setup-zfsbootmenu.yml

- hosts: localhost
  become: true
  become_method: sudo
  gather_facts: false
  vars_prompt:
    - name: "ansible_become_password"
      prompt: "Enter sudo password for chroot tasks"
      private: yes
    - name: "username"
      prompt: "Enter the username for the new user"
      private: no  # Set to `yes` to hide input

    - name: "user_password"
      prompt: "Enter the password for the new user"
      private: yes

    - name: "root_password"
      prompt: "Enter the root password"
      private: yes

    - name: "hostname"
      prompt: "Enter the hostname for this system"
      private: no
  vars:
    # ID: "{{ lookup('ini', 'ID section=None file=/etc/os-release') }}"
    ID: "debian"
    BOOT_DISK: '/dev/nvme0n1'  # Adjust as needed
    BOOT_PART: '1'
    BOOT_DEVICE: "{{ BOOT_DISK }}p{{ BOOT_PART }}"
    POOL_DISK: '/dev/nvme0n1'  # Adjust as needed
    POOL_PART: '2'
    POOL_DEVICE: "{{ POOL_DISK }}p{{ POOL_PART }}"
    KERNEL_VERSION: '6.1.0-25-amd64'
  tasks:
    - name: Configure apt sources
      copy:
        dest: /etc/apt/sources.list
        content: |
          deb http://deb.debian.org/debian bookworm main contrib non-free-firmware
          deb-src http://deb.debian.org/debian bookworm main contrib non-free-firmware

          deb http://deb.debian.org/debian-security bookworm-security main contrib non-free-firmware
          deb-src http://deb.debian.org/debian-security/ bookworm-security main contrib non-free-firmware

          deb http://deb.debian.org/debian bookworm-updates main contrib non-free-firmware
          deb-src http://deb.debian.org/debian bookworm-updates main contrib non-free-firmware

          deb http://deb.debian.org/debian bookworm-backports main contrib non-free-firmware
          deb-src http://deb.debian.org/debian bookworm-backports main contrib non-free-firmware

    - name: Update apt cache
      apt:
        update_cache: yes

    # - name: Get kernel version
    #   command: uname -r
    #   register: kernel_version
    #
    # - name: Debug kernel version
    #   debug:
    #     var: kernel_version

    - name: Install necessary packages
      apt:
        name:
          - debootstrap
          - gdisk
          - dkms
          - "linux-headers-{{ KERNEL_VERSION }}"
          - zfsutils-linux
        state: present

    - name: Generate hostid
      command: zgenhostid -f 0x00bab10c

    - name: Wipe zpool labels from POOL_DISK
      command: zpool labelclear -f "{{ POOL_DISK }}"
      ignore_errors: yes

    - name: Wipe filesystem signatures from disks
      command: wipefs -a "{{ item }}"
      loop:
        - "{{ POOL_DISK }}"
        - "{{ BOOT_DISK }}"

    - name: Zap all partitions on disks
      command: sgdisk --zap-all "{{ item }}"
      loop:
        - "{{ POOL_DISK }}"
        - "{{ BOOT_DISK }}"

    - name: Create EFI boot partition
      command: sgdisk -n "{{ BOOT_PART }}:1M:+512M" -t "{{ BOOT_PART }}:ef00" "{{ BOOT_DISK }}"

    - name: Create zpool partition
      command: sgdisk -n "{{ POOL_PART }}:0:-10M" -t "{{ POOL_PART }}:bf00" "{{ POOL_DISK }}"

    - name: Create zpool
      command: >
        zpool create -f -o ashift=12
        -O compression=lz4
        -O acltype=posixacl
        -O xattr=sa
        -O relatime=on
        -o autotrim=on
        -o compatibility=openzfs-2.1-linux
        -m none zroot "{{ POOL_DEVICE }}"

    - name: Create ZFS datasets
      command: zfs create -o mountpoint=none zroot/ROOT

    - name: Create root dataset
      command: zfs create -o mountpoint=/ -o canmount=noauto zroot/ROOT/{{ ID }}

    - name: Create home dataset
      command: zfs create -o mountpoint=/home zroot/home

    - name: Set bootfs property
      command: zpool set bootfs=zroot/ROOT/{{ ID }} zroot

    - name: Export zpool
      command: zpool export zroot

    - name: Import zpool
      command: zpool import -N -R /mnt zroot

    - name: Mount root dataset
      command: zfs mount zroot/ROOT/{{ ID }}

    - name: Mount home dataset
      command: zfs mount zroot/home

    - name: Trigger udevadm
      command: udevadm trigger

    - name: Install minimal Debian system
      command: debootstrap bookworm /mnt

    - name: Copy /etc/hostid
      copy:
        src: /etc/hostid
        dest: /mnt/etc/hostid
        owner: root
        group: root
        mode: '0644'

    - name: Copy /etc/resolv.conf
      copy:
        src: /etc/resolv.conf
        dest: /mnt/etc/resolv.conf
        owner: root
        group: root
        mode: '0644'

    - name: Mount /proc
      mount:
        path: /mnt/proc
        src: proc
        fstype: proc
        state: mounted

    - name: Mount /sys
      mount:
        path: /mnt/sys
        src: sys
        fstype: sysfs
        state: mounted

    - name: Mount /dev
      mount:
        path: /mnt/dev
        src: /dev
        fstype: bind
        opts: bind
        state: mounted

    - name: Mount /dev/pts
      mount:
        path: /mnt/dev/pts
        src: /dev/pts
        fstype: bind
        opts: bind
        state: mounted

    - name: Ensure /mnt directory exists
      file:
        path: /mnt
        state: directory
        mode: '0755'

- hosts: chroot
  become: true
  become_method: sudo
  gather_facts: false
  tasks:
    - name: Set hostname
      hostname:
        name: "{{ hostname }}"

    - name: Set /etc/hosts entry
      lineinfile:
        path: /etc/hosts
        line: '127.0.1.1\t{{ hostname }}'
        create: yes

    - name: Set root password
      user:
        name: root
        password: "{{ root_password | password_hash('sha512') }}"

    - name: Configure apt sources
      copy:
        dest: /etc/apt/sources.list
        content: |
          deb http://deb.debian.org/debian bookworm main contrib non-free-firmware
          deb-src http://deb.debian.org/debian bookworm main contrib non-free-firmware

          deb http://deb.debian.org/debian-security bookworm-security main contrib non-free-firmware
          deb-src http://deb.debian.org/debian-security/ bookworm-security main contrib non-free-firmware

          deb http://deb.debian.org/debian bookworm-updates main contrib non-free-firmware
          deb-src http://deb.debian.org/debian bookworm-updates main contrib non-free-firmware

          deb http://deb.debian.org/debian bookworm-backports main contrib non-free-firmware
          deb-src http://deb.debian.org/debian bookworm-backports main contrib non-free-firmware

    - name: Update apt cache
      apt:
        update_cache: yes

    - name: Install base packages
      apt:
        name:
          - locales
          - keyboard-configuration
          - console-setup
        state: present

    - name: Reconfigure locales
      command: dpkg-reconfigure locales
      args:
        stdin: 'en_US.UTF-8 UTF-8'

    - name: Reconfigure tzdata
      command: dpkg-reconfigure tzdata

    - name: Reconfigure keyboard-configuration
      command: dpkg-reconfigure keyboard-configuration

    - name: Reconfigure console-setup
      command: dpkg-reconfigure console-setup

    - name: Install ZFS packages
      apt:
        name:
          - linux-headers-amd64
          - linux-image-amd64
          - zfs-initramfs
          - dosfstools
        state: present

    - name: Set DKMS config
      lineinfile:
        path: /etc/dkms/zfs.conf
        line: 'REMAKE_INITRD=yes'
        create: yes

    - name: Enable ZFS services
      systemd:
        name: "{{ item }}"
        enabled: yes
      loop:
        - zfs.target
        - zfs-import-cache
        - zfs-mount
        - zfs-import.target

    - name: Update initramfs
      command: update-initramfs -c -k all

    - name: Set ZFSBootMenu commandline
      command: zfs set org.zfsbootmenu:commandline="quiet" zroot/ROOT

    - name: Create EFI filesystem
      filesystem:
        fstype: vfat
        dev: "{{ BOOT_DEVICE }}"
        force: yes

    - name: Ensure /boot/efi in fstab
      blockinfile:
        path: /etc/fstab
        block: |
          UUID={{ lookup('pipe', "blkid -s UUID -o value {{ BOOT_DEVICE }}") }} /boot/efi vfat defaults 0 0

    - name: Create /boot/efi directory
      file:
        path: /boot/efi
        state: directory

    - name: Mount /boot/efi
      mount:
        path: /boot/efi
        src: "{{ BOOT_DEVICE }}"
        fstype: vfat
        state: mounted

    - name: Install curl
      apt:
        name: curl
        state: present

    - name: Install ZFSBootMenu
      get_url:
        url: https://get.zfsbootmenu.org/efi
        dest: /boot/efi/EFI/ZBM/VMLINUZ.EFI
        mode: '0755'

    - name: Copy VMLINUZ.EFI to backup
      copy:
        src: /boot/efi/EFI/ZBM/VMLINUZ.EFI
        dest: /boot/efi/EFI/ZBM/VMLINUZ-BACKUP.EFI
        mode: '0755'

    - name: Copy VMLINUZ.EFI to default boot path
      copy:
        src: /boot/efi/EFI/ZBM/VMLINUZ.EFI
        dest: /boot/efi/EFI/BOOT/bootx64.efi
        mode: '0755'

    - name: Mount efivarfs
      mount:
        path: /sys/firmware/efi/efivars
        src: efivarfs
        fstype: efivarfs
        state: mounted

    - name: Install efibootmgr
      apt:
        name: efibootmgr
        state: present

    - name: Add EFI boot entry for ZFSBootMenu (Backup)
      command: efibootmgr -c -d "{{ BOOT_DISK }}" -p "{{ BOOT_PART }}" -L "ZFSBootMenu (Backup)" -l '\\EFI\\ZBM\\VMLINUZ-BACKUP.EFI'

    - name: Add EFI boot entry for ZFSBootMenu
      command: efibootmgr -c -d "{{ BOOT_DISK }}" -p "{{ BOOT_PART }}" -L "ZFSBootMenu" -l '\\EFI\\ZBM\\VMLINUZ.EFI'

    - name: Add EFI boot entry for default path
      command: efibootmgr -c -d "{{ BOOT_DISK }}" -p "{{ BOOT_PART }}" -L "ZFSBootMenu" -l '\\EFI\\BOOT\\bootx64.efi'

    - name: Install system utilities
      apt:
        name:
          - systemd-timesyncd
          - net-tools
          - iproute2
          - isc-dhcp-client
          - iputils-ping
          - traceroute
          - curl
          - wget
          - dnsutils
          - ethtool
          - ifupdown
          - tcpdump
          - nmap
          - nano
          - vim
          - htop
          - openssh-server
          - git
          - tmux
        state: present

    - name: Run dist-upgrade
      apt:
        upgrade: dist
        update_cache: yes

    - name: Create user
      user:
        name: "{{ username }}"
        groups: "audio,cdrom,dip,floppy,netdev,plugdev,sudo,video"
        shell: /bin/bash
        create_home: yes
        password: "{{ user_password | password_hash('sha512') }}"

- hosts: localhost
  become: true
  gather_facts: false
  tasks:
    - name: Unmount filesystems
      command: umount -lf {{ item }}
      loop:
        - /mnt/dev/pts
        - /mnt/dev
        - /mnt/sys
        - /mnt/proc

    - name: Export zpool
      command: zpool export -a