move around install scripts
This commit is contained in:
		
							parent
							
								
									144eac76ce
								
							
						
					
					
						commit
						3441b392e0
					
				
							
								
								
									
										121
									
								
								install-encrypted.sh
									
									
									
									
									
										Executable file
									
								
							
							
						
						
									
										121
									
								
								install-encrypted.sh
									
									
									
									
									
										Executable file
									
								
							|  | @ -0,0 +1,121 @@ | |||
| # Setup | ||||
| # Presumes pre-formatted harddrives  | ||||
| BOOT=/dev/sda1 | ||||
| DISK=/dev/sda2 | ||||
| 
 | ||||
| dd if=/dev/urandom of=./keyfile0.bin bs=1024 count=4 | ||||
| dd if=/dev/urandom of=./keyfile1.bin bs=1024 count=4 | ||||
| 
 | ||||
| echo "Creating LUKS partitions..." | ||||
| # Enter the passphrase which is used to unlock disk. You will enter this in grub on every boot | ||||
| cryptsetup luksFormat --type luks1 -c aes-xts-plain64 -s 256 -h sha512 $DISK | ||||
| # Add a second key which will be used by nixos. You will need to enter the pasphrase from previous step | ||||
| cryptsetup luksAddKey $DISK keyfile0.bin | ||||
| cryptsetup luksOpen $DISK crypted-nixos -d keyfile0.bin | ||||
| 
 | ||||
| # Create the LVM | ||||
| echo "Creating LVM partitions..." | ||||
| pvcreate /dev/mapper/crypted-nixos | ||||
| vgcreate vg /dev/mapper/crypted-nixos | ||||
| lvcreate -L 4G -n swap vg | ||||
| lvcreate -l '100%FREE' -n root vg | ||||
| 
 | ||||
| # Format the disks | ||||
| echo "Formatting disks..." | ||||
| mkfs.fat -F 32 $BOOT | ||||
| mkswap -L swap /dev/vg/swap | ||||
| mkfs.ext4 -L root /dev/vg/root | ||||
| # mkfs.ext4 -L data /dev/mapper/crypted-data | ||||
| 
 | ||||
| echo "Mounting drives..." | ||||
| mount /dev/vg/root /mnt | ||||
| mkdir -p /mnt/boot/efi | ||||
| mount $BOOT /mnt/boot/efi | ||||
| swapon /dev/vg/swap | ||||
| 
 | ||||
| # Copy the keys | ||||
| 
 | ||||
| mkdir -p /mnt/etc/secrets/initrd/ | ||||
| cp keyfile0.bin keyfile1.bin /mnt/etc/secrets/initrd | ||||
| chmod 000 /mnt/etc/secrets/initrd/keyfile*.bin | ||||
| 
 | ||||
| # Generate and edit configuration | ||||
| 
 | ||||
| echo "Generating NixOS config..." | ||||
| nixos-generate-config --root /mnt | ||||
| 
 | ||||
| # TODO:  neds to get the uuid of each of the disks  | ||||
| # UUID=$(blkid)  | ||||
| echo "Extending NixOS config..." | ||||
| cat >> /mnt/etc/nixos/configuration.nix <<'endmsg' | ||||
|   boot.loader.efi.canTouchEfiVariables = true; | ||||
|   boot.loader.efi.efiSysMountPoint = "/boot/efi"; | ||||
|   boot.loader.grub = { | ||||
|     enable = true; | ||||
|     device = "nodev"; | ||||
|     version = 2; | ||||
|     efiSupport = true; | ||||
|     enableCryptodisk = true; | ||||
|   }; | ||||
|    | ||||
|   boot.initrd = { | ||||
|     luks.devices."root" = { | ||||
| 			# UPDATE ME | ||||
|       device = "/dev/disk/by-uuid/a8b302cf-5296-4a2e-a7ba-707e6fa75123"; # UUID for /dev/nvme01np2  | ||||
|       preLVM = true; | ||||
|       keyFile = "/keyfile0.bin"; | ||||
|       allowDiscards = true; | ||||
|     }; | ||||
|     secrets = { | ||||
|       # Create /mnt/etc/secrets/initrd directory and copy keys to it | ||||
|       "keyfile0.bin" = "/etc/secrets/initrd/keyfile0.bin"; | ||||
|       "keyfile1.bin" = "/etc/secrets/initrd/keyfile1.bin"; | ||||
|     }; | ||||
| 	}; | ||||
| 
 | ||||
|   # Data mount | ||||
| 	# This is all wrong for box for now | ||||
|   # fileSystems."/data" = { | ||||
|   #   device = "/dev/disk/by-uuid/79630267-5766-4c7d-85a5-1d5f1dcd58ad"; # UUID for /dev/mapper/crypted-data | ||||
|   #   encrypted = { | ||||
|   #     enable = true; | ||||
|   #     label = "crypted-data"; | ||||
|   #     blkDev = "/dev/disk/by-uuid/3476cb09-b3c4-4301-9ec9-84f60f32828a"; # UUID for /dev/sda1 | ||||
|   #     keyFile = "/keyfile1.bin"; | ||||
|   #   }; | ||||
|   # }; | ||||
| 
 | ||||
|   time.timeZone = "Australia/Brisbane"; | ||||
| 
 | ||||
|   networking.useDHCP = false; | ||||
| 
 | ||||
|   nix = { | ||||
|     package = pkgs.nixUnstable; | ||||
|     extraOptions = '' | ||||
|       experimental-features = nix-command flakes | ||||
|     ''; | ||||
|   }; | ||||
| 
 | ||||
|   users.users.anish = { | ||||
|     isNormalUser = true; | ||||
|     hashedPassword = "MVHHpy9gbe3ow"; | ||||
|     extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user. | ||||
|     openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDM0Zvei46x/yZl/IeBCq6+IYQQ0avulzVyBysF9cPigZMCybWRV7IEU+E3k9t6JrbdbdGfJkcZIWmsWDdKS8W8mBnZpVoT0ffLynu8JQ/TKdGm4Qv6bgUeKNrGsNv0ZPs2CDaGSLj0oJfRF7Ko10tcLP0vW+yujrh+y6TH/vVzJioaV4TGvtCUpn+wEQah9ROwPQLUUofsSWdnRsDJ/gp37zXWs4l5wyjSKtP3O9RZUP7kBekbSqEgSXiTk0oUQSVqIWl9NDiP6onk/gSOjXsR/JPqsSN/XI/c/yj6gyY0f51Ru2D7iBxuMJIJcWV+rU6coIj+ULcQWLzt/7TI8jq5AOOzI/ll4zbL24Eo84Rz+TP9tvMMhDZ0VaMN22AJ8qQEjc5P09tWKsX7Jg39XelyV1jHXncE4yvIE9F4RSCHzWCeKeXakizQNuzSaxTxIExRFYHjNW5bR6+3MTGwVrEIXU+qML+0yFTR86MT+tdY5AreAJQLwbog79O1NupeXJE= anish@curve" ]; | ||||
|   }; | ||||
|   security.sudo.wheelNeedsPassword = false; # needed for deploy-rs | ||||
| 
 | ||||
|   services.openssh.enable = true; | ||||
| 
 | ||||
|   # This value determines the NixOS release from which the default | ||||
|   # settings for stateful data, like file locations and database versions | ||||
|   # on your system were taken. It‘s perfectly fine and recommended to leave | ||||
|   # this value at the release version of the first install of this system. | ||||
|   # Before changing this value read the documentation for this option | ||||
|   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). | ||||
|   system.stateVersion = "21.05"; # Did you read the comment? | ||||
| } | ||||
| 
 | ||||
| endmsg | ||||
| 
 | ||||
| 
 | ||||
| # sudo nixos-install | ||||
							
								
								
									
										172
									
								
								install-yubikey.sh
									
									
									
									
									
										Executable file
									
								
							
							
						
						
									
										172
									
								
								install-yubikey.sh
									
									
									
									
									
										Executable file
									
								
							|  | @ -0,0 +1,172 @@ | |||
| rbtohex() { | ||||
|     ( od -An -vtx1 | tr -d ' \n' ) | ||||
| } | ||||
| 
 | ||||
| hextorb() { | ||||
|     ( tr '[:lower:]' '[:upper:]' | sed -e 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/gI'| xargs printf ) | ||||
| } | ||||
| 
 | ||||
| # Setup | ||||
| # nix-env -i gcc-wrapper | ||||
| # nix-env -i yubikey-personalization | ||||
| # nix-env -i openssl | ||||
| # Use nix-shell https://github.com/sgillespie/nixos-yubikey-luks/archive/master.tar.gz | ||||
| 
 | ||||
| # Compile correct version of OpenSSL key derivation | ||||
| cc -O3 -I$(nix-build "<nixpkgs>" --no-build-output -A openssl.dev)/include -L$(nix-build "<nixpkgs>" --no-build-output -A openssl.out)/lib $(nix eval "(with import <nixpkgs> {}; pkgs.path)")/nixos/modules/system/boot/pbkdf2-sha512.c -o ./pbkdf2-sha512 -lcrypto | ||||
| 
 | ||||
| # Yubikey Setup | ||||
| SLOT=2 | ||||
| ykpersonalize -"$SLOT" -ochal-resp -ochal-hmac | ||||
| SALT_LENGTH=16 | ||||
| salt="$(dd if=/dev/random bs=1 count=$SALT_LENGTH 2>/dev/null | rbtohex)" | ||||
| k_user=PASSWORDCHANGEMEPLAEASES  | ||||
| challenge="$(echo -n $salt | openssl dgst -binary -sha512 | rbtohex)" | ||||
| response="$(ykchalresp -2 -x $challenge 2>/dev/null)" | ||||
| 
 | ||||
| # Setup LUKS device | ||||
| KEY_LENGTH=512 | ||||
| ITERATIONS=1000000 | ||||
| k_luks="$(echo -n $k_user | ./pbkdf2-sha512 $(($KEY_LENGTH / 8)) $ITERATIONS $response | rbtohex)" | ||||
| 
 | ||||
| EFI_PART=/dev/sda1 | ||||
| LUKS_PART=/dev/sda2 | ||||
| EFI_MNT=/boot/ | ||||
| mkdir -p "$EFI_MNT" | ||||
| mkfs.fat -F 32 -n boot "$EFI_PART" | ||||
| mount "$EFI_PART" "$EFI_MNT" | ||||
| STORAGE=/crypt-storage/default | ||||
| mkdir -p "$(dirname $EFI_MNT$STORAGE)" | ||||
| echo -ne "$salt\n$ITERATIONS" > $EFI_MNT$STORAGE | ||||
| CIPHER=aes-xts-plain64 | ||||
| HASH=sha512 | ||||
| echo -n "$k_luks" | hextorb | cryptsetup luksFormat --cipher="$CIPHER" --key-size="$KEY_LENGTH" --hash="$HASH" --key-file=- "$LUKS_PART" | ||||
| umount "$EFI_MNT" | ||||
| 
 | ||||
| # LVM Setup | ||||
| LUKSROOT=crypthome | ||||
| echo -n "$k_luks" | hextorb | cryptsetup luksOpen $LUKS_PART $LUKSROOT --key-file=-  | ||||
| pvcreate "/dev/mapper/$LUKSROOT" | ||||
| VGNAME=partitions | ||||
| vgcreate "$VGNAME" "/dev/mapper/$LUKSROOT" | ||||
| lvcreate -L 2G -n swap "$VGNAME" | ||||
| FSROOT=fsroot | ||||
| lvcreate -l 100%FREE -n "$FSROOT" "$VGNAME" | ||||
| 
 | ||||
| vgchange -ay | ||||
| mkswap -L swap /dev/partitions/swap | ||||
| 
 | ||||
| # BTRFS Setup | ||||
| mkfs.btrfs -L "$FSROOT" "/dev/partitions/$FSROOT" | ||||
| 
 | ||||
| # incase the above breaks | ||||
| #mkdir /mnt-root | ||||
| #touch /mnt-root/nix-store.squashfs | ||||
| 
 | ||||
| mount "/dev/partitions/$FSROOT" /mnt | ||||
| cd /mnt | ||||
| btrfs subvolume create root | ||||
| btrfs subvolume create home | ||||
| cd | ||||
| umount /mnt | ||||
| mount -o subvol=root "/dev/partitions/$FSROOT" /mnt | ||||
| mkdir /mnt/home | ||||
| mount -o subvol=home "/dev/partitions/$FSROOT" /mnt/home | ||||
| mkdir /mnt/boot | ||||
| mount "$EFI_PART" /mnt/boot | ||||
| 
 | ||||
| swapon /dev/partitions/swap | ||||
| 
 | ||||
| # Install NixOS | ||||
| nixos-generate-config --root /mnt | ||||
| 
 | ||||
| # Change the config | ||||
| cat > /mnt/etc/nixos/configuration.nix <<'endmsg' | ||||
| { config, pkgs, ... }: | ||||
| 
 | ||||
| { | ||||
|   imports = | ||||
|     [ # Include the results of the hardware scan. | ||||
|       ./hardware-configuration.nix | ||||
|     ]; | ||||
| 
 | ||||
|   boot.loader.grub.enable = true; | ||||
|   boot.loader.grub.version = 2; | ||||
|   # Define on which hard drive you want to install Grub. | ||||
|   boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only | ||||
| 
 | ||||
|   # Minimal list of modules to use the EFI system partition and the YubiKey | ||||
|   boot.initrd.kernelModules = [ "vfat" "nls_cp437" "nls_iso8859-1" "usbhid" ]; | ||||
|    | ||||
|   # Enable support for the YubiKey PBA | ||||
|   boot.initrd.luks.yubikeySupport = true; | ||||
|    | ||||
|   # Configuration to use your Luks device | ||||
|   boot.initrd.luks.devices = { | ||||
|     "crypthome" = { | ||||
|       device = "/dev/sda2"; | ||||
|       preLVM = true; # You may want to set this to false if you need to start a network service first | ||||
|       yubikey = { | ||||
|         slot = 2; | ||||
|         twoFactor = true; # Set to false if you did not set up a user password. | ||||
|         storage = { | ||||
|           device = "/dev/sda1"; | ||||
|         }; | ||||
|       }; | ||||
|     };  | ||||
|   }; | ||||
| 
 | ||||
|   # Enable Flakes | ||||
|   nix = { | ||||
|     package = pkgs.nixUnstable; | ||||
|     extraOptions = '' | ||||
|       experimental-features = nix-command flakes | ||||
|     ''; | ||||
|    }; | ||||
| 
 | ||||
|   networking.hostName = "curve"; # Define your hostname. | ||||
|   networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant. | ||||
| 
 | ||||
|   time.timeZone = "Australia/Brisbane"; | ||||
| 
 | ||||
|   networking.useDHCP = false; | ||||
|   networking.interfaces.enp0s31f6.useDHCP = true; | ||||
|   networking.interfaces.wlp3s0.useDHCP = true; | ||||
| 
 | ||||
|   # Select internationalisation properties. | ||||
|   i18n.defaultLocale = "en_US.UTF-8"; | ||||
|   # console = { | ||||
|   #   font = "Lat2-Terminus16"; | ||||
|   #   keyMap = "us"; | ||||
|   # }; | ||||
| 
 | ||||
|   services.xserver.layout = "us,dvorak"; | ||||
| 
 | ||||
|   sound.enable = true; | ||||
|   hardware.pulseaudio.enable = true; | ||||
| 
 | ||||
|   services.xserver.libinput.enable = true; | ||||
| 
 | ||||
|   # Hmmm maybe somewhere else?  | ||||
|   users.users.anish = { | ||||
|     isNormalUser = true; | ||||
|     extraGroups = [ "wheel" ];  | ||||
|   }; | ||||
| 
 | ||||
|   # Enable the OpenSSH daemon. | ||||
|   # services.openssh.enable = true; | ||||
| 
 | ||||
|   # This value determines the NixOS release from which the default | ||||
|   # settings for stateful data, like file locations and database versions | ||||
|   # on your system were taken. It‘s perfectly fine and recommended to leave | ||||
|   # this value at the release version of the first install of this system. | ||||
|   # Before changing this value read the documentation for this option | ||||
|   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). | ||||
|   system.stateVersion = "21.05"; # Did you read the comment? | ||||
| } | ||||
| 
 | ||||
| endmsg | ||||
| 
 | ||||
| cd /mnt | ||||
| nixos-install --root /mnt | ||||
| passwd | ||||
		Loading…
	
		Reference in a new issue