85 Commits
Author SHA1 Message Date
mazex 8f48493bf8 lightdm doesnt work go back to gdm 2023-09-11 08:37:30 +02:00
mazex d3d458a4a6 enable xserver 2023-09-11 08:35:22 +02:00
mazex 30d2cdbf18 services xserver display manager 2023-09-11 08:34:48 +02:00
mazex 2302cbee07 lightdm display manager 2023-09-11 08:34:06 +02:00
mazex f80174f820 then no freejail too bad 2023-09-11 08:03:16 +02:00
mazex cf975eefe8 allow unfree then 2023-09-11 08:02:16 +02:00
mazex 52072180e2 discord and spotify in global 2023-09-11 08:01:30 +02:00
mazex 3e858f3a62 spotify and discord in unfree 2023-09-11 08:00:07 +02:00
mazex 06cbf3c69e firejail here we go with spotify and discord 2023-09-11 07:58:18 +02:00
mazex d1ca41c9c6 firejail here we go 2023-09-11 07:49:35 +02:00
mazex 8834abb11f unfree packages for spotify and discord 2023-09-11 07:22:18 +02:00
mazex 4b37e71c7b new groups 2023-09-11 07:21:02 +02:00
mazex f69764d3b0 fix 2023-09-11 07:19:12 +02:00
mazex 906869e696 added lots of locale 2023-09-11 07:18:43 +02:00
mazex d203a9394a added the 2023-09-11 07:13:33 +02:00
mazex 84b574cc94 locale 2023-09-11 07:13:16 +02:00
mazex 39b1343c21 70 2023-09-04 19:09:00 +02:00
mazex 1b7c48f812 '' 2023-09-04 19:05:48 +02:00
mazex 0c8b386c04 clean tunneltower 2023-09-04 19:01:50 +02:00
mazex aab0054896 no type 2023-09-04 19:00:02 +02:00
mazex c271d086c9 enable linger for marc 2023-09-04 18:57:14 +02:00
mazex 72ede67564 mcfly 2023-09-02 15:09:46 +02:00
mazex f86fa42ec1 Revert "hyprland"
This reverts commit 98e44f40b2.
2023-08-28 01:32:59 +02:00
mazex 88ca30da73 Revert "no url"
This reverts commit 9404cdd55e.
2023-08-28 01:32:41 +02:00
mazex 5bda3eb8a6 free vnc 2023-08-28 01:29:02 +02:00
mazex 9404cdd55e no url 2023-08-21 04:36:24 +02:00
mazex 98e44f40b2 hyprland 2023-08-21 04:34:49 +02:00
mazex 9da30ef535 enable xserver 2023-08-21 04:26:24 +02:00
mazex 44de68db6b gnome gdm 2023-08-21 04:22:10 +02:00
mazex 71ead633de gdm 2023-08-21 04:20:02 +02:00
mazex f9db5b6a28 gdm 2023-08-21 04:18:15 +02:00
mazex 6f13522f52 no alacritty 2023-08-21 04:00:53 +02:00
mazex aba9b0789e alacritty 2023-08-21 04:00:36 +02:00
mazex c3545e93db backward 2023-08-21 03:55:10 +02:00
mazex bfcd43ff13 wayland window manager 2023-08-21 03:54:52 +02:00
mazex abcb04846a seat group 2023-08-21 03:51:48 +02:00
mazex 3885a679ef ly 2023-08-21 03:51:01 +02:00
mazex 7f382c30df seatd 2023-08-21 03:47:29 +02:00
mazex ab2fe7d036 killall 2023-08-21 03:45:16 +02:00
mazex 2dec9664e6 hyprland enable 2023-08-21 03:43:12 +02:00
mazex e267a91a51 no mg 2023-08-21 03:29:44 +02:00
mazex 99f6130b5e enable flakes 2023-08-13 20:15:22 +02:00
mazex 94bb015b81 autossh 2023-08-13 18:36:39 +02:00
mazex 6c3ee63e22 autossh pls 2023-08-13 18:20:14 +02:00
mazex 37dd78c236 fix 2023-08-13 18:17:59 +02:00
mazex 634821da31 no k3s 2023-07-17 19:31:03 +02:00
mazex 054c944dbc once is enough 2023-07-07 04:09:59 +02:00
mazex c3c135bd7c fix enrionment system packages 2023-07-07 04:09:38 +02:00
mazex 2aec10d69f fix let in 2023-07-07 04:06:23 +02:00
mazex a114e9ddb9 kubernetes pls 2023-07-07 04:05:11 +02:00
mazex dda312c598 htop 2023-07-07 04:02:33 +02:00
mazex 422bd28822 marc in docker group 2023-07-06 14:41:16 +02:00
mazex 773f4cb407 kubectl 2023-07-05 12:14:14 +02:00
mazex e64e3adcd1 Revert "disable home manager"
This reverts commit 054d8889c9.
2023-07-04 12:50:49 +02:00
mazex 054d8889c9 disable home manager 2023-07-04 12:47:42 +02:00
mazex 343eb10b05 home manager 2023-07-04 04:28:14 +02:00
mazex 1c5feaa451 gnupg 2023-07-04 04:18:09 +02:00
mazex 245f279a2e marc same as root 2023-07-04 04:08:34 +02:00
mazex 4c66642ba6 bat 2023-07-04 04:03:21 +02:00
mazex 00879f3e15 zsh enable 2023-07-04 00:56:30 +02:00
mazex f4e673b746 gnumake 2023-07-04 00:52:14 +02:00
mazex bc817489de coreutils 2023-07-04 00:50:57 +02:00
mazex 1f1bd39c95 make 2023-07-04 00:49:16 +02:00
mazex 7d4677e733 neovim and stow 2023-07-04 00:48:40 +02:00
mazex f30e2c3251 pulseaudio 2023-06-25 04:25:35 +02:00
mazex e68d52d626 tower 2023-06-25 04:22:58 +02:00
mazex ebfadf1ee3 bluetooth 2023-06-25 04:17:29 +02:00
mazex 4b00071d59 tower 2023-06-24 15:36:57 +02:00
mazex 5e3e6bccb2 timezone 2023-06-24 15:36:33 +02:00
mazex f2624feaef custom hostname 2023-06-24 15:34:47 +02:00
mazex 7babdb2592 fix flag 2023-06-24 15:32:07 +02:00
mazex 560844cd49 kubernetes zfs support 2023-06-24 15:31:02 +02:00
mazex 917cb9fede openssh.authorizedKeys 2023-06-24 15:21:08 +02:00
mazex 03a91d16ca fix system packages 2023-06-24 15:16:46 +02:00
mazex 036ba8fdbf kubernetes 2023-06-24 15:15:29 +02:00
mazex 4a82b5fa6c passwordssh 2023-06-24 15:04:59 +02:00
mazex 4d625910d3 removed useless line 2023-06-24 15:03:56 +02:00
mazex a03749f995 docker 2023-06-24 15:02:09 +02:00
mazex ac29dcaa09 marc fix 2023-06-24 06:49:04 +02:00
mazex 7d4bb67c3b marc 2023-06-24 06:48:26 +02:00
mazex 16be42651c iwd 2023-06-24 06:29:54 +02:00
mazex ad1d13112d fix part
Signed-off-by: Marc Partensky <marc@marcpartensky.com>
2023-06-24 04:02:07 +00:00
mazex 9a4eb4554d flake.lock: Update
Flake lock file updates:

• Updated input 'nixpkgs':
    'github:nixos/nixpkgs/3a70dd92993182f8e514700ccf5b1ae9fc8a3b8d' (2023-05-31)
  → 'github:nixos/nixpkgs/ecb441f22067ba1d6312f4932a7c64efa8d19a7b' (2023-06-22)
2023-06-24 04:01:36 +00:00
mazex b197a375ce initial installation
Signed-off-by: Marc Partensky <marc@marcpartensky.com>
2023-06-24 04:00:42 +00:00
mazex f1ccf0c7bf initial commit
Signed-off-by: Marc Partensky <marc@marcpartensky.com>
2023-06-24 03:55:39 +00:00
10 changed files with 206 additions and 283 deletions
+7 -8
View File
@@ -1,4 +1,4 @@
* Minimal installer for NixOS using ZFS encrypted root
* Minimal NixOS Root on ZFS configuration
This repo contains a minimal set of configuration needed for
installing NixOS on a computer with ZFS as root filesystem.
@@ -8,18 +8,17 @@ LICENSE
configuration.nix <- configuration shared by all hosts
flake.lock
flake.nix
hosts/nixos/default.nix <- per-host configuration
hosts/nixos/sshUnlock.txt
hosts/exampleHost/default.nix <- per-host configuration
hosts/exampleHost/sshUnlock.txt
modules/boot/default.nix
modules/default.nix
modules/fileSystems/default.nix
modules/networking/default.nix
modules/users/default.nix
#+end_src text
#+end_src
* Thanks to
See [[https://github.com/ne9z/personal-dotfiles][ne9z dotfiles repo]] for an example of how to configure
Just enough to get you started.
See [[https://github.com/ne9z/personal-dotfiles][my personal dotfiles repo]] for an example of how to configure
servers and desktop computers in the same git repository, based on
this template repo you are viewing now.
[[https://openzfs.github.io/openzfs-docs/Getting%20Started/NixOS/Root%20on%20ZFS.html][Official Tutorial]]
+182 -7
View File
@@ -1,4 +1,12 @@
{ my-config, zfs-root, inputs, pkgs, lib, ... }: {
{
my-config, zfs-root, inputs, pkgs, lib, ...
}:
let
kubeMasterIP = "10.1.1.2";
kubeMasterHostname = "api.kube";
kubeMasterAPIServerPort = 6443;
in
{
# load module config to top-level configuration
inherit my-config zfs-root;
@@ -10,16 +18,50 @@
throw "refuse to build: git tree is dirty";
system.stateVersion = "22.11";
system.activationScripts = {
enableLingering = ''
# remove all existing lingering users
rm -r /var/lib/systemd/linger
mkdir /var/lib/systemd/linger
# enable for the subset of declared users
touch /var/lib/systemd/linger/marc
'';
};
virtualisation.docker.enable = true;
# Enable NetworkManager for wireless networking,
# You can configure networking with "nmtui" command.
networking.useDHCP = true;
networking.networkmanager.enable = false;
# networking.useDHCP = true;
networking.hostName = "tower";
networking.networkmanager.enable = true;
networking.wireless.iwd.enable = true;
networking.networkmanager.wifi.backend = "iwd";
services.xserver.enable = true;
services.xserver.displayManager.gdm.enable = true;
hardware.pulseaudio.enable = true;
hardware.bluetooth.enable = true;
programs.hyprland.enable = true;
users.users = {
root = {
initialHashedPassword = "rootHash_placeholder";
openssh.authorizedKeys.keys = [ "sshKey_placeholder" ];
isNormalUser = false;
shell = pkgs.zsh;
initialHashedPassword = "$6$0QAYnBqAJtqB12p3$2lb7rAS2sYw49GUJt0L0bAEpZJSv4HZARQjlbYPhexSmeRB71IRMBzXjf3b4rX6fuDxOuDLydP/Kni9uraS5j/";
openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDiUE73uIEgijfmSsDwBvZmecQnqjBUPRKlMDmevsThc1YJNWEHl57NNIUcx6XSCDPKu5azayImLqIBt8wT5xlqtNX20uCnikDfXZ8gFbGlMRTGZKutQZIRmUrUS5mz97S4dVVK+n5WU+OwOfEg/XKXPh4WbTVDpfTTg7RopRAXkma56HV2TJM0ndPRN8VLmBmtnwdQwEpJ0tRRY+KOHmTojsH65eaZ89+BHbto+Kg+lk6x8IH5VDCRQNHgTEccOpOGYBSHRpoZi1a5h3yajf/eGAQ9Cd38DOsfMtm84oFlii7oXPyxwXoM+uH1SDnvLXyheIrV/XLUurSbEb4aJni6Zu79Z9l8xHhUNmVNSZqWOWUvPbAHlDKUzsbxgk9Zs9OTvSDaRzGhViYl4e1Qc993yerGSW1HHIvYUKM7o5nSQqskSOvOI+ahL5fIbgdyVx4FeuURZIyZSxCz4jIJTK15/6pkT/miHKv+vmQhsoLCqgyXY4SG1p9ruzKkzBe03ZQVW5WeFDLYRjZ+Z4Q2IL2K3BmLgp8tInkPJizQ7v5UGSiajJmPxY0j+CqdH9ZlIBdf8GS+run/N4hpMC1/ayUZRbCY5jg4c8bev8dKEZYJKPs/Hq2zLRZe4YtxcKuiGhgIwQOzo/QrCvSM4pVDgo+d2DjEzIdapqE8hF6BHWDg/w== marc.partensky@gmail.com" ];
};
marc = {
isNormalUser = true;
home = "/home/marc";
description = "Marc Partensky";
extraGroups = ["wheel" "networkmanager" "docker" "seat" "kvm" "video"];
# openssh.authorizedKeys.keys =
shell = pkgs.zsh;
initialHashedPassword = "$6$0QAYnBqAJtqB12p3$2lb7rAS2sYw49GUJt0L0bAEpZJSv4HZARQjlbYPhexSmeRB71IRMBzXjf3b4rX6fuDxOuDLydP/Kni9uraS5j/";
openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDiUE73uIEgijfmSsDwBvZmecQnqjBUPRKlMDmevsThc1YJNWEHl57NNIUcx6XSCDPKu5azayImLqIBt8wT5xlqtNX20uCnikDfXZ8gFbGlMRTGZKutQZIRmUrUS5mz97S4dVVK+n5WU+OwOfEg/XKXPh4WbTVDpfTTg7RopRAXkma56HV2TJM0ndPRN8VLmBmtnwdQwEpJ0tRRY+KOHmTojsH65eaZ89+BHbto+Kg+lk6x8IH5VDCRQNHgTEccOpOGYBSHRpoZi1a5h3yajf/eGAQ9Cd38DOsfMtm84oFlii7oXPyxwXoM+uH1SDnvLXyheIrV/XLUurSbEb4aJni6Zu79Z9l8xHhUNmVNSZqWOWUvPbAHlDKUzsbxgk9Zs9OTvSDaRzGhViYl4e1Qc993yerGSW1HHIvYUKM7o5nSQqskSOvOI+ahL5fIbgdyVx4FeuURZIyZSxCz4jIJTK15/6pkT/miHKv+vmQhsoLCqgyXY4SG1p9ruzKkzBe03ZQVW5WeFDLYRjZ+Z4Q2IL2K3BmLgp8tInkPJizQ7v5UGSiajJmPxY0j+CqdH9ZlIBdf8GS+run/N4hpMC1/ayUZRbCY5jg4c8bev8dKEZYJKPs/Hq2zLRZe4YtxcKuiGhgIwQOzo/QrCvSM4pVDgo+d2DjEzIdapqE8hF6BHWDg/w== marc.partensky@gmail.com" ];
};
};
@@ -36,24 +78,157 @@
services.openssh = {
enable = lib.mkDefault true;
settings = { PasswordAuthentication = lib.mkDefault false; };
settings = { PasswordAuthentication = lib.mkDefault true; };
};
# kubernetes https://nixos.wiki/wiki/K3s
networking.firewall.allowedTCPPorts = [ 6443 5900 ];
# services.k3s = {
# enable = true;
# role = "server";
# # TODO describe how to enable zfs snapshotter in containerd
# extraFlags = toString [
# "--container-runtime-endpoint unix:///run/containerd/containerd.sock"
# ];
# };
# kubernetes zfs support
# virtualisation.containerd = {
# enable = true;
# settings =
# let
# fullCNIPlugins = pkgs.buildEnv {
# name = "full-cni";
# paths = with pkgs;[
# cni-plugins
# cni-plugin-flannel
# ];
# };
# in {
# plugins."io.containerd.grpc.v1.cri".cni = {
# bin_dir = "${fullCNIPlugins}/bin";
# conf_dir = "/var/lib/rancher/k3s/agent/etc/cni/net.d/";
# };
# };
# };
# kubernetes support
# resolve master hostname
# networking.extraHosts = "${kubeMasterIP} ${kubeMasterHostname}";
# services.kubernetes = {
# roles = ["master" "node"];
# masterAddress = kubeMasterHostname;
# apiserverAddress = "https://${kubeMasterHostname}:${toString kubeMasterAPIServerPort}";
# easyCerts = true;
# apiserver = {
# securePort = kubeMasterAPIServerPort;
# advertiseAddress = kubeMasterIP;
# };
# # use coredns
# addons.dns.enable = true;
# # needed if you use swap
# kubelet.extraOpts = "--fail-swap-on=false";
# };
boot.zfs.forceImportRoot = lib.mkDefault false;
nix.settings.experimental-features = lib.mkDefault [ "nix-command" "flakes" ];
programs.git.enable = true;
programs.zsh.enable = true;
security = {
doas.enable = lib.mkDefault true;
sudo.enable = lib.mkDefault false;
};
nix = {
package = pkgs.nixFlakes;
extraOptions = ''
experimental-features = nix-command flakes
'';
};
systemd.services.tunneltower = {
enable = true;
description = "Connect to my tower remotely";
unitConfig = {
# Type = "simple";
};
serviceConfig = {
ExecStart = ''
${pkgs.autossh}/bin/autossh -M 0 \
-o ServerAliveInterval=30 \
-o ServerAliveCountMax=3 \
-o PubkeyAuthentication=yes \
-o PasswordAuthentication=no \
-NR localhost:42070:localhost:22 \
-p 42069 \
-i ~/.ssh/id_rsa \
marc@207.180.235.56
'';
};
wantedBy = [ "multi-user.target" ];
};
environment.systemPackages = builtins.attrValues {
inherit (pkgs)
mg # emacs-like editor
k3s
autossh
jq # other programs
neovim
stow
coreutils
gnumake
bat
gnupg
home-manager
htop
kompose
kubectl
kubernetes
killall
seatd
mcfly
sddm
;
};
i18n.defaultLocale = "fr_FR.UTF-8";
i18n.extraLocaleSettings = {
LC_ADDRESS = "fr_FR.UTF-8";
LC_IDENTIFICATION = "fr_FR.UTF-8";
LC_MEASUREMENT = "fr_FR.UTF-8";
LC_MONETARY = "fr_FR.UTF-8";
LC_NAME = "fr_FR.UTF-8";
LC_NUMERIC = "fr_FR.UTF-8";
LC_PAPER = "fr_FR.UTF-8";
LC_TELEPHONE = "fr_FR.UTF-8";
LC_TIME = "fr_FR.UTF-8";
};
environment.sessionVariables = {
# POLKIT_AUTH_AGENT = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1";
# GSETTINGS_SCHEMA_DIR = "${pkgs.gsettings-desktop-schemas}/share/gsettings-schemas/${pkgs.gsettings-desktop-schemas.name}/glib-2.0/schemas";
# LIBVA_DRIVER_NAME = "nvidia";
# XDG_SESSION_TYPE = "wayland";
# GBM_BACKEND = "nvidia-drm";
# __GLX_VENDOR_LIBRARY_NAME = "nvidia";
# WLR_NO_HARDWARE_CURSORS = "1";
# NIXOS_OZONE_WL = "1";
# MOZ_ENABLE_WAYLAND = "1";
# SDL_VIDEODRIVER = "wayland";
# _JAVA_AWT_WM_NONREPARENTING = "1";
# CLUTTER_BACKEND = "wayland";
# WLR_RENDERER = "vulkan";
# XDG_CURRENT_DESKTOP = "Hyprland";
# XDG_SESSION_DESKTOP = "Hyprland";
# GTK_USE_PORTAL = "1";
# NIXOS_XDG_OPEN_USE_PORTAL = "1";
};
}
Generated
+3 -3
View File
@@ -2,11 +2,11 @@
"nodes": {
"nixpkgs": {
"locked": {
"lastModified": 1685533922,
"narHash": "sha256-y4FCQpYafMQ42l1V+NUrMel9RtFtZo59PzdzflKR/lo=",
"lastModified": 1687466461,
"narHash": "sha256-oupXI7g7RPzlpGUfAu1xG4KBK53GrZH8/xeKgKDB4+Q=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "3a70dd92993182f8e514700ccf5b1ae9fc8a3b8d",
"rev": "ecb441f22067ba1d6312f4932a7c64efa8d19a7b",
"type": "github"
},
"original": {
+2 -2
View File
@@ -18,10 +18,10 @@
};
in {
nixosConfigurations = {
nixos = let
tower = let
system = "x86_64-linux";
pkgs = nixpkgs.legacyPackages.${system};
in mkHost (import ./hosts/nixos { inherit system pkgs; });
in mkHost (import ./hosts/tower { inherit system pkgs; });
};
};
}
@@ -1,6 +1,6 @@
# #
##
## per-host configuration for nixos host
## per-host configuration for exampleHost
##
##
@@ -8,10 +8,10 @@
inherit pkgs system;
zfs-root = {
boot = {
devNodes = "/dev/disk/by-id/";
bootDevices = [ "bootDevices_placeholder" ];
devNodes = "/dev/";
bootDevices = [ "nvme0n1" ];
immutable = false;
availableKernelModules = [ "kernelModules_placeholder" ];
availableKernelModules = [ "nvme" "xhci_pci" "usbhid" "usb_storage" "sd_mod" ];
removableEfi = true;
kernelParams = [ ];
sshUnlock = {
@@ -22,9 +22,9 @@
};
networking = {
# read changeHostName.txt file.
hostName = "nixos";
hostName = "tower";
timeZone = "Europe/Paris";
hostId = "abcd1234";
hostId = "97a4a6a0";
};
};
-251
View File
@@ -1,251 +0,0 @@
#!/bin/env bash
lsblk
echo ""
read -p "disk: " DISK
read -p "swapsize GiB: " SWAPSIZEGIB
read -p "reserve GiB: " RESERVEGIB
read -sp "password: " POOLPASS
EMAIL="marc@marcpartensky.com"
NAME="Marc Partensky"
RESERVE=$((RESERVEGIB * 1024))
SWAPSIZE=$((SWAPSIZEGIB * 1024))
MNT=$(mktemp -d)
log() { echo -e "\n\033[1m${@}\033[0m"; }
log Destroying zfs pool rpool and bpool just in case
swapoff -a
zpool import -fa
for i in ${DISK}; do
zpool labelclear -f $i
done
zpool destroy -f bpool
zpool destroy -f rpool
zpool export -a
log Unmounting filesystems just in case
# ---
umount -Rl "${MNT}"
log Enabling Nix Flakes functionality
# ---
mkdir -p ~/.config/nix
echo "experimental-features = nix-command flakes" >> ~/.config/nix/nix.conf
log Installing programs needed for system installation
# ---
if ! command -v git; then nix-env -f '<nixpkgs>' -iA git; fi
if ! command -v jq; then nix-env -f '<nixpkgs>' -iA jq; fi
if ! command -v partprobe; then nix-env -f '<nixpkgs>' -iA parted; fi
log Partition the disks
# ---
partition_disk () {
local disk="${1}"
blkdiscard -f "${disk}" || true
parted --script --align=optimal "${disk}" -- \
mklabel gpt \
mkpart swap 1MiB $((SWAPSIZE + 1))MiB \
mkpart rpool $((SWAPSIZE + 1))MiB -$((RESERVE + 100))MiB \
mkpart bpool -$((RESERVE + 100))MiB -$((RESERVE + 3))MiB \
mkpart EFI -$((RESERVE + 3))MiB -$((RESERVE + 2))MiB \
mkpart BIOS -$((RESERVE + 2))MiB -$((RESERVE + 1))MiB \
set 4 esp on \
set 5 bios_grub on \
set 5 legacy_boot on
partprobe "${disk}"
udevadm settle
}
for i in ${DISK}; do
partition_disk "${i}"
done
log Creating boot pool
# ---
# shellcheck disable=SC2046
zpool create \
-o compatibility=grub2 \
-o ashift=12 \
-o autotrim=on \
-O acltype=posixacl \
-O canmount=off \
-O compression=lz4 \
-O devices=off \
-O normalization=formD \
-O relatime=on \
-O xattr=sa \
-O mountpoint=/boot \
-R "${MNT}" \
bpool \
$(for i in ${DISK}; do
printf '%s ' "${i}3";
done)
log Creating root pool
# ---
# shellcheck disable=SC2046
echo $POOLPASS | zpool create \
-o ashift=12 \
-o autotrim=on \
-R "${MNT}" \
-O acltype=posixacl \
-O canmount=off \
-O compression=zstd \
-O dnodesize=auto \
-O normalization=formD \
-O relatime=on \
-O xattr=sa \
-O mountpoint=/ \
-o feature@encryption=enabled \
-O encryption=on \
-O keyformat=passphrase \
rpool \
$(for i in ${DISK}; do
printf '%s ' "${i}2";
done)
log Creating encrypted root system container
# ---
echo $POOLPASS | zfs create \
-o canmount=off \
-o mountpoint=none \
-o encryption=on \
-o keylocation=prompt \
-o keyformat=passphrase \
rpool/nixos
log Creating system datasets, managing mountpoints with mountpoint=legacy
# ---
zfs create -o mountpoint=legacy rpool/nixos/root
mount -t zfs rpool/nixos/root "${MNT}"/
zfs create -o mountpoint=legacy rpool/nixos/home
mkdir "${MNT}"/home
mount -t zfs rpool/nixos/home "${MNT}"/home
zfs create -o mountpoint=legacy rpool/nixos/var
zfs create -o mountpoint=legacy rpool/nixos/var/lib
zfs create -o mountpoint=legacy rpool/nixos/var/log
zfs create -o mountpoint=none bpool/nixos
zfs create -o mountpoint=legacy bpool/nixos/root
mkdir "${MNT}"/boot
mount -t zfs bpool/nixos/root "${MNT}"/boot
mkdir -p "${MNT}"/var/log
mkdir -p "${MNT}"/var/lib
mount -t zfs rpool/nixos/var/lib "${MNT}"/var/lib
mount -t zfs rpool/nixos/var/log "${MNT}"/var/log
zfs create -o mountpoint=legacy rpool/nixos/empty
zfs snapshot rpool/nixos/empty@start
log Formatting and mounting ESP
# ---
for i in ${DISK}; do
mkfs.vfat -n EFI "${i}"4
mkdir -p "${MNT}"/boot/efis/"${i##*/}"4
mount -t vfat -o iocharset=iso8859-1 "${i}"4 "${MNT}"/boot/efis/"${i##*/}"4
done
log Cloning template flake configuration
# ---
mkdir -p "${MNT}"/etc
git clone --depth 1 --branch custom \
https://github.com/marcpartensky/dotfiles-flake.git "${MNT}"/etc/nixos
rm -rf "${MNT}"/etc/nixos/.git
git -C "${MNT}"/etc/nixos/ init -b master
git -C "${MNT}"/etc/nixos/ add "${MNT}"/etc/nixos/
git -C "${MNT}"/etc/nixos config user.email $EMAIL
git -C "${MNT}"/etc/nixos config user.name $NAME
git -C "${MNT}"/etc/nixos commit -asm 'initial commit'
log Customizing configuration to your hardware
# ---
for i in ${DISK}; do
sed -i \
"s|/dev/disk/by-id/|${i%/*}/|" \
"${MNT}"/etc/nixos/hosts/nixos/default.nix
break
done
diskNames=""
for i in ${DISK}; do
diskNames="${diskNames} \"${i##*/}\""
done
sed -i "s|\"bootDevices_placeholder\"|${diskNames}|g" \
"${MNT}"/etc/nixos/hosts/nixos/default.nix
sed -i "s|\"abcd1234\"|\"$(head -c4 /dev/urandom | od -A none -t x4| sed 's| ||g' || true)\"|g" \
"${MNT}"/etc/nixos/hosts/nixos/default.nix
sed -i "s|\"x86_64-linux\"|\"$(uname -m || true)-linux\"|g" \
"${MNT}"/etc/nixos/flake.nix
cp "$(command -v nixos-generate-config || true)" ./nixos-generate-config
chmod a+rw ./nixos-generate-config
# shellcheck disable=SC2016
echo 'print STDOUT $initrdAvailableKernelModules' >> ./nixos-generate-config
kernelModules="$(./nixos-generate-config --show-hardware-config --no-filesystems | tail -n1 || true)"
sed -i "s|\"kernelModules_placeholder\"|${kernelModules}|g" \
"${MNT}"/etc/nixos/hosts/nixos/default.nix
log Setting root password
# ---
rootPwd=$(mkpasswd -m SHA-512)
sed -i \
"s|rootHash_placeholder|${rootPwd}|" \
"${MNT}"/etc/nixos/configuration.nix
log Commiting changes to local repo
# ---
git -C "${MNT}"/etc/nixos commit -asm 'initial installation'
log Updating flake lock file to track latest system version
# ---
nix flake update --commit-lock-file \
"git+file://${MNT}/etc/nixos"
log Installing system and apply configuration
# ---
nixos-install \
--root "${MNT}" \
--no-root-passwd \
--flake "git+file://${MNT}/etc/nixos#nixos"
log Setuping encrypted swap. This is useful if the available memory is small
# ---
for i in ${DISK}; do
cryptsetup open --type plain --key-file /dev/random "${i}"1 "${i##*/}"1
mkswap /dev/mapper/"${i##*/}"1
swapon /dev/mapper/"${i##*/}"1
done
log Unmounting filesystems
# ---
umount -Rl "${MNT}"
zpool export -a
log The installation is done, enjoy
+5 -5
View File
@@ -44,11 +44,11 @@ in {
};
partitionScheme = mkOption {
default = {
swap = "1";
rootPool = "2";
bootPool = "3";
efiBoot = "4";
biosBoot = "5";
biosBoot = "p5";
efiBoot = "p1";
swap = "p4";
bootPool = "p2";
rootPool = "p3";
};
description = "Describe on disk partitions";
type = types.attrsOf types.str;
+1 -1
View File
@@ -7,7 +7,7 @@ in {
hostName = mkOption {
description = "The name of the machine. Used by nix flake.";
type = types.str;
default = "nixos";
default = "exampleHost";
};
timeZone = mkOption {
type = types.str;