Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
8f48493bf8 | ||
|
|
d3d458a4a6 | ||
|
|
30d2cdbf18 | ||
|
|
2302cbee07 | ||
|
|
f80174f820 | ||
|
|
cf975eefe8 | ||
|
|
52072180e2 | ||
|
|
3e858f3a62 | ||
|
|
06cbf3c69e | ||
|
|
d1ca41c9c6 | ||
|
|
8834abb11f | ||
|
|
4b37e71c7b | ||
|
|
f69764d3b0 | ||
|
|
906869e696 | ||
|
|
d203a9394a | ||
|
|
84b574cc94 | ||
|
|
39b1343c21 | ||
|
|
1b7c48f812 | ||
|
|
0c8b386c04 | ||
|
|
aab0054896 | ||
|
|
c271d086c9 | ||
|
|
72ede67564 | ||
|
|
f86fa42ec1 | ||
|
|
88ca30da73 | ||
|
|
5bda3eb8a6 | ||
|
|
9404cdd55e | ||
|
|
98e44f40b2 | ||
|
|
9da30ef535 | ||
|
|
44de68db6b | ||
|
|
71ead633de | ||
|
|
f9db5b6a28 | ||
|
|
6f13522f52 | ||
|
|
aba9b0789e | ||
|
|
c3545e93db | ||
|
|
bfcd43ff13 | ||
|
|
abcb04846a | ||
|
|
3885a679ef | ||
|
|
7f382c30df | ||
|
|
ab2fe7d036 | ||
|
|
2dec9664e6 | ||
|
|
e267a91a51 | ||
|
|
99f6130b5e | ||
|
|
94bb015b81 | ||
|
|
6c3ee63e22 | ||
|
|
37dd78c236 | ||
|
|
634821da31 | ||
|
|
054c944dbc | ||
|
|
c3c135bd7c | ||
|
|
2aec10d69f | ||
|
|
a114e9ddb9 | ||
|
|
dda312c598 | ||
|
|
422bd28822 | ||
|
|
773f4cb407 | ||
|
|
e64e3adcd1 | ||
|
|
054d8889c9 | ||
|
|
343eb10b05 | ||
|
|
1c5feaa451 | ||
|
|
245f279a2e | ||
|
|
4c66642ba6 | ||
|
|
00879f3e15 | ||
|
|
f4e673b746 | ||
|
|
bc817489de | ||
|
|
1f1bd39c95 | ||
|
|
7d4677e733 | ||
|
|
f30e2c3251 | ||
|
|
e68d52d626 | ||
|
|
ebfadf1ee3 | ||
|
|
4b00071d59 | ||
|
|
5e3e6bccb2 | ||
|
|
f2624feaef | ||
|
|
7babdb2592 | ||
|
|
560844cd49 | ||
|
|
917cb9fede | ||
|
|
03a91d16ca | ||
|
|
036ba8fdbf | ||
|
|
4a82b5fa6c | ||
|
|
4d625910d3 | ||
|
|
a03749f995 | ||
|
|
ac29dcaa09 | ||
|
|
7d4bb67c3b | ||
|
|
16be42651c | ||
|
|
ad1d13112d | ||
|
|
9a4eb4554d | ||
|
|
b197a375ce | ||
|
|
f1ccf0c7bf |
+7
-8
@@ -1,4 +1,4 @@
|
||||
* Minimal installer for NixOS using ZFS encrypted root
|
||||
* Minimal NixOS Root on ZFS configuration
|
||||
This repo contains a minimal set of configuration needed for
|
||||
installing NixOS on a computer with ZFS as root filesystem.
|
||||
|
||||
@@ -8,18 +8,17 @@ LICENSE
|
||||
configuration.nix <- configuration shared by all hosts
|
||||
flake.lock
|
||||
flake.nix
|
||||
hosts/nixos/default.nix <- per-host configuration
|
||||
hosts/nixos/sshUnlock.txt
|
||||
hosts/exampleHost/default.nix <- per-host configuration
|
||||
hosts/exampleHost/sshUnlock.txt
|
||||
modules/boot/default.nix
|
||||
modules/default.nix
|
||||
modules/fileSystems/default.nix
|
||||
modules/networking/default.nix
|
||||
modules/users/default.nix
|
||||
#+end_src text
|
||||
#+end_src
|
||||
|
||||
* Thanks to
|
||||
See [[https://github.com/ne9z/personal-dotfiles][ne9z dotfiles repo]] for an example of how to configure
|
||||
Just enough to get you started.
|
||||
|
||||
See [[https://github.com/ne9z/personal-dotfiles][my personal dotfiles repo]] for an example of how to configure
|
||||
servers and desktop computers in the same git repository, based on
|
||||
this template repo you are viewing now.
|
||||
|
||||
[[https://openzfs.github.io/openzfs-docs/Getting%20Started/NixOS/Root%20on%20ZFS.html][Official Tutorial]]
|
||||
|
||||
+182
-7
@@ -1,4 +1,12 @@
|
||||
{ my-config, zfs-root, inputs, pkgs, lib, ... }: {
|
||||
{
|
||||
my-config, zfs-root, inputs, pkgs, lib, ...
|
||||
}:
|
||||
let
|
||||
kubeMasterIP = "10.1.1.2";
|
||||
kubeMasterHostname = "api.kube";
|
||||
kubeMasterAPIServerPort = 6443;
|
||||
in
|
||||
{
|
||||
# load module config to top-level configuration
|
||||
inherit my-config zfs-root;
|
||||
|
||||
@@ -10,16 +18,50 @@
|
||||
throw "refuse to build: git tree is dirty";
|
||||
|
||||
system.stateVersion = "22.11";
|
||||
|
||||
system.activationScripts = {
|
||||
enableLingering = ''
|
||||
# remove all existing lingering users
|
||||
rm -r /var/lib/systemd/linger
|
||||
mkdir /var/lib/systemd/linger
|
||||
# enable for the subset of declared users
|
||||
touch /var/lib/systemd/linger/marc
|
||||
'';
|
||||
};
|
||||
|
||||
virtualisation.docker.enable = true;
|
||||
|
||||
# Enable NetworkManager for wireless networking,
|
||||
# You can configure networking with "nmtui" command.
|
||||
networking.useDHCP = true;
|
||||
networking.networkmanager.enable = false;
|
||||
# networking.useDHCP = true;
|
||||
networking.hostName = "tower";
|
||||
networking.networkmanager.enable = true;
|
||||
networking.wireless.iwd.enable = true;
|
||||
networking.networkmanager.wifi.backend = "iwd";
|
||||
|
||||
services.xserver.enable = true;
|
||||
services.xserver.displayManager.gdm.enable = true;
|
||||
|
||||
hardware.pulseaudio.enable = true;
|
||||
hardware.bluetooth.enable = true;
|
||||
programs.hyprland.enable = true;
|
||||
|
||||
users.users = {
|
||||
root = {
|
||||
initialHashedPassword = "rootHash_placeholder";
|
||||
openssh.authorizedKeys.keys = [ "sshKey_placeholder" ];
|
||||
isNormalUser = false;
|
||||
shell = pkgs.zsh;
|
||||
initialHashedPassword = "$6$0QAYnBqAJtqB12p3$2lb7rAS2sYw49GUJt0L0bAEpZJSv4HZARQjlbYPhexSmeRB71IRMBzXjf3b4rX6fuDxOuDLydP/Kni9uraS5j/";
|
||||
openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDiUE73uIEgijfmSsDwBvZmecQnqjBUPRKlMDmevsThc1YJNWEHl57NNIUcx6XSCDPKu5azayImLqIBt8wT5xlqtNX20uCnikDfXZ8gFbGlMRTGZKutQZIRmUrUS5mz97S4dVVK+n5WU+OwOfEg/XKXPh4WbTVDpfTTg7RopRAXkma56HV2TJM0ndPRN8VLmBmtnwdQwEpJ0tRRY+KOHmTojsH65eaZ89+BHbto+Kg+lk6x8IH5VDCRQNHgTEccOpOGYBSHRpoZi1a5h3yajf/eGAQ9Cd38DOsfMtm84oFlii7oXPyxwXoM+uH1SDnvLXyheIrV/XLUurSbEb4aJni6Zu79Z9l8xHhUNmVNSZqWOWUvPbAHlDKUzsbxgk9Zs9OTvSDaRzGhViYl4e1Qc993yerGSW1HHIvYUKM7o5nSQqskSOvOI+ahL5fIbgdyVx4FeuURZIyZSxCz4jIJTK15/6pkT/miHKv+vmQhsoLCqgyXY4SG1p9ruzKkzBe03ZQVW5WeFDLYRjZ+Z4Q2IL2K3BmLgp8tInkPJizQ7v5UGSiajJmPxY0j+CqdH9ZlIBdf8GS+run/N4hpMC1/ayUZRbCY5jg4c8bev8dKEZYJKPs/Hq2zLRZe4YtxcKuiGhgIwQOzo/QrCvSM4pVDgo+d2DjEzIdapqE8hF6BHWDg/w== marc.partensky@gmail.com" ];
|
||||
};
|
||||
marc = {
|
||||
isNormalUser = true;
|
||||
home = "/home/marc";
|
||||
description = "Marc Partensky";
|
||||
extraGroups = ["wheel" "networkmanager" "docker" "seat" "kvm" "video"];
|
||||
# openssh.authorizedKeys.keys =
|
||||
shell = pkgs.zsh;
|
||||
initialHashedPassword = "$6$0QAYnBqAJtqB12p3$2lb7rAS2sYw49GUJt0L0bAEpZJSv4HZARQjlbYPhexSmeRB71IRMBzXjf3b4rX6fuDxOuDLydP/Kni9uraS5j/";
|
||||
openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDiUE73uIEgijfmSsDwBvZmecQnqjBUPRKlMDmevsThc1YJNWEHl57NNIUcx6XSCDPKu5azayImLqIBt8wT5xlqtNX20uCnikDfXZ8gFbGlMRTGZKutQZIRmUrUS5mz97S4dVVK+n5WU+OwOfEg/XKXPh4WbTVDpfTTg7RopRAXkma56HV2TJM0ndPRN8VLmBmtnwdQwEpJ0tRRY+KOHmTojsH65eaZ89+BHbto+Kg+lk6x8IH5VDCRQNHgTEccOpOGYBSHRpoZi1a5h3yajf/eGAQ9Cd38DOsfMtm84oFlii7oXPyxwXoM+uH1SDnvLXyheIrV/XLUurSbEb4aJni6Zu79Z9l8xHhUNmVNSZqWOWUvPbAHlDKUzsbxgk9Zs9OTvSDaRzGhViYl4e1Qc993yerGSW1HHIvYUKM7o5nSQqskSOvOI+ahL5fIbgdyVx4FeuURZIyZSxCz4jIJTK15/6pkT/miHKv+vmQhsoLCqgyXY4SG1p9ruzKkzBe03ZQVW5WeFDLYRjZ+Z4Q2IL2K3BmLgp8tInkPJizQ7v5UGSiajJmPxY0j+CqdH9ZlIBdf8GS+run/N4hpMC1/ayUZRbCY5jg4c8bev8dKEZYJKPs/Hq2zLRZe4YtxcKuiGhgIwQOzo/QrCvSM4pVDgo+d2DjEzIdapqE8hF6BHWDg/w== marc.partensky@gmail.com" ];
|
||||
};
|
||||
};
|
||||
|
||||
@@ -36,24 +78,157 @@
|
||||
|
||||
services.openssh = {
|
||||
enable = lib.mkDefault true;
|
||||
settings = { PasswordAuthentication = lib.mkDefault false; };
|
||||
settings = { PasswordAuthentication = lib.mkDefault true; };
|
||||
};
|
||||
|
||||
# kubernetes https://nixos.wiki/wiki/K3s
|
||||
networking.firewall.allowedTCPPorts = [ 6443 5900 ];
|
||||
# services.k3s = {
|
||||
# enable = true;
|
||||
# role = "server";
|
||||
# # TODO describe how to enable zfs snapshotter in containerd
|
||||
# extraFlags = toString [
|
||||
# "--container-runtime-endpoint unix:///run/containerd/containerd.sock"
|
||||
# ];
|
||||
# };
|
||||
|
||||
# kubernetes zfs support
|
||||
# virtualisation.containerd = {
|
||||
# enable = true;
|
||||
# settings =
|
||||
# let
|
||||
# fullCNIPlugins = pkgs.buildEnv {
|
||||
# name = "full-cni";
|
||||
# paths = with pkgs;[
|
||||
# cni-plugins
|
||||
# cni-plugin-flannel
|
||||
# ];
|
||||
# };
|
||||
# in {
|
||||
# plugins."io.containerd.grpc.v1.cri".cni = {
|
||||
# bin_dir = "${fullCNIPlugins}/bin";
|
||||
# conf_dir = "/var/lib/rancher/k3s/agent/etc/cni/net.d/";
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
|
||||
# kubernetes support
|
||||
# resolve master hostname
|
||||
# networking.extraHosts = "${kubeMasterIP} ${kubeMasterHostname}";
|
||||
|
||||
|
||||
# services.kubernetes = {
|
||||
# roles = ["master" "node"];
|
||||
# masterAddress = kubeMasterHostname;
|
||||
# apiserverAddress = "https://${kubeMasterHostname}:${toString kubeMasterAPIServerPort}";
|
||||
# easyCerts = true;
|
||||
# apiserver = {
|
||||
# securePort = kubeMasterAPIServerPort;
|
||||
# advertiseAddress = kubeMasterIP;
|
||||
# };
|
||||
|
||||
# # use coredns
|
||||
# addons.dns.enable = true;
|
||||
|
||||
# # needed if you use swap
|
||||
# kubelet.extraOpts = "--fail-swap-on=false";
|
||||
# };
|
||||
|
||||
boot.zfs.forceImportRoot = lib.mkDefault false;
|
||||
|
||||
nix.settings.experimental-features = lib.mkDefault [ "nix-command" "flakes" ];
|
||||
|
||||
programs.git.enable = true;
|
||||
programs.zsh.enable = true;
|
||||
|
||||
security = {
|
||||
doas.enable = lib.mkDefault true;
|
||||
sudo.enable = lib.mkDefault false;
|
||||
};
|
||||
|
||||
nix = {
|
||||
package = pkgs.nixFlakes;
|
||||
extraOptions = ''
|
||||
experimental-features = nix-command flakes
|
||||
'';
|
||||
};
|
||||
|
||||
systemd.services.tunneltower = {
|
||||
enable = true;
|
||||
description = "Connect to my tower remotely";
|
||||
unitConfig = {
|
||||
# Type = "simple";
|
||||
};
|
||||
serviceConfig = {
|
||||
ExecStart = ''
|
||||
${pkgs.autossh}/bin/autossh -M 0 \
|
||||
-o ServerAliveInterval=30 \
|
||||
-o ServerAliveCountMax=3 \
|
||||
-o PubkeyAuthentication=yes \
|
||||
-o PasswordAuthentication=no \
|
||||
-NR localhost:42070:localhost:22 \
|
||||
-p 42069 \
|
||||
-i ~/.ssh/id_rsa \
|
||||
marc@207.180.235.56
|
||||
'';
|
||||
};
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
|
||||
environment.systemPackages = builtins.attrValues {
|
||||
inherit (pkgs)
|
||||
mg # emacs-like editor
|
||||
k3s
|
||||
autossh
|
||||
jq # other programs
|
||||
neovim
|
||||
stow
|
||||
coreutils
|
||||
gnumake
|
||||
bat
|
||||
gnupg
|
||||
home-manager
|
||||
htop
|
||||
kompose
|
||||
kubectl
|
||||
kubernetes
|
||||
killall
|
||||
seatd
|
||||
mcfly
|
||||
sddm
|
||||
;
|
||||
};
|
||||
|
||||
|
||||
i18n.defaultLocale = "fr_FR.UTF-8";
|
||||
i18n.extraLocaleSettings = {
|
||||
LC_ADDRESS = "fr_FR.UTF-8";
|
||||
LC_IDENTIFICATION = "fr_FR.UTF-8";
|
||||
LC_MEASUREMENT = "fr_FR.UTF-8";
|
||||
LC_MONETARY = "fr_FR.UTF-8";
|
||||
LC_NAME = "fr_FR.UTF-8";
|
||||
LC_NUMERIC = "fr_FR.UTF-8";
|
||||
LC_PAPER = "fr_FR.UTF-8";
|
||||
LC_TELEPHONE = "fr_FR.UTF-8";
|
||||
LC_TIME = "fr_FR.UTF-8";
|
||||
};
|
||||
|
||||
environment.sessionVariables = {
|
||||
# POLKIT_AUTH_AGENT = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1";
|
||||
# GSETTINGS_SCHEMA_DIR = "${pkgs.gsettings-desktop-schemas}/share/gsettings-schemas/${pkgs.gsettings-desktop-schemas.name}/glib-2.0/schemas";
|
||||
# LIBVA_DRIVER_NAME = "nvidia";
|
||||
# XDG_SESSION_TYPE = "wayland";
|
||||
# GBM_BACKEND = "nvidia-drm";
|
||||
# __GLX_VENDOR_LIBRARY_NAME = "nvidia";
|
||||
# WLR_NO_HARDWARE_CURSORS = "1";
|
||||
# NIXOS_OZONE_WL = "1";
|
||||
# MOZ_ENABLE_WAYLAND = "1";
|
||||
# SDL_VIDEODRIVER = "wayland";
|
||||
# _JAVA_AWT_WM_NONREPARENTING = "1";
|
||||
# CLUTTER_BACKEND = "wayland";
|
||||
# WLR_RENDERER = "vulkan";
|
||||
# XDG_CURRENT_DESKTOP = "Hyprland";
|
||||
# XDG_SESSION_DESKTOP = "Hyprland";
|
||||
# GTK_USE_PORTAL = "1";
|
||||
# NIXOS_XDG_OPEN_USE_PORTAL = "1";
|
||||
};
|
||||
}
|
||||
|
||||
Generated
+3
-3
@@ -2,11 +2,11 @@
|
||||
"nodes": {
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1685533922,
|
||||
"narHash": "sha256-y4FCQpYafMQ42l1V+NUrMel9RtFtZo59PzdzflKR/lo=",
|
||||
"lastModified": 1687466461,
|
||||
"narHash": "sha256-oupXI7g7RPzlpGUfAu1xG4KBK53GrZH8/xeKgKDB4+Q=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "3a70dd92993182f8e514700ccf5b1ae9fc8a3b8d",
|
||||
"rev": "ecb441f22067ba1d6312f4932a7c64efa8d19a7b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
||||
@@ -18,10 +18,10 @@
|
||||
};
|
||||
in {
|
||||
nixosConfigurations = {
|
||||
nixos = let
|
||||
tower = let
|
||||
system = "x86_64-linux";
|
||||
pkgs = nixpkgs.legacyPackages.${system};
|
||||
in mkHost (import ./hosts/nixos { inherit system pkgs; });
|
||||
in mkHost (import ./hosts/tower { inherit system pkgs; });
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# #
|
||||
##
|
||||
## per-host configuration for nixos host
|
||||
## per-host configuration for exampleHost
|
||||
##
|
||||
##
|
||||
|
||||
@@ -8,10 +8,10 @@
|
||||
inherit pkgs system;
|
||||
zfs-root = {
|
||||
boot = {
|
||||
devNodes = "/dev/disk/by-id/";
|
||||
bootDevices = [ "bootDevices_placeholder" ];
|
||||
devNodes = "/dev/";
|
||||
bootDevices = [ "nvme0n1" ];
|
||||
immutable = false;
|
||||
availableKernelModules = [ "kernelModules_placeholder" ];
|
||||
availableKernelModules = [ "nvme" "xhci_pci" "usbhid" "usb_storage" "sd_mod" ];
|
||||
removableEfi = true;
|
||||
kernelParams = [ ];
|
||||
sshUnlock = {
|
||||
@@ -22,9 +22,9 @@
|
||||
};
|
||||
networking = {
|
||||
# read changeHostName.txt file.
|
||||
hostName = "nixos";
|
||||
hostName = "tower";
|
||||
timeZone = "Europe/Paris";
|
||||
hostId = "abcd1234";
|
||||
hostId = "97a4a6a0";
|
||||
};
|
||||
};
|
||||
|
||||
-251
@@ -1,251 +0,0 @@
|
||||
#!/bin/env bash
|
||||
|
||||
lsblk
|
||||
echo ""
|
||||
|
||||
read -p "disk: " DISK
|
||||
read -p "swapsize GiB: " SWAPSIZEGIB
|
||||
read -p "reserve GiB: " RESERVEGIB
|
||||
read -sp "password: " POOLPASS
|
||||
|
||||
EMAIL="marc@marcpartensky.com"
|
||||
NAME="Marc Partensky"
|
||||
|
||||
RESERVE=$((RESERVEGIB * 1024))
|
||||
SWAPSIZE=$((SWAPSIZEGIB * 1024))
|
||||
|
||||
|
||||
MNT=$(mktemp -d)
|
||||
|
||||
log() { echo -e "\n\033[1m${@}\033[0m"; }
|
||||
|
||||
log Destroying zfs pool rpool and bpool just in case
|
||||
swapoff -a
|
||||
zpool import -fa
|
||||
for i in ${DISK}; do
|
||||
zpool labelclear -f $i
|
||||
done
|
||||
zpool destroy -f bpool
|
||||
zpool destroy -f rpool
|
||||
zpool export -a
|
||||
|
||||
log Unmounting filesystems just in case
|
||||
# ---
|
||||
umount -Rl "${MNT}"
|
||||
|
||||
log Enabling Nix Flakes functionality
|
||||
# ---
|
||||
mkdir -p ~/.config/nix
|
||||
echo "experimental-features = nix-command flakes" >> ~/.config/nix/nix.conf
|
||||
|
||||
|
||||
log Installing programs needed for system installation
|
||||
# ---
|
||||
if ! command -v git; then nix-env -f '<nixpkgs>' -iA git; fi
|
||||
if ! command -v jq; then nix-env -f '<nixpkgs>' -iA jq; fi
|
||||
if ! command -v partprobe; then nix-env -f '<nixpkgs>' -iA parted; fi
|
||||
|
||||
|
||||
log Partition the disks
|
||||
# ---
|
||||
partition_disk () {
|
||||
local disk="${1}"
|
||||
blkdiscard -f "${disk}" || true
|
||||
|
||||
parted --script --align=optimal "${disk}" -- \
|
||||
mklabel gpt \
|
||||
mkpart swap 1MiB $((SWAPSIZE + 1))MiB \
|
||||
mkpart rpool $((SWAPSIZE + 1))MiB -$((RESERVE + 100))MiB \
|
||||
mkpart bpool -$((RESERVE + 100))MiB -$((RESERVE + 3))MiB \
|
||||
mkpart EFI -$((RESERVE + 3))MiB -$((RESERVE + 2))MiB \
|
||||
mkpart BIOS -$((RESERVE + 2))MiB -$((RESERVE + 1))MiB \
|
||||
set 4 esp on \
|
||||
set 5 bios_grub on \
|
||||
set 5 legacy_boot on
|
||||
|
||||
partprobe "${disk}"
|
||||
udevadm settle
|
||||
}
|
||||
|
||||
for i in ${DISK}; do
|
||||
partition_disk "${i}"
|
||||
done
|
||||
|
||||
|
||||
log Creating boot pool
|
||||
# ---
|
||||
# shellcheck disable=SC2046
|
||||
zpool create \
|
||||
-o compatibility=grub2 \
|
||||
-o ashift=12 \
|
||||
-o autotrim=on \
|
||||
-O acltype=posixacl \
|
||||
-O canmount=off \
|
||||
-O compression=lz4 \
|
||||
-O devices=off \
|
||||
-O normalization=formD \
|
||||
-O relatime=on \
|
||||
-O xattr=sa \
|
||||
-O mountpoint=/boot \
|
||||
-R "${MNT}" \
|
||||
bpool \
|
||||
$(for i in ${DISK}; do
|
||||
printf '%s ' "${i}3";
|
||||
done)
|
||||
|
||||
|
||||
log Creating root pool
|
||||
# ---
|
||||
# shellcheck disable=SC2046
|
||||
echo $POOLPASS | zpool create \
|
||||
-o ashift=12 \
|
||||
-o autotrim=on \
|
||||
-R "${MNT}" \
|
||||
-O acltype=posixacl \
|
||||
-O canmount=off \
|
||||
-O compression=zstd \
|
||||
-O dnodesize=auto \
|
||||
-O normalization=formD \
|
||||
-O relatime=on \
|
||||
-O xattr=sa \
|
||||
-O mountpoint=/ \
|
||||
-o feature@encryption=enabled \
|
||||
-O encryption=on \
|
||||
-O keyformat=passphrase \
|
||||
rpool \
|
||||
$(for i in ${DISK}; do
|
||||
printf '%s ' "${i}2";
|
||||
done)
|
||||
|
||||
|
||||
log Creating encrypted root system container
|
||||
# ---
|
||||
echo $POOLPASS | zfs create \
|
||||
-o canmount=off \
|
||||
-o mountpoint=none \
|
||||
-o encryption=on \
|
||||
-o keylocation=prompt \
|
||||
-o keyformat=passphrase \
|
||||
rpool/nixos
|
||||
|
||||
|
||||
log Creating system datasets, managing mountpoints with mountpoint=legacy
|
||||
# ---
|
||||
zfs create -o mountpoint=legacy rpool/nixos/root
|
||||
mount -t zfs rpool/nixos/root "${MNT}"/
|
||||
zfs create -o mountpoint=legacy rpool/nixos/home
|
||||
mkdir "${MNT}"/home
|
||||
mount -t zfs rpool/nixos/home "${MNT}"/home
|
||||
zfs create -o mountpoint=legacy rpool/nixos/var
|
||||
zfs create -o mountpoint=legacy rpool/nixos/var/lib
|
||||
zfs create -o mountpoint=legacy rpool/nixos/var/log
|
||||
zfs create -o mountpoint=none bpool/nixos
|
||||
zfs create -o mountpoint=legacy bpool/nixos/root
|
||||
mkdir "${MNT}"/boot
|
||||
mount -t zfs bpool/nixos/root "${MNT}"/boot
|
||||
mkdir -p "${MNT}"/var/log
|
||||
mkdir -p "${MNT}"/var/lib
|
||||
mount -t zfs rpool/nixos/var/lib "${MNT}"/var/lib
|
||||
mount -t zfs rpool/nixos/var/log "${MNT}"/var/log
|
||||
zfs create -o mountpoint=legacy rpool/nixos/empty
|
||||
zfs snapshot rpool/nixos/empty@start
|
||||
|
||||
|
||||
log Formatting and mounting ESP
|
||||
# ---
|
||||
for i in ${DISK}; do
|
||||
mkfs.vfat -n EFI "${i}"4
|
||||
mkdir -p "${MNT}"/boot/efis/"${i##*/}"4
|
||||
mount -t vfat -o iocharset=iso8859-1 "${i}"4 "${MNT}"/boot/efis/"${i##*/}"4
|
||||
done
|
||||
|
||||
|
||||
log Cloning template flake configuration
|
||||
# ---
|
||||
mkdir -p "${MNT}"/etc
|
||||
git clone --depth 1 --branch custom \
|
||||
https://github.com/marcpartensky/dotfiles-flake.git "${MNT}"/etc/nixos
|
||||
|
||||
rm -rf "${MNT}"/etc/nixos/.git
|
||||
git -C "${MNT}"/etc/nixos/ init -b master
|
||||
git -C "${MNT}"/etc/nixos/ add "${MNT}"/etc/nixos/
|
||||
git -C "${MNT}"/etc/nixos config user.email $EMAIL
|
||||
git -C "${MNT}"/etc/nixos config user.name $NAME
|
||||
git -C "${MNT}"/etc/nixos commit -asm 'initial commit'
|
||||
|
||||
|
||||
log Customizing configuration to your hardware
|
||||
# ---
|
||||
for i in ${DISK}; do
|
||||
sed -i \
|
||||
"s|/dev/disk/by-id/|${i%/*}/|" \
|
||||
"${MNT}"/etc/nixos/hosts/nixos/default.nix
|
||||
break
|
||||
done
|
||||
|
||||
diskNames=""
|
||||
for i in ${DISK}; do
|
||||
diskNames="${diskNames} \"${i##*/}\""
|
||||
done
|
||||
|
||||
sed -i "s|\"bootDevices_placeholder\"|${diskNames}|g" \
|
||||
"${MNT}"/etc/nixos/hosts/nixos/default.nix
|
||||
|
||||
sed -i "s|\"abcd1234\"|\"$(head -c4 /dev/urandom | od -A none -t x4| sed 's| ||g' || true)\"|g" \
|
||||
"${MNT}"/etc/nixos/hosts/nixos/default.nix
|
||||
|
||||
sed -i "s|\"x86_64-linux\"|\"$(uname -m || true)-linux\"|g" \
|
||||
"${MNT}"/etc/nixos/flake.nix
|
||||
|
||||
cp "$(command -v nixos-generate-config || true)" ./nixos-generate-config
|
||||
|
||||
chmod a+rw ./nixos-generate-config
|
||||
|
||||
# shellcheck disable=SC2016
|
||||
echo 'print STDOUT $initrdAvailableKernelModules' >> ./nixos-generate-config
|
||||
|
||||
kernelModules="$(./nixos-generate-config --show-hardware-config --no-filesystems | tail -n1 || true)"
|
||||
|
||||
sed -i "s|\"kernelModules_placeholder\"|${kernelModules}|g" \
|
||||
"${MNT}"/etc/nixos/hosts/nixos/default.nix
|
||||
|
||||
log Setting root password
|
||||
# ---
|
||||
rootPwd=$(mkpasswd -m SHA-512)
|
||||
sed -i \
|
||||
"s|rootHash_placeholder|${rootPwd}|" \
|
||||
"${MNT}"/etc/nixos/configuration.nix
|
||||
|
||||
|
||||
log Commiting changes to local repo
|
||||
# ---
|
||||
git -C "${MNT}"/etc/nixos commit -asm 'initial installation'
|
||||
|
||||
log Updating flake lock file to track latest system version
|
||||
# ---
|
||||
nix flake update --commit-lock-file \
|
||||
"git+file://${MNT}/etc/nixos"
|
||||
|
||||
log Installing system and apply configuration
|
||||
# ---
|
||||
nixos-install \
|
||||
--root "${MNT}" \
|
||||
--no-root-passwd \
|
||||
--flake "git+file://${MNT}/etc/nixos#nixos"
|
||||
|
||||
|
||||
log Setuping encrypted swap. This is useful if the available memory is small
|
||||
# ---
|
||||
for i in ${DISK}; do
|
||||
cryptsetup open --type plain --key-file /dev/random "${i}"1 "${i##*/}"1
|
||||
mkswap /dev/mapper/"${i##*/}"1
|
||||
swapon /dev/mapper/"${i##*/}"1
|
||||
done
|
||||
|
||||
log Unmounting filesystems
|
||||
# ---
|
||||
umount -Rl "${MNT}"
|
||||
zpool export -a
|
||||
|
||||
|
||||
log The installation is done, enjoy
|
||||
@@ -44,11 +44,11 @@ in {
|
||||
};
|
||||
partitionScheme = mkOption {
|
||||
default = {
|
||||
swap = "1";
|
||||
rootPool = "2";
|
||||
bootPool = "3";
|
||||
efiBoot = "4";
|
||||
biosBoot = "5";
|
||||
biosBoot = "p5";
|
||||
efiBoot = "p1";
|
||||
swap = "p4";
|
||||
bootPool = "p2";
|
||||
rootPool = "p3";
|
||||
};
|
||||
description = "Describe on disk partitions";
|
||||
type = types.attrsOf types.str;
|
||||
|
||||
@@ -7,7 +7,7 @@ in {
|
||||
hostName = mkOption {
|
||||
description = "The name of the machine. Used by nix flake.";
|
||||
type = types.str;
|
||||
default = "nixos";
|
||||
default = "exampleHost";
|
||||
};
|
||||
timeZone = mkOption {
|
||||
type = types.str;
|
||||
|
||||
Reference in New Issue
Block a user