
+    <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64"
+      publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS"
+      xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
+      <OOBE>
+        <HideEULAPage>true</HideEULAPage>
+        <HideOnlineAccountScreens>true</HideOnlineAccountScreens>
+        <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
+        <ProtectYourPC>3</ProtectYourPC>
+      </OOBE>
+      <UserAccounts>
+        <LocalAccounts>
+          <LocalAccount wcm:action="add">
+            <Name>guofang</Name>
+            <Group>Administrators</Group>
+            <DisplayName>Guofang</DisplayName>
+            <Password>
+              <Value>wang</Value>
+              <PlainText>true</PlainText>
+            </Password>
+          </LocalAccount>
+        </LocalAccounts>
+      </UserAccounts>
+      <AutoLogon>
+        <Enabled>true</Enabled>
+        <LogonCount>1</LogonCount>
+        <Username>guofang</Username>
+        <Password>
+          <Value>wang</Value>
+          <PlainText>true</PlainText>
+        </Password>
+      </AutoLogon>
+      <FirstLogonCommands>
+        <SynchronousCommand wcm:action="add">
+          <Order>1</Order>
+          <Description>Configure Windows from the answer-media script</Description>
+          <CommandLine>powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$script = Get-ChildItem -Path (Get-PSDrive -PSProvider FileSystem).Root -Filter 'Configure-Windows.ps1' -File -ErrorAction SilentlyContinue | Select-Object -First 1; if (-not $script) { throw 'Configure-Windows.ps1 was not found on the attached media.' }; &amp; $script.FullName"</CommandLine>
+          <RequiresUserInput>false</RequiresUserInput>
+        </SynchronousCommand>
+      </FirstLogonCommands>
+    </component>
+  </settings>
+</unattend>
@@ -0,0 +1,97 @@
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version Latest
+
+function Install-VirtIOGuestTools {
+    $installer = Get-ChildItem `
+        -Path (Get-PSDrive -PSProvider FileSystem).Root `
+        -Filter 'virtio-win-guest-tools.exe' `
+        -File `
+        -ErrorAction SilentlyContinue |
+        Select-Object -First 1
+
+    if (-not $installer) {
+        throw 'virtio-win-guest-tools.exe was not found on the attached media.'
+    }
+
+    $process = Start-Process `
+        -FilePath $installer.FullName `
+        -ArgumentList '/quiet', '/norestart' `
+        -Wait `
+        -PassThru
+
+    if ($process.ExitCode -notin 0, 3010) {
+        throw "VirtIO guest tools installer exited with code $($process.ExitCode)."
+    }
+}
+
+function Install-OpenSSHServer {
+    $capability = Get-WindowsCapability -Online -Name 'OpenSSH.Server*' |
+        Select-Object -First 1
+
+    if (-not $capability) {
+        throw 'The OpenSSH Server Windows capability was not found.'
+    }
+
+    if ($capability.State -ne 'Installed') {
+        Add-WindowsCapability -Online -Name $capability.Name | Out-Null
+    }
+
+    Set-Service -Name 'sshd' -StartupType Automatic
+    Start-Service -Name 'sshd'
+
+    $rule = Get-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -ErrorAction SilentlyContinue
+    if ($rule) {
+        Set-NetFirewallRule `
+            -Name 'OpenSSH-Server-In-TCP' `
+            -Enabled True `
+            -Profile Private, Public
+    }
+    else {
+        New-NetFirewallRule `
+            -Name 'OpenSSH-Server-In-TCP' `
+            -DisplayName 'OpenSSH SSH Server (sshd)' `
+            -Enabled True `
+            -Direction Inbound `
+            -Protocol TCP `
+            -Action Allow `
+            -LocalPort 22 `
+            -Profile Private, Public | Out-Null
+    }
+}
+
+function Install-AdministratorAuthorizedKey {
+    $authorizedKeys = Join-Path $env:ProgramData 'ssh\administrators_authorized_keys'
+    $publicKey = 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCwsF2ZDSHDaXM9BdDq3Vxkp6T+DJEakKaVZQJUEHexS34mbrxYAxmGBUPCrddfE01dS31kGS4XHVBa+wGUYodY+nPwnrfD1Q4phKVSzXr65K1Y/sCcjSiANBPWpv2Xd7IMOfLlrdLtmf5QcKWroIqO2LaIDGECwzUUHrfprgeaF9N0FGcmrgbmm23JUk+f6guRQ4br88L4rWIWEBvL9bTdwErNkdfsYE2F/U8aIFpMcVy2eJIOgy8ZjZvkGdm4r730YkTDL1VmAjiHH3/m2R1EOvwLzFhyWKoa4ULk/IQW+8iNnG42QEcaWRM+hMwlVdnNhPJP6WzS+fAEbibD3zM0q2X/4ex+cXRNOCd2/0KhnD2+3p1BM5QeFTzDappkk8W2meQkDE3hvTjtIQCzygFO6LNWtEEa7BTvvlMqF3CZWh88J9XiP750SjESe3Ge5o9A0T2hcJa+KZ1LxVEmNt4nD6E/OD4EymoaLIJZ1fH5ksSFjHzJ+mJouSVjc/H/VSE= guofang@GUOFANG-OFFICE'
+
+    [IO.File]::WriteAllText(
+        $authorizedKeys,
+        $publicKey + [Environment]::NewLine,
+        [Text.Encoding]::ASCII
+    )
+
+    & icacls.exe `
+        $authorizedKeys `
+        '/inheritance:r' `
+        '/grant' `
+        '*S-1-5-32-544:F' `
+        '*S-1-5-18:F'
+
+    if ($LASTEXITCODE -ne 0) {
+        throw "icacls.exe exited with code $LASTEXITCODE."
+    }
+}
+
+function Enable-AutomaticLogon {
+    $winlogonPath = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon'
+
+    Set-ItemProperty -Path $winlogonPath -Name 'AutoAdminLogon' -Value '1' -Type String
+    Set-ItemProperty -Path $winlogonPath -Name 'DefaultUserName' -Value 'guofang' -Type String
+    Set-ItemProperty -Path $winlogonPath -Name 'DefaultPassword' -Value 'wang' -Type String
+    Set-ItemProperty -Path $winlogonPath -Name 'DefaultDomainName' -Value $env:COMPUTERNAME -Type String
+    Remove-ItemProperty -Path $winlogonPath -Name 'AutoLogonCount' -ErrorAction SilentlyContinue
+}
+
+Install-VirtIOGuestTools
+Install-OpenSSHServer
+Install-AdministratorAuthorizedKey
+Enable-AutomaticLogon
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+output="${1:-${script_dir}/seed.iso}"
+seed_files=(
+  "$script_dir/Autounattend.xml"
+  "$script_dir/Configure-Windows.ps1"
+)
+
+mkdir -p "$(dirname -- "$output")"
+if command -v xorriso >/dev/null 2>&1; then
+  xorriso -as mkisofs -quiet -o "$output" -V CIDATA -J -r "${seed_files[@]}"
+elif command -v genisoimage >/dev/null 2>&1; then
+  genisoimage -quiet -o "$output" -V CIDATA -J -r "${seed_files[@]}"
+elif command -v mkisofs >/dev/null 2>&1; then
+  mkisofs -quiet -o "$output" -V CIDATA -J -r "${seed_files[@]}"
+else
+  printf 'Error: install xorriso, genisoimage, or mkisofs.\n' >&2
+  exit 1
+fi
+printf 'Built Windows 11 answer-file ISO: %s\n' "$output"