# 0_debootstrap.sh
rm -rf rootfs
arch="amd64"
hostname="custom"
mirror="http://ru.archive.ubuntu.com/ubuntu/"
suite="bionic"
variant="minbase"
components="main,universe,restricted,multiverse"
include="linux-image-4.15.0-20-generic, live-boot, dropbear, cryptsetup, systemd-sysv"
debootstrap  --merged-usr --cache-dir=`(pwd)`/cache --arch="$arch" --include="$include" --components="$components" --variant="$variant" "$suite"  rootfs "$mirror"
echo "$hostname" > rootfs/etc/hostname
echo "Setting root passwd"

echo "CRYPTSETUP=y" > rootfs/etc/cryptsetup-initramfs/conf-hook
chroot rootfs /bin/bash -c "echo -e 'zaq1xsw2\nzaq1xsw2\n' | passwd root"
#разрешить ssh в initrd по паролю
sed -i 's/local flags=\"Fs\"/local flags=\"F\"/' rootfs/usr/share/initramfs-tools/scripts/init-premount/dropbear
#скопировать рутовый пароль в initramfs
cp passwd_hook.sh rootfs/etc/initramfs-tools/hooks/

chroot rootfs /bin/bash -c "update-initramfs -u"
rm -rf image
mkdir -p image/{live,isolinux}
mksquashfs rootfs image/live/filesystem.squashfs  -e boot

#password_hook.sh  chmod +x password_hook.sh
#!/bin/sh

PREREQ=""
prereqs()
{
echo "$PREREQ"
}
case $1 in
	prereqs)
		prereqs
		exit 0
	;;
esac

grep -e root /etc/shadow > ${DESTDIR}/etc/shadow

#создание криптоконтейнера
rm crypt.img
size=`du  --block-size=512 image/live/filesystem.squashfs |  awk '{print $1}'`
dd if=/dev/zero of=crypt.img bs=512 count=1 seek=$(($size+10320))
loopdev=`losetup -f`
losetup $loopdev crypt.img
echo -n "mypass" |  cryptsetup -q luksFormat $loopdev -
echo -n "mypass" |  cryptsetup -q luksOpen $loopdev crypt
dd if=image/live/filesystem.squashfs of=/dev/mapper/crypt bs=512
# mkdir /mnt/crypt
# mount /dev/mapper/crypt /mnt/crypt
# umount /mnt/crypt
# rmdir /mnt/crypt
cryptsetup luksClose crypt
losetup -d $loopdev
mv crypt.img image/live/filesystem.squashfs

#Генерация загрузочного образа
mkdir -p image/live image/isolinux
rm live.iso
echo "prompt 0
DEFAULT Custom
menu title Boot Menu
timeout 300

label Custom
menu label ^Custom
menu default
kernel /live/vmlinuz
append initrd=/live/initrd ipv6.disable=1 net.ifnames=0 biosdevname=0 ip=192.168.0.192::192.168.0.1:255.255.255.0::eth0:none boot=live" > image/isolinux/isolinux.cfg
cp rootfs/boot/vmlinuz* image/live/vmlinuz
cp rootfs/boot/initrd* image/live/initrd
cp /usr/lib/ISOLINUX/isolinux.bin image/isolinux/
cp /usr/lib/syslinux/modules/bios/ldlinux.c32  image/isolinux/

xorriso -as mkisofs -r -J -joliet-long -l -cache-inodes \
-isohybrid-mbr /usr/lib/ISOLINUX/isohdpfx.bin -partition_offset 16 \
-A "ISO"  \
-b isolinux/isolinux.bin -c isolinux/boot.cat -no-emul-boot -boot-load-size 4 -boot-info-table \
-o live.iso image

loopdev=`losetup -f`
losetup $loopdev /live/medium/live/filesystem.squashfs
cryptsetup luksOpen $loopdev crypt
# тут вводим пароль
mkdir /newroot
mount /dev/mapper/crypt /newroot
mount --move /sys /newroot/sys
mount --move /proc/newroot/proc
mount --move /dev/newroot/dev
exec switch_root /newroot /sbin/init