mostly docs

This commit is contained in:
Eric Litak 2016-03-14 02:59:18 -07:00
parent 8a76425fbe
commit c769beaddf

View file

@ -1,56 +1,83 @@
#! /usr/bin/env bash #! /usr/bin/env bash
set -e
# WARNING NB This script wipes out the targeted host's root filesystem when it
# runs to completion. Any errors halt execution. set -x is used to help debug,
# as often a failed run leaves the system in an inconsistent state, requiring a
# rebuild (in DigitalOcean panel: Droplet Settings -> "Destroy" -> "Rebuild
# from original").
#
# TO USE:
# - Add any custom config you want (see notes below)
# - Deploy a Debian 8.3 x64 droplet (enable ipv6; add your ssh key)
# - cat customConfig.optional nixos-infect | ssh root@targethost bash
#
# This was last tested with the DigitalOcean Debian 8.3 x64 image. Different
# versions as well as the Ubuntu images should work as well, but then, there's
# not much point in selecting something different if you intend to wipe out the
# fs as this does. You may need to make minor modifications to use in other
# templates, but basically all that will ever need tweaking should be:
# /etc/nixos/{,hardware-}configuration.nix, inline in this file
# /etc/nixso/networking.nix, generated at runtime (no ipv6? different number of adapters?)
#
# Motivation: nixos-assimilate should supplant this script entirely, if it's
# ever completed. nixos-in-place was quite broken when I tried it, and also
# took a pretty janky approach that was substantially more complex than this
# (although it supported more platforms): it didn't install to root (/nixos
# instead), left dregs of the old filesystem (almost always unnecessary since
# starting from a fresh deployment), and most importantly, simply didn't work for
# me! (old system was being because grub wasnt properly reinstalled)
set -ex
makeConf() { makeConf() {
# XXX NB remember to escape / $ ` in heredocs! # NB remember to escape / $ ` in heredocs!
# TODO use appended archive or some curl-able tarball? # TODO use appended archive or some curl-able tarball?
mkdir -p /etc/nixos/shared mkdir -p /etc/nixos
cat > /etc/nixos/networking.nix <<EOF cat > /etc/nixos/networking.nix << EOF
# This file will be populated at runtime with the # This file will be populated at runtime with the
# networking details gathered from the active system. # networking details gathered from the active system.
{...}:{} {...}:{}
EOF EOF
cat > /etc/nixos/configuration.nix <<EOF cat > /etc/nixos/configuration.nix << EOF
{ config, pkgs, ... }: { { config, pkgs, ... }: {
imports = [ imports = [
./hardware-configuration.nix ./hardware-configuration.nix
./networking.nix ./networking.nix
#./shared/essentials.nix
#./shared/user-settings.nix
]; ];
networking.hostName = "$(hostname)";
time.timeZone = "America/Los_Angeles"; time.timeZone = "America/Los_Angeles";
boot.cleanTmpDir = true; boot.cleanTmpDir = true;
services.openssh.enable = true;
services.tlsdated.enable = true; services.tlsdated.enable = true;
#services.tlsdated.extraOptions = ""; # BUG fixed in unstable services.openssh.enable = true;
networking.firewall.allowPing = true; networking.firewall.allowPing = true;
networking.hostName = "$(hostname)";
users.users.root.openssh.authorizedKeys.keys = [ ''
$(cat /root/.ssh/authorized_keys | head -n1)
'' ];
} }
EOF EOF
# (nixos-generate-config will add qemu-user and bind-mounts, so avoid) # (nixos-generate-config will add qemu-user and bind-mounts, so avoid)
cat > /etc/nixos/hardware-configuration.nix <<EOF cat > /etc/nixos/hardware-configuration.nix << EOF
{ config, lib, pkgs, ... }: { { config, lib, pkgs, ... }: {
imports = [ <nixpkgs/nixos/modules/profiles/qemu-guest.nix> ]; imports = [ <nixpkgs/nixos/modules/profiles/qemu-guest.nix> ];
boot.loader.grub.devices = [ "/dev/vda" ]; boot.loader.grub.devices = [ "/dev/vda" ];
fileSystems."/" = { device = "/dev/vda1"; fsType = "ext4"; }; fileSystems."/" = { device = "/dev/vda1"; fsType = "ext4"; };
} }
EOF EOF
#! /usr/bin/env bash #! /usr/bin/env bash
# NB put your semi-sensitive (not posted to github) configuration in a separate # NB put your semi-sensitive (not posted to github) configuration in a separate
# file and include it via this customConfig() function. e.g.: # file and include it via this customConfig() function. e.g.:
# customConfig() { # customConfig() {
# cat > /etc/nixos/custom.nix << EOF # cat > /etc/nixos/custom.nix << EOF
# { config, lib, pkgs, ... }: { # { config, lib, pkgs, ... }: {
# } # }
# EOF # EOF
# } # }
# #
# then you can add the files in configuration.nix's imports above and run something like: # then you can add the files in configuration.nix's imports above and run something like:
# cat customConfig nixos-infect | root@targethost bash # cat customConfig nixos-infect | root@targethost bash
if [[ `type -t customConfig` == "function" ]]; then customConfig; fi if [[ `type -t customConfig` == "function" ]]; then customConfig; fi
} }
makeSwap() { makeSwap() {
@ -63,7 +90,7 @@ makeSwap() {
} }
makeConf makeConf
makeSwap # TODO check if actually needed? seem to recall smallest size would die. makeSwap # smallest (512MB) droplet needs extra memory!
apt-get install -y curl sudo rsync apt-get install -y curl sudo rsync
@ -100,8 +127,7 @@ swapoff /swap
mount -B / $oldRootMount mount -B / $oldRootMount
rsync -a --delete --exclude=$(dirname $newRootMount) $newRootMount/ $oldRootMount rsync -a --delete --exclude=$(dirname $newRootMount) $newRootMount/ $oldRootMount
# restore access to commands (TODO not sure whih of these 3 are essential, nor if order matters XXX) # restore access to commands
export PATH=/nix/var/nix/profiles/system/sw/bin:/nix/var/nix/profiles/system/sw/sbin
/nix/var/nix/profiles/system/activate /nix/var/nix/profiles/system/activate
source /nix/var/nix/profiles/system/etc/profile source /nix/var/nix/profiles/system/etc/profile
@ -115,7 +141,7 @@ gateway6=$(ip -6 route show dev eth0 | grep default | sed -r 's|default via ([0-
ether0=$(ip address show dev eth0 | grep link/ether | sed -r 's|.*link/ether ([0-9a-f:]+) .*|\1|') ether0=$(ip address show dev eth0 | grep link/ether | sed -r 's|.*link/ether ([0-9a-f:]+) .*|\1|')
ether1=$(ip address show dev eth1 | grep link/ether | sed -r 's|.*link/ether ([0-9a-f:]+) .*|\1|') ether1=$(ip address show dev eth1 | grep link/ether | sed -r 's|.*link/ether ([0-9a-f:]+) .*|\1|')
cat > /etc/nixos/networking.nix <<EOF cat > /etc/nixos/networking.nix << EOF
{ config, pkgs, ... }: { { config, pkgs, ... }: {
networking = { networking = {
nameservers = [ "8.8.4.4" ]; nameservers = [ "8.8.4.4" ];
@ -129,7 +155,7 @@ cat > /etc/nixos/networking.nix <<EOF
eth1.useDHCP = false; eth1.useDHCP = false;
}; };
}; };
services.udev.extraRules = '' services.udev.extraRules = ''
KERNEL=="eth*", ATTR{address}=="$ether0", NAME="eth0" KERNEL=="eth*", ATTR{address}=="$ether0", NAME="eth0"
KERNEL=="eth*", ATTR{address}=="$ether1", NAME="eth1" KERNEL=="eth*", ATTR{address}=="$ether1", NAME="eth1"
''; '';
@ -140,4 +166,5 @@ EOF
nixos-rebuild boot --install-grub nixos-rebuild boot --install-grub
sync sync
echo "You may now Ctrl-C or otherwise terminate this process."
reboot -f reboot -f