]> Git — Sourcephile - sourcephile-nix.git/blob - machines/losurdo/Makefile
nix: fix PASSWORD_STORE_DIR
[sourcephile-nix.git] / machines / losurdo / Makefile
1 #cwd := $(notdir $(patsubst %/,%,$(dir $(abspath $(lastword $(MAKEFILE_LIST))))))
2 #disk := /dev/disk/by-id/usb-Generic-_Multi-Card_20071114173400000-0:0
3 #disk := /dev/disk/by-id/nvme-Samsung_SSD_970_EVO_Plus_250GB_S4EUNJ0N211426T
4 server := losurdo
5 disk_sd := $(shell sourcephile-nix-get machines.$(server).config.boot.loader.grub.devices.0)
6 disk_nvme := /dev/disk/by-id/nvme-Samsung_SSD_970_EVO_Plus_250GB_S4EUNJ0N211426T
7 rpool := $(server)_nvme
8 cipher := aes-128-gcm
9 autotrim := on
10 reservation := 1G
11 #unicode_normalization := formD
12
13 wipe-sd:
14 sudo modprobe zfs
15 sudo zpool labelclear -f /dev/disk/by-partlabel/$(server)_nvme_rpool || true
16 sudo $$(which sgdisk) --zap-all $(disk_sd)
17
18 part: wipe-sd wipe-nvme
19 part-sd: wipe-sd
20 sudo $$(which sgdisk) -a1 -n0:34:2047 -t0:EF02 -c0:"$(server)_sd_bios" $(disk_sd)
21 sudo $$(which sgdisk) -n0:1M:+100M -t0:EF00 -c0:"$(server)_sd_efi" $(disk_sd)
22 sudo $$(which sgdisk) -n0:0:+256M -t0:8300 -c0:"$(server)_sd_boot" $(disk_sd)
23 sudo $$(which sgdisk) --randomize-guids $(disk_sd)
24 sudo $$(which sgdisk) --backup=$(server)_sd.sgdisk $(disk_sd)
25 part-nvme:
26 sudo $$(which sgdisk) -n0:0:+8G -t0:8200 -c0:"$(server)_nvme_swap" $(disk_nvme)
27 sudo $$(which sgdisk) -n0:0:0 -t0:BF01 -c0:"$(server)_nvme_rpool" $(disk_nvme)
28 sudo $$(which sgdisk) --randomize-guids $(disk_nvme)
29 sudo $$(which sgdisk) --backup=$(server)_nvme.sgdisk $(disk_nvme)
30
31 format: umount format-efi format-boot format-rpool
32 format-efi:
33 sudo blkid /dev/disk/by-partlabel/$(server)_sd_efi -t TYPE=vfat || \
34 sudo mkfs.vfat -F 16 -s 1 -n EFI /dev/disk/by-partlabel/$(server)_sd_efi
35 format-boot:
36 sudo mkdir -p /mnt/$(server)
37 sudo blkid -t TYPE=ext2 /dev/disk/by-partlabel/$(server)_sd_boot; test $$? != 2 || \
38 sudo mkfs.ext2 /dev/disk/by-partlabel/$(server)_sd_boot
39 format-rpool:
40 sudo zpool list $(rpool) 2>/dev/null || \
41 sudo zpool create -o ashift=12 \
42 $(if $(cipher),-O encryption=$(cipher) \
43 -O keyformat=passphrase \
44 -O keylocation=prompt) \
45 $(if $(unicode_normalization),-O normalization=$(unicode_normalization) \
46 -R /mnt/$(server) $(rpool) /dev/disk/by-partlabel/$(server)_nvme_root
47 sudo zpool set \
48 autotrim=$(autotrim) \
49 $(rpool)
50 sudo zfs set \
51 acltype=posixacl \
52 atime=off \
53 canmount=off \
54 compression=lz4 \
55 dnodesize=auto \
56 relatime=on \
57 xattr=sa \
58 mountpoint=/ \
59 $(rpool)
60 # https://nixos.wiki/wiki/NixOS_on_ZFS#Reservations
61 sudo zfs list $(rpool)/reserved 2>/dev/null || \
62 sudo zfs create -o canmount=off -o mountpoint=none $(rpool)/reserved
63 sudo zfs set refreservation=$(reservation) $(rpool)/reserved
64 # /
65 # mountpoint=legacy is required to let NixOS mount the ZFS filesystems.
66 sudo zfs list $(rpool)/root 2>/dev/null || \
67 sudo zfs create \
68 -o canmount=on \
69 -o mountpoint=legacy \
70 $(rpool)/root
71 # /boot
72 #sudo zfs list bpool/boot 2>/dev/null || \
73 #sudo zfs create \
74 # -o canmount=on \
75 # -o mountpoint=legacy \
76 # bpool/boot
77 # /*
78 for p in \
79 home \
80 nix \
81 var \
82 var/cache \
83 var/log \
84 var/tmp \
85 ; do \
86 sudo zfs list $(rpool)/"$$p" 2>/dev/null || \
87 sudo zfs create \
88 -o canmount=on \
89 -o mountpoint=legacy \
90 $(rpool)/"$$p" ; \
91 done
92 sudo zfs set \
93 com.sun:auto-snapshot=false \
94 $(rpool)/nix
95 sudo zfs set \
96 com.sun:auto-snapshot=false \
97 $(rpool)/var/cache
98 sudo zfs set \
99 com.sun:auto-snapshot=false \
100 sync=disabled \
101 $(rpool)/var/tmp
102
103 mount: mount-rpool mount-boot mount-efi
104 mount-rpool:
105 # scan needed zpools
106 sudo zpool list $(rpool) || \
107 sudo zpool import -f $(rpool)
108 # load encryption key
109 sudo zfs get -H encryption $(rpool) | \
110 grep -q '^$(rpool)\s*encryption\s*off' || \
111 sudo zfs get -H keystatus $(rpool) | \
112 grep -q '^$(rpool)\s*keystatus\s*available' || \
113 sudo zfs load-key $(rpool)
114 # /
115 sudo mkdir -p /mnt/$(server)
116 sudo mountpoint /mnt/$(server) || \
117 sudo mount -v -t zfs $(rpool)/root /mnt/$(server)
118 # /*
119 for p in \
120 home \
121 nix \
122 var \
123 var/cache \
124 var/log \
125 var/tmp \
126 ; do \
127 sudo mkdir -p /mnt/$(server)/"$$p"; \
128 sudo mountpoint /mnt/$(server)/"$$p" || \
129 sudo mount -v -t zfs $(rpool)/"$$p" /mnt/$(server)/"$$p" ; \
130 done
131 sudo chmod 1777 /mnt/$(server)/var/tmp
132 mount-boot:
133 sudo mkdir -p /mnt/$(server)/boot
134 sudo mountpoint /mnt/$(server)/boot || \
135 sudo mount -v /dev/disk/by-partlabel/$(server)_sd_boot /mnt/$(server)/boot
136 #sudo mount -v -t zfs bpool/boot /mnt/$(server)/boot
137 mount-efi: | mount-boot
138 sudo mkdir -p /mnt/$(server)/boot/efi
139 sudo mountpoint /mnt/$(server)/boot/efi || \
140 sudo mount -v /dev/disk/by-partlabel/$(server)_sd_efi /mnt/$(server)/boot/efi
141
142 bootstrap: mount
143 # Workaround https://dev.gnupg.org/T3908
144 chmod o+rw $$GPG_TTY $$XAUTHORITY
145
146 sudo --preserve-env \
147 NIXOS_CONFIG="$$PWD/install.nix" \
148 $$(which nixos-install) \
149 --root /mnt/$(server) \
150 --no-root-passwd \
151 --no-channel-copy \
152 --show-trace
153
154 # End workaround https://dev.gnupg.org/T3908
155 chmod o-rw $$GPG_TTY $$XAUTHORITY
156
157 sudo sourcephile-shred-tmp
158
159 umount:
160 for p in \
161 boot/efi \
162 boot \
163 home \
164 nix \
165 var/cache \
166 var/log \
167 var/tmp \
168 var \
169 "" \
170 ; do \
171 ! sudo mountpoint /mnt/$(server)/"$$p" || \
172 sudo umount -v /mnt/$(server)/"$$p" ; \
173 done
174 ! sudo zpool list $(rpool) 2>/dev/null || \
175 zfs get -H encryption $(rpool) | \
176 grep -q '^$(rpool)\s*encryption\s*off' || \
177 zfs get -H keystatus $(rpool) | \
178 grep -q '^$(rpool)\s*keystatus\s*unavailable' || \
179 sudo zfs unload-key $(rpool)
180 #! sudo zpool list bpool 2>/dev/null || \
181 #sudo zpool export bpool
182 ! sudo zpool list $(rpool) 2>/dev/null || \
183 sudo zpool export $(rpool)
184
185 unlock:
186 pass machines/$(server)/zfs/rpool | \
187 NIXOPS_DEPLOYMENT="$${NIXOPS_DEPLOYMENT:-$(LOSURDO_DEPLOYMENT)}" \
188 nixops ssh $(server) -p 2222 'zfs load-key $(rpool) && pkill zfs'