use systemd initrd

Signed-off-by: Yǔchēn Guō 郭宇琛 <yguo@posteo.net>

Dockerfile

@@ -1,10 +0,0 @@
-FROM alpine
-
-RUN apk update
-RUN apk add mkpasswd zfs
-
-COPY LICENSE configuration.nix flake.lock flake.nix install.sh ./
-COPY hosts ./
-COPY modules ./
-
-ENTRYPOINT [ "./install.sh" ]

docker-compose.yml

@@ -1,5 +0,0 @@
-version: "3.9"
-services:
-  nixos-zfs-installer:
-    image: marcpartensky/nixos-zfs-installer
-    build: .

flake.nix

@@ -55,7 +55,7 @@
         };
     in {
       nixosConfigurations = {
-        nixos = mkHost "nixos" "x86_64-linux";
+        exampleHost = mkHost "exampleHost" "x86_64-linux";
       };
     };
 }

hosts/exampleHost/default.nix

@@ -5,15 +5,15 @@
       bootDevices = [ "bootDevices_placeholder" ];
       immutable.enable = false;
       removableEfi = true;
-      luks.enable = true;
+      luks.enable = false;
     };
   };
   boot.initrd.availableKernelModules = [ "kernelModules_placeholder" ];
   boot.kernelParams = [ ];
   networking.hostId = "abcd1234";
   # read changeHostName.txt file.
-  networking.hostName = "nixos";
-  time.timeZone = "Europe/Paris";
+  networking.hostName = "exampleHost";
+  time.timeZone = "Europe/Berlin";
 
   # import preconfigured profiles
   imports = [

hosts/nixos/sshUnlock.txt

@@ -1,61 +0,0 @@
-Audience
-
-This text is intended for users who wish to remotely unlock their
-natively encrypted ZFS root filesystem with SSH during the early
-stages of system boot up.
-
-=================================================================
-
-Steps
-
-By default, the initial RAM disk image, (hereafter refered to as
-initrd) only includes essential kernel modules needed for mounting the
-root filesystem.
-
-To enable network connection during this stage of system boot, you
-need to instruct NixOS to include kernel modules needed for the
-network adapter.
-
-Check which module is needed with:
-
-  nix-shell -p pciutils --run "lspci -v | grep -iA8 'network\|ethernet'"
-
-Then, add the the modules to
-
-  zfs-root.boot.availableKernelModules
-
-option inside the per-host configuration file.  This file is located
-at hosts/exampleHost/default.nix.
-
-By default, initrd uses DHCP auto-configuration for networking.  If
-you need to specify a static IP address, see the documentation for
-"ip=" kernel command line option for NFS root:
-
-  https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt
-
-Then, add the necessary kernel command line options to
-
-  zfs-root.boot.kernelParams
-
-option inside the per-host configuration file.
-
-Finally, you need to generate a pair of SSH private keys exclusively
-for use with decrypting the root filesystem during boot.  This pair of
-keys should not be used anywhere else.  Reasons for this can be found
-in the documentation NixOS option:
-
-  boot.initrd.network.ssh.hostKeys
-
-> Do NOT use your regular SSH host private keys for this purpose or
-> you'll expose them to regular users! Additionally, even if your initrd
-> supports secrets, if you're using initrd SSH to unlock an encrypted
-> disk then using your regular host keys exposes the private keys on
-> your unencrypted boot partition.
-
-You can generate host key with:
-
-  ssh-keygen -t ed25519 -N "" -f "/var/lib/ssh_unlock_zfs_ed25519_key"
-  ssh-keygen -t rsa -N "" -f "/var/lib/ssh_unlock_zfs_rsa_key"
-
-If you are performing a system installation, change path from
-/var/lib to /mnt/var/lib in both commands.

install.sh

@@ -1,271 +0,0 @@
-#!/usr/bin/env bash
-
-log() { echo -e "\n\033[1m${@}\033[0m"; }
-
-log Checking root
-mustberoot() {
-    log You must be root
-    exit 1
-}
-whoami | grep root || mustberoot
-
-log Checking connectivity
-curl -s google.com > /dev/null || exit 1
-
-log Loading zfs module first
-modprobe zfs || exit 1
-
-log Installing packages
-nix-env -f '<nixpkgs>' -iA git jq parted fzf
-
-echo ""
-lsblk
-echo ""
-
-# read -p "disk: " DISK
-DISK=`lsblk | grep disk | grep -v SWAP | awk '{print $1}' | fzf`
-DISK=`echo /dev/$DISK`
-log $disk
-read -p "swapsize GiB: " SWAPSIZEGIB
-read -p "reserve GiB: " RESERVEGIB
-read -sp "password: " POOLPASS
-
-EMAIL="marc@marcpartensky.com"
-NAME="Marc Partensky"
-
-RESERVE=$((RESERVEGIB * 1024))
-SWAPSIZE=$((SWAPSIZEGIB * 1024))
-
-
-MNT=$(mktemp -d)
-
-log Destroying zfs pool rpool and bpool just in case
-swapoff -a
-zpool import -fa
-for i in ${DISK}; do
-   zpool labelclear -f $i
-done
-zpool destroy -f bpool
-zpool destroy -f rpool
-zpool export -a
-
-log Unmounting filesystems just in case
-# ---
-umount -Rl "${MNT}"
-
-log Enabling Nix Flakes functionality
-# ---
-mkdir -p ~/.config/nix
-echo "experimental-features = nix-command flakes" >> ~/.config/nix/nix.conf
-
-
-log Installing programs needed for system installation
-
-
-log Partition the disks
-# ---
-partition_disk () {
- local disk=$1
- blkdiscard -f $disk || true
-
- parted --script --align=optimal  $disk -- \
-     mklabel gpt \
-     mkpart swap  1MiB $((SWAPSIZE + 1))MiB \
-     mkpart rpool $((SWAPSIZE + 1))MiB -$((RESERVE + 100))MiB \
-     mkpart bpool -$((RESERVE + 100))MiB -$((RESERVE + 40))MiB \
-     mkpart EFI -$((RESERVE + 40))MiB -$((RESERVE + 2))MiB \
-     mkpart BIOS -$((RESERVE + 2))MiB -$((RESERVE + 1))MiB \
-     set 4 esp on \
-     set 5 bios_grub on \
-     set 5 legacy_boot on
-
- partprobe $disk
- udevadm settle
-}
-
-for i in $DISK; do
-   partition_disk $i || exit 1
-done
-
-log disk $DISK
-
-
-log Creating boot pool
-# ---
-# shellcheck disable=SC2046
-createbpool="zpool create \
-    -o compatibility=grub2 \
-    -o ashift=12 \
-    -o autotrim=on \
-    -O acltype=posixacl \
-    -O canmount=off \
-    -O compression=lz4 \
-    -O devices=off \
-    -O normalization=formD \
-    -O relatime=on \
-    -O xattr=sa \
-    -m /boot \
-    -R $MNT \
-    bpool \
-    `for i in $DISK; do
-       printf '%s ' ${i}p3
-     done`"
-echo $createbpool
-eval $createbpool
-
-
-log Creating root pool
-# ---
-# shellcheck disable=SC2046
-echo $POOLPASS | zpool create \
-    -o ashift=12 \
-    -o autotrim=on \
-    -R $MNT \
-    -O acltype=posixacl \
-    -O canmount=off \
-    -O compression=zstd \
-    -O dnodesize=auto \
-    -O normalization=formD \
-    -O relatime=on \
-    -O xattr=sa \
-    -o feature@encryption=enabled \
-    -O encryption=on \
-    -O keyformat=passphrase \
-    -m / \
-    rpool \
-   $(for i in $DISK; do
-      printf '%s ' "${i}p2";
-     done)
-
-
-log Creating encrypted root system container
-# ---
-echo $POOLPASS | zfs create \
-    -o canmount=off \
-    -o mountpoint=none \
-    -o encryption=on \
-    -o keylocation=prompt \
-    -o keyformat=passphrase \
-    rpool/nixos
-
-
-log Creating system datasets, managing mountpoints with mountpoint=legacy
-# ---
-zfs create -o mountpoint=legacy     rpool/nixos/root
-mount -t zfs rpool/nixos/root "${MNT}"/
-zfs create -o mountpoint=legacy rpool/nixos/home
-mkdir "${MNT}"/home
-mount -t zfs rpool/nixos/home "${MNT}"/home
-zfs create -o mountpoint=legacy  rpool/nixos/var
-zfs create -o mountpoint=legacy rpool/nixos/var/lib
-zfs create -o mountpoint=legacy rpool/nixos/var/log
-zfs create -o mountpoint=none bpool/nixos
-zfs create -o mountpoint=legacy bpool/nixos/root
-mkdir "${MNT}"/boot
-mount -t zfs bpool/nixos/root "${MNT}"/boot
-mkdir -p "${MNT}"/var/log
-mkdir -p "${MNT}"/var/lib
-mount -t zfs rpool/nixos/var/lib "${MNT}"/var/lib
-mount -t zfs rpool/nixos/var/log "${MNT}"/var/log
-zfs create -o mountpoint=legacy rpool/nixos/empty
-zfs snapshot rpool/nixos/empty@start
-
-
-log Formatting and mounting ESP
-# ---
-for i in ${DISK}; do
- mkfs.vfat -n EFI "${i}"p4
- mkdir -p "${MNT}"/boot/efis/"${i##*/}"p4
- mount -t vfat -o iocharset=iso8859-1 "${i}"p4 "${MNT}"/boot/efis/"${i##*/}"p4
-done
-
-
-log Cloning template flake configuration
-# ---
-mkdir -p "${MNT}"/etc
-git clone --depth 1 --branch custom \
-  https://github.com/marcpartensky/nixos-zfs-installer.git "${MNT}"/etc/nixos
-
-rm -rf "${MNT}"/etc/nixos/.git
-git -C "${MNT}"/etc/nixos/ init -b master
-git -C "${MNT}"/etc/nixos/ add "${MNT}"/etc/nixos/
-git -C "${MNT}"/etc/nixos config user.email $EMAIL
-git -C "${MNT}"/etc/nixos config user.name $NAME
-git -C "${MNT}"/etc/nixos commit -nasm 'initial commit'
-
-
-log Customizing configuration to your hardware
-# ---
-for i in ${DISK}; do
-  sed -i \
-  "s|/dev/disk/by-id/|${i%/*}/|" \
-  "${MNT}"/etc/nixos/hosts/nixos/default.nix
-  break
-done
-
-diskNames=""
-for i in ${DISK}; do
-  diskNames="${diskNames} \"${i##*/}\""
-done
-
-sed -i "s|\"bootDevices_placeholder\"|${diskNames}|g" \
-  "${MNT}"/etc/nixos/hosts/nixos/default.nix
-
-sed -i "s|\"abcd1234\"|\"$(head -c4 /dev/urandom | od -A none -t x4| sed 's| ||g' || true)\"|g" \
-  "${MNT}"/etc/nixos/hosts/nixos/default.nix
-
-sed -i "s|\"x86_64-linux\"|\"$(uname -m || true)-linux\"|g" \
-  "${MNT}"/etc/nixos/flake.nix
-
-cp "$(command -v nixos-generate-config || true)" ./nixos-generate-config
-
-chmod a+rwx ./nixos-generate-config
-
-# shellcheck disable=SC2016
-echo 'print STDOUT $initrdAvailableKernelModules' >> ./nixos-generate-config
-
-kernelModules="$(./nixos-generate-config --show-hardware-config --no-filesystems | tail -n1 || true)"
-
-sed -i "s|\"kernelModules_placeholder\"|${kernelModules}|g" \
-  "${MNT}"/etc/nixos/hosts/nixos/default.nix
-
-log Setting root password
-# ---
-rootPwd=$(echo $POOLPASS | mkpasswd -sm SHA-512)
-sed -i \
-"s|rootHash_placeholder|${rootPwd}|" \
-"${MNT}"/etc/nixos/configuration.nix
-
-
-log Commiting changes to local repo
-# ---
-git -C "${MNT}"/etc/nixos commit -asm 'initial installation'
-
-log Updating flake lock file to track latest system version
-# ---
-nix flake update --commit-lock-file \
-  "git+file://${MNT}/etc/nixos"
-
-log Installing system and apply configuration
-# ---
-nixos-install \
---root "${MNT}" \
---no-root-passwd \
---flake "git+file://${MNT}/etc/nixos#nixos"
-
-
-log Setuping encrypted swap. This is useful if the available memory is small
-# ---
-for i in ${DISK}; do
-   cryptsetup open --type plain --key-file /dev/random "${i}"p1 "${i##*/}"p1
-   mkswap /dev/mapper/"${i##*/}"p1
-   swapon /dev/mapper/"${i##*/}"p1
-done
-
-log Unmounting filesystems
-# ---
-umount -Rl "${MNT}"
-zpool export -a
-
-
-log The installation is done, enjoy

modules/boot/default.nix

@@ -41,11 +41,11 @@ in {
     };
     partitionScheme = mkOption {
       default = {
-        swap = "p1";
-        rootPool = "p2";
-        bootPool = "p3";
-        efiBoot = "p4";
-        biosBoot = "p5";
+        biosBoot = "-part5";
+        efiBoot = "-part1";
+        swap = "-part4";
+        bootPool = "-part2";
+        rootPool = "-part3";
       };
       description = "Describe on disk partitions";
       type = types.attrsOf types.str;

modules/networking/default.nix

@@ -1,29 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.zfs-root.networking;
-  inherit (lib) types mkDefault mkOption;
-in {
-  options.zfs-root.networking = {
-    hostName = mkOption {
-      description = "The name of the machine.  Used by nix flake.";
-      type = types.str;
-      default = "nixos";
-    };
-    timeZone = mkOption {
-      type = types.str;
-      default = "Etc/UTC";
-    };
-    hostId = mkOption {
-      description = "Set host id";
-      type = types.str;
-    };
-  };
-  config = {
-    networking.hostId = cfg.hostId;
-    time.timeZone = cfg.timeZone;
-    networking = {
-      firewall.enable = mkDefault true;
-      hostName = cfg.hostName;
-    };
-  };
-}

nixos-generate-config

@@ -1 +0,0 @@
-print STDOUT $initrdAvailableKernelModules