Differential D52452 Diff 162202 release/tools/ec2.conf

Changeset View

Standalone View

release/tools/ec2.conf

Show All 16 Lines

# No swap space; it doesn't make sense to provision any as part of the disk		# No swap space; it doesn't make sense to provision any as part of the disk
# image when we could be launching onto a system with anywhere between 0.5		# image when we could be launching onto a system with anywhere between 0.5
# and 4096 GB of RAM.		# and 4096 GB of RAM.
export NOSWAP=YES		export NOSWAP=YES

ec2_common() {		ec2_common() {
# Delete the pkg package and the repo database; they will likely be		# Delete the pkg package and the repo database; they will likely be
# long out of date before the EC2 instance is launched.		# long out of date before the EC2 instance is launched. In
		# unprivileged builds this is unnecessary as pkg will not be
		# installed to begin with.
		if [ -z "${NO_ROOT}" ]; then
mount -t devfs devfs ${DESTDIR}/dev		mount -t devfs devfs ${DESTDIR}/dev
chroot ${DESTDIR} ${EMULATOR} env ASSUME_ALWAYS_YES=yes \		chroot ${DESTDIR} ${EMULATOR} env ASSUME_ALWAYS_YES=yes \
/usr/sbin/pkg delete -f -y pkg		/usr/sbin/pkg delete -f -y pkg
umount ${DESTDIR}/dev		umount ${DESTDIR}/dev
rm -r ${DESTDIR}/var/db/pkg/repos/FreeBSD-ports		rm -r ${DESTDIR}/var/db/pkg/repos/FreeBSD-ports
rm -r ${DESTDIR}/var/db/pkg/repos/FreeBSD-ports-kmods		rm -r ${DESTDIR}/var/db/pkg/repos/FreeBSD-ports-kmods
		fi

# Turn off IPv6 Duplicate Address Detection; the EC2 networking		# Turn off IPv6 Duplicate Address Detection; the EC2 networking
# configuration makes it unnecessary.		# configuration makes it unnecessary.
echo 'net.inet6.ip6.dad_count=0' >> ${DESTDIR}/etc/sysctl.conf		echo 'net.inet6.ip6.dad_count=0' >> ${DESTDIR}/etc/sysctl.conf
		metalog_add_data ./etc/sysctl.conf

		# Tell gptboot not to wait 3 seconds for a keypress which will
		# never arrive.
		printf -- "-n\n" > ${DESTDIR}/boot.config
		metalog_add_data ./boot.config

# Booting quickly is more important than giving users a chance to		# Booting quickly is more important than giving users a chance to
# access the boot loader via the serial port.		# access the boot loader via the serial port.
echo 'autoboot_delay="-1"' >> ${DESTDIR}/boot/loader.conf		echo 'autoboot_delay="-1"' >> ${DESTDIR}/boot/loader.conf
echo 'beastie_disable="YES"' >> ${DESTDIR}/boot/loader.conf		echo 'beastie_disable="YES"' >> ${DESTDIR}/boot/loader.conf

# The EFI RNG on Graviton 2 is particularly slow if we ask for the		# The EFI RNG on Graviton 2 is particularly slow if we ask for the
# default 2048 bytes of entropy; ask for 64 bytes instead.		# default 2048 bytes of entropy; ask for 64 bytes instead.
echo 'entropy_efi_seed_size="64"' >> ${DESTDIR}/boot/loader.conf		echo 'entropy_efi_seed_size="64"' >> ${DESTDIR}/boot/loader.conf

# Tell gptboot not to wait 3 seconds for a keypress which will
# never arrive.
printf -- "-n\n" > ${DESTDIR}/boot.config

# The emulated keyboard attached to EC2 instances is inaccessible to		# The emulated keyboard attached to EC2 instances is inaccessible to
# users, and there is no mouse attached at all; disable to keyboard		# users, and there is no mouse attached at all; disable to keyboard
# and the keyboard controller (to which the mouse would attach, if		# and the keyboard controller (to which the mouse would attach, if
# one existed) in order to save time in device probing.		# one existed) in order to save time in device probing.
echo 'hint.atkbd.0.disabled=1' >> ${DESTDIR}/boot/loader.conf		echo 'hint.atkbd.0.disabled=1' >> ${DESTDIR}/boot/loader.conf
echo 'hint.atkbdc.0.disabled=1' >> ${DESTDIR}/boot/loader.conf		echo 'hint.atkbdc.0.disabled=1' >> ${DESTDIR}/boot/loader.conf

# There is no floppy drive on EC2 instances so disable the driver.		# There is no floppy drive on EC2 instances so disable the driver.
Show All 30 Lines	ec2_common() {
# historical "nvd" driver.		# historical "nvd" driver.
echo 'hw.nvme.use_nvd="0"' >> ${DESTDIR}/boot/loader.conf		echo 'hw.nvme.use_nvd="0"' >> ${DESTDIR}/boot/loader.conf

# Reduce the timeout for PCIe Eject ("hotunplug") requests. PCIe		# Reduce the timeout for PCIe Eject ("hotunplug") requests. PCIe
# mandates a 5 second timeout to allow someone to cancel the eject		# mandates a 5 second timeout to allow someone to cancel the eject
# by pressing the "Attention button" a second time, but in the EC2		# by pressing the "Attention button" a second time, but in the EC2
# environment this delay serves no purpose.		# environment this delay serves no purpose.
echo 'hw.pci.pcie_hp_detach_timeout="0"' >> ${DESTDIR}/boot/loader.conf		echo 'hw.pci.pcie_hp_detach_timeout="0"' >> ${DESTDIR}/boot/loader.conf
		metalog_add_data ./boot/loader.conf

# Disable KbdInteractiveAuthentication according to EC2 requirements.		# Disable KbdInteractiveAuthentication according to EC2 requirements.
sed -i '' -e \		sed -i '' -e \
's/^#KbdInteractiveAuthentication yes/KbdInteractiveAuthentication no/' \		's/^#KbdInteractiveAuthentication yes/KbdInteractiveAuthentication no/' \
${DESTDIR}/etc/ssh/sshd_config		${DESTDIR}/etc/ssh/sshd_config

# RSA host keys are obsolete and also very slow to generate		# RSA host keys are obsolete and also very slow to generate
echo 'sshd_rsa_enable="NO"' >> ${DESTDIR}/etc/rc.conf		echo 'sshd_rsa_enable="NO"' >> ${DESTDIR}/etc/rc.conf
Show All 18 Lines
fi		fi

# Provide instructions on how to mount the requested filesystem.		# Provide instructions on how to mount the requested filesystem.
FS=$1		FS=$1
REGION=`fetch -qo- http://169.254.169.254/latest/meta-data/placement/availability-zone \| sed -e 's/[a-z]$//'`		REGION=`fetch -qo- http://169.254.169.254/latest/meta-data/placement/availability-zone \| sed -e 's/[a-z]$//'`
echo "-nfsv4,minorversion=1,oneopenown ${FS}.efs.${REGION}.amazonaws.com:/"		echo "-nfsv4,minorversion=1,oneopenown ${FS}.efs.${REGION}.amazonaws.com:/"
EOF		EOF
chmod 755 ${DESTDIR}/etc/autofs/special_efs		chmod 755 ${DESTDIR}/etc/autofs/special_efs
		metalog_add_data ./etc/autofs/special_efs 0755

return 0		return 0
}		}

ec2_base_networking () {		ec2_base_networking () {
# EC2 instances use DHCP to get their network configuration. IPv6		# EC2 instances use DHCP to get their network configuration. IPv6
# requires accept_rtadv.		# requires accept_rtadv.
echo 'ifconfig_DEFAULT="SYNCDHCP accept_rtadv"' >> ${DESTDIR}/etc/rc.conf		echo 'ifconfig_DEFAULT="SYNCDHCP accept_rtadv"' >> ${DESTDIR}/etc/rc.conf
Show All 11 Lines	ec2_base_networking () {
# Provide a script which rtsold can use to launch DHCPv6		# Provide a script which rtsold can use to launch DHCPv6
mkdir -p ${DESTDIR}/usr/local/libexec		mkdir -p ${DESTDIR}/usr/local/libexec
cat > ${DESTDIR}/usr/local/libexec/rtsold-M <<'EOF'		cat > ${DESTDIR}/usr/local/libexec/rtsold-M <<'EOF'
#!/bin/sh		#!/bin/sh

/usr/local/sbin/dhclient -6 -nw -N -cf /dev/null $1		/usr/local/sbin/dhclient -6 -nw -N -cf /dev/null $1
EOF		EOF
chmod 755 ${DESTDIR}/usr/local/libexec/rtsold-M		chmod 755 ${DESTDIR}/usr/local/libexec/rtsold-M
		metalog_add_data ./usr/local/libexec/rtsold-M 0755

return 0		return 0
}		}