]> Git — Sourcephile - julm/julm-nix.git/blob - hosts/courge/Makefile
aubergine: clean code
[julm/julm-nix.git] / hosts / courge / Makefile
1 #cwd := $(notdir $(patsubst %/,%,$(dir $(abspath $(lastword $(MAKEFILE_LIST))))))
2 hostName := courge
3 disk_ssd := /dev/disk/by-id/FIXME
4 zpool := $(hostName)
5 cipher := aes-128-gcm
6 autotrim := on
7 reservation := 1G
8 compression := zstd
9
10 machine-id.clear:
11 touch -a $@
12 sudo unshare --mount sh -xc 'mount --bind $@ /etc/machine-id && systemd-machine-id-setup'
13 credential.secret: machine-id.clear
14 sudo unshare --mount sh -xc 'mount --bind machine-id.clear /etc/machine-id && mount --bind . /var/lib/systemd && systemd-creds setup'
15 credential.secret.gpg: credential.secret
16 sudo chown $(USER) credential.secret
17 gpg --encrypt $(shell printf -- ' -r %s' $$(cat .gpg-id)) credential.secret
18 shred -fu $<
19
20 ssh/host.key ssh/host.key.pub:
21 mkdir -p $(@D)
22 ssh-keygen -t ed25519 -f $@
23 ssh/host.key.gpg: ssh/host.key
24 gpg --encrypt $(shell printf -- ' -r %s' $$(cat .gpg-id)) $<
25 shred -fu $<
26 ssh/host.key.cred: ssh/host.key.gpg
27 ../gpg2cred-local.sh $< host.key
28
29 wipe:
30 sudo modprobe zfs
31 sudo zpool labelclear -f /dev/disk/by-partlabel/$(hostName)_ssd_zpool || true
32 sudo $$(which sgdisk) --zap-all $(disk_ssd)
33
34 part: wipe
35 # https://wiki.archlinux.org/index.php/BIOS_boot_partition
36 #sudo $$(which sgdisk) -a1 -n0:34:2047 -t0:EF02 -c0:"$(hostName)_ssd_bios" $(disk_ssd)
37 sudo $$(which sgdisk) -n0::+256M -t0:EF00 -c0:"$(hostName)_ssd_efi" $(disk_ssd)
38 #sudo $$(which sgdisk) -n0:0:+256M -t0:8300 -c0:"$(hostName)_ssd_boot" $(disk_ssd)
39 sudo $$(which sgdisk) -n0:0:+4G -t0:8200 -c0:"$(hostName)_ssd_swap" $(disk_ssd)
40 sudo $$(which sgdisk) -n0:0:0 -t0:BF01 -c0:"$(hostName)_ssd_zpool" $(disk_ssd)
41 # https://wiki.archlinux.org/index.php/Partitioning#Tricking_old_BIOS_into_booting_from_GPT
42 #printf '\200\0\0\0\0\0\0\0\0\0\0\0\001\0\0\0' | sudo dd of=$(disk_ssd) bs=1 seek=462
43 sudo $$(which sgdisk) --randomize-guids $(disk_ssd)
44 sudo $$(which sgdisk) --backup=$(hostName)_ssd.sgdisk $(disk_ssd)
45 sudo partprobe
46 sudo udevadm settle
47
48 format: umount format-efi format-zpool
49 format-efi:
50 sudo blkid /dev/disk/by-partlabel/$(hostName)_ssd_efi -t TYPE=vfat || \
51 sudo mkfs.vfat -F 32 -s 1 -n EFI /dev/disk/by-partlabel/$(hostName)_ssd_efi
52 format-zpool:
53 sudo zpool list $(zpool) 2>/dev/null || \
54 sudo zpool create -o ashift=12 \
55 -O utf8only=yes \
56 $(if $(cipher),-O encryption=$(cipher) \
57 -O keyformat=passphrase \
58 -O keylocation=prompt) \
59 -R /mnt/$(hostName) $(zpool) /dev/disk/by-partlabel/$(hostName)_ssd_zpool
60 sudo zpool set \
61 autotrim=$(autotrim) \
62 $(zpool)
63 sudo zfs set \
64 acltype=off \
65 atime=off \
66 canmount=off \
67 compression=$(compression) \
68 dnodesize=auto \
69 relatime=on \
70 xattr=off \
71 mountpoint=none \
72 $(zpool)
73 # https://nixos.wiki/wiki/NixOS_on_ZFS#Reservations
74 sudo zfs list $(zpool)/reserved 2>/dev/null || \
75 sudo zfs create -o canmount=off -o mountpoint=none $(zpool)/reserved
76 sudo zfs set refreservation=$(reservation) $(zpool)/reserved
77 # /
78 sudo zfs list $(zpool)/root 2>/dev/null || \
79 sudo zfs create -o canmount=on -o mountpoint=/ $(zpool)/root
80 # /*
81 for p in nix home var; do \
82 sudo zfs list $(zpool)/root/"$$p" 2>/dev/null || \
83 sudo zfs create $(zpool)/root/"$$p" ; \
84 done
85 #sudo zfs set sync=disabled $(zpool)/root/var/tmp
86 #sudo zfs set copies=2 $(zpool)/root/home/files
87
88 mount: mount-zpool mount-efi
89 mount-zpool:
90 # scan needed zpools
91 sudo zpool list $(zpool) || \
92 sudo zpool import -f $(zpool)
93 # load encryption key
94 sudo zfs get -H encryption $(zpool)/root | \
95 grep -q '^$(zpool)/root\s*encryption\s*off' || \
96 sudo zfs get -H keystatus $(zpool)/root | \
97 grep -q '^$(zpool)/root\s*keystatus\s*available' || \
98 sudo zfs load-key $(zpool)/root
99 # /
100 sudo mkdir -p /mnt/$(hostName)
101 sudo mountpoint /mnt/$(hostName) || \
102 sudo mount -v -o zfsutil -t zfs $(zpool) /mnt/$(hostName)
103 # /*
104 for p in nix var ; do \
105 sudo mkdir -p /mnt/$(hostName)/"$$p"; \
106 sudo mountpoint /mnt/$(hostName)/"$$p" || \
107 sudo mount -v -o zfsutil -t zfs $(zpool)/"$$p" /mnt/$(hostName)/"$$p" ; \
108 done
109 #sudo chmod 1777 /mnt/$(hostName)/var/tmp
110 mount-efi:
111 sudo mkdir -p /mnt/$(hostName)/boot/efi
112 sudo mountpoint /mnt/$(hostName)/boot/efi || \
113 sudo mount -v /dev/disk/by-partlabel/$(hostName)_ssd_efi /mnt/$(hostName)/boot/efi
114
115 bootstrap: mount
116 # Workaround https://dev.gnupg.org/T3908
117 chmod o+rw $$GPG_TTY $$XAUTHORITY
118
119 sudo --preserve-env \
120 $$(which nixos-install) \
121 --root /mnt/$(hostName) \
122 --flake '.#$(hostName)' \
123 --no-root-passwd \
124 --no-channel-copy \
125 --option allow-import-from-derivation true \
126 --show-trace
127
128 # End workaround https://dev.gnupg.org/T3908
129 chmod o-rw $$GPG_TTY $$XAUTHORITY
130
131 umount:
132 for p in \
133 boot/efi \
134 boot \
135 nix \
136 var \
137 "" \
138 ; do \
139 ! sudo mountpoint /mnt/$(hostName)/"$$p" || \
140 sudo umount -v /mnt/$(hostName)/"$$p" ; \
141 done
142 ! sudo zpool list $(zpool) 2>/dev/null || \
143 zfs get -H encryption $(zpool) | \
144 grep -q '^$(zpool)\s*encryption\s*off' || \
145 zfs get -H keystatus $(zpool) | \
146 grep -q '^$(zpool)\s*keystatus\s*unavailable' || \
147 sudo zfs unload-key $(zpool)
148 #! sudo zpool list bpool 2>/dev/null || \
149 #sudo zpool export bpool
150 ! sudo zpool list $(zpool) 2>/dev/null || \
151 sudo zpool export $(zpool)