2022-11-12 - This is a manual install guide for updating the BIOS (optional) and installing Debian Bullseye on the PC Engines APU2 board. This is a network based installation, connect internet via Ethernet.

• https://www.pcengines.ch/apu2.htm

• APU2 board
• Power supply
• Internet over Ethernet
• Serial (via Serial↔USB adapter)
• mSATA SSD

• Download the latest BIOS for your version of the board here: https://pcengines.github.io/.
• Download the TinyCore image.
• Write image to USB flash drive.

  zcat apu2-tinycore6.4.img.gz | sudo dd of=/dev/sdX bs=1M conv=fsync status=progress

• Mount the USB flash drive.

  sudo mount /dev/sda1 /mnt

• Copy rom to flash:

  sudo cp apu2_v4.17.0.2.rom /mnt

• Unmount the flash drive.

  sudo umount /mnt

• Connect APU2 serial console.
• Boot the APU2 board from USB media (F10).
• If you see a lot of messages like below, just ctrl-c:

  FAT partition not mounted yet, retrying since 3 s
  FAT partition not mounted yet, retrying since 6 s^C

• Flash the BIOS and reboot when finished:

  cd /media/SYSLINUX
  flashrom -p internal -w apu2_v4.17.0.2.rom
  
  reboot
  
  ...
  PC Engines apu2
  coreboot build 20222807
  BIOS version v4.17.0.2
  4080 MB ECC DRAM
  
  ...

• Download amd64 netinst ISO: https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/debian-11.5.0-amd64-netinst.iso
• Copy image to USB drive:

  sudo dd if=debian-11.5.0-amd64-netinst.iso of=/dev/sdX bs=4k oflag=direct status=progress

• Unmount USB drive.
• Boot APU2 from USB.
• Press h and <ENTER>.
  
• Then enter the following 'install' command:

  #Press F2 through F10 for details, or ENTER to boot: 
  install vga=off console=ttyS0,115200n8

• Press <ENTER> to start install.
• During install, deselect any desktop environment and select the SSH server and standard system utilities.
• At first reboot, you'll get the following error:

  vga= is deprecated. Use set gfxpayload=text before linux command instead.

• Edit /etc/default/grub, change vga=off into gfxpayload=text and run update-grub.

• Configure default firewall

  cp /usr/share/doc/nftables/examples/workstation.nft /etc/nftables.conf
  vi /etc/nftables.conf
  systemctl enable --now nftables

• Update system.

  apt update
  apt upgrade

Configure front LEDs to blink on network and disk activity.

• Add modules to /etc/modules.

  ledtrig-default-on
  ledtrig-netdev
  ledtrig-heartbeat

• Load modules with modprobe.
• Add tmpfiles config:

  cat > /etc/tmpfiles.d/apuled.conf <<EOF
  w /sys/class/leds/apu2:green:led1/trigger - - - - default-on
  w /sys/class/leds/apu2:green:led2/trigger - - - - disk-activity
  w /sys/class/leds/apu2:green:led3/trigger - - - - netdev
  w /sys/class/leds/apu2:green:led3/rx - - - - 1
  w /sys/class/leds/apu2:green:led3/tx - - - - 1
  w /sys/class/leds/apu2:green:led3/device_name - - - - enp1s0
  EOF

• Enable watchdog in BIOS, set timeout for example to 300 seconds.
• Disable i2c_piix4 https://pcengines.github.io/apu2-documentation/theory-of-operation/

  cat > /etc/modprobe.d/noi2c.conf <<EOF
  # Disable i2c_piix4, see https://pcengines.github.io/apu2-documentation/theory-of-operation/
  blacklist i2c_piix4
  EOF

• Update initramfs.

  update-initramfs -u

• Edit /etc/systemd/system.conf and enable watchdog.

  RuntimeWatchdogSec=60

• Reboot
• Test the watchdog by pausing the init process. It should reboot after the configured timeout.

  gdb -p 1