#!/bin/sh
cat << 'EOF'
  rawnix.org Installation Guide - https://rawnix.org/handbook

  Network:
    Ethernet starts automatically.
    WiFi: wpa_passphrase "SSID" "pass" > /tmp/wpa.conf
          wpa_supplicant -B -i wlan0 -c /tmp/wpa.conf && dhcpcd wlan0

  Partition:
    fdisk /dev/sdX          1: EFI System, 1G     rest: as you like
    mkfs.fat -F32 /dev/sdX1

  --- Unencrypted -------------------------------------------------
    mkfs.ext4 /dev/sdX2
    mount /dev/sdX2 /mnt

  --- Encrypted ---------------------------------------------------
    genluks formats, opens, mkfs's and mounts every volume in one go,
    then gives each non-root volume a keyfile on the encrypted root.
    One passphrase at boot: the initramfs unlocks root, and stage 1
    opens the rest from the keyfiles.

    genluks /mnt /dev/sdX2:/
    genluks /mnt /dev/sdX2:/ /dev/sdX3:/var /dev/sdX6:/home /dev/sdX8:swap
    genluks /mnt /dev/sdX2:/ /dev/sdX9:/data2:plain,xfs

    <target>  a path, or the bare word "swap" (not a mountpoint)
    <opts>    comma-separated: plain (no encryption), and/or
              ext4 | xfs | btrfs (default ext4)

  ESP (both cases):
    mkdir -p /mnt/boot/efi && mount /dev/sdX1 /mnt/boot/efi

  Install:
    setup-filesystem /mnt
    setup-boot /mnt                     (writes the kernel cmdline)

    install --target /mnt base          (libs + core + opt + devel + kernel)
    install --target /mnt core          (libs + core + opt, no kernel)
    install --target /mnt core kernel   (the above + prebuilt kernel)

    The kernel goes last on purpose: installing it runs depmod and then
    limine-sync, which writes limine.conf on the ESP from what is in
    /boot.  Nothing else installs a bootloader.

  fstab + chroot:
    genfstab /mnt > /mnt/etc/fstab && enter-chroot /mnt

  Inside chroot:
    passwd root
    echo myhostname > /etc/hostname
    ln -sf /usr/share/zoneinfo/Region/City /etc/localtime
    ports -u                            (before any other pkg command:
                                         pkg seeds its dependency db on
                                         first use and needs the tree)

  Before rebooting:
    cat /boot/efi/limine.conf           (should list the kernel, with
                                         cryptroot= if you encrypted)
    ls /boot/efi                        (vmlinuz-*, tinyrd.img, EFI/)
    cat /etc/crypttab                   (if you have extra volumes)
  
  Verify EFI loader
    efibootmgr or mount -t efivarfs efivarfs /sys/firmware/efi/efivars
    efibootmgr
    efibootmgr -c -d /dev/sda -p 1 -L "rawnix" -l '\EFI\BOOT\BOOTX64.EFI'
    efibootmgr -v

  Adding an encrypted volume to a running system:
    cryptsetup luksFormat --type luks2 /dev/sdXn
    cryptsetup open /dev/sdXn cdata && mkfs.ext4 /dev/mapper/cdata
    mount /dev/mapper/cdata /data
    genluks /                           (adds a keyfile and a crypttab
                                         entry; safe to re-run)
    genfstab / > /etc/fstab.new         (then merge what you want)
EOF