Debian Preseed Guide: Automate Installer Questions Safely

Preseed automates questions, not outcomes. The safest workflow records exactly when each answer is loaded, tests the target disk policy on every hardware class, and boots the installed system before release.

Debian Installer is built from components that ask debconf questions. A preseed file supplies answers and marks those dialogs as seen. The current Debian Installer preseeding introduction documents three delivery methods: initrd, file, and network. Their timing matters because an answer cannot control a question that was already processed.

A small preseed file with visible risks

### Locale and network
d-i debian-installer/locale string en_US.UTF-8
d-i keyboard-configuration/xkb-keymap select us
d-i netcfg/choose_interface select auto
d-i netcfg/get_hostname string edge-01

### Mirror and accounts
d-i mirror/country string manual
d-i mirror/http/hostname string deb.debian.org
d-i passwd/root-login boolean false
d-i passwd/user-fullname string Operations
d-i passwd/username string ops
d-i passwd/user-password-crypted password $6$REPLACE_WITH_SHA512_CRYPT

### Storage: review the target disk for every hardware class
d-i partman-auto/disk string /dev/vda
d-i partman-auto/method string lvm
d-i partman-auto/choose_recipe select atomic
d-i partman/confirm boolean true
d-i partman/confirm_nooverwrite boolean true

### Packages and final command
tasksel tasksel/first multiselect standard, ssh-server
d-i pkgsel/include string curl jq prometheus-node-exporter
d-i preseed/late_command string in-target systemctl enable prometheus-node-exporter

The disk line is intentionally easy to spot. Debian warns that disk identification can depend on driver load order. /dev/vdamay be right for one virtual machine and wrong for another target. Keep partition confirmation answers near the selector so reviewers see the destructive action as one policy.

Use auto mode to delay early questions

Debian's Preseed loading guide explains that auto mode delays locale and keyboard questions until networking has had a chance to load a network preseed. It also raises debconf priority so lower-priority questions do not stop the install. A typical network boot entry includes auto=true, priority=critical, and a trusted preseed/url.

Do not put reusable secrets on an unauthenticated HTTP endpoint. A preseed can contain password hashes, repository credentials, and late commands. Limit who can fetch it, keep logs from recording sensitive query strings, and prefer short-lived per-build material.

Acceptance checks for the installed disk

• The machine boots with the installer media removed.
• The intended user can authenticate and direct root login follows policy.
• The root filesystem is on the expected disk and has the expected LVM shape.
• The package set contains the required service without an unintended desktop task.
• The service listens after a second reboot, not only after late_command ran.

Those checks are portable even if Preseed is later replaced. Store the machine behavior separately from debconf syntax, then express the same contract in an Ubuntu Autoinstall file, a Kickstart file, or an OpenFactory recipe without losing the release criteria.