automated iso download for pxe boot

common.nix

@@ -29,8 +29,8 @@
     };
   };
   systemd.tmpfiles.rules = [
-    "d /root/backup 0700 root root -"
+    "d /root/backup"
-    "d /root/backup/base 0700 root root -"
+    "d /root/backup/base"
     "L /root/backup/base/nixos - - - - /etc/nixos"
     "L /root/backup/base/secrets - - - - /secrets"
     "L /root/backup/base/sbctl - - - - /var/lib/sbctl"

flake.nix

@@ -6,34 +6,28 @@
       url = "github:nix-community/home-manager";
     };
   };
-  outputs = inputs@{ self, nixpkgs, home-manager, ... }: {
+  outputs = inputs@{ self, nixpkgs, home-manager, ... }: { nixosConfigurations = {
-    nixosConfigurations = {
+    nixos-server = nixpkgs.lib.nixosSystem { modules = [
-      nixos-server = nixpkgs.lib.nixosSystem {
+      ./server/configuration.nix
-        modules = [
+      home-manager.nixosModules.home-manager { home-manager = {
-          ./server/configuration.nix
+        useGlobalPkgs = true;
-          home-manager.nixosModules.home-manager {
+        useUserPackages = true;
-            home-manager.useGlobalPkgs = true;
+        users.root = ./home/root.nix;
-            home-manager.useUserPackages = true;
+        extraSpecialArgs = { inherit inputs; };
-            home-manager.extraSpecialArgs = { inherit inputs; };
+      }; }
-            home-manager.users.root = ./home/server/root.nix;
+    ]; };
-          }
+    nixos-desktop = nixpkgs.lib.nixosSystem { modules = [
-        ];
+      ./desktop/configuration.nix
-      };
+      home-manager.nixosModules.home-manager { home-manager = {
-      nixos-desktop = nixpkgs.lib.nixosSystem {
+        useGlobalPkgs = true;
-        modules = [
+        useUserPackages = true;
-          ./desktop/configuration.nix
+        extraSpecialArgs = { inherit inputs; };
-          home-manager.nixosModules.home-manager {
+        users = {
-            home-manager.useGlobalPkgs = true;
+          data = ./home/data.nix;
-            home-manager.useUserPackages = true;
+          root = ./home/root.nix;
-            home-manager.extraSpecialArgs = { inherit inputs; };
+          bogale = ./home/bogale.nix;
-            home-manager.users = {
+        };
-              data = ./home/desktop/data.nix;
+      }; }
-              root = ./home/desktop/root.nix;
+    ]; };
-              bogale = ./home/desktop/bogale.nix;
+  }; };
-            };
-          }
-        ];
-      };
-    };
-  };
 }

home/bogale.nix

@@ -1,6 +1,6 @@
 { config, pkgs, ... }:
 {
-  imports = [ ../common.nix ];
+  imports = [ ./common.nix ];
   home = {
     username = "bogale";
     homeDirectory = "/home/bogale";

home/data.nix

@@ -1,6 +1,6 @@
 { config, pkgs, ... }:
 {
-  imports = [ ../common.nix ];
+  imports = [ ./common.nix ];
   home = {
     username = "data";
     homeDirectory = "/home/data";

home/root.nix

@@ -1,6 +1,6 @@
 { config, pkgs, ... }:
 {
-  imports = [ ../common.nix ];
+  imports = [ ./common.nix ];
   home = {
     username = "root";
     homeDirectory = "/root";

home/server/root.nix

@@ -1,8 +0,0 @@
-{ config, pkgs, ... }:
-{
-  imports = [ ../common.nix ];
-  home = {
-    username = "root";
-    homeDirectory = "/root";
-  };
-}

install.sh

@@ -0,0 +1,17 @@
+set -euo pipefail
+gdisk $DISK
+mkfs.fat -F 32 $ESPPART
+cryptsetup luksFormat $ROOTPART
+cryptsetup open $ROOTPART root
+mkfs.ext4 $ROOTPART
+mount /dev/mapper/root /mnt
+mount $ESPPART --mkdir -o umask=077 /mnt/boot
+mkdir /mnt/var
+mkswap -F -s $SWAPSIZE /mnt/var/swapfile
+swapon /mnt/var/swapfile
+mkdir -p /mnt/etc/nixos
+nixos-generate-config --root /mnt --kernel latest --flake
+#copy backup
+nixos-install --no-root-passwd --no-channel-copy --flake "/mnt/etc/nixos#nixos"
+sbctl enroll-keys --yes-this-might-brick-my-machine
+systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+2+7 $ROOTPART

marks

@@ -1,11 +0,0 @@
-installation:
-gdisk
-cryptsetup
-mkfs
-mount
-copy backup
-mkswap -s $SIZE -F /mnt/var/swapfile
-swapon /mnt/var/swapfile
-sbctl enroll-keys --yes-this-might-brick-my-machine
-nixos-install --flake "/mnt/etc/nixos#nixos" --no-channel-copy --no-root-passwd
-systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+2+7 <LUKS_DEV>

mods/pxeboot.nix

@@ -42,36 +42,46 @@
     };
   };
   systemd = {
-    tmpfiles.rules = [ "d /var/lib/podman-dracut 0755 root root -" ];
+    tmpfiles.rules = [ "d /srv/tftp" ];
     services.pxeboot = {
-      serviceConfig.Type = "oneshot";
+      before = [ "nfs-server.service" ];
-      #wantedBy = [ "multi-user.target" ];
+      requiredBy = [ "nfs-server.service" ];
-      path = with pkgs; [ xz e2fsprogs grub2_efi util-linux ];
+      path = with pkgs; [ xz curl e2fsprogs grub2_efi util-linux ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        ExecStop = pkgs.writeShellScript "stop.sh" ''
+          set -e
+          for distro in arch fedora; do
+            cd /srv/nfs/$distro
+            mountpoint -q root && umount root
+            mountpoint -q lower && umount lower
+            mountpoint -q loop && umount loop
+          done
+        '';
+      };
       script = let
         resolv = pkgs.writeText "resolv.conf" ''
           nameserver fc02::1
           nameserver 10.2.0.1
           options edns0 trust-ad
         '';
-        entryScript = pkgs.writeText "entry.sh" ''
+        archIso = {
-          set -e
+          rootfs = "arch/x86_64/airootfs.sfs";
-          dnf install -y dracut-network nfs-utils
+          hash = "684ded26c63240ff4a41e8c25ee84ea6da233f557364821f13d12c2b0a9059a5";
-          cd /data/workdir
+          url = "https://fastly.mirror.pkgbuild.com/iso/2026.10.01/archlinux-x86_64.iso";
-          for target in $(cd ..; ls | grep -v workdir); do
+        };
-            modsDir=../$target/usr/lib/modules/*
+        fedoraIso = {
-            mkdir $target
+          rootfs = "LiveOS/squashfs.img";
-            cp $modsDir/vmlinuz $target
+          hash = "1620295f6a00c27c3208f0c00b8ece4eab1ec69b9002152d97488bf26a426ddf";
-            dracut -Nm "network-manager nfs" --zstd -k $modsDir \
+          url = "https://download.fedoraproject.org/pub/fedora/linux/releases/" +
-              --kver $(basename $modsDir) $target/initramfs
+          "44/Workstation/x86_64/iso/Fedora-Workstation-Live-44-1.7.x86_64.iso";
-          done
+        };
-        '';
         grubCfg = pkgs.writeText "grub.cfg" ''
-          set timeout=5
-          #set path=(http,$net_default_server)/local/boot/pxe
-          set nfs="rw ip=dhcp root=nfs4:$net_default_server:/srv/nfs"
           function load {
-            linux $path/$1/vmlinuz $nfs/$1/root $2
+            set p=$cmdpath/boot/$1
-            initrd $path/$1/initramfs
+            linux $p/vmlinuz $2 rw ip=dhcp root=nfs4:$net_default_server:/srv/nfs/$1/root
+            initrd $p/boot/$1/initramfs
           }
           menuentry Arch {
             load arch
@@ -80,15 +90,40 @@
             load fedora selinux=0
           }
         '';
+        entryScript = pkgs.writeShellScript "entry.sh" ''
+          set -e
+          dnf install -y nfs-utils dracut-network
+          cd /data/workdir
+          for target in $(ls .. | grep -v workdir); do
+            mkdir $target
+            modsDir=../$target/usr/lib/modules/*
+            cp $modsDir/vmlinuz $target
+            dracut -Nm "network-manager nfs" --zstd -k $modsDir \
+              --kver $(basename $modsDir) $target/initramfs
+          done
+        '';
       in ''
-        for distro in arch:arch/x86_64/airootfs.sfs fedora:LiveOS/squashfs.img; do
+        for distro in arch fedora; do
-          rootfs=''${distro##*:}
+          case $distro in
-          distro=''${distro%:*}
+            arch) url=${archIso.url}
+            rootfs=${archIso.rootfs}
+            hash=${archIso.hash};;
+            fedora) url=${fedoraIso.url}
+            rootfs=${fedoraIso.rootfs}
+            hash=${fedoraIso.hash};;
+          esac
+          mkdir -p /srv/nfs/$distro
           cd /srv/nfs/$distro
-          mkdir -p loop work lower upper #root -> move to tmpfiles
+          if [ ! -e $distro.iso ]; then
+            curl -C - "$url" -Lo $distro.iso.tmp
+            mv $distro.iso{.tmp,}
+            sha256sum $distro.iso | grep $hash
+          fi
+          mkdir -p loop root work lower upper
           mountpoint -q loop || mount $distro.iso loop
           mountpoint -q lower || mount loop/$rootfs lower
-          mountpoint -q root || mount -t overlay overlay -o workdir=work,nfs_export=on,lowerdir=lower,upperdir=upper root
+          mountpoint -q root || mount -t overlay overlay root -o \
+            workdir=work,nfs_export=on,lowerdir=lower,upperdir=upper
           if [ ! -e upper/etc/resolv.conf ]; then
             cd root/etc
             rm -f resolv.conf
@@ -96,19 +131,20 @@
             chattr +i resolv.conf
           fi
         done
-        cd /srv
+        cd /srv/tftp
-        #either check of tftp dir, or file in tftp, if it forced to exists through tmpfiles
         if [ ! -e grubx64.efi ]; then
-          grub-mkstandalone -O x86_64-efi --compress=xz -o grubx64.efi #--modules=efinet /boot/grub/grub.cfg=${grubCfg}
+          grub-mkstandalone -O x86_64-efi --compress=xz -o \
+            grubx64.efi --modules=efinet /boot/grub/grub.cfg=${grubCfg}
         fi
-        if [ ! -e pxe ]; then
+        if [ ! -e boot ]; then
-          mkdir pxe
+          workdir=/var/lib/podman-dracut
-          cp ${entryScript} /var/lib/podman-dracut/entry.sh
+          rm -rf $workdir
+          mkdir boot $workdir
+          cp ${entryScript} $workdir/entry.sh
           systemctl --wait start podman-fedora-dracut.service
-          mv /var/lib/podman-dracut/*/ pxe
+          mv $workdir/*/ boot
-          chmod -R 640 pxe
+          chmod -R 644 boot
-          chgrp -R php pxe
+          chmod +x $(find boot -type d)
-          chmod ug+x $(find pxe -type d)
         fi
       '';
     };

server/mods/web.nix

@@ -54,18 +54,18 @@
           ENABLE_CAPTCHA = true;
           REGISTER_EMAIL_CONFIRM = true;
         };
-        server = {
-          SSH_PORT = 32831;
-          PROTOCOL = "http+unix";
-          ROOT_URL = "https://bogaledev.ru/git/";
-          HTTP_ADDR = "/run/forgejo/forgejo.sock";
-        };
         mailer = {
           ENABLED = true;
           SMTP_PORT = 25;
           SMTP_ADDR = "localhost";
           FROM = "Forgejo <forgejo@bogaledev.ru>";
         };
+        server = {
+          SSH_PORT = 32831;
+          PROTOCOL = "http+unix";
+          ROOT_URL = "https://bogaledev.ru/git/";
+          HTTP_ADDR = "/run/forgejo/forgejo.sock";
+        };
       };
     };
     nginx = {
@@ -105,11 +105,6 @@
           "/".extraConfig = phpPool;
           "/local/".extraConfig = "${phpPool} ${localNetworks}";
           "/git/".proxyPass = "http://unix:/run/forgejo/forgejo.sock:/";
-          "/grafana/" = {
-            proxyWebsockets = true;
-            extraConfig = localNetworks;
-            proxyPass = "http://unix:/run/grafana/grafana.sock:/";
-          };
           "/local/net/".extraConfig = ''
             allow fc01::/64;
             allow 10.1.0.0/16;
@@ -120,6 +115,11 @@
             extraConfig = localNetworks;
             proxyPass = "http://localhost:46151";
           };
+          "/grafana/" = {
+            proxyWebsockets = true;
+            extraConfig = localNetworks;
+            proxyPass = "http://unix:/run/grafana/grafana.sock:/";
+          };
         };
       };
     };