28. 自动化部署与镜像管理

tee /var/www/html/ks.cfg << 'EOF'
# ============================================================
# Kickstart 配置 - RHEL 9 企业基线无人值守安装
# 部署目标: linuxdc | IP: 192.168.1.100
# ============================================================

# 安装源（使用 Red Hat CDN，需有效订阅；或替换为本地 ISO 地址）
url --url="https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os"

# 区域与键盘
lang en_US.UTF-8
keyboard us
timezone Asia/Shanghai --utc

# 账户配置
# 生产环境：root 账户锁定，仅通过 ops 用户搭配 sudo 操作
rootpw --lock
# 用户密码使用 python3 -c "import crypt; print(crypt.crypt('密码','$6$salt'))" 生成哈希
user --name=ops --groups=wheel \
     --password='$6$rounds=4096$salt$hashedpassword'

# 网络配置（根据实际环境修改 IP 参数）
network --bootproto=static \
        --ip=192.168.1.100 \
        --netmask=255.255.255.0 \
        --gateway=192.168.1.1 \
        --nameserver=8.8.8.8 \
        --hostname=linuxdc \
        --activate

# 磁盘分区（企业级 GPT 分区方案）
zerombr
clearpart --all --initlabel --disklabel=gpt
part /boot/efi  --fstype=efi   --size=512
part /boot      --fstype=xfs   --size=1024
part swap       --fstype=swap  --size=4096
part /          --fstype=xfs   --size=20480 --grow

# 引导加载程序
bootloader --location=mbr

# 软件包选择
%packages
@^minimal-environment
@core
chrony
openssh-server
vim-enhanced
bash-completion
net-tools
bind-utils
policycoreutils-python-utils
%end

# 安装前脚本（运行在 RAM disk 环境中）
%pre
echo "Kickstart 开始: $(date)" > /tmp/ks-install.log
%end

# 安装后脚本（运行在已安装的系统 chroot 中）
%post
set -euo pipefail

# SSH 安全配置：修改端口并禁止 root 直接登录
sed -i 's/^#Port 22/Port 2222/'           /etc/ssh/sshd_config
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config

# SELinux 放行自定义 SSH 端口
semanage port -a -t ssh_port_t -p tcp 2222

# 防火墙：放行 2222，移除默认 22
firewall-cmd --permanent --add-port=2222/tcp
firewall-cmd --permanent --remove-service=ssh

# 时间同步
systemctl enable --now chronyd

echo "安装完成: $(date)" >> /tmp/ks-install.log
%end
EOF

# 修复 SELinux 上下文，确保 Apache 可读取
restorecon -v /var/www/html/ks.cfg

# 验证 Kickstart 文件可通过 HTTP 访问
curl -s http://192.168.1.100/ks.cfg | head -5

dnf install -y pykickstart
ksvalidator /var/www/html/ks.cfg
echo "语法检查退出码: $?"

# 安装所需服务组件
dnf install -y tftp-server dhcp-server syslinux syslinux-tftpboot

# 从 RHEL ISO 提取内核和 initrd（PXE 引导所需）
mkdir -p /var/lib/tftpboot/pxelinux.cfg
mkdir -p /var/lib/tftpboot/images/rhel9

mount -o loop,ro /root/rhel-9.x-x86_64-dvd.iso /mnt/rhel-iso
cp /mnt/rhel-iso/isolinux/vmlinuz    /var/lib/tftpboot/images/rhel9/
cp /mnt/rhel-iso/isolinux/initrd.img /var/lib/tftpboot/images/rhel9/
cp /usr/share/syslinux/pxelinux.0    /var/lib/tftpboot/
cp /usr/share/syslinux/ldlinux.c32   /var/lib/tftpboot/
umount /mnt/rhel-iso

tee /var/lib/tftpboot/pxelinux.cfg/default << 'EOF'
DEFAULT rhel9-auto
PROMPT 0
TIMEOUT 100

LABEL rhel9-auto
    MENU LABEL Auto Install RHEL 9 (Kickstart)
    KERNEL images/rhel9/vmlinuz
    APPEND initrd=images/rhel9/initrd.img \
           inst.repo=http://192.168.1.100 \
           inst.ks=http://192.168.1.100/ks.cfg \
           console=ttyS0,115200n8 quiet

LABEL rhel9-manual
    MENU LABEL Manual Install RHEL 9
    KERNEL images/rhel9/vmlinuz
    APPEND initrd=images/rhel9/initrd.img \
           inst.repo=http://192.168.1.100
EOF

tee /etc/dhcp/dhcpd.conf << 'EOF'
subnet 192.168.1.0 netmask 255.255.255.0 {
    range 192.168.1.150 192.168.1.200;
    option routers          192.168.1.1;
    option domain-name-servers 8.8.8.8;
    # PXE 引导参数
    filename    "pxelinux.0";
    next-server 192.168.1.100;
}
EOF

systemctl enable --now tftp.socket dhcpd
firewall-cmd --permanent --add-service=dhcp
firewall-cmd --permanent --add-service=tftp
firewall-cmd --reload

dnf install -y osbuild-composer composer-cli cockpit-composer

systemctl enable --now osbuild-composer.socket
systemctl enable --now cockpit.socket

# 将 ops 用户加入 weldr 组（无需 root 即可使用 composer-cli）
usermod -aG weldr ops
# 需重新登录使组权限生效

# 验证服务状态
composer-cli status show

tee ~/custom-rhel9.toml << 'EOF'
name        = "linuxdc-base"
description = "linuxdc 企业基线镜像 - 含安全加固与运维工具"
version     = "1.0.0"

[[packages]]
name    = "vim-enhanced"
version = "*"

[[packages]]
name    = "bash-completion"
version = "*"

[[packages]]
name    = "chrony"
version = "*"

[[packages]]
name    = "openssh-server"
version = "*"

[[packages]]
name    = "podman"
version = "*"

[[packages]]
name    = "ansible-core"
version = "*"

# 预置运维账户
[[customizations.user]]
name     = "ops"
groups   = ["wheel"]
key      = "ssh-ed25519 AAAA... ops@linuxdc"

# 默认启用 / 禁用的服务
[customizations.services]
enabled  = ["sshd", "chronyd", "firewalld"]
disabled = ["telnet"]

# 防火墙预置规则
[customizations.firewall]
ports = ["2222:tcp"]
EOF

# 推送 Blueprint 到 Image Builder
composer-cli blueprints push ~/custom-rhel9.toml

# 验证 Blueprint 已成功注册
composer-cli blueprints list
composer-cli blueprints show linuxdc-base

# 查看支持的输出格式
composer-cli compose types

# 启动构建（ISO 格式，适合物理机和 VMware 部署）
composer-cli compose start linuxdc-base iso

# 监控构建状态（WAITING → RUNNING → FINISHED）
watch -n 30 composer-cli compose status

# 构建完成后下载镜像（替换实际 UUID）
BUILD_UUID=$(composer-cli compose status | grep FINISHED | awk '{print $1}' | head -1)
composer-cli compose image "${BUILD_UUID}"

# 将镜像移至 Web 目录供网络分发
mv "${BUILD_UUID}-disk.iso" /var/www/html/linuxdc-base.iso
restorecon -v /var/www/html/linuxdc-base.iso

# 验证可通过 HTTP 访问（返回 200 即正常）
curl -I http://192.168.1.100/linuxdc-base.iso

# 更新 Blueprint 版本号后重新推送
sed -i 's/version = "1.0.0"/version = "1.1.0"/' ~/custom-rhel9.toml
composer-cli blueprints push ~/custom-rhel9.toml

# 查看 Blueprint 变更历史
composer-cli blueprints changes linuxdc-base

# 删除旧构建结果（释放磁盘空间）
composer-cli compose list
composer-cli compose delete <UUID>

# Image Builder 综合诊断
journalctl -u osbuild-composer -f
composer-cli compose info <UUID>