From acace867a80682159c25248764aad321695974c7 Mon Sep 17 00:00:00 2001 From: bogale Date: Sat, 3 Oct 2026 00:18:13 +0900 Subject: [PATCH] pxeboot chain --- common.nix | 108 ++++++++++++++++++++++++++++++++------ desktop/configuration.nix | 2 +- server/configuration.nix | 2 +- server/mods/mail.nix | 6 ++- server/mods/sysd.nix | 2 +- server/mods/web.nix | 6 ++- 6 files changed, 105 insertions(+), 21 deletions(-) diff --git a/common.nix b/common.nix index 90f54db..498db5e 100644 --- a/common.nix +++ b/common.nix @@ -26,9 +26,14 @@ users.users.root.hashedPasswordFile = "/secrets/user/root-pw"; networking = { firewall = { - allowedTCPPorts = [ 53 80 ]; + allowedTCPPorts = [ 53 80 2049 ]; allowedUDPPorts = [ 53 67 69 547 ]; }; + nat = { + enable = true; + enableIPv6 = true; + internalInterfaces = [ "enp1s0" ]; + }; wg-quick.interfaces.awg0 = { type = "amneziawg"; peers = [ { @@ -40,19 +45,35 @@ enable = true; ensureProfiles = { environmentFiles = [ "/secrets/wifi.env" ]; - profiles.home-wifi = { - wifi-security.key-mgmt = "sae"; - connection = { - id = "home-wifi"; - type = "wifi"; + profiles = { + ethernet = { + ipv6 = { + method = "manual"; + addresses = "fc02::1/64"; + }; + ipv4 = { + method = "manual"; + addresses = "10.2.0.1/16"; + }; + connection = { + id = "ethernet"; + type = "802-3-ethernet"; + }; }; - ipv6 = { - method = "manual"; - gateway = "fc01::1"; - }; - ipv4 = { - method = "manual"; - gateway = "10.1.0.1"; + wifi = { + wifi-security.key-mgmt = "sae"; + ipv6 = { + method = "manual"; + gateway = "fc01::1"; + }; + ipv4 = { + method = "manual"; + gateway = "10.1.0.1"; + }; + connection = { + id = "wifi"; + type = "802-11-wireless"; + }; }; }; }; @@ -60,7 +81,11 @@ }; environment.systemPackages = with pkgs; [ jq + _7zz sbctl + dracut + openssl + grub2_efi ]; services = { logind.settings.Login.HandleLidSwitch = "ignore"; @@ -76,6 +101,15 @@ recommendedProxySettings = true; recommendedBrotliSettings = true; }; + nfs.server = { + enable = true; + exports = let + clients."10.2.0.0/16" = [ "mp" "rw" "no_root_squash" ]; + in { + "/srv/nfs/arch/root" = clients; + "/srv/nfs/fedora/root" = clients; + }; + }; dnsmasq = { enable = true; settings = { @@ -90,9 +124,53 @@ dhcp-boot = "grubx64.efi"; dhcp-range = [ "10.2.0.2,10.2.255.254,12h" "fc02::2,fc02::ffff:ffff:ffff:ffff,12h" ]; - server = [ "2606:4700:4700::1112" "1.1.1.2" - "2606:4700:4700::1002" "1.0.0.2" ]; + server = [ "1.1.1.2" "2606:4700:4700::1112" + "1.0.0.2" "2606:4700:4700::1002" ]; }; }; }; + systemd.services.pxeboot = { + serviceConfig.Type = "oneshot"; + wantedBy = [ "multi-user.target" ]; + path = with pkgs; [ xz dracut grub2_efi util-linux ]; + script = let + grubCfg = pkgs.writeText "grub.cfg" '' + set timeout=10 + set path=(http,$net_default_server)/local/boot/pxe + set nfs="rw ifname=ens0:$net_default_mac ip=$net_default_ip::$net_default_server:255.255.0.0::ens0:none root=nfs4:$net_default_server:/srv/nfs" + menuentry Arch { + linux $path/arch/linux $nfs/arch/root + initrd $path/arch/initramfs + } + menuentry Fedora { + linux $path/fedora/linux $nfs/fedora/root selinux=0 + initrd $path/fedora/initramfs + } + ''; + in '' + if [ ! -e /srv/tftp/grubx64.efi ]; then + echo "Building grub" + grub-mkstandalone -O x86_64-efi --compress=xz --modules=efinet -o /srv/tftp/grubx64.efi /boot/grub/grub.cfg=${grubCfg} + fi + for distro in arch:arch/x86_64/airootfs.sfs fedora:LiveOS/squashfs.img; do + rootfs=''${distro#*:} + distro=''${distro%%:*} + cd /srv/nfs/$distro + mkdir -p loop lower upper work root + mountpoint -q loop || mount $distro.iso loop + mountpoint -q lower || mount loop/$rootfs lower + mountpoint -q root || mount -t overlay overlay -o lowerdir=lower,upperdir=upper,workdir=work,nfs_export=on root + cd /srv/http/local/boot/pxe + if [ ! -e $distro ]; then + mkdir $distro + modsDir=$OLDPWD/lower/usr/lib/modules/* + cp $modsDir/vmlinuz $distro/linux + dracut -Nvm "network-manager nfs" --zstd --kver $(basename $modsDir) -k $modsDir $distro/initramfs + chmod -R 640 $distro + chgrp -R php $distro + chmod ug+x $distro + fi + done + ''; + }; } diff --git a/desktop/configuration.nix b/desktop/configuration.nix index ccd0ac8..5ad287a 100644 --- a/desktop/configuration.nix +++ b/desktop/configuration.nix @@ -20,7 +20,7 @@ configFile = "/secrets/awg/2.conf"; address = [ "fc00::3/128" "10.0.0.3/32" ]; }; - networkmanager.ensureProfiles.profiles.home-wifi = { + networkmanager.ensureProfiles.profiles.wifi = { wifi.ssid = "bogale_5"; ipv6.addresses = "fc01::3/64"; ipv4.addresses = "10.1.0.3/16"; diff --git a/server/configuration.nix b/server/configuration.nix index 053fc97..e1fab52 100644 --- a/server/configuration.nix +++ b/server/configuration.nix @@ -40,7 +40,7 @@ configFile = "/secrets/awg/1.conf"; address = [ "fc00::2/128" "10.0.0.2/32" ]; }; - networkmanager.ensureProfiles.profiles.home-wifi = { + networkmanager.ensureProfiles.profiles.wifi = { wifi.ssid = "bogale_2.4"; ipv6.addresses = "fc01::2/64"; ipv4.addresses = "10.1.0.2/16"; diff --git a/server/mods/mail.nix b/server/mods/mail.nix index 5784320..0630e99 100644 --- a/server/mods/mail.nix +++ b/server/mods/mail.nix @@ -33,17 +33,21 @@ in { smtpd_sasl_path = "${postfixDir}/auth"; milter_macro_daemon_name = "ORIGINATING"; smtpd_client_restrictions = "permit_sasl_authenticated,reject"; - smtpd_tls_chain_files = "${sslCertDir}/key.pem,${sslCertDir}/fullchain.pem"; }; settings.main = { smtp_tls_wrappermode = true; smtp_sasl_auth_enable = true; smtp_tls_security_level = "verify"; + smtpd_tls_security_level = "encrypt"; relayhost = [ "smtp.resend.com:2465" ]; virtual_mailbox_domains = "bogaledev.ru"; smtp_sasl_tls_security_options = "noanonymous"; virtual_transport = "lmtp:unix:${postfixDir}/lmtp"; smtp_sasl_password_maps = "hash:/etc/postfix/smtp_passwd"; + smtpd_tls_chain_files = [ + "${sslCertDir}/key.pem" + "${sslCertDir}/fullchain.pem" + ]; }; }; dovecot2 = { diff --git a/server/mods/sysd.nix b/server/mods/sysd.nix index 5910243..e569309 100644 --- a/server/mods/sysd.nix +++ b/server/mods/sysd.nix @@ -71,7 +71,7 @@ failures=$((1+$(cat /run/network.failures))) fi if [ $failures -ge $limit ]; then - echo "<4>restarting NetworkManager" + echo "<4>restarting network" systemctl restart NetworkManager.service [ $limit -lt 360 ] && limit=$((2*$limit)) failures=0 diff --git a/server/mods/web.nix b/server/mods/web.nix index e3fa526..d7a45c1 100644 --- a/server/mods/web.nix +++ b/server/mods/web.nix @@ -77,15 +77,17 @@ ''; localNetworks = '' allow fc00::/64; - allow fc01::/120; + allow fc01::/96; + allow fc02::/64; allow 10.0.0.0/16; allow 10.1.0.0/24; + allow 10.2.0.0/16; deny all; ''; in { quic = true; + addSSL = true; default = true; - forceSSL = true; root = "/srv/http"; useACMEHost = "bogaledev.ru"; extraConfig = ''