ringofstorms/dotfiles
ringofstorms/dotfiles
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

trying out installer again

Browse source
This commit is contained in:
RingOfStorms (Joshua Bell) 2025-12-16 10:42:50 -06:00
parent 4fab3305f1
commit 8dddb1588d
3 changed files with 162 additions and 139 deletions
Download patch file Download diff file Expand all files Collapse all files

2
hosts/i001/flake.nix
View file

@ -77,6 +77,8 @@
system.stateVersion = stateAndHomeVersion; system.stateVersion = stateAndHomeVersion;
# TODO allowing password auth for now # TODO allowing password auth for now
services.openssh.settings.PasswordAuthentication = lib.mkForce true; services.openssh.settings.PasswordAuthentication = lib.mkForce true;
# TODO remove this for testbed
security.sudo.wheelNeedsPassword = false;
# Home Manager # Home Manager
home-manager = { home-manager = {

294
hosts/i001/hardware-mounts.nix
View file

@ -6,15 +6,14 @@
... ...
}: }:
let let
BOOT = "/dev/disk/by-uuid/ABDB-2A38";
PRIMARY = "/dev/disk/by-uuid/08610781-26d3-456f-9026-35dd4a40846f";
SWAP = "/dev/disk/by-uuid/e4b53a74-6fde-4e72-b925-be3a249e37be";
USB_KEY = "/dev/disk/by-uuid/63a7bd87-d644-43ea-83ba-547c03012fb6"; USB_KEY = "/dev/disk/by-uuid/63a7bd87-d644-43ea-83ba-547c03012fb6";
BOOT = "/dev/disk/by-uuid/ABDB-2A38"; primaryDeviceUnit = "${utils.escapeSystemdPath PRIMARY}.device";
PRIMARY_UUID = "08610781-26d3-456f-9026-35dd4a40846f";
PRIMARY = "/dev/disk/by-uuid/${PRIMARY_UUID}";
inherit (utils) escapeSystemdPath;
primaryDeviceUnit = "${escapeSystemdPath PRIMARY}.device";
in in
lib.mkMerge [ lib.mkMerge [
# Main filesystems # Main filesystems
@ -35,15 +34,8 @@ lib.mkMerge [
fsType = "bcachefs"; fsType = "bcachefs";
options = [ options = [
"X-mount.subdir=@root" "X-mount.subdir=@root"
]; # "x-systemd.requires=unlock-bcachefs-custom.service"
}; # "x-systemd.after=unlock-bcachefs-custom.service"
fileSystems."/.old_roots" = {
device = PRIMARY;
fsType = "bcachefs";
options = [
"nofail" # this may not exist yet just skip it
"X-mount.mkdir"
"X-mount.subdir=@old_roots"
]; ];
}; };
fileSystems."/nix" = { fileSystems."/nix" = {
@ -60,7 +52,7 @@ lib.mkMerge [
fsType = "bcachefs"; fsType = "bcachefs";
options = [ options = [
"X-mount.mkdir" "X-mount.mkdir"
"X-mount.subdir=@root" "X-mount.subdir=@snapshots"
"relatime" "relatime"
]; ];
}; };
@ -74,15 +66,8 @@ lib.mkMerge [
]; ];
}; };
} }
# SWAP # SWAP (optional)
{ { swapDevices = [ { device = SWAP; } ]; }
swapDevices = [
# {
# device = "/.swap/swapfile";
# size = 8 * 1024; # Creates an 8GB swap file
# }
];
}
# Disable bcachefs built in password prompts for all mounts (which asks for every single subdir mount above # Disable bcachefs built in password prompts for all mounts (which asks for every single subdir mount above
( (
let let
@ -132,25 +117,21 @@ lib.mkMerge [
"bcachefs" "bcachefs"
]; ];
boot.initrd.systemd.mounts = [ # From a USB key # NOTE this method does work but if you want to boot w/o
{ # and get prompted it takes 30 seconds to fail
what = USB_KEY; # boot.initrd.systemd.mounts = [
type = "bcachefs"; # {
where = "/usb_key"; # what = USB_KEY;
options = "ro"; # type = "bcachefs";
description = "key"; # where = "/usb_key";
wantedBy = [ # options = "ro";
"initrd.target" # description = "key";
"initrd-root-fs.target" # wantedBy = [
]; # "initrd.target"
} # "initrd-root-fs.target"
]; # ];
boot.initrd.systemd.services."sysroot.mount" = { # }
unitConfig = { # ];
Requires = [ "unlock-bcachefs-custom.service" ];
After = [ "unlock-bcachefs-custom.service" ];
};
};
boot.initrd.systemd.services.unlock-bcachefs-custom = { boot.initrd.systemd.services.unlock-bcachefs-custom = {
description = "Custom single bcachefs unlock for all subvolumes"; description = "Custom single bcachefs unlock for all subvolumes";
@ -160,125 +141,166 @@ lib.mkMerge [
"sysroot.mount" "sysroot.mount"
"initrd-root-fs.target" "initrd-root-fs.target"
]; ];
# Stronger than wantedBy if you want it absolutely required:
requiredBy = [
"sysroot.mount"
"initrd-root-fs.target"
];
before = [ before = [
"sysroot.mount" "sysroot.mount"
"initrd-root-fs.target" "initrd-root-fs.target"
]; ];
requires = [ requires = [
"usb_key.mount"
primaryDeviceUnit primaryDeviceUnit
]; ];
after = [ after = [
"usb_key.mount" # "usb_key.mount"
primaryDeviceUnit primaryDeviceUnit
"initrd-root-device.target" "initrd-root-device.target"
]; ];
# script = '' # unitConfig = {
# echo "Using test password..." # # Ensure this service doesn't time out if USB detection takes a while
# # DefaultDependencies = "no";
# mkdir -p /usb_key # };
# # Wait for USB device (optional, to handle slow init) serviceConfig = {
# for i in $(seq 1 50); do Type = "oneshot";
# if [ -b "${USB_KEY}" ]; then RemainAfterExit = true;
# break KeyringMode = "shared"; # TODO so it shares with reset root below, not needed otherwise
# fi };
# echo "Waiting for USB key ${USB_KEY}..."
# sleep 0.2
# done
#
# if [ ! -b "${USB_KEY}" ]; then
# echo "USB key device ${USB_KEY} not present in initrd"
# exit 1
# fi
#
# # Mount the key
# mount -t bcachefs -o ro "${USB_KEY}" /usb_key
#
# echo "test" | ${pkgs.bcachefs-tools}/bin/bcachefs unlock "${PRIMARY}"
# echo "bcachefs unlock successful for ${PRIMARY}"
# '';
script = ''
echo "Using test password..."
echo "test" | ${pkgs.bcachefs-tools}/bin/bcachefs unlock "${PRIMARY}"
echo "bcachefs unlock successful for ${PRIMARY}"
'';
# script = '' # script = ''
# echo "Using USB key for bcachefs unlock: ${USB_KEY}" # echo "Using USB key for bcachefs unlock: ${USB_KEY}"
# #
# echo "test" | ${pkgs.bcachefs-tools}/bin/bcachefs unlock "${PRIMARY}"
# echo "done...."
# exit 0
#
# # only try mount if the node exists # # only try mount if the node exists
# if [ ! -e "${USB_KEY}" ]; then # if [ ! -e "${USB_KEY}" ]; then
# echo "USB key device ${USB_KEY} not present in initrd" # echo "USB key device ${USB_KEY} not present in initrd"
# exit 1 # exit 1
# fi # fi
#
# ${pkgs.bcachefs-tools}/bin/bcachefs unlock -f /usb_key/key "${PRIMARY}" # ${pkgs.bcachefs-tools}/bin/bcachefs unlock -f /usb_key/key "${PRIMARY}"
# echo "bcachefs unlock successful for ${PRIMARY}" # echo "bcachefs unlock successful for ${PRIMARY}"
# ''; # '';
script = ''
echo "Searching for USB Unlock Key..."
KEY_FOUND=0
# 4 second search
for i in {1..40}; do
if [ -e "${USB_KEY}" ]; then
KEY_FOUND=1
break
fi
sleep 0.1
done
if [ "$KEY_FOUND" -eq 1 ]; then
echo "USB Key found at ${USB_KEY}. Attempting unlock..."
mkdir -p /tmp/usb_key_mount
# Mount read-only
if mount -t bcachefs -o ro "${USB_KEY}" /tmp/usb_key_mount; then
# Attempt unlock
${pkgs.bcachefs-tools}/bin/bcachefs unlock -f /tmp/usb_key_mount/key "${PRIMARY}"
UNLOCK_STATUS=$?
# Cleanup
umount /tmp/usb_key_mount
if [ $UNLOCK_STATUS -eq 0 ]; then
echo "Bcachefs unlock successful!"
exit 0
else
echo "Failed to unlock with USB key."
fi
else
echo "Failed to mount USB key device."
fi
else
echo "USB Key not found within timeout."
fi
# 3. Fallback
echo "Proceeding to standard mount (password prompt will appear if still locked)..."
exit 0
'';
}; };
# TODO rotate root # TODO rotate root
} }
# Reset root for erase your darlings/impermanence/preservation # Reset root for erase your darlings/impermanence/preservation
{ (lib.mkIf false {
# boot.initrd.systemd.services.bcachefs-reset-root = { boot.initrd.systemd.services.bcachefs-reset-root = {
# description = "Reset bcachefs root subvolume before pivot"; description = "Reset bcachefs root subvolume before pivot";
# wantedBy = [ "initrd.target" ];
# # We want this to run after we've ATTEMPTED to unlock,
# after = [ # but strictly BEFORE the real root is mounted at /sysroot
# "initrd-root-device.target" after = [
# "cryptsetup.target" "initrd-root-device.target"
# "unlock-bcachefs-custom" "cryptsetup.target"
# ]; "unlock-bcachefs-custom.service"
# requires = [ primaryDeviceUnit ]; ];
#
# serviceConfig = { # This is the most important part: prevent sysroot from mounting until we are done resetting it
# Type = "oneshot"; before = [
# # initrd has a minimal PATH; set one explicitly "sysroot.mount"
# Environment = "PATH=/bin:/sbin:/usr/bin:/usr/sbin"; ];
# # If tools are in /usr, this helps ensure it's in the initrd
# # (you may also need environment.systemPackages + boot.initrd.includeDefaultModules) requires = [ primaryDeviceUnit ];
# ExecStart = pkgs.writeShellScript "bcachefs-reset-root" '' wantedBy = [ "initrd.target" ];
# set -euo pipefail
# serviceConfig = {
# PRIMARY=${PRIMARY} Type = "oneshot";
# KeyringMode = "shared";
# echo "Unlocking bcachefs volume ${PRIMARY}..." # We need a path that includes standard tools (mkdir, mount, find, date, stat)
# echo "test" | bcachefs unlock "''${PRIMARY}" # and bcachefs tools.
# Environment = "PATH=${
# mkdir -p /primary_tmp lib.makeBinPath [
# mount "''${PRIMARY}" /primary_tmp pkgs.coreutils
# pkgs.util-linux
# if [[ -e /primary_tmp/@root ]]; then pkgs.findutils
# mkdir -p /primary_tmp/@old_roots pkgs.bcachefs-tools
# bcachefs set-file-option /primary_tmp/@old_roots --compression=zstd ]
# }:/bin:/sbin";
# timestamp=$(date --date="@$(stat -c %Y /primary_tmp/@root)" "+%Y-%m-%-d_%H:%M:%S") };
# bcachefs subvolume snapshot /primary_tmp/@root "/primary_tmp/@old_roots/$timestamp"
# bcachefs subvolume delete /primary_tmp/@root script = ''
# # 1. Safety check: Try to see if we can read the device.
# # Cleanup old snapshots (>30 days) # If the unlock script failed (or user hasn't typed password yet), this mount will fail.
# # Note: path was /primary_tmp/old_roots in your snippet; using @old_roots for consistency # We should probably exit non-zero to stop the boot or loop here?
# for i in $(find /primary_tmp/@old_roots/ -maxdepth 1 -mtime +30); do # Actually, if we fail here, the boot continues to sysroot.mount, which will prompt for password,
# bcachefs subvolume delete "$i" # BUT we will have skipped the reset. This is a trade-off.
# done
# fi mkdir -p /primary_tmp
#
# bcachefs subvolume create /primary_tmp/@root # Try mounting. If locked, this fails.
# umount /primary_tmp if ! mount "${PRIMARY}" /primary_tmp; then
# ''; echo "bcachefs-reset-root: Failed to mount ${PRIMARY}. Drive might be locked."
# }; echo "Skipping root reset."
# }; exit 0
} fi
# 2. Perform the Snapshot & Reset
if [[ -e /primary_tmp/@root ]]; then
mkdir -p /primary_tmp/@snapshots/old_roots
# Format: YYYY-MM-DD_HH:MM:SS
timestamp=$(date --date="@$(stat -c %Y /primary_tmp/@root)" "+%Y-%m-%-d_%H:%M:%S")
echo "Snapshotting old root to @snapshots/old_roots/$timestamp"
bcachefs subvolume snapshot /primary_tmp/@root "/primary_tmp/@snapshots/old_roots/$timestamp"
echo "Deleting current @root"
bcachefs subvolume delete /primary_tmp/@root
# Cleanup old snapshots (>30 days)
echo "Cleaning up old snapshots..."
find /primary_tmp/@snapshots/old_roots/ -maxdepth 1 -mtime +30 -print0 | xargs -0 -r -I {} sh -c 'echo "Deleting {}"; bcachefs subvolume delete "{}"'
fi
# 3. Create fresh root
echo "Creating fresh @root subvolume"
bcachefs subvolume create /primary_tmp/@root
# 4. Cleanup
umount /primary_tmp
'';
};
})
] ]

5
utilities/nixos-installers/install_bcachefs.md
View file

@ -34,7 +34,6 @@ mkfs.fat -F 32 -n BOOT /dev/$BOOT
```sh ```sh
PRIMARY=sda2 PRIMARY=sda2
# keyctl link @u @s
bcachefs format --label=nixos --encrypted /dev/$PRIMARY bcachefs format --label=nixos --encrypted /dev/$PRIMARY
bcachefs unlock /dev/$PRIMARY bcachefs unlock /dev/$PRIMARY
``` ```
@ -50,8 +49,8 @@ swapon /dev/$SWAP
### Setup subvolumes ### Setup subvolumes
```sh ```sh
# keyctl link @u @s keyctl link @u @s
U=$(lsblk -o fsType,uuid | grep bcachefs | awk '{print $2}') U=$(lsblk -o name,uuid | grep $PRIMARY | awk '{print $2}')
echo $U echo $U
mount /dev/disk/by-uuid/$U /mnt mount /dev/disk/by-uuid/$U /mnt