122 lines
4.1 KiB
Bash
122 lines
4.1 KiB
Bash
|
# Setup
|
|||
|
|
# Presumes pre-formatted harddrives
|
|||
|
|
BOOT=/dev/sda1
|
|||
|
|
DISK=/dev/sda2
|
|||
|
|
|
|||
|
|
dd if=/dev/urandom of=./keyfile0.bin bs=1024 count=4
|
|||
|
|
dd if=/dev/urandom of=./keyfile1.bin bs=1024 count=4
|
|||
|
|
|
|||
|
|
echo "Creating LUKS partitions..."
|
|||
|
|
# Enter the passphrase which is used to unlock disk. You will enter this in grub on every boot
|
|||
|
|
cryptsetup luksFormat --type luks1 -c aes-xts-plain64 -s 256 -h sha512 $DISK
|
|||
|
|
# Add a second key which will be used by nixos. You will need to enter the pasphrase from previous step
|
|||
|
|
cryptsetup luksAddKey $DISK keyfile0.bin
|
|||
|
|
cryptsetup luksOpen $DISK crypted-nixos -d keyfile0.bin
|
|||
|
|
|
|||
|
|
# Create the LVM
|
|||
|
|
echo "Creating LVM partitions..."
|
|||
|
|
pvcreate /dev/mapper/crypted-nixos
|
|||
|
|
vgcreate vg /dev/mapper/crypted-nixos
|
|||
|
|
lvcreate -L 4G -n swap vg
|
|||
|
|
lvcreate -l '100%FREE' -n root vg
|
|||
|
|
|
|||
|
|
# Format the disks
|
|||
|
|
echo "Formatting disks..."
|
|||
|
|
mkfs.fat -F 32 $BOOT
|
|||
|
|
mkswap -L swap /dev/vg/swap
|
|||
|
|
mkfs.ext4 -L root /dev/vg/root
|
|||
|
|
# mkfs.ext4 -L data /dev/mapper/crypted-data
|
|||
|
|
|
|||
|
|
echo "Mounting drives..."
|
|||
|
|
mount /dev/vg/root /mnt
|
|||
|
|
mkdir -p /mnt/boot/efi
|
|||
|
|
mount $BOOT /mnt/boot/efi
|
|||
|
|
swapon /dev/vg/swap
|
|||
|
|
|
|||
|
|
# Copy the keys
|
|||
|
|
|
|||
|
|
mkdir -p /mnt/etc/secrets/initrd/
|
|||
|
|
cp keyfile0.bin keyfile1.bin /mnt/etc/secrets/initrd
|
|||
|
|
chmod 000 /mnt/etc/secrets/initrd/keyfile*.bin
|
|||
|
|
|
|||
|
|
# Generate and edit configuration
|
|||
|
|
|
|||
|
|
echo "Generating NixOS config..."
|
|||
|
|
nixos-generate-config --root /mnt
|
|||
|
|
|
|||
|
|
# TODO: neds to get the uuid of each of the disks
|
|||
|
|
# UUID=$(blkid)
|
|||
|
|
echo "Extending NixOS config..."
|
|||
|
|
cat >> /mnt/etc/nixos/configuration.nix <<'endmsg'
|
|||
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|||
|
|
boot.loader.efi.efiSysMountPoint = "/boot/efi";
|
|||
|
|
boot.loader.grub = {
|
|||
|
|
enable = true;
|
|||
|
|
device = "nodev";
|
|||
|
|
version = 2;
|
|||
|
|
efiSupport = true;
|
|||
|
|
enableCryptodisk = true;
|
|||
|
|
};
|
|||
|
|
|
|||
|
|
boot.initrd = {
|
|||
|
|
luks.devices."root" = {
|
|||
|
|
# UPDATE ME
|
|||
|
|
device = "/dev/disk/by-uuid/a8b302cf-5296-4a2e-a7ba-707e6fa75123"; # UUID for /dev/nvme01np2
|
|||
|
|
preLVM = true;
|
|||
|
|
keyFile = "/keyfile0.bin";
|
|||
|
|
allowDiscards = true;
|
|||
|
|
};
|
|||
|
|
secrets = {
|
|||
|
|
# Create /mnt/etc/secrets/initrd directory and copy keys to it
|
|||
|
|
"keyfile0.bin" = "/etc/secrets/initrd/keyfile0.bin";
|
|||
|
|
"keyfile1.bin" = "/etc/secrets/initrd/keyfile1.bin";
|
|||
|
|
};
|
|||
|
|
};
|
|||
|
|
|
|||
|
|
# Data mount
|
|||
|
|
# This is all wrong for box for now
|
|||
|
|
# fileSystems."/data" = {
|
|||
|
|
# device = "/dev/disk/by-uuid/79630267-5766-4c7d-85a5-1d5f1dcd58ad"; # UUID for /dev/mapper/crypted-data
|
|||
|
|
# encrypted = {
|
|||
|
|
# enable = true;
|
|||
|
|
# label = "crypted-data";
|
|||
|
|
# blkDev = "/dev/disk/by-uuid/3476cb09-b3c4-4301-9ec9-84f60f32828a"; # UUID for /dev/sda1
|
|||
|
|
# keyFile = "/keyfile1.bin";
|
|||
|
|
# };
|
|||
|
|
# };
|
|||
|
|
|
|||
|
|
time.timeZone = "Australia/Brisbane";
|
|||
|
|
|
|||
|
|
networking.useDHCP = false;
|
|||
|
|
|
|||
|
|
nix = {
|
|||
|
|
package = pkgs.nixUnstable;
|
|||
|
|
extraOptions = ''
|
|||
|
|
experimental-features = nix-command flakes
|
|||
|
|
'';
|
|||
|
|
};
|
|||
|
|
|
|||
|
|
users.users.anish = {
|
|||
|
|
isNormalUser = true;
|
|||
|
|
hashedPassword = "MVHHpy9gbe3ow";
|
|||
|
|
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
|
|||
|
|
openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDM0Zvei46x/yZl/IeBCq6+IYQQ0avulzVyBysF9cPigZMCybWRV7IEU+E3k9t6JrbdbdGfJkcZIWmsWDdKS8W8mBnZpVoT0ffLynu8JQ/TKdGm4Qv6bgUeKNrGsNv0ZPs2CDaGSLj0oJfRF7Ko10tcLP0vW+yujrh+y6TH/vVzJioaV4TGvtCUpn+wEQah9ROwPQLUUofsSWdnRsDJ/gp37zXWs4l5wyjSKtP3O9RZUP7kBekbSqEgSXiTk0oUQSVqIWl9NDiP6onk/gSOjXsR/JPqsSN/XI/c/yj6gyY0f51Ru2D7iBxuMJIJcWV+rU6coIj+ULcQWLzt/7TI8jq5AOOzI/ll4zbL24Eo84Rz+TP9tvMMhDZ0VaMN22AJ8qQEjc5P09tWKsX7Jg39XelyV1jHXncE4yvIE9F4RSCHzWCeKeXakizQNuzSaxTxIExRFYHjNW5bR6+3MTGwVrEIXU+qML+0yFTR86MT+tdY5AreAJQLwbog79O1NupeXJE= anish@curve" ];
|
|||
|
|
};
|
|||
|
|
security.sudo.wheelNeedsPassword = false; # needed for deploy-rs
|
|||
|
|
|
|||
|
|
services.openssh.enable = true;
|
|||
|
|
|
|||
|
|
# This value determines the NixOS release from which the default
|
|||
|
|
# settings for stateful data, like file locations and database versions
|
|||
|
|
# on your system were taken. It‘s perfectly fine and recommended to leave
|
|||
|
|
# this value at the release version of the first install of this system.
|
|||
|
|
# Before changing this value read the documentation for this option
|
|||
|
|
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
|||
|
|
system.stateVersion = "21.05"; # Did you read the comment?
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
endmsg
|
|||
|
|
|
|||
|
|
|
|||
|
|
# sudo nixos-install
|