Rocky Linux 9 Kickstart

[OhMyMndy]

# see https://access.redhat.com/solutions/5509
# see https://www.golinuxhub.com/2018/05/sample-kickstart-partition-example-raid/
# see https://access.redhat.com/labs/kickstartconfig/
# see https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/installation_guide/sect-kickstart-howto#sect-kickstart-installation-starting-automatic

lang en_US
keyboard --xlayouts='us'
timezone Europe/Amsterdam --utc
rootpw $2b$10$OZTWYTc5xlmwIc0Lrp/x3u3xFgAEBMy5J4Xa9YMmprCbshtoKShw. --iscrypted

user --name=mandy --groups=wheel --iscrypted --password=$2b$10$OZTWYTc5xlmwIc0Lrp/x3u3xFgAEBMy5J4Xa9YMmprCbshtoKShw.

reboot --eject
cdrom
bootloader --append="rhgb quiet crashkernel=1G-4G:192M,4G-64G:256M,64G-:512M"
zerombr

clearpart --all --initlabel



part /boot --size 1024 --asprimary --fstype=ext4 --ondrive=sda
part swap --ondisk=sda --size=2048

part pv.01 --size=1 --grow --fstype=lmpv --ondrive=sda

volgroup vg_root pv.01



logvol  /tmp  --vgname=vg_root  --size=2048  --name=lv_tmp
logvol  /var  --vgname=vg_root  --size=8192  --name=lv_var
logvol  /var/log  --vgname=vg_root  --size=4096  --name=lv_var_log
logvol  /var/log/audit  --vgname=vg_root  --size=4096  --name=lv_var_log_audit
logvol  /var/tmp  --vgname=vg_root  --size=4096  --name=lv_var_tmp

# Set to a certain size so the Post step can install stuff, before the grow step ran on the first boot
logvol / --vgname=vg_root --name=root --fstype=xfs --size=8192 --grow


network --bootproto=dhcp
firstboot --disable
selinux --enforcing
firewall --enabled --ssh

%addon com_redhat_oscap
content-type = scap-security-guide
profile = xccdf_org.ssgproject.content_profile_ospp
%end

%post --interpreter=/bin/bash --log=/var/log/ks-post.log
set -x

df -h

dnf install update -y --refresh
dnf install epel-release -y

dnf install -y tig htop
dnf install -y kernel-devel kernel-debug-devel dkms

dnf install -y https://download.falco.org/packages/rpm/falco-0.0.0-x86_64.rpm

systemctl enable falco-modern-bpf

sed -i '/^user.max_user_namespaces/d' /etc/sysctl.conf

cat <<EOL | tee /etc/sysctl.d/99-z-podman.conf
net.ipv4.ip_unprivileged_port_start = 80
user.max_user_namespaces = 31477
EOL

# see https://access.redhat.com/solutions/5488251
# /usr/bin/eject -i 0
# /usr/bin/eject -r
%end

%packages
@^graphical-server-environment
@hardware-monitoring
@network-tools
curl
vim
tmux
git
%end