Install vanilla UEFI Debian on Raspberry Pi 3

rpi3.sh

# You will need a real Debian machine to perform cross debootstrap
# Debian on WSL does not work

# Enter root mode
sudo -i

# Define variables
TARGET=/dev/mmcblk0
MOUNT_POINT=/mnt
IP_ADDRESS=192.168.0.2
GATEWAY=192.168.0.1

# Install dependency
apt update
apt install -y btrfs-progs dosfstools qemu-user-static debootstrap curl gnupg

# Set up partition table and file systems
dd if=/dev/zero of=${TARGET} bs=1M count=8
(echo o; echo n; echo 'p'; echo '1'; echo ''; echo '+512M'; echo t; echo c; echo n; echo 'p'; echo '2'; echo ''; echo ''; echo w) | fdisk ${TARGET}
mkfs.fat -F32 ${TARGET}p1
mkfs.btrfs -f ${TARGET}p2

# Create subvolumes
mount -o compress=zstd ${TARGET}p2 ${MOUNT_POINT}
btrfs subvolume create ${MOUNT_POINT}/@
umount ${MOUNT_POINT}

# Mount partitions
mount -o compress=zstd,subvol=@ ${TARGET}p2 ${MOUNT_POINT}
mkdir -p ${MOUNT_POINT}/boot/efi
mount ${TARGET}p1 ${MOUNT_POINT}/boot/efi

# Install UEFI Firmware
curl -o fw.zip https://github.com/pftf/RPi3/releases/download/v1.37/RPi3_UEFI_Firmware_v1.37.zip
unzip fw.zip -d ${MOUNT_POINT}/boot/efi
rm fw.zip

# First stage debootstrap
debootstrap --arch=arm64 --foreign --components=main,non-free,contrib --include=locales bullseye ${MOUNT_POINT} https://mirrors.tuna.tsinghua.edu.cn/debian

# Second stage debootstrap
cp /usr/bin/qemu-aarch64-static ${MOUNT_POINT}/usr/bin/
LANG=C.UTF-8 chroot ${MOUNT_POINT} /usr/bin/qemu-aarch64-static /bin/bash /debootstrap/debootstrap --second-stage

# Set up fstab
echo "UUID=$(blkid -s UUID -o value ${TARGET}p2) / btrfs defaults,subvol=@,compress=zstd 0 0" >> ${MOUNT_POINT}/etc/fstab
echo "UUID=$(blkid -s UUID -o value ${TARGET}p1) /boot/efi vfat defaults 1 2" >> ${MOUNT_POINT}/etc/fstab

# Update source.list
echo "deb https://mirrors.tuna.tsinghua.edu.cn/debian/ bullseye-updates main contrib non-free" >> ${MOUNT_POINT}/etc/apt/sources.list
echo "deb https://mirrors.tuna.tsinghua.edu.cn/debian/ bullseye-backports main contrib non-free" >> ${MOUNT_POINT}/etc/apt/sources.list
echo "deb https://mirrors.tuna.tsinghua.edu.cn/debian-security bullseye-security main contrib non-free" >> ${MOUNT_POINT}/etc/apt/sources.list

echo "deb [signed-by=/usr/share/keyrings/pimox-archive-keyring.gpg] https://raw.fastgit.org/pimox/pimox7/master/ dev/" > ${MOUNT_POINT}/etc/apt/sources.list.d/pimox.list
curl https://raw.fastgit.org/pimox/pimox7/master/KEY.gpg | gpg --dearmour -o ${MOUNT_POINT}/usr/share/keyrings/pimox-archive-keyring.gpg

# Configure network
cat << EOF > ${MOUNT_POINT}/etc/network/interfaces
source /etc/network/interfaces.d/*
auto lo
iface lo inet loopback
auto enp0s25
iface enp0s25 inet manual
        ovs_type OVSPort
        ovs_bridge vmbr0
auto untagged
iface untagged inet static
        address ${IP_ADDRESS}/24
        gateway ${GATEWAY}
        ovs_type OVSIntPort
        ovs_bridge vmbr0
auto vmbr0
iface vmbr0 inet manual
        ovs_type OVSBridge
        ovs_ports enp0s25 untagged
EOF

# Enter chroot
for i in /dev /dev/pts /proc /sys /run; do mount -B $i ${MOUNT_POINT}$i; done
LANG=en_US.UTF-8 chroot ${MOUNT_POINT} /usr/bin/qemu-aarch64-static /bin/bash

# Define variables
USER=user

# Configure locale and timezone
sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen
echo 'LANG="en_US.UTF-8"'> /etc/default/locale
dpkg-reconfigure -f noninteractive locales
update-locale LANG=en_US.UTF-8
echo "Asia/Shanghai" > /etc/timezone
ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
dpkg-reconfigure -f noninteractive tzdata

# Install additional packages
apt update
apt install -y linux-image-arm64 grub-efi openssh-server sudo haveged zram-tools tmux bash-completion wpasupplicant openvswitch-switch btrfs-progs
printf "SIZE=512\nPRIORITY=100\nALGO=zstd\n" >> /etc/default/zramswap
systemctl enable ssh haveged zramswap

# Install grub
grub-install --target=arm64-efi --efi-directory=/boot/efi --removable
sed -i "s/GRUB_CMDLINE_LINUX_DEFAULT=\"quiet\"/GRUB_CMDLINE_LINUX_DEFAULT=\"cgroup_enable=cpuset cgroup_enable=memory cgroup_memory=1\"/" /etc/default/grub
GRUB_DISABLE_OS_PROBER=true update-grub

# Clean up
apt-get clean

# Change root password
passwd

# Create new user for SSH login
useradd -m -s /bin/bash ${USER}
usermod -a -G sudo ${USER}
passwd ${USER}

# Exit chroot
exit
rm ${MOUNT_POINT}/usr/bin/qemu-aarch64-static
sync
umount -R ${MOUNT_POINT}