hosts/courge/Makefile

   1 #cwd := $(notdir $(patsubst %/,%,$(dir $(abspath $(lastword $(MAKEFILE_LIST))))))
   2 hostName    := courge
   3 disk_ssd    := /dev/disk/by-id/ata-Samsung_SSD_850_PRO_128GB_S1SMNSAFC36436X
   4 zpool       := $(hostName)
   5 cipher      := aes-128-gcm
   6 autotrim    := on
   7 reservation := 1G
   8 compression := zstd
   9
  10 machine-id.clear:
  11         touch -a $@
  12         sudo unshare --mount sh -xc 'mount --bind $@ /etc/machine-id && systemd-machine-id-setup'
  13 credential.secret: machine-id.clear
  14         sudo unshare --mount sh -xc 'mount --bind machine-id.clear /etc/machine-id && mount --bind . /var/lib/systemd && systemd-creds setup'
  15 credential.secret.gpg: credential.secret
  16         sudo chown $(USER) credential.secret
  17         gpg --encrypt $(shell printf -- ' -r %s' $$(cat .gpg-id)) credential.secret
  18         shred -fu $<
  19
  20 ssh/host.key ssh/host.key.pub:
  21         mkdir -p $(@D)
  22         ssh-keygen -t ed25519 -f $@
  23 ssh/host.key.gpg: ssh/host.key
  24         gpg --encrypt $(shell printf -- ' -r %s' $$(cat .gpg-id)) $<
  25         shred -fu $<
  26 ssh/host.key.cred: ssh/host.key.gpg
  27         ../gpg2cred-local.sh $< host.key
  28
  29 wipe:
  30         sudo modprobe zfs
  31         sudo zpool labelclear -f /dev/disk/by-partlabel/$(hostName)_ssd_zpool || true
  32         sudo $$(which sgdisk) --zap-all $(disk_ssd)
  33
  34 part: wipe
  35         # https://wiki.archlinux.org/index.php/BIOS_boot_partition
  36         sudo $$(which sgdisk) -a1 -n0:34:2047  -t0:EF02 -c0:"$(hostName)_ssd_bios"  $(disk_ssd)
  37         sudo $$(which sgdisk)     -n0:1M:+32M  -t0:EF00 -c0:"$(hostName)_ssd_efi"   $(disk_ssd)
  38         sudo $$(which sgdisk)     -n0:0:+256M  -t0:8300 -c0:"$(hostName)_ssd_boot"  $(disk_ssd)
  39         sudo $$(which sgdisk)     -n0:0:+4G    -t0:8200 -c0:"$(hostName)_ssd_swap"  $(disk_ssd)
  40         sudo $$(which sgdisk)     -n0:0:0      -t0:BF01 -c0:"$(hostName)_ssd_zpool" $(disk_ssd)
  41         # https://wiki.archlinux.org/index.php/Partitioning#Tricking_old_BIOS_into_booting_from_GPT
  42         printf '\200\0\0\0\0\0\0\0\0\0\0\0\001\0\0\0' | sudo dd of=$(disk_ssd) bs=1 seek=462
  43         sudo $$(which sgdisk) --randomize-guids $(disk_ssd)
  44         sudo $$(which sgdisk) --backup=$(hostName)_ssd.sgdisk $(disk_ssd)
  45
  46 format: umount format-efi format-boot format-zpool
  47 format-efi:
  48         sudo blkid /dev/disk/by-partlabel/$(hostName)_ssd_efi -t TYPE=vfat || \
  49         sudo mkfs.vfat -F 16 -s 1 -n EFI /dev/disk/by-partlabel/$(hostName)_ssd_efi
  50 format-boot:
  51         sudo mkdir -p /mnt/$(hostName)
  52         sudo blkid -t TYPE=ext2 /dev/disk/by-partlabel/$(hostName)_ssd_boot; test $$? != 2 || \
  53         sudo mkfs.ext2 /dev/disk/by-partlabel/$(hostName)_ssd_boot
  54 format-zpool:
  55         sudo zpool list $(zpool) 2>/dev/null || \
  56         sudo zpool create -o ashift=12 \
  57          -O utf8only=yes \
  58          $(if $(cipher),-O encryption=$(cipher) \
  59          -O keyformat=passphrase \
  60          -O keylocation=prompt) \
  61          -R /mnt/$(hostName) $(zpool) /dev/disk/by-partlabel/$(hostName)_ssd_zpool
  62         sudo zpool set \
  63          autotrim=$(autotrim) \
  64          $(zpool)
  65         sudo zfs set \
  66          acltype=off \
  67          atime=off \
  68          canmount=off \
  69          compression=$(compression) \
  70          dnodesize=auto \
  71          relatime=on \
  72          xattr=off \
  73          mountpoint=/ \
  74          $(zpool)
  75         # https://nixos.wiki/wiki/NixOS_on_ZFS#Reservations
  76         sudo zfs list $(zpool)/reserved 2>/dev/null || \
  77         sudo zfs create -o canmount=off -o mountpoint=none $(zpool)/reserved
  78         sudo zfs set refreservation=$(reservation) $(zpool)/reserved
  79         # /
  80         # mountpoint=legacy is required to let NixOS mount the ZFS filesystems.
  81         sudo zfs list $(zpool)/root 2>/dev/null || \
  82         sudo zfs create \
  83          -o canmount=on \
  84          -o mountpoint=legacy \
  85          $(zpool)/root
  86         # /*
  87         for p in \
  88          nix \
  89          var \
  90          ; do \
  91                 sudo zfs list $(zpool)/"$$p" 2>/dev/null || \
  92                 sudo zfs create \
  93                  -o canmount=on \
  94                  -o mountpoint=legacy \
  95                  $(zpool)/"$$p" ; \
  96          done
  97         #sudo zfs set sync=disabled $(zpool)/var/tmp
  98         #sudo zfs set copies=2 $(zpool)/home/files
  99
 100 mount: mount-zpool mount-boot mount-efi
 101 mount-zpool:
 102         # scan needed zpools
 103         sudo zpool list $(zpool) || \
 104         sudo zpool import -f $(zpool)
 105         # load encryption key
 106         sudo zfs get -H encryption $(zpool) | \
 107         grep -q '^$(zpool)\s*encryption\s*off' || \
 108         sudo zfs get -H keystatus $(zpool) | \
 109         grep -q '^$(zpool)\s*keystatus\s*available' || \
 110         sudo zfs load-key $(zpool)
 111         # /
 112         sudo mkdir -p /mnt/$(hostName)
 113         sudo mountpoint /mnt/$(hostName) || \
 114         sudo mount -v -t zfs $(zpool)/root /mnt/$(hostName)
 115         # /*
 116         for p in \
 117          nix \
 118          var \
 119          ; do \
 120                 sudo mkdir -p /mnt/$(hostName)/"$$p"; \
 121                 sudo mountpoint /mnt/$(hostName)/"$$p" || \
 122                 sudo mount -v -t zfs $(zpool)/"$$p" /mnt/$(hostName)/"$$p" ; \
 123          done
 124         #sudo chmod 1777 /mnt/$(hostName)/var/tmp
 125 mount-boot:
 126         sudo mkdir -p /mnt/$(hostName)/boot
 127         sudo mountpoint /mnt/$(hostName)/boot || \
 128         sudo mount -v /dev/disk/by-partlabel/$(hostName)_ssd_boot /mnt/$(hostName)/boot
 129         #sudo mount -v -t zfs bpool/boot /mnt/$(hostName)/boot
 130 mount-efi: | mount-boot
 131         sudo mkdir -p /mnt/$(hostName)/boot/efi
 132         sudo mountpoint /mnt/$(hostName)/boot/efi || \
 133         sudo mount -v /dev/disk/by-partlabel/$(hostName)_ssd_efi /mnt/$(hostName)/boot/efi
 134
 135 bootstrap: mount
 136         # Workaround https://dev.gnupg.org/T3908
 137         chmod o+rw $$GPG_TTY $$XAUTHORITY
 138
 139         sudo --preserve-env \
 140         $$(which nixos-install) \
 141          --root /mnt/$(hostName) \
 142          --flake '.#$(hostName)' \
 143          --no-root-passwd \
 144          --no-channel-copy \
 145          --option allow-import-from-derivation true \
 146          --show-trace
 147
 148         # End workaround https://dev.gnupg.org/T3908
 149         chmod o-rw $$GPG_TTY $$XAUTHORITY
 150
 151 umount:
 152         for p in \
 153          boot/efi \
 154          boot \
 155          nix \
 156          var \
 157          "" \
 158          ; do \
 159                 ! sudo mountpoint /mnt/$(hostName)/"$$p" || \
 160                 sudo umount -v /mnt/$(hostName)/"$$p" ; \
 161          done
 162         ! sudo zpool list $(zpool) 2>/dev/null || \
 163         zfs get -H encryption $(zpool) | \
 164         grep -q '^$(zpool)\s*encryption\s*off' || \
 165         zfs get -H keystatus $(zpool) | \
 166         grep -q '^$(zpool)\s*keystatus\s*unavailable' || \
 167         sudo zfs unload-key $(zpool)
 168         #! sudo zpool list bpool 2>/dev/null || \
 169         #sudo zpool export bpool
 170         ! sudo zpool list $(zpool) 2>/dev/null || \
 171         sudo zpool export $(zpool)
 172
 173 unlock:
 174         pass hostNames/$(hostName)/zfs/zpool | \
 175         NIXOPS_DEPLOYMENT="$${NIXOPS_DEPLOYMENT:-$(LOSURDO_DEPLOYMENT)}" \
 176         nixops ssh $(hostName) -p 2222 'zfs load-key $(zpool) && pkill zfs'