DNS: Cloudflare by default; Cloud-init: disable ds-identify and force NoCloud

* feat: use static ip without manually typing it

* fix(cidr_to_netmask): rewrite to support sh

* refactor: remove cidr_to_netmask(), set cidr directly

https://lists.debian.org/debian-boot/2012/09/msg00239.html

* refactor: rename option --static-ip to --static-ipv4

* Add --static-ipv4 doc

---------

Co-authored-by: Anonymous <>
Co-authored-by: Brent, Yang Bohan <youthdna@live.com>

README.md

@@ -1,60 +1,22 @@
 # Debian Network Reinstall Script
 
-[General description in English ↓](#introduction)
+[中文说明 ↓](#中文说明)
-
-## VPS 网络重装 Debian 11 脚本
-
-**暂不支持 Oracle Linux 作为原系统。创建新机器时请选择 Ubuntu 20.04 或 18.04 系统模板。**
-
-下载脚本：
-
-```
-curl -fLO https://raw.githubusercontent.com/bohanyang/debi/master/debi.sh && chmod a+rx debi.sh
-```
-
-运行脚本：
-
-```
-sudo ./debi.sh --cdn --network-console --ethx --bbr --user root --password <新系统用户密码>
-```
-
-* `--bbr` 开启 BBR
-* `--ethx` 网卡名称使用传统形式，如 `eth0` 而不是 `ens3`
-* `--cloud-kernel` 安装占用空间较小的 `cloud` 内核，但可能会导致 UEFI 启动的机器（如 Oracle、Azure 及 Hyper-V、Google Cloud 等）VNC 黑屏。BIOS 启动的普通 VPS 则没有此问题。
-* 默认时区为 UTC，添加 `--timezone Asia/Shanghai` 可使用中国时区。
-* 默认使用 Debian 官方 CDN 镜像源（deb.debian.org），添加 `--china` 可使用阿里云镜像源。
-
-如果没有报错可以重启：
-
-```
-sudo shutdown -r now
-```
-
-约 30 秒后可以尝试 SSH 登录 `installer` 用户，密码与之前设置的相同。如果成功连接，可以按 Ctrl-A 然后再按 4 监控安装日志。安装完成后会自动重启进入新系统。
-
-
-### [Oracle 自动获取 IPv6](https://github.com/bohanyang/debi/wiki/%E7%94%B2%E9%AA%A8%E6%96%87%E4%BA%91%E6%9C%8D%E5%8A%A1%E5%99%A8%E8%87%AA%E5%8A%A8%E8%8E%B7%E5%8F%96-IPv6)
-### [Oracle 纯 IPv6 网络（无公网 IPv4）下安装方法](https://github.com/bohanyang/debi/wiki/%E7%94%B2%E9%AA%A8%E6%96%87%E4%BA%91%E6%9C%8D%E5%8A%A1%E5%99%A8%E7%BA%AF-IPv6-%E7%BD%91%E7%BB%9C%EF%BC%88%E6%97%A0%E5%85%AC%E7%BD%91-IPv4%EF%BC%89%E4%B8%8B%E5%AE%89%E8%A3%85%E6%96%B9%E6%B3%95)
 
 ## Introduction
 
-This script is written to reinstall a VPS/virtual machine to minimal Debian 11.
+This script is written to reinstall VPS/VMs to minimal Debian.
 
-## Should Work On
+## Platforms
 
-### Virtualization Platform
+- ✔ KVM or physical machines ❌ Containers
-
+- ✔ Debian or Ubuntu or Red Hat Linux as original OS with GRUB 2 bootloader
- * SolusVM/OpenStack/DigitalOcean/Vultr/Linode/Proxmox/QEMU KVM (BIOS boot)
+- ✔ MBR or GPT partition table
- * Oracle Cloud Infrastructure (UEFI boot)
+- ✔ Multiple disks or LVM
- * Google Cloud Compute Engine (**Must manually configure the VPC internal IP and the gateway.** UEFI boot with Secure Boot support)
+- ✔ IPv4 or IPv6
- * AWS EC2 & Lightsail (BIOS boot)
+- ✔ Legacy BIOS or UEFI boot
- * Hyper-V & Azure (Generation 1 BIOS boot & Generation 2 UEFI boot)
+- ✔ Most VPS or cloud providers
-
+- ⚠️ Google Compute Engine - **MUST** manually specify IP/CIDR and gateway of VPC
-### Original OS
+- ⚠️ AWS EC2 or Lightsail - Does **NOT** work with UEFI boot
-
- * Debian 8 or later
- * Ubuntu 14.04 or later
- * CentOS 7 or later
 
 ## How It Works
 
@@ -70,9 +32,6 @@ Download the script with curl:
 
     curl -fLO https://raw.githubusercontent.com/bohanyang/debi/master/debi.sh
 
-    # for IPv6-only machines
-    curl -fLO --resolve 'raw.githubusercontent.com:443:2a04:4e42::133' https://raw.githubusercontent.com/bohanyang/debi/master/debi.sh
-
 or wget:
 
     wget -O debi.sh https://raw.githubusercontent.com/bohanyang/debi/master/debi.sh
@@ -98,18 +57,31 @@ Otherwise, you can run this command to revert all changes made by the script:
 
 ## Available Options
 
+### Presets
+
+| Region | Alias          | Mirror                               | DNS        | NTP                 |
+|--------|----------------|--------------------------------------|------------|---------------------|
+| Global | Default        | https://deb.debian.org               | Google     | time.google.com     |
+| Global | `--cloudflare` | https://deb.debian.org               | Cloudflare | time.cloudflare.com |
+| Global | `--aws`        | https://cdn-aws.deb.debian.org       | Google     | time.aws.com        |
+| China  | `--ustc`       | https://mirrors.ustc.edu.cn          | DNSPod     | time.amazonaws.cn   |
+| China  | `--tuna`       | https://mirrors.tuna.tsinghua.edu.cn | DNSPod     | time.amazonaws.cn   |
+| China  | `--aliyun`     | https://mirrors.aliyun.com           | AliDNS     | time.amazonaws.cn   |
+
  * `--interface <string>` Manually select a network interface, e.g. eth1
  * `--ethx` Disable *Consistent Network Device Naming* to get interface names like *ethX* back
  * `--ip <string>` Disable the auto network config (DHCP) and configure a static IP address, e.g. `10.0.0.2`, `1.2.3.4/24`, `2001:2345:6789:abcd::ef/48`
+ * `--static-ipv4` Disable the auto network config (DHCP) and configure with the current IPv4 address and gateway detected automatically
  * `--netmask <string>` e.g. `255.255.255.0`, `ffff:ffff:ffff:ffff::`
  * `--gateway <string>` e.g. `10.0.0.1`, `none` if no gateway
- * `--dns '8.8.8.8 8.8.4.4'` (Default IPv6 DNS: `2001:4860:4860::8888 2001:4860:4860::8844`)
+ * `--dns '8.8.8.8 8.8.4.4'`
+ * `--dns6 '2001:4860:4860::8888 2001:4860:4860::8844'` (effective only if IPv6 is specified)
  * `--hostname <string>` FQDN hostname (includes the domain name), e.g. `server1.example.com`
  * `--network-console` Enable the network console of the installer. `ssh installer@ip` to connect
- * `--version 11` Supports: `9`, `10`, `11`, `12`
+ * `--version 12` Supports: `10`, `11`, `12`, `13`
- * `--suite bullseye` **For normal cases, please use `--version` instead.** e.g. `stable`, `testing`, `sid`
+ * `--suite bullseye` **Please use `--version` instead if you don't have special needs.** e.g. `stable`, `testing`, `sid`
- * `--release-d-i` d-i (Debian Installer) for the released versions: 11 (bullseye), 10 (buster) and 9 (stretch)
+ * `--release-d-i` d-i (Debian Installer) for the released versions: 12 (bookworm), 11 (bullseye) and 10 (buster)
- * `--daily-d-i` Use latest daily build of d-i (Debian Installer) for the unreleased version: 12 (bookworm), sid (unstable)
+ * `--daily-d-i` Use latest daily build of d-i (Debian Installer) for the unreleased version: 13 (trixie), sid (unstable)
  * `--mirror-protocol http` or `https` or `ftp`
  * `--https` alias to `--mirror-protocol https`
  * `--reuse-proxy` Reuse the value of `http(s)_proxy` environment variable as the mirror proxy
@@ -123,7 +95,7 @@ Otherwise, you can run this command to revert all changes made by the script:
  * `--authorized-keys-url <string>` URL to your authorized keys for SSH authentication. e.g. `https://github.com/torvalds.keys`
  * `--sudo-with-password` Require password when the user invokes `sudo` command
  * `--timezone UTC` e.g. `Asia/Shanghai` for China (UTC+8) https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List
- * `--ntp 0.debian.pool.ntp.org`
+ * `--ntp time.google.com`
  * `--no-disk-partitioning, --no-part` **(Manual installation)** Proceed disk partitioning manually in VNC or remote console
  * `--disk <string>` Manually select a disk for installation. **Please remember to specify this when more than one disk is available!** e.g. `/dev/sda`
  * `--no-force-gpt` By default, GPT rather than MBR partition table will be created. This option disables it.
@@ -135,6 +107,8 @@ Otherwise, you can run this command to revert all changes made by the script:
  * `--cloud-kernel` Choose `linux-image-cloud-amd64` or `...arm64` as the kernel image
  * `--bpo-kernel` Choose the kernel image from Debian Backports (newer version from the next Debian release)
  * `--no-install-recommends`
+ * `--apt-non-free-firmware`, `--apt-non-free`, `--apt-contrib`, `--apt-src`, `--apt-backports`
+ * `--no-apt-non-free-firmware`, `--no-apt-non-free`, `--no-apt-contrib`, `--no-apt-src`, `--no-apt-backports`
  * `--install 'ca-certificates libpam-systemd'` Install additional APT packages. Space-separated and quoted.
  * `--safe-upgrade` **(Default)** `apt upgrade --with-new-pkgs`. [See](https://salsa.debian.org/installer-team/pkgsel/-/blob/master/debian/postinst)
  * `--full-upgrade` `apt dist-upgrade`
@@ -149,25 +123,32 @@ Otherwise, you can run this command to revert all changes made by the script:
  * `--grub-timeout 5` How many seconds the GRUB menu shows before entering the installer
  * `--force-lowmem <integer>` Valid values: 0, 1, 2. Force [low memory level](https://salsa.debian.org/installer-team/lowmem). Useful if your machine has memory less than 500M where level 2 is set (see issue #45). `--force-lowmem 1` may solve it. 
  * `--dry-run` Print generated preseed and GRUB entry without downloading the installer and actually saving them
+ * `--cidata ./cidata-example` Custom data for cloud-init. **VM provider's data source will be IGNORED.** See example.
 
-### Presets
+## 中文说明
 
-### `--cdn`
+下载脚本：
 
- * `--mirror-protocol https`
+```
- * `--mirror-host deb.debian.org`
+curl -fLO https://raw.githubusercontent.com/bohanyang/debi/master/debi.sh && chmod a+rx debi.sh
- * `--security-repository mirror`
+```
 
-### `--aws`
+运行脚本：
 
- * `--mirror-protocol https`
+```
- * `--mirror-host cdn-aws.deb.debian.org`
+sudo ./debi.sh --cdn --network-console --ethx --bbr --user root --password <新系统用户密码>
- * `--security-repository mirror`
+```
 
-### `--china`
+* `--bbr` 开启 BBR
+* `--ethx` 网卡名称使用传统形式，如 `eth0` 而不是 `ens3`
+* `--cloud-kernel` 安装占用空间较小的 `cloud` 内核，但可能会导致 UEFI 启动的机器（如 Oracle、Azure 及 Hyper-V、Google Cloud 等）VNC 黑屏。BIOS 启动的普通 VPS 则没有此问题。
+* 默认时区为 UTC，添加 `--timezone Asia/Shanghai` 可使用中国时区。
+* 默认使用 Debian 官方 CDN 镜像源（deb.debian.org），添加 `--ustc` 可使用中科大镜像源。
 
- * `--dns '223.5.5.5 223.6.6.6'`
+如果没有报错可以重启：
- * `--mirror-protocol https`
+
- * `--mirror-host mirrors.aliyun.com`
+```
- * `--security-repository mirror`
+sudo shutdown -r now
- * `--ntp ntp.aliyun.com`
+```
+
+约 30 秒后可以尝试 SSH 登录 `installer` 用户，密码与之前设置的相同。如果成功连接，可以按 Ctrl-A 然后再按 4 监控安装日志。安装完成后会自动重启进入新系统。

cidata-example/meta-data

@@ -0,0 +1 @@
+instance-id: 4c75121c-44fb-4166-8717-800b73cab4e4

cidata-example/user-data

@@ -0,0 +1,21 @@
+#cloud-config
+hostname: ci01
+user: debian
+disable_root: false
+ssh_pwauth: true
+password: 'kuras001'
+ssh_authorized_keys:
+  - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCgBp08hAwwPk2w2T+yvlqil7jqXlzM7ulIA9lrgJB9NJLZV3wyYEmcxP/frTSUanjWtiYlrmn5d6EJFwR01Ga+aD6hwQoSZtKyVGY7zKfM6NWKF/lcpFT6HxPg33C4tpueqSqupSlx2yoPqRZhVoCeERrN9k/7fN8Bv8Xvfa/LN8sAI4v8CEJ7BpRXplRwnxceECBdJm0d3ebzMTnj1sfWBTgu/5iwpDh8DRR6LEab7famSTTB8jo6gz3gcwZC+Q3L/UTxS4kcjiQTuX7G74ae9+oSOpuPfP7N0Yo7lJDr8LCZHqkAZC47mQ2baatmD4hc3ZdVD64k6V1b/ms+37/7 youth@DESKTOP-AV4DNMN
+chpasswd: { expire: false }
+
+write_files:
+  - content: |
+      [Swap]
+      What=/swapfile
+
+      [Install]
+      WantedBy=swap.target
+    path: /etc/systemd/system/swapfile.swap
+
+runcmd:
+  - [ sh, -c, "[ ! -e /swapfile ] && { fallocate -l 100M /swapfile && chmod 0600 /swapfile && mkswap /swapfile; }; systemctl daemon-reload && systemctl enable --now swapfile.swap" ]

debi.sh

@@ -18,7 +18,7 @@ command_exists() {
 }
 
 # Sets variable:
-late_command=
+in_target_script=
 in_target() {
     local command=
 
@@ -27,8 +27,8 @@ in_target() {
     done
 
     if [ -n "$command" ]; then
-        [ -z "$late_command" ] && late_command='true'
+        [ -z "$in_target_script" ] && in_target_script='true'
-        late_command="$late_command;$command"
+        in_target_script="$in_target_script;$command"
     fi
 }
 
@@ -111,10 +111,10 @@ set_mirror_proxy() {
 
 set_security_archive() {
     case $suite in
-        stretch|oldoldstable|buster|oldstable)
+        buster|oldoldstable)
             security_archive="$suite/updates"
             ;;
-        bullseye|stable|bookworm|testing)
+        bullseye|oldstable|bookworm|stable|trixie|testing)
             security_archive="$suite-security"
             ;;
         sid|unstable)
@@ -127,10 +127,10 @@ set_security_archive() {
 
 set_daily_d_i() {
     case $suite in
-        stretch|oldoldstable|buster|oldstable|bullseye|stable|bookworm)
+        buster|oldoldstable|bullseye|oldstable|bookworm|stable)
             daily_d_i=false
             ;;
-        testing|sid|unstable)
+        trixie|testing|sid|unstable)
             daily_d_i=true
             ;;
         *)
@@ -146,18 +146,18 @@ set_suite() {
 
 set_debian_version() {
     case $1 in
-        9|stretch|oldoldstable)
+        10|buster|oldoldstable)
-            set_suite stretch
-            ;;
-        10|buster|oldstable)
             set_suite buster
             ;;
-        11|bullseye|stable)
+        11|bullseye|oldstable)
             set_suite bullseye
             ;;
-        12|bookworm|testing)
+        12|bookworm|stable)
             set_suite bookworm
             ;;
+        13|trixie|testing)
+            set_suite trixie
+            ;;
         sid|unstable)
             set_suite sid
             ;;
@@ -168,14 +168,11 @@ set_debian_version() {
 
 has_cloud_kernel() {
     case $suite in
-        stretch|oldoldstable)
+        buster|oldoldstable)
-            [ "$architecture" = amd64 ] && [ "$bpo_kernel" = true ] && return
-            ;;
-        buster|oldstable)
             [ "$architecture" = amd64 ] && return
             [ "$architecture" = arm64 ] && [ "$bpo_kernel" = true ] && return
             ;;
-        bullseye|stable|bookworm|testing|sid|unstable)
+        bullseye|oldstable|bookworm|stable|trixie|testing|sid|unstable)
             [ "$architecture" = amd64 ] || [ "$architecture" = arm64 ] && return
     esac
 
@@ -187,7 +184,7 @@ has_cloud_kernel() {
 
 has_backports() {
     case $suite in
-        stretch|oldoldstable|buster|oldstable|bullseye|stable|bookworm|testing) return
+        buster|oldoldstable|bullseye|oldstable|bookworm|stable|trixie|testing) return
     esac
 
     warn "No backports kernel is available for $suite"
@@ -199,24 +196,26 @@ interface=auto
 ip=
 netmask=
 gateway=
-dns='8.8.8.8 8.8.4.4'
+dns='1.1.1.1 1.0.0.1'
+dns6='2606:4700:4700::1111 2606:4700:4700::1001'
+dns10='1.1.1.1 2606:4700:4700::1111'
 hostname=
 network_console=false
-set_debian_version 11
+set_debian_version 12
-mirror_protocol=http
+mirror_protocol=https
 mirror_host=deb.debian.org
 mirror_directory=/debian
 mirror_proxy=
-security_repository=http://security.debian.org/debian-security
+security_repository=mirror
 account_setup=true
 username=debian
 password=
 authorized_keys_url=
 sudo_with_password=false
 timezone=UTC
-ntp=0.debian.pool.ntp.org
+ntp=time.google.com
 disk_partitioning=true
-disk=
+disk="/dev/$(lsblk -no PKNAME "$(df /boot | grep -Eo '/dev/[a-z0-9]+')")"
 force_gpt=true
 efi=
 esp=106
@@ -225,7 +224,7 @@ kernel=
 cloud_kernel=false
 bpo_kernel=false
 install_recommends=true
-install='ca-certificates libpam-systemd'
+install=
 upgrade=
 kernel_params=
 force_lowmem=
@@ -238,20 +237,51 @@ firmware=false
 force_efi_extra_removable=true
 grub_timeout=5
 dry_run=false
+apt_non_free_firmware=true
+apt_non_free=false
+apt_contrib=false
+apt_src=true
+apt_backports=true
+cidata=
 
 while [ $# -gt 0 ]; do
     case $1 in
-        --cdn|--aws)
+        --cdn)
-            mirror_protocol=https
-            [ "$1" = '--aws' ] && mirror_host=cdn-aws.deb.debian.org
-            security_repository=mirror
             ;;
-        --china)
+        --aws)
+            mirror_host=cdn-aws.deb.debian.org
+            ntp=time.aws.com
+            ;;
+        --cloudflare)
+            dns='1.1.1.1 1.0.0.1'
+            dns6='2606:4700:4700::1111 2606:4700:4700::1001'
+            ntp=time.cloudflare.com
+            ;;
+        --aliyun)
             dns='223.5.5.5 223.6.6.6'
-            mirror_protocol=https
+            dns6='2400:3200::1 2400:3200:baba::1'
             mirror_host=mirrors.aliyun.com
-            ntp=ntp.aliyun.com
+            ntp=time.amazonaws.cn
-            security_repository=mirror
+            ;;
+        --ustc|--china)
+            dns='119.29.29.29'
+            dns6='2402:4e00::'
+            mirror_host=mirrors.ustc.edu.cn
+            ntp=time.amazonaws.cn
+            ;;
+        --tuna)
+            dns='119.29.29.29'
+            dns6='2402:4e00::'
+            mirror_host=mirrors.tuna.tsinghua.edu.cn
+            ntp=time.amazonaws.cn
+            ;;
+        --static-ipv4)
+            ip=$(ip r get 1.1.1.1 | awk '/src/ {print $7}')
+            gateway=$(ip r get 1.1.1.1 | awk '/via/ {print $3}')
+            _cidr=$(ip -o -f inet addr show | grep -w "$ip" | awk '{print $4}' | cut -d'/' -f2)
+            ip="$ip/$_cidr"
+            hostname=$(hostname)
+            interface=$(ip r get 1.1.1.1 | awk '/dev/ {print $5}')
             ;;
         --interface)
             interface=$2
@@ -273,6 +303,10 @@ while [ $# -gt 0 ]; do
             dns=$2
             shift
             ;;
+        --dns6)
+            dns6=$2
+            shift
+            ;;
         --hostname)
             hostname=$2
             shift
@@ -385,6 +419,38 @@ while [ $# -gt 0 ]; do
         --bpo-kernel)
             bpo_kernel=true
             ;;
+        --apt-non-free-firmware)
+            apt_non_free_firmware=true
+            ;;
+        --apt-non-free)
+            apt_non_free=true
+            apt_contrib=true
+            ;;
+        --apt-contrib)
+            apt_contrib=true
+            ;;
+        --apt-src)
+            apt_src=true
+            ;;
+        --apt-backports)
+            apt_backports=true
+            ;;
+        --no-apt-non-free-firmware)
+            apt_non_free_firmware=false
+            ;;
+        --no-apt-non-free)
+            apt_non_free=false
+            ;;
+        --no-apt-contrib)
+            apt_contrib=false
+            apt_non_free=false
+            ;;
+        --no-apt-src)
+            apt_src=false
+            ;;
+        --no-apt-backports)
+            apt_backports=false
+            ;;
         --no-install-recommends)
             install_recommends=false
             ;;
@@ -434,6 +500,12 @@ while [ $# -gt 0 ]; do
         --dry-run)
             dry_run=true
             ;;
+        --cidata)
+            cidata=$(realpath "$2")
+            [ ! -f "$cidata/meta-data" ] && err 'No "meta-data" file found in the cloud-init directory'
+            [ ! -f "$cidata/user-data" ] && err 'No "user-data" file found in the cloud-init directory'
+            shift
+            ;;
         *)
             err "Unknown option: \"$1\""
     esac
@@ -468,6 +540,23 @@ done
 [ -n "$authorized_keys_url" ] && ! download "$authorized_keys_url" /dev/null &&
 err "Failed to download SSH authorized public keys from \"$authorized_keys_url\""
 
+non_free_firmware_available=false
+case $suite in
+    bookworm|stable|trixie|testing|sid|unstable)
+        non_free_firmware_available=true
+        ;;
+    *)
+        apt_non_free_firmware=false
+esac
+
+apt_components=main
+[ "$apt_contrib" = true ] && apt_components="$apt_components contrib"
+[ "$apt_non_free" = true ] && apt_components="$apt_components non-free"
+[ "$apt_non_free_firmware" = true ] && apt_components="$apt_components non-free-firmware"
+
+apt_services=updates
+[ "$apt_backports" = true ] && apt_services="$apt_services, backports"
+
 installer_directory="/boot/debian-$suite"
 
 save_preseed='cat'
@@ -503,11 +592,15 @@ EOF
     echo "d-i netcfg/get_ipaddress string $ip" | $save_preseed
     [ -n "$netmask" ] && echo "d-i netcfg/get_netmask string $netmask" | $save_preseed
     [ -n "$gateway" ] && echo "d-i netcfg/get_gateway string $gateway" | $save_preseed
-    [ -z "${ip%%*:*}" ] && [ -n "${dns%%*:*}" ] && dns='2001:4860:4860::8888 2001:4860:4860::8844'
+    [ -z "${ip%%*:*}" ] && [ -n "${dns%%*:*}" ] && dns="$dns6"
     [ -n "$dns" ] && echo "d-i netcfg/get_nameservers string $dns" | $save_preseed
     echo 'd-i netcfg/confirm_static boolean true' | $save_preseed
 }
 
+[ -z "$ip" ] && {
+    echo "d-i netcfg/get_nameservers string $dns10" | $save_preseed
+}
+
 if [ -n "$hostname" ]; then
     echo "d-i netcfg/hostname string $hostname" | $save_preseed
     hostname=debian
@@ -711,6 +804,7 @@ d-i partman-partitioning/confirm_write_new_label boolean true
 d-i partman/choose_partition select finish
 d-i partman/confirm boolean true
 d-i partman/confirm_nooverwrite boolean true
+d-i partman-lvm/device_remove_lvm boolean true
 EOF
 }
 
@@ -725,17 +819,24 @@ EOF
 
 [ "$security_repository" = mirror ] && security_repository=$mirror_protocol://$mirror_host${mirror_directory%/*}/debian-security
 
-# If not sid/unstable
+$save_preseed << EOF
-[ -n "$security_archive" ] && {
-    $save_preseed << EOF
 
 # Apt setup
 
-d-i apt-setup/services-select multiselect updates, backports
+d-i apt-setup/contrib boolean $apt_contrib
-d-i apt-setup/local0/repository string $security_repository $security_archive main
+d-i apt-setup/non-free boolean $apt_non_free
-d-i apt-setup/local0/source boolean true
+d-i apt-setup/enable-source-repositories boolean $apt_src
+d-i apt-setup/services-select multiselect $apt_services
 EOF
 
+[ "$non_free_firmware_available" = true ] && echo "d-i apt-setup/non-free-firmware boolean $apt_non_free_firmware" | $save_preseed
+
+# If not sid/unstable
+[ -n "$security_archive" ] && {
+    $save_preseed << EOF
+d-i apt-setup/local0/repository string $security_repository $security_archive $apt_components
+d-i apt-setup/local0/source boolean $apt_src
+EOF
 }
 
 $save_preseed << 'EOF'
@@ -745,6 +846,9 @@ $save_preseed << 'EOF'
 tasksel tasksel/first multiselect ssh-server
 EOF
 
+install="$install ca-certificates libpam-systemd"
+[ -n "$cidata" ] && install="$install cloud-init"
+
 [ -n "$install" ] && echo "d-i pkgsel/include string $install" | $save_preseed
 [ -n "$upgrade" ] && echo "d-i pkgsel/upgrade select $upgrade" | $save_preseed
 
@@ -774,7 +878,14 @@ EOF
 
 [ "$bbr" = true ] && in_target '{ echo "net.core.default_qdisc=fq"; echo "net.ipv4.tcp_congestion_control=bbr"; } > /etc/sysctl.d/bbr.conf'
 
-[ -n "$late_command" ] && echo "d-i preseed/late_command string in-target sh -c '$late_command'" | $save_preseed
+[ -n "$cidata" ] && in_target 'echo "{ datasource_list: [ NoCloud ], datasource: { NoCloud: { fs_label: ~ } } }" > /etc/cloud/cloud.cfg.d/99_mandate_nocloud.cfg'
+[ -n "$cidata" ] && in_target 'printf "%s\n%s\n" "policy: disabled" "datasource: NoCloud" > /etc/cloud/ds-identify.cfg'
+
+late_command='true'
+[ -n "$in_target_script" ] && late_command="$late_command; in-target sh -c '$in_target_script'"
+[ -n "$cidata" ] && late_command="$late_command; mkdir -p /target/var/lib/cloud/seed/nocloud; cp -r /cidata/. /target/var/lib/cloud/seed/nocloud/"
+
+echo "d-i preseed/late_command string $late_command" | $save_preseed
 
 [ "$power_off" = true ] && echo 'd-i debian-installer/exit/poweroff boolean true' | $save_preseed
 
@@ -792,6 +903,12 @@ save_grub_cfg='cat'
     gzip -d initrd.gz
     # cpio reads a list of file names from the standard input
     echo preseed.cfg | cpio -o -H newc -A -F initrd
+
+    if [ -n "$cidata" ]; then
+        cp -r "$cidata" cidata
+        find cidata | cpio -o -H newc -A -F initrd
+    fi
+
     gzip -1 initrd
 
     mkdir -p /etc/default/grub.d
@@ -812,9 +929,19 @@ EOF
         # shellcheck disable=SC2016
         echo 'zz_debi=/etc/default/grub.d/zz-debi.cfg; if [ -f "$zz_debi" ]; then . "$zz_debi"; fi' >> /etc/default/grub
         grub_cfg=/boot/grub2/grub.cfg
+        [ -d /sys/firmware/efi ] && grub_cfg=/boot/efi/EFI/*/grub.cfg
         grub2-mkconfig -o "$grub_cfg"
+    elif command_exists grub-mkconfig; then
+        tmp=$(mktemp)
+        grep -vF zz_debi /etc/default/grub > "$tmp"
+        cat "$tmp" > /etc/default/grub
+        rm "$tmp"
+        # shellcheck disable=SC2016
+        echo 'zz_debi=/etc/default/grub.d/zz-debi.cfg; if [ -f "$zz_debi" ]; then . "$zz_debi"; fi' >> /etc/default/grub
+        grub_cfg=/boot/grub/grub.cfg
+        grub-mkconfig -o "$grub_cfg"
     else
-        err 'Could not find "update-grub" or "grub2-mkconfig" command'
+        err 'Could not find "update-grub" or "grub2-mkconfig" or "grub-mkconfig" command'
     fi
 
     save_grub_cfg="tee -a $grub_cfg"