diff --git a/release/tools/ec2-base.conf b/release/tools/ec2-base.conf index 3ed20474a4e8..b6354db3d9d1 100644 --- a/release/tools/ec2-base.conf +++ b/release/tools/ec2-base.conf @@ -1,39 +1,40 @@ #!/bin/sh . ${WORLDDIR}/release/tools/ec2.conf # Packages to install into the image we're creating. In addition to packages # present on all EC2 AMIs, we install: # * amazon-ssm-agent (not enabled by default, but some users need to use # it on systems not connected to the internet), # * ec2-scripts, which provides a range of EC2ification startup scripts, # * firstboot-freebsd-update, to install security updates at first boot, # * firstboot-pkgs, to install packages at first boot, and # * isc-dhcp44-client, used for IPv6 network setup. export VM_EXTRA_PACKAGES="${VM_EXTRA_PACKAGES} amazon-ssm-agent ec2-scripts \ firstboot-freebsd-update firstboot-pkgs isc-dhcp44-client" # Services to enable in rc.conf(5). export VM_RC_LIST="${VM_RC_LIST} ec2_configinit ec2_ephemeral_swap \ ec2_fetchkey ec2_loghostkey firstboot_freebsd_update firstboot_pkgs \ growfs sshd" vm_extra_pre_umount() { # The AWS CLI tools are generally useful, and small enough that they # will download quickly; but users will often override this setting # via EC2 user-data. echo 'firstboot_pkgs_list="devel/py-awscli"' >> ${DESTDIR}/etc/rc.conf # Any EC2 ephemeral disks seen when the system first boots will # be "new" disks; there is no "previous boot" when they might have # been seen and used already. touch ${DESTDIR}/var/db/ec2_ephemeral_diskseen + metalog_add_data ./var/db/ec2_ephemeral_diskseen # Configuration common to all EC2 AMIs ec2_common # Standard FreeBSD network configuration ec2_base_networking return 0 } diff --git a/release/tools/ec2-builder.conf b/release/tools/ec2-builder.conf index 7927fc13a74d..993dffc565eb 100644 --- a/release/tools/ec2-builder.conf +++ b/release/tools/ec2-builder.conf @@ -1,57 +1,62 @@ #!/bin/sh . ${WORLDDIR}/release/tools/ec2.conf # Build with a 7.9 GB partition; this is enough for our stripped-down # base system plus the compressed ec2-base image. export VMSIZE=8000m # Flags to installworld/kernel: We don't want debug symbols (kernel or # userland), 32-bit libraries, tests, or the debugger. export INSTALLOPTS="WITHOUT_DEBUG_FILES=YES WITHOUT_KERNEL_SYMBOLS=YES \ WITHOUT_LIB32=YES WITHOUT_TESTS=YES WITHOUT_LLDB=YES" # Packages to install into the image we're creating. In addition to packages # present on all EC2 AMIs, we install: # * ec2-scripts, which provides a range of EC2ification startup scripts, # * isc-dhcp44-client, used for IPv6 network setup, and # * py-awscli, to make it easier for users to create AMIs. export VM_EXTRA_PACKAGES="${VM_EXTRA_PACKAGES} ec2-scripts \ isc-dhcp44-client devel/py-awscli" # Services to enable in rc.conf(5). export VM_RC_LIST="${VM_RC_LIST} ec2_configinit ec2_ephemeral_swap \ ec2_fetchkey ec2_loghostkey sshd" vm_extra_pre_umount() { # Any EC2 ephemeral disks seen when the system first boots will # be "new" disks; there is no "previous boot" when they might have # been seen and used already. touch ${DESTDIR}/var/db/ec2_ephemeral_diskseen + metalog_add_data ./var/db/ec2_ephemeral_diskseen # Configuration common to all EC2 AMIs ec2_common # Standard FreeBSD network configuration ec2_base_networking # Grab a copy of the ec2-base disk image, and compress it zstd < ${EC2BASEIMG} > ${DESTDIR}/image.zst + metalog_add_data ./image.zst # Disable fortune so we don't have extra noise at login chmod a-x ${DESTDIR}/usr/bin/fortune # Install the AMI-building script install -m 755 ${WORLDDIR}/release/tools/mkami.sh ${DESTDIR}/bin/mkami + metalog_add_data ./bin/mkami 0755 # Install an /etc/rc which juggles disks around for us install -m 755 ${WORLDDIR}/release/tools/rc.amibuilder ${DESTDIR}/etc + metalog_add_data ./etc/rc.amibuilder 0755 # We want to mount from the UFS disk and juggle disks first cat >> ${DESTDIR}/boot/loader.conf <<-EOF vfs.root.mountfrom="ufs:/dev/gpt/rootfs" init_script="/etc/rc.amibuilder" EOF + metalog_add_data ./boot/loader.conf return 0 } diff --git a/release/tools/ec2-cloud-init.conf b/release/tools/ec2-cloud-init.conf index 048202e252f6..2a15ae5c57d8 100644 --- a/release/tools/ec2-cloud-init.conf +++ b/release/tools/ec2-cloud-init.conf @@ -1,32 +1,33 @@ #!/bin/sh . ${WORLDDIR}/release/tools/ec2.conf # Packages to install into the image we're creating. In addition to packages # present on all EC2 AMIs, we install amazon-ssm-agent and cloud-init. export VM_EXTRA_PACKAGES="${VM_EXTRA_PACKAGES} amazon-ssm-agent net/cloud-init" # Services to enable in rc.conf(5). export VM_RC_LIST="${VM_RC_LIST} cloudinit sshd" vm_extra_pre_umount() { # Configuration common to all EC2 AMIs ec2_common # Configure cloud-init cat <<-'EOF' > ${DESTDIR}/usr/local/etc/cloud/cloud.cfg.d/98_ec2.cfg disable_root: true system_info: distro: freebsd default_user: name: ec2-user lock_passwd: True groups: [wheel] shell: /bin/sh homedir: /home/ec2-user doas: - permit nopass ec2-user EOF + metalog_add_data ./usr/local/etc/cloud/cloud.cfg.d/98_ec2.cfg return 0 } diff --git a/release/tools/ec2-small.conf b/release/tools/ec2-small.conf index 858836717f5a..e2a348d6ba8f 100644 --- a/release/tools/ec2-small.conf +++ b/release/tools/ec2-small.conf @@ -1,44 +1,45 @@ #!/bin/sh . ${WORLDDIR}/release/tools/ec2.conf # Build with a 4.9 GB partition; the growfs rc.d script will expand # the partition to fill the root disk after the EC2 instance is launched. # Note that if this is set to G, we will end up with an GB disk # image since VMSIZE is the size of the filesystem partition, not the disk # which it resides within. (This overrides the default in ec2.conf.) export VMSIZE=5000m # Flags to installworld/kernel: We don't want debug symbols (kernel or # userland), 32-bit libraries, tests, or the debugger. export INSTALLOPTS="WITHOUT_DEBUG_FILES=YES WITHOUT_KERNEL_SYMBOLS=YES \ WITHOUT_LIB32=YES WITHOUT_TESTS=YES WITHOUT_LLDB=YES" # Packages to install into the image we're creating. In addition to packages # present on all EC2 AMIs, we install: # * ec2-scripts, which provides a range of EC2ification startup scripts, # * firstboot-freebsd-update, to install security updates at first boot, # * firstboot-pkgs, to install packages at first boot, and # * isc-dhcp44-client, used for IPv6 network setup. export VM_EXTRA_PACKAGES="${VM_EXTRA_PACKAGES} ec2-scripts \ firstboot-freebsd-update firstboot-pkgs isc-dhcp44-client" # Services to enable in rc.conf(5). export VM_RC_LIST="${VM_RC_LIST} ec2_configinit ec2_ephemeral_swap \ ec2_fetchkey ec2_loghostkey firstboot_freebsd_update firstboot_pkgs \ growfs sshd" vm_extra_pre_umount() { # Any EC2 ephemeral disks seen when the system first boots will # be "new" disks; there is no "previous boot" when they might have # been seen and used already. touch ${DESTDIR}/var/db/ec2_ephemeral_diskseen + metalog_add_data ./var/db/ec2_ephemeral_diskseen # Configuration common to all EC2 AMIs ec2_common # Standard FreeBSD network configuration ec2_base_networking return 0 } diff --git a/release/tools/ec2.conf b/release/tools/ec2.conf index 31f40962b19d..aecaabfcd277 100644 --- a/release/tools/ec2.conf +++ b/release/tools/ec2.conf @@ -1,162 +1,171 @@ #!/bin/sh # Package which should be installed onto all EC2 AMIs: # * ebsnvme-id, which is very minimal and provides important EBS-specific # functionality, export VM_EXTRA_PACKAGES="${VM_EXTRA_PACKAGES} ebsnvme-id" # Services which should be enabled by default in rc.conf(5). export VM_RC_LIST="dev_aws_disk ntpd" # Build with a 7.9 GB partition; the growfs rc.d script will expand # the partition to fill the root disk after the EC2 instance is launched. # Note that if this is set to G, we will end up with an GB disk # image since VMSIZE is the size of the filesystem partition, not the disk # which it resides within. export VMSIZE=8000m # No swap space; it doesn't make sense to provision any as part of the disk # image when we could be launching onto a system with anywhere between 0.5 # and 4096 GB of RAM. export NOSWAP=YES ec2_common() { # Delete the pkg package and the repo database; they will likely be - # long out of date before the EC2 instance is launched. - mount -t devfs devfs ${DESTDIR}/dev - chroot ${DESTDIR} ${EMULATOR} env ASSUME_ALWAYS_YES=yes \ - /usr/sbin/pkg delete -f -y pkg - umount ${DESTDIR}/dev - rm -r ${DESTDIR}/var/db/pkg/repos/FreeBSD-ports - rm -r ${DESTDIR}/var/db/pkg/repos/FreeBSD-ports-kmods + # long out of date before the EC2 instance is launched. In + # unprivileged builds this is unnecessary as pkg will not be + # installed to begin with. + if [ -z "${NO_ROOT}" ]; then + mount -t devfs devfs ${DESTDIR}/dev + chroot ${DESTDIR} ${EMULATOR} env ASSUME_ALWAYS_YES=yes \ + /usr/sbin/pkg delete -f -y pkg + umount ${DESTDIR}/dev + rm -r ${DESTDIR}/var/db/pkg/repos/FreeBSD-ports + rm -r ${DESTDIR}/var/db/pkg/repos/FreeBSD-ports-kmods + fi # Turn off IPv6 Duplicate Address Detection; the EC2 networking # configuration makes it unnecessary. echo 'net.inet6.ip6.dad_count=0' >> ${DESTDIR}/etc/sysctl.conf + metalog_add_data ./etc/sysctl.conf + + # Tell gptboot not to wait 3 seconds for a keypress which will + # never arrive. + printf -- "-n\n" > ${DESTDIR}/boot.config + metalog_add_data ./boot.config # Booting quickly is more important than giving users a chance to # access the boot loader via the serial port. echo 'autoboot_delay="-1"' >> ${DESTDIR}/boot/loader.conf echo 'beastie_disable="YES"' >> ${DESTDIR}/boot/loader.conf # The EFI RNG on Graviton 2 is particularly slow if we ask for the # default 2048 bytes of entropy; ask for 64 bytes instead. echo 'entropy_efi_seed_size="64"' >> ${DESTDIR}/boot/loader.conf - # Tell gptboot not to wait 3 seconds for a keypress which will - # never arrive. - printf -- "-n\n" > ${DESTDIR}/boot.config - # The emulated keyboard attached to EC2 instances is inaccessible to # users, and there is no mouse attached at all; disable to keyboard # and the keyboard controller (to which the mouse would attach, if # one existed) in order to save time in device probing. echo 'hint.atkbd.0.disabled=1' >> ${DESTDIR}/boot/loader.conf echo 'hint.atkbdc.0.disabled=1' >> ${DESTDIR}/boot/loader.conf # There is no floppy drive on EC2 instances so disable the driver. echo 'hint.fd.0.disabled=1' >> ${DESTDIR}/boot/loader.conf echo 'hint.fdc.0.disabled=1' >> ${DESTDIR}/boot/loader.conf # There is no parallel port on EC2 instances so disable driver. echo 'hint.ppc.0.disabled=1' >> ${DESTDIR}/boot/loader.conf # EC2 has two consoles: An emulated serial port ("system log"), # which has been present since 2006; and a VGA console ("instance # screenshot") which was introduced in 2016. echo 'boot_multicons="YES"' >> ${DESTDIR}/boot/loader.conf # Graviton 1 through Graviton 4 have a bug in their ACPI where they # mark the PL061's pins as needing to be configured in PullUp mode # (in fact the PL061 has no pullup/pulldown resistors). Graviton 1 # through Graviton 3 have non-functional PCI _EJ0 and need a value # written to the PCI power status register in order to eject a # device. EC2 instances with PCI (not PCIe) buses need a short # delay before rescanning upon device detach. echo 'debug.acpi.quirks="56"' >> ${DESTDIR}/boot/loader.conf # The default behaviour of re-routing INTx interrupts causes a # resource leak on INTRng (aka on Graviton systems). Repeated # hotplug/unplug on PCI (not PCIe) Graviton systems ends up with # a kernel panic unless we disable this. echo 'hw.pci.intx_reroute=0' >> ${DESTDIR}/boot/loader.conf # Load the kernel module for the Amazon "Elastic Network Adapter" echo 'if_ena_load="YES"' >> ${DESTDIR}/boot/loader.conf # Use the "nda" driver for accessing NVMe disks rather than the # historical "nvd" driver. echo 'hw.nvme.use_nvd="0"' >> ${DESTDIR}/boot/loader.conf # Reduce the timeout for PCIe Eject ("hotunplug") requests. PCIe # mandates a 5 second timeout to allow someone to cancel the eject # by pressing the "Attention button" a second time, but in the EC2 # environment this delay serves no purpose. echo 'hw.pci.pcie_hp_detach_timeout="0"' >> ${DESTDIR}/boot/loader.conf + metalog_add_data ./boot/loader.conf # Disable KbdInteractiveAuthentication according to EC2 requirements. sed -i '' -e \ 's/^#KbdInteractiveAuthentication yes/KbdInteractiveAuthentication no/' \ ${DESTDIR}/etc/ssh/sshd_config # RSA host keys are obsolete and also very slow to generate echo 'sshd_rsa_enable="NO"' >> ${DESTDIR}/etc/rc.conf # Use FreeBSD Update mirrors hosted in AWS sed -i '' -e 's/update.FreeBSD.org/aws.update.FreeBSD.org/' \ ${DESTDIR}/etc/freebsd-update.conf # Use the NTP service provided by Amazon sed -i '' -e 's/^pool/#pool/' \ -e '1,/^#server/s/^#server.*/server 169.254.169.123 iburst/' \ ${DESTDIR}/etc/ntp.conf # Provide a map for accessing Elastic File System mounts cat > ${DESTDIR}/etc/autofs/special_efs <<'EOF' #!/bin/sh if [ $# -eq 0 ]; then # No way to know which EFS filesystems exist and are # accessible to this EC2 instance. exit 0 fi # Provide instructions on how to mount the requested filesystem. FS=$1 REGION=`fetch -qo- http://169.254.169.254/latest/meta-data/placement/availability-zone | sed -e 's/[a-z]$//'` echo "-nfsv4,minorversion=1,oneopenown ${FS}.efs.${REGION}.amazonaws.com:/" EOF chmod 755 ${DESTDIR}/etc/autofs/special_efs + metalog_add_data ./etc/autofs/special_efs 0755 # The first time the AMI boots, run "first boot" scripts. touch ${DESTDIR}/firstboot return 0 } ec2_base_networking () { # EC2 instances use DHCP to get their network configuration. IPv6 # requires accept_rtadv. echo 'ifconfig_DEFAULT="SYNCDHCP accept_rtadv"' >> ${DESTDIR}/etc/rc.conf # The EC2 DHCP server can be trusted to know whether an IP address is # assigned to us; we don't need to ARP to check if anyone else is using # the address before we start using it. echo 'dhclient_arpwait="NO"' >> ${DESTDIR}/etc/rc.conf # Enable IPv6 on all interfaces, and spawn DHCPv6 via rtsold echo 'ipv6_activate_all_interfaces="YES"' >> ${DESTDIR}/etc/rc.conf echo 'rtsold_enable="YES"' >> ${DESTDIR}/etc/rc.conf echo 'rtsold_flags="-M /usr/local/libexec/rtsold-M -a"' >> ${DESTDIR}/etc/rc.conf # Provide a script which rtsold can use to launch DHCPv6 mkdir -p ${DESTDIR}/usr/local/libexec cat > ${DESTDIR}/usr/local/libexec/rtsold-M <<'EOF' #!/bin/sh /usr/local/sbin/dhclient -6 -nw -N -cf /dev/null $1 EOF chmod 755 ${DESTDIR}/usr/local/libexec/rtsold-M + metalog_add_data ./usr/local/libexec/rtsold-M 0755 return 0 }