]> Git — Sourcephile - sourcephile-nix.git/blob - servers/mermet/Makefile
pass: add recv-pass
[sourcephile-nix.git] / servers / mermet / Makefile
1 #cwd := $(notdir $(patsubst %/,%,$(dir $(abspath $(lastword $(MAKEFILE_LIST))))))
2 NIXOPS_DEPLOYMENT := maintenance
3 mermet_disk := $(shell sed -ne 's/^device: \(.*\)/\1/p' sfdisk.txt)
4 #mermet_cipher :=
5 mermet_cipher := aes-128-gcm
6 mermet_autotrim :=
7 mermet_reservation := 40G
8 #mermet_channel := $$(nix-env -p /nix/var/nix/profiles/per-user/$$USER/channels -q nixpkgs --no-name --out-path)
9
10 echo:
11 echo $(MAKEFILES)
12
13 wipeout: umount
14 sudo zpool labelclear -f $(mermet_disk)-part3 || true
15 sudo zpool labelclear -f $(mermet_disk)-part5 || true
16 sudo $$(which sgdisk) --zap-all $(mermet_disk)
17
18 partition:
19 sudo modprobe zfs
20 sudo $$(which sfdisk) $(mermet_disk) <sfdisk.txt
21 sudo $$(which sgdisk) --randomize-guids $(mermet_disk)
22 sudo partprobe
23
24 format:
25 # DOC: https://github.com/zfsonlinux/zfs/wiki/Debian-Buster-Root-on-ZFS
26 sudo mkdir -p /mnt/mermet
27 blkid -t TYPE=ext2 $(mermet_disk)-part3; test $$? != 2 || \
28 mkfs.ext2 $(mermet_disk)-part3
29 # bpool
30 ## NOTE: enable only ZFS features supported by GRUB
31 #sudo zpool list bpool 2>/dev/null || \
32 #sudo zpool create -o ashift=12 -d \
33 # -o feature@allocation_classes=enabled \
34 # -o feature@async_destroy=enabled \
35 # -o feature@bookmarks=enabled \
36 # -o feature@embedded_data=enabled \
37 # -o feature@empty_bpobj=enabled \
38 # -o feature@enabled_txg=enabled \
39 # -o feature@extensible_dataset=enabled \
40 # -o feature@filesystem_limits=enabled \
41 # -o feature@hole_birth=enabled \
42 # -o feature@large_blocks=enabled \
43 # -o feature@lz4_compress=enabled \
44 # -o feature@project_quota=enabled \
45 # -o feature@resilver_defer=enabled \
46 # -o feature@spacemap_histogram=enabled \
47 # -o feature@spacemap_v2=enabled \
48 # -o feature@userobj_accounting=enabled \
49 # -o feature@zpool_checkpoint=enabled \
50 # -o feature@multi_vdev_crash_dump=disabled \
51 # -o feature@large_dnode=disabled \
52 # -o feature@sha512=disabled \
53 # -o feature@skein=disabled \
54 # -o feature@edonr=disabled \
55 # -O normalization=formD \
56 # -R /mnt/mermet bpool $(mermet_disk)-part3
57 #sudo zfs set \
58 # acltype=posixacl \
59 # canmount=off \
60 # compression=lz4 \
61 # devices=off \
62 # relatime=on \
63 # xattr=sa \
64 # mountpoint=/ \
65 # bpool
66
67 # swap
68 # Note: configured with a volatile key in mermet.nix
69 #blkid -t TYPE=crypto_LUKS $(mermet_disk)-part4; test $$? != 2 || \
70 #sudo cryptsetup luksFormat --cipher aes-xts-plain64 --key-size 256 --hash sha256 $(mermet_disk)-part4
71 #sudo cryptsetup luksOpen $(mermet_disk)-part4 swap
72 #blkid -t TYPE=swap /dev/mapper/-swap; test $$? != 2 || \
73 #sudo mkswap --check --label swap
74 #sudo cryptsetup luksClose $(mermet_disk)-part4 swap
75 # rpool
76 sudo zpool list rpool 2>/dev/null || \
77 sudo zpool create -o ashift=12 \
78 $(if $(mermet_cipher),-O encryption=$(mermet_cipher) \
79 -O keyformat=passphrase \
80 -O keylocation=prompt) \
81 -O normalization=formD \
82 -R /mnt/mermet rpool $(mermet_disk)-part5
83 sudo zfs set \
84 acltype=posixacl \
85 atime=off \
86 $(if $(mermet_autotrim),autotrim=on) \
87 canmount=off \
88 compression=lz4 \
89 dnodesize=auto \
90 relatime=on \
91 $(if $(mermet_reservation),reservation=$(mermet_reservation)) \
92 xattr=sa \
93 mountpoint=/ \
94 rpool
95 # /
96 # NOTE: mountpoint=legacy is required to let NixOS mount the ZFS filesystems.
97 sudo zfs list rpool/root 2>/dev/null || \
98 sudo zfs create \
99 -o canmount=on \
100 -o mountpoint=legacy \
101 rpool/root
102 # /boot
103 #sudo zfs list bpool/boot 2>/dev/null || \
104 #sudo zfs create \
105 # -o canmount=on \
106 # -o mountpoint=legacy \
107 # bpool/boot
108 # /boot/efi
109 sudo blkid $(mermet_disk)-part2 -t TYPE=vfat || \
110 sudo mkfs.vfat -F 32 -s 1 -n EFI $(mermet_disk)-part2
111 # /*
112 for p in \
113 home \
114 nix \
115 var \
116 var/cache \
117 var/log \
118 var/mail \
119 var/tmp \
120 var/www \
121 ; do \
122 sudo zfs list rpool/"$$p" 2>/dev/null || \
123 sudo zfs create \
124 -o canmount=on \
125 -o mountpoint=legacy \
126 rpool/"$$p" ; \
127 done
128 sudo zfs set \
129 com.sun:auto-snapshot=false \
130 rpool/nix
131 sudo zfs set \
132 com.sun:auto-snapshot=false \
133 rpool/var/cache
134 sudo zfs set \
135 com.sun:auto-snapshot=false \
136 sync=disabled \
137 rpool/var/tmp
138
139 mount:
140 # scan needed zpools
141 #sudo zpool list bpool || \
142 #sudo zpool import -f bpool
143 sudo zpool list rpool || \
144 sudo zpool import -f rpool
145 # load encryption key
146 zfs get -H encryption rpool | \
147 grep -q '^rpool\s*encryption\s*off' || \
148 zfs get -H keystatus rpool | \
149 grep -q '^rpool\s*keystatus\s*available' || \
150 sudo zfs load-key rpool
151 # /
152 sudo mkdir -p /mnt/mermet
153 sudo mountpoint /mnt/mermet || \
154 sudo mount -v -t zfs rpool/root /mnt/mermet
155 # /boot
156 sudo mkdir -p /mnt/mermet/boot
157 sudo mountpoint /mnt/mermet/boot || \
158 sudo mount -v $(mermet_disk)-part3 /mnt/mermet/boot
159 #sudo mount -v -t zfs bpool/boot /mnt/mermet/boot
160 # /boot/efi
161 sudo mkdir -p /mnt/mermet/boot/efi
162 sudo mountpoint /mnt/mermet/boot/efi || \
163 sudo mount -v $(mermet_disk)-part2 /mnt/mermet/boot/efi
164 # /*
165 for p in \
166 home \
167 nix \
168 var \
169 var/cache \
170 var/log \
171 var/mail \
172 var/tmp \
173 var/www \
174 ; do \
175 sudo mkdir -p /mnt/mermet/"$$p"; \
176 sudo mountpoint /mnt/mermet/"$$p" || \
177 sudo mount -v -t zfs rpool/"$$p" /mnt/mermet/"$$p" ; \
178 done
179 sudo chmod 1777 /mnt/mermet/var/tmp
180
181 bootstrap: mount
182 #test "$$(sudo grub-probe /mnt/mermet/boot)" = zfs
183 # NOTE: nixos-install will install GRUB following mermet.nix
184 # BIOS
185 #sudo grub-install $(mermet_disk)
186 # UEFI
187 #sudo grub-install \
188 # --target=x86_64-efi \
189 # --efi-directory=/mnt/mermet/boot/efi \
190 # --bootloader-id=nixos \
191 # --recheck \
192 # --no-floppy
193
194 pass servers/mermet/dropbear/host.key | \
195 sudo install -D -o root -g root -m 400 /dev/stdin \
196 /mnt/mermet/etc/dropbear/host.key && \
197 test -s /mnt/mermet/etc/dropbear/host.key
198
199 #trap "test ! -e SHRED-ME || sudo find SHRED-ME -type f -exec shred -u {} + && sudo rm -rf SHRED-ME" EXIT ;
200 sudo \
201 GNUPGHOME="$$GNUPGHOME" \
202 GPG_TTY="$$GPG_TTY" \
203 LANG="$$LANG" \
204 LC_CTYPE="$$LC_CTYPE" \
205 NIXOPS_DEPLOYMENT="$(NIXOPS_DEPLOYMENT)" \
206 NIXOS_CONFIG="$$(readlink -e ../mermet.nix)" \
207 NIX_CONF_DIR="$$NIX_CONF_DIR" \
208 NIX_PATH="$$NIX_PATH" \
209 PASSWORD_STORE_DIR="$$PASSWORD_STORE_DIR" \
210 PATH="$$PATH" \
211 SSL_CERT_FILE="$$SSL_CERT_FILE" \
212 $$(which nixos-install) \
213 --root /mnt/mermet \
214 $(if $(mermet_channel),--channel "$(mermet_channel)") \
215 --no-root-passwd \
216 --show-trace
217
218 umount:
219 for p in \
220 boot/efi \
221 boot \
222 home \
223 nix \
224 var/cache \
225 var/log \
226 var/mail \
227 var/tmp \
228 var/www \
229 var \
230 "" \
231 ; do \
232 ! sudo mountpoint /mnt/mermet/"$$p" || \
233 sudo umount -v /mnt/mermet/"$$p" ; \
234 done
235 ! sudo zpool list rpool 2>/dev/null || \
236 zfs get -H encryption rpool | \
237 grep -q '^rpool\s*encryption\s*off' || \
238 zfs get -H keystatus rpool | \
239 grep -q '^rpool\s*keystatus\s*unavailable' || \
240 sudo zfs unload-key rpool
241 #! sudo zpool list bpool 2>/dev/null || \
242 #sudo zpool export bpool
243 ! sudo zpool list rpool 2>/dev/null || \
244 sudo zpool export rpool
245
246 unlock:
247 pass servers/mermet/zfs/rpool | \
248 nixops ssh mermet -p 2222 'zfs load-key rpool && pkill zfs'