1 #cwd := $(notdir $(patsubst %/,%,$(dir $(abspath $(lastword $(MAKEFILE_LIST))))))
2 NIXOPS_DEPLOYMENT := maintenance
3 mermet_disk := $(shell sed -ne 's/^device: \(.*\)/\1/p' sfdisk.txt)
5 mermet_cipher := aes-128-gcm
7 mermet_reservation := 40G
8 #mermet_channel := $$(nix-env -p /nix/var/nix/profiles/per-user/$$USER/channels -q nixpkgs --no-name --out-path)
14 sudo zpool labelclear -f $(mermet_disk)-part3 || true
15 sudo zpool labelclear -f $(mermet_disk)-part5 || true
16 sudo $$(which sgdisk) --zap-all $(mermet_disk)
20 sudo $$(which sfdisk) $(mermet_disk) <sfdisk.txt
21 sudo $$(which sgdisk) --randomize-guids $(mermet_disk)
25 # DOC: https://github.com/zfsonlinux/zfs/wiki/Debian-Buster-Root-on-ZFS
26 sudo mkdir -p /mnt/mermet
27 blkid -t TYPE=ext2 $(mermet_disk)-part3; test $$? != 2 || \
28 mkfs.ext2 $(mermet_disk)-part3
30 ## NOTE: enable only ZFS features supported by GRUB
31 #sudo zpool list bpool 2>/dev/null || \
32 #sudo zpool create -o ashift=12 -d \
33 # -o feature@allocation_classes=enabled \
34 # -o feature@async_destroy=enabled \
35 # -o feature@bookmarks=enabled \
36 # -o feature@embedded_data=enabled \
37 # -o feature@empty_bpobj=enabled \
38 # -o feature@enabled_txg=enabled \
39 # -o feature@extensible_dataset=enabled \
40 # -o feature@filesystem_limits=enabled \
41 # -o feature@hole_birth=enabled \
42 # -o feature@large_blocks=enabled \
43 # -o feature@lz4_compress=enabled \
44 # -o feature@project_quota=enabled \
45 # -o feature@resilver_defer=enabled \
46 # -o feature@spacemap_histogram=enabled \
47 # -o feature@spacemap_v2=enabled \
48 # -o feature@userobj_accounting=enabled \
49 # -o feature@zpool_checkpoint=enabled \
50 # -o feature@multi_vdev_crash_dump=disabled \
51 # -o feature@large_dnode=disabled \
52 # -o feature@sha512=disabled \
53 # -o feature@skein=disabled \
54 # -o feature@edonr=disabled \
55 # -O normalization=formD \
56 # -R /mnt/mermet bpool $(mermet_disk)-part3
68 # Note: configured with a volatile key in mermet.nix
69 #blkid -t TYPE=crypto_LUKS $(mermet_disk)-part4; test $$? != 2 || \
70 #sudo cryptsetup luksFormat --cipher aes-xts-plain64 --key-size 256 --hash sha256 $(mermet_disk)-part4
71 #sudo cryptsetup luksOpen $(mermet_disk)-part4 swap
72 #blkid -t TYPE=swap /dev/mapper/-swap; test $$? != 2 || \
73 #sudo mkswap --check --label swap
74 #sudo cryptsetup luksClose $(mermet_disk)-part4 swap
76 sudo zpool list rpool 2>/dev/null || \
77 sudo zpool create -o ashift=12 \
78 $(if $(mermet_cipher),-O encryption=$(mermet_cipher) \
79 -O keyformat=passphrase \
80 -O keylocation=prompt) \
81 -O normalization=formD \
82 -R /mnt/mermet rpool $(mermet_disk)-part5
86 $(if $(mermet_autotrim),autotrim=on) \
91 $(if $(mermet_reservation),reservation=$(mermet_reservation)) \
96 # NOTE: mountpoint=legacy is required to let NixOS mount the ZFS filesystems.
97 sudo zfs list rpool/root 2>/dev/null || \
100 -o mountpoint=legacy \
103 #sudo zfs list bpool/boot 2>/dev/null || \
106 # -o mountpoint=legacy \
109 sudo blkid $(mermet_disk)-part2 -t TYPE=vfat || \
110 sudo mkfs.vfat -F 32 -s 1 -n EFI $(mermet_disk)-part2
122 sudo zfs list rpool/"$$p" 2>/dev/null || \
125 -o mountpoint=legacy \
129 com.sun:auto-snapshot=false \
132 com.sun:auto-snapshot=false \
135 com.sun:auto-snapshot=false \
141 #sudo zpool list bpool || \
142 #sudo zpool import -f bpool
143 sudo zpool list rpool || \
144 sudo zpool import -f rpool
145 # load encryption key
146 zfs get -H encryption rpool | \
147 grep -q '^rpool\s*encryption\s*off' || \
148 zfs get -H keystatus rpool | \
149 grep -q '^rpool\s*keystatus\s*available' || \
150 sudo zfs load-key rpool
152 sudo mkdir -p /mnt/mermet
153 sudo mountpoint /mnt/mermet || \
154 sudo mount -v -t zfs rpool/root /mnt/mermet
156 sudo mkdir -p /mnt/mermet/boot
157 sudo mountpoint /mnt/mermet/boot || \
158 sudo mount -v $(mermet_disk)-part3 /mnt/mermet/boot
159 #sudo mount -v -t zfs bpool/boot /mnt/mermet/boot
161 sudo mkdir -p /mnt/mermet/boot/efi
162 sudo mountpoint /mnt/mermet/boot/efi || \
163 sudo mount -v $(mermet_disk)-part2 /mnt/mermet/boot/efi
175 sudo mkdir -p /mnt/mermet/"$$p"; \
176 sudo mountpoint /mnt/mermet/"$$p" || \
177 sudo mount -v -t zfs rpool/"$$p" /mnt/mermet/"$$p" ; \
179 sudo chmod 1777 /mnt/mermet/var/tmp
182 #test "$$(sudo grub-probe /mnt/mermet/boot)" = zfs
183 # NOTE: nixos-install will install GRUB following mermet.nix
185 #sudo grub-install $(mermet_disk)
188 # --target=x86_64-efi \
189 # --efi-directory=/mnt/mermet/boot/efi \
190 # --bootloader-id=nixos \
194 pass servers/mermet/dropbear/host.key | \
195 sudo install -D -o root -g root -m 400 /dev/stdin \
196 /mnt/mermet/etc/dropbear/host.key && \
197 test -s /mnt/mermet/etc/dropbear/host.key
199 #trap "test ! -e SHRED-ME || sudo find SHRED-ME -type f -exec shred -u {} + && sudo rm -rf SHRED-ME" EXIT ;
201 GNUPGHOME="$$GNUPGHOME" \
202 GPG_TTY="$$GPG_TTY" \
204 LC_CTYPE="$$LC_CTYPE" \
205 NIXOPS_DEPLOYMENT="$(NIXOPS_DEPLOYMENT)" \
206 NIXOS_CONFIG="$$(readlink -e ../mermet.nix)" \
207 NIX_CONF_DIR="$$NIX_CONF_DIR" \
208 NIX_PATH="$$NIX_PATH" \
209 PASSWORD_STORE_DIR="$$PASSWORD_STORE_DIR" \
211 SSL_CERT_FILE="$$SSL_CERT_FILE" \
212 $$(which nixos-install) \
214 $(if $(mermet_channel),--channel "$(mermet_channel)") \
232 ! sudo mountpoint /mnt/mermet/"$$p" || \
233 sudo umount -v /mnt/mermet/"$$p" ; \
235 ! sudo zpool list rpool 2>/dev/null || \
236 zfs get -H encryption rpool | \
237 grep -q '^rpool\s*encryption\s*off' || \
238 zfs get -H keystatus rpool | \
239 grep -q '^rpool\s*keystatus\s*unavailable' || \
240 sudo zfs unload-key rpool
241 #! sudo zpool list bpool 2>/dev/null || \
242 #sudo zpool export bpool
243 ! sudo zpool list rpool 2>/dev/null || \
244 sudo zpool export rpool
247 pass servers/mermet/zfs/rpool | \
248 nixops ssh mermet -p 2222 'zfs load-key rpool && pkill zfs'