dev/nixfiles
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Functioning installation

Browse Source
This commit is contained in:
Jack O'Sullivan
2022-02-19 22:55:53 +00:00
parent ac0d2bc001
commit 7537cf4205
11 changed files with 487 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
nixos/boxes/colony.nix
View File

@@ -1,5 +1,7 @@
{ lib, pkgs, ... }:
{ lib, pkgs, modulesPath, ... }:
{
imports = [ "${modulesPath}/profiles/qemu-guest.nix" ];
my = {
firewall = {
trustedInterfaces = [ "blah" ];
@@ -15,11 +17,20 @@
};
};
server.enable = true;
homeConfig = {};
tmproot.unsaved.ignore = [
"/var/db/dhcpcd/enp1s0.lease"
];
};
fileSystems = {
"/boot" = {
device = "/dev/disk/by-label/ESP";
fsType = "vfat";
};
"/nix" = {
device = "/dev/disk/by-label/nix";
fsType = "ext4";
};
"/persist" = {
device = "/dev/disk/by-label/persist";
fsType = "ext4";
@@ -27,5 +38,7 @@
};
};
networking = { };
networking = {
interfaces.enp1s0.useDHCP = true;
};
}

72
nixos/installer.nix
View File

@@ -1,6 +1,8 @@
{ lib, pkgs, modulesPath, config, ... }:
let
inherit (lib) mkDefault mkForce;
inherit (lib) mkDefault mkForce mkImageMediaOverride;
installRoot = "/mnt";
in
{
imports = [
@@ -10,18 +12,69 @@ in
"${modulesPath}/profiles/base.nix"
];
# Some of this is yoinked from modules/profiles/installation-device.nix
config = {
my = {
# Whatever installer mechanism is chosen will provied an appropriate `/`
tmproot.enable = false;
firewall.nat.enable = false;
server.enable = true;
deploy.enable = false;
user.enable = false;
};
environment.sessionVariables = {
INSTALL_ROOT = installRoot;
};
users.users.root.openssh.authorizedKeys.keyFiles = [ lib.my.authorizedKeys ];
home-manager.users.root = {
programs = {
starship.settings = {
hostname.ssh_only = false;
};
};
home.shellAliases = {
show-hw-config = "nixos-generate-config --show-hardware-config --root $INSTALL_ROOT";
};
};
services = {
openssh = {
permitRootLogin = mkImageMediaOverride "prohibit-password";
};
};
# Will be set dynamically
networking.hostName = "";
# This should be overridden by whatever boot mechanism is used
fileSystems."/" = mkDefault {
device = "none";
fsType = "tmpfs";
};
systemd.tmpfiles.rules = [
"d ${installRoot} 0755 root root"
];
boot.postBootCommands =
''
${pkgs.nettools}/bin/hostname "installer-$(${pkgs.coreutils}/bin/head -c4 /dev/urandom | \
${pkgs.coreutils}/bin/od -A none -t x4 | \
${pkgs.gawk}/bin/awk '{ print $1 }')"
'';
environment.systemPackages = with pkgs; [
# We disable networking.useDHCP, so bring these in for the user
# dhcpcd probably has more features, but dhclient actually seems a bit more simple
(pkgs.writeShellScriptBin "dhclient" ''exec ${pkgs.dhcp}/bin/dhclient -v "$@"'')
dhcpcd
];
# Much of this onwards is yoinked from modules/profiles/installation-device.nix
# Good to have docs in the installer!
documentation.enable = mkForce true;
documentation.nixos.enable = mkForce true;
# TODO: docs rebuilding every time?
documentation.enable = mkForce false;
documentation.nixos.enable = mkForce false;
# Enable wpa_supplicant, but don't start it by default.
networking.wireless.enable = mkDefault true;
@@ -39,16 +92,5 @@ in
# download-using-manifests.pl from forking even if there is
# plenty of free memory.
boot.kernel.sysctl."vm.overcommit_memory" = "1";
# This should be overridden by whatever boot mechanism is used
fileSystems."/" = mkDefault {
device = "none";
fsType = "tmpfs";
};
environment.systemPackages = with pkgs; [
# We disable networking.useDHCP, so bring this in for the user
dhcpcd
];
};
}

71
nixos/modules/common.nix
View File

@@ -1,23 +1,31 @@
{ lib, pkgs, pkgs', inputs, options, config, ... }:
let
inherit (builtins) attrValues;
inherit (lib) flatten optional mkIf mkDefault mkMerge mkAliasDefinitions;
inherit (lib.my) mkOpt' mkBoolOpt' dummyOption;
defaultUsername = "dev";
uname = config.my.user.name;
inherit (lib) flatten optional mkIf mkDefault mkMerge mkOption mkAliasDefinitions;
inherit (lib.my) mkOpt' mkBoolOpt' dummyOption mkDefault';
in
{
options = with lib.types; {
my = {
# Pretty hacky but too lazy to figure out if there's a better way to alias the options
user = mkOpt' (attrsOf anything) { } "User definition (as `users.users.*`).";
homeConfig = mkOpt' anything { } "Home configuration (as `home-manager.users.*`)";
# TODO: Move to separate module
user = {
enable = mkBoolOpt' true "Whether to create a primary user.";
config = mkOption {
type = options.users.users.type.nestedTypes.elemType;
default = { };
description = "User definition (as `users.users.*`).";
};
homeConfig = mkOption {
type = options.home-manager.users.type.nestedTypes.elemType;
default = { };
# Prevent docs traversing into all of home-manager
visible = "shallow";
description = "Home configuration (as `home-manager.users.*`)";
};
};
ssh = {
# If enabled, we can't set `authorized_keys` from home-manager because SSH won't like the file being owned by
# root.
strictModes = mkBoolOpt' false
strictModes = mkBoolOpt' true
("Specifies whether sshd(8) should check file modes and ownership of the user's files and home directory "+
"before accepting login.");
};
@@ -28,17 +36,37 @@ in
};
config = mkMerge [
(let
cfg = config.my.user;
user' = cfg.config;
in mkIf cfg.enable
{
my = {
user = {
name = mkDefault defaultUsername;
isNormalUser = true;
uid = mkDefault 1000;
extraGroups = mkDefault [ "wheel" ];
password = mkDefault "hunter2"; # TODO: secrets...
config = {
name = mkDefault' "dev";
isNormalUser = true;
uid = mkDefault 1000;
extraGroups = mkDefault [ "wheel" ];
password = mkDefault "hunter2"; # TODO: secrets...
openssh.authorizedKeys.keyFiles = [ lib.my.authorizedKeys ];
};
# In order for this option to evaluate on its own, home-manager expects the `name` (which is derived from the
# parent attr name) to be the users name, aka `home-manager.users.<name>`
homeConfig = { _module.args.name = lib.mkForce user'.name; };
};
deploy.authorizedKeys = mkDefault user'.openssh.authorizedKeys;
};
# mkAliasDefinitions will copy the unmerged defintions to allow the upstream submodule to deal with
users.users.${user'.name} = mkAliasDefinitions options.my.user.config;
# NOTE: As the "outermost" module is still being evaluated in NixOS land, special params (e.g. pkgs) won't be
# passed to it
home-manager.users.${user'.name} = mkAliasDefinitions options.my.user.homeConfig;
})
{
home-manager = {
# Installs packages in the system config instead of in the local profile on activation
useUserPackages = mkDefault true;
@@ -46,13 +74,8 @@ in
users = {
mutableUsers = false;
users.${uname} = mkAliasDefinitions options.my.user;
};
# NOTE: As the "outermost" module is still being evaluated in NixOS land, special params (e.g. pkgs) won't be
# passed to it
home-manager.users.${uname} = config.my.homeConfig;
security = {
sudo.enable = mkDefault false;
doas = {
@@ -63,6 +86,8 @@ in
nix = {
package = pkgs'.unstable.nixVersions.stable;
# TODO: This has been renamed to nix.settings.trusted-users in 22.05
trustedUsers = [ "@wheel" ];
extraOptions =
''
experimental-features = nix-command flakes ca-derivations
@@ -70,6 +95,7 @@ in
};
nixpkgs = {
overlays = [
inputs.deploy-rs.overlay
# TODO: Wait for https://github.com/NixOS/nixpkgs/pull/159074 to arrive to nixos-unstable
(final: prev: { remarshal = pkgs'.master.remarshal; })
];
@@ -109,6 +135,7 @@ in
};
networking = {
domain = mkDefault "int.nul.ie";
useDHCP = mkDefault false;
enableIPv6 = mkDefault true;
};
@@ -137,6 +164,8 @@ in
openssh = {
enable = mkDefault true;
extraConfig = ''StrictModes ${if config.my.ssh.strictModes then "yes" else "no"}'';
permitRootLogin = mkDefault "no";
passwordAuthentication = mkDefault false;
};
};

66
nixos/modules/deploy-rs.nix Normal file
View File

@@ -0,0 +1,66 @@
{ lib, extendModules, pkgs, options, config, baseModules, ... }:
let
inherit (builtins) head;
inherit (lib) mkOption mkMerge mkIf mkDefault;
inherit (lib.my) mkOpt' mkBoolOpt';
cfg = config.my.deploy;
in
{
options.my.deploy = with lib.types; rec {
authorizedKeys = {
keys = mkOpt' (listOf singleLineStr) [ ] "SSH public keys to add to the default deployment user.";
keyFiles = mkOpt' (listOf str) [ ] "SSH public key files to add to the default deployment user.";
};
enable = mkBoolOpt' true "Whether to expose deploy-rs configuration for this system.";
node = mkOpt' lib.my.deploy-rs.node { } "deploy-rs node configuration.";
generate = {
system.enable = mkBoolOpt' true "Whether to generate a deploy-rs profile for this system's config.";
};
rendered = mkOption {
type = nullOr (attrsOf anything);
default = null;
internal = true;
description = "Rendered deploy-rs node configuration.";
};
};
config = mkMerge [
{
my.deploy = {
enable = mkIf config.my.build.isDevVM false;
node = {
hostname = mkDefault config.networking.fqdn;
profiles = {
system = mkIf cfg.generate.system.enable {
path = pkgs.deploy-rs.lib.activate.nixos { inherit config; };
user = "root";
};
};
sshUser = "deploy";
user = mkDefault "root";
sudo = mkDefault (if config.security.doas.enable then "doas -u" else "sudo -u");
sshOpts = mkDefault [ "-p" (toString (head config.services.openssh.ports)) ];
};
rendered = mkIf cfg.enable (lib.my.deploy-rs.filterOpts cfg.node);
};
}
(mkIf cfg.enable {
users = {
users."${cfg.node.sshUser}" = {
isSystemUser = true;
group = cfg.node.sshUser;
extraGroups = mkDefault [ "wheel" ];
shell = pkgs.bash;
openssh.authorizedKeys = cfg.authorizedKeys;
};
groups."${cfg.node.sshUser}" = {};
};
})
];
}

9
nixos/modules/server.nix
View File

@@ -1,19 +1,20 @@
{ config, lib, ... }:
let
inherit (lib) mkIf;
inherit (lib) mkIf mkDefault;
inherit (lib.my) mkBoolOpt';
cfg = config.my.server;
uname = if config.my.user.enable then config.my.user.config.name else "root";
in
{
options.my.server.enable = mkBoolOpt' false "Whether to enable common configuration for servers.";
config = mkIf cfg.enable {
services = {
getty.autologinUser = config.my.user.name;
kmscon.autologinUser = config.my.user.name;
getty.autologinUser = mkDefault uname;
kmscon.autologinUser = mkDefault uname;
};
my.homeConfig = {
my.user.homeConfig = {
my.gui.enable = false;
};
};

7
nixos/modules/tmproot.nix
View File

@@ -50,7 +50,8 @@ let
rootDef = {
device = "yeet";
fsType = "tmpfs";
options = [ "size=${cfg.size}" ];
# The default mode for tmpfs is 777
options = [ "size=${cfg.size}" "mode=755" ];
};
in
{
@@ -98,6 +99,10 @@ in
# Specifies obsolete files that should be deleted on activation - we'll never have those!
"/etc/.clean"
# These are set in environment.etc by the sshd module, but because their mode needs to be changed,
# setup-etc will copy them instead of symlinking
"/etc/ssh/authorized_keys.d"
];
environment.systemPackages = [