=====PC Engines APU2 - Debian 11, Bullseye=====
**2022-11-12** - This is a manual install guide for updating the BIOS (optional) and installing Debian Bullseye on the PC Engines APU2 board. This is a network based installation, connect internet via Ethernet.


====Documentation====
  * [[https://www.pcengines.ch/apu2.htm]]

====Required hardware====
  * APU2 board
  * Power supply
  * Internet over Ethernet
  * Serial (via Serial<->USB adapter)
  * mSATA SSD

====Update BIOS (optional)====
  * Download the latest BIOS for your version of the board here: [[https://pcengines.github.io/]].
  * Download the [[http://pcengines.ch/file/apu2-tinycore6.4.img.gz|TinyCore image]]. 
  * Write image to USB flash drive. <code>zcat apu2-tinycore6.4.img.gz | sudo dd of=/dev/sdX bs=1M conv=fsync status=progress</code>
  * Mount the USB flash drive. <code>sudo mount /dev/sda1 /mnt</code>
  * Copy rom to flash:<code>sudo cp apu2_v4.17.0.2.rom /mnt</code>
  * Unmount the flash drive.<code>sudo umount /mnt</code>
  * Connect APU2 serial console.
  * Boot the APU2 board from USB media (F10).
  * If you see a lot of messages like below, just ctrl-c:<code>FAT partition not mounted yet, retrying since 3 s
FAT partition not mounted yet, retrying since 6 s^C</code>
  * Flash the BIOS and reboot when finished:<code>cd /media/SYSLINUX
flashrom -p internal -w apu2_v4.17.0.2.rom

reboot

...
PC Engines apu2
coreboot build 20222807
BIOS version v4.17.0.2
4080 MB ECC DRAM

...
</code>
====Install Debian 11====
  * Download amd64 netinst ISO: [[https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/debian-11.5.0-amd64-netinst.iso]]
  * Copy image to USB drive:<code>sudo dd if=debian-11.5.0-amd64-netinst.iso of=/dev/sdX bs=4k oflag=direct status=progress</code>
  * Unmount USB drive.
  * Boot APU2 from USB.
  * Press ''h'' and <ENTER>. \\ {{::debian-serial.png?nolink|}}
  * Then enter the following 'install' command:<code>#Press F2 through F10 for details, or ENTER to boot: 
install vga=off console=ttyS0,115200n8</code>
  * Press <ENTER> to start install.
  * During install, deselect any desktop environment and select the ''SSH server'' and ''standard system utilities''.
  * At first reboot, you'll get the following error:<code>vga= is deprecated. Use set gfxpayload=text before linux command instead.</code>
  * Edit ''/etc/default/grub'', change ''vga=off'' into ''gfxpayload=text'' and run update-grub.

====Post-install====
===Firewall===
  * Configure default firewall<code>cp /usr/share/doc/nftables/examples/workstation.nft /etc/nftables.conf
vi /etc/nftables.conf
systemctl enable --now nftables
</code>
===Update===
  * Update system.<code>apt update
apt upgrade</code>
===LEDs===
Configure front LEDs to blink on network and disk activity.
  * Add modules to ''/etc/modules''.<code>ledtrig-default-on
ledtrig-netdev
ledtrig-heartbeat</code>
  * Load modules with ''modprobe''.
  * Add tmpfiles config:<code>
cat > /etc/tmpfiles.d/apuled.conf <<EOF
w /sys/class/leds/apu2:green:led1/trigger - - - - default-on
w /sys/class/leds/apu2:green:led2/trigger - - - - disk-activity
w /sys/class/leds/apu2:green:led3/trigger - - - - netdev
w /sys/class/leds/apu2:green:led3/rx - - - - 1
w /sys/class/leds/apu2:green:led3/tx - - - - 1
w /sys/class/leds/apu2:green:led3/device_name - - - - enp1s0
EOF
</code>
===Watchdog===
  * Enable watchdog in BIOS, set timeout for example to 300 seconds.
  * Disable i2c_piix4 [[https://pcengines.github.io/apu2-documentation/theory-of-operation/]]<code>cat > /etc/modprobe.d/noi2c.conf <<EOF
# Disable i2c_piix4, see https://pcengines.github.io/apu2-documentation/theory-of-operation/
blacklist i2c_piix4
EOF</code>
  * Update initramfs.<code>update-initramfs -u</code>
  * Edit ''/etc/systemd/system.conf'' and enable watchdog.<code>RuntimeWatchdogSec=60</code>
  * Reboot
  * Test the watchdog by pausing the init process. It should reboot after the configured timeout.<code>gdb -p 1</code>


{{tag>[hardware apu debian linux ]}}