# This is a sample configuration file for bilibop-lockfs.

# Here is a partition scheme:
#
# /dev/sdc : USB HDD hosting the running system (250GB)
#     /dev/sdc1 : Physical Volume (20GB)
#                 vg0 : Volume Group with only one PV (/dev/sdc1)
#         /dev/vg0/boot : Logical Volume mounted on /boot (1GB)
#         /dev/vg0/home : Logical Volume mounted on /home (7GB)
#         /dev/vg0/root : Logical Volume mounted on /     (10GB)
#         /dev/vg0/swap : Logical Volume used as swap device (2GB)
#     /dev/sdc2 : FAT32 partition with portable applications for Windows,
#                 no mountpoint (10GB)
#     /dev/sdc3 : Ext4 partition mounted on /var/spool/apt-mirror (100GB)
#     /dev/sdc4 : Primary extended partition
#     /dev/sdc5 : FAT32 logical partition with sorted public data,
#                 no mountpoint (50GB)
#     /dev/sdc6 : FAT32 logical partition with unsorted public data,
#                 no mountpoint (50GB)
#     /dev/sdc7 : LUKS logical partition with private data,
#                 no mountpoint (20GB)
#
# If the lockfs feature is enabled (from the configuration file, from the boot
# commandline or by a heuristic), then the root filesystem will be mounted as
# a readonly branch of an aufs mounted on /. After what all filesystems listed
# in /etc/fstab will be mounted as readonly branches of the corresponding aufs
# mountpoints. For example, the line:
#
# UUID=12345678-9abc-def0-1234-56789abcdef0 /home ext4 nosuid,noatime,nodiratime 0 2
#
# will be replaced by the following three lines:
#
# UUID=12345678-9abc-def0-1234-56789abcdef0 /aufs/ro/home ext4 nosuid,noatime,nodiratime,ro 0 0
# tmpfs /aufs/rw/home tmpfs nosuid,mode=0755 0 0
# none /home aufs br:/aufs/rw/home=rw:/aufs/ro/home=rr 0 0
#
# And the block device with UUID=12345678-9abc-def0-1234-56789abcdef0 will
# be set as read-only with blockdev(8).


## SETTINGS ##

# /dev/sdc2 and /dev/sdc5 to /dev/sdc7 are not listed in /etc/fstab: so,
# they are not managed by bilibop-lockfs.

# Even when bilibop-lockfs is enabled, I want to be able to update the apt
# repository (/dev/sdc3 mounted on /var/spool/apt-mirror) and so I have to
# whitelist it:
BILIBOP_LOCKFS_WHITELIST="/var/spool/apt-mirror"
# or, after 'e2label /dev/sdc3 apt-mirror':
BILIBOP_LOCKFS_WHITELIST="LABEL=apt-mirror"
# The main advantage of the first format is that the filesystem can be
# whitelisted by the initramfs script, because there is no need to query
# metadata about it. But the main advantage of the second format is that
# if you modify mountpoint in /etc/fstab, there is no need to update
# bilibop.conf(5). But if you want the filesystem whitelisted by the
# initramfs script with the second format (LABEL=*), you have to modify
# /etc/fstab as follows:
# LABEL=apt-mirror /var/spool/apt-mirror ext4 defaults 0 2
# Of course, this works with 'UUID=*' too, and of course, the whitelisted
# device must match the fstab entry to be taken into account by the
# initramfs script.
#
# XXX: common mountpoints that can be added in BILIBOP_LOCKFS_WHITELIST
# are /home or /usr/local. Include some mountpoints such as /boot or /usr
# or /var is this variable is a very bad idea. You have been warned.

# By default, bilibop-lockfs disables swap devices if they are not set to
# be encrypted. If I need swap, I have to set it to be encrypted (for that,
# see crypttab(5)), or I have to bypass the default behaviour:
BILIBOP_LOCKFS_SWAP_POLICY="soft"

# If I need sometimes to remount /aufs/ro, /aufs/ro/boot or /aufs/ro/home
# as writable to copy bookmarks in my browser account, modify bilibop.conf
# itself, add some useful settings in /boot/grub/custom.cfg or whatever,
# I have to bypass the 'hard' global policy (but this is not a good idea):
BILIBOP_LOCKFS_POLICY="soft"

# There is no need of a lot of space for /boot:
BILIBOP_LOCKFS_SIZE="/boot=10M"

# I know what I do, and I prefer to use 'df' to query information about
# filesystem status:
BILIBOP_LOCKFS_NOTIFY_POLICY="never"

