move around install scripts
This commit is contained in:
parent
144eac76ce
commit
3441b392e0
121
install-encrypted.sh
Executable file
121
install-encrypted.sh
Executable file
|
|
@ -0,0 +1,121 @@
|
|||
# Setup
|
||||
# Presumes pre-formatted harddrives
|
||||
BOOT=/dev/sda1
|
||||
DISK=/dev/sda2
|
||||
|
||||
dd if=/dev/urandom of=./keyfile0.bin bs=1024 count=4
|
||||
dd if=/dev/urandom of=./keyfile1.bin bs=1024 count=4
|
||||
|
||||
echo "Creating LUKS partitions..."
|
||||
# Enter the passphrase which is used to unlock disk. You will enter this in grub on every boot
|
||||
cryptsetup luksFormat --type luks1 -c aes-xts-plain64 -s 256 -h sha512 $DISK
|
||||
# Add a second key which will be used by nixos. You will need to enter the pasphrase from previous step
|
||||
cryptsetup luksAddKey $DISK keyfile0.bin
|
||||
cryptsetup luksOpen $DISK crypted-nixos -d keyfile0.bin
|
||||
|
||||
# Create the LVM
|
||||
echo "Creating LVM partitions..."
|
||||
pvcreate /dev/mapper/crypted-nixos
|
||||
vgcreate vg /dev/mapper/crypted-nixos
|
||||
lvcreate -L 4G -n swap vg
|
||||
lvcreate -l '100%FREE' -n root vg
|
||||
|
||||
# Format the disks
|
||||
echo "Formatting disks..."
|
||||
mkfs.fat -F 32 $BOOT
|
||||
mkswap -L swap /dev/vg/swap
|
||||
mkfs.ext4 -L root /dev/vg/root
|
||||
# mkfs.ext4 -L data /dev/mapper/crypted-data
|
||||
|
||||
echo "Mounting drives..."
|
||||
mount /dev/vg/root /mnt
|
||||
mkdir -p /mnt/boot/efi
|
||||
mount $BOOT /mnt/boot/efi
|
||||
swapon /dev/vg/swap
|
||||
|
||||
# Copy the keys
|
||||
|
||||
mkdir -p /mnt/etc/secrets/initrd/
|
||||
cp keyfile0.bin keyfile1.bin /mnt/etc/secrets/initrd
|
||||
chmod 000 /mnt/etc/secrets/initrd/keyfile*.bin
|
||||
|
||||
# Generate and edit configuration
|
||||
|
||||
echo "Generating NixOS config..."
|
||||
nixos-generate-config --root /mnt
|
||||
|
||||
# TODO: neds to get the uuid of each of the disks
|
||||
# UUID=$(blkid)
|
||||
echo "Extending NixOS config..."
|
||||
cat >> /mnt/etc/nixos/configuration.nix <<'endmsg'
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
boot.loader.efi.efiSysMountPoint = "/boot/efi";
|
||||
boot.loader.grub = {
|
||||
enable = true;
|
||||
device = "nodev";
|
||||
version = 2;
|
||||
efiSupport = true;
|
||||
enableCryptodisk = true;
|
||||
};
|
||||
|
||||
boot.initrd = {
|
||||
luks.devices."root" = {
|
||||
# UPDATE ME
|
||||
device = "/dev/disk/by-uuid/a8b302cf-5296-4a2e-a7ba-707e6fa75123"; # UUID for /dev/nvme01np2
|
||||
preLVM = true;
|
||||
keyFile = "/keyfile0.bin";
|
||||
allowDiscards = true;
|
||||
};
|
||||
secrets = {
|
||||
# Create /mnt/etc/secrets/initrd directory and copy keys to it
|
||||
"keyfile0.bin" = "/etc/secrets/initrd/keyfile0.bin";
|
||||
"keyfile1.bin" = "/etc/secrets/initrd/keyfile1.bin";
|
||||
};
|
||||
};
|
||||
|
||||
# Data mount
|
||||
# This is all wrong for box for now
|
||||
# fileSystems."/data" = {
|
||||
# device = "/dev/disk/by-uuid/79630267-5766-4c7d-85a5-1d5f1dcd58ad"; # UUID for /dev/mapper/crypted-data
|
||||
# encrypted = {
|
||||
# enable = true;
|
||||
# label = "crypted-data";
|
||||
# blkDev = "/dev/disk/by-uuid/3476cb09-b3c4-4301-9ec9-84f60f32828a"; # UUID for /dev/sda1
|
||||
# keyFile = "/keyfile1.bin";
|
||||
# };
|
||||
# };
|
||||
|
||||
time.timeZone = "Australia/Brisbane";
|
||||
|
||||
networking.useDHCP = false;
|
||||
|
||||
nix = {
|
||||
package = pkgs.nixUnstable;
|
||||
extraOptions = ''
|
||||
experimental-features = nix-command flakes
|
||||
'';
|
||||
};
|
||||
|
||||
users.users.anish = {
|
||||
isNormalUser = true;
|
||||
hashedPassword = "MVHHpy9gbe3ow";
|
||||
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
|
||||
openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDM0Zvei46x/yZl/IeBCq6+IYQQ0avulzVyBysF9cPigZMCybWRV7IEU+E3k9t6JrbdbdGfJkcZIWmsWDdKS8W8mBnZpVoT0ffLynu8JQ/TKdGm4Qv6bgUeKNrGsNv0ZPs2CDaGSLj0oJfRF7Ko10tcLP0vW+yujrh+y6TH/vVzJioaV4TGvtCUpn+wEQah9ROwPQLUUofsSWdnRsDJ/gp37zXWs4l5wyjSKtP3O9RZUP7kBekbSqEgSXiTk0oUQSVqIWl9NDiP6onk/gSOjXsR/JPqsSN/XI/c/yj6gyY0f51Ru2D7iBxuMJIJcWV+rU6coIj+ULcQWLzt/7TI8jq5AOOzI/ll4zbL24Eo84Rz+TP9tvMMhDZ0VaMN22AJ8qQEjc5P09tWKsX7Jg39XelyV1jHXncE4yvIE9F4RSCHzWCeKeXakizQNuzSaxTxIExRFYHjNW5bR6+3MTGwVrEIXU+qML+0yFTR86MT+tdY5AreAJQLwbog79O1NupeXJE= anish@curve" ];
|
||||
};
|
||||
security.sudo.wheelNeedsPassword = false; # needed for deploy-rs
|
||||
|
||||
services.openssh.enable = true;
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "21.05"; # Did you read the comment?
|
||||
}
|
||||
|
||||
endmsg
|
||||
|
||||
|
||||
# sudo nixos-install
|
||||
172
install-yubikey.sh
Executable file
172
install-yubikey.sh
Executable file
|
|
@ -0,0 +1,172 @@
|
|||
rbtohex() {
|
||||
( od -An -vtx1 | tr -d ' \n' )
|
||||
}
|
||||
|
||||
hextorb() {
|
||||
( tr '[:lower:]' '[:upper:]' | sed -e 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/gI'| xargs printf )
|
||||
}
|
||||
|
||||
# Setup
|
||||
# nix-env -i gcc-wrapper
|
||||
# nix-env -i yubikey-personalization
|
||||
# nix-env -i openssl
|
||||
# Use nix-shell https://github.com/sgillespie/nixos-yubikey-luks/archive/master.tar.gz
|
||||
|
||||
# Compile correct version of OpenSSL key derivation
|
||||
cc -O3 -I$(nix-build "<nixpkgs>" --no-build-output -A openssl.dev)/include -L$(nix-build "<nixpkgs>" --no-build-output -A openssl.out)/lib $(nix eval "(with import <nixpkgs> {}; pkgs.path)")/nixos/modules/system/boot/pbkdf2-sha512.c -o ./pbkdf2-sha512 -lcrypto
|
||||
|
||||
# Yubikey Setup
|
||||
SLOT=2
|
||||
ykpersonalize -"$SLOT" -ochal-resp -ochal-hmac
|
||||
SALT_LENGTH=16
|
||||
salt="$(dd if=/dev/random bs=1 count=$SALT_LENGTH 2>/dev/null | rbtohex)"
|
||||
k_user=PASSWORDCHANGEMEPLAEASES
|
||||
challenge="$(echo -n $salt | openssl dgst -binary -sha512 | rbtohex)"
|
||||
response="$(ykchalresp -2 -x $challenge 2>/dev/null)"
|
||||
|
||||
# Setup LUKS device
|
||||
KEY_LENGTH=512
|
||||
ITERATIONS=1000000
|
||||
k_luks="$(echo -n $k_user | ./pbkdf2-sha512 $(($KEY_LENGTH / 8)) $ITERATIONS $response | rbtohex)"
|
||||
|
||||
EFI_PART=/dev/sda1
|
||||
LUKS_PART=/dev/sda2
|
||||
EFI_MNT=/boot/
|
||||
mkdir -p "$EFI_MNT"
|
||||
mkfs.fat -F 32 -n boot "$EFI_PART"
|
||||
mount "$EFI_PART" "$EFI_MNT"
|
||||
STORAGE=/crypt-storage/default
|
||||
mkdir -p "$(dirname $EFI_MNT$STORAGE)"
|
||||
echo -ne "$salt\n$ITERATIONS" > $EFI_MNT$STORAGE
|
||||
CIPHER=aes-xts-plain64
|
||||
HASH=sha512
|
||||
echo -n "$k_luks" | hextorb | cryptsetup luksFormat --cipher="$CIPHER" --key-size="$KEY_LENGTH" --hash="$HASH" --key-file=- "$LUKS_PART"
|
||||
umount "$EFI_MNT"
|
||||
|
||||
# LVM Setup
|
||||
LUKSROOT=crypthome
|
||||
echo -n "$k_luks" | hextorb | cryptsetup luksOpen $LUKS_PART $LUKSROOT --key-file=-
|
||||
pvcreate "/dev/mapper/$LUKSROOT"
|
||||
VGNAME=partitions
|
||||
vgcreate "$VGNAME" "/dev/mapper/$LUKSROOT"
|
||||
lvcreate -L 2G -n swap "$VGNAME"
|
||||
FSROOT=fsroot
|
||||
lvcreate -l 100%FREE -n "$FSROOT" "$VGNAME"
|
||||
|
||||
vgchange -ay
|
||||
mkswap -L swap /dev/partitions/swap
|
||||
|
||||
# BTRFS Setup
|
||||
mkfs.btrfs -L "$FSROOT" "/dev/partitions/$FSROOT"
|
||||
|
||||
# incase the above breaks
|
||||
#mkdir /mnt-root
|
||||
#touch /mnt-root/nix-store.squashfs
|
||||
|
||||
mount "/dev/partitions/$FSROOT" /mnt
|
||||
cd /mnt
|
||||
btrfs subvolume create root
|
||||
btrfs subvolume create home
|
||||
cd
|
||||
umount /mnt
|
||||
mount -o subvol=root "/dev/partitions/$FSROOT" /mnt
|
||||
mkdir /mnt/home
|
||||
mount -o subvol=home "/dev/partitions/$FSROOT" /mnt/home
|
||||
mkdir /mnt/boot
|
||||
mount "$EFI_PART" /mnt/boot
|
||||
|
||||
swapon /dev/partitions/swap
|
||||
|
||||
# Install NixOS
|
||||
nixos-generate-config --root /mnt
|
||||
|
||||
# Change the config
|
||||
cat > /mnt/etc/nixos/configuration.nix <<'endmsg'
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.version = 2;
|
||||
# Define on which hard drive you want to install Grub.
|
||||
boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
|
||||
|
||||
# Minimal list of modules to use the EFI system partition and the YubiKey
|
||||
boot.initrd.kernelModules = [ "vfat" "nls_cp437" "nls_iso8859-1" "usbhid" ];
|
||||
|
||||
# Enable support for the YubiKey PBA
|
||||
boot.initrd.luks.yubikeySupport = true;
|
||||
|
||||
# Configuration to use your Luks device
|
||||
boot.initrd.luks.devices = {
|
||||
"crypthome" = {
|
||||
device = "/dev/sda2";
|
||||
preLVM = true; # You may want to set this to false if you need to start a network service first
|
||||
yubikey = {
|
||||
slot = 2;
|
||||
twoFactor = true; # Set to false if you did not set up a user password.
|
||||
storage = {
|
||||
device = "/dev/sda1";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Enable Flakes
|
||||
nix = {
|
||||
package = pkgs.nixUnstable;
|
||||
extraOptions = ''
|
||||
experimental-features = nix-command flakes
|
||||
'';
|
||||
};
|
||||
|
||||
networking.hostName = "curve"; # Define your hostname.
|
||||
networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
|
||||
|
||||
time.timeZone = "Australia/Brisbane";
|
||||
|
||||
networking.useDHCP = false;
|
||||
networking.interfaces.enp0s31f6.useDHCP = true;
|
||||
networking.interfaces.wlp3s0.useDHCP = true;
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
# console = {
|
||||
# font = "Lat2-Terminus16";
|
||||
# keyMap = "us";
|
||||
# };
|
||||
|
||||
services.xserver.layout = "us,dvorak";
|
||||
|
||||
sound.enable = true;
|
||||
hardware.pulseaudio.enable = true;
|
||||
|
||||
services.xserver.libinput.enable = true;
|
||||
|
||||
# Hmmm maybe somewhere else?
|
||||
users.users.anish = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ];
|
||||
};
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
# services.openssh.enable = true;
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "21.05"; # Did you read the comment?
|
||||
}
|
||||
|
||||
endmsg
|
||||
|
||||
cd /mnt
|
||||
nixos-install --root /mnt
|
||||
passwd
|
||||
Loading…
Reference in a new issue