machines/losurdo/Makefile

   1 #cwd := $(notdir $(patsubst %/,%,$(dir $(abspath $(lastword $(MAKEFILE_LIST))))))
   2 #disk       := /dev/disk/by-id/usb-Generic-_Multi-Card_20071114173400000-0:0
   3 #disk       := /dev/disk/by-id/nvme-Samsung_SSD_970_EVO_Plus_250GB_S4EUNJ0N211426T
   4 server      := losurdo
   5 disk_sd     := $(shell sourcephile-nix-get machines.$(server).config.boot.loader.grub.devices.0)
   6 disk_nvme   := /dev/disk/by-id/nvme-Samsung_SSD_970_EVO_Plus_250GB_S4EUNJ0N211426T
   7 rpool       := $(server)_nvme
   8 cipher      := aes-128-gcm
   9 autotrim    := on
  10 reservation := 1G
  11 #unicode_normalization := formD
  12
  13 wipe-sd:
  14         sudo modprobe zfs
  15         sudo zpool labelclear -f /dev/disk/by-partlabel/$(server)_nvme_rpool || true
  16         sudo $$(which sgdisk) --zap-all $(disk_sd)
  17
  18 part: wipe-sd wipe-nvme
  19 part-sd: wipe-sd
  20         sudo $$(which sgdisk) -a1 -n0:34:2047  -t0:EF02 -c0:"$(server)_sd_bios"  $(disk_sd)
  21         sudo $$(which sgdisk)     -n0:1M:+100M -t0:EF00 -c0:"$(server)_sd_efi"   $(disk_sd)
  22         sudo $$(which sgdisk)     -n0:0:+256M  -t0:8300 -c0:"$(server)_sd_boot"  $(disk_sd)
  23         sudo $$(which sgdisk) --randomize-guids $(disk_sd)
  24         sudo $$(which sgdisk) --backup=$(server)_sd.sgdisk $(disk_sd)
  25 part-nvme:
  26         sudo $$(which sgdisk) -n0:0:+8G -t0:8200 -c0:"$(server)_nvme_swap"  $(disk_nvme)
  27         sudo $$(which sgdisk) -n0:0:0   -t0:BF01 -c0:"$(server)_nvme_rpool" $(disk_nvme)
  28         sudo $$(which sgdisk) --randomize-guids $(disk_nvme)
  29         sudo $$(which sgdisk) --backup=$(server)_nvme.sgdisk $(disk_nvme)
  30
  31 format: umount format-efi format-boot format-rpool
  32 format-efi:
  33         sudo blkid /dev/disk/by-partlabel/$(server)_sd_efi -t TYPE=vfat || \
  34         sudo mkfs.vfat -F 16 -s 1 -n EFI /dev/disk/by-partlabel/$(server)_sd_efi
  35 format-boot:
  36         sudo mkdir -p /mnt/$(server)
  37         sudo blkid -t TYPE=ext2 /dev/disk/by-partlabel/$(server)_sd_boot; test $$? != 2 || \
  38         sudo mkfs.ext2 /dev/disk/by-partlabel/$(server)_sd_boot
  39 format-rpool:
  40         sudo zpool list $(rpool) 2>/dev/null || \
  41         sudo zpool create -o ashift=12 \
  42          $(if $(cipher),-O encryption=$(cipher) \
  43          -O keyformat=passphrase \
  44          -O keylocation=prompt) \
  45          $(if $(unicode_normalization),-O normalization=$(unicode_normalization) \
  46          -R /mnt/$(server) $(rpool) /dev/disk/by-partlabel/$(server)_nvme_root
  47         sudo zpool set \
  48          autotrim=$(autotrim) \
  49          $(rpool)
  50         sudo zfs set \
  51          acltype=posixacl \
  52          atime=off \
  53          canmount=off \
  54          compression=lz4 \
  55          dnodesize=auto \
  56          relatime=on \
  57          xattr=sa \
  58          mountpoint=/ \
  59          $(rpool)
  60         # https://nixos.wiki/wiki/NixOS_on_ZFS#Reservations
  61         sudo zfs list $(rpool)/reserved 2>/dev/null || \
  62         sudo zfs create -o canmount=off -o mountpoint=none $(rpool)/reserved
  63         sudo zfs set refreservation=$(reservation) $(rpool)/reserved
  64         # /
  65         # mountpoint=legacy is required to let NixOS mount the ZFS filesystems.
  66         sudo zfs list $(rpool)/root 2>/dev/null || \
  67         sudo zfs create \
  68          -o canmount=on \
  69          -o mountpoint=legacy \
  70          $(rpool)/root
  71         # /boot
  72         #sudo zfs list bpool/boot 2>/dev/null || \
  73         #sudo zfs create \
  74         # -o canmount=on \
  75         # -o mountpoint=legacy \
  76         # bpool/boot
  77         # /*
  78         for p in \
  79          home \
  80          nix \
  81          var \
  82          var/cache \
  83          var/log \
  84          var/tmp \
  85          ; do \
  86                 sudo zfs list $(rpool)/"$$p" 2>/dev/null || \
  87                 sudo zfs create \
  88                  -o canmount=on \
  89                  -o mountpoint=legacy \
  90                  $(rpool)/"$$p" ; \
  91          done
  92         sudo zfs set \
  93          com.sun:auto-snapshot=false \
  94          $(rpool)/nix
  95         sudo zfs set \
  96          com.sun:auto-snapshot=false \
  97          $(rpool)/var/cache
  98         sudo zfs set \
  99          com.sun:auto-snapshot=false \
 100          sync=disabled \
 101          $(rpool)/var/tmp
 102
 103 mount: mount-rpool mount-boot mount-efi
 104 mount-rpool:
 105         # scan needed zpools
 106         sudo zpool list $(rpool) || \
 107         sudo zpool import -f $(rpool)
 108         # load encryption key
 109         sudo zfs get -H encryption $(rpool) | \
 110         grep -q '^$(rpool)\s*encryption\s*off' || \
 111         sudo zfs get -H keystatus $(rpool) | \
 112         grep -q '^$(rpool)\s*keystatus\s*available' || \
 113         sudo zfs load-key $(rpool)
 114         # /
 115         sudo mkdir -p /mnt/$(server)
 116         sudo mountpoint /mnt/$(server) || \
 117         sudo mount -v -t zfs $(rpool)/root /mnt/$(server)
 118         # /*
 119         for p in \
 120          home \
 121          nix \
 122          var \
 123          var/cache \
 124          var/log \
 125          var/tmp \
 126          ; do \
 127                 sudo mkdir -p /mnt/$(server)/"$$p"; \
 128                 sudo mountpoint /mnt/$(server)/"$$p" || \
 129                 sudo mount -v -t zfs $(rpool)/"$$p" /mnt/$(server)/"$$p" ; \
 130          done
 131         sudo chmod 1777 /mnt/$(server)/var/tmp
 132 mount-boot:
 133         sudo mkdir -p /mnt/$(server)/boot
 134         sudo mountpoint /mnt/$(server)/boot || \
 135         sudo mount -v /dev/disk/by-partlabel/$(server)_sd_boot /mnt/$(server)/boot
 136         #sudo mount -v -t zfs bpool/boot /mnt/$(server)/boot
 137 mount-efi: | mount-boot
 138         sudo mkdir -p /mnt/$(server)/boot/efi
 139         sudo mountpoint /mnt/$(server)/boot/efi || \
 140         sudo mount -v /dev/disk/by-partlabel/$(server)_sd_efi /mnt/$(server)/boot/efi
 141
 142 bootstrap: mount
 143         # Workaround https://dev.gnupg.org/T3908
 144         chmod o+rw $$GPG_TTY $$XAUTHORITY
 145
 146         sudo --preserve-env \
 147         NIXOS_CONFIG="$$PWD/install.nix" \
 148         $$(which nixos-install) \
 149          --root /mnt/$(server) \
 150          --no-root-passwd \
 151          --no-channel-copy \
 152          --show-trace
 153
 154         # End workaround https://dev.gnupg.org/T3908
 155         chmod o-rw $$GPG_TTY $$XAUTHORITY
 156
 157         sudo sourcephile-shred-tmp
 158
 159 umount:
 160         for p in \
 161          boot/efi \
 162          boot \
 163          home \
 164          nix \
 165          var/cache \
 166          var/log \
 167          var/tmp \
 168          var \
 169          "" \
 170          ; do \
 171                 ! sudo mountpoint /mnt/$(server)/"$$p" || \
 172                 sudo umount -v /mnt/$(server)/"$$p" ; \
 173          done
 174         ! sudo zpool list $(rpool) 2>/dev/null || \
 175         zfs get -H encryption $(rpool) | \
 176         grep -q '^$(rpool)\s*encryption\s*off' || \
 177         zfs get -H keystatus $(rpool) | \
 178         grep -q '^$(rpool)\s*keystatus\s*unavailable' || \
 179         sudo zfs unload-key $(rpool)
 180         #! sudo zpool list bpool 2>/dev/null || \
 181         #sudo zpool export bpool
 182         ! sudo zpool list $(rpool) 2>/dev/null || \
 183         sudo zpool export $(rpool)
 184
 185 unlock:
 186         pass machines/$(server)/zfs/rpool | \
 187         NIXOPS_DEPLOYMENT="$${NIXOPS_DEPLOYMENT:-$(LOSURDO_DEPLOYMENT)}" \
 188         nixops ssh $(server) -p 2222 'zfs load-key $(rpool) && pkill zfs'