bogale/nixos
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

automated iso download for pxe boot

Browse source
This commit is contained in:
bogale 2026-10-06 23:47:12 +09:00
commit 692e10627f
10 changed files with 129 additions and 101 deletions
Download patch file Download diff file Expand all files Collapse all files

4
common.nix
View file

@ -29,8 +29,8 @@
};
};
systemd.tmpfiles.rules = [
"d /root/backup 0700 root root -"
"d /root/backup/base 0700 root root -"
"d /root/backup"
"d /root/backup/base"
"L /root/backup/base/nixos - - - - /etc/nixos"
"L /root/backup/base/secrets - - - - /secrets"
"L /root/backup/base/sbctl - - - - /var/lib/sbctl"

48
flake.nix
View file

@ -6,34 +6,28 @@
url = "github:nix-community/home-manager";
};
};
outputs = inputs@{ self, nixpkgs, home-manager, ... }: {
nixosConfigurations = {
nixos-server = nixpkgs.lib.nixosSystem {
modules = [
outputs = inputs@{ self, nixpkgs, home-manager, ... }: { nixosConfigurations = {
nixos-server = nixpkgs.lib.nixosSystem { modules = [
./server/configuration.nix
home-manager.nixosModules.home-manager {
home-manager.useGlobalPkgs = true;
home-manager.useUserPackages = true;
home-manager.extraSpecialArgs = { inherit inputs; };
home-manager.users.root = ./home/server/root.nix;
}
];
};
nixos-desktop = nixpkgs.lib.nixosSystem {
modules = [
home-manager.nixosModules.home-manager { home-manager = {
useGlobalPkgs = true;
useUserPackages = true;
users.root = ./home/root.nix;
extraSpecialArgs = { inherit inputs; };
}; }
]; };
nixos-desktop = nixpkgs.lib.nixosSystem { modules = [
./desktop/configuration.nix
home-manager.nixosModules.home-manager {
home-manager.useGlobalPkgs = true;
home-manager.useUserPackages = true;
home-manager.extraSpecialArgs = { inherit inputs; };
home-manager.users = {
data = ./home/desktop/data.nix;
root = ./home/desktop/root.nix;
bogale = ./home/desktop/bogale.nix;
};
}
];
};
};
home-manager.nixosModules.home-manager { home-manager = {
useGlobalPkgs = true;
useUserPackages = true;
extraSpecialArgs = { inherit inputs; };
users = {
data = ./home/data.nix;
root = ./home/root.nix;
bogale = ./home/bogale.nix;
};
}; }
]; };
}; };
}

2
home/desktop/bogale.nix → home/bogale.nix
View file

@ -1,6 +1,6 @@
{ config, pkgs, ... }:
{
imports = [ ../common.nix ];
imports = [ ./common.nix ];
home = {
username = "bogale";
homeDirectory = "/home/bogale";

2
home/desktop/data.nix → home/data.nix
View file

@ -1,6 +1,6 @@
{ config, pkgs, ... }:
{
imports = [ ../common.nix ];
imports = [ ./common.nix ];
home = {
username = "data";
homeDirectory = "/home/data";

2
home/desktop/root.nix → home/root.nix
View file

@ -1,6 +1,6 @@
{ config, pkgs, ... }:
{
imports = [ ../common.nix ];
imports = [ ./common.nix ];
home = {
username = "root";
homeDirectory = "/root";

8
home/server/root.nix
View file

@ -1,8 +0,0 @@
{ config, pkgs, ... }:
{
imports = [ ../common.nix ];
home = {
username = "root";
homeDirectory = "/root";
};
}

17
install.sh Normal file
View file

@ -0,0 +1,17 @@
set -euo pipefail
gdisk $DISK
mkfs.fat -F 32 $ESPPART
cryptsetup luksFormat $ROOTPART
cryptsetup open $ROOTPART root
mkfs.ext4 $ROOTPART
mount /dev/mapper/root /mnt
mount $ESPPART --mkdir -o umask=077 /mnt/boot
mkdir /mnt/var
mkswap -F -s $SWAPSIZE /mnt/var/swapfile
swapon /mnt/var/swapfile
mkdir -p /mnt/etc/nixos
nixos-generate-config --root /mnt --kernel latest --flake
#copy backup
nixos-install --no-root-passwd --no-channel-copy --flake "/mnt/etc/nixos#nixos"
sbctl enroll-keys --yes-this-might-brick-my-machine
systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+2+7 $ROOTPART

11
marks
View file

@ -1,11 +0,0 @@
installation:
gdisk
cryptsetup
mkfs
mount
copy backup
mkswap -s $SIZE -F /mnt/var/swapfile
swapon /mnt/var/swapfile
sbctl enroll-keys --yes-this-might-brick-my-machine
nixos-install --flake "/mnt/etc/nixos#nixos" --no-channel-copy --no-root-passwd
systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+2+7 <LUKS_DEV>

108
mods/pxeboot.nix
View file

@ -42,36 +42,46 @@
};
};
systemd = {
tmpfiles.rules = [ "d /var/lib/podman-dracut 0755 root root -" ];
tmpfiles.rules = [ "d /srv/tftp" ];
services.pxeboot = {
serviceConfig.Type = "oneshot";
#wantedBy = [ "multi-user.target" ];
path = with pkgs; [ xz e2fsprogs grub2_efi util-linux ];
before = [ "nfs-server.service" ];
requiredBy = [ "nfs-server.service" ];
path = with pkgs; [ xz curl e2fsprogs grub2_efi util-linux ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStop = pkgs.writeShellScript "stop.sh" ''
set -e
for distro in arch fedora; do
cd /srv/nfs/$distro
mountpoint -q root && umount root
mountpoint -q lower && umount lower
mountpoint -q loop && umount loop
done
'';
};
script = let
resolv = pkgs.writeText "resolv.conf" ''
nameserver fc02::1
nameserver 10.2.0.1
options edns0 trust-ad
'';
entryScript = pkgs.writeText "entry.sh" ''
set -e
dnf install -y dracut-network nfs-utils
cd /data/workdir
for target in $(cd ..; ls | grep -v workdir); do
modsDir=../$target/usr/lib/modules/*
mkdir $target
cp $modsDir/vmlinuz $target
dracut -Nm "network-manager nfs" --zstd -k $modsDir \
--kver $(basename $modsDir) $target/initramfs
done
'';
archIso = {
rootfs = "arch/x86_64/airootfs.sfs";
hash = "684ded26c63240ff4a41e8c25ee84ea6da233f557364821f13d12c2b0a9059a5";
url = "https://fastly.mirror.pkgbuild.com/iso/2026.10.01/archlinux-x86_64.iso";
};
fedoraIso = {
rootfs = "LiveOS/squashfs.img";
hash = "1620295f6a00c27c3208f0c00b8ece4eab1ec69b9002152d97488bf26a426ddf";
url = "https://download.fedoraproject.org/pub/fedora/linux/releases/" +
"44/Workstation/x86_64/iso/Fedora-Workstation-Live-44-1.7.x86_64.iso";
};
grubCfg = pkgs.writeText "grub.cfg" ''
set timeout=5
#set path=(http,$net_default_server)/local/boot/pxe
set nfs="rw ip=dhcp root=nfs4:$net_default_server:/srv/nfs"
function load {
linux $path/$1/vmlinuz $nfs/$1/root $2
initrd $path/$1/initramfs
set p=$cmdpath/boot/$1
linux $p/vmlinuz $2 rw ip=dhcp root=nfs4:$net_default_server:/srv/nfs/$1/root
initrd $p/boot/$1/initramfs
}
menuentry Arch {
load arch
@ -80,15 +90,40 @@
load fedora selinux=0
}
'';
entryScript = pkgs.writeShellScript "entry.sh" ''
set -e
dnf install -y nfs-utils dracut-network
cd /data/workdir
for target in $(ls .. | grep -v workdir); do
mkdir $target
modsDir=../$target/usr/lib/modules/*
cp $modsDir/vmlinuz $target
dracut -Nm "network-manager nfs" --zstd -k $modsDir \
--kver $(basename $modsDir) $target/initramfs
done
'';
in ''
for distro in arch:arch/x86_64/airootfs.sfs fedora:LiveOS/squashfs.img; do
rootfs=''${distro##*:}
distro=''${distro%:*}
for distro in arch fedora; do
case $distro in
arch) url=${archIso.url}
rootfs=${archIso.rootfs}
hash=${archIso.hash};;
fedora) url=${fedoraIso.url}
rootfs=${fedoraIso.rootfs}
hash=${fedoraIso.hash};;
esac
mkdir -p /srv/nfs/$distro
cd /srv/nfs/$distro
mkdir -p loop work lower upper #root -> move to tmpfiles
if [ ! -e $distro.iso ]; then
curl -C - "$url" -Lo $distro.iso.tmp
mv $distro.iso{.tmp,}
sha256sum $distro.iso | grep $hash
fi
mkdir -p loop root work lower upper
mountpoint -q loop || mount $distro.iso loop
mountpoint -q lower || mount loop/$rootfs lower
mountpoint -q root || mount -t overlay overlay -o workdir=work,nfs_export=on,lowerdir=lower,upperdir=upper root
mountpoint -q root || mount -t overlay overlay root -o \
workdir=work,nfs_export=on,lowerdir=lower,upperdir=upper
if [ ! -e upper/etc/resolv.conf ]; then
cd root/etc
rm -f resolv.conf
@ -96,19 +131,20 @@
chattr +i resolv.conf
fi
done
cd /srv
#either check of tftp dir, or file in tftp, if it forced to exists through tmpfiles
cd /srv/tftp
if [ ! -e grubx64.efi ]; then
grub-mkstandalone -O x86_64-efi --compress=xz -o grubx64.efi #--modules=efinet /boot/grub/grub.cfg=${grubCfg}
grub-mkstandalone -O x86_64-efi --compress=xz -o \
grubx64.efi --modules=efinet /boot/grub/grub.cfg=${grubCfg}
fi
if [ ! -e pxe ]; then
mkdir pxe
cp ${entryScript} /var/lib/podman-dracut/entry.sh
if [ ! -e boot ]; then
workdir=/var/lib/podman-dracut
rm -rf $workdir
mkdir boot $workdir
cp ${entryScript} $workdir/entry.sh
systemctl --wait start podman-fedora-dracut.service
mv /var/lib/podman-dracut/*/ pxe
chmod -R 640 pxe
chgrp -R php pxe
chmod ug+x $(find pxe -type d)
mv $workdir/*/ boot
chmod -R 644 boot
chmod +x $(find boot -type d)
fi
'';
};

22
server/mods/web.nix
View file

@ -54,18 +54,18 @@
ENABLE_CAPTCHA = true;
REGISTER_EMAIL_CONFIRM = true;
};
server = {
SSH_PORT = 32831;
PROTOCOL = "http+unix";
ROOT_URL = "https://bogaledev.ru/git/";
HTTP_ADDR = "/run/forgejo/forgejo.sock";
};
mailer = {
ENABLED = true;
SMTP_PORT = 25;
SMTP_ADDR = "localhost";
FROM = "Forgejo <forgejo@bogaledev.ru>";
};
server = {
SSH_PORT = 32831;
PROTOCOL = "http+unix";
ROOT_URL = "https://bogaledev.ru/git/";
HTTP_ADDR = "/run/forgejo/forgejo.sock";
};
};
};
nginx = {
@ -105,11 +105,6 @@
"/".extraConfig = phpPool;
"/local/".extraConfig = "${phpPool} ${localNetworks}";
"/git/".proxyPass = "http://unix:/run/forgejo/forgejo.sock:/";
"/grafana/" = {
proxyWebsockets = true;
extraConfig = localNetworks;
proxyPass = "http://unix:/run/grafana/grafana.sock:/";
};
"/local/net/".extraConfig = ''
allow fc01::/64;
allow 10.1.0.0/16;
@ -120,6 +115,11 @@
extraConfig = localNetworks;
proxyPass = "http://localhost:46151";
};
"/grafana/" = {
proxyWebsockets = true;
extraConfig = localNetworks;
proxyPass = "http://unix:/run/grafana/grafana.sock:/";
};
};
};
};