Review draft post on OpenBSD on QEMU

2 files changed, 46 insertions, 35 deletions

diff --git a/_drafts/autoinstall-openbsd-on-qemu.md b/_drafts/autoinstall-openbsd-on-qemu.md
index b99f4be..4550fcc 100644
--- a/_drafts/autoinstall-openbsd-on-qemu.md
+++ b/_drafts/autoinstall-openbsd-on-qemu.md
@@ -1,13 +1,10 @@
 ---
 title: Auto-install OpenBSD on QEMU
 description: How to perform an unattended installation of OpenBSD on the QEMU virtual machine monitor.
-published: 2020-07-15
+published: 2020-07-21
 ---
 
 <!-- TODO: Update published date in post and script. -->
-<!-- TODO: Configure shell script mime type. -->
-<!-- TODO: https://www.tumfatig.net/20190625/automated-openbsd-deployment-on-vmd8/ -->
-<!-- TODO: https://www.tumfatig.net/20190426/openbsd-automatic-upgrade/ -->
 
 I happen to develop a pet project of mine on a Linux desktop, while actually targeting an [OpenBSD](https://www.openbsd.org/) server.
 Thus I searched for a scriptable way to install OpenBSD on the [QEMU](https://www.qemu.org/) virtual machine manager, such that I could automate a local integration test against OpenBSD running on Linux.
@@ -22,17 +19,16 @@ In the end, I will present a simple yet [complete POSIX shell script](/files/aut
 The script is intended to run on Linux, though.
 If you already have a running OpenBSD installation, you should consider to use OpenBSD's own hypervisor [vmm(4)](https://man.openbsd.org/OpenBSD-6.7/vmm) instead of QEMU as described in the [OpenBSD FAQ](https://www.openbsd.org/faq/faq16.html) and in this [blog post](https://eradman.com/posts/autoinstall-openbsd.html) by Eric Radman.
 
-## Outline
-
 We will perform the following steps:
 
-1. Create a local OpenBSD mirror.
-1. Configure the unattended installation.
-1. Create a network boot environment.
-1. Create a virtual machine.
-1. Log in to the virtual machine.
+1. Install prerequisites
+1. Setup a local OpenBSD mirror
+1. Configure the installation
+1. Setup a network boot environment
+1. Install the virtual machine
+1. Log in to the virtual machine
 
-## Prerequisites
+## Install prerequisites
 
 We will use the following tools:
 
@@ -41,15 +37,14 @@ We will use the following tools:
 * [QEMU](https://www.qemu.org/), a virtual machine monitor
 * [rsync](https://rsync.samba.org/), an incremental file transfer tool
 * [signify](https://github.com/aperezdc/signify), a cryptographic signature tool
-* [socat](http://www.dest-unreach.org/socat/), a successor of the infamous 
-TCP/IP swiss army knife, [netcat](https://nc110.sourceforge.io/)
+* [socat](http://www.dest-unreach.org/socat/), a successor of the infamous TCP/IP Swiss Army knife, [netcat](https://nc110.sourceforge.io/)
 
 Chances are that your Linux distribution of choice packages these tools.
 For example, the following command installs them on Arch Linux:
 
     $ sudo pacman -S curl openssh qemu rsync signify socat
 
-## Create a local OpenBSD mirror
+## Setup a local OpenBSD mirror
 
 To begin with, we setup a partial, local [OpenBSD mirror](https://www.openbsd.org/ftp.html).
 
@@ -63,7 +58,7 @@ Second, we fetch the base public key from the official HTTPS mirror using [curl(
         --output mirror/pub/OpenBSD/6.7/openbsd-67-base.pub \
         https://ftp.openbsd.org/pub/OpenBSD/6.7/openbsd-67-base.pub
 
-Third, we fetch the kernel, [PXE](https://en.wikipedia.org/w/index.php?title=Preboot_Execution_Environment&oldid=955913424) bootstrap program, and file sets from an untrusted [rsync mirror](https://www.openbsd.org/ftp.html#rsync) using [rsync(1)](https://download.samba.org/pub/rsync/rsync.1):
+Third, we fetch the kernel, the [PXE](https://en.wikipedia.org/w/index.php?title=Preboot_Execution_Environment&oldid=955913424) bootstrap program, and the file sets from an untrusted [rsync mirror](https://www.openbsd.org/ftp.html#rsync) using [rsync(1)](https://download.samba.org/pub/rsync/rsync.1):
 
     $ rsync --archive --files-from=- --verbose \
         rsync://ftp.halifax.rwth-aachen.de/openbsd/6.7/amd64/ \
@@ -84,7 +79,7 @@ Third, we fetch the kernel, [PXE](https://en.wikipedia.org/w/index.php?title=Pre
     xshare67.tgz
     EOF
 
-Fourth, we verify the fetched files using [signify(1)](https://man.openbsd.org/OpenBSD-6.7/signify) and the previously fetched base public key:
+Fourth, we verify the fetched files using [signify(1)](https://man.openbsd.org/OpenBSD-6.7/signify) and the previously fetched base public key:[^sha256]
 
     $ ( cd mirror/pub/OpenBSD/6.7/amd64 && signify -C \
         -p ../openbsd-67-base.pub \
@@ -92,7 +87,7 @@ Fourth, we verify the fetched files using [signify(1)](https://man.openbsd.org/O
         -- bsd bsd.* pxeboot *67.tgz )
 
 Finally, we serve the local mirror at <http://127.0.0.1:8080/>.
-Feel free to use your webserver of choice.
+Feel free to use your web server of choice.
 Chances are, that your Linux distribution comes with Python's [http.server module](https://docs.python.org/3/library/http.server.html):
 
     $ python3 \
@@ -102,7 +97,7 @@ Chances are, that your Linux distribution comes with Python's [http.server modul
 
 ## Configure the installation
 
-First, we create a response file for [autoinstall(8)](https://man.openbsd.org/OpenBSD-6.7/autoinstall) at `mirror/install.conf`:
+First, we create a response file for [autoinstall(8)](https://man.openbsd.org/OpenBSD-6.7/autoinstall) at `mirror/install.conf`:[^response-file]
 
     Change the default console to com0 = yes
     Which speed should com0 use = 115200
@@ -144,8 +139,7 @@ Next, we create a [disklabel(8)](https://man.openbsd.org/OpenBSD-6.7/disklabel)
 
 Finally, we create an optional site-specific file set.
 This way, we can run some commands at the end of the installation.
-Here, we reset the OpenBSD mirror server used by pkg_add(1) and other commands.
-Otherwise, we would need to include the binary packages in the local OpenBSD mirror.
+Here, we reset the OpenBSD mirror server used by [pkg_add(1)](https://man.openbsd.org/OpenBSD-6.7/pkg_add) and other commands.[^restrict-network]
 Moreover, we permit the wheel user group --- and thus the user `puffy` --- to run any command as root without entering their password using [doas(1)](https://man.openbsd.org/OpenBSD-6.7/doas).
 
 Create the file `site/install.site`:
@@ -163,7 +157,7 @@ Then, make the file executable, package the file set, and add it to the local Op
     $ ( cd site && tar -czf ../mirror/pub/OpenBSD/6.7/amd64/site67.tgz . )
     $ ( cd mirror/pub/OpenBSD/6.7/amd64 && ls -l > index.txt )
 
-## Create a network boot environment
+## Setup a network boot environment
 
 We create a dedicated directory to serve the OpenBSD kernel and PXE bootstrap program over [TFTP](https://en.wikipedia.org/w/index.php?title=Trivial_File_Transfer_Protocol&oldid=959587822):
 
@@ -177,7 +171,7 @@ Furthermore, we create a [boot(8)](https://man.openbsd.org/OpenBSD-6.7/man8/amd6
     set tty com0
     boot tftp:/bsd.rd
 
-## Create a virtual machine
+## Install the virtual machine
 
 First, we create a copy-on-write disk image using [qemu-img(1)](https://www.qemu.org/docs/master/tools/qemu-img.html):
 
@@ -198,16 +192,14 @@ Let's break this last command down.
 The `-enable-kvm` option enables the Linux [Kernel-based Virtual Machine (KVM)](https://www.linux-kvm.org/) support.
 The `-smp` option instructs QEMU to simulate a [symmetric multiprocessing (SMP)](https://en.wikipedia.org/w/index.php?title=Symmetric_multiprocessing&oldid=951686602) system.
 The `-m` option sets the amount of virtual memory.
-The `-drive` option attaches the previously created copy-on-write disk image as a [virtio](https://wiki.libvirt.org/page/Virtio) disk drive.
+The `-drive` option attaches the previously created copy-on-write disk image as a [Virtio](https://wiki.libvirt.org/page/Virtio) disk drive.
 The `-device` option attaches a standard network adapter.
 The `-netdev` option configures a virtual network `10.0.2.0/24` where `10.0.2.2` and `10.0.2.15` point to the QEMU host and guest respectively.
-Moreover, we instruct QEMU to redirect (a) port 2222 on the host to port 22 on the guest, and (b) port 80 on the virtual host address `10.0.2.1` to port 8080 on the host.
-The former enables us to `ssh` into the guest, and the latter frees us from binding to the privileged port 80 on the host.
+Moreover, we instruct QEMU to (a) run an embedded TFTP server, (b) redirect port 2222 on the host to port 22 on the guest, and (c) redirect port 80 on the virtual host address `10.0.2.1` to port 8080 on the host.
+The former port redirection enables us to log in to the guest using [ssh(1)](https://man.openbsd.org/OpenBSD-6.7/ssh), and the latter port redirection frees us from binding to the privileged port 80 on the host.[^socat]
 Finally, the `-nographic` option turns QEMU into a command-line application that redirects the emulated serial port to the console.
 Press `C-a x` to stop the virtual machine, or `C-a h` to show other options.
 
-<!-- TODO: Why socat? -->
-
 ## Log in to the virtual machine
 
 Once the virtual machine has booted, you can login as the user `puffy` using [ssh(1)](https://man.openbsd.org/OpenBSD-6.7/ssh):
@@ -222,9 +214,28 @@ Here, we use the `StrictHostKeyChecking` and `UserKnownHostsFile` options to kee
 
 ## Conclusion
 
-<!-- TODO: Summary -->
-<!-- TODO: Advertise script again -->
-<!-- TODO: Special URLs used by autoinstall -->
-<!-- TODO: Offline VM using full local OpenBSD mirror or caching proxy -->
-<!-- TODO: Verify using SHA256 instead of signify -->
-<!-- TODO: StrictHostKeyChecking yes, UserKnownHostsFile ./tmp_known_hosts -->
+We auto-installed OpenBSD/amd64 6.7 on the QEMU PC system emulator 5.0.0 by means of several command-line tools.
+First, we setup a partial, local OpenBSD mirror using [rsync(1)](https://download.samba.org/pub/rsync/rsync.1) and [signify(1)](https://man.openbsd.org/OpenBSD-6.7/signify).
+Second, we prepared a response file for [autoinstall(8)](https://man.openbsd.org/OpenBSD-6.7/autoinstall), a [disklabel(8)](https://man.openbsd.org/OpenBSD-6.7/disklabel) template, and a site-specific file set.
+Third, we setup a standard network boot environment.
+Fourth, we actually installed OpenBSD on a QEMU guest machine.
+Finally, we logged in to the virtual machine using [ssh(1)](https://man.openbsd.org/OpenBSD-6.7/ssh).
+
+Of course, you can automate the whole process.
+For example, I use a simple, yet [complete POSIX shell script](/files/autoinstall-openbsd-on-qemu.sh) to auto-install OpenBSD on QEMU.
+In fact, I have written another script to install and test the said pet project of mine as well.
+But this is out of scope here.
+
+[^sha256]:
+  You can also verify the [SHA256 checksums](https://ftp.openbsd.org/pub/OpenBSD/6.7/amd64/SHA256) of the fetched files if you cannot use [signify(1)](https://man.openbsd.org/OpenBSD-6.7/signify).
+
+[^response-file]:
+  You can serve per-host response files for [autoinstall(8)](https://www.tumfatig.net/20190426/openbsd-automatic-upgrade/) by prefixing the MAC address or the hostname.
+  Besides, you can add the response file to the RAM disk kernel `bsd.rd` using [rdsetroot(8)](https://man.openbsd.org/OpenBSD-6.7/rdsetroot).
+
+[^restrict-network]:
+  You can create a fully isolated virtual machine by (a) including patches, packages, and ports in your local OpenBSD mirror, and (b) restricting the virtual network created by QEMU.
+
+[^socat]:
+  I failed to forward port 80 on the virtual host address to port 8080 on the local host using [qemu-system-x86_64(1)](https://www.qemu.org/docs/master/system/qemu-manpage.html)'s `guestfwd` alone.
+  Instead, I resorted to the invaluable [socat(1)](http://www.dest-unreach.org/socat/doc/socat.html).
diff --git a/_drafts/autoinstall-openbsd-on-qemu.sh b/_drafts/autoinstall-openbsd-on-qemu.sh
index 104456a..d700482 100644
--- a/_drafts/autoinstall-openbsd-on-qemu.sh
+++ b/_drafts/autoinstall-openbsd-on-qemu.sh
@@ -3,7 +3,7 @@
 # Auto-install OpenBSD/amd64 6.7 on QEMU.
 #
 # First published at https://www.skreutz.com/posts/autoinstall-openbsd-on-qemu/
-# on 15 June 2020.
+# on 21 July 2020.
 #
 # Copyright (c) 2020 Stefan Kreutz <mail@skreutz.com>
 #