]> Git — Sourcephile - julm/julm-nix.git/blob - hosts/nan2gua1/Makefile
nan2gua1: init host
[julm/julm-nix.git] / hosts / nan2gua1 / Makefile
1 #cwd := $(notdir $(patsubst %/,%,$(dir $(abspath $(lastword $(MAKEFILE_LIST))))))
2 hostName := nan2gua1
3 domainName := sourcephile.fr
4 disk1 := /dev/disk/by-id/nvme-SKHynix_HFS512GDE9X081N_FYABN01431060B636_1
5 zfs_pool := $(hostName)
6 zfs_encryption := aes-128-gcm
7 zfs_autotrim := on
8 zfs_emergency := 1G
9 zfs_compression := zstd
10 ssh_target ?= root@192.168.4.100
11 disk_bios :=
12 disk_boot_size := 512M
13 disk_swap_size := 4G
14 creds := \
15 ssh/host.key.cred \
16 nebula/$(domainName)/$(hostName).key.cred
17
18 git-crypt:
19 test -s ../../.git/git-crypt/keys/"$(hostName)" || \
20 git-crypt init --key-name "$(hostName)"
21 git-crypt add-gpg-user --key-name "$(hostName)" $$(cat .gpg-id)
22
23 creds: host-id.clear machine-id.clear credential.secret.gpg $(creds)
24 # ExplanationNote: avoid regenerating secrets that have been removed for security
25 .SECONDARY: credential.secret $(patsubst %.cred,%,$(creds))
26
27 .PRECIOUS: %.clear
28 host-id.clear:
29 uuidgen | head -c8 >"$@"
30 machine-id.clear:
31 uuidgen | tr -d - >"$@"
32 #touch -a $@
33 #sudo unshare --mount sh -xc 'mount --bind $@ /etc/machine-id && systemd-machine-id-setup'
34 credential.secret: machine-id.clear
35 sudo unshare --mount sh -xec ' \
36 mount --bind machine-id.clear /etc/machine-id && \
37 mount --bind . /var/lib/systemd && \
38 systemd-creds setup \
39 '
40
41 .PRECIOUS: %.cred
42 %.cred: %.gpg
43 #../gpg2cred-local.sh $< $(shell basename "$*")
44 ssh_target=$(ssh_target) ../gpg2cred-remote.sh "$*".gpg $(shell basename "$*")
45 .PRECIOUS: %.gpg
46 %.gpg: %
47 test $$(stat -c %U "$*") == "$(USER)" || sudo chown $(USER) credential.secret
48 gpg --encrypt $(shell printf -- ' -r %s' $$(cat .gpg-id)) "$*"
49 shred -fu "$*"
50 zpool_root.passphrase.gpg:
51 gpg --encrypt $(shell printf -- ' -r %s' $$(cat .gpg-id)) --output $@
52
53 users/%/login/hashedPassword.clear:
54 mkdir -p "$(@D)"
55 mkpasswd -m yescrypt | tr -d '\n' >"$@"
56
57 ssh/host.key ssh/host.key.pub:
58 mkdir -p $(@D)
59 ssh-keygen -t ed25519 -f $@
60
61 nebula/$(domainName)/$(hostName).key:
62 nebula-cert keygen \
63 -out-pub nebula/$(domainName)/$(hostName).pub \
64 -out-key nebula/$(domainName)/$(hostName).key
65 # Now nebula/$(hostName).pub needs to be signed by the CA
66 # to produce a nebula/$(hostName).crt
67
68 clears: \
69 users/julm/login/hashedPassword.clear
70
71 wipe:
72 ssh $(ssh_target) sh -xec '" \
73 test ! -d /home/julm; \
74 modprobe zfs; \
75 ! zpool list $(zfs_pool) || zpool export -f $(zfs_pool); \
76 zpool labelclear -f /dev/disk/by-partlabel/$(hostName)_disk1_zpool || true; \
77 sgdisk --zap-all $(disk1); \
78 partprobe || true; \
79 udevadm settle; \
80 "'
81
82 part: wipe zpool_root.passphrase.gpg
83 # https://wiki.archlinux.org/index.php/BIOS_boot_partition
84 #sudo $$(which sgdisk) -a1 -n0:34:2047 -t0:EF02 -c0:"$(hostName)_disk1_bios" $(disk1)
85 # https://wiki.archlinux.org/index.php/Partitioning#Tricking_old_BIOS_into_booting_from_GPT
86 #printf '\200\0\0\0\0\0\0\0\0\0\0\0\001\0\0\0' | sudo dd of=$(disk1) bs=1 seek=462
87 # https://help.ubuntu.com/community/SwapFaq#How_much_swap_do_I_need.3F
88 gpg --decrypt zpool_root.passphrase.gpg | \
89 ssh $(ssh_target) sh -xec '" \
90 $(if $(disk_bios),sgdisk -a1 -n0:34:2047 -t0:EF02 -c0:$(hostName)_disk1_bios $(disk1);,) \
91 sgdisk -n0::+$(disk_boot_size) -t0:EF00 -c0:"$(hostName)_disk1_boot" $(disk1); \
92 sgdisk -n0:0:+$(disk_swap_size) -t0:8200 -c0:"$(hostName)_disk1_swap" $(disk1); \
93 sgdisk -n0:0:0 -t0:BF01 -c0:"$(hostName)_disk1_zpool" $(disk1); \
94 sgdisk --randomize-guids $(disk1); \
95 sgdisk --backup=$(hostName)_disk1.sgdisk $(disk1); \
96 partprobe || true; \
97 udevadm settle; \
98 mkfs.vfat -F 32 -s 1 -n EFI /dev/disk/by-partlabel/$(hostName)_disk1_boot; \
99 zpool create -o ashift=12 \
100 -O utf8only=on \
101 -R /mnt/$(hostName) $(zfs_pool) /dev/disk/by-partlabel/$(hostName)_disk1_zpool; \
102 zpool set autotrim=$(zfs_autotrim) $(zfs_pool); \
103 zfs set \
104 acltype=off \
105 atime=off \
106 canmount=off \
107 compression=$(zfs_compression) \
108 dnodesize=auto \
109 relatime=on \
110 xattr=off \
111 mountpoint=none \
112 $(zfs_pool); \
113 zfs create \
114 -o canmount=off \
115 -o mountpoint=none \
116 -o refreservation=$(zfs_emergency) \
117 $(zfs_pool)/emergency; \
118 zfs create -o canmount=on -o mountpoint=/ \
119 $(if $(zfs_encryption),-o encryption=$(zfs_encryption) \
120 -o keyformat=passphrase \
121 -o keylocation=prompt) \
122 $(zfs_pool)/root; \
123 for p in nix home var; do \
124 zfs create $(zfs_pool)/root/\$$p; \
125 done; \
126 zfs set acltype=posixacl xattr=sa $(zfs_pool)/root/var; \
127 "'
128 #https://askubuntu.com/questions/970886/journalctl-says-failed-to-search-journal-acl-operation-not-supported
129
130 #sudo zfs set sync=disabled $(zfs_pool)/root/var/tmp
131 #sudo zfs set copies=2 $(zfs_pool)/root/home/files
132
133 copy-ssh:
134 host=$(ssh_target); host=$${host#*@}; ssh-keygen -R $$host
135 ssh-copy-id $(ssh_target)
136 #ssh -oForwardAgent=yes nixos@192.168.3.101 ssh-copy-id -i .ssh/id_ed25519.pub julm@192.168.3.1
137
138 install: NIX_STORE_DIR=/nix/store
139 install: targetRoot=/mnt/$(hostName)
140 install: targetStore=store=$(NIX_STORE_DIR)&remote-store=$(targetRoot)%3freal=$(targetRoot)$(NIX_STORE_DIR)
141 #%26store=$(NIX_STORE_DIR)
142 install: credential.secret.gpg
143 # This may require to increase the size of the partition holding the Nix store.
144 # Especially when building from a live NixOS whose RAM is not compressed:
145 # mount -o remount,size=30G /nix/.rw-store
146 nix -L build --out-link ../$(hostName).root \
147 "../..#nixosConfigurations.$(hostName).config.system.build.toplevel"
148 ssh $(ssh_target) sh -xec '" \
149 mount -o remount,size=30G /nix/.rw-store; \
150 zpool list $(zfs_pool) || zpool import $(zfs_pool); \
151 test \$$(zfs get -H encryption -o value $(zfs_pool)/root) = off || \
152 test \$$(zfs get -H keystatus -o value $(zfs_pool)/root) = available || \
153 zfs load-key $(zfs_pool)/root; \
154 mountpoint $(targetRoot) || \
155 mount -v -o zfsutil,X-mount.mkdir -t zfs $(zfs_pool)/root $(targetRoot); \
156 mountpoint $(targetRoot)/boot1 || \
157 mount -v -o X-mount.mkdir /dev/disk/by-partlabel/$(hostName)_disk1_boot $(targetRoot)/boot1; \
158 mountpoint $(targetRoot)/nix || \
159 mount -v -o zfsutil,X-mount.mkdir -t zfs $(zfs_pool)/root/nix $(targetRoot)/nix; \
160 mountpoint $(targetRoot)/var || \
161 mount -v -o zfsutil,X-mount.mkdir -t zfs $(zfs_pool)/root/var $(targetRoot)/var; \
162 findmnt \
163 "'
164 nix copy --to "ssh://$(ssh_target)?$(targetStore)" ../$(hostName).root
165 gpg --decrypt credential.secret.gpg | \
166 ssh $(ssh_target) sh -xec '" \
167 nix-env --store $(targetRoot) -p $(targetRoot)/nix/var/nix/profiles/system \
168 --set '$$(readlink -f ../$(hostName).root)'; \
169 mkdir -m 0755 -p $(targetRoot)/etc; \
170 touch $(targetRoot)/etc/NIXOS; \
171 install -D -o root -g root -m 400 /dev/stdin $(targetRoot)/var/lib/systemd/credential.secret; \
172 "'
173 ssh $(ssh_target) nixos-enter --root $(targetRoot) -c '" \
174 set -eux; \
175 mount --rbind --mkdir / $(targetRoot); \
176 mount --make-rslave $(targetRoot); \
177 NIXOS_INSTALL_BOOTLOADER=1 '$$(realpath -e ../$(hostName).root)'/bin/switch-to-configuration boot; \
178 umount -R $(targetRoot) && rmdir $(targetRoot) \
179 "'
180
181 unmount:
182 ssh $(ssh_target) sh -xec '" \
183 ! mountpoint $(targetRoot)/boot1 || \
184 umount -v $(targetRoot)/boot1; \
185 ! mountpoint $(targetRoot)/nix || \
186 umount -v $(targetRoot)/nix; \
187 ! mountpoint $(targetRoot)/var || \
188 umount -v $(targetRoot)/var; \
189 ! mountpoint $(targetRoot) || \
190 umount -v $(targetRoot); \
191 ! zpool list $(zfs_pool) || \
192 zpool export $(zfs_pool); \
193 findmnt \
194 "'