actual content

This commit is contained in:
Eric Litak 2016-03-13 22:09:30 -07:00
parent 4d7077a1f9
commit cd744c716f

159
nixos-infect Normal file → Executable file
View file

@ -1 +1,160 @@
#! /usr/bin/env bash #! /usr/bin/env bash
set -ex
makeConf() {
# XXX NB remember to escape / $ ` in heredocs!
# TODO use appended archive or some curl-able tarball?
mkdir -p /etc/nixos/shared
cat > /etc/nixos/networking.nix <<EOF
# This file will be populated at runtime with the
# networking details gathered from the active system.
{...}:{}
EOF
cat > /etc/nixos/configuration.nix <<EOF
{ config, pkgs, ... }: {
imports = [
./hardware-configuration.nix
./networking.nix
#./shared/essentials.nix
#./shared/user-settings.nix
];
networking.hostName = "$(hostname)";
time.timeZone = "America/Los_Angeles";
boot.cleanTmpDir = true;
services.openssh.enable = true;
services.tlsdated.enable = true;
#services.tlsdated.extraOptions = ""; # BUG fixed in unstable
networking.firewall.allowPing = true;
}
EOF
# (nixos-generate-config will add qemu-user and bind-mounts, so avoid)
cat > /etc/nixos/hardware-configuration.nix <<EOF
{ config, lib, pkgs, ... }: {
imports = [ <nixpkgs/nixos/modules/profiles/qemu-guest.nix> ];
boot.loader.grub.devices = [ "/dev/vda" ];
fileSystems."/" = { device = "/dev/vda1"; fsType = "ext4"; };
}
EOF
#! /usr/bin/env bash
# NB put your semi-sensitive (not posted to github) configuration in a separate
# file and include it via this customConfig() function. e.g.:
# customConfig() {
# cat > /etc/nixos/custom.nix << EOF
# { config, lib, pkgs, ... }: {
# }
# EOF
# }
#
# then you can add the files in configuration.nix's imports above and run something like:
# cat customConfig nixos-infect | root@targethost bash
if [[ `type -t customConfig` == "function" ]]; then customConfig; fi
}
makeSwap() {
if [[ ! -e /swap ]]; then
dd if=/dev/zero of=/swap bs=1M count=$((1024*2))
chmod 0600 /swap
mkswap /swap
swapon /swap
fi
}
bindSubs() {
for dir in dev proc run sys; do
mkdir $1/$dir
mount -R {,$1}/$dir
done
}
makeConf
makeSwap
apt-get install -y curl sudo rsync
groupadd -r nixbld
seq 1 10 | xargs -I{} useradd -c "Nix build user {}" -d /var/empty -g nixbld -G nixbld -M -N -r -s `which nologin` nixbld{}
# XXX force version 1.10 because 1.11 insists on nixexprs.tar.xz which is unavailable for older releases
#curl https://nixos.org/nix/install | sed -r 's|nix-([0-9.]+)|nix-1.10|g' | sh
curl https://nixos.org/nix/install | sh
source ~/.nix-profile/etc/profile.d/nix.sh
nix-channel --add https://nixos.org/channels/nixos-unstable nixos
nix-channel --update
# XXX BUG encountered in latest unstable (no permission /bin/bash nonsense)
#nix-channel --add https://nixos.org/channels/nixos-15.09 nixpkgs
#nix-channel --update
newRootImg=`mktemp`
newRootMount=`mktemp -d`
oldRootMount=`mktemp -d`
export NIXOS_CONFIG=/etc/nixos/configuration.nix
nix-env -i -f /nix/var/nix/profiles/per-user/root/channels/nixpkgs/nixos \
-A config.system.build.nixos-install \
-A config.system.build.nixos-option \
-A config.system.build.nixos-generate-config
dd if=/dev/zero of=$newRootImg bs=1M count=$((1024*2))
mkfs.ext4 $newRootImg
mount $newRootImg $newRootMount
rsync -aR /./etc/nixos $newRootMount
nixos-install --root $newRootMount
swapoff /swap || true
mount -B / $oldRootMount
# XXX bindmount causes /bin/bash permission BUG on many versions (nix 1.10-1.11, nixpkgs 15-16), so just use loopback img for now
#mount -B $newRoot $newRootMount
#bindSubs $newRootMount
rsync -a --delete --exclude=$(dirname $newRootMount) $newRootMount/ $oldRootMount
# restore access to commands (not sure whih of these 3 are essential, nor if order matters XXX)
export PATH=/nix/var/nix/profiles/system/sw/bin:/nix/var/nix/profiles/system/sw/sbin
/nix/var/nix/profiles/system/activate
source /nix/var/nix/profiles/system/etc/profile
# XXX temporary fix for name resolution
echo nameserver 8.8.4.4 > /etc/resolv.conf
ip4s=$(ip address show dev eth0 | grep 'inet ' | sed -r 's|.*inet ([0-9.]+)/([0-9]+).*|{ address="\1"; prefixLength=\2; }|')
ip6s=$(ip address show dev eth0 | grep 'inet6 .*global' | sed -r 's|.*inet6 ([0-9a-f:]+)/([0-9]+).*|{ address="\1"; prefixLength=\2; }|')
gateway=$(ip route show dev eth0 | grep default | sed -r 's|default via ([0-9.]+).*|\1|')
gateway6=$(ip -6 route show dev eth0 | grep default | sed -r 's|default via ([0-9a-f:]+).*|\1|')
ether0=$(ip address show dev eth0 | grep link/ether | sed -r 's|.*link/ether ([0-9a-f:]+) .*|\1|')
ether1=$(ip address show dev eth1 | grep link/ether | sed -r 's|.*link/ether ([0-9a-f:]+) .*|\1|')
cat > /etc/nixos/networking.nix <<EOF
{ config, pkgs, ... }: {
networking = {
nameservers = [ "8.8.4.4" ];
defaultGateway = "$gateway";
defaultGateway6 = "$gateway6";
interfaces = {
eth0 = {
ip4 = [ $ip4s ];
ip6 = [ $ip6s ];
};
eth1.useDHCP = false;
};
};
services.udev.extraRules = ''
KERNEL=="eth*", ATTR{address}=="$ether0", NAME="eth0"
KERNEL=="eth*", ATTR{address}=="$ether1", NAME="eth1"
'';
}
EOF
# grub/initrd was probably installed incorrectly (using false root device), so we need a final rebuild
nixos-rebuild boot --install-grub
sync
reboot -f
#echo s > /proc/sysrq-trigger # sync
#echo b > /proc/sysrq-trigger # reboot -f better if i fix PATH?