GPT/UEFI Kickstarter configuration

Asclepiadae · September 17, 2026, 9:18pm

Hey I have what I hope is a quick question. I’m building a kickstart file, and am a little confused with how to configure the disk. I know I need

ignoredisk --only-use=disk/by-path/pci-0000:00:1f.2-ata-1
zerombr
clearpart --all --initlabel --drives=disk/by-path/pci-0000:00:1f.2-ata-1 --disklabel gpt

but I’m looking to use UEFI which, according to RH kickstart generator, “Cannot be used with automatic partitioning at the same time” - so I can’t use reqpart?

Is the following sufficient for the boot, swap, and volume partitions and then two logical volumes (for home and everything else)?

part /boot/efi --fstype="efi" --size=512
part /boot --fstype="ext4" --size=512
part swap --hibernation --fstype=swap
part pv.01 --size=1 --grow
volgroup VolGroup00 pv.01
logvol /home --fstype ext4 --name=home --vgname=VolGroup00 --size=10240
logvol / --fstype ext4 --name=rootsys --vgname=VolGroup00 --size=10240 --grow

Do I need the line bootloader --location=? If so is it bootloader --location=gpt rather than mbr?

Full file is provided here for reference.

kickstart.ks

# ============================================================================
# AlmaLinux 10.2 — "minimal" profile — palanaeum (Supermicro X10SLM+-F)
#
# Security posture:
#   * root account locked (no password, no login) — `rootpw --lock`
#   * one admin user in wheel, SSH public-key only, password locked
#   * sshd: no root login, no password auth (drop-in below)
#   * SELinux enforcing, firewalld on, only ssh open until Ansible runs
#
# ============================================================================
# System language
lang en_CA.UTF-8

# Keyboard layouts
keyboard --vckeymap=us --xlayouts='us'

# Time
timezone America/Edmonton --utc
timesource --ntp-server=time.nrc.ca
timesource --ntp-server=time.chu.nrc.ca

# No GUI Installer and do not configure the X Window System
text
skipx

# Reboot after install, disable the Setup Agent on first boot
reboot
firstboot --disable

# ---- Network -----------------------------------------------------------------

network --activate --device=0c:c4:7a:4b:3d:4e --hostname=palanaeum.lan --bootproto=static --ip=10.0.1.3 --netmask=255.255.255.128 --gateway=10.0.1.1 --nameserver=10.0.1.1 --onboot=on
network --activate --device=0c:c4:7a:4b:3d:4f --hostname=palanaeum-storage.lan --bootproto=static --ip=10.0.1.4 --netmask=255.255.255.128 --gateway=10.0.1.1 --nameserver=10.0.1.1 --onboot=on

# ---- Storage -----------------------------------------------------------------
# The X10SLM+-F chipset (C224) SATA controller is PCI 0000:00:1f.2; the SSD is
# on port 1.
ignoredisk --only-use=disk/by-path/pci-0000:00:1f.2-ata-1
# This command is required when performing an unattended installation on a system with previously
# initialized disks.
zerombr
# Clear all partitions and set as gpt
clearpart --all --drives=disk/by-path/pci-0000:00:1f.2-ata-1 --disklabel gpt

part /boot/efi --fstype="efi" --size=512
part /boot --fstype="ext4" --size=512
part swap  --hibernation  --fstype=swap
part pv.01 --size=1 --grow
volgroup VolGroup00 pv.01
logvol /home --fstype ext4 --name=home --vgname=VolGroup00 --size=10240
logvol / --fstype ext4 --name=rootsys --vgname=VolGroup00 --size=10240 --grow

bootloader --location=mbr

# ---- Security ----------------------------------------------------------------
# lock root user
rootpw --lock

# Admin user: password locked => key-only over SSH.
user --name=philip --groups=wheel --lock --gecos="Philip"
sshkey --username=philip "ssh-ed25519 {KEY} philip@palanaeum"

# Start SELinux and firewalld
selinux --enforcing
firewall --enabled --ssh
services --enabled=sshd,chronyd,NetworkManager,firewalld,cockpit.socket

# ---- Packages ----------------------------------------------------------------

# add base repositories with mirrors
repo --name="almalinux10-baseos" --mirrorlist="https://mirrors.almalinux.org/mirrorlist/10/baseos"
repo --name="almalinux10-appstream" --mirrorlist="https://mirrors.almalinux.org/mirrorlist/10/appstream"

# add epel repo (10.2 not default 10.3 which is ahead of distro) with mirrors
repo --name="epel10-everything" --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=epel-10.2&arch=x86_64"

# add CRB with mirrors
repo --name="CRB" --mirrorlist="https://mirrors.almalinux.org/mirrorlist/10/crb/"

# Other repos
repo --name=rpmfusion-free --mirrorlist="https://mirrors.rpmfusion.org/mirrorlist?repo=free-fedora-44&arch=x86_64"
repo --name=rpmfusion-free-updates --mirrorlist="https://mirrors.rpmfusion.org/mirrorlist?repo=free-fedora-updates-released-44&arch=x86_64" --cost=0
repo --name=rpmfusion-nonfree --mirrorlist="https://mirrors.rpmfusion.org/mirrorlist?repo=nonfree-fedora-44&arch=x86_64"
repo --name=rpmfusion-nonfree-updates --mirrorlist="https://mirrors.rpmfusion.org/mirrorlist?repo=nonfree-fedora-updates-released-44&arch=x86_64" --cost=0

%packages --ignoremissing
@^minimal-environment
@headless-management
python3
git-core
tar
chrony
tuned
ipmitool
smartmontools
lm_sensors
%end

# Disable kdump by default, frees up some memory
%addon com_redhat_kdump --disable
%end

# ---- Post --------------------------------------------------------------------
%post --log=/root/ks-post.log
set -euxo pipefail

# sshd hardening drop-in (Ansible manages the same file afterwards).
cat > /etc/ssh/sshd_config.d/50-homelab.conf <<'SSHD'
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
ChallengeResponseAuthentication no
PubkeyAuthentication yes
PermitEmptyPasswords no
X11Forwarding no
AllowAgentForwarding no
AllowTcpForwarding yes
MaxAuthTries 4
LoginGraceTime 30
ClientAliveInterval 300
ClientAliveCountMax 2
AllowGroups wheel
SSHD
chmod 0600 /etc/ssh/sshd_config.d/50-homelab.conf

# Console auto-login and getty on the IPMI serial console for emergencies only.
systemctl enable serial-getty@ttyS1.service || true

# Tuned profile for a storage server.
systemctl enable tuned
tuned-adm profile throughput-performance || true

# Marker for Ansible.
install -d /etc/homelab
echo "kickstart=palanaeum.ks $(date -Is)" > /etc/homelab/provisioned
%end

label · September 18, 2026, 5:22pm

The bootloader line is not required. Anaconda will know that you’re installing on a UEFI system and make the necessary changes. Below is an example from my kickstarts.

ignoredisk --only-use=sda
clearpart --all --initlabel
# Disk partitioning information
part /boot --fstype="xfs" --ondisk=sda --size=1024
part /boot/efi --fstype="efi" --ondisk=sda --size=600 --fsoptions="umask=0077,shortname=winnt"
part pv.111 --fstype="lvmpv" --ondisk=sda --size=44452
volgroup almalinuxvg --pesize=4096 pv.111
logvol / --fstype="xfs" --size=8192 --name=root --vgname=almalinuxvg
logvol /var/log/audit --fstype="xfs" --size=4096 --name=audit --vgname=almalinuxvg
logvol /home --fstype="xfs" --size=4096 --name=home --vgname=almalinuxvg --fsoptions="nodev"
logvol swap --fstype="swap" --size=4096 --name=swap --vgname=almalinuxvg
logvol /tmp --fstype="xfs" --size=4096 --name=tmp --vgname=almalinuxvg --fsoptions="nodev,noexec,nosuid"
logvol /var --fstype="xfs" --size=8192 --name=var --vgname=almalinuxvg
logvol /var/log --fstype="xfs" --size=4096 --name=log --vgname=almalinuxvg

Asclepiadae · September 19, 2026, 12:49am

Ah perfect thanks! Curious now about the efi partition, with --fsoptions="umask=0077,shortname=winnt`". Why is that shortname used?

Also is there any reason to have the swap as a logical volume? I figured a partition (as long as it was sized to match the RAM for hibernation if I ever hibernated the server) would be a cleaner setup.

label · September 19, 2026, 2:29am

They are default options that pyanaconda generates in kickstart.cfg if you’re doing a manual install. I’ve simply kept them.

github.com/rhinstaller/anaconda

pyanaconda/modules/storage/partitioning/custom/custom_partitioning.py

main


      
              kwargs["name"] = partition_data.mountpoint
              partition_data.mountpoint = ""
          
              if devicetree.get_device_by_name(kwargs["name"]):
                  raise StorageError(
                      _("Stratis partition \"{}\" is defined multiple times.").format(kwargs["name"])
                  )
          
              if partition_data.onPart:
                  data.onPart[kwargs["name"]] = partition_data.onPart
          elif partition_data.mountpoint == "/boot/efi":
              ty = "EFI System Partition"
              partition_data.fsopts = "defaults,uid=0,gid=0,umask=077,shortname=winnt"
          else:
              if partition_data.fstype != "":
                  ty = partition_data.fstype
              elif partition_data.mountpoint == "/boot":
                  ty = storage.default_boot_fstype
              else:
                  ty = storage.default_fstype

No reason other than it’s what I’m used to setting up over many years. If you size it in LVM properly the first time, you basically enforce it to be contiguous (attempting to avoid fragmentation). With that said, there is nothing wrong with having a lone partition for it elsewhere if that’s what you prefer.

jlehtone · September 20, 2026, 7:56am

The “efi” partition is a FAT filesystem. man mount writes:

Mount options for vfat

shortname=mode
Defines the behavior for creation and display of filenames which fit into 8.3 characters. If a long name for a file exists, it will always be the preferred one for display. There are four modes:
lower
Force the short name to lower case upon display; store a long name when the short name is not all upper case.
win95
Force the short name to upper case upon display; store a long name when the short name is not all upper case.
winnt
Display the short name as is; store a long name when the short name is not all lower case or all upper case.
mixed
Display the short name as is; store a long name when the short name is not all upper case. This mode is the default since Linux 2.6.32.

I did (re)install one system interactively the other day, and that did store (to /root/anaconda-ks.cfg):

ignoredisk --only-use=sda
# Partition clearing information
clearpart --none --initlabel
# Disk partitioning information
part /boot/efi --fstype="efi" --ondisk=sda --size=600 --fsoptions="umask=0077,shortname=winnt"
part /var/cache/cachefs --fstype="ext4" --ondisk=sda --size=40960
part /opt --fstype="ext4" --ondisk=sda --size=16384
part /boot --fstype="ext4" --ondisk=sda --size=1024
part /mnt/local --fstype="ext4" --ondisk=sda --size=133120
part swap --fstype="swap" --ondisk=sda --size=4096
part / --fstype="ext4" --ondisk=sda --size=40960

(We have all data on NFS …)