Index: stable/10/release/tools/ec2.conf =================================================================== --- stable/10/release/tools/ec2.conf (revision 326263) +++ stable/10/release/tools/ec2.conf (revision 326264) @@ -1,86 +1,88 @@ #!/bin/sh # # $FreeBSD$ # # Packages to install into the image we're creating. This is a deliberately # minimalist set, providing only the packages necessary to bootstrap further # package installation as specified via EC2 user-data. export VM_EXTRA_PACKAGES="ec2-scripts firstboot-freebsd-update firstboot-pkgs" # Set to a list of third-party software to enable in rc.conf(5). export VM_RC_LIST="ec2_configinit ec2_fetchkey ec2_ephemeralswap ec2_loghostkey firstboot_freebsd_update firstboot_pkgs" # Build with a 1.5 GB UFS partition; the growfs rc.d script will expand # the partition to fill the root disk after the EC2 instance is launched. # Note that if this is set to G, we will end up with an GB disk # image since VMSIZE is the size of the UFS partition, not the disk which # it resides within. export VMSIZE=1536M # No swap space; the ec2_ephemeralswap rc.d script will allocate swap # space on EC2 ephemeral disks. (If they exist -- the T2 low-cost instances # and the C4 compute-optimized instances don't have ephemeral disks. But # it would be silly to bloat the image and increase costs for every instance # just for those two families, especially since instances ranging in size # from 1 GB of RAM to 60 GB of RAM would need different sizes of swap space # anyway.) export NOSWAP=YES vm_extra_pre_umount() { # The firstboot_pkgs rc.d script will download the repository # catalogue and install or update pkg when the instance first # launches, so these files would just be replaced anyway; removing # them from the image allows it to boot faster. chroot ${DESTDIR} env ASSUME_ALWAYS_YES=yes \ /usr/sbin/pkg delete -f -y pkg rm ${DESTDIR}/var/db/pkg/repo-*.sqlite # The size of the EC2 root disk can be configured at instance launch # time; expand our filesystem to fill the disk. echo 'growfs_enable="YES"' >> ${DESTDIR}/etc/rc.conf # EC2 instances use DHCP to get their network configuration. echo 'ifconfig_DEFAULT="SYNCDHCP"' >> ${DESTDIR}/etc/rc.conf # Unless the system has been configured via EC2 user-data, the user # will need to SSH in to do anything. echo 'sshd_enable="YES"' >> ${DESTDIR}/etc/rc.conf # The AWS CLI tools are generally useful, and small enough that they # will download quickly; but users will often override this setting # via EC2 user-data. echo 'firstboot_pkgs_list="awscli"' >> ${DESTDIR}/etc/rc.conf # The EC2 console is output-only, so while printing a backtrace can # be useful, there's no point dropping into a debugger or waiting # for a keypress. echo 'debug.trace_on_panic=1' >> ${DESTDIR}/etc/sysctl.conf echo 'debug.debugger_on_panic=0' >> ${DESTDIR}/etc/sysctl.conf echo 'kern.panic_reboot_wait_time=0' >> ${DESTDIR}/etc/sysctl.conf # The console is not interactive, so we might as well boot quickly. echo 'autoboot_delay="-1"' >> ${DESTDIR}/boot/loader.conf echo 'beastie_disable="YES"' >> ${DESTDIR}/boot/loader.conf # EC2 has two consoles: An emulated serial port ("system log"), # which has been present since 2006; and a VGA console ("instance # screenshot") which was introduced in 2016. echo 'boot_multicons="YES"' >> ${DESTDIR}/boot/loader.conf # Some older EC2 hardware used a version of Xen with a bug in its # emulated serial port. It is not clear if EC2 still has any such # nodes, but apply the workaround just in case. echo 'hw.broken_txfifo="1"' >> ${DESTDIR}/boot/loader.conf # The first time the AMI boots, the installed "first boot" scripts # should be allowed to run: # * ec2_configinit (download and process EC2 user-data) # * ec2_fetchkey (arrange for SSH using the EC2-provided public key) # * growfs (expand the filesystem to fill the provided disk) # * firstboot_freebsd_update (install critical updates) # * firstboot_pkgs (install packages) touch ${DESTDIR}/firstboot + rm -f ${DESTDIR}/etc/resolv.conf + return 0 } Index: stable/10/release/tools/gce.conf =================================================================== --- stable/10/release/tools/gce.conf (revision 326263) +++ stable/10/release/tools/gce.conf (revision 326264) @@ -1,93 +1,95 @@ #!/bin/sh # # $FreeBSD$ # # Set to a list of packages to install. export VM_EXTRA_PACKAGES="firstboot-freebsd-update firstboot-pkgs \ google-cloud-sdk google-daemon panicmail sudo firstboot-growfs \ google-startup-scripts" # Set to a list of third-party software to enable in rc.conf(5). export VM_RC_LIST="google_accounts_manager ntpd sshd firstboot_growfs \ firstboot_pkgs firstboot_freebsd_update google_startup" vm_extra_install_base() { echo 'search google.internal' > ${DESTDIR}/etc/resolv.conf echo 'nameserver 169.254.169.254' >> ${DESTDIR}/etc/resolv.conf echo 'nameserver 8.8.8.8' >> ${DESTDIR}/etc/resolv.conf } vm_extra_pre_umount() { cat << EOF >> ${DESTDIR}/etc/rc.conf dumpdev="AUTO" ifconfig_DEFAULT="SYNCDHCP mtu 1460" ntpd_sync_on_start="YES" # need to fill in something here #firstboot_pkgs_list="" panicmail_autosubmit="YES" EOF cat << EOF >> ${DESTDIR}/boot/loader.conf autoboot_delay="-1" beastie_disable="YES" loader_logo="none" hw.memtest.tests="0" console="comconsole,vidconsole" hw.vtnet.mq_disable=1 kern.timecounter.hardware=ACPI-safe aesni_load="YES" nvme_load="YES" EOF echo '169.254.169.254 metadata.google.internal metadata' > \ ${DESTDIR}/etc/hosts # overwrite ntp.conf cat << EOF > ${DESTDIR}/etc/ntp.conf server metadata.google.internal iburst restrict default kod nomodify notrap nopeer noquery restrict -6 default kod nomodify notrap nopeer noquery restrict 127.0.0.1 restrict -6 ::1 restrict 127.127.1.0 EOF cat << EOF >> ${DESTDIR}/etc/syslog.conf *.err;kern.warning;auth.notice;mail.crit /dev/console EOF cat << EOF >> ${DESTDIR}/etc/ssh/sshd_config ChallengeResponseAuthentication no X11Forwarding no AcceptEnv LANG Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc AllowAgentForwarding no ClientAliveInterval 420 EOF cat << EOF >> ${DESTDIR}/etc/crontab 0 3 * * * root /usr/sbin/freebsd-update cron EOF cat << EOF >> ${DESTDIR}/etc/sysctl.conf net.inet.icmp.drop_redirect=1 net.inet.ip.redirect=0 net.inet.tcp.blackhole=2 net.inet.udp.blackhole=1 kern.ipc.somaxconn=1024 debug.trace_on_panic=1 debug.debugger_on_panic=0 EOF ## XXX: Verify this is needed. I do not see this requirement ## in the docs, and it impairs the ability to boot-test a copy ## of the image prior to packaging for upload to GCE. #sed -E -i '' 's/^([^#].*[[:space:]])on/\1off/' ${DESTDIR}/etc/ttys touch ${DESTDIR}/firstboot + rm -f ${DESTDIR}/etc/resolv.conf + return 0 } Index: stable/10/release/tools/vagrant-virtualbox.conf =================================================================== --- stable/10/release/tools/vagrant-virtualbox.conf (revision 326263) +++ stable/10/release/tools/vagrant-virtualbox.conf (revision 326264) @@ -1,18 +1,19 @@ #!/bin/sh # # $FreeBSD$ # . ${WORLDDIR}/release/tools/vagrant.conf export VM_EXTRA_PACKAGES="${VM_EXTRA_PACKAGES} virtualbox-ose-additions" vm_extra_pre_umount () { # VirtualBox first boot pkgs echo 'firstboot_pkgs_list="sudo rsync virtualbox-ose-additions"' >> ${DESTDIR}/etc/rc.conf echo 'vboxguest_enable="YES"' >> ${DESTDIR}/etc/rc.conf echo 'vboxservice_enable="YES"' >> ${DESTDIR}/etc/rc.conf # Setup the Vagrant common items vagrant_common + rm -f ${DESTDIR}/etc/resolv.conf } Index: stable/10/release/tools/vagrant-vmware.conf =================================================================== --- stable/10/release/tools/vagrant-vmware.conf (revision 326263) +++ stable/10/release/tools/vagrant-vmware.conf (revision 326264) @@ -1,22 +1,23 @@ #!/bin/sh # # $FreeBSD$ # . ${WORLDDIR}/release/tools/vagrant.conf export VM_EXTRA_PACKAGES="${VM_EXTRA_PACKAGES} open-vm-tools-nox11" vm_extra_pre_umount () { # VMWare first boot pkgs echo 'firstboot_pkgs_list="sudo rsync open-vm-tools-nox11"' >> ${DESTDIR}/etc/rc.conf echo 'vmware_guest_vmblock_enable="YES"' >> ${DESTDIR}/etc/rc.conf echo 'vmware_guest_vmhgfs_enable="YES"' >> ${DESTDIR}/etc/rc.conf echo 'vmware_guest_vmmemctl_enable="YES"' >> ${DESTDIR}/etc/rc.conf echo 'vmware_guest_vmxnet_enable="YES"' >> ${DESTDIR}/etc/rc.conf echo 'vmware_guestd_enable="YES"' >> ${DESTDIR}/etc/rc.conf # Setup the Vagrant common items vagrant_common + rm -f ${DESTDIR}/etc/resolv.conf } Index: stable/10 =================================================================== --- stable/10 (revision 326263) +++ stable/10 (revision 326264) Property changes on: stable/10 ___________________________________________________________________ Modified: svn:mergeinfo ## -0,0 +0,1 ## Merged /head:r326068 Index: stable/11/release/tools/ec2.conf =================================================================== --- stable/11/release/tools/ec2.conf (revision 326263) +++ stable/11/release/tools/ec2.conf (revision 326264) @@ -1,94 +1,96 @@ #!/bin/sh # # $FreeBSD$ # # Packages to install into the image we're creating. This is a deliberately # minimalist set, providing only the packages necessary to bootstrap further # package installation as specified via EC2 user-data. export VM_EXTRA_PACKAGES="ec2-scripts firstboot-freebsd-update firstboot-pkgs dual-dhclient" # Set to a list of third-party software to enable in rc.conf(5). export VM_RC_LIST="ec2_configinit ec2_fetchkey ec2_ephemeralswap ec2_loghostkey firstboot_freebsd_update firstboot_pkgs" # Build with a 2 GB UFS partition; the growfs rc.d script will expand # the partition to fill the root disk after the EC2 instance is launched. # Note that if this is set to G, we will end up with an GB disk # image since VMSIZE is the size of the UFS partition, not the disk which # it resides within. export VMSIZE=2048M # No swap space; the ec2_ephemeralswap rc.d script will allocate swap # space on EC2 ephemeral disks. (If they exist -- the T2 low-cost instances # and the C4 compute-optimized instances don't have ephemeral disks. But # it would be silly to bloat the image and increase costs for every instance # just for those two families, especially since instances ranging in size # from 1 GB of RAM to 60 GB of RAM would need different sizes of swap space # anyway.) export NOSWAP=YES vm_extra_pre_umount() { # The firstboot_pkgs rc.d script will download the repository # catalogue and install or update pkg when the instance first # launches, so these files would just be replaced anyway; removing # them from the image allows it to boot faster. chroot ${DESTDIR} env ASSUME_ALWAYS_YES=yes \ /usr/sbin/pkg delete -f -y pkg rm ${DESTDIR}/var/db/pkg/repo-*.sqlite # The size of the EC2 root disk can be configured at instance launch # time; expand our filesystem to fill the disk. echo 'growfs_enable="YES"' >> ${DESTDIR}/etc/rc.conf # EC2 instances use DHCP to get their network configuration. IPv6 # requires accept_rtadv. echo 'ifconfig_DEFAULT="SYNCDHCP accept_rtadv"' >> ${DESTDIR}/etc/rc.conf # Unless the system has been configured via EC2 user-data, the user # will need to SSH in to do anything. echo 'sshd_enable="YES"' >> ${DESTDIR}/etc/rc.conf # The AWS CLI tools are generally useful, and small enough that they # will download quickly; but users will often override this setting # via EC2 user-data. echo 'firstboot_pkgs_list="awscli"' >> ${DESTDIR}/etc/rc.conf # Enable IPv6 on all interfaces, and use DHCP on both IPv4 and IPv6. echo 'ipv6_activate_all_interfaces="YES"' >> ${DESTDIR}/etc/rc.conf echo 'dhclient_program="/usr/local/sbin/dual-dhclient"' >> ${DESTDIR}/etc/rc.conf # The EC2 console is output-only, so while printing a backtrace can # be useful, there's no point dropping into a debugger or waiting # for a keypress. echo 'debug.trace_on_panic=1' >> ${DESTDIR}/etc/sysctl.conf echo 'debug.debugger_on_panic=0' >> ${DESTDIR}/etc/sysctl.conf echo 'kern.panic_reboot_wait_time=0' >> ${DESTDIR}/etc/sysctl.conf # The console is not interactive, so we might as well boot quickly. echo 'autoboot_delay="-1"' >> ${DESTDIR}/boot/loader.conf echo 'beastie_disable="YES"' >> ${DESTDIR}/boot/loader.conf # EC2 has two consoles: An emulated serial port ("system log"), # which has been present since 2006; and a VGA console ("instance # screenshot") which was introduced in 2016. echo 'boot_multicons="YES"' >> ${DESTDIR}/boot/loader.conf # Some older EC2 hardware used a version of Xen with a bug in its # emulated serial port. It is not clear if EC2 still has any such # nodes, but apply the workaround just in case. echo 'hw.broken_txfifo="1"' >> ${DESTDIR}/boot/loader.conf # Load the kernel module for the Amazon "Elastic Network Adapter" echo 'if_ena_load="YES"' >> ${DESTDIR}/boot/loader.conf # The first time the AMI boots, the installed "first boot" scripts # should be allowed to run: # * ec2_configinit (download and process EC2 user-data) # * ec2_fetchkey (arrange for SSH using the EC2-provided public key) # * growfs (expand the filesystem to fill the provided disk) # * firstboot_freebsd_update (install critical updates) # * firstboot_pkgs (install packages) touch ${DESTDIR}/firstboot + rm -f ${DESTDIR}/etc/resolv.conf + return 0 } Index: stable/11/release/tools/gce.conf =================================================================== --- stable/11/release/tools/gce.conf (revision 326263) +++ stable/11/release/tools/gce.conf (revision 326264) @@ -1,93 +1,95 @@ #!/bin/sh # # $FreeBSD$ # # Set to a list of packages to install. export VM_EXTRA_PACKAGES="firstboot-freebsd-update firstboot-pkgs \ google-cloud-sdk google-daemon panicmail sudo firstboot-growfs \ google-startup-scripts" # Set to a list of third-party software to enable in rc.conf(5). export VM_RC_LIST="google_accounts_manager ntpd sshd firstboot_growfs \ firstboot_pkgs firstboot_freebsd_update google_startup" vm_extra_install_base() { echo 'search google.internal' > ${DESTDIR}/etc/resolv.conf echo 'nameserver 169.254.169.254' >> ${DESTDIR}/etc/resolv.conf echo 'nameserver 8.8.8.8' >> ${DESTDIR}/etc/resolv.conf } vm_extra_pre_umount() { cat << EOF >> ${DESTDIR}/etc/rc.conf dumpdev="AUTO" ifconfig_DEFAULT="SYNCDHCP mtu 1460" ntpd_sync_on_start="YES" # need to fill in something here #firstboot_pkgs_list="" panicmail_autosubmit="YES" EOF cat << EOF >> ${DESTDIR}/boot/loader.conf autoboot_delay="-1" beastie_disable="YES" loader_logo="none" hw.memtest.tests="0" console="comconsole,vidconsole" hw.vtnet.mq_disable=1 kern.timecounter.hardware=ACPI-safe aesni_load="YES" nvme_load="YES" EOF echo '169.254.169.254 metadata.google.internal metadata' > \ ${DESTDIR}/etc/hosts # overwrite ntp.conf cat << EOF > ${DESTDIR}/etc/ntp.conf server metadata.google.internal iburst restrict default kod nomodify notrap nopeer noquery restrict -6 default kod nomodify notrap nopeer noquery restrict 127.0.0.1 restrict -6 ::1 restrict 127.127.1.0 EOF cat << EOF >> ${DESTDIR}/etc/syslog.conf *.err;kern.warning;auth.notice;mail.crit /dev/console EOF cat << EOF >> ${DESTDIR}/etc/ssh/sshd_config ChallengeResponseAuthentication no X11Forwarding no AcceptEnv LANG Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc AllowAgentForwarding no ClientAliveInterval 420 EOF cat << EOF >> ${DESTDIR}/etc/crontab 0 3 * * * root /usr/sbin/freebsd-update cron EOF cat << EOF >> ${DESTDIR}/etc/sysctl.conf net.inet.icmp.drop_redirect=1 net.inet.ip.redirect=0 net.inet.tcp.blackhole=2 net.inet.udp.blackhole=1 kern.ipc.somaxconn=1024 debug.trace_on_panic=1 debug.debugger_on_panic=0 EOF ## XXX: Verify this is needed. I do not see this requirement ## in the docs, and it impairs the ability to boot-test a copy ## of the image prior to packaging for upload to GCE. #sed -E -i '' 's/^([^#].*[[:space:]])on/\1off/' ${DESTDIR}/etc/ttys touch ${DESTDIR}/firstboot + rm -f ${DESTDIR}/etc/resolv.conf + return 0 } Index: stable/11/release/tools/vagrant-virtualbox.conf =================================================================== --- stable/11/release/tools/vagrant-virtualbox.conf (revision 326263) +++ stable/11/release/tools/vagrant-virtualbox.conf (revision 326264) @@ -1,18 +1,19 @@ #!/bin/sh # # $FreeBSD$ # . ${WORLDDIR}/release/tools/vagrant.conf export VM_EXTRA_PACKAGES="${VM_EXTRA_PACKAGES} virtualbox-ose-additions-nox11" vm_extra_pre_umount () { # VirtualBox first boot pkgs echo 'firstboot_pkgs_list="sudo rsync virtualbox-ose-additions-nox11"' >> ${DESTDIR}/etc/rc.conf echo 'vboxguest_enable="YES"' >> ${DESTDIR}/etc/rc.conf echo 'vboxservice_enable="YES"' >> ${DESTDIR}/etc/rc.conf # Setup the Vagrant common items vagrant_common + rm -f ${DESTDIR}/etc/resolv.conf } Index: stable/11/release/tools/vagrant-vmware.conf =================================================================== --- stable/11/release/tools/vagrant-vmware.conf (revision 326263) +++ stable/11/release/tools/vagrant-vmware.conf (revision 326264) @@ -1,22 +1,23 @@ #!/bin/sh # # $FreeBSD$ # . ${WORLDDIR}/release/tools/vagrant.conf export VM_EXTRA_PACKAGES="${VM_EXTRA_PACKAGES} open-vm-tools-nox11" vm_extra_pre_umount () { # VMWare first boot pkgs echo 'firstboot_pkgs_list="sudo rsync open-vm-tools-nox11"' >> ${DESTDIR}/etc/rc.conf echo 'vmware_guest_vmblock_enable="YES"' >> ${DESTDIR}/etc/rc.conf echo 'vmware_guest_vmhgfs_enable="YES"' >> ${DESTDIR}/etc/rc.conf echo 'vmware_guest_vmmemctl_enable="YES"' >> ${DESTDIR}/etc/rc.conf echo 'vmware_guest_vmxnet_enable="YES"' >> ${DESTDIR}/etc/rc.conf echo 'vmware_guestd_enable="YES"' >> ${DESTDIR}/etc/rc.conf # Setup the Vagrant common items vagrant_common + rm -f ${DESTDIR}/etc/resolv.conf } Index: stable/11 =================================================================== --- stable/11 (revision 326263) +++ stable/11 (revision 326264) Property changes on: stable/11 ___________________________________________________________________ Modified: svn:mergeinfo ## -0,0 +0,1 ## Merged /head:r326068