hosts/pumpkin/Makefile

   1 #cwd := $(notdir $(patsubst %/,%,$(dir $(abspath $(lastword $(MAKEFILE_LIST))))))
   2 hostName    := pumpkin
   3 disk_nvme1  := /dev/disk/by-id/nvme-SKHynix_HFS512GD9TNI-L2B0B_NY0CN04731130CQ3V_1
   4 zpool       := $(hostName)
   5 cipher      := aes-128-gcm
   6 autotrim    := on
   7 reservation := 1G
   8 compression := zstd
   9 TARGET      ?= root@192.168.4.110
  10
  11 machine-id.clear:
  12         uuidgen | tr -d - >$@
  13         #touch -a $@
  14         #sudo unshare --mount sh -xc 'mount --bind $@ /etc/machine-id && systemd-machine-id-setup'
  15 credential.secret: machine-id.clear
  16         sudo unshare --mount sh -xc 'mount --bind machine-id.clear /etc/machine-id && mount --bind . /var/lib/systemd && systemd-creds setup'
  17 credential.secret.gpg: credential.secret
  18         sudo chown $(USER) credential.secret
  19         gpg --encrypt $(shell printf -- ' -r %s' $$(cat .gpg-id)) credential.secret
  20         shred -fu $<
  21
  22 ssh/host.key ssh/host.key.pub:
  23         mkdir -p $(@D)
  24         ssh-keygen -t ed25519 -f $@
  25 ssh/host.key.gpg: ssh/host.key
  26         gpg --encrypt $(shell printf -- ' -r %s' $$(cat .gpg-id)) $<
  27         shred -fu $<
  28 ssh/host.key.cred: ssh/host.key.gpg
  29         ../gpg2cred-local.sh $< host.key
  30
  31 wipe:
  32         ssh $(TARGET) sh -xec '" \
  33           modprobe zfs; \
  34           ! zpool list $(zpool) || zpool export -f $(zpool); \
  35           zpool labelclear -f /dev/disk/by-partlabel/$(hostName)_nvme1_zpool || true; \
  36           sgdisk --zap-all $(disk_nvme1); \
  37           partprobe || true; \
  38           udevadm settle; \
  39         "'
  40
  41 part: wipe
  42         # https://wiki.archlinux.org/index.php/BIOS_boot_partition
  43         #sudo $$(which sgdisk) -a1 -n0:34:2047  -t0:EF02 -c0:"$(hostName)_nvme1_bios"  $(disk_nvme1)
  44         # https://wiki.archlinux.org/index.php/Partitioning#Tricking_old_BIOS_into_booting_from_GPT
  45         #printf '\200\0\0\0\0\0\0\0\0\0\0\0\001\0\0\0' | sudo dd of=$(disk_nvme1) bs=1 seek=462
  46         # https://help.ubuntu.com/community/SwapFaq#How_much_swap_do_I_need.3F
  47         ssh $(TARGET) sh -xec '" \
  48           sgdisk -n0::+512M -t0:EF00 -c0:"$(hostName)_nvme1_boot"  $(disk_nvme1); \
  49           sgdisk -n0:0:+6G  -t0:8200 -c0:"$(hostName)_nvme1_swap"  $(disk_nvme1); \
  50           sgdisk -n0:0:0    -t0:BF01 -c0:"$(hostName)_nvme1_zpool" $(disk_nvme1); \
  51           sgdisk --randomize-guids $(disk_nvme1); \
  52           sgdisk --backup=$(hostName)_nvme1.sgdisk $(disk_nvme1); \
  53           partprobe || true; \
  54           udevadm settle; \
  55           mkfs.vfat -F 32 -s 1 -n EFI /dev/disk/by-partlabel/$(hostName)_nvme1_boot; \
  56           zpool create -o ashift=12 \
  57             -O utf8only=on \
  58             -R /mnt/$(hostName) $(zpool) /dev/disk/by-partlabel/$(hostName)_nvme1_zpool; \
  59           zpool set autotrim=$(autotrim) $(zpool); \
  60           zfs set \
  61             acltype=off \
  62             atime=off \
  63             canmount=off \
  64             compression=$(compression) \
  65             dnodesize=auto \
  66             relatime=on \
  67             xattr=off \
  68             mountpoint=none \
  69             $(zpool); \
  70           zfs create -o canmount=off -o mountpoint=none $(zpool)/reserved; \
  71           zfs set refreservation=$(reservation) $(zpool)/reserved; \
  72           zfs create -o canmount=on -o mountpoint=/ \
  73             $(if $(cipher),-o encryption=$(cipher) \
  74             -o keyformat=passphrase \
  75             -o keylocation=prompt) \
  76             $(zpool)/root; \
  77           for p in nix home var; do \
  78             zfs create $(zpool)/root/\$$p; \
  79           done; \
  80           zfs set acltype=posixacl xattr=sa $(zpool)/root/var; \
  81         "'
  82         #https://askubuntu.com/questions/970886/journalctl-says-failed-to-search-journal-acl-operation-not-supported
  83
  84           #sudo zfs set sync=disabled $(zpool)/root/var/tmp
  85           #sudo zfs set copies=2 $(zpool)/root/home/files
  86
  87 copy-ssh:
  88         host=$(TARGET); host=$${host#*@}; ssh-keygen -R $$host
  89         ssh-copy-id $(TARGET)
  90         #ssh -oForwardAgent=yes nixos@192.168.3.101 ssh-copy-id -i .ssh/id_ed25519.pub julm@192.168.3.1
  91
  92 install: NIX_STORE_DIR=/nix/store
  93 install: targetRoot=/mnt/$(hostName)
  94 install: targetStore=store=$(NIX_STORE_DIR)&remote-store=$(targetRoot)%3fstore=$(NIX_STORE_DIR)%26real=$(targetRoot)$(NIX_STORE_DIR)
  95 install:
  96         # This may require to increase the size of the partition holding the Nix store.
  97         # Especially when building from a live NixOS whose RAM is not compressed:
  98         #   mount -o remount,size=30G /nix/.rw-store
  99         nix -L build --out-link ../$(hostName).root \
 100           "../..#nixosConfigurations.$(hostName).config.system.build.toplevel"
 101         ssh $(TARGET) sh -xec '" \
 102           zpool list $(zpool) || zpool import $(zpool); \
 103           test \$$(zfs get -H encryption -o value $(zpool)/root) = off || \
 104           test \$$(zfs get -H keystatus -o value $(zpool)/root) = available || \
 105           zfs load-key $(zpool)/root; \
 106           mountpoint $(targetRoot) || \
 107           mount -v -o zfsutil,X-mount.mkdir -t zfs $(zpool)/root $(targetRoot); \
 108           mountpoint $(targetRoot)/boot1 || \
 109           mount -v -o X-mount.mkdir /dev/disk/by-partlabel/$(hostName)_nvme1_boot $(targetRoot)/boot1; \
 110           mountpoint $(targetRoot)/nix || \
 111           mount -v -o zfsutil,X-mount.mkdir -t zfs $(zpool)/root/nix $(targetRoot)/nix; \
 112           mountpoint $(targetRoot)/var || \
 113           mount -v -o zfsutil,X-mount.mkdir -t zfs $(zpool)/root/var $(targetRoot)/var; \
 114           findmnt \
 115         "'
 116         nix copy --to "ssh://$(TARGET)?$(targetStore)" ../$(hostName).root
 117         gpg -d credential.secret.gpg | \
 118         ssh $(TARGET) sh -xec '" \
 119           nix-env --store $(targetRoot) -p $(targetRoot)/nix/var/nix/profiles/system \
 120             --set '$$(readlink -f ../$(hostName).root)'; \
 121           mkdir -m 0755 -p $(targetRoot)/etc; \
 122           touch $(targetRoot)/etc/NIXOS; \
 123           install -D -o root -g root -m 400 /dev/stdin $(targetRoot)/var/lib/systemd/credential.secret; \
 124         "'
 125         ssh $(TARGET) nixos-enter --root $(targetRoot) -c '" \
 126           set -eux; \
 127           mount --rbind --mkdir / $(targetRoot); \
 128           mount --make-rslave $(targetRoot); \
 129           NIXOS_INSTALL_BOOTLOADER=1 '$$(realpath -e ../$(hostName).root)'/bin/switch-to-configuration boot; \
 130           umount -R $(targetRoot) && rmdir $(targetRoot) \
 131         "'