fix(deploy): dropbear at boot on initramfs-tools, with dracut's image as the way back (ADR 0039, D20)

Ubuntu 26.04 builds its boot images with dracut, and dropbear-initramfs needs
initramfs-tools, which replaces it. The host's step 2 now installs
initramfs-tools with cryptsetup-initramfs beside dropbear, sets the boot
image's address in a conf.d file of its own, and checks every new image for
what opens the disk, dropbear, its key and the adapter's driver before any
reboot. Before switching, dracut's image of the running kernel is kept as an
entry in GRUB's menu (shown 5 s, the boot in text), so a failed image is
undone at the iMac without a USB stick.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/host/README.md

@@ -10,6 +10,9 @@ end of the tunnel.
 | `sshd-halkyon.conf` | `/etc/ssh/sshd_config.d/10-halkyon.conf` | keys alone, two users (D17) |
 | `dropbear.conf` | `/etc/dropbear/initramfs/dropbear.conf` | the passphrase over SSH at boot (D20) |
 | `initramfs-modules` | appended to `/etc/initramfs-tools/modules` | the USB network adapter at boot (D20) |
+| `initramfs-ip` | `/etc/initramfs-tools/conf.d/halkyon-ip` | its address by DHCP at boot (D20) |
+| `grub-halkyon.cfg` | `/etc/default/grub.d/halkyon.cfg` | GRUB's menu for 5 s, the boot in text (D20) |
+| `grub-dracut-fallback` | `/etc/grub.d/41_dracut_fallback` | the way back to dracut's image (D20) |
 | `fstab-docker` | appended to `/etc/fstab` | Docker's and containerd's data on the HDD (D12) |
 | `docker-after-data.conf` | `docker.service.d/` and `containerd.service.d/` | both wait for it (D12) |
 | `wg-halkyon.conf` | `/etc/wireguard/wg-halkyon.conf` | home's end of the tunnel (D8) |
@@ -45,22 +48,53 @@ for the later.
    (*Heimnetz › Netzwerk › balthasar › Diesem Netzwerkgerät immer die gleiche
    IPv4-Adresse zuweisen*), so that 192.168.178.53 stays its address.
 
-2. **The passphrase over SSH at boot** (D20):
+2. **The passphrase over SSH at boot** (D20). Ubuntu 26.04 builds its boot images with
+   dracut; `dropbear-initramfs` needs initramfs-tools, which replaces it. So first the
+   way back: today's image, dracut's, kept for the kernel running now, as an entry in
+   GRUB's menu, which shows for 5 seconds from now on:
 
    ```sh
-   sudo apt install dropbear-initramfs
+   sudo cp /boot/initrd.img-$(uname -r) /boot/initrd.img-$(uname -r).dracut
+   sudo install -m 644 deploy/host/grub-halkyon.cfg /etc/default/grub.d/halkyon.cfg
+   sudo install -m 755 deploy/host/grub-dracut-fallback /etc/grub.d/41_dracut_fallback
+   sudo update-grub                     # "Found the way back: … with dracut's image"
+   grep -c 'the way back' /boot/grub/grub.cfg   # 1
+   ```
+
+   Then initramfs-tools, with what opens the root disk (`cryptsetup-initramfs`) and
+   dropbear. apt lists `dracut` and `dracut-core` to be removed, and nothing else:
+
+   ```sh
+   sudo apt install initramfs-tools cryptsetup-initramfs dropbear-initramfs
    sudo install -m 644 deploy/host/dropbear.conf /etc/dropbear/initramfs/dropbear.conf
    # melchior's public key alone (from ~/.ssh/authorized_keys, step 1), restricted:
    printf 'no-port-forwarding,no-agent-forwarding,no-X11-forwarding,command="/usr/bin/cryptroot-unlock" %s\n' \
      "$(cat ~/.ssh/authorized_keys)" | sudo tee /etc/dropbear/initramfs/authorized_keys
    grep -v '^#' deploy/host/initramfs-modules | sudo tee -a /etc/initramfs-tools/modules
-   echo 'IP=::::balthasar:enx0050b6bffcff:dhcp' | sudo tee -a /etc/initramfs-tools/initramfs.conf
-   sudo update-initramfs -u
+   sudo install -m 644 deploy/host/initramfs-ip /etc/initramfs-tools/conf.d/halkyon-ip
+   sudo update-initramfs -u -k all
    ```
 
-   At the next boot, at home: `ssh -p 2222 root@192.168.178.53` from melchior asks for the
-   root disk's passphrase, and the boot goes on. The keyboard at the iMac still works as
-   before, so a mistake here costs no more than the walk to it.
+   Before any reboot, each new image must hold what opens the disk, dropbear, its key
+   and the adapter's driver:
+
+   ```sh
+   for image in /boot/initrd.img-*-generic; do
+     echo "== $image"
+     sudo lsinitramfs "$image" | grep -E 'cryptroot/crypttab$|sbin/cryptsetup$|sbin/dropbear$|/authorized_keys$|cdc_ncm\.ko|sbin/lvm$'
+   done   # for each: crypttab, cryptsetup, dropbear, authorized_keys, cdc_ncm, lvm
+   sudo sh -c 'unmkinitramfs /boot/initrd.img-$(uname -r) /tmp/initrd &&
+     find /tmp/initrd -path "*cryptroot/crypttab" -exec cat {} +; rm -rf /tmp/initrd'
+   # dm_crypt-0 UUID=… none luks…
+   sudo dropbearkey -y -f /etc/dropbear/initramfs/dropbear_ed25519_host_key | grep -i fingerprint
+   ```
+
+   The last line is dropbear's own host key, which melchior sees on port 2222 at the
+   next boot. At that boot, at home: `ssh -p 2222 root@192.168.178.53` from melchior asks
+   for the root disk's passphrase, and the boot goes on. The keyboard at the iMac still
+   works as before. Should the new image not open the disk, choose *the way back* in
+   GRUB's menu at the iMac: it boots as before this step. Once the new images have
+   booted: `sudo rm /etc/grub.d/41_dracut_fallback /boot/initrd.img-*.dracut && sudo update-grub`.
 
 3. **No desktop** (D12): it stops starting at boot, and Docker Desktop, which runs a VM of
    its own beside Docker, goes. Multipass is switched off while no VM is needed: its

deploy/host/grub-dracut-fallback

@@ -0,0 +1,27 @@
+#!/bin/sh
+# The way back to the boot image dracut made (ADR 0039, D20), as
+# /etc/grub.d/41_dracut_fallback (root, 0755) on the instance's host at home, which
+# update-grub runs. Ubuntu 26.04 builds its boot images with dracut, and
+# dropbear-initramfs needs initramfs-tools, which replaces it: should an image of
+# initramfs-tools not open the root disk, this entry boots a kernel with the image
+# dracut had made for it, kept beside it as initrd.img-<version>.dracut. Chosen at the
+# iMac in GRUB's menu (grub-halkyon.cfg). Once initramfs-tools' images have booted,
+# the copy and this file may go.
+set -e
+boot=$(findmnt -no UUID /boot)
+for image in /boot/initrd.img-*.dracut; do
+  [ -e "$image" ] || continue
+  version=${image#/boot/initrd.img-}
+  version=${version%.dracut}
+  [ -e "/boot/vmlinuz-$version" ] || continue
+  echo "Found the way back: $version with dracut's image" >&2
+  cat <<EOF
+menuentry 'Ubuntu, $version with dracut (the way back)' {
+	insmod part_gpt
+	insmod ext2
+	search --no-floppy --fs-uuid --set=root $boot
+	linux /vmlinuz-$version root=/dev/mapper/ubuntu--vg-ubuntu--lv ro
+	initrd /initrd.img-$version.dracut
+}
+EOF
+done

deploy/host/grub-halkyon.cfg

@@ -0,0 +1,7 @@
+# GRUB on the instance's host at home (ADR 0039, D20), as /etc/default/grub.d/halkyon.cfg:
+# its menu shown for 5 seconds, so that at the iMac the way back (grub-dracut-fallback)
+# can be chosen, and the boot in text, without a splash: no desktop, and the
+# passphrase's prompt is plain on the screen as over SSH.
+GRUB_TIMEOUT_STYLE=menu
+GRUB_TIMEOUT=5
+GRUB_CMDLINE_LINUX_DEFAULT=""

deploy/host/initramfs-ip

@@ -0,0 +1,4 @@
+# The boot image's network (ADR 0039, D20), as /etc/initramfs-tools/conf.d/halkyon-ip
+# on the instance's host at home: the USB adapter by DHCP, so dropbear is reached at
+# balthasar's fixed address (the FRITZ!Box keeps it).
+IP=::::balthasar:enx0050b6bffcff:dhcp