#cwd := $(notdir $(patsubst %/,%,$(dir $(abspath $(lastword $(MAKEFILE_LIST)))))) #disk := /dev/disk/by-id/usb-Generic-_Multi-Card_20071114173400000-0:0 #disk := /dev/disk/by-id/nvme-Samsung_SSD_970_EVO_Plus_250GB_S4EUNJ0N211426T server := losurdo disk := $(shell sourcephile-nix-get nodes.$(server).config.boot.loader.grub.devices.0) partlabel := $(server)_nvme rpool := $(partlabel) cipher := aes-128-gcm autotrim := on reservation := 1G wipeout: sudo modprobe zfs sudo zpool labelclear -f $(disk)-part5 || true sudo $$(which sgdisk) --zap-all $(disk) partition: wipeout sudo $$(which sgdisk) -a1 -n0:34:2047 -t0:EF02 -c0:"$(partlabel)_bios" $(disk) sudo $$(which sgdisk) -n0:1M:+8M -t0:EF00 -c0:"$(partlabel)_efi" $(disk) sudo $$(which sgdisk) -n0:0:+256M -t0:8300 -c0:"$(partlabel)_boot" $(disk) sudo $$(which sgdisk) -n0:0:+8G -t0:8200 -c0:"$(partlabel)_swap" $(disk) sudo $$(which sgdisk) -n0:0:0 -t0:BF01 -c0:"$(partlabel)_rpool" $(disk) sudo $$(which sgdisk) --randomize-guids $(disk) sudo $$(which sgdisk) --backup=sgdisk.backup $(disk) format: format-efi format-boot format-rpool format-efi: sudo blkid $(disk)-part2 -t TYPE=vfat || \ sudo mkfs.vfat -F 32 -s 1 -n EFI $(disk)-part2 format-boot: sudo mkdir -p /mnt/$(server) sudo blkid -t TYPE=ext2 $(disk)-part3; test $$? != 2 || \ sudo mkfs.ext2 $(disk)-part3 format-rpool: sudo zpool list $(rpool) 2>/dev/null || \ sudo zpool create -o ashift=12 \ $(if $(cipher),-O encryption=$(cipher) \ -O keyformat=passphrase \ -O keylocation=prompt) \ -O normalization=formD \ -R /mnt/$(server) $(rpool) $(disk)-part5 sudo zpool set \ autotrim=$(autotrim) \ $(rpool) sudo zfs set \ acltype=posixacl \ atime=off \ canmount=off \ compression=lz4 \ dnodesize=auto \ relatime=on \ xattr=sa \ mountpoint=/ \ $(rpool) # https://nixos.wiki/wiki/NixOS_on_ZFS#Reservations sudo zfs list $(rpool)/reserved 2>/dev/null || \ sudo zfs create -o canmount=off -o mountpoint=none $(rpool)/reserved sudo zfs set refreservation=$(reservation) $(rpool)/reserved # / # mountpoint=legacy is required to let NixOS mount the ZFS filesystems. sudo zfs list $(rpool)/root 2>/dev/null || \ sudo zfs create \ -o canmount=on \ -o mountpoint=legacy \ $(rpool)/root # /boot #sudo zfs list bpool/boot 2>/dev/null || \ #sudo zfs create \ # -o canmount=on \ # -o mountpoint=legacy \ # bpool/boot # /* for p in \ home \ nix \ var \ var/cache \ var/log \ var/tmp \ ; do \ sudo zfs list $(rpool)/"$$p" 2>/dev/null || \ sudo zfs create \ -o canmount=on \ -o mountpoint=legacy \ $(rpool)/"$$p" ; \ done sudo zfs set \ com.sun:auto-snapshot=false \ $(rpool)/nix sudo zfs set \ com.sun:auto-snapshot=false \ $(rpool)/var/cache sudo zfs set \ com.sun:auto-snapshot=false \ sync=disabled \ $(rpool)/var/tmp mount: mount-rpool mount-boot mount-efi mount-rpool: # scan needed zpools sudo zpool list $(rpool) || \ sudo zpool import -f $(rpool) # load encryption key sudo zfs get -H encryption $(rpool) | \ grep -q '^$(rpool)\s*encryption\s*off' || \ sudo zfs get -H keystatus $(rpool) | \ grep -q '^$(rpool)\s*keystatus\s*available' || \ sudo zfs load-key $(rpool) # / sudo mkdir -p /mnt/$(server) sudo mountpoint /mnt/$(server) || \ sudo mount -v -t zfs $(rpool)/root /mnt/$(server) # /* for p in \ home \ nix \ var \ var/cache \ var/log \ var/tmp \ ; do \ sudo mkdir -p /mnt/$(server)/"$$p"; \ sudo mountpoint /mnt/$(server)/"$$p" || \ sudo mount -v -t zfs $(rpool)/"$$p" /mnt/$(server)/"$$p" ; \ done sudo chmod 1777 /mnt/$(server)/var/tmp mount-boot: sudo mkdir -p /mnt/$(server)/boot sudo mountpoint /mnt/$(server)/boot || \ sudo mount -v $(disk)-part3 /mnt/$(server)/boot #sudo mount -v -t zfs bpool/boot /mnt/$(server)/boot mount-efi: | mount-boot sudo mkdir -p /mnt/$(server)/boot/efi sudo mountpoint /mnt/$(server)/boot/efi || \ sudo mount -v $(disk)-part2 /mnt/$(server)/boot/efi bootstrap: mount # Workaround https://dev.gnupg.org/T3908 chmod o+rw $$GPG_TTY $$XAUTHORITY sudo --preserve-env \ NIXOS_CONFIG="$$PWD/configuration.nix" \ $$(which nixos-install) \ --root /mnt/$(server) \ --no-root-passwd \ --no-channel-copy \ --show-trace # End workaround https://dev.gnupg.org/T3908 chmod o-rw $$GPG_TTY $$XAUTHORITY sudo sourcephile-shred-tmp umount: for p in \ boot/efi \ boot \ home \ nix \ var/cache \ var/log \ var/tmp \ var \ "" \ ; do \ ! sudo mountpoint /mnt/$(server)/"$$p" || \ sudo umount -v /mnt/$(server)/"$$p" ; \ done ! sudo zpool list $(rpool) 2>/dev/null || \ zfs get -H encryption $(rpool) | \ grep -q '^$(rpool)\s*encryption\s*off' || \ zfs get -H keystatus $(rpool) | \ grep -q '^$(rpool)\s*keystatus\s*unavailable' || \ sudo zfs unload-key $(rpool) #! sudo zpool list bpool 2>/dev/null || \ #sudo zpool export bpool ! sudo zpool list $(rpool) 2>/dev/null || \ sudo zpool export $(rpool) unlock: pass servers/$(server)/zfs/$(rpool) | \ NIXOPS_DEPLOYMENT="$${NIXOPS_DEPLOYMENT:-$(LOSURDO_DEPLOYMENT)}" \ nixops ssh $(server) -p 2222 'zfs load-key $(rpool) && pkill zfs'