[disko] rm duplicate filesystems entry

Merge branch 'master' into issue31
[malovpn] add hetzner
2025-02-05 14:31:39 +01:00 · 2025-02-05 14:25:57 +01:00 · 2025-01-28 14:56:09 +01:00 · 2025-01-24 23:19:52 +01:00 · 2025-01-24 18:56:20 +01:00 · 2025-01-24 18:42:31 +01:00
9 changed files with 216 additions and 252 deletions
--- a/machines/bakunin/configuration.nix
+++ b/machines/bakunin/configuration.nix
@@ -26,6 +26,7 @@ in

  malobeo.disks = {
    enable = true;
+    legacy = true;
    hostId = "a3c3102f";
    root = {
      disk0 = "disk/by-id/ata-HITACHI_HTS725016A9A364_110308PCKB04VNHX9XTJ";
@@ -33,9 +34,7 @@ in
  };

  malobeo.initssh = {
-    enable = true;
-    authorizedKeys = sshKeys.admins;
-    ethernetDrivers = ["r8169"];
+    enable = false;
  };

  hardware.sane.enable = true; #scanner support
--- a/machines/fanny/configuration.nix
+++ b/machines/fanny/configuration.nix
@@ -51,6 +51,7 @@ in
      disk0 = "disk/by-id/ata-SAMSUNG_MZ7LN256HCHP-000L7_S20HNAAH200381";
    };
    storage = {
+      enable = true;
      disks = ["disk/by-id/wwn-0x50014ee265b53b60" "disk/by-id/wwn-0x50014ee2bb0a194a"];
      mirror = true;
    };
--- a/machines/modules/disko/btrfs-laptop.nix
+++ b/machines/modules/disko/btrfs-laptop.nix
@@ -1,63 +0,0 @@
-{ config, self, inputs, ... }:
-
-{
-  imports = [
-    inputs.disko.nixosModules.disko
-  ];
-
-  # https://github.com/nix-community/disko/blob/master/example/luks-btrfs-subvolumes.nix
-  disko.devices = {
-    disk = {
-      main = {
-        type = "disk";
-        # When using disko-install, we will overwrite this value from the commandline
-        device = "/dev/disk/by-id/some-disk-id";
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "512M";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "umask=0077" ];
-              };
-            };
-            luks = {
-              size = "100%";
-              content = {
-                type = "luks";
-                name = "crypted";
-                passwordFile = /tmp/secret.key; # Interactive
-                content = {
-                  type = "btrfs";
-                  extraArgs = [ "-f" ];
-                  subvolumes = {
-                    "/root" = {
-                      mountpoint = "/";
-                      mountOptions = [ "compress=zstd" "noatime" ];
-                    };
-                    "/home" = {
-                      mountpoint = "/home";
-                      mountOptions = [ "compress=zstd" "noatime" ];
-                    };
-                    "/nix" = {
-                      mountpoint = "/nix";
-                      mountOptions = [ "compress=zstd" "noatime" ];
-                    };
-                    "/swap" = {
-                      mountpoint = "/.swapvol";
-                      swap.swapfile.size = "20M";
-                    };
-                  };
-                };
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-}
--- a/machines/modules/disko/default.nix
+++ b/machines/modules/disko/default.nix
@@ -20,6 +20,11 @@ in
      default = true;
      description = "Allows encryption to be disabled for testing";
    };
+    legacy = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Enable legacy boot (bios)";
+    };
    devNodes = lib.mkOption {
      type = lib.types.str;
      default = "/dev/disk/by-id/";
@@ -81,198 +86,220 @@ in
    };
  };

-  config = lib.mkIf cfg.enable {
-    networking.hostId = cfg.hostId;
-    disko.devices = {
-      disk = lib.mkMerge [
-        {
-          ssd0 = lib.mkIf (cfg.root.disk0 != "") {
-            type = "disk";
-            device = "/dev/${cfg.root.disk0}";
-            content = {
-              type = "gpt";
-              partitions = {
-                ESP = {
-                  size = "1024M";
-                  type = "EF00";
-                  content = {
-                    type = "filesystem";
-                    format = "vfat";
-                    mountpoint = "/boot";
-                    mountOptions = [ "umask=0077" ];
+  config = lib.mkMerge [
+    (lib.mkIf (cfg.enable && !cfg.legacy) {
+      boot = {
+        loader.systemd-boot.enable = true;
+        loader.efi.canTouchEfiVariables = true;
+        supportedFilesystems = [ "vfat" "zfs" ];
+      };
+      fileSystems."/boot".neededForBoot = true;
+    })
+    (lib.mkIf (cfg.enable && cfg.legacy) {
+      boot.loader.grub = {
+        enable = lib.mkForce true;
+        device = "/dev/${cfg.root.disk0}-part1";
+        efiSupport = false;
+        enableCryptodisk = cfg.encryption;
+        zfsSupport = true;
+      };
+    })
+    (lib.mkIf cfg.enable {
+      networking.hostId = cfg.hostId;
+      disko.devices = {
+        disk = lib.mkMerge [
+          {
+            ssd0 = lib.mkIf (cfg.root.disk0 != "") {
+              type = "disk";
+              device = "/dev/${cfg.root.disk0}";
+              content = {
+                type = "gpt";
+                partitions = {
+                  ESP = lib.mkIf (!cfg.legacy) {
+                    size = "1024M";
+                    type = "EF00";
+                    content = {
+                      type = "filesystem";
+                      format = "vfat";
+                      mountpoint = "/boot";
+                      mountOptions = [ "umask=0077" ];
+                    };
                  };
-                };
-                encryptedSwap = {
-                  size = cfg.root.swap;
-                  content =  {
-                    type = "swap";
-                    randomEncryption = true;
+                  boot = lib.mkIf cfg.legacy {
+                    size = "1024M";
+                    type = "EF02";
                  };
-                };
-                zfs = {
-                  size = "100%";
-                  content = {
-                    type = "zfs";
-                    pool = "zroot";
+                  encryptedSwap = {
+                    size = cfg.root.swap;
+                    content =  {
+                      type = "swap";
+                      randomEncryption = true;
+                    };
                  };
-                };
-              };
-            };
-          };
-          ssd1 = lib.mkIf (cfg.root.disk1 != "") {
-            type = "disk";
-            device = "/dev/${cfg.root.disk1}";
-            content = {
-              type = "gpt";
-              partitions = {
-                zfs = {
-                  size = "100%";
-                  content = {
-                    type = "zfs";
-                    pool = "zroot";
-                  };
-                };
-              };
-            };
-          };
-        }
-        (lib.mkIf cfg.storage.enable (
-          lib.mkMerge (
-            map (diskname: {
-              "${diskname}" = {
-                type = "disk";
-                device = "/dev/${diskname}";
-                content = {
-                  type = "gpt";
-                  partitions = {
-                    zfs = {
-                      size = "100%";
-                      content = {
-                        type = "zfs";
-                        pool = "storage";
-                      };
+                  zfs = {
+                    size = "100%";
+                    content = {
+                      type = "zfs";
+                      pool = "zroot";
                    };
                  };
                };
              };
-            }) cfg.storage.disks
-          )
-        ))
-      ];
+            };
+            ssd1 = lib.mkIf (cfg.root.disk1 != "") {
+              type = "disk";
+              device = "/dev/${cfg.root.disk1}";
+              content = {
+                type = "gpt";
+                partitions = {
+                  zfs = {
+                    size = "100%";
+                    content = {
+                      type = "zfs";
+                      pool = "zroot";
+                    };
+                  };
+                };
+              };
+            };
+          }
+          (lib.mkIf cfg.storage.enable (
+            lib.mkMerge (
+              map (diskname: {
+                "${diskname}" = {
+                  type = "disk";
+                  device = "/dev/${diskname}";
+                  content = {
+                    type = "gpt";
+                    partitions = {
+                      zfs = {
+                        size = "100%";
+                        content = {
+                          type = "zfs";
+                          pool = "storage";
+                        };
+                      };
+                    };
+                  };
+                };
+              }) cfg.storage.disks
+            )
+          ))
+        ];

-      zpool = {
-        zroot = {
-          type = "zpool";
-          mode = lib.mkIf cfg.root.mirror "mirror";
-          # Workaround: cannot import 'zroot': I/O error in disko tests
-          options.cachefile = "none";
-          rootFsOptions = {
-            mountpoint = "none";
-            xattr = "sa";         # für microvm virtiofs mount
-            acltype = "posixacl"; # für microvm virtiofs mount 
-            compression = "zstd";
-            "com.sun:auto-snapshot" = "false";
+        zpool = {
+          zroot = {
+            type = "zpool";
+            mode = lib.mkIf cfg.root.mirror "mirror";
+            # Workaround: cannot import 'zroot': I/O error in disko tests
+            options.cachefile = "none";
+            rootFsOptions = {
+              mountpoint = "none";
+              xattr = "sa";         # für microvm virtiofs mount
+              acltype = "posixacl"; # für microvm virtiofs mount 
+              compression = "zstd";
+              "com.sun:auto-snapshot" = "false";
+            };
+
+            datasets = {
+              encrypted = {
+                type = "zfs_fs";
+                options = {
+                  mountpoint = "none";
+                  encryption = lib.mkIf cfg.encryption "aes-256-gcm";
+                  keyformat = lib.mkIf cfg.encryption "passphrase";
+                  keylocation = lib.mkIf cfg.encryption "file:///tmp/secret.key";
+                };
+                # use this to read the key during boot
+                postCreateHook = lib.mkIf cfg.encryption ''
+                  zfs set keylocation="prompt" zroot/encrypted;
+                '';
+              };
+              "encrypted/root" = {
+                type = "zfs_fs";
+                mountpoint = "/";
+                options.mountpoint = "legacy";
+              };
+              "encrypted/var" = {
+                type = "zfs_fs";
+                mountpoint = "/var";
+                options.mountpoint = "legacy";
+              };
+              "encrypted/etc" = {
+                type = "zfs_fs";
+                mountpoint = "/etc";
+                options.mountpoint = "legacy";
+              };
+              "encrypted/home" = {
+                type = "zfs_fs";
+                mountpoint = "/home";
+                options.mountpoint = "legacy";
+              };
+              "encrypted/nix" = {
+                type = "zfs_fs";
+                mountpoint = "/nix";
+                options.mountpoint = "legacy";
+              };
+              reserved = {
+                # for cow delete if pool is full
+                options = {
+                  canmount = "off";
+                  mountpoint = "none";
+                  reservation = "${cfg.root.reservation}";
+                };
+                type = "zfs_fs";
+              };
+            };
          };

-          datasets = {
-            encrypted = {
-              type = "zfs_fs";
-              options = {
-                mountpoint = "none";
-                encryption = lib.mkIf cfg.encryption "aes-256-gcm";
-                keyformat = lib.mkIf cfg.encryption "passphrase";
-                keylocation = lib.mkIf cfg.encryption "file:///tmp/secret.key";
+          storage = lib.mkIf cfg.storage.enable {
+            type = "zpool";
+            mode = lib.mkIf (cfg.storage.mirror) "mirror";
+            rootFsOptions = { 
+              mountpoint = "none";
+              xattr = "sa";         # für microvm virtiofs mount
+              acltype = "posixacl"; # für microvm virtiofs mount 
+            };
+            datasets = {
+              encrypted = {
+                type = "zfs_fs";
+                options = {
+                  mountpoint = "none";
+                  encryption = lib.mkIf cfg.encryption "aes-256-gcm";
+                  keyformat = lib.mkIf cfg.encryption "passphrase";
+                  keylocation = lib.mkIf cfg.encryption "file:///tmp/secret.key";
+                };
+                # use this to read the key during boot
+                postCreateHook = lib.mkIf cfg.encryption ''
+                  zfs set keylocation="file:///root/secret.key" storage/encrypted;
+                '';
              };
-              # use this to read the key during boot
-              postCreateHook = lib.mkIf cfg.encryption ''
-                zfs set keylocation="prompt" zroot/encrypted;
-              '';
-            };
-            "encrypted/root" = {
-              type = "zfs_fs";
-              mountpoint = "/";
-              options.mountpoint = "legacy";
-            };
-            "encrypted/var" = {
-              type = "zfs_fs";
-              mountpoint = "/var";
-              options.mountpoint = "legacy";
-            };
-            "encrypted/etc" = {
-              type = "zfs_fs";
-              mountpoint = "/etc";
-              options.mountpoint = "legacy";
-            };
-            "encrypted/home" = {
-              type = "zfs_fs";
-              mountpoint = "/home";
-              options.mountpoint = "legacy";
-            };
-            "encrypted/nix" = {
-              type = "zfs_fs";
-              mountpoint = "/nix";
-              options.mountpoint = "legacy";
-            };
-            reserved = {
-              # for cow delete if pool is full
-              options = {
-                canmount = "off";
-                mountpoint = "none";
-                reservation = "${cfg.root.reservation}";
+              "encrypted/data" = {
+                type = "zfs_fs";
+                mountpoint = "/data";
              };
-              type = "zfs_fs";
-            };
-          };
-        };
-
-        storage = lib.mkIf cfg.storage.enable {
-          type = "zpool";
-          mode = lib.mkIf (cfg.storage.mirror) "mirror";
-          rootFsOptions = { 
-            mountpoint = "none";
-            xattr = "sa";         # für microvm virtiofs mount
-            acltype = "posixacl"; # für microvm virtiofs mount 
-          };
-          datasets = {
-            encrypted = {
-              type = "zfs_fs";
-              options = {
-                mountpoint = "none";
-                encryption = lib.mkIf cfg.encryption "aes-256-gcm";
-                keyformat = lib.mkIf cfg.encryption "passphrase";
-                keylocation = lib.mkIf cfg.encryption "file:///tmp/secret.key";
+              reserved = {
+                # for cow delete if pool is full
+                options = {
+                  canmount = "off";
+                  mountpoint = "none";
+                  reservation = "${cfg.storage.reservation}";
+                };
+                type = "zfs_fs";
              };
-              # use this to read the key during boot
-              postCreateHook = lib.mkIf cfg.encryption ''
-                zfs set keylocation="prompt" storage/encrypted;
-              '';
-            };
-            "encrypted/data" = {
-              type = "zfs_fs";
-              mountpoint = "/data";
-              options.mountpoint = "legacy";
-            };
-            reserved = {
-              # for cow delete if pool is full
-              options = {
-                canmount = "off";
-                mountpoint = "none";
-                reservation = "${cfg.storage.reservation}";
-              };
-              type = "zfs_fs";
            };
          };
        };
      };
-    };

-    boot.zfs.devNodes = lib.mkDefault cfg.devNodes;
+      boot.zfs.devNodes = lib.mkDefault cfg.devNodes;
+      boot.zfs.extraPools = lib.mkIf cfg.storage.enable [ "storage" ];

-    fileSystems."/".neededForBoot = true;
-    fileSystems."/etc".neededForBoot = true;
-    fileSystems."/boot".neededForBoot = true;
-    fileSystems."/var".neededForBoot = true;
-    fileSystems."/home".neededForBoot = true;
-    fileSystems."/nix".neededForBoot = true;
-  };
+      fileSystems."/".neededForBoot = true;
+      fileSystems."/etc".neededForBoot = true;
+      fileSystems."/var".neededForBoot = true;
+      fileSystems."/home".neededForBoot = true;
+      fileSystems."/nix".neededForBoot = true;
+    })
+  ];
 }
--- a/machines/modules/malobeo/initssh.nix
+++ b/machines/modules/malobeo/initssh.nix
@@ -26,13 +26,8 @@ in
  
  config = lib.mkIf (cfg.enable && config.malobeo.disks.encryption) {
    boot = {
-      loader.systemd-boot.enable = true;
-      loader.efi.canTouchEfiVariables = true;
-      supportedFilesystems = [ "vfat" "zfs" ];
      zfs = {
-        forceImportAll = true;
        requestEncryptionCredentials = true;
-        
      };
      initrd = {
        availableKernelModules = cfg.ethernetDrivers;
--- a/machines/modules/malobeo/peers.nix
+++ b/machines/modules/malobeo/peers.nix
@@ -30,6 +30,13 @@
    publicKey = "TrJ4UAF//zXdaLwZudI78L+rTC36zEDodTDOWNS4Y1Y=";
  };

+  "hetzner" = {
+    role = "client";
+    address = [ "10.100.0.6/24" ];
+    allowedIPs = [ "10.100.0.6/32" ];
+    publicKey = "csRzgwtnzmSLeLkSwTwEOrdKq55UOxZacR5D3GopCTQ=";
+  };
+
  "fanny" = {
    role = "client";
    address = [ "10.100.0.101/24" ];
--- a/machines/testvm/configuration.nix
+++ b/machines/testvm/configuration.nix
@@ -24,7 +24,7 @@ in

  malobeo.disks = {
    enable = true;
-    encryption = false;
+    encryption = true;
    hostId = "83abc8cb";
    devNodes = "/dev/disk/by-path/";
    root = {
--- a/scripts/remote-install-encrypt.sh
+++ b/scripts/remote-install-encrypt.sh
@@ -37,9 +37,11 @@ trap cleanup EXIT

 # Create the directory where sshd expects to find the host keys
 install -d -m755 "$temp/etc/ssh/"
+install -d -m755 "$temp/root/"

 diskKey=$(sops -d machines/$hostname/disk.key)
 echo "$diskKey" > /tmp/secret.key
+echo "$diskKey" > $temp/root/secret.key

 ssh-keygen -f $temp/etc/ssh/"$hostname" -t ed25519 -N ""
 ssh-keygen -f $temp/etc/ssh/initrd -t ed25519 -N ""
--- a/scripts/unlock-boot.sh
+++ b/scripts/unlock-boot.sh
@@ -23,18 +23,14 @@ echo
 if [ $# = 1 ]
    then
    diskkey=$(sops -d machines/$HOSTNAME/disk.key)
-    echo "$diskkey" | ssh $sshoptions root@$HOSTNAME-initrd "systemd-tty-ask-password-agent" #storage
-
    echo "$diskkey" | ssh $sshoptions root@$HOSTNAME-initrd "systemd-tty-ask-password-agent" #root

 elif [ $# = 2 ]
    then
    diskkey=$(sops -d machines/$HOSTNAME/disk.key)
    IP=$2
-    echo "$diskkey" | ssh $sshoptions root@$IP "systemd-tty-ask-password-agent" #storage
-
    echo "$diskkey" | ssh $sshoptions root@$IP "systemd-tty-ask-password-agent" #root
-
+    
 else
    echo
    echo "Unlock the root disk on a remote host."
Author	SHA1	Message	Date
kalipso	2f4cb3787b	[disko] rm duplicate filesystems entry All checks were successful Check flake syntax / flake-check (push) Successful in 4m16s Details	2025-02-05 14:31:39 +01:00
kalipso	4f9e66ba82	Merge branch 'master' into issue31 Some checks failed Check flake syntax / flake-check (push) Failing after 2m0s Details	2025-02-05 14:25:57 +01:00
kalipso	1f9d39b53d	[malovpn] add hetzner All checks were successful Check flake syntax / flake-check (push) Successful in 4m39s Details	2025-01-28 14:56:09 +01:00
ahtlon	362d9cf488	[fanny] enable storage creation with disko All checks were successful Check flake syntax / flake-check (push) Successful in 4m27s Details	2025-01-24 23:19:52 +01:00
ahtlon	e22c895cf7	Merge branch 'issue47' All checks were successful Check flake syntax / flake-check (push) Successful in 4m33s Details Fixes #47	2025-01-24 18:56:20 +01:00
ahtlon	a07bec0472	[scripts] only need to unlock once All checks were successful Check flake syntax / flake-check (push) Successful in 4m18s Details	2025-01-24 18:42:31 +01:00
ahtlon	4a67683462	[disko] Bit of a hack but the storage partition now gets mounted after zroot using a file on the disk. All checks were successful Check flake syntax / flake-check (push) Successful in 4m17s Details	2025-01-24 18:30:51 +01:00
ahtlon	fb222bc1a4	[disko] rm btrfs-laptop.nix	2025-01-24 15:08:24 +01:00
ahtlon	c51c1e8e92	Merge master All checks were successful Check flake syntax / flake-check (push) Successful in 6m6s Details	2025-01-19 18:00:27 +01:00
ahtlon	a96b8f65c9	[disko]Force grub on legacy boot Some checks failed Check flake syntax / flake-check (push) Waiting to run Details Evaluate Hydra Jobs / eval-hydra-jobs (push) Has been cancelled Details Evaluate Hydra Jobs / eval-hydra-jobs (pull_request) Has been cancelled Details Check flake syntax / flake-check (pull_request) Has been cancelled Details	2025-01-19 17:59:29 +01:00
Ahtlon	29d6bc02e0	Merge branch 'master' into issue31 Some checks failed Evaluate Hydra Jobs / eval-hydra-jobs (pull_request) Successful in 3m41s Details Evaluate Hydra Jobs / eval-hydra-jobs (push) Successful in 3m46s Details Check flake syntax / flake-check (pull_request) Failing after 2m20s Details Check flake syntax / flake-check (push) Failing after 2m15s Details	2025-01-18 22:57:21 +01:00
ahtlon	c0cef1ff1e	Apply legacy to bakunin Some checks failed Evaluate Hydra Jobs / eval-hydra-jobs (push) Has been cancelled Details Evaluate Hydra Jobs / eval-hydra-jobs (pull_request) Successful in 5m14s Details	2025-01-18 21:33:41 +01:00
ahtlon	7099c92236	[disko] add legacy option I don't know if the grub device is right	2025-01-18 21:33:23 +01:00