Add an unattended-install ISO builder
Boot the stick, pick one GRUB entry, walk away: it wipes the target disk, installs Ubuntu 26.04.1 with the NVIDIA driver and codecs, and runs setup.sh on first boot to install the apps. build-iso.sh does the image surgery in a container, so the build machine needs nothing but podman. The wipe is pinned to one disk serial (the 990 PRO). The Data drive can't match it, and an unmatched disk stops the install rather than guessing — so the stick can't eat another machine either. The autoinstall entry is not the GRUB default, so an accidental boot lands in the ordinary Ubuntu installer. Verified by running the install in a VM with two virtual NVMe drives carrying the real serials: unattended start to finish, target partitioned and installed, Data disk byte-for-byte identical, and late-commands left /opt/main-desktop plus the enabled first-boot service in place. Testing caught the autoinstall args landing after '---' (where they reach the installed system instead of the installer, and do nothing), and the first-boot run adding root rather than ckoch to the docker group, since runuser leaves $USER alone. setup.sh gains an unattended mode for that first-boot run, waits out the dpkg lock that Ubuntu's own boot-time upgrades hold, waits for snapd to finish seeding before removing the Firefox snap, and skips the driver step on machines with no NVIDIA card. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5
+55
-23
@@ -2,8 +2,14 @@
|
||||
# Fresh Ubuntu 26.04 LTS -> my desktop, in one pass. Run as your user; it sudos as needed.
|
||||
# Safe to re-run: each step checks before it changes anything. Reboot when it finishes,
|
||||
# then run `sudo flatpak update` once so the Flatpak apps get the NVIDIA GL runtime.
|
||||
#
|
||||
# UNATTENDED=1 (or --unattended) asks nothing: used by the first-boot run after an
|
||||
# install from the ISO, where the driver is already in place.
|
||||
set -euo pipefail
|
||||
|
||||
UNATTENDED=${UNATTENDED:-}
|
||||
[[ ${1:-} == --unattended ]] && UNATTENDED=1
|
||||
|
||||
REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
|
||||
# Second NVMe (970 EVO Plus, label "Data"): SteamLibrary + emulator files. Never formatted.
|
||||
@@ -17,13 +23,20 @@ MARVIN_CREDS=/etc/samba/credentials-marvin
|
||||
step() { printf '\n\033[1;34m== %s ==\033[0m\n' "$*"; }
|
||||
warn() { printf '\033[1;33mwarning:\033[0m %s\n' "$*" >&2; }
|
||||
die() { printf '\033[1;31merror:\033[0m %s\n' "$*" >&2; exit 1; }
|
||||
apt_install() { sudo DEBIAN_FRONTEND=noninteractive apt-get install -y "$@"; }
|
||||
# Ubuntu's own unattended-upgrades run right after boot, so wait for the dpkg lock rather
|
||||
# than failing the moment it's held — that's the difference between a first-boot run that
|
||||
# works and one that dies in the first minute.
|
||||
APT_OPTS=(-o DPkg::Lock::Timeout=600)
|
||||
apt_install() { sudo DEBIAN_FRONTEND=noninteractive apt-get "${APT_OPTS[@]}" install -y "$@"; }
|
||||
|
||||
[[ $EUID -ne 0 ]] || die "run as your user, not with sudo"
|
||||
. /etc/os-release
|
||||
[[ $ID == ubuntu ]] || die "expected Ubuntu, found $ID"
|
||||
[[ $VERSION_ID == 26.04 ]] || warn "written for 26.04; this is $VERSION_ID — carrying on"
|
||||
CODENAME=${UBUNTU_CODENAME:-$VERSION_CODENAME}
|
||||
# Who we actually are. Not $USER: the first-boot service reaches this through runuser, which
|
||||
# leaves $USER as root, and group changes would land on the wrong account.
|
||||
ME=$(id -un)
|
||||
|
||||
# Ask for the password once and keep sudo alive for the whole run (Flatpaks take a while).
|
||||
sudo -v
|
||||
@@ -33,7 +46,7 @@ trap 'kill "$keepalive" 2>/dev/null' EXIT
|
||||
|
||||
# ---------------------------------------------------------------------------------------
|
||||
step "Apt repositories"
|
||||
sudo apt-get update
|
||||
sudo apt-get "${APT_OPTS[@]}" update
|
||||
apt_install curl gpg ca-certificates software-properties-common
|
||||
for c in universe multiverse restricted; do sudo add-apt-repository -y -n "$c"; done
|
||||
sudo dpkg --add-architecture i386 # Steam + 32-bit game libraries
|
||||
@@ -96,8 +109,8 @@ if [[ ! -f /etc/apt/sources.list.d/claude-desktop.list ]]; then
|
||||
| sudo tee /etc/apt/sources.list.d/claude-desktop.list >/dev/null
|
||||
fi
|
||||
|
||||
sudo apt-get update
|
||||
sudo DEBIAN_FRONTEND=noninteractive apt-get full-upgrade -y
|
||||
sudo apt-get "${APT_OPTS[@]}" update
|
||||
sudo DEBIAN_FRONTEND=noninteractive apt-get "${APT_OPTS[@]}" full-upgrade -y
|
||||
|
||||
# ---------------------------------------------------------------------------------------
|
||||
step "Packages"
|
||||
@@ -115,27 +128,32 @@ apt_install \
|
||||
|
||||
# ---------------------------------------------------------------------------------------
|
||||
step "NVIDIA driver (open kernel modules — the only kind the RTX 5090 supports)"
|
||||
apt_install ubuntu-drivers-common
|
||||
installed_driver() {
|
||||
{ dpkg-query -W -f='${Status} ${Package}\n' 'nvidia-driver-*' 2>/dev/null || true; } \
|
||||
| awk '/^install ok installed / {print $4}' | sort -V | tail -1
|
||||
}
|
||||
if [[ $(installed_driver) != *-open ]]; then
|
||||
ubuntu-drivers devices 2>/dev/null | grep -E 'model|driver' || true
|
||||
# Picks Ubuntu's recommended branch plus its prebuilt, signed kernel modules (no DKMS).
|
||||
sudo ubuntu-drivers install
|
||||
if ! grep -qx '0x10de' /sys/bus/pci/devices/*/vendor 2>/dev/null; then
|
||||
# No NVIDIA card here at all (a VM, say) — nothing to install, and nothing to fail over.
|
||||
warn "no NVIDIA GPU on this machine — skipping the driver"
|
||||
else
|
||||
apt_install ubuntu-drivers-common
|
||||
if [[ $(installed_driver) != *-open ]]; then
|
||||
ubuntu-drivers devices 2>/dev/null | grep -E 'model|driver' || true
|
||||
# Picks Ubuntu's recommended branch plus its prebuilt, signed kernel modules (no DKMS).
|
||||
sudo ubuntu-drivers install
|
||||
fi
|
||||
driver=$(installed_driver)
|
||||
[[ $driver == nvidia-driver-*-open ]] \
|
||||
|| die "got '${driver:-no driver}', but the 5090 needs an -open driver — check 'ubuntu-drivers devices'"
|
||||
branch=${driver#nvidia-driver-}; branch=${branch%-open}
|
||||
apt_install "libnvidia-gl-$branch:i386" # 32-bit GL/Vulkan for Steam and Proton
|
||||
echo "using $driver"
|
||||
fi
|
||||
driver=$(installed_driver)
|
||||
[[ $driver == nvidia-driver-*-open ]] \
|
||||
|| die "got '${driver:-no driver}', but the 5090 needs an -open driver — check 'ubuntu-drivers devices'"
|
||||
branch=${driver#nvidia-driver-}; branch=${branch%-open}
|
||||
apt_install "libnvidia-gl-$branch:i386" # 32-bit GL/Vulkan for Steam and Proton
|
||||
echo "using $driver"
|
||||
|
||||
# ---------------------------------------------------------------------------------------
|
||||
step "Docker, GPU containers, Claude's Cowork VM"
|
||||
sudo usermod -aG docker "$USER" # docker without sudo (after reboot)
|
||||
getent group kvm >/dev/null && sudo usermod -aG kvm "$USER" # Cowork needs /dev/kvm + vhost-vsock
|
||||
sudo usermod -aG docker "$ME" # docker without sudo (after reboot)
|
||||
getent group kvm >/dev/null && sudo usermod -aG kvm "$ME" # Cowork needs /dev/kvm + vhost-vsock
|
||||
echo vhost_vsock | sudo tee /etc/modules-load.d/vhost_vsock.conf >/dev/null
|
||||
if ! grep -q nvidia /etc/docker/daemon.json 2>/dev/null; then
|
||||
sudo nvidia-ctk runtime configure --runtime=docker # enables `docker run --gpus all`
|
||||
@@ -150,11 +168,18 @@ sudo flatpak install -y --noninteractive --system flathub "${apps[@]}"
|
||||
# Firefox's read-only peek at landingPage, as set by hand on Bazzite
|
||||
flatpak override --user org.mozilla.firefox --filesystem="$HOME/Documents/git/landingPage:ro"
|
||||
|
||||
# Firefox/Thunderbird come from Flathub instead, so restoring ~/.var/app brings the old
|
||||
# profiles back untouched. Drop Ubuntu's snaps and the debs that pull them back in.
|
||||
# Firefox/Thunderbird come from Flathub instead, so copying ~/.var/app over brings the old
|
||||
# profiles with them. Drop Ubuntu's snaps and the debs that pull them back in.
|
||||
# On a first boot snapd may still be seeding, and a remove during that fails — wait it out,
|
||||
# and treat a failure here as a warning rather than losing the rest of the run.
|
||||
sudo snap wait system seed.loaded 2>/dev/null || true
|
||||
for s in firefox thunderbird; do
|
||||
if snap list "$s" >/dev/null 2>&1; then sudo snap remove --purge "$s"; fi
|
||||
if dpkg -s "$s" >/dev/null 2>&1; then sudo apt-get remove -y "$s"; fi
|
||||
if snap list "$s" >/dev/null 2>&1; then
|
||||
sudo snap remove --purge "$s" || warn "couldn't remove the $s snap — remove it by hand later"
|
||||
fi
|
||||
if dpkg -s "$s" >/dev/null 2>&1; then
|
||||
sudo apt-get "${APT_OPTS[@]}" remove -y "$s" || warn "couldn't remove the $s deb"
|
||||
fi
|
||||
done
|
||||
xdg-settings set default-web-browser org.mozilla.firefox.desktop 2>/dev/null || true
|
||||
|
||||
@@ -228,7 +253,7 @@ if ! grep -q "$DATA_UUID" /etc/fstab; then
|
||||
fi
|
||||
sudo blkid -U "$DATA_UUID" >/dev/null || warn "Data drive ($DATA_UUID) not found — fstab entry is nofail, so boot is fine"
|
||||
|
||||
if [[ ! -f $MARVIN_CREDS ]]; then
|
||||
if [[ ! -f $MARVIN_CREDS && -z $UNATTENDED ]]; then
|
||||
echo "server-marvin SMB share — press Enter to skip mounting it."
|
||||
read -rp " username: " smb_user
|
||||
if [[ -n $smb_user ]]; then
|
||||
@@ -252,7 +277,13 @@ step "Small carry-overs from Bazzite"
|
||||
echo 'options bluetooth disable_ertm=1' | sudo tee /etc/modprobe.d/bluetooth-xbox.conf >/dev/null
|
||||
|
||||
step "Done"
|
||||
cat <<'EOF'
|
||||
if [[ -n $UNATTENDED ]]; then
|
||||
cat <<'EOF'
|
||||
Log out and back in for the docker and kvm groups.
|
||||
Then sign in to your apps, and add /mnt/data/SteamLibrary in Steam > Settings > Storage.
|
||||
EOF
|
||||
else
|
||||
cat <<'EOF'
|
||||
Reboot now — the NVIDIA driver and your docker/kvm groups only take effect after that.
|
||||
|
||||
Then, once:
|
||||
@@ -262,3 +293,4 @@ Then, once:
|
||||
|
||||
Then sign in to things, and add /mnt/data/SteamLibrary in Steam > Settings > Storage.
|
||||
EOF
|
||||
fi
|
||||
|
||||
Reference in New Issue
Block a user