From 46c2e595fea320ddbe1db01a91ccf22d35701ab8 Mon Sep 17 00:00:00 2001 From: bogale Date: Wed, 7 Oct 2026 00:10:23 +0900 Subject: [PATCH] automated iso download for pxe boot --- common.nix | 4 +- flake.nix | 54 ++++++++--------- home/{desktop => }/bogale.nix | 2 +- home/{desktop => }/data.nix | 2 +- home/{desktop => }/root.nix | 2 +- home/server/root.nix | 8 --- install.sh | 17 ++++++ marks | 11 ---- mods/pxeboot.nix | 108 ++++++++++++++++++++++------------ server/mods/web.nix | 22 +++---- 10 files changed, 129 insertions(+), 101 deletions(-) rename home/{desktop => }/bogale.nix (77%) rename home/{desktop => }/data.nix (76%) rename home/{desktop => }/root.nix (75%) delete mode 100644 home/server/root.nix create mode 100644 install.sh delete mode 100644 marks diff --git a/common.nix b/common.nix index d82e778..90a8a9e 100644 --- a/common.nix +++ b/common.nix @@ -29,8 +29,8 @@ }; }; systemd.tmpfiles.rules = [ - "d /root/backup 0700 root root -" - "d /root/backup/base 0700 root root -" + "d /root/backup" + "d /root/backup/base" "L /root/backup/base/nixos - - - - /etc/nixos" "L /root/backup/base/secrets - - - - /secrets" "L /root/backup/base/sbctl - - - - /var/lib/sbctl" diff --git a/flake.nix b/flake.nix index 3664963..f376312 100644 --- a/flake.nix +++ b/flake.nix @@ -6,34 +6,28 @@ url = "github:nix-community/home-manager"; }; }; - outputs = inputs@{ self, nixpkgs, home-manager, ... }: { - nixosConfigurations = { - nixos-server = nixpkgs.lib.nixosSystem { - modules = [ - ./server/configuration.nix - home-manager.nixosModules.home-manager { - home-manager.useGlobalPkgs = true; - home-manager.useUserPackages = true; - home-manager.extraSpecialArgs = { inherit inputs; }; - home-manager.users.root = ./home/server/root.nix; - } - ]; - }; - nixos-desktop = nixpkgs.lib.nixosSystem { - modules = [ - ./desktop/configuration.nix - home-manager.nixosModules.home-manager { - home-manager.useGlobalPkgs = true; - home-manager.useUserPackages = true; - home-manager.extraSpecialArgs = { inherit inputs; }; - home-manager.users = { - data = ./home/desktop/data.nix; - root = ./home/desktop/root.nix; - bogale = ./home/desktop/bogale.nix; - }; - } - ]; - }; - }; - }; + outputs = inputs@{ self, nixpkgs, home-manager, ... }: { nixosConfigurations = { + nixos-server = nixpkgs.lib.nixosSystem { modules = [ + ./server/configuration.nix + home-manager.nixosModules.home-manager { home-manager = { + useGlobalPkgs = true; + useUserPackages = true; + users.root = ./home/root.nix; + extraSpecialArgs = { inherit inputs; }; + }; } + ]; }; + nixos-desktop = nixpkgs.lib.nixosSystem { modules = [ + ./desktop/configuration.nix + home-manager.nixosModules.home-manager { home-manager = { + useGlobalPkgs = true; + useUserPackages = true; + extraSpecialArgs = { inherit inputs; }; + users = { + data = ./home/data.nix; + root = ./home/root.nix; + bogale = ./home/bogale.nix; + }; + }; } + ]; }; + }; }; } diff --git a/home/desktop/bogale.nix b/home/bogale.nix similarity index 77% rename from home/desktop/bogale.nix rename to home/bogale.nix index 3fe8e42..70ec97a 100644 --- a/home/desktop/bogale.nix +++ b/home/bogale.nix @@ -1,6 +1,6 @@ { config, pkgs, ... }: { - imports = [ ../common.nix ]; + imports = [ ./common.nix ]; home = { username = "bogale"; homeDirectory = "/home/bogale"; diff --git a/home/desktop/data.nix b/home/data.nix similarity index 76% rename from home/desktop/data.nix rename to home/data.nix index 36b4edc..2c64968 100644 --- a/home/desktop/data.nix +++ b/home/data.nix @@ -1,6 +1,6 @@ { config, pkgs, ... }: { - imports = [ ../common.nix ]; + imports = [ ./common.nix ]; home = { username = "data"; homeDirectory = "/home/data"; diff --git a/home/desktop/root.nix b/home/root.nix similarity index 75% rename from home/desktop/root.nix rename to home/root.nix index f9e4713..76e6ac2 100644 --- a/home/desktop/root.nix +++ b/home/root.nix @@ -1,6 +1,6 @@ { config, pkgs, ... }: { - imports = [ ../common.nix ]; + imports = [ ./common.nix ]; home = { username = "root"; homeDirectory = "/root"; diff --git a/home/server/root.nix b/home/server/root.nix deleted file mode 100644 index f9e4713..0000000 --- a/home/server/root.nix +++ /dev/null @@ -1,8 +0,0 @@ -{ config, pkgs, ... }: -{ - imports = [ ../common.nix ]; - home = { - username = "root"; - homeDirectory = "/root"; - }; -} diff --git a/install.sh b/install.sh new file mode 100644 index 0000000..2e87fac --- /dev/null +++ b/install.sh @@ -0,0 +1,17 @@ +set -euo pipefail +gdisk $DISK +mkfs.fat -F 32 $ESPPART +cryptsetup luksFormat $ROOTPART +cryptsetup open $ROOTPART root +mkfs.ext4 $ROOTPART +mount /dev/mapper/root /mnt +mount $ESPPART --mkdir -o umask=077 /mnt/boot +mkdir /mnt/var +mkswap -F -s $SWAPSIZE /mnt/var/swapfile +swapon /mnt/var/swapfile +mkdir -p /mnt/etc/nixos +nixos-generate-config --root /mnt --kernel latest --flake +#copy backup +nixos-install --no-root-passwd --no-channel-copy --flake "/mnt/etc/nixos#nixos" +sbctl enroll-keys --yes-this-might-brick-my-machine +systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+2+7 $ROOTPART diff --git a/marks b/marks deleted file mode 100644 index c80fb7f..0000000 --- a/marks +++ /dev/null @@ -1,11 +0,0 @@ -installation: -gdisk -cryptsetup -mkfs -mount -copy backup -mkswap -s $SIZE -F /mnt/var/swapfile -swapon /mnt/var/swapfile -sbctl enroll-keys --yes-this-might-brick-my-machine -nixos-install --flake "/mnt/etc/nixos#nixos" --no-channel-copy --no-root-passwd -systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+2+7 diff --git a/mods/pxeboot.nix b/mods/pxeboot.nix index 52c2e62..308f140 100644 --- a/mods/pxeboot.nix +++ b/mods/pxeboot.nix @@ -42,36 +42,46 @@ }; }; systemd = { - tmpfiles.rules = [ "d /var/lib/podman-dracut 0755 root root -" ]; + tmpfiles.rules = [ "d /srv/tftp" ]; services.pxeboot = { - serviceConfig.Type = "oneshot"; - #wantedBy = [ "multi-user.target" ]; - path = with pkgs; [ xz e2fsprogs grub2_efi util-linux ]; + before = [ "nfs-server.service" ]; + requiredBy = [ "nfs-server.service" ]; + path = with pkgs; [ xz curl e2fsprogs grub2_efi util-linux ]; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + ExecStop = pkgs.writeShellScript "stop.sh" '' + set -e + for distro in arch fedora; do + cd /srv/nfs/$distro + mountpoint -q root && umount root + mountpoint -q lower && umount lower + mountpoint -q loop && umount loop + done + ''; + }; script = let resolv = pkgs.writeText "resolv.conf" '' nameserver fc02::1 nameserver 10.2.0.1 options edns0 trust-ad ''; - entryScript = pkgs.writeText "entry.sh" '' - set -e - dnf install -y dracut-network nfs-utils - cd /data/workdir - for target in $(cd ..; ls | grep -v workdir); do - modsDir=../$target/usr/lib/modules/* - mkdir $target - cp $modsDir/vmlinuz $target - dracut -Nm "network-manager nfs" --zstd -k $modsDir \ - --kver $(basename $modsDir) $target/initramfs - done - ''; + archIso = { + rootfs = "arch/x86_64/airootfs.sfs"; + hash = "684ded26c63240ff4a41e8c25ee84ea6da233f557364821f13d12c2b0a9059a5"; + url = "https://fastly.mirror.pkgbuild.com/iso/2026.10.01/archlinux-x86_64.iso"; + }; + fedoraIso = { + rootfs = "LiveOS/squashfs.img"; + hash = "1620295f6a00c27c3208f0c00b8ece4eab1ec69b9002152d97488bf26a426ddf"; + url = "https://download.fedoraproject.org/pub/fedora/linux/releases/" + + "44/Workstation/x86_64/iso/Fedora-Workstation-Live-44-1.7.x86_64.iso"; + }; grubCfg = pkgs.writeText "grub.cfg" '' - set timeout=5 - #set path=(http,$net_default_server)/local/boot/pxe - set nfs="rw ip=dhcp root=nfs4:$net_default_server:/srv/nfs" function load { - linux $path/$1/vmlinuz $nfs/$1/root $2 - initrd $path/$1/initramfs + set p=$cmdpath/boot/$1 + linux $p/vmlinuz $2 rw ip=dhcp root=nfs4:$net_default_server:/srv/nfs/$1/root + initrd $p/initramfs } menuentry Arch { load arch @@ -80,15 +90,40 @@ load fedora selinux=0 } ''; + entryScript = pkgs.writeShellScript "entry.sh" '' + set -e + dnf install -y nfs-utils dracut-network + cd /data/workdir + for target in $(ls .. | grep -v workdir); do + mkdir $target + modsDir=../$target/usr/lib/modules/* + cp $modsDir/vmlinuz $target + dracut -Nm "network-manager nfs" --zstd -k $modsDir \ + --kver $(basename $modsDir) $target/initramfs + done + ''; in '' - for distro in arch:arch/x86_64/airootfs.sfs fedora:LiveOS/squashfs.img; do - rootfs=''${distro##*:} - distro=''${distro%:*} + for distro in arch fedora; do + case $distro in + arch) url=${archIso.url} + rootfs=${archIso.rootfs} + hash=${archIso.hash};; + fedora) url=${fedoraIso.url} + rootfs=${fedoraIso.rootfs} + hash=${fedoraIso.hash};; + esac + mkdir -p /srv/nfs/$distro cd /srv/nfs/$distro - mkdir -p loop work lower upper #root -> move to tmpfiles + if [ ! -e $distro.iso ]; then + curl -C - "$url" -Lo $distro.iso.tmp + mv $distro.iso{.tmp,} + sha256sum $distro.iso | grep $hash + fi + mkdir -p loop root work lower upper mountpoint -q loop || mount $distro.iso loop mountpoint -q lower || mount loop/$rootfs lower - mountpoint -q root || mount -t overlay overlay -o workdir=work,nfs_export=on,lowerdir=lower,upperdir=upper root + mountpoint -q root || mount -t overlay overlay root -o \ + workdir=work,nfs_export=on,lowerdir=lower,upperdir=upper if [ ! -e upper/etc/resolv.conf ]; then cd root/etc rm -f resolv.conf @@ -96,19 +131,20 @@ chattr +i resolv.conf fi done - cd /srv - #either check of tftp dir, or file in tftp, if it forced to exists through tmpfiles + cd /srv/tftp if [ ! -e grubx64.efi ]; then - grub-mkstandalone -O x86_64-efi --compress=xz -o grubx64.efi #--modules=efinet /boot/grub/grub.cfg=${grubCfg} + grub-mkstandalone -O x86_64-efi --compress=xz -o \ + grubx64.efi --modules=efinet /boot/grub/grub.cfg=${grubCfg} fi - if [ ! -e pxe ]; then - mkdir pxe - cp ${entryScript} /var/lib/podman-dracut/entry.sh + if [ ! -e boot ]; then + workdir=/var/lib/podman-dracut + rm -rf $workdir + mkdir boot $workdir + cp ${entryScript} $workdir/entry.sh systemctl --wait start podman-fedora-dracut.service - mv /var/lib/podman-dracut/*/ pxe - chmod -R 640 pxe - chgrp -R php pxe - chmod ug+x $(find pxe -type d) + mv $workdir/*/ boot + chmod -R 644 boot + chmod +x $(find boot -type d) fi ''; }; diff --git a/server/mods/web.nix b/server/mods/web.nix index 296ca2c..6ee8b24 100644 --- a/server/mods/web.nix +++ b/server/mods/web.nix @@ -54,18 +54,18 @@ ENABLE_CAPTCHA = true; REGISTER_EMAIL_CONFIRM = true; }; - server = { - SSH_PORT = 32831; - PROTOCOL = "http+unix"; - ROOT_URL = "https://bogaledev.ru/git/"; - HTTP_ADDR = "/run/forgejo/forgejo.sock"; - }; mailer = { ENABLED = true; SMTP_PORT = 25; SMTP_ADDR = "localhost"; FROM = "Forgejo "; }; + server = { + SSH_PORT = 32831; + PROTOCOL = "http+unix"; + ROOT_URL = "https://bogaledev.ru/git/"; + HTTP_ADDR = "/run/forgejo/forgejo.sock"; + }; }; }; nginx = { @@ -105,11 +105,6 @@ "/".extraConfig = phpPool; "/local/".extraConfig = "${phpPool} ${localNetworks}"; "/git/".proxyPass = "http://unix:/run/forgejo/forgejo.sock:/"; - "/grafana/" = { - proxyWebsockets = true; - extraConfig = localNetworks; - proxyPass = "http://unix:/run/grafana/grafana.sock:/"; - }; "/local/net/".extraConfig = '' allow fc01::/64; allow 10.1.0.0/16; @@ -120,6 +115,11 @@ extraConfig = localNetworks; proxyPass = "http://localhost:46151"; }; + "/grafana/" = { + proxyWebsockets = true; + extraConfig = localNetworks; + proxyPass = "http://unix:/run/grafana/grafana.sock:/"; + }; }; }; };