move around install scripts
This commit is contained in:
		
							parent
							
								
									144eac76ce
								
							
						
					
					
						commit
						3441b392e0
					
				
							
								
								
									
										121
									
								
								install-encrypted.sh
									
									
									
									
									
										Executable file
									
								
							
							
						
						
									
										121
									
								
								install-encrypted.sh
									
									
									
									
									
										Executable file
									
								
							|  | @ -0,0 +1,121 @@ | ||||||
|  | # Setup | ||||||
|  | # Presumes pre-formatted harddrives  | ||||||
|  | BOOT=/dev/sda1 | ||||||
|  | DISK=/dev/sda2 | ||||||
|  | 
 | ||||||
|  | dd if=/dev/urandom of=./keyfile0.bin bs=1024 count=4 | ||||||
|  | dd if=/dev/urandom of=./keyfile1.bin bs=1024 count=4 | ||||||
|  | 
 | ||||||
|  | echo "Creating LUKS partitions..." | ||||||
|  | # Enter the passphrase which is used to unlock disk. You will enter this in grub on every boot | ||||||
|  | cryptsetup luksFormat --type luks1 -c aes-xts-plain64 -s 256 -h sha512 $DISK | ||||||
|  | # Add a second key which will be used by nixos. You will need to enter the pasphrase from previous step | ||||||
|  | cryptsetup luksAddKey $DISK keyfile0.bin | ||||||
|  | cryptsetup luksOpen $DISK crypted-nixos -d keyfile0.bin | ||||||
|  | 
 | ||||||
|  | # Create the LVM | ||||||
|  | echo "Creating LVM partitions..." | ||||||
|  | pvcreate /dev/mapper/crypted-nixos | ||||||
|  | vgcreate vg /dev/mapper/crypted-nixos | ||||||
|  | lvcreate -L 4G -n swap vg | ||||||
|  | lvcreate -l '100%FREE' -n root vg | ||||||
|  | 
 | ||||||
|  | # Format the disks | ||||||
|  | echo "Formatting disks..." | ||||||
|  | mkfs.fat -F 32 $BOOT | ||||||
|  | mkswap -L swap /dev/vg/swap | ||||||
|  | mkfs.ext4 -L root /dev/vg/root | ||||||
|  | # mkfs.ext4 -L data /dev/mapper/crypted-data | ||||||
|  | 
 | ||||||
|  | echo "Mounting drives..." | ||||||
|  | mount /dev/vg/root /mnt | ||||||
|  | mkdir -p /mnt/boot/efi | ||||||
|  | mount $BOOT /mnt/boot/efi | ||||||
|  | swapon /dev/vg/swap | ||||||
|  | 
 | ||||||
|  | # Copy the keys | ||||||
|  | 
 | ||||||
|  | mkdir -p /mnt/etc/secrets/initrd/ | ||||||
|  | cp keyfile0.bin keyfile1.bin /mnt/etc/secrets/initrd | ||||||
|  | chmod 000 /mnt/etc/secrets/initrd/keyfile*.bin | ||||||
|  | 
 | ||||||
|  | # Generate and edit configuration | ||||||
|  | 
 | ||||||
|  | echo "Generating NixOS config..." | ||||||
|  | nixos-generate-config --root /mnt | ||||||
|  | 
 | ||||||
|  | # TODO:  neds to get the uuid of each of the disks  | ||||||
|  | # UUID=$(blkid)  | ||||||
|  | echo "Extending NixOS config..." | ||||||
|  | cat >> /mnt/etc/nixos/configuration.nix <<'endmsg' | ||||||
|  |   boot.loader.efi.canTouchEfiVariables = true; | ||||||
|  |   boot.loader.efi.efiSysMountPoint = "/boot/efi"; | ||||||
|  |   boot.loader.grub = { | ||||||
|  |     enable = true; | ||||||
|  |     device = "nodev"; | ||||||
|  |     version = 2; | ||||||
|  |     efiSupport = true; | ||||||
|  |     enableCryptodisk = true; | ||||||
|  |   }; | ||||||
|  |    | ||||||
|  |   boot.initrd = { | ||||||
|  |     luks.devices."root" = { | ||||||
|  | 			# UPDATE ME | ||||||
|  |       device = "/dev/disk/by-uuid/a8b302cf-5296-4a2e-a7ba-707e6fa75123"; # UUID for /dev/nvme01np2  | ||||||
|  |       preLVM = true; | ||||||
|  |       keyFile = "/keyfile0.bin"; | ||||||
|  |       allowDiscards = true; | ||||||
|  |     }; | ||||||
|  |     secrets = { | ||||||
|  |       # Create /mnt/etc/secrets/initrd directory and copy keys to it | ||||||
|  |       "keyfile0.bin" = "/etc/secrets/initrd/keyfile0.bin"; | ||||||
|  |       "keyfile1.bin" = "/etc/secrets/initrd/keyfile1.bin"; | ||||||
|  |     }; | ||||||
|  | 	}; | ||||||
|  | 
 | ||||||
|  |   # Data mount | ||||||
|  | 	# This is all wrong for box for now | ||||||
|  |   # fileSystems."/data" = { | ||||||
|  |   #   device = "/dev/disk/by-uuid/79630267-5766-4c7d-85a5-1d5f1dcd58ad"; # UUID for /dev/mapper/crypted-data | ||||||
|  |   #   encrypted = { | ||||||
|  |   #     enable = true; | ||||||
|  |   #     label = "crypted-data"; | ||||||
|  |   #     blkDev = "/dev/disk/by-uuid/3476cb09-b3c4-4301-9ec9-84f60f32828a"; # UUID for /dev/sda1 | ||||||
|  |   #     keyFile = "/keyfile1.bin"; | ||||||
|  |   #   }; | ||||||
|  |   # }; | ||||||
|  | 
 | ||||||
|  |   time.timeZone = "Australia/Brisbane"; | ||||||
|  | 
 | ||||||
|  |   networking.useDHCP = false; | ||||||
|  | 
 | ||||||
|  |   nix = { | ||||||
|  |     package = pkgs.nixUnstable; | ||||||
|  |     extraOptions = '' | ||||||
|  |       experimental-features = nix-command flakes | ||||||
|  |     ''; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   users.users.anish = { | ||||||
|  |     isNormalUser = true; | ||||||
|  |     hashedPassword = "MVHHpy9gbe3ow"; | ||||||
|  |     extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user. | ||||||
|  |     openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDM0Zvei46x/yZl/IeBCq6+IYQQ0avulzVyBysF9cPigZMCybWRV7IEU+E3k9t6JrbdbdGfJkcZIWmsWDdKS8W8mBnZpVoT0ffLynu8JQ/TKdGm4Qv6bgUeKNrGsNv0ZPs2CDaGSLj0oJfRF7Ko10tcLP0vW+yujrh+y6TH/vVzJioaV4TGvtCUpn+wEQah9ROwPQLUUofsSWdnRsDJ/gp37zXWs4l5wyjSKtP3O9RZUP7kBekbSqEgSXiTk0oUQSVqIWl9NDiP6onk/gSOjXsR/JPqsSN/XI/c/yj6gyY0f51Ru2D7iBxuMJIJcWV+rU6coIj+ULcQWLzt/7TI8jq5AOOzI/ll4zbL24Eo84Rz+TP9tvMMhDZ0VaMN22AJ8qQEjc5P09tWKsX7Jg39XelyV1jHXncE4yvIE9F4RSCHzWCeKeXakizQNuzSaxTxIExRFYHjNW5bR6+3MTGwVrEIXU+qML+0yFTR86MT+tdY5AreAJQLwbog79O1NupeXJE= anish@curve" ]; | ||||||
|  |   }; | ||||||
|  |   security.sudo.wheelNeedsPassword = false; # needed for deploy-rs | ||||||
|  | 
 | ||||||
|  |   services.openssh.enable = true; | ||||||
|  | 
 | ||||||
|  |   # This value determines the NixOS release from which the default | ||||||
|  |   # settings for stateful data, like file locations and database versions | ||||||
|  |   # on your system were taken. It‘s perfectly fine and recommended to leave | ||||||
|  |   # this value at the release version of the first install of this system. | ||||||
|  |   # Before changing this value read the documentation for this option | ||||||
|  |   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). | ||||||
|  |   system.stateVersion = "21.05"; # Did you read the comment? | ||||||
|  | } | ||||||
|  | 
 | ||||||
|  | endmsg | ||||||
|  | 
 | ||||||
|  | 
 | ||||||
|  | # sudo nixos-install | ||||||
							
								
								
									
										172
									
								
								install-yubikey.sh
									
									
									
									
									
										Executable file
									
								
							
							
						
						
									
										172
									
								
								install-yubikey.sh
									
									
									
									
									
										Executable file
									
								
							|  | @ -0,0 +1,172 @@ | ||||||
|  | rbtohex() { | ||||||
|  |     ( od -An -vtx1 | tr -d ' \n' ) | ||||||
|  | } | ||||||
|  | 
 | ||||||
|  | hextorb() { | ||||||
|  |     ( tr '[:lower:]' '[:upper:]' | sed -e 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/gI'| xargs printf ) | ||||||
|  | } | ||||||
|  | 
 | ||||||
|  | # Setup | ||||||
|  | # nix-env -i gcc-wrapper | ||||||
|  | # nix-env -i yubikey-personalization | ||||||
|  | # nix-env -i openssl | ||||||
|  | # Use nix-shell https://github.com/sgillespie/nixos-yubikey-luks/archive/master.tar.gz | ||||||
|  | 
 | ||||||
|  | # Compile correct version of OpenSSL key derivation | ||||||
|  | cc -O3 -I$(nix-build "<nixpkgs>" --no-build-output -A openssl.dev)/include -L$(nix-build "<nixpkgs>" --no-build-output -A openssl.out)/lib $(nix eval "(with import <nixpkgs> {}; pkgs.path)")/nixos/modules/system/boot/pbkdf2-sha512.c -o ./pbkdf2-sha512 -lcrypto | ||||||
|  | 
 | ||||||
|  | # Yubikey Setup | ||||||
|  | SLOT=2 | ||||||
|  | ykpersonalize -"$SLOT" -ochal-resp -ochal-hmac | ||||||
|  | SALT_LENGTH=16 | ||||||
|  | salt="$(dd if=/dev/random bs=1 count=$SALT_LENGTH 2>/dev/null | rbtohex)" | ||||||
|  | k_user=PASSWORDCHANGEMEPLAEASES  | ||||||
|  | challenge="$(echo -n $salt | openssl dgst -binary -sha512 | rbtohex)" | ||||||
|  | response="$(ykchalresp -2 -x $challenge 2>/dev/null)" | ||||||
|  | 
 | ||||||
|  | # Setup LUKS device | ||||||
|  | KEY_LENGTH=512 | ||||||
|  | ITERATIONS=1000000 | ||||||
|  | k_luks="$(echo -n $k_user | ./pbkdf2-sha512 $(($KEY_LENGTH / 8)) $ITERATIONS $response | rbtohex)" | ||||||
|  | 
 | ||||||
|  | EFI_PART=/dev/sda1 | ||||||
|  | LUKS_PART=/dev/sda2 | ||||||
|  | EFI_MNT=/boot/ | ||||||
|  | mkdir -p "$EFI_MNT" | ||||||
|  | mkfs.fat -F 32 -n boot "$EFI_PART" | ||||||
|  | mount "$EFI_PART" "$EFI_MNT" | ||||||
|  | STORAGE=/crypt-storage/default | ||||||
|  | mkdir -p "$(dirname $EFI_MNT$STORAGE)" | ||||||
|  | echo -ne "$salt\n$ITERATIONS" > $EFI_MNT$STORAGE | ||||||
|  | CIPHER=aes-xts-plain64 | ||||||
|  | HASH=sha512 | ||||||
|  | echo -n "$k_luks" | hextorb | cryptsetup luksFormat --cipher="$CIPHER" --key-size="$KEY_LENGTH" --hash="$HASH" --key-file=- "$LUKS_PART" | ||||||
|  | umount "$EFI_MNT" | ||||||
|  | 
 | ||||||
|  | # LVM Setup | ||||||
|  | LUKSROOT=crypthome | ||||||
|  | echo -n "$k_luks" | hextorb | cryptsetup luksOpen $LUKS_PART $LUKSROOT --key-file=-  | ||||||
|  | pvcreate "/dev/mapper/$LUKSROOT" | ||||||
|  | VGNAME=partitions | ||||||
|  | vgcreate "$VGNAME" "/dev/mapper/$LUKSROOT" | ||||||
|  | lvcreate -L 2G -n swap "$VGNAME" | ||||||
|  | FSROOT=fsroot | ||||||
|  | lvcreate -l 100%FREE -n "$FSROOT" "$VGNAME" | ||||||
|  | 
 | ||||||
|  | vgchange -ay | ||||||
|  | mkswap -L swap /dev/partitions/swap | ||||||
|  | 
 | ||||||
|  | # BTRFS Setup | ||||||
|  | mkfs.btrfs -L "$FSROOT" "/dev/partitions/$FSROOT" | ||||||
|  | 
 | ||||||
|  | # incase the above breaks | ||||||
|  | #mkdir /mnt-root | ||||||
|  | #touch /mnt-root/nix-store.squashfs | ||||||
|  | 
 | ||||||
|  | mount "/dev/partitions/$FSROOT" /mnt | ||||||
|  | cd /mnt | ||||||
|  | btrfs subvolume create root | ||||||
|  | btrfs subvolume create home | ||||||
|  | cd | ||||||
|  | umount /mnt | ||||||
|  | mount -o subvol=root "/dev/partitions/$FSROOT" /mnt | ||||||
|  | mkdir /mnt/home | ||||||
|  | mount -o subvol=home "/dev/partitions/$FSROOT" /mnt/home | ||||||
|  | mkdir /mnt/boot | ||||||
|  | mount "$EFI_PART" /mnt/boot | ||||||
|  | 
 | ||||||
|  | swapon /dev/partitions/swap | ||||||
|  | 
 | ||||||
|  | # Install NixOS | ||||||
|  | nixos-generate-config --root /mnt | ||||||
|  | 
 | ||||||
|  | # Change the config | ||||||
|  | cat > /mnt/etc/nixos/configuration.nix <<'endmsg' | ||||||
|  | { config, pkgs, ... }: | ||||||
|  | 
 | ||||||
|  | { | ||||||
|  |   imports = | ||||||
|  |     [ # Include the results of the hardware scan. | ||||||
|  |       ./hardware-configuration.nix | ||||||
|  |     ]; | ||||||
|  | 
 | ||||||
|  |   boot.loader.grub.enable = true; | ||||||
|  |   boot.loader.grub.version = 2; | ||||||
|  |   # Define on which hard drive you want to install Grub. | ||||||
|  |   boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only | ||||||
|  | 
 | ||||||
|  |   # Minimal list of modules to use the EFI system partition and the YubiKey | ||||||
|  |   boot.initrd.kernelModules = [ "vfat" "nls_cp437" "nls_iso8859-1" "usbhid" ]; | ||||||
|  |    | ||||||
|  |   # Enable support for the YubiKey PBA | ||||||
|  |   boot.initrd.luks.yubikeySupport = true; | ||||||
|  |    | ||||||
|  |   # Configuration to use your Luks device | ||||||
|  |   boot.initrd.luks.devices = { | ||||||
|  |     "crypthome" = { | ||||||
|  |       device = "/dev/sda2"; | ||||||
|  |       preLVM = true; # You may want to set this to false if you need to start a network service first | ||||||
|  |       yubikey = { | ||||||
|  |         slot = 2; | ||||||
|  |         twoFactor = true; # Set to false if you did not set up a user password. | ||||||
|  |         storage = { | ||||||
|  |           device = "/dev/sda1"; | ||||||
|  |         }; | ||||||
|  |       }; | ||||||
|  |     };  | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   # Enable Flakes | ||||||
|  |   nix = { | ||||||
|  |     package = pkgs.nixUnstable; | ||||||
|  |     extraOptions = '' | ||||||
|  |       experimental-features = nix-command flakes | ||||||
|  |     ''; | ||||||
|  |    }; | ||||||
|  | 
 | ||||||
|  |   networking.hostName = "curve"; # Define your hostname. | ||||||
|  |   networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant. | ||||||
|  | 
 | ||||||
|  |   time.timeZone = "Australia/Brisbane"; | ||||||
|  | 
 | ||||||
|  |   networking.useDHCP = false; | ||||||
|  |   networking.interfaces.enp0s31f6.useDHCP = true; | ||||||
|  |   networking.interfaces.wlp3s0.useDHCP = true; | ||||||
|  | 
 | ||||||
|  |   # Select internationalisation properties. | ||||||
|  |   i18n.defaultLocale = "en_US.UTF-8"; | ||||||
|  |   # console = { | ||||||
|  |   #   font = "Lat2-Terminus16"; | ||||||
|  |   #   keyMap = "us"; | ||||||
|  |   # }; | ||||||
|  | 
 | ||||||
|  |   services.xserver.layout = "us,dvorak"; | ||||||
|  | 
 | ||||||
|  |   sound.enable = true; | ||||||
|  |   hardware.pulseaudio.enable = true; | ||||||
|  | 
 | ||||||
|  |   services.xserver.libinput.enable = true; | ||||||
|  | 
 | ||||||
|  |   # Hmmm maybe somewhere else?  | ||||||
|  |   users.users.anish = { | ||||||
|  |     isNormalUser = true; | ||||||
|  |     extraGroups = [ "wheel" ];  | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   # Enable the OpenSSH daemon. | ||||||
|  |   # services.openssh.enable = true; | ||||||
|  | 
 | ||||||
|  |   # This value determines the NixOS release from which the default | ||||||
|  |   # settings for stateful data, like file locations and database versions | ||||||
|  |   # on your system were taken. It‘s perfectly fine and recommended to leave | ||||||
|  |   # this value at the release version of the first install of this system. | ||||||
|  |   # Before changing this value read the documentation for this option | ||||||
|  |   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). | ||||||
|  |   system.stateVersion = "21.05"; # Did you read the comment? | ||||||
|  | } | ||||||
|  | 
 | ||||||
|  | endmsg | ||||||
|  | 
 | ||||||
|  | cd /mnt | ||||||
|  | nixos-install --root /mnt | ||||||
|  | passwd | ||||||
		Loading…
	
		Reference in a new issue