helm/install-encrypted.sh

122 lines
4.1 KiB
Bash
Raw Permalink Blame History

This file contains ambiguous Unicode characters!

This file contains ambiguous Unicode characters that may be confused with others in your current locale. If your use case is intentional and legitimate, you can safely ignore this warning. Use the Escape button to highlight these characters.

# Setup
# Presumes pre-formatted harddrives
BOOT=/dev/sda1
DISK=/dev/sda2
dd if=/dev/urandom of=./keyfile0.bin bs=1024 count=4
dd if=/dev/urandom of=./keyfile1.bin bs=1024 count=4
echo "Creating LUKS partitions..."
# Enter the passphrase which is used to unlock disk. You will enter this in grub on every boot
cryptsetup luksFormat --type luks1 -c aes-xts-plain64 -s 256 -h sha512 $DISK
# Add a second key which will be used by nixos. You will need to enter the pasphrase from previous step
cryptsetup luksAddKey $DISK keyfile0.bin
cryptsetup luksOpen $DISK crypted-nixos -d keyfile0.bin
# Create the LVM
echo "Creating LVM partitions..."
pvcreate /dev/mapper/crypted-nixos
vgcreate vg /dev/mapper/crypted-nixos
lvcreate -L 4G -n swap vg
lvcreate -l '100%FREE' -n root vg
# Format the disks
echo "Formatting disks..."
mkfs.fat -F 32 $BOOT
mkswap -L swap /dev/vg/swap
mkfs.ext4 -L root /dev/vg/root
# mkfs.ext4 -L data /dev/mapper/crypted-data
echo "Mounting drives..."
mount /dev/vg/root /mnt
mkdir -p /mnt/boot/efi
mount $BOOT /mnt/boot/efi
swapon /dev/vg/swap
# Copy the keys
mkdir -p /mnt/etc/secrets/initrd/
cp keyfile0.bin keyfile1.bin /mnt/etc/secrets/initrd
chmod 000 /mnt/etc/secrets/initrd/keyfile*.bin
# Generate and edit configuration
echo "Generating NixOS config..."
nixos-generate-config --root /mnt
# TODO: neds to get the uuid of each of the disks
# UUID=$(blkid)
echo "Extending NixOS config..."
cat >> /mnt/etc/nixos/configuration.nix <<'endmsg'
boot.loader.efi.canTouchEfiVariables = true;
boot.loader.efi.efiSysMountPoint = "/boot/efi";
boot.loader.grub = {
enable = true;
device = "nodev";
version = 2;
efiSupport = true;
enableCryptodisk = true;
};
boot.initrd = {
luks.devices."root" = {
# UPDATE ME
device = "/dev/disk/by-uuid/a8b302cf-5296-4a2e-a7ba-707e6fa75123"; # UUID for /dev/nvme01np2
preLVM = true;
keyFile = "/keyfile0.bin";
allowDiscards = true;
};
secrets = {
# Create /mnt/etc/secrets/initrd directory and copy keys to it
"keyfile0.bin" = "/etc/secrets/initrd/keyfile0.bin";
"keyfile1.bin" = "/etc/secrets/initrd/keyfile1.bin";
};
};
# Data mount
# This is all wrong for box for now
# fileSystems."/data" = {
# device = "/dev/disk/by-uuid/79630267-5766-4c7d-85a5-1d5f1dcd58ad"; # UUID for /dev/mapper/crypted-data
# encrypted = {
# enable = true;
# label = "crypted-data";
# blkDev = "/dev/disk/by-uuid/3476cb09-b3c4-4301-9ec9-84f60f32828a"; # UUID for /dev/sda1
# keyFile = "/keyfile1.bin";
# };
# };
time.timeZone = "Australia/Brisbane";
networking.useDHCP = false;
nix = {
package = pkgs.nixUnstable;
extraOptions = ''
experimental-features = nix-command flakes
'';
};
users.users.anish = {
isNormalUser = true;
hashedPassword = "MVHHpy9gbe3ow";
extraGroups = [ "wheel" ]; # Enable sudo for the user.
openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDM0Zvei46x/yZl/IeBCq6+IYQQ0avulzVyBysF9cPigZMCybWRV7IEU+E3k9t6JrbdbdGfJkcZIWmsWDdKS8W8mBnZpVoT0ffLynu8JQ/TKdGm4Qv6bgUeKNrGsNv0ZPs2CDaGSLj0oJfRF7Ko10tcLP0vW+yujrh+y6TH/vVzJioaV4TGvtCUpn+wEQah9ROwPQLUUofsSWdnRsDJ/gp37zXWs4l5wyjSKtP3O9RZUP7kBekbSqEgSXiTk0oUQSVqIWl9NDiP6onk/gSOjXsR/JPqsSN/XI/c/yj6gyY0f51Ru2D7iBxuMJIJcWV+rU6coIj+ULcQWLzt/7TI8jq5AOOzI/ll4zbL24Eo84Rz+TP9tvMMhDZ0VaMN22AJ8qQEjc5P09tWKsX7Jg39XelyV1jHXncE4yvIE9F4RSCHzWCeKeXakizQNuzSaxTxIExRFYHjNW5bR6+3MTGwVrEIXU+qML+0yFTR86MT+tdY5AreAJQLwbog79O1NupeXJE= anish@curve" ];
};
security.sudo.wheelNeedsPassword = false; # needed for deploy-rs
services.openssh.enable = true;
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. Its perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "22.11"; # Did you read the comment?
}
endmsg
# sudo nixos-install