]> Git — Sourcephile - sourcephile-nix.git/blob - servers/mermet/Makefile
unbound: enable unbound-control locally
[sourcephile-nix.git] / servers / mermet / Makefile
1 #cwd := $(notdir $(patsubst %/,%,$(dir $(abspath $(lastword $(MAKEFILE_LIST))))))
2 NIXOPS_DEPLOYMENT := maintenance
3 mermet_disk := $(shell sed -ne 's/^device: \(.*\)/\1/p' sfdisk.txt)
4 #mermet_cipher :=
5 mermet_cipher := aes-128-gcm
6 mermet_autotrim :=
7 mermet_reservation := 40G
8 #mermet_channel := $$(nix-env -p /nix/var/nix/profiles/per-user/$$USER/channels -q nixpkgs --no-name --out-path)
9
10 echo:
11 echo $(MAKEFILES)
12
13 wipeout: umount
14 sudo zpool labelclear -f $(mermet_disk)-part3 || true
15 sudo zpool labelclear -f $(mermet_disk)-part5 || true
16 sudo $$(which sgdisk) --zap-all $(mermet_disk)
17
18 partition:
19 sudo modprobe zfs
20 sudo $$(which sfdisk) $(mermet_disk) <sfdisk.txt
21 sudo $$(which sgdisk) --randomize-guids $(mermet_disk)
22 sudo partprobe
23
24 format:
25 # DOC: https://github.com/zfsonlinux/zfs/wiki/Debian-Buster-Root-on-ZFS
26 sudo mkdir -p /mnt/mermet
27 blkid -t TYPE=ext2 $(mermet_disk)-part3; test $$? != 2 || \
28 mkfs.ext2 $(mermet_disk)-part3
29 # bpool
30 ## NOTE: enable only ZFS features supported by GRUB
31 #sudo zpool list bpool 2>/dev/null || \
32 #sudo zpool create -o ashift=12 -d \
33 # -o feature@allocation_classes=enabled \
34 # -o feature@async_destroy=enabled \
35 # -o feature@bookmarks=enabled \
36 # -o feature@embedded_data=enabled \
37 # -o feature@empty_bpobj=enabled \
38 # -o feature@enabled_txg=enabled \
39 # -o feature@extensible_dataset=enabled \
40 # -o feature@filesystem_limits=enabled \
41 # -o feature@hole_birth=enabled \
42 # -o feature@large_blocks=enabled \
43 # -o feature@lz4_compress=enabled \
44 # -o feature@project_quota=enabled \
45 # -o feature@resilver_defer=enabled \
46 # -o feature@spacemap_histogram=enabled \
47 # -o feature@spacemap_v2=enabled \
48 # -o feature@userobj_accounting=enabled \
49 # -o feature@zpool_checkpoint=enabled \
50 # -o feature@multi_vdev_crash_dump=disabled \
51 # -o feature@large_dnode=disabled \
52 # -o feature@sha512=disabled \
53 # -o feature@skein=disabled \
54 # -o feature@edonr=disabled \
55 # -O normalization=formD \
56 # -R /mnt/mermet bpool $(mermet_disk)-part3
57 #sudo zfs set \
58 # acltype=posixacl \
59 # canmount=off \
60 # compression=lz4 \
61 # devices=off \
62 # relatime=on \
63 # xattr=sa \
64 # mountpoint=/ \
65 # bpool
66
67 # swap
68 # Note: configured with a volatile key in mermet.nix
69 #blkid -t TYPE=crypto_LUKS $(mermet_disk)-part4; test $$? != 2 || \
70 #sudo cryptsetup luksFormat --cipher aes-xts-plain64 --key-size 256 --hash sha256 $(mermet_disk)-part4
71 #sudo cryptsetup luksOpen $(mermet_disk)-part4 swap
72 #blkid -t TYPE=swap /dev/mapper/-swap; test $$? != 2 || \
73 #sudo mkswap --check --label swap
74 #sudo cryptsetup luksClose $(mermet_disk)-part4 swap
75 # rpool
76 sudo zpool list rpool 2>/dev/null || \
77 sudo zpool create -o ashift=12 \
78 $(if $(mermet_cipher),-O encryption=$(mermet_cipher) \
79 -O keyformat=passphrase \
80 -O keylocation=prompt) \
81 -O normalization=formD \
82 -R /mnt/mermet rpool $(mermet_disk)-part5
83 sudo zfs set \
84 acltype=posixacl \
85 atime=off \
86 $(if $(mermet_autotrim),autotrim=on) \
87 canmount=off \
88 compression=lz4 \
89 dnodesize=auto \
90 relatime=on \
91 $(if $(mermet_reservation),reservation=$(mermet_reservation)) \
92 xattr=sa \
93 mountpoint=/ \
94 rpool
95 # /
96 # NOTE: mountpoint=legacy is required to let NixOS mount the ZFS filesystems.
97 sudo zfs list rpool/root 2>/dev/null || \
98 sudo zfs create \
99 -o canmount=on \
100 -o mountpoint=legacy \
101 rpool/root
102 # /boot
103 #sudo zfs list bpool/boot 2>/dev/null || \
104 #sudo zfs create \
105 # -o canmount=on \
106 # -o mountpoint=legacy \
107 # bpool/boot
108 # /boot/efi
109 sudo blkid $(mermet_disk)-part2 -t TYPE=vfat || \
110 sudo mkfs.vfat -F 32 -s 1 -n EFI $(mermet_disk)-part2
111 # /*
112 for p in \
113 home \
114 nix \
115 var \
116 var/cache \
117 var/log \
118 var/mail \
119 var/redis \
120 var/tmp \
121 var/www \
122 ; do \
123 sudo zfs list rpool/"$$p" 2>/dev/null || \
124 sudo zfs create \
125 -o canmount=on \
126 -o mountpoint=legacy \
127 rpool/"$$p" ; \
128 done
129 sudo zfs set \
130 com.sun:auto-snapshot=false \
131 rpool/nix
132 sudo zfs set \
133 com.sun:auto-snapshot=false \
134 rpool/var/cache
135 sudo zfs set \
136 com.sun:auto-snapshot=false \
137 sync=disabled \
138 rpool/var/tmp
139
140 mount:
141 # scan needed zpools
142 #sudo zpool list bpool || \
143 #sudo zpool import -f bpool
144 sudo zpool list rpool || \
145 sudo zpool import -f rpool
146 # load encryption key
147 zfs get -H encryption rpool | \
148 grep -q '^rpool\s*encryption\s*off' || \
149 zfs get -H keystatus rpool | \
150 grep -q '^rpool\s*keystatus\s*available' || \
151 sudo zfs load-key rpool
152 # /
153 sudo mkdir -p /mnt/mermet
154 sudo mountpoint /mnt/mermet || \
155 sudo mount -v -t zfs rpool/root /mnt/mermet
156 # /boot
157 sudo mkdir -p /mnt/mermet/boot
158 sudo mountpoint /mnt/mermet/boot || \
159 sudo mount -v $(mermet_disk)-part3 /mnt/mermet/boot
160 #sudo mount -v -t zfs bpool/boot /mnt/mermet/boot
161 # /boot/efi
162 sudo mkdir -p /mnt/mermet/boot/efi
163 sudo mountpoint /mnt/mermet/boot/efi || \
164 sudo mount -v $(mermet_disk)-part2 /mnt/mermet/boot/efi
165 # /*
166 for p in \
167 home \
168 nix \
169 var \
170 var/cache \
171 var/log \
172 var/mail \
173 var/redis \
174 var/tmp \
175 var/www \
176 ; do \
177 sudo mkdir -p /mnt/mermet/"$$p"; \
178 sudo mountpoint /mnt/mermet/"$$p" || \
179 sudo mount -v -t zfs rpool/"$$p" /mnt/mermet/"$$p" ; \
180 done
181 sudo chmod 1777 /mnt/mermet/var/tmp
182
183 bootstrap: mount
184 #test "$$(sudo grub-probe /mnt/mermet/boot)" = zfs
185 # NOTE: nixos-install will install GRUB following mermet.nix
186 # BIOS
187 #sudo grub-install $(mermet_disk)
188 # UEFI
189 #sudo grub-install \
190 # --target=x86_64-efi \
191 # --efi-directory=/mnt/mermet/boot/efi \
192 # --bootloader-id=nixos \
193 # --recheck \
194 # --no-floppy
195
196 pass servers/mermet/dropbear/host.key | \
197 sudo install -D -o root -g root -m 400 /dev/stdin \
198 /mnt/mermet/etc/dropbear/host.key && \
199 test -s /mnt/mermet/etc/dropbear/host.key
200
201 #trap "test ! -e SHRED-ME || sudo find SHRED-ME -type f -exec shred -u {} + && sudo rm -rf SHRED-ME" EXIT ;
202 sudo \
203 GNUPGHOME="$$GNUPGHOME" \
204 GPG_TTY="$$GPG_TTY" \
205 LANG="$$LANG" \
206 LC_CTYPE="$$LC_CTYPE" \
207 NIXOPS_DEPLOYMENT="$(NIXOPS_DEPLOYMENT)" \
208 NIXOS_CONFIG="$$(readlink -e ../mermet.nix)" \
209 NIX_CONF_DIR="$$NIX_CONF_DIR" \
210 NIX_PATH="$$NIX_PATH" \
211 PASSWORD_STORE_DIR="$$PASSWORD_STORE_DIR" \
212 PATH="$$PATH" \
213 SSL_CERT_FILE="$$SSL_CERT_FILE" \
214 $$(which nixos-install) \
215 --root /mnt/mermet \
216 $(if $(mermet_channel),--channel "$(mermet_channel)") \
217 --no-root-passwd \
218 --show-trace
219
220 umount:
221 for p in \
222 boot/efi \
223 boot \
224 home \
225 nix \
226 var/cache \
227 var/log \
228 var/mail \
229 var/redis \
230 var/tmp \
231 var/www \
232 var \
233 "" \
234 ; do \
235 ! sudo mountpoint /mnt/mermet/"$$p" || \
236 sudo umount -v /mnt/mermet/"$$p" ; \
237 done
238 ! sudo zpool list rpool 2>/dev/null || \
239 zfs get -H encryption rpool | \
240 grep -q '^rpool\s*encryption\s*off' || \
241 zfs get -H keystatus rpool | \
242 grep -q '^rpool\s*keystatus\s*unavailable' || \
243 sudo zfs unload-key rpool
244 #! sudo zpool list bpool 2>/dev/null || \
245 #sudo zpool export bpool
246 ! sudo zpool list rpool 2>/dev/null || \
247 sudo zpool export rpool
248
249 unlock:
250 pass servers/mermet/zfs/rpool | \
251 nixops ssh mermet -p 2222 'zfs load-key rpool && pkill zfs'