mirror of
https://github.com/Swarsel/.dotfiles.git
synced 2026-04-14 05:09:09 +02:00
chore: change to native nix scripts
This commit is contained in:
Leon Schwarzäugl
parent
80c08a6d19
commit
7ad9d84109
GPG key ID:
26A54C31F2A4FD84
42 changed files with 2071 additions and 2102 deletions
2010
SwarselSystems.org
2010
SwarselSystems.org
File diff suppressed because it is too large
Load diff
|
|
@ -1851,7 +1851,7 @@ create a new one."
|
||||||
(
|
(
|
||||||
(,""
|
(,""
|
||||||
,swarsel-domain
|
,swarsel-domain
|
||||||
,(concat "Browse " main-domain)
|
,(concat "Browse " swarsel-domain)
|
||||||
(lambda (&rest _) (browse-url ,(concat "https://" swarsel-domain))))
|
(lambda (&rest _) (browse-url ,(concat "https://" swarsel-domain))))
|
||||||
)
|
)
|
||||||
))))
|
))))
|
||||||
|
|
|
||||||
|
|
@ -1,33 +0,0 @@
|
||||||
# Adapted from https://github.com/bennofs/nix-index/blob/master/command-not-found.sh
|
|
||||||
command_not_found_handle() {
|
|
||||||
if [ -n "${MC_SID-}" ] || ! [ -t 1 ]; then
|
|
||||||
>&2 echo "$1: command not found"
|
|
||||||
return 127
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo -n "searching nix-index..."
|
|
||||||
ATTRS=$(@nix-locate@ --minimal --no-group --type x --type s --whole-name --at-root "/bin/$1")
|
|
||||||
|
|
||||||
case $(echo -n "$ATTRS" | grep -c "^") in
|
|
||||||
0)
|
|
||||||
>&2 echo -ne "$(@tput@ el1)\r"
|
|
||||||
>&2 echo "$1: command not found"
|
|
||||||
;;
|
|
||||||
*)
|
|
||||||
>&2 echo -ne "$(@tput@ el1)\r"
|
|
||||||
>&2 echo "The program ‘$(@tput@ setaf 4)$1$(@tput@ sgr0)’ is currently not installed."
|
|
||||||
>&2 echo "It is provided by the following derivation(s):"
|
|
||||||
while read -r ATTR; do
|
|
||||||
ATTR=${ATTR%.out}
|
|
||||||
>&2 echo " $(@tput@ setaf 12)nixpkgs#$(@tput@ setaf 4)$ATTR$(@tput@ sgr0)"
|
|
||||||
done <<< "$ATTRS"
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
|
|
||||||
return 127
|
|
||||||
}
|
|
||||||
|
|
||||||
command_not_found_handler() {
|
|
||||||
command_not_found_handle "$@"
|
|
||||||
return $?
|
|
||||||
}
|
|
||||||
|
|
@ -1,23 +0,0 @@
|
||||||
wait=0
|
|
||||||
while :; do
|
|
||||||
case ${1:-} in
|
|
||||||
-w | --wait)
|
|
||||||
wait=1
|
|
||||||
;;
|
|
||||||
*) break ;;
|
|
||||||
esac
|
|
||||||
shift
|
|
||||||
done
|
|
||||||
|
|
||||||
STR=$(swaymsg -t get_tree | jq -r 'recurse(.nodes[]) | select(.name == "__i3_scratch")' | grep kittyterm || true)
|
|
||||||
if [ "$STR" == "" ]; then
|
|
||||||
swaymsg '[title="kittyterm"]' scratchpad show
|
|
||||||
emacsclient -c -a "" "$@"
|
|
||||||
swaymsg '[title="kittyterm"]' scratchpad show
|
|
||||||
else
|
|
||||||
if [[ $wait -eq 0 ]]; then
|
|
||||||
emacsclient -n -c -a "" "$@"
|
|
||||||
else
|
|
||||||
emacsclient -c -a "" "$@"
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
|
|
@ -1,20 +0,0 @@
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
OLD_TRANSID=$(sudo btrfs subvolume find-new /mnt/root-blank 9999999)
|
|
||||||
OLD_TRANSID=${OLD_TRANSID#transid marker was }
|
|
||||||
|
|
||||||
sudo btrfs subvolume find-new "/mnt/root" "$OLD_TRANSID" |
|
|
||||||
sed '$d' |
|
|
||||||
cut -f17- -d' ' |
|
|
||||||
sort |
|
|
||||||
uniq |
|
|
||||||
while read -r path; do
|
|
||||||
path="/$path"
|
|
||||||
if [ -L "$path" ]; then
|
|
||||||
: # The path is a symbolic link, so is probably handled by NixOS already
|
|
||||||
elif [ -d "$path" ]; then
|
|
||||||
: # The path is a directory, ignore
|
|
||||||
else
|
|
||||||
echo "$path"
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
WORKSPACE=$(niri msg -j workspaces | jq -r '.[] | select(.is_focused == true) | .id')
|
|
||||||
|
|
||||||
COUNT=$(niri msg -j windows | jq --argjson ws "$WORKSPACE" -r '.[] | select(.workspace_id == $ws and .is_floating == false) | .app_id' | wc -l)
|
|
||||||
|
|
||||||
while [[ $COUNT == "0" || $COUNT == "2" ]]; do
|
|
||||||
COUNT=$(niri msg -j windows | jq --argjson ws "$WORKSPACE" -r '.[] | select(.workspace_id == $ws and .is_floating == false) | .app_id' | wc -l)
|
|
||||||
done
|
|
||||||
|
|
||||||
if [[ $COUNT == "1" ]]; then
|
|
||||||
niri msg action maximize-column
|
|
||||||
fi
|
|
||||||
|
|
@ -1,5 +0,0 @@
|
||||||
if swaymsg opacity plus 0.01 -q; then
|
|
||||||
swaymsg opacity 1
|
|
||||||
else
|
|
||||||
swaymsg opacity 0.95
|
|
||||||
fi
|
|
||||||
|
|
@ -1,51 +0,0 @@
|
||||||
# Adapted from https://code.kulupu.party/thesuess/home-manager/src/branch/main/modules/river.nix
|
|
||||||
shopt -s nullglob globstar
|
|
||||||
|
|
||||||
otp=0
|
|
||||||
typeit=0
|
|
||||||
while :; do
|
|
||||||
case ${1:-} in
|
|
||||||
-t | --type)
|
|
||||||
typeit=1
|
|
||||||
;;
|
|
||||||
-o | --otp)
|
|
||||||
otp=1
|
|
||||||
;;
|
|
||||||
*) break ;;
|
|
||||||
esac
|
|
||||||
shift
|
|
||||||
done
|
|
||||||
|
|
||||||
export PASSWORD_STORE_DIR=~/.local/share/password-store
|
|
||||||
prefix=${PASSWORD_STORE_DIR-~/.local/share/password-store}
|
|
||||||
if [[ $otp -eq 0 ]]; then
|
|
||||||
password_files=("$prefix"/**/*.gpg)
|
|
||||||
else
|
|
||||||
password_files=("$prefix"/otp/**/*.gpg)
|
|
||||||
fi
|
|
||||||
password_files=("${password_files[@]#"$prefix"/}")
|
|
||||||
password_files=("${password_files[@]%.gpg}")
|
|
||||||
|
|
||||||
password=$(printf '%s\n' "${password_files[@]}" | fuzzel --dmenu "$@")
|
|
||||||
|
|
||||||
[[ -n $password ]] || exit
|
|
||||||
if [[ $otp -eq 0 ]]; then
|
|
||||||
if [[ $typeit -eq 0 ]]; then
|
|
||||||
pass show -c "$password" &> /tmp/pass-fuzzel
|
|
||||||
else
|
|
||||||
pass show "$password" | {
|
|
||||||
IFS= read -r pass
|
|
||||||
printf %s "$pass"
|
|
||||||
} | wtype -
|
|
||||||
fi
|
|
||||||
else
|
|
||||||
if [[ $typeit -eq 0 ]]; then
|
|
||||||
pass otp -c "$password" &> /tmp/pass-fuzzel
|
|
||||||
else
|
|
||||||
pass otp "$password" | {
|
|
||||||
IFS= read -r pass
|
|
||||||
printf %s "$pass"
|
|
||||||
} | wtype -
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
notify-send -u critical -a pass -t 1000 "Copied/Typed Password"
|
|
||||||
|
|
@ -1,7 +0,0 @@
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
if [ ! -d "$(pwd)/.git" ]; then
|
|
||||||
git init
|
|
||||||
fi
|
|
||||||
nix flake init --template "$FLAKE"#"$1"
|
|
||||||
direnv allow
|
|
||||||
|
|
@ -1,12 +0,0 @@
|
||||||
shopt -s nullglob globstar
|
|
||||||
|
|
||||||
notify-send "$(env | grep -E 'WAYLAND|SWAY')"
|
|
||||||
|
|
||||||
password="$1"
|
|
||||||
|
|
||||||
pass show "$password" | {
|
|
||||||
IFS= read -r pass
|
|
||||||
printf %s "$pass"
|
|
||||||
} | wtype -
|
|
||||||
|
|
||||||
notify-send -u critical -a pass -t 1000 "Typed Password"
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
HISTFILE="$HOME"/.histfile
|
|
||||||
|
|
||||||
last_ssh_cmd=$(grep -E "ssh " "$HISTFILE" | sed -E 's/^: [0-9]+:[0-9]+;//' | grep "^ssh " | tail -1)
|
|
||||||
host=$(echo "$last_ssh_cmd" | sed -E 's/.*ssh ([^@ ]+@)?([^ ]+).*/\2/')
|
|
||||||
|
|
||||||
if [[ -n $host ]]; then
|
|
||||||
echo "Removing SSH host key for: $host"
|
|
||||||
ssh-keygen -R "$host"
|
|
||||||
else
|
|
||||||
echo "No valid SSH command found in history."
|
|
||||||
fi
|
|
||||||
|
|
@ -1,394 +0,0 @@
|
||||||
# highly inspired by https://github.com/EmergentMind/nix-config/blob/dev/files/scripts/bootstrap-nixos.sh
|
|
||||||
set -eo pipefail
|
|
||||||
|
|
||||||
target_hostname=""
|
|
||||||
target_destination=""
|
|
||||||
target_arch=""
|
|
||||||
target_user="swarsel"
|
|
||||||
ssh_port="22"
|
|
||||||
persist_dir=""
|
|
||||||
disk_encryption=0
|
|
||||||
disk_encryption_args=""
|
|
||||||
no_disko_deps="false"
|
|
||||||
temp=$(mktemp -d)
|
|
||||||
|
|
||||||
function help_and_exit() {
|
|
||||||
echo
|
|
||||||
echo "Remotely installs SwarselSystem on a target machine including secret deployment."
|
|
||||||
echo
|
|
||||||
echo "USAGE: $0 -n <target_hostname> -d <target_destination> [OPTIONS]"
|
|
||||||
echo
|
|
||||||
echo "ARGS:"
|
|
||||||
echo " -n <target_hostname> specify target_hostname of the target host to deploy the nixos config on."
|
|
||||||
echo " -d <target_destination> specify ip or url to the target host."
|
|
||||||
echo " -a <targeit_arch> specify the architecture of the target host."
|
|
||||||
echo " target during install process."
|
|
||||||
echo
|
|
||||||
echo "OPTIONS:"
|
|
||||||
echo " -u <target_user> specify target_user with sudo access. nix-config will be cloned to their home."
|
|
||||||
echo " Default='${target_user}'."
|
|
||||||
echo " --port <ssh_port> specify the ssh port to use for remote access. Default=${ssh_port}."
|
|
||||||
echo " --debug Enable debug mode."
|
|
||||||
echo " --no-disko-deps Upload only disk script and not dependencies (for use on low ram)."
|
|
||||||
echo " -h | --help Print this help."
|
|
||||||
exit 0
|
|
||||||
}
|
|
||||||
|
|
||||||
function cleanup() {
|
|
||||||
rm -rf "$temp"
|
|
||||||
rm -rf /tmp/disko-password
|
|
||||||
}
|
|
||||||
trap cleanup exit
|
|
||||||
|
|
||||||
function red() {
|
|
||||||
echo -e "\x1B[31m[!] $1 \x1B[0m"
|
|
||||||
if [ -n "${2-}" ]; then
|
|
||||||
echo -e "\x1B[31m[!] $($2) \x1B[0m"
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
function green() {
|
|
||||||
echo -e "\x1B[32m[+] $1 \x1B[0m"
|
|
||||||
if [ -n "${2-}" ]; then
|
|
||||||
echo -e "\x1B[32m[+] $($2) \x1B[0m"
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
function yellow() {
|
|
||||||
echo -e "\x1B[33m[*] $1 \x1B[0m"
|
|
||||||
if [ -n "${2-}" ]; then
|
|
||||||
echo -e "\x1B[33m[*] $($2) \x1B[0m"
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
function yes_or_no() {
|
|
||||||
echo -en "\x1B[32m[+] $* [y/n] (default: y): \x1B[0m"
|
|
||||||
while true; do
|
|
||||||
read -rp "" yn
|
|
||||||
yn=${yn:-y}
|
|
||||||
case $yn in
|
|
||||||
[Yy]*) return 0 ;;
|
|
||||||
[Nn]*) return 1 ;;
|
|
||||||
esac
|
|
||||||
done
|
|
||||||
}
|
|
||||||
|
|
||||||
function update_sops_file() {
|
|
||||||
key_name=$1
|
|
||||||
key_type=$2
|
|
||||||
key=$3
|
|
||||||
|
|
||||||
if [ ! "$key_type" == "hosts" ] && [ ! "$key_type" == "users" ]; then
|
|
||||||
red "Invalid key type passed to update_sops_file. Must be either 'hosts' or 'users'."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
cd "${git_root}"
|
|
||||||
|
|
||||||
SOPS_FILE=".sops.yaml"
|
|
||||||
sed -i "{
|
|
||||||
# Remove any * and & entries for this host
|
|
||||||
/[*&]$key_name/ d;
|
|
||||||
# Inject a new age: entry
|
|
||||||
# n matches the first line following age: and p prints it, then we transform it while reusing the spacing
|
|
||||||
/age:/{n; p; s/\(.*- \*\).*/\1$key_name/};
|
|
||||||
# Inject a new hosts or user: entry
|
|
||||||
/&$key_type/{n; p; s/\(.*- &\).*/\1$key_name $key/}
|
|
||||||
}" $SOPS_FILE
|
|
||||||
green "Updating .sops.yaml"
|
|
||||||
cd -
|
|
||||||
}
|
|
||||||
|
|
||||||
while [[ $# -gt 0 ]]; do
|
|
||||||
case "$1" in
|
|
||||||
-n)
|
|
||||||
shift
|
|
||||||
target_hostname=$1
|
|
||||||
;;
|
|
||||||
-d)
|
|
||||||
shift
|
|
||||||
target_destination=$1
|
|
||||||
;;
|
|
||||||
-a)
|
|
||||||
shift
|
|
||||||
target_arch=$1
|
|
||||||
;;
|
|
||||||
-u)
|
|
||||||
shift
|
|
||||||
target_user=$1
|
|
||||||
;;
|
|
||||||
--port)
|
|
||||||
shift
|
|
||||||
ssh_port=$1
|
|
||||||
;;
|
|
||||||
--no-disko-deps)
|
|
||||||
no_disko_deps="true"
|
|
||||||
;;
|
|
||||||
--debug)
|
|
||||||
set -x
|
|
||||||
;;
|
|
||||||
-h | --help) help_and_exit ;;
|
|
||||||
*)
|
|
||||||
echo "Invalid option detected."
|
|
||||||
help_and_exit
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
shift
|
|
||||||
done
|
|
||||||
|
|
||||||
if [[ $target_arch == "" || $target_destination == "" || $target_hostname == "" ]]; then
|
|
||||||
red "error: target_arch, target_destination or target_hostname not set."
|
|
||||||
help_and_exit
|
|
||||||
fi
|
|
||||||
|
|
||||||
LOCKED="$(nix eval ~/.dotfiles#nixosConfigurations."$target_hostname".config.node.lockFromBootstrapping)"
|
|
||||||
if [[ $LOCKED == "true" ]]; then
|
|
||||||
red "THIS SYSTEM IS LOCKED FROM BOOTSTRAPPING - set 'node.lockFromBootstrapping = lib.mkForce false;' to proceed"
|
|
||||||
exit
|
|
||||||
fi
|
|
||||||
|
|
||||||
green "~SwarselSystems~ remote installer"
|
|
||||||
green "Reading system information for $target_hostname ..."
|
|
||||||
|
|
||||||
DISK="$(nix eval --raw ~/.dotfiles#nixosConfigurations."$target_hostname".config.swarselsystems.rootDisk)"
|
|
||||||
green "Root Disk: $DISK"
|
|
||||||
|
|
||||||
CRYPTED="$(nix eval ~/.dotfiles#nixosConfigurations."$target_hostname".config.swarselsystems.isCrypted)"
|
|
||||||
if [[ $CRYPTED == "true" ]]; then
|
|
||||||
green "Encryption: ✓"
|
|
||||||
disk_encryption=1
|
|
||||||
disk_encryption_args=(
|
|
||||||
--disk-encryption-keys
|
|
||||||
/tmp/disko-password
|
|
||||||
/tmp/disko-password
|
|
||||||
)
|
|
||||||
else
|
|
||||||
red "Encryption: X"
|
|
||||||
disk_encryption=0
|
|
||||||
fi
|
|
||||||
|
|
||||||
IMPERMANENCE="$(nix eval ~/.dotfiles#nixosConfigurations."$target_hostname".config.swarselsystems.isImpermanence)"
|
|
||||||
if [[ $IMPERMANENCE == "true" ]]; then
|
|
||||||
green "Impermanence: ✓"
|
|
||||||
persist_dir="/persist"
|
|
||||||
else
|
|
||||||
red "Impermanence: X"
|
|
||||||
persist_dir=""
|
|
||||||
fi
|
|
||||||
|
|
||||||
SWAP="$(nix eval ~/.dotfiles#nixosConfigurations."$target_hostname".config.swarselsystems.isSwap)"
|
|
||||||
if [[ $SWAP == "true" ]]; then
|
|
||||||
green "Swap: ✓"
|
|
||||||
else
|
|
||||||
red "Swap: X"
|
|
||||||
fi
|
|
||||||
|
|
||||||
SECUREBOOT="$(nix eval ~/.dotfiles#nixosConfigurations."$target_hostname".config.swarselsystems.isSecureBoot)"
|
|
||||||
if [[ $SECUREBOOT == "true" ]]; then
|
|
||||||
green "Secure Boot: ✓"
|
|
||||||
else
|
|
||||||
red "Secure Boot: X"
|
|
||||||
fi
|
|
||||||
|
|
||||||
ssh_cmd="ssh -oport=${ssh_port} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -t $target_user@$target_destination"
|
|
||||||
# ssh_root_cmd=$(echo "$ssh_cmd" | sed "s|${target_user}@|root@|") # uses @ in the sed switch to avoid it triggering on the $ssh_key value
|
|
||||||
ssh_root_cmd=${ssh_cmd/${target_user}@/root@}
|
|
||||||
scp_cmd="scp -oport=${ssh_port} -o StrictHostKeyChecking=no"
|
|
||||||
|
|
||||||
if [[ -z ${FLAKE} ]]; then
|
|
||||||
FLAKE=/home/"$target_user"/.dotfiles
|
|
||||||
fi
|
|
||||||
if [ ! -d "$FLAKE" ]; then
|
|
||||||
cd /home/"$target_user"
|
|
||||||
yellow "Flake directory not found - cloning repository from GitHub"
|
|
||||||
git clone git@github.com:Swarsel/.dotfiles.git || (yellow "Could not clone repository via SSH - defaulting to HTTPS" && git clone https://github.com/Swarsel/.dotfiles.git)
|
|
||||||
FLAKE=/home/"$target_user"/.dotfiles
|
|
||||||
fi
|
|
||||||
|
|
||||||
cd "$FLAKE"
|
|
||||||
|
|
||||||
rm install/flake.lock || true
|
|
||||||
git_root=$(git rev-parse --show-toplevel)
|
|
||||||
# ------------------------
|
|
||||||
green "Wiping known_hosts of $target_destination"
|
|
||||||
sed -i "/$target_hostname/d; /$target_destination/d" ~/.ssh/known_hosts
|
|
||||||
# ------------------------
|
|
||||||
green "Preparing a new ssh_host_ed25519_key pair for $target_hostname."
|
|
||||||
# Create the directory where sshd expects to find the host keys
|
|
||||||
install -d -m755 "$temp/$persist_dir/etc/ssh"
|
|
||||||
# Generate host ssh key pair without a passphrase
|
|
||||||
ssh-keygen -t ed25519 -f "$temp/$persist_dir/etc/ssh/ssh_host_ed25519_key" -C root@"$target_hostname" -N ""
|
|
||||||
# Set the correct permissions so sshd will accept the key
|
|
||||||
chmod 600 "$temp/$persist_dir/etc/ssh/ssh_host_ed25519_key"
|
|
||||||
echo "Adding ssh host fingerprint at $target_destination to ~/.ssh/known_hosts"
|
|
||||||
# This will fail if we already know the host, but that's fine
|
|
||||||
ssh-keyscan -p "$ssh_port" "$target_destination" >> ~/.ssh/known_hosts || true
|
|
||||||
# ------------------------
|
|
||||||
# when using luks, disko expects a passphrase on /tmp/disko-password, so we set it for now and will update the passphrase later
|
|
||||||
# via the config
|
|
||||||
if [ "$disk_encryption" -eq 1 ]; then
|
|
||||||
while true; do
|
|
||||||
green "Set disk encryption passphrase:"
|
|
||||||
read -rs luks_passphrase
|
|
||||||
green "Please confirm passphrase:"
|
|
||||||
read -rs luks_passphrase_confirm
|
|
||||||
if [[ $luks_passphrase == "$luks_passphrase_confirm" ]]; then
|
|
||||||
echo "$luks_passphrase" > /tmp/disko-password
|
|
||||||
$ssh_root_cmd "echo '$luks_passphrase' > /tmp/disko-password"
|
|
||||||
break
|
|
||||||
else
|
|
||||||
red "Passwords do not match"
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
fi
|
|
||||||
# ------------------------
|
|
||||||
green "Generating hardware-config.nix for $target_hostname and adding it to the nix-config."
|
|
||||||
$ssh_root_cmd "nixos-generate-config --force --no-filesystems --root /mnt"
|
|
||||||
|
|
||||||
mkdir -p "$FLAKE"/hosts/nixos/"$target_arch"/"$target_hostname"
|
|
||||||
$scp_cmd root@"$target_destination":/mnt/etc/nixos/hardware-configuration.nix "${git_root}"/hosts/nixos/"$target_arch"/"$target_hostname"/hardware-configuration.nix
|
|
||||||
# ------------------------
|
|
||||||
green "Generating hostkey for ssh initrd"
|
|
||||||
$ssh_root_cmd "mkdir -p $temp/etc/secrets/initrd /etc/secrets/initrd"
|
|
||||||
$ssh_root_cmd "ssh-keygen -t ed25519 -N '' -f $temp/etc/secrets/initrd/ssh_host_ed25519_key"
|
|
||||||
$ssh_root_cmd "cp $temp/etc/secrets/initrd/ssh_host_ed25519_key /etc/secrets/initrd/ssh_host_ed25519_key"
|
|
||||||
# ------------------------
|
|
||||||
|
|
||||||
green "Deploying minimal NixOS installation on $target_destination"
|
|
||||||
|
|
||||||
if [[ $no_disko_deps == "true" ]]; then
|
|
||||||
green "Building without disko dependencies (using custom kexec)"
|
|
||||||
nix run github:nix-community/nixos-anywhere/1.10.0 -- "${disk_encryption_args[@]}" --no-disko-deps --ssh-port "$ssh_port" --extra-files "$temp" --flake ./install#"$target_hostname" --kexec "$(nix build --print-out-paths .#packages."$target_arch".swarsel-kexec)/swarsel-kexec-$target_arch.tar.gz" root@"$target_destination"
|
|
||||||
else
|
|
||||||
green "Building with disko dependencies (using nixos-images kexec)"
|
|
||||||
nix run github:nix-community/nixos-anywhere/1.10.0 -- "${disk_encryption_args[@]}" --ssh-port "$ssh_port" --extra-files "$temp" --flake ./install#"$target_hostname" root@"$target_destination"
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "Updating ssh host fingerprint at $target_destination to ~/.ssh/known_hosts"
|
|
||||||
ssh-keyscan -p "$ssh_port" "$target_destination" >> ~/.ssh/known_hosts || true
|
|
||||||
# ------------------------
|
|
||||||
|
|
||||||
while true; do
|
|
||||||
read -rp "Press Enter to continue once the remote host has finished booting."
|
|
||||||
if nc -z "$target_destination" "${ssh_port}" 2> /dev/null; then
|
|
||||||
green "$target_destination is booted. Continuing..."
|
|
||||||
break
|
|
||||||
else
|
|
||||||
yellow "$target_destination is not yet ready."
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
|
|
||||||
# ------------------------
|
|
||||||
|
|
||||||
if [[ $SECUREBOOT == "true" ]]; then
|
|
||||||
green "Setting up secure boot keys"
|
|
||||||
$ssh_root_cmd "mkdir -p /var/lib/sbctl"
|
|
||||||
read -ra scp_call <<< "${scp_cmd}"
|
|
||||||
sudo "${scp_call[@]}" -r /var/lib/sbctl root@"$target_destination":/var/lib/
|
|
||||||
$ssh_root_cmd "sbctl enroll-keys --ignore-immutable --microsoft || true"
|
|
||||||
fi
|
|
||||||
# ------------------------
|
|
||||||
|
|
||||||
if [ -n "$persist_dir" ]; then
|
|
||||||
$ssh_root_cmd "cp /etc/machine-id $persist_dir/etc/machine-id || true"
|
|
||||||
$ssh_root_cmd "cp -R /etc/ssh/ $persist_dir/etc/ssh/ || true"
|
|
||||||
fi
|
|
||||||
# ------------------------
|
|
||||||
green "Generating an age key based on the new ssh_host_ed25519_key."
|
|
||||||
target_key=$(
|
|
||||||
ssh-keyscan -p "$ssh_port" -t ssh-ed25519 "$target_destination" 2>&1 |
|
|
||||||
grep ssh-ed25519 |
|
|
||||||
cut -f2- -d" " ||
|
|
||||||
(
|
|
||||||
red "Failed to get ssh key. Host down?"
|
|
||||||
exit 1
|
|
||||||
)
|
|
||||||
)
|
|
||||||
host_age_key=$(nix shell nixpkgs#ssh-to-age.out -c sh -c "echo $target_key | ssh-to-age")
|
|
||||||
|
|
||||||
if grep -qv '^age1' <<< "$host_age_key"; then
|
|
||||||
red "The result from generated age key does not match the expected format."
|
|
||||||
yellow "Result: $host_age_key"
|
|
||||||
yellow "Expected format: age1xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
|
|
||||||
exit 1
|
|
||||||
else
|
|
||||||
echo "$host_age_key"
|
|
||||||
fi
|
|
||||||
|
|
||||||
green "Updating nix-secrets/.sops.yaml"
|
|
||||||
update_sops_file "$target_hostname" "hosts" "$host_age_key"
|
|
||||||
yellow ".sops.yaml has been updated. There may be superfluous entries, you might need to edit manually."
|
|
||||||
if yes_or_no "Do you want to manually edit .sops.yaml now?"; then
|
|
||||||
vim "${git_root}"/.sops.yaml
|
|
||||||
fi
|
|
||||||
green "Updating all secrets files to reflect updates .sops.yaml"
|
|
||||||
sops updatekeys --yes --enable-local-keyservice "${git_root}"/hosts/nixos/"$target_arch"/"$target_hostname"/secrets/* || true
|
|
||||||
# --------------------------
|
|
||||||
green "Making ssh_host_ed25519_key available to home-manager for user $target_user"
|
|
||||||
sed -i "/$target_hostname/d; /$target_destination/d" ~/.ssh/known_hosts
|
|
||||||
$ssh_root_cmd "mkdir -p /home/$target_user/.ssh; chown -R $target_user:users /home/$target_user/.ssh/"
|
|
||||||
$scp_cmd root@"$target_destination":/etc/ssh/ssh_host_ed25519_key root@"$target_destination":/home/"$target_user"/.ssh/ssh_host_ed25519_key
|
|
||||||
$ssh_root_cmd "chown $target_user:users /home/$target_user/.ssh/ssh_host_ed25519_key"
|
|
||||||
# __________________________
|
|
||||||
|
|
||||||
if yes_or_no "Add ssh host fingerprints for git upstream repositories? (This is needed for building the full config)"; then
|
|
||||||
green "Adding ssh host fingerprints for git{lab,hub}"
|
|
||||||
$ssh_cmd "mkdir -p /home/$target_user/.ssh/; ssh-keyscan -t ssh-ed25519 gitlab.com github.com | tee /home/$target_user/.ssh/known_hosts"
|
|
||||||
$ssh_root_cmd "mkdir -p /root/.ssh/; ssh-keyscan -t ssh-ed25519 gitlab.com github.com | tee /root/.ssh/known_hosts"
|
|
||||||
fi
|
|
||||||
# --------------------------
|
|
||||||
|
|
||||||
if yes_or_no "Do you want to copy your full nix-config and nix-secrets to $target_hostname?"; then
|
|
||||||
green "Adding ssh host fingerprint at $target_destination to ~/.ssh/known_hosts"
|
|
||||||
ssh-keyscan -p "$ssh_port" "$target_destination" >> ~/.ssh/known_hosts || true
|
|
||||||
green "Copying full nix-config to $target_hostname"
|
|
||||||
cd "${git_root}"
|
|
||||||
just sync "$target_user" "$target_destination"
|
|
||||||
|
|
||||||
if [ -n "$persist_dir" ]; then
|
|
||||||
$ssh_root_cmd "cp -r /home/$target_user/.dotfiles $persist_dir/.dotfiles || true"
|
|
||||||
$ssh_root_cmd "cp -r /home/$target_user/.ssh $persist_dir/.ssh || true"
|
|
||||||
fi
|
|
||||||
|
|
||||||
if yes_or_no "Do you want to rebuild immediately?"; then
|
|
||||||
green "Building nix-config for $target_hostname"
|
|
||||||
# yellow "Reminder: The password is 'setup'"
|
|
||||||
$ssh_root_cmd "mkdir -p /root/.local/share/nix/; printf '{\"extra-substituters\":{\"https://nix-community.cachix.org\":true,\"https://nix-community.cachix.org https://cache.ngi0.nixos.org/\":true},\"extra-trusted-public-keys\":{\"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=\":true,\"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs= cache.ngi0.nixos.org-1:KqH5CBLNSyX184S9BKZJo1LxrxJ9ltnY2uAs5c/f1MA=\":true}}' | tee /root/.local/share/nix/trusted-settings.json"
|
|
||||||
# $ssh_cmd -oForwardAgent=yes "cd .dotfiles && sudo nixos-rebuild --show-trace --flake .#$target_hostname switch"
|
|
||||||
store_path=$(nix build --no-link --print-out-paths .#nixosConfigurations."$target_hostname".config.system.build.toplevel)
|
|
||||||
green "Copying generation to $target_hostname"
|
|
||||||
nix copy --to "ssh://root@$target_destination" "$store_path"
|
|
||||||
# prev_system=$($ssh_root_cmd " readlink -e /nix/var/nix/profiles/system")
|
|
||||||
green "Linking generation in bootloader"
|
|
||||||
$ssh_root_cmd "/run/current-system/sw/bin/nix-env --profile /nix/var/nix/profiles/system --set $store_path"
|
|
||||||
green "Setting generation to activate upon next boot"
|
|
||||||
$ssh_root_cmd "$store_path/bin/switch-to-configuration boot"
|
|
||||||
else
|
|
||||||
echo
|
|
||||||
green "NixOS was successfully installed!"
|
|
||||||
echo "Post-install config build instructions:"
|
|
||||||
echo "To copy nix-config from this machine to the $target_hostname, run the following command from ~/nix-config"
|
|
||||||
echo "just sync $target_user $target_destination"
|
|
||||||
echo "To rebuild, sign into $target_hostname and run the following command from ~/nix-config"
|
|
||||||
echo "cd nix-config"
|
|
||||||
# see above FIXME:(bootstrap)
|
|
||||||
echo "sudo nixos-rebuild .pre-commit-config.yaml show-trace --flake .#$target_hostname switch"
|
|
||||||
# echo "just rebuild"
|
|
||||||
echo
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
|
|
||||||
green "NixOS was successfully installed!"
|
|
||||||
if yes_or_no "You can now commit and push the nix-config, which includes the hardware-configuration.nix for $target_hostname?"; then
|
|
||||||
cd "${git_root}"
|
|
||||||
deadnix hosts/nixos/"$target_arch"/"$target_hostname"/hardware-configuration.nix -qe
|
|
||||||
nixpkgs--fmt hosts/nixos/"$target_arch"/"$target_hostname"/hardware-configuration.nix
|
|
||||||
(.pre-commit-config.yaml mit run --all-files 2> /dev/null || true) &&
|
|
||||||
git add "$git_root/hosts/nixos/$target_arch/$target_hostname/hardware-configuration.nix" &&
|
|
||||||
git add "$git_root/.sops.yaml" &&
|
|
||||||
git add "$git_root/secrets" &&
|
|
||||||
(git commit -m "feat: deployed $target_hostname" || true) && git push
|
|
||||||
fi
|
|
||||||
|
|
||||||
if yes_or_no "Reboot now?"; then
|
|
||||||
$ssh_root_cmd "reboot"
|
|
||||||
fi
|
|
||||||
|
|
||||||
rm -rf /tmp/disko-password
|
|
||||||
|
|
@ -1,2 +0,0 @@
|
||||||
swaymsg "output * power on" > /dev/null 2>&1 || true
|
|
||||||
swaymsg "output * dpms on" > /dev/null 2>&1 || true
|
|
||||||
|
|
@ -1,188 +0,0 @@
|
||||||
set -eo pipefail
|
|
||||||
|
|
||||||
target_config="hotel"
|
|
||||||
target_hostname="hotel"
|
|
||||||
target_user="swarsel"
|
|
||||||
target_arch=""
|
|
||||||
persist_dir=""
|
|
||||||
target_disk="/dev/vda"
|
|
||||||
disk_encryption=0
|
|
||||||
|
|
||||||
function help_and_exit() {
|
|
||||||
echo
|
|
||||||
echo "Locally installs SwarselSystem on this machine."
|
|
||||||
echo
|
|
||||||
echo "USAGE: $0 -n <target_config> -d <target_disk> [OPTIONS]"
|
|
||||||
echo
|
|
||||||
echo "ARGS:"
|
|
||||||
echo " -n <target_config> specify the nixos config to deploy."
|
|
||||||
echo " Default: hotel"
|
|
||||||
echo " -d <target_disk> specify disk to install on."
|
|
||||||
echo " Default: /dev/vda"
|
|
||||||
echo " -u <target_user> specify user to deploy for."
|
|
||||||
echo " Default: swarsel"
|
|
||||||
echo " -a <target_arch> specify target architecture."
|
|
||||||
echo " -h | --help Print this help."
|
|
||||||
exit 0
|
|
||||||
}
|
|
||||||
|
|
||||||
function red() {
|
|
||||||
echo -e "\x1B[31m[!] $1 \x1B[0m"
|
|
||||||
if [ -n "${2-}" ]; then
|
|
||||||
echo -e "\x1B[31m[!] $($2) \x1B[0m"
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
function green() {
|
|
||||||
echo -e "\x1B[32m[+] $1 \x1B[0m"
|
|
||||||
if [ -n "${2-}" ]; then
|
|
||||||
echo -e "\x1B[32m[+] $($2) \x1B[0m"
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
function yellow() {
|
|
||||||
echo -e "\x1B[33m[*] $1 \x1B[0m"
|
|
||||||
if [ -n "${2-}" ]; then
|
|
||||||
echo -e "\x1B[33m[*] $($2) \x1B[0m"
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
while [[ $# -gt 0 ]]; do
|
|
||||||
case "$1" in
|
|
||||||
-n)
|
|
||||||
shift
|
|
||||||
target_config=$1
|
|
||||||
target_hostname=$1
|
|
||||||
;;
|
|
||||||
-u)
|
|
||||||
shift
|
|
||||||
target_user=$1
|
|
||||||
;;
|
|
||||||
-d)
|
|
||||||
shift
|
|
||||||
target_disk=$1
|
|
||||||
;;
|
|
||||||
-a)
|
|
||||||
shift
|
|
||||||
target_arch=$1
|
|
||||||
;;
|
|
||||||
-h | --help) help_and_exit ;;
|
|
||||||
*)
|
|
||||||
echo "Invalid option detected."
|
|
||||||
help_and_exit
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
shift
|
|
||||||
done
|
|
||||||
|
|
||||||
function cleanup() {
|
|
||||||
sudo rm -rf .cache/nix
|
|
||||||
sudo rm -rf /root/.cache/nix
|
|
||||||
}
|
|
||||||
trap cleanup exit
|
|
||||||
|
|
||||||
if [[ $target_arch == "" || $target_hostname == "" ]]; then
|
|
||||||
red "error: target_arch or target_hostname not set."
|
|
||||||
help_and_exit
|
|
||||||
fi
|
|
||||||
|
|
||||||
green "~SwarselSystems~ local installer"
|
|
||||||
|
|
||||||
cd /home/"$target_user"
|
|
||||||
|
|
||||||
sudo rm -rf /root/.cache/nix
|
|
||||||
sudo rm -rf .cache/nix
|
|
||||||
sudo rm -rf .dotfiles
|
|
||||||
|
|
||||||
green "Cloning repository from GitHub"
|
|
||||||
git clone https://github.com/Swarsel/.dotfiles.git
|
|
||||||
|
|
||||||
local_keys=$(ssh-add -L || true)
|
|
||||||
pub_key=$(cat /home/"$target_user"/.dotfiles/secrets/public/ssh/yubikey.pub)
|
|
||||||
read -ra pub_arr <<< "$pub_key"
|
|
||||||
|
|
||||||
cd .dotfiles
|
|
||||||
if [[ $local_keys != *"${pub_arr[1]}"* ]]; then
|
|
||||||
yellow "The ssh key for this configuration is not available."
|
|
||||||
green "Adjusting flake.nix so that the configuration is buildable ..."
|
|
||||||
sed -i '/vbc-nix = {/,/^[[:space:]]*};/d' flake.nix
|
|
||||||
sed -i '/[[:space:]]*\/\/ (inputs.vbc-nix.overlays.default final prev)/d' overlays/default.nix
|
|
||||||
nix flake update vbc-nix
|
|
||||||
git add .
|
|
||||||
else
|
|
||||||
green "Valid SSH key found! Continuing with installation"
|
|
||||||
fi
|
|
||||||
|
|
||||||
green "Reading system information for $target_config ..."
|
|
||||||
DISK="$(nix eval --raw ~/.dotfiles#nixosConfigurations."$target_hostname".config.swarselsystems.rootDisk)"
|
|
||||||
green "Root Disk in config: $DISK - Root Disk passed in cli: $target_disk"
|
|
||||||
|
|
||||||
CRYPTED="$(nix eval ~/.dotfiles#nixosConfigurations."$target_hostname".config.swarselsystems.isCrypted)"
|
|
||||||
if [[ $CRYPTED == "true" ]]; then
|
|
||||||
green "Encryption: ✓"
|
|
||||||
disk_encryption=1
|
|
||||||
else
|
|
||||||
red "Encryption: X"
|
|
||||||
disk_encryption=0
|
|
||||||
fi
|
|
||||||
|
|
||||||
IMPERMANENCE="$(nix eval ~/.dotfiles#nixosConfigurations."$target_hostname".config.swarselsystems.isImpermanence)"
|
|
||||||
if [[ $IMPERMANENCE == "true" ]]; then
|
|
||||||
green "Impermanence: ✓"
|
|
||||||
persist_dir="/persist"
|
|
||||||
else
|
|
||||||
red "Impermanence: X"
|
|
||||||
persist_dir=""
|
|
||||||
fi
|
|
||||||
|
|
||||||
SWAP="$(nix eval ~/.dotfiles#nixosConfigurations."$target_hostname".config.swarselsystems.isSwap)"
|
|
||||||
if [[ $SWAP == "true" ]]; then
|
|
||||||
green "Swap: ✓"
|
|
||||||
else
|
|
||||||
red "Swap: X"
|
|
||||||
fi
|
|
||||||
|
|
||||||
SECUREBOOT="$(nix eval ~/.dotfiles#nixosConfigurations."$target_hostname".config.swarselsystems.isSecureBoot)"
|
|
||||||
if [[ $SECUREBOOT == "true" ]]; then
|
|
||||||
green "Secure Boot: ✓"
|
|
||||||
else
|
|
||||||
red "Secure Boot: X"
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ "$disk_encryption" -eq 1 ]; then
|
|
||||||
while true; do
|
|
||||||
green "Set disk encryption passphrase:"
|
|
||||||
read -rs luks_passphrase
|
|
||||||
green "Please confirm passphrase:"
|
|
||||||
read -rs luks_passphrase_confirm
|
|
||||||
if [[ $luks_passphrase == "$luks_passphrase_confirm" ]]; then
|
|
||||||
echo "$luks_passphrase" > /tmp/disko-password
|
|
||||||
break
|
|
||||||
else
|
|
||||||
red "Passwords do not match"
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
fi
|
|
||||||
|
|
||||||
green "Setting up disk ..."
|
|
||||||
if [[ $target_config == "hotel" ]]; then
|
|
||||||
sudo nix --experimental-features "nix-command flakes" run github:nix-community/disko/v1.10.0 -- --mode destroy,format,mount --flake .#"$target_config" --yes-wipe-all-disks --arg diskDevice "$target_disk"
|
|
||||||
else
|
|
||||||
sudo nix --experimental-features "nix-command flakes" run github:nix-community/disko/latest -- --mode destroy,format,mount --flake .#"$target_config" --yes-wipe-all-disks
|
|
||||||
fi
|
|
||||||
sudo mkdir -p /mnt/"$persist_dir"/home/"$target_user"/
|
|
||||||
sudo cp -r /home/"$target_user"/.dotfiles /mnt/"$persist_dir"/home/"$target_user"/
|
|
||||||
sudo chown -R 1000:100 /mnt/"$persist_dir"/home/"$target_user"
|
|
||||||
|
|
||||||
green "Generating hardware configuration ..."
|
|
||||||
sudo nixos-generate-config --root /mnt --no-filesystems --dir /home/"$target_user"/.dotfiles/hosts/nixos/"$target_arch"/"$target_config"/
|
|
||||||
|
|
||||||
git add /home/"$target_user"/.dotfiles/hosts/nixos/"$target_arch"/"$target_config"/hardware-configuration.nix
|
|
||||||
sudo mkdir -p /root/.local/share/nix/
|
|
||||||
printf '{\"extra-substituters\":{\"https://nix-community.cachix.org\":true,\"https://nix-community.cachix.org https://cache.ngi0.nixos.org/\":true},\"extra-trusted-public-keys\":{\"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=\":true,\"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs= cache.ngi0.nixos.org-1:KqH5CBLNSyX184S9BKZJo1LxrxJ9ltnY2uAs5c/f1MA=\":true}}' | sudo tee /root/.local/share/nix/trusted-settings.json > /dev/null
|
|
||||||
green "Installing flake $target_config"
|
|
||||||
|
|
||||||
store_path=$(nix build --no-link --print-out-paths .#nixosConfigurationsMinimal."$target_config".config.system.build.toplevel)
|
|
||||||
green "Linking generation in bootloader"
|
|
||||||
sudo "/run/current-system/sw/bin/nix-env --profile /nix/var/nix/profiles/system --set $store_path"
|
|
||||||
green "Setting generation to activate upon next boot"
|
|
||||||
sudo "$store_path/bin/switch-to-configuration boot"
|
|
||||||
green "Installation finished! Reboot to see changes"
|
|
||||||
|
|
@ -1,72 +0,0 @@
|
||||||
set -eo pipefail
|
|
||||||
|
|
||||||
target_config="hotel"
|
|
||||||
target_user="swarsel"
|
|
||||||
|
|
||||||
function help_and_exit() {
|
|
||||||
echo
|
|
||||||
echo "Locally installs SwarselSystem on this machine."
|
|
||||||
echo
|
|
||||||
echo "USAGE: $0 -d <disk> [OPTIONS]"
|
|
||||||
echo
|
|
||||||
echo "ARGS:"
|
|
||||||
echo " -d <disk> specify disk to install on."
|
|
||||||
echo " -n <target_config> specify the nixos config to deploy."
|
|
||||||
echo " Default: hotel"
|
|
||||||
echo " Default: hotel"
|
|
||||||
echo " -u <target_user> specify user to deploy for."
|
|
||||||
echo " Default: swarsel"
|
|
||||||
echo " -h | --help Print this help."
|
|
||||||
exit 0
|
|
||||||
}
|
|
||||||
|
|
||||||
function green() {
|
|
||||||
echo -e "\x1B[32m[+] $1 \x1B[0m"
|
|
||||||
if [ -n "${2-}" ]; then
|
|
||||||
echo -e "\x1B[32m[+] $($2) \x1B[0m"
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
while [[ $# -gt 0 ]]; do
|
|
||||||
case "$1" in
|
|
||||||
-n)
|
|
||||||
shift
|
|
||||||
target_config=$1
|
|
||||||
;;
|
|
||||||
-u)
|
|
||||||
shift
|
|
||||||
target_user=$1
|
|
||||||
;;
|
|
||||||
-h | --help) help_and_exit ;;
|
|
||||||
*)
|
|
||||||
echo "Invalid option detected."
|
|
||||||
help_and_exit
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
shift
|
|
||||||
done
|
|
||||||
|
|
||||||
function cleanup() {
|
|
||||||
sudo rm -rf .cache/nix
|
|
||||||
sudo rm -rf /root/.cache/nix
|
|
||||||
}
|
|
||||||
trap cleanup exit
|
|
||||||
|
|
||||||
sudo rm -rf .cache/nix
|
|
||||||
sudo rm -rf /root/.cache/nix
|
|
||||||
|
|
||||||
green "~SwarselSystems~ remote post-installer"
|
|
||||||
|
|
||||||
cd /home/"$target_user"/.dotfiles
|
|
||||||
|
|
||||||
SECUREBOOT="$(nix eval ~/.dotfiles#nixosConfigurations."$target_config".config.swarselsystems.isSecureBoot)"
|
|
||||||
|
|
||||||
if [[ $SECUREBOOT == "true" ]]; then
|
|
||||||
green "Setting up secure boot keys"
|
|
||||||
sudo mkdir -p /var/lib/sbctl
|
|
||||||
sbctl create-keys || true
|
|
||||||
sbctl enroll-keys --ignore-immutable --microsoft || true
|
|
||||||
fi
|
|
||||||
|
|
||||||
sudo nixos-rebuild --flake .#"$target_config" switch
|
|
||||||
green "Post-install finished!"
|
|
||||||
|
|
@ -1,110 +0,0 @@
|
||||||
set -eo pipefail
|
|
||||||
|
|
||||||
target_config="hotel"
|
|
||||||
target_arch=""
|
|
||||||
target_user="swarsel"
|
|
||||||
|
|
||||||
function help_and_exit() {
|
|
||||||
echo
|
|
||||||
echo "Builds SwarselSystem configuration."
|
|
||||||
echo
|
|
||||||
echo "USAGE: $0 [OPTIONS]"
|
|
||||||
echo
|
|
||||||
echo "ARGS:"
|
|
||||||
echo " -n <target_config> specify nixos config to build."
|
|
||||||
echo " Default: hotel"
|
|
||||||
echo " -u <target_user> specify user to deploy for."
|
|
||||||
echo " Default: swarsel"
|
|
||||||
echo " -a <target_arch> specify target architecture."
|
|
||||||
echo " -h | --help Print this help."
|
|
||||||
exit 0
|
|
||||||
}
|
|
||||||
|
|
||||||
function red() {
|
|
||||||
echo -e "\x1B[31m[!] $1 \x1B[0m"
|
|
||||||
if [ -n "${2-}" ]; then
|
|
||||||
echo -e "\x1B[31m[!] $($2) \x1B[0m"
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
function green() {
|
|
||||||
echo -e "\x1B[32m[+] $1 \x1B[0m"
|
|
||||||
if [ -n "${2-}" ]; then
|
|
||||||
echo -e "\x1B[32m[+] $($2) \x1B[0m"
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
function yellow() {
|
|
||||||
echo -e "\x1B[33m[*] $1 \x1B[0m"
|
|
||||||
if [ -n "${2-}" ]; then
|
|
||||||
echo -e "\x1B[33m[*] $($2) \x1B[0m"
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
while [[ $# -gt 0 ]]; do
|
|
||||||
case "$1" in
|
|
||||||
-n)
|
|
||||||
shift
|
|
||||||
target_config=$1
|
|
||||||
;;
|
|
||||||
-a)
|
|
||||||
shift
|
|
||||||
target_arch=$1
|
|
||||||
;;
|
|
||||||
-u)
|
|
||||||
shift
|
|
||||||
target_user=$1
|
|
||||||
;;
|
|
||||||
-h | --help) help_and_exit ;;
|
|
||||||
*)
|
|
||||||
echo "Invalid option detected."
|
|
||||||
help_and_exit
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
shift
|
|
||||||
done
|
|
||||||
|
|
||||||
if [[ $target_arch == "" ]]; then
|
|
||||||
red "error: target_arch not set."
|
|
||||||
help_and_exit
|
|
||||||
fi
|
|
||||||
|
|
||||||
cd /home/"$target_user"
|
|
||||||
|
|
||||||
if [ ! -d /home/"$target_user"/.dotfiles ]; then
|
|
||||||
green "Cloning repository from GitHub"
|
|
||||||
git clone https://github.com/Swarsel/.dotfiles.git
|
|
||||||
else
|
|
||||||
red "A .dotfiles repository is in the way. Please (re-)move the repository and try again."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
local_keys=$(ssh-add -L || true)
|
|
||||||
pub_key=$(cat /home/"$target_user"/.dotfiles/secrets/public/ssh/yubikey.pub)
|
|
||||||
read -ra pub_arr <<< "$pub_key"
|
|
||||||
|
|
||||||
cd .dotfiles
|
|
||||||
if [[ $local_keys != *"${pub_arr[1]}"* ]]; then
|
|
||||||
yellow "The ssh key for this configuration is not available."
|
|
||||||
green "Adjusting flake.nix so that the configuration is buildable"
|
|
||||||
sed -i '/nix-secrets = {/,/^[[:space:]]*};/d' flake.nix
|
|
||||||
sed -i '/vbc-nix = {/,/^[[:space:]]*};/d' flake.nix
|
|
||||||
sed -i '/[[:space:]]*\/\/ (inputs.vbc-nix.overlays.default final prev)/d' overlays/default.nix
|
|
||||||
rm modules/home/common/env.nix
|
|
||||||
rm modules/home/common/gammastep.nix
|
|
||||||
rm modules/home/common/git.nix
|
|
||||||
rm modules/home/common/mail.nix
|
|
||||||
rm modules/home/common/yubikey.nix
|
|
||||||
rm modules/nixos/server/restic.nix
|
|
||||||
rm hosts/nixos/aarch64-linux/milkywell/default.nix
|
|
||||||
rm -rf modules/nixos/server
|
|
||||||
rm -rf modules/home/server
|
|
||||||
nix flake update vbc-nix
|
|
||||||
git add .
|
|
||||||
else
|
|
||||||
green "Valid SSH key found! Continuing with installation"
|
|
||||||
fi
|
|
||||||
sudo nixos-generate-config --dir /home/"$target_user"/.dotfiles/hosts/nixos/"$target_arch"/"$target_config"/
|
|
||||||
git add /home/"$target_user"/.dotfiles/hosts/nixos/"$target_arch"/"$target_config"/hardware-configuration.nix
|
|
||||||
|
|
||||||
green "Installing flake $target_config"
|
|
||||||
sudo nixos-rebuild --show-trace --flake .#"$target_config" boot
|
|
||||||
yellow "Please keep in mind that this is only a demo of the configuration. Things might break unexpectedly."
|
|
||||||
|
|
@ -1,62 +0,0 @@
|
||||||
kitty=0
|
|
||||||
element=0
|
|
||||||
vesktop=0
|
|
||||||
spotifyplayer=0
|
|
||||||
while :; do
|
|
||||||
case ${1:-} in
|
|
||||||
-k | --kitty)
|
|
||||||
kitty=1
|
|
||||||
;;
|
|
||||||
-e | --element)
|
|
||||||
element=1
|
|
||||||
;;
|
|
||||||
-d | --vesktop)
|
|
||||||
vesktop=1
|
|
||||||
;;
|
|
||||||
-s | --spotifyplayer)
|
|
||||||
spotifyplayer=1
|
|
||||||
;;
|
|
||||||
*) break ;;
|
|
||||||
esac
|
|
||||||
shift
|
|
||||||
done
|
|
||||||
|
|
||||||
if [[ $kitty -eq 1 ]]; then
|
|
||||||
STR=$(swaymsg -t get_tree | jq -r 'recurse(.nodes[]) | select(.name == "__i3_scratch")' | grep kittyterm || true)
|
|
||||||
CHECK=$(swaymsg -t get_tree | grep kittyterm || true)
|
|
||||||
if [ "$CHECK" == "" ]; then
|
|
||||||
exec kitty --app-id kittyterm -T kittyterm -o confirm_os_window_close=0 zellij attach --create kittyterm &
|
|
||||||
sleep 1
|
|
||||||
fi
|
|
||||||
if [ "$STR" == "" ]; then
|
|
||||||
exec swaymsg '[title="kittyterm"]' scratchpad show
|
|
||||||
else
|
|
||||||
exec swaymsg '[title="kittyterm"]' scratchpad show
|
|
||||||
fi
|
|
||||||
elif [[ $element -eq 1 ]]; then
|
|
||||||
STR=$(swaymsg -t get_tree | grep Element || true)
|
|
||||||
if [ "$STR" == "" ]; then
|
|
||||||
exec element-desktop
|
|
||||||
else
|
|
||||||
exec swaymsg '[app_id=Element]' kill
|
|
||||||
fi
|
|
||||||
elif [[ $vesktop -eq 1 ]]; then
|
|
||||||
STR=$(swaymsg -t get_tree | grep vesktop || true)
|
|
||||||
if [ "$STR" == "" ]; then
|
|
||||||
exec vesktop
|
|
||||||
else
|
|
||||||
exec swaymsg '[app_id=vesktop]' kill
|
|
||||||
fi
|
|
||||||
elif [[ $spotifyplayer -eq 1 ]]; then
|
|
||||||
STR=$(swaymsg -t get_tree | jq -r 'recurse(.nodes[]) | select(.name == "__i3_scratch")' | grep spotifytui || true)
|
|
||||||
CHECK=$(swaymsg -t get_tree | grep spotifytui || true)
|
|
||||||
if [ "$CHECK" == "" ]; then
|
|
||||||
exec kitty --add-id spotifytui -T spotifytui -o confirm_os_window_close=0 spotify_player &
|
|
||||||
sleep 1
|
|
||||||
fi
|
|
||||||
if [ "$STR" == "" ]; then
|
|
||||||
exec swaymsg '[title="spotifytui"]' scratchpad show
|
|
||||||
else
|
|
||||||
exec swaymsg '[title="spotifytui"]' scratchpad show
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
|
|
@ -1,8 +0,0 @@
|
||||||
# KITTIES=$(($(pgrep -P 1 kitty | wc -l) - 1))
|
|
||||||
|
|
||||||
# if ((KITTIES < 1)); then
|
|
||||||
# exec kitty -o confirm_os_window_close=0 zellij attach --create main
|
|
||||||
# else
|
|
||||||
# exec kitty -o confirm_os_window_close=0 zellij attach --create "temp $KITTIES"
|
|
||||||
# fi
|
|
||||||
exec kitty -o confirm_os_window_close=0 zellij
|
|
||||||
|
|
@ -1,24 +0,0 @@
|
||||||
CFG=$(git --git-dir="$HOME"/.dotfiles/.git --work-tree="$HOME"/.dotfiles/ status -s | wc -l)
|
|
||||||
CSE=$(git --git-dir="$DOCUMENT_DIR_PRIV"/CSE_TUWIEN/.git --work-tree="$DOCUMENT_DIR_PRIV"/CSE_TUWIEN/ status -s | wc -l)
|
|
||||||
PASS=$(($(git --git-dir="$HOME"/.local/share/password-store/.git --work-tree="$HOME"/.local/share/password-store/ status -s | wc -l) + $(git --git-dir="$HOME"/.local/share/password-store/.git --work-tree="$HOME"/.local/share/password-store/ diff origin/main..HEAD | wc -l)))
|
|
||||||
|
|
||||||
if [[ $CFG != 0 ]]; then
|
|
||||||
CFG_STR='CONFIG'
|
|
||||||
else
|
|
||||||
CFG_STR=''
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [[ $CSE != 0 ]]; then
|
|
||||||
CSE_STR=' CSE'
|
|
||||||
else
|
|
||||||
CSE_STR=''
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [[ $PASS != 0 ]]; then
|
|
||||||
PASS_STR=' PASS'
|
|
||||||
else
|
|
||||||
PASS_STR=''
|
|
||||||
fi
|
|
||||||
|
|
||||||
OUT="$CFG_STR""$CSE_STR""$PASS_STR"
|
|
||||||
echo "$OUT"
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
{ self, lib, config, pkgs, ... }:
|
{ lib, config, pkgs, ... }:
|
||||||
{
|
{
|
||||||
options.swarselmodules.nix-index = lib.mkEnableOption "nix-index settings";
|
options.swarselmodules.nix-index = lib.mkEnableOption "nix-index settings";
|
||||||
config = lib.mkIf config.swarselmodules.nix-index {
|
config = lib.mkIf config.swarselmodules.nix-index {
|
||||||
|
|
@ -6,7 +6,43 @@
|
||||||
let
|
let
|
||||||
commandNotFound = pkgs.runCommandLocal "command-not-found.sh" { } ''
|
commandNotFound = pkgs.runCommandLocal "command-not-found.sh" { } ''
|
||||||
mkdir -p $out/etc/profile.d
|
mkdir -p $out/etc/profile.d
|
||||||
substitute ${self + /files/scripts/command-not-found.sh} \
|
cat > $out/etc/profile.d/command-not-found.sh <<'EOF'
|
||||||
|
# Adapted from https://github.com/bennofs/nix-index/blob/master/command-not-found.sh
|
||||||
|
command_not_found_handle() {
|
||||||
|
if [ -n "''${MC_SID-}" ] || ! [ -t 1 ]; then
|
||||||
|
>&2 echo "$1: command not found"
|
||||||
|
return 127
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo -n "searching nix-index..."
|
||||||
|
ATTRS=$(@nix-locate@ --minimal --no-group --type x --type s --whole-name --at-root "/bin/$1")
|
||||||
|
|
||||||
|
case $(echo -n "$ATTRS" | grep -c "^") in
|
||||||
|
0)
|
||||||
|
>&2 echo -ne "$(@tput@ el1)\r"
|
||||||
|
>&2 echo "$1: command not found"
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
>&2 echo -ne "$(@tput@ el1)\r"
|
||||||
|
>&2 echo "The program ‘$(@tput@ setaf 4)$1$(@tput@ sgr0)’ is currently not installed."
|
||||||
|
>&2 echo "It is provided by the following derivation(s):"
|
||||||
|
while read -r ATTR; do
|
||||||
|
ATTR=''${ATTR%.out}
|
||||||
|
>&2 echo " $(@tput@ setaf 12)nixpkgs#$(@tput@ setaf 4)$ATTR$(@tput@ sgr0)"
|
||||||
|
done <<< "$ATTRS"
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
return 127
|
||||||
|
}
|
||||||
|
|
||||||
|
command_not_found_handler() {
|
||||||
|
command_not_found_handle "$@"
|
||||||
|
return $?
|
||||||
|
}
|
||||||
|
EOF
|
||||||
|
|
||||||
|
substitute $out/etc/profile.d/command-not-found.sh \
|
||||||
$out/etc/profile.d/command-not-found.sh \
|
$out/etc/profile.d/command-not-found.sh \
|
||||||
--replace-fail @nix-locate@ ${pkgs.nix-index}/bin/nix-locate \
|
--replace-fail @nix-locate@ ${pkgs.nix-index}/bin/nix-locate \
|
||||||
--replace-fail @tput@ ${pkgs.ncurses}/bin/tput
|
--replace-fail @tput@ ${pkgs.ncurses}/bin/tput
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,4 @@
|
||||||
{ name, writeShellApplication, fzf, ... }:
|
{ name, writeShellApplication, fzf, ... }:
|
||||||
|
|
||||||
writeShellApplication {
|
writeShellApplication {
|
||||||
inherit name;
|
inherit name;
|
||||||
runtimeInputs = [ fzf ];
|
runtimeInputs = [ fzf ];
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,4 @@
|
||||||
{ name, writeShellApplication, fzf, ... }:
|
{ name, writeShellApplication, fzf, ... }:
|
||||||
|
|
||||||
writeShellApplication {
|
writeShellApplication {
|
||||||
inherit name;
|
inherit name;
|
||||||
runtimeInputs = [ fzf ];
|
runtimeInputs = [ fzf ];
|
||||||
|
|
|
||||||
|
|
@ -1,7 +1,5 @@
|
||||||
# taken from https://github.com/NixOS/nixpkgs/issues/186570#issuecomment-1627797219
|
# taken from https://github.com/NixOS/nixpkgs/issues/186570#issuecomment-1627797219
|
||||||
{ appimageTools, fetchurl, writeScriptBin, pkgs, ... }:
|
{ appimageTools, fetchurl, writeScriptBin, pkgs, ... }:
|
||||||
|
|
||||||
|
|
||||||
let
|
let
|
||||||
cura5 = appimageTools.wrapType2 rec {
|
cura5 = appimageTools.wrapType2 rec {
|
||||||
pname = "cura5";
|
pname = "cura5";
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,30 @@
|
||||||
{ self, name, writeShellApplication, emacs30-pgtk, sway, jq }:
|
{ name, writeShellApplication, emacs30-pgtk, sway, jq, ... }:
|
||||||
writeShellApplication {
|
writeShellApplication {
|
||||||
inherit name;
|
inherit name;
|
||||||
runtimeInputs = [ emacs30-pgtk sway jq ];
|
runtimeInputs = [ emacs30-pgtk sway jq ];
|
||||||
text = builtins.readFile "${self}/files/scripts/${name}.sh";
|
text = ''
|
||||||
|
wait=0
|
||||||
|
while :; do
|
||||||
|
case ''${1:-} in
|
||||||
|
-w | --wait)
|
||||||
|
wait=1
|
||||||
|
;;
|
||||||
|
*) break ;;
|
||||||
|
esac
|
||||||
|
shift
|
||||||
|
done
|
||||||
|
|
||||||
|
STR=$(swaymsg -t get_tree | jq -r 'recurse(.nodes[]) | select(.name == "__i3_scratch")' | grep kittyterm || true)
|
||||||
|
if [ "$STR" == "" ]; then
|
||||||
|
swaymsg '[title="kittyterm"]' scratchpad show
|
||||||
|
emacsclient -c -a "" "$@"
|
||||||
|
swaymsg '[title="kittyterm"]' scratchpad show
|
||||||
|
else
|
||||||
|
if [[ $wait -eq 0 ]]; then
|
||||||
|
emacsclient -n -c -a "" "$@"
|
||||||
|
else
|
||||||
|
emacsclient -c -a "" "$@"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
'';
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,26 @@
|
||||||
{ self, name, writeShellApplication }:
|
{ name, writeShellApplication, ... }:
|
||||||
writeShellApplication {
|
writeShellApplication {
|
||||||
inherit name;
|
inherit name;
|
||||||
text = builtins.readFile "${self}/files/scripts/${name}.sh";
|
text = ''
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
OLD_TRANSID=$(sudo btrfs subvolume find-new /mnt/root-blank 9999999)
|
||||||
|
OLD_TRANSID=''${OLD_TRANSID#transid marker was }
|
||||||
|
|
||||||
|
sudo btrfs subvolume find-new "/mnt/root" "$OLD_TRANSID" |
|
||||||
|
sed '$d' |
|
||||||
|
cut -f17- -d' ' |
|
||||||
|
sort |
|
||||||
|
uniq |
|
||||||
|
while read -r path; do
|
||||||
|
path="/$path"
|
||||||
|
if [ -L "$path" ]; then
|
||||||
|
: # The path is a symbolic link, so is probably handled by NixOS already
|
||||||
|
elif [ -d "$path" ]; then
|
||||||
|
: # The path is a directory, ignore
|
||||||
|
else
|
||||||
|
echo "$path"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
'';
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,4 @@
|
||||||
{ name, writeShellApplication, fzf, findutils, home-manager, ... }:
|
{ name, writeShellApplication, fzf, findutils, home-manager, ... }:
|
||||||
|
|
||||||
writeShellApplication {
|
writeShellApplication {
|
||||||
inherit name;
|
inherit name;
|
||||||
runtimeInputs = [ fzf findutils home-manager ];
|
runtimeInputs = [ fzf findutils home-manager ];
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,18 @@
|
||||||
{ self, name, writeShellApplication, jq }:
|
{ name, writeShellApplication, jq, ... }:
|
||||||
writeShellApplication {
|
writeShellApplication {
|
||||||
inherit name;
|
inherit name;
|
||||||
runtimeInputs = [ jq ];
|
runtimeInputs = [ jq ];
|
||||||
text = builtins.readFile "${self}/files/scripts/${name}.sh";
|
text = ''
|
||||||
|
WORKSPACE=$(niri msg -j workspaces | jq -r '.[] | select(.is_focused == true) | .id')
|
||||||
|
|
||||||
|
COUNT=$(niri msg -j windows | jq --argjson ws "$WORKSPACE" -r '.[] | select(.workspace_id == $ws and .is_floating == false) | .app_id' | wc -l)
|
||||||
|
|
||||||
|
while [[ $COUNT == "0" || $COUNT == "2" ]]; do
|
||||||
|
COUNT=$(niri msg -j windows | jq --argjson ws "$WORKSPACE" -r '.[] | select(.workspace_id == $ws and .is_floating == false) | .app_id' | wc -l)
|
||||||
|
done
|
||||||
|
|
||||||
|
if [[ $COUNT == "1" ]]; then
|
||||||
|
niri msg action maximize-column
|
||||||
|
fi
|
||||||
|
'';
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,12 @@
|
||||||
{ self, name, writeShellApplication, sway }:
|
{ name, writeShellApplication, sway, ... }:
|
||||||
writeShellApplication {
|
writeShellApplication {
|
||||||
inherit name;
|
inherit name;
|
||||||
runtimeInputs = [ sway ];
|
runtimeInputs = [ sway ];
|
||||||
text = builtins.readFile "${self}/files/scripts/${name}.sh";
|
text = ''
|
||||||
|
if swaymsg opacity plus 0.01 -q; then
|
||||||
|
swaymsg opacity 1
|
||||||
|
else
|
||||||
|
swaymsg opacity 0.95
|
||||||
|
fi
|
||||||
|
'';
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,58 @@
|
||||||
{ self, name, writeShellApplication, libnotify, pass, fuzzel, wtype }:
|
{ name, writeShellApplication, libnotify, pass, fuzzel, wtype, ... }:
|
||||||
writeShellApplication {
|
writeShellApplication {
|
||||||
inherit name;
|
inherit name;
|
||||||
runtimeInputs = [ libnotify (pass.withExtensions (exts: [ exts.pass-otp ])) fuzzel wtype ];
|
runtimeInputs = [ libnotify (pass.withExtensions (exts: [ exts.pass-otp ])) fuzzel wtype ];
|
||||||
text = builtins.readFile "${self}/files/scripts/${name}.sh";
|
text = ''
|
||||||
|
# Adapted from https://code.kulupu.party/thesuess/home-manager/src/branch/main/modules/river.nix
|
||||||
|
shopt -s nullglob globstar
|
||||||
|
|
||||||
|
otp=0
|
||||||
|
typeit=0
|
||||||
|
while :; do
|
||||||
|
case ''${1:-} in
|
||||||
|
-t | --type)
|
||||||
|
typeit=1
|
||||||
|
;;
|
||||||
|
-o | --otp)
|
||||||
|
otp=1
|
||||||
|
;;
|
||||||
|
*) break ;;
|
||||||
|
esac
|
||||||
|
shift
|
||||||
|
done
|
||||||
|
|
||||||
|
export PASSWORD_STORE_DIR=~/.local/share/password-store
|
||||||
|
prefix=''${PASSWORD_STORE_DIR-~/.local/share/password-store}
|
||||||
|
if [[ $otp -eq 0 ]]; then
|
||||||
|
password_files=("$prefix"/**/*.gpg)
|
||||||
|
else
|
||||||
|
password_files=("$prefix"/otp/**/*.gpg)
|
||||||
|
fi
|
||||||
|
password_files=("''${password_files[@]#"$prefix"/}")
|
||||||
|
password_files=("''${password_files[@]%.gpg}")
|
||||||
|
|
||||||
|
password=$(printf '%s\n' "''${password_files[@]}" | fuzzel --dmenu "$@")
|
||||||
|
|
||||||
|
[[ -n $password ]] || exit
|
||||||
|
if [[ $otp -eq 0 ]]; then
|
||||||
|
if [[ $typeit -eq 0 ]]; then
|
||||||
|
pass show -c "$password" &> /tmp/pass-fuzzel
|
||||||
|
else
|
||||||
|
pass show "$password" | {
|
||||||
|
IFS= read -r pass
|
||||||
|
printf %s "$pass"
|
||||||
|
} | wtype -
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
if [[ $typeit -eq 0 ]]; then
|
||||||
|
pass otp -c "$password" &> /tmp/pass-fuzzel
|
||||||
|
else
|
||||||
|
pass otp "$password" | {
|
||||||
|
IFS= read -r pass
|
||||||
|
printf %s "$pass"
|
||||||
|
} | wtype -
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
notify-send -u critical -a pass -t 1000 "Copied/Typed Password"
|
||||||
|
'';
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,13 @@
|
||||||
{ self, name, writeShellApplication }:
|
{ name, writeShellApplication, ... }:
|
||||||
writeShellApplication {
|
writeShellApplication {
|
||||||
inherit name;
|
inherit name;
|
||||||
text = builtins.readFile "${self}/files/scripts/${name}.sh";
|
text = ''
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
if [ ! -d "$(pwd)/.git" ]; then
|
||||||
|
git init
|
||||||
|
fi
|
||||||
|
nix flake init --template "$FLAKE"#"$1"
|
||||||
|
direnv allow
|
||||||
|
'';
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,4 @@
|
||||||
{ name, writeShellApplication, curl, ... }:
|
{ name, writeShellApplication, curl, ... }:
|
||||||
|
|
||||||
writeShellApplication {
|
writeShellApplication {
|
||||||
inherit name;
|
inherit name;
|
||||||
runtimeInputs = [ curl ];
|
runtimeInputs = [ curl ];
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,19 @@
|
||||||
{ self, name, writeShellApplication, libnotify, pass, wtype }:
|
{ name, writeShellApplication, libnotify, pass, wtype, ... }:
|
||||||
writeShellApplication {
|
writeShellApplication {
|
||||||
inherit name;
|
inherit name;
|
||||||
runtimeInputs = [ libnotify pass wtype ];
|
runtimeInputs = [ libnotify pass wtype ];
|
||||||
text = builtins.readFile "${self}/files/scripts/${name}.sh";
|
text = ''
|
||||||
|
shopt -s nullglob globstar
|
||||||
|
|
||||||
|
notify-send "$(env | grep -E 'WAYLAND|SWAY')"
|
||||||
|
|
||||||
|
password="$1"
|
||||||
|
|
||||||
|
pass show "$password" | {
|
||||||
|
IFS= read -r pass
|
||||||
|
printf %s "$pass"
|
||||||
|
} | wtype -
|
||||||
|
|
||||||
|
notify-send -u critical -a pass -t 1000 "Typed Password"
|
||||||
|
'';
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,18 @@
|
||||||
{ self, name, writeShellApplication, openssh }:
|
{ name, writeShellApplication, openssh, ... }:
|
||||||
writeShellApplication {
|
writeShellApplication {
|
||||||
inherit name;
|
inherit name;
|
||||||
runtimeInputs = [ openssh ];
|
runtimeInputs = [ openssh ];
|
||||||
text = builtins.readFile "${self}/files/scripts/${name}.sh";
|
text = ''
|
||||||
|
HISTFILE="$HOME"/.histfile
|
||||||
|
|
||||||
|
last_ssh_cmd=$(grep -E "ssh " "$HISTFILE" | sed -E 's/^: [0-9]+:[0-9]+;//' | grep "^ssh " | tail -1)
|
||||||
|
host=$(echo "$last_ssh_cmd" | sed -E 's/.*ssh ([^@ ]+@)?([^ ]+).*/\2/')
|
||||||
|
|
||||||
|
if [[ -n $host ]]; then
|
||||||
|
echo "Removing SSH host key for: $host"
|
||||||
|
ssh-keygen -R "$host"
|
||||||
|
else
|
||||||
|
echo "No valid SSH command found in history."
|
||||||
|
fi
|
||||||
|
'';
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,401 @@
|
||||||
{ self, name, writeShellApplication, openssh }:
|
{ name, writeShellApplication, openssh, ... }:
|
||||||
writeShellApplication {
|
writeShellApplication {
|
||||||
inherit name;
|
inherit name;
|
||||||
runtimeInputs = [ openssh ];
|
runtimeInputs = [ openssh ];
|
||||||
text = builtins.readFile "${self}/files/scripts/${name}.sh";
|
text = ''
|
||||||
|
# highly inspired by https://github.com/EmergentMind/nix-config/blob/dev/files/scripts/bootstrap-nixos.sh
|
||||||
|
set -eo pipefail
|
||||||
|
|
||||||
|
target_hostname=""
|
||||||
|
target_destination=""
|
||||||
|
target_arch=""
|
||||||
|
target_user="swarsel"
|
||||||
|
ssh_port="22"
|
||||||
|
persist_dir=""
|
||||||
|
disk_encryption=0
|
||||||
|
disk_encryption_args=""
|
||||||
|
no_disko_deps="false"
|
||||||
|
temp=$(mktemp -d)
|
||||||
|
|
||||||
|
function help_and_exit() {
|
||||||
|
echo
|
||||||
|
echo "Remotely installs SwarselSystem on a target machine including secret deployment."
|
||||||
|
echo
|
||||||
|
echo "USAGE: $0 -n <target_hostname> -d <target_destination> [OPTIONS]"
|
||||||
|
echo
|
||||||
|
echo "ARGS:"
|
||||||
|
echo " -n <target_hostname> specify target_hostname of the target host to deploy the nixos config on."
|
||||||
|
echo " -d <target_destination> specify ip or url to the target host."
|
||||||
|
echo " -a <targeit_arch> specify the architecture of the target host."
|
||||||
|
echo " target during install process."
|
||||||
|
echo
|
||||||
|
echo "OPTIONS:"
|
||||||
|
echo " -u <target_user> specify target_user with sudo access. nix-config will be cloned to their home."
|
||||||
|
echo " Default=''${target_user}."
|
||||||
|
echo " --port <ssh_port> specify the ssh port to use for remote access. Default=''${ssh_port}."
|
||||||
|
echo " --debug Enable debug mode."
|
||||||
|
echo " --no-disko-deps Upload only disk script and not dependencies (for use on low ram)."
|
||||||
|
echo " -h | --help Print this help."
|
||||||
|
exit 0
|
||||||
|
}
|
||||||
|
|
||||||
|
function cleanup() {
|
||||||
|
rm -rf "$temp"
|
||||||
|
rm -rf /tmp/disko-password
|
||||||
|
}
|
||||||
|
trap cleanup exit
|
||||||
|
|
||||||
|
function red() {
|
||||||
|
echo -e "\x1B[31m[!] $1 \x1B[0m"
|
||||||
|
if [ -n "''${2-}" ]; then
|
||||||
|
echo -e "\x1B[31m[!] $($2) \x1B[0m"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
function green() {
|
||||||
|
echo -e "\x1B[32m[+] $1 \x1B[0m"
|
||||||
|
if [ -n "''${2-}" ]; then
|
||||||
|
echo -e "\x1B[32m[+] $($2) \x1B[0m"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
function yellow() {
|
||||||
|
echo -e "\x1B[33m[*] $1 \x1B[0m"
|
||||||
|
if [ -n "''${2-}" ]; then
|
||||||
|
echo -e "\x1B[33m[*] $($2) \x1B[0m"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
function yes_or_no() {
|
||||||
|
echo -en "\x1B[32m[+] $* [y/n] (default: y): \x1B[0m"
|
||||||
|
while true; do
|
||||||
|
read -rp "" yn
|
||||||
|
yn=''${yn:-y}
|
||||||
|
case $yn in
|
||||||
|
[Yy]*) return 0 ;;
|
||||||
|
[Nn]*) return 1 ;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
}
|
||||||
|
|
||||||
|
function update_sops_file() {
|
||||||
|
key_name=$1
|
||||||
|
key_type=$2
|
||||||
|
key=$3
|
||||||
|
|
||||||
|
if [ ! "$key_type" == "hosts" ] && [ ! "$key_type" == "users" ]; then
|
||||||
|
red "Invalid key type passed to update_sops_file. Must be either 'hosts' or 'users'."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
cd "''${git_root}"
|
||||||
|
|
||||||
|
SOPS_FILE=".sops.yaml"
|
||||||
|
sed -i "{
|
||||||
|
# Remove any * and & entries for this host
|
||||||
|
/[*&]$key_name/ d;
|
||||||
|
# Inject a new age: entry
|
||||||
|
# n matches the first line following age: and p prints it, then we transform it while reusing the spacing
|
||||||
|
/age:/{n; p; s/\(.*- \*\).*/\1$key_name/};
|
||||||
|
# Inject a new hosts or user: entry
|
||||||
|
/&$key_type/{n; p; s/\(.*- &\).*/\1$key_name $key/}
|
||||||
|
}" $SOPS_FILE
|
||||||
|
green "Updating .sops.yaml"
|
||||||
|
cd -
|
||||||
|
}
|
||||||
|
|
||||||
|
while [[ $# -gt 0 ]]; do
|
||||||
|
case "$1" in
|
||||||
|
-n)
|
||||||
|
shift
|
||||||
|
target_hostname=$1
|
||||||
|
;;
|
||||||
|
-d)
|
||||||
|
shift
|
||||||
|
target_destination=$1
|
||||||
|
;;
|
||||||
|
-a)
|
||||||
|
shift
|
||||||
|
target_arch=$1
|
||||||
|
;;
|
||||||
|
-u)
|
||||||
|
shift
|
||||||
|
target_user=$1
|
||||||
|
;;
|
||||||
|
--port)
|
||||||
|
shift
|
||||||
|
ssh_port=$1
|
||||||
|
;;
|
||||||
|
--no-disko-deps)
|
||||||
|
no_disko_deps="true"
|
||||||
|
;;
|
||||||
|
--debug)
|
||||||
|
set -x
|
||||||
|
;;
|
||||||
|
-h | --help) help_and_exit ;;
|
||||||
|
*)
|
||||||
|
echo "Invalid option detected."
|
||||||
|
help_and_exit
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
shift
|
||||||
|
done
|
||||||
|
|
||||||
|
if [[ $target_arch == "" || $target_destination == "" || $target_hostname == "" ]]; then
|
||||||
|
red "error: target_arch, target_destination or target_hostname not set."
|
||||||
|
help_and_exit
|
||||||
|
fi
|
||||||
|
|
||||||
|
LOCKED="$(nix eval ~/.dotfiles#nixosConfigurations."$target_hostname".config.node.lockFromBootstrapping)"
|
||||||
|
if [[ $LOCKED == "true" ]]; then
|
||||||
|
red "THIS SYSTEM IS LOCKED FROM BOOTSTRAPPING - set 'node.lockFromBootstrapping = lib.mkForce false;' to proceed"
|
||||||
|
exit
|
||||||
|
fi
|
||||||
|
|
||||||
|
green "~SwarselSystems~ remote installer"
|
||||||
|
green "Reading system information for $target_hostname ..."
|
||||||
|
|
||||||
|
DISK="$(nix eval --raw ~/.dotfiles#nixosConfigurations."$target_hostname".config.swarselsystems.rootDisk)"
|
||||||
|
green "Root Disk: $DISK"
|
||||||
|
|
||||||
|
CRYPTED="$(nix eval ~/.dotfiles#nixosConfigurations."$target_hostname".config.swarselsystems.isCrypted)"
|
||||||
|
if [[ $CRYPTED == "true" ]]; then
|
||||||
|
green "Encryption: ✓"
|
||||||
|
disk_encryption=1
|
||||||
|
disk_encryption_args=(
|
||||||
|
--disk-encryption-keys
|
||||||
|
/tmp/disko-password
|
||||||
|
/tmp/disko-password
|
||||||
|
)
|
||||||
|
else
|
||||||
|
red "Encryption: X"
|
||||||
|
disk_encryption=0
|
||||||
|
fi
|
||||||
|
|
||||||
|
IMPERMANENCE="$(nix eval ~/.dotfiles#nixosConfigurations."$target_hostname".config.swarselsystems.isImpermanence)"
|
||||||
|
if [[ $IMPERMANENCE == "true" ]]; then
|
||||||
|
green "Impermanence: ✓"
|
||||||
|
persist_dir="/persist"
|
||||||
|
else
|
||||||
|
red "Impermanence: X"
|
||||||
|
persist_dir=""
|
||||||
|
fi
|
||||||
|
|
||||||
|
SWAP="$(nix eval ~/.dotfiles#nixosConfigurations."$target_hostname".config.swarselsystems.isSwap)"
|
||||||
|
if [[ $SWAP == "true" ]]; then
|
||||||
|
green "Swap: ✓"
|
||||||
|
else
|
||||||
|
red "Swap: X"
|
||||||
|
fi
|
||||||
|
|
||||||
|
SECUREBOOT="$(nix eval ~/.dotfiles#nixosConfigurations."$target_hostname".config.swarselsystems.isSecureBoot)"
|
||||||
|
if [[ $SECUREBOOT == "true" ]]; then
|
||||||
|
green "Secure Boot: ✓"
|
||||||
|
else
|
||||||
|
red "Secure Boot: X"
|
||||||
|
fi
|
||||||
|
|
||||||
|
ssh_cmd="ssh -oport=''${ssh_port} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -t $target_user@$target_destination"
|
||||||
|
# ssh_root_cmd=$(echo "$ssh_cmd" | sed "s|''${target_user}@|root@|") # uses @ in the sed switch to avoid it triggering on the $ssh_key value
|
||||||
|
ssh_root_cmd=''${ssh_cmd/''${target_user}@/root@}
|
||||||
|
scp_cmd="scp -oport=''${ssh_port} -o StrictHostKeyChecking=no"
|
||||||
|
|
||||||
|
if [[ -z ''${FLAKE} ]]; then
|
||||||
|
FLAKE=/home/"$target_user"/.dotfiles
|
||||||
|
fi
|
||||||
|
if [ ! -d "$FLAKE" ]; then
|
||||||
|
cd /home/"$target_user"
|
||||||
|
yellow "Flake directory not found - cloning repository from GitHub"
|
||||||
|
git clone git@github.com:Swarsel/.dotfiles.git || (yellow "Could not clone repository via SSH - defaulting to HTTPS" && git clone https://github.com/Swarsel/.dotfiles.git)
|
||||||
|
FLAKE=/home/"$target_user"/.dotfiles
|
||||||
|
fi
|
||||||
|
|
||||||
|
cd "$FLAKE"
|
||||||
|
|
||||||
|
rm install/flake.lock || true
|
||||||
|
git_root=$(git rev-parse --show-toplevel)
|
||||||
|
# ------------------------
|
||||||
|
green "Wiping known_hosts of $target_destination"
|
||||||
|
sed -i "/$target_hostname/d; /$target_destination/d" ~/.ssh/known_hosts
|
||||||
|
# ------------------------
|
||||||
|
green "Preparing a new ssh_host_ed25519_key pair for $target_hostname."
|
||||||
|
# Create the directory where sshd expects to find the host keys
|
||||||
|
install -d -m755 "$temp/$persist_dir/etc/ssh"
|
||||||
|
# Generate host ssh key pair without a passphrase
|
||||||
|
ssh-keygen -t ed25519 -f "$temp/$persist_dir/etc/ssh/ssh_host_ed25519_key" -C root@"$target_hostname" -N ""
|
||||||
|
# Set the correct permissions so sshd will accept the key
|
||||||
|
chmod 600 "$temp/$persist_dir/etc/ssh/ssh_host_ed25519_key"
|
||||||
|
echo "Adding ssh host fingerprint at $target_destination to ~/.ssh/known_hosts"
|
||||||
|
# This will fail if we already know the host, but that's fine
|
||||||
|
ssh-keyscan -p "$ssh_port" "$target_destination" >> ~/.ssh/known_hosts || true
|
||||||
|
# ------------------------
|
||||||
|
# when using luks, disko expects a passphrase on /tmp/disko-password, so we set it for now and will update the passphrase later
|
||||||
|
# via the config
|
||||||
|
if [ "$disk_encryption" -eq 1 ]; then
|
||||||
|
while true; do
|
||||||
|
green "Set disk encryption passphrase:"
|
||||||
|
read -rs luks_passphrase
|
||||||
|
green "Please confirm passphrase:"
|
||||||
|
read -rs luks_passphrase_confirm
|
||||||
|
if [[ $luks_passphrase == "$luks_passphrase_confirm" ]]; then
|
||||||
|
echo "$luks_passphrase" > /tmp/disko-password
|
||||||
|
$ssh_root_cmd "echo '$luks_passphrase' > /tmp/disko-password"
|
||||||
|
break
|
||||||
|
else
|
||||||
|
red "Passwords do not match"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
# ------------------------
|
||||||
|
green "Generating hardware-config.nix for $target_hostname and adding it to the nix-config."
|
||||||
|
$ssh_root_cmd "nixos-generate-config --force --no-filesystems --root /mnt"
|
||||||
|
|
||||||
|
mkdir -p "$FLAKE"/hosts/nixos/"$target_arch"/"$target_hostname"
|
||||||
|
$scp_cmd root@"$target_destination":/mnt/etc/nixos/hardware-configuration.nix "''${git_root}"/hosts/nixos/"$target_arch"/"$target_hostname"/hardware-configuration.nix
|
||||||
|
# ------------------------
|
||||||
|
green "Generating hostkey for ssh initrd"
|
||||||
|
$ssh_root_cmd "mkdir -p $temp/etc/secrets/initrd /etc/secrets/initrd"
|
||||||
|
$ssh_root_cmd "ssh-keygen -t ed25519 -N '''' -f $temp/etc/secrets/initrd/ssh_host_ed25519_key"
|
||||||
|
$ssh_root_cmd "cp $temp/etc/secrets/initrd/ssh_host_ed25519_key /etc/secrets/initrd/ssh_host_ed25519_key"
|
||||||
|
# ------------------------
|
||||||
|
|
||||||
|
green "Deploying minimal NixOS installation on $target_destination"
|
||||||
|
|
||||||
|
if [[ $no_disko_deps == "true" ]]; then
|
||||||
|
green "Building without disko dependencies (using custom kexec)"
|
||||||
|
nix run github:nix-community/nixos-anywhere/1.10.0 -- "''${disk_encryption_args[@]}" --no-disko-deps --ssh-port "$ssh_port" --extra-files "$temp" --flake ./install#"$target_hostname" --kexec "$(nix build --print-out-paths .#packages."$target_arch".swarsel-kexec)/swarsel-kexec-$target_arch.tar.gz" root@"$target_destination"
|
||||||
|
else
|
||||||
|
green "Building with disko dependencies (using nixos-images kexec)"
|
||||||
|
nix run github:nix-community/nixos-anywhere/1.10.0 -- "''${disk_encryption_args[@]}" --ssh-port "$ssh_port" --extra-files "$temp" --flake ./install#"$target_hostname" root@"$target_destination"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "Updating ssh host fingerprint at $target_destination to ~/.ssh/known_hosts"
|
||||||
|
ssh-keyscan -p "$ssh_port" "$target_destination" >> ~/.ssh/known_hosts || true
|
||||||
|
# ------------------------
|
||||||
|
|
||||||
|
while true; do
|
||||||
|
read -rp "Press Enter to continue once the remote host has finished booting."
|
||||||
|
if nc -z "$target_destination" "''${ssh_port}" 2> /dev/null; then
|
||||||
|
green "$target_destination is booted. Continuing..."
|
||||||
|
break
|
||||||
|
else
|
||||||
|
yellow "$target_destination is not yet ready."
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
# ------------------------
|
||||||
|
|
||||||
|
if [[ $SECUREBOOT == "true" ]]; then
|
||||||
|
green "Setting up secure boot keys"
|
||||||
|
$ssh_root_cmd "mkdir -p /var/lib/sbctl"
|
||||||
|
read -ra scp_call <<< "''${scp_cmd}"
|
||||||
|
sudo "''${scp_call[@]}" -r /var/lib/sbctl root@"$target_destination":/var/lib/
|
||||||
|
$ssh_root_cmd "sbctl enroll-keys --ignore-immutable --microsoft || true"
|
||||||
|
fi
|
||||||
|
# ------------------------
|
||||||
|
|
||||||
|
if [ -n "$persist_dir" ]; then
|
||||||
|
$ssh_root_cmd "cp /etc/machine-id $persist_dir/etc/machine-id || true"
|
||||||
|
$ssh_root_cmd "cp -R /etc/ssh/ $persist_dir/etc/ssh/ || true"
|
||||||
|
fi
|
||||||
|
# ------------------------
|
||||||
|
green "Generating an age key based on the new ssh_host_ed25519_key."
|
||||||
|
target_key=$(
|
||||||
|
ssh-keyscan -p "$ssh_port" -t ssh-ed25519 "$target_destination" 2>&1 |
|
||||||
|
grep ssh-ed25519 |
|
||||||
|
cut -f2- -d" " ||
|
||||||
|
(
|
||||||
|
red "Failed to get ssh key. Host down?"
|
||||||
|
exit 1
|
||||||
|
)
|
||||||
|
)
|
||||||
|
host_age_key=$(nix shell nixpkgs#ssh-to-age.out -c sh -c "echo $target_key | ssh-to-age")
|
||||||
|
|
||||||
|
if grep -qv '^age1' <<< "$host_age_key"; then
|
||||||
|
red "The result from generated age key does not match the expected format."
|
||||||
|
yellow "Result: $host_age_key"
|
||||||
|
yellow "Expected format: age1xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
|
||||||
|
exit 1
|
||||||
|
else
|
||||||
|
echo "$host_age_key"
|
||||||
|
fi
|
||||||
|
|
||||||
|
green "Updating nix-secrets/.sops.yaml"
|
||||||
|
update_sops_file "$target_hostname" "hosts" "$host_age_key"
|
||||||
|
yellow ".sops.yaml has been updated. There may be superfluous entries, you might need to edit manually."
|
||||||
|
if yes_or_no "Do you want to manually edit .sops.yaml now?"; then
|
||||||
|
vim "''${git_root}"/.sops.yaml
|
||||||
|
fi
|
||||||
|
green "Updating all secrets files to reflect updates .sops.yaml"
|
||||||
|
sops updatekeys --yes --enable-local-keyservice "''${git_root}"/hosts/nixos/"$target_arch"/"$target_hostname"/secrets/* || true
|
||||||
|
# --------------------------
|
||||||
|
green "Making ssh_host_ed25519_key available to home-manager for user $target_user"
|
||||||
|
sed -i "/$target_hostname/d; /$target_destination/d" ~/.ssh/known_hosts
|
||||||
|
$ssh_root_cmd "mkdir -p /home/$target_user/.ssh; chown -R $target_user:users /home/$target_user/.ssh/"
|
||||||
|
$scp_cmd root@"$target_destination":/etc/ssh/ssh_host_ed25519_key root@"$target_destination":/home/"$target_user"/.ssh/ssh_host_ed25519_key
|
||||||
|
$ssh_root_cmd "chown $target_user:users /home/$target_user/.ssh/ssh_host_ed25519_key"
|
||||||
|
# __________________________
|
||||||
|
|
||||||
|
if yes_or_no "Add ssh host fingerprints for git upstream repositories? (This is needed for building the full config)"; then
|
||||||
|
green "Adding ssh host fingerprints for git{lab,hub}"
|
||||||
|
$ssh_cmd "mkdir -p /home/$target_user/.ssh/; ssh-keyscan -t ssh-ed25519 gitlab.com github.com | tee /home/$target_user/.ssh/known_hosts"
|
||||||
|
$ssh_root_cmd "mkdir -p /root/.ssh/; ssh-keyscan -t ssh-ed25519 gitlab.com github.com | tee /root/.ssh/known_hosts"
|
||||||
|
fi
|
||||||
|
# --------------------------
|
||||||
|
|
||||||
|
if yes_or_no "Do you want to copy your full nix-config and nix-secrets to $target_hostname?"; then
|
||||||
|
green "Adding ssh host fingerprint at $target_destination to ~/.ssh/known_hosts"
|
||||||
|
ssh-keyscan -p "$ssh_port" "$target_destination" >> ~/.ssh/known_hosts || true
|
||||||
|
green "Copying full nix-config to $target_hostname"
|
||||||
|
cd "''${git_root}"
|
||||||
|
just sync "$target_user" "$target_destination"
|
||||||
|
|
||||||
|
if [ -n "$persist_dir" ]; then
|
||||||
|
$ssh_root_cmd "cp -r /home/$target_user/.dotfiles $persist_dir/.dotfiles || true"
|
||||||
|
$ssh_root_cmd "cp -r /home/$target_user/.ssh $persist_dir/.ssh || true"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if yes_or_no "Do you want to rebuild immediately?"; then
|
||||||
|
green "Building nix-config for $target_hostname"
|
||||||
|
# yellow "Reminder: The password is 'setup'"
|
||||||
|
$ssh_root_cmd "mkdir -p /root/.local/share/nix/; printf '{\"extra-substituters\":{\"https://nix-community.cachix.org\":true,\"https://nix-community.cachix.org https://cache.ngi0.nixos.org/\":true},\"extra-trusted-public-keys\":{\"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=\":true,\"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs= cache.ngi0.nixos.org-1:KqH5CBLNSyX184S9BKZJo1LxrxJ9ltnY2uAs5c/f1MA=\":true}}' | tee /root/.local/share/nix/trusted-settings.json"
|
||||||
|
# $ssh_cmd -oForwardAgent=yes "cd .dotfiles && sudo nixos-rebuild --show-trace --flake .#$target_hostname switch"
|
||||||
|
store_path=$(nix build --no-link --print-out-paths .#nixosConfigurations."$target_hostname".config.system.build.toplevel)
|
||||||
|
green "Copying generation to $target_hostname"
|
||||||
|
nix copy --to "ssh://root@$target_destination" "$store_path"
|
||||||
|
# prev_system=$($ssh_root_cmd " readlink -e /nix/var/nix/profiles/system")
|
||||||
|
green "Linking generation in bootloader"
|
||||||
|
$ssh_root_cmd "/run/current-system/sw/bin/nix-env --profile /nix/var/nix/profiles/system --set $store_path"
|
||||||
|
green "Setting generation to activate upon next boot"
|
||||||
|
$ssh_root_cmd "$store_path/bin/switch-to-configuration boot"
|
||||||
|
else
|
||||||
|
echo
|
||||||
|
green "NixOS was successfully installed!"
|
||||||
|
echo "Post-install config build instructions:"
|
||||||
|
echo "To copy nix-config from this machine to the $target_hostname, run the following command from ~/nix-config"
|
||||||
|
echo "just sync $target_user $target_destination"
|
||||||
|
echo "To rebuild, sign into $target_hostname and run the following command from ~/nix-config"
|
||||||
|
echo "cd nix-config"
|
||||||
|
# see above FIXME:(bootstrap)
|
||||||
|
echo "sudo nixos-rebuild .pre-commit-config.yaml show-trace --flake .#$target_hostname switch"
|
||||||
|
# echo "just rebuild"
|
||||||
|
echo
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
green "NixOS was successfully installed!"
|
||||||
|
if yes_or_no "You can now commit and push the nix-config, which includes the hardware-configuration.nix for $target_hostname?"; then
|
||||||
|
cd "''${git_root}"
|
||||||
|
deadnix hosts/nixos/"$target_arch"/"$target_hostname"/hardware-configuration.nix -qe
|
||||||
|
nixpkgs--fmt hosts/nixos/"$target_arch"/"$target_hostname"/hardware-configuration.nix
|
||||||
|
(.pre-commit-config.yaml mit run --all-files 2> /dev/null || true) &&
|
||||||
|
git add "$git_root/hosts/nixos/$target_arch/$target_hostname/hardware-configuration.nix" &&
|
||||||
|
git add "$git_root/.sops.yaml" &&
|
||||||
|
git add "$git_root/secrets" &&
|
||||||
|
(git commit -m "feat: deployed $target_hostname" || true) && git push
|
||||||
|
fi
|
||||||
|
|
||||||
|
if yes_or_no "Reboot now?"; then
|
||||||
|
$ssh_root_cmd "reboot"
|
||||||
|
fi
|
||||||
|
|
||||||
|
rm -rf /tmp/disko-password
|
||||||
|
'';
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,9 @@
|
||||||
{ self, name, writeShellApplication, sway }:
|
{ name, writeShellApplication, sway, ... }:
|
||||||
writeShellApplication {
|
writeShellApplication {
|
||||||
inherit name;
|
inherit name;
|
||||||
runtimeInputs = [ sway ];
|
runtimeInputs = [ sway ];
|
||||||
text = builtins.readFile "${self}/files/scripts/${name}.sh";
|
text = ''
|
||||||
|
swaymsg "output * power on" > /dev/null 2>&1 || true
|
||||||
|
swaymsg "output * dpms on" > /dev/null 2>&1 || true
|
||||||
|
'';
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,195 @@
|
||||||
{ self, name, writeShellApplication, git }:
|
{ name, writeShellApplication, git, ... }:
|
||||||
writeShellApplication {
|
writeShellApplication {
|
||||||
inherit name;
|
inherit name;
|
||||||
runtimeInputs = [ git ];
|
runtimeInputs = [ git ];
|
||||||
text = builtins.readFile "${self}/files/scripts/${name}.sh";
|
text = ''
|
||||||
|
set -eo pipefail
|
||||||
|
|
||||||
|
target_config="hotel"
|
||||||
|
target_hostname="hotel"
|
||||||
|
target_user="swarsel"
|
||||||
|
target_arch=""
|
||||||
|
persist_dir=""
|
||||||
|
target_disk="/dev/vda"
|
||||||
|
disk_encryption=0
|
||||||
|
|
||||||
|
function help_and_exit() {
|
||||||
|
echo
|
||||||
|
echo "Locally installs SwarselSystem on this machine."
|
||||||
|
echo
|
||||||
|
echo "USAGE: $0 -n <target_config> -d <target_disk> [OPTIONS]"
|
||||||
|
echo
|
||||||
|
echo "ARGS:"
|
||||||
|
echo " -n <target_config> specify the nixos config to deploy."
|
||||||
|
echo " Default: hotel"
|
||||||
|
echo " -d <target_disk> specify disk to install on."
|
||||||
|
echo " Default: /dev/vda"
|
||||||
|
echo " -u <target_user> specify user to deploy for."
|
||||||
|
echo " Default: swarsel"
|
||||||
|
echo " -a <target_arch> specify target architecture."
|
||||||
|
echo " -h | --help Print this help."
|
||||||
|
exit 0
|
||||||
|
}
|
||||||
|
|
||||||
|
function red() {
|
||||||
|
echo -e "\x1B[31m[!] $1 \x1B[0m"
|
||||||
|
if [ -n "''${2-}" ]; then
|
||||||
|
echo -e "\x1B[31m[!] $($2) \x1B[0m"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
function green() {
|
||||||
|
echo -e "\x1B[32m[+] $1 \x1B[0m"
|
||||||
|
if [ -n "''${2-}" ]; then
|
||||||
|
echo -e "\x1B[32m[+] $($2) \x1B[0m"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
function yellow() {
|
||||||
|
echo -e "\x1B[33m[*] $1 \x1B[0m"
|
||||||
|
if [ -n "''${2-}" ]; then
|
||||||
|
echo -e "\x1B[33m[*] $($2) \x1B[0m"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
while [[ $# -gt 0 ]]; do
|
||||||
|
case "$1" in
|
||||||
|
-n)
|
||||||
|
shift
|
||||||
|
target_config=$1
|
||||||
|
target_hostname=$1
|
||||||
|
;;
|
||||||
|
-u)
|
||||||
|
shift
|
||||||
|
target_user=$1
|
||||||
|
;;
|
||||||
|
-d)
|
||||||
|
shift
|
||||||
|
target_disk=$1
|
||||||
|
;;
|
||||||
|
-a)
|
||||||
|
shift
|
||||||
|
target_arch=$1
|
||||||
|
;;
|
||||||
|
-h | --help) help_and_exit ;;
|
||||||
|
*)
|
||||||
|
echo "Invalid option detected."
|
||||||
|
help_and_exit
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
shift
|
||||||
|
done
|
||||||
|
|
||||||
|
function cleanup() {
|
||||||
|
sudo rm -rf .cache/nix
|
||||||
|
sudo rm -rf /root/.cache/nix
|
||||||
|
}
|
||||||
|
trap cleanup exit
|
||||||
|
|
||||||
|
if [[ $target_arch == "" || $target_hostname == "" ]]; then
|
||||||
|
red "error: target_arch or target_hostname not set."
|
||||||
|
help_and_exit
|
||||||
|
fi
|
||||||
|
|
||||||
|
green "~SwarselSystems~ local installer"
|
||||||
|
|
||||||
|
cd /home/"$target_user"
|
||||||
|
|
||||||
|
sudo rm -rf /root/.cache/nix
|
||||||
|
sudo rm -rf .cache/nix
|
||||||
|
sudo rm -rf .dotfiles
|
||||||
|
|
||||||
|
green "Cloning repository from GitHub"
|
||||||
|
git clone https://github.com/Swarsel/.dotfiles.git
|
||||||
|
|
||||||
|
local_keys=$(ssh-add -L || true)
|
||||||
|
pub_key=$(cat /home/"$target_user"/.dotfiles/secrets/public/ssh/yubikey.pub)
|
||||||
|
read -ra pub_arr <<< "$pub_key"
|
||||||
|
|
||||||
|
cd .dotfiles
|
||||||
|
if [[ $local_keys != *"''${pub_arr[1]}"* ]]; then
|
||||||
|
yellow "The ssh key for this configuration is not available."
|
||||||
|
green "Adjusting flake.nix so that the configuration is buildable ..."
|
||||||
|
sed -i '/vbc-nix = {/,/^[[:space:]]*};/d' flake.nix
|
||||||
|
sed -i '/[[:space:]]*\/\/ (inputs.vbc-nix.overlays.default final prev)/d' overlays/default.nix
|
||||||
|
nix flake update vbc-nix
|
||||||
|
git add .
|
||||||
|
else
|
||||||
|
green "Valid SSH key found! Continuing with installation"
|
||||||
|
fi
|
||||||
|
|
||||||
|
green "Reading system information for $target_config ..."
|
||||||
|
DISK="$(nix eval --raw ~/.dotfiles#nixosConfigurations."$target_hostname".config.swarselsystems.rootDisk)"
|
||||||
|
green "Root Disk in config: $DISK - Root Disk passed in cli: $target_disk"
|
||||||
|
|
||||||
|
CRYPTED="$(nix eval ~/.dotfiles#nixosConfigurations."$target_hostname".config.swarselsystems.isCrypted)"
|
||||||
|
if [[ $CRYPTED == "true" ]]; then
|
||||||
|
green "Encryption: ✓"
|
||||||
|
disk_encryption=1
|
||||||
|
else
|
||||||
|
red "Encryption: X"
|
||||||
|
disk_encryption=0
|
||||||
|
fi
|
||||||
|
|
||||||
|
IMPERMANENCE="$(nix eval ~/.dotfiles#nixosConfigurations."$target_hostname".config.swarselsystems.isImpermanence)"
|
||||||
|
if [[ $IMPERMANENCE == "true" ]]; then
|
||||||
|
green "Impermanence: ✓"
|
||||||
|
persist_dir="/persist"
|
||||||
|
else
|
||||||
|
red "Impermanence: X"
|
||||||
|
persist_dir=""
|
||||||
|
fi
|
||||||
|
|
||||||
|
SWAP="$(nix eval ~/.dotfiles#nixosConfigurations."$target_hostname".config.swarselsystems.isSwap)"
|
||||||
|
if [[ $SWAP == "true" ]]; then
|
||||||
|
green "Swap: ✓"
|
||||||
|
else
|
||||||
|
red "Swap: X"
|
||||||
|
fi
|
||||||
|
|
||||||
|
SECUREBOOT="$(nix eval ~/.dotfiles#nixosConfigurations."$target_hostname".config.swarselsystems.isSecureBoot)"
|
||||||
|
if [[ $SECUREBOOT == "true" ]]; then
|
||||||
|
green "Secure Boot: ✓"
|
||||||
|
else
|
||||||
|
red "Secure Boot: X"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ "$disk_encryption" -eq 1 ]; then
|
||||||
|
while true; do
|
||||||
|
green "Set disk encryption passphrase:"
|
||||||
|
read -rs luks_passphrase
|
||||||
|
green "Please confirm passphrase:"
|
||||||
|
read -rs luks_passphrase_confirm
|
||||||
|
if [[ $luks_passphrase == "$luks_passphrase_confirm" ]]; then
|
||||||
|
echo "$luks_passphrase" > /tmp/disko-password
|
||||||
|
break
|
||||||
|
else
|
||||||
|
red "Passwords do not match"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
|
||||||
|
green "Setting up disk ..."
|
||||||
|
if [[ $target_config == "hotel" ]]; then
|
||||||
|
sudo nix --experimental-features "nix-command flakes" run github:nix-community/disko/v1.10.0 -- --mode destroy,format,mount --flake .#"$target_config" --yes-wipe-all-disks --arg diskDevice "$target_disk"
|
||||||
|
else
|
||||||
|
sudo nix --experimental-features "nix-command flakes" run github:nix-community/disko/latest -- --mode destroy,format,mount --flake .#"$target_config" --yes-wipe-all-disks
|
||||||
|
fi
|
||||||
|
sudo mkdir -p /mnt/"$persist_dir"/home/"$target_user"/
|
||||||
|
sudo cp -r /home/"$target_user"/.dotfiles /mnt/"$persist_dir"/home/"$target_user"/
|
||||||
|
sudo chown -R 1000:100 /mnt/"$persist_dir"/home/"$target_user"
|
||||||
|
|
||||||
|
green "Generating hardware configuration ..."
|
||||||
|
sudo nixos-generate-config --root /mnt --no-filesystems --dir /home/"$target_user"/.dotfiles/hosts/nixos/"$target_arch"/"$target_config"/
|
||||||
|
|
||||||
|
git add /home/"$target_user"/.dotfiles/hosts/nixos/"$target_arch"/"$target_config"/hardware-configuration.nix
|
||||||
|
sudo mkdir -p /root/.local/share/nix/
|
||||||
|
printf '{\"extra-substituters\":{\"https://nix-community.cachix.org\":true,\"https://nix-community.cachix.org https://cache.ngi0.nixos.org/\":true},\"extra-trusted-public-keys\":{\"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=\":true,\"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs= cache.ngi0.nixos.org-1:KqH5CBLNSyX184S9BKZJo1LxrxJ9ltnY2uAs5c/f1MA=\":true}}' | sudo tee /root/.local/share/nix/trusted-settings.json > /dev/null
|
||||||
|
green "Installing flake $target_config"
|
||||||
|
|
||||||
|
store_path=$(nix build --no-link --print-out-paths .#nixosConfigurationsMinimal."$target_config".config.system.build.toplevel)
|
||||||
|
green "Linking generation in bootloader"
|
||||||
|
sudo "/run/current-system/sw/bin/nix-env --profile /nix/var/nix/profiles/system --set $store_path"
|
||||||
|
green "Setting generation to activate upon next boot"
|
||||||
|
sudo "$store_path/bin/switch-to-configuration boot"
|
||||||
|
green "Installation finished! Reboot to see changes"
|
||||||
|
'';
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,79 @@
|
||||||
{ self, name, writeShellApplication, git }:
|
{ name, writeShellApplication, git, ... }:
|
||||||
writeShellApplication {
|
writeShellApplication {
|
||||||
inherit name;
|
inherit name;
|
||||||
runtimeInputs = [ git ];
|
runtimeInputs = [ git ];
|
||||||
text = builtins.readFile "${self}/files/scripts/${name}.sh";
|
text = ''
|
||||||
|
set -eo pipefail
|
||||||
|
|
||||||
|
target_config="hotel"
|
||||||
|
target_user="swarsel"
|
||||||
|
|
||||||
|
function help_and_exit() {
|
||||||
|
echo
|
||||||
|
echo "Locally installs SwarselSystem on this machine."
|
||||||
|
echo
|
||||||
|
echo "USAGE: $0 -d <disk> [OPTIONS]"
|
||||||
|
echo
|
||||||
|
echo "ARGS:"
|
||||||
|
echo " -d <disk> specify disk to install on."
|
||||||
|
echo " -n <target_config> specify the nixos config to deploy."
|
||||||
|
echo " Default: hotel"
|
||||||
|
echo " Default: hotel"
|
||||||
|
echo " -u <target_user> specify user to deploy for."
|
||||||
|
echo " Default: swarsel"
|
||||||
|
echo " -h | --help Print this help."
|
||||||
|
exit 0
|
||||||
|
}
|
||||||
|
|
||||||
|
function green() {
|
||||||
|
echo -e "\x1B[32m[+] $1 \x1B[0m"
|
||||||
|
if [ -n "''${2-}" ]; then
|
||||||
|
echo -e "\x1B[32m[+] $($2) \x1B[0m"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
while [[ $# -gt 0 ]]; do
|
||||||
|
case "$1" in
|
||||||
|
-n)
|
||||||
|
shift
|
||||||
|
target_config=$1
|
||||||
|
;;
|
||||||
|
-u)
|
||||||
|
shift
|
||||||
|
target_user=$1
|
||||||
|
;;
|
||||||
|
-h | --help) help_and_exit ;;
|
||||||
|
*)
|
||||||
|
echo "Invalid option detected."
|
||||||
|
help_and_exit
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
shift
|
||||||
|
done
|
||||||
|
|
||||||
|
function cleanup() {
|
||||||
|
sudo rm -rf .cache/nix
|
||||||
|
sudo rm -rf /root/.cache/nix
|
||||||
|
}
|
||||||
|
trap cleanup exit
|
||||||
|
|
||||||
|
sudo rm -rf .cache/nix
|
||||||
|
sudo rm -rf /root/.cache/nix
|
||||||
|
|
||||||
|
green "~SwarselSystems~ remote post-installer"
|
||||||
|
|
||||||
|
cd /home/"$target_user"/.dotfiles
|
||||||
|
|
||||||
|
SECUREBOOT="$(nix eval ~/.dotfiles#nixosConfigurations."$target_config".config.swarselsystems.isSecureBoot)"
|
||||||
|
|
||||||
|
if [[ $SECUREBOOT == "true" ]]; then
|
||||||
|
green "Setting up secure boot keys"
|
||||||
|
sudo mkdir -p /var/lib/sbctl
|
||||||
|
sbctl create-keys || true
|
||||||
|
sbctl enroll-keys --ignore-immutable --microsoft || true
|
||||||
|
fi
|
||||||
|
|
||||||
|
sudo nixos-rebuild --flake .#"$target_config" switch
|
||||||
|
green "Post-install finished!"
|
||||||
|
'';
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,117 @@
|
||||||
{ self, name, writeShellApplication, git }:
|
{ name, writeShellApplication, git, ... }:
|
||||||
writeShellApplication {
|
writeShellApplication {
|
||||||
inherit name;
|
inherit name;
|
||||||
runtimeInputs = [ git ];
|
runtimeInputs = [ git ];
|
||||||
text = builtins.readFile "${self}/files/scripts/${name}.sh";
|
text = ''
|
||||||
|
set -eo pipefail
|
||||||
|
|
||||||
|
target_config="hotel"
|
||||||
|
target_arch=""
|
||||||
|
target_user="swarsel"
|
||||||
|
|
||||||
|
function help_and_exit() {
|
||||||
|
echo
|
||||||
|
echo "Builds SwarselSystem configuration."
|
||||||
|
echo
|
||||||
|
echo "USAGE: $0 [OPTIONS]"
|
||||||
|
echo
|
||||||
|
echo "ARGS:"
|
||||||
|
echo " -n <target_config> specify nixos config to build."
|
||||||
|
echo " Default: hotel"
|
||||||
|
echo " -u <target_user> specify user to deploy for."
|
||||||
|
echo " Default: swarsel"
|
||||||
|
echo " -a <target_arch> specify target architecture."
|
||||||
|
echo " -h | --help Print this help."
|
||||||
|
exit 0
|
||||||
|
}
|
||||||
|
|
||||||
|
function red() {
|
||||||
|
echo -e "\x1B[31m[!] $1 \x1B[0m"
|
||||||
|
if [ -n "''${2-}" ]; then
|
||||||
|
echo -e "\x1B[31m[!] $($2) \x1B[0m"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
function green() {
|
||||||
|
echo -e "\x1B[32m[+] $1 \x1B[0m"
|
||||||
|
if [ -n "''${2-}" ]; then
|
||||||
|
echo -e "\x1B[32m[+] $($2) \x1B[0m"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
function yellow() {
|
||||||
|
echo -e "\x1B[33m[*] $1 \x1B[0m"
|
||||||
|
if [ -n "''${2-}" ]; then
|
||||||
|
echo -e "\x1B[33m[*] $($2) \x1B[0m"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
while [[ $# -gt 0 ]]; do
|
||||||
|
case "$1" in
|
||||||
|
-n)
|
||||||
|
shift
|
||||||
|
target_config=$1
|
||||||
|
;;
|
||||||
|
-a)
|
||||||
|
shift
|
||||||
|
target_arch=$1
|
||||||
|
;;
|
||||||
|
-u)
|
||||||
|
shift
|
||||||
|
target_user=$1
|
||||||
|
;;
|
||||||
|
-h | --help) help_and_exit ;;
|
||||||
|
*)
|
||||||
|
echo "Invalid option detected."
|
||||||
|
help_and_exit
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
shift
|
||||||
|
done
|
||||||
|
|
||||||
|
if [[ $target_arch == "" ]]; then
|
||||||
|
red "error: target_arch not set."
|
||||||
|
help_and_exit
|
||||||
|
fi
|
||||||
|
|
||||||
|
cd /home/"$target_user"
|
||||||
|
|
||||||
|
if [ ! -d /home/"$target_user"/.dotfiles ]; then
|
||||||
|
green "Cloning repository from GitHub"
|
||||||
|
git clone https://github.com/Swarsel/.dotfiles.git
|
||||||
|
else
|
||||||
|
red "A .dotfiles repository is in the way. Please (re-)move the repository and try again."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
local_keys=$(ssh-add -L || true)
|
||||||
|
pub_key=$(cat /home/"$target_user"/.dotfiles/secrets/public/ssh/yubikey.pub)
|
||||||
|
read -ra pub_arr <<< "$pub_key"
|
||||||
|
|
||||||
|
cd .dotfiles
|
||||||
|
if [[ $local_keys != *"''${pub_arr[1]}"* ]]; then
|
||||||
|
yellow "The ssh key for this configuration is not available."
|
||||||
|
green "Adjusting flake.nix so that the configuration is buildable"
|
||||||
|
sed -i '/nix-secrets = {/,/^[[:space:]]*};/d' flake.nix
|
||||||
|
sed -i '/vbc-nix = {/,/^[[:space:]]*};/d' flake.nix
|
||||||
|
sed -i '/[[:space:]]*\/\/ (inputs.vbc-nix.overlays.default final prev)/d' overlays/default.nix
|
||||||
|
rm modules/home/common/env.nix
|
||||||
|
rm modules/home/common/gammastep.nix
|
||||||
|
rm modules/home/common/git.nix
|
||||||
|
rm modules/home/common/mail.nix
|
||||||
|
rm modules/home/common/yubikey.nix
|
||||||
|
rm modules/nixos/server/restic.nix
|
||||||
|
rm hosts/nixos/aarch64-linux/milkywell/default.nix
|
||||||
|
rm -rf modules/nixos/server
|
||||||
|
rm -rf modules/home/server
|
||||||
|
nix flake update vbc-nix
|
||||||
|
git add .
|
||||||
|
else
|
||||||
|
green "Valid SSH key found! Continuing with installation"
|
||||||
|
fi
|
||||||
|
sudo nixos-generate-config --dir /home/"$target_user"/.dotfiles/hosts/nixos/"$target_arch"/"$target_config"/
|
||||||
|
git add /home/"$target_user"/.dotfiles/hosts/nixos/"$target_arch"/"$target_config"/hardware-configuration.nix
|
||||||
|
|
||||||
|
green "Installing flake $target_config"
|
||||||
|
sudo nixos-rebuild --show-trace --flake .#"$target_config" boot
|
||||||
|
yellow "Please keep in mind that this is only a demo of the configuration. Things might break unexpectedly."
|
||||||
|
'';
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
{ self, name, writeShellApplication, kitty, element-desktop, vesktop, spotify-player, jq }:
|
{ self, name, writeShellApplication, kitty, element-desktop, vesktop, spotify-player, jq, ... }:
|
||||||
writeShellApplication {
|
writeShellApplication {
|
||||||
inherit name;
|
inherit name;
|
||||||
runtimeInputs = [ kitty element-desktop vesktop spotify-player jq ];
|
runtimeInputs = [ kitty element-desktop vesktop spotify-player jq ];
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,69 @@
|
||||||
{ self, name, writeShellApplication, kitty, element-desktop, vesktop, spotify-player, jq }:
|
{ name, writeShellApplication, kitty, element-desktop, vesktop, spotify-player, jq, ... }:
|
||||||
writeShellApplication {
|
writeShellApplication {
|
||||||
inherit name;
|
inherit name;
|
||||||
runtimeInputs = [ kitty element-desktop vesktop spotify-player jq ];
|
runtimeInputs = [ kitty element-desktop vesktop spotify-player jq ];
|
||||||
text = builtins.readFile "${self}/files/scripts/${name}.sh";
|
text = ''
|
||||||
|
kitty=0
|
||||||
|
element=0
|
||||||
|
vesktop=0
|
||||||
|
spotifyplayer=0
|
||||||
|
while :; do
|
||||||
|
case ''${1:-} in
|
||||||
|
-k | --kitty)
|
||||||
|
kitty=1
|
||||||
|
;;
|
||||||
|
-e | --element)
|
||||||
|
element=1
|
||||||
|
;;
|
||||||
|
-d | --vesktop)
|
||||||
|
vesktop=1
|
||||||
|
;;
|
||||||
|
-s | --spotifyplayer)
|
||||||
|
spotifyplayer=1
|
||||||
|
;;
|
||||||
|
*) break ;;
|
||||||
|
esac
|
||||||
|
shift
|
||||||
|
done
|
||||||
|
|
||||||
|
if [[ $kitty -eq 1 ]]; then
|
||||||
|
STR=$(swaymsg -t get_tree | jq -r 'recurse(.nodes[]) | select(.name == "__i3_scratch")' | grep kittyterm || true)
|
||||||
|
CHECK=$(swaymsg -t get_tree | grep kittyterm || true)
|
||||||
|
if [ "$CHECK" == "" ]; then
|
||||||
|
exec kitty --app-id kittyterm -T kittyterm -o confirm_os_window_close=0 zellij attach --create kittyterm &
|
||||||
|
sleep 1
|
||||||
|
fi
|
||||||
|
if [ "$STR" == "" ]; then
|
||||||
|
exec swaymsg '[title="kittyterm"]' scratchpad show
|
||||||
|
else
|
||||||
|
exec swaymsg '[title="kittyterm"]' scratchpad show
|
||||||
|
fi
|
||||||
|
elif [[ $element -eq 1 ]]; then
|
||||||
|
STR=$(swaymsg -t get_tree | grep Element || true)
|
||||||
|
if [ "$STR" == "" ]; then
|
||||||
|
exec element-desktop
|
||||||
|
else
|
||||||
|
exec swaymsg '[app_id=Element]' kill
|
||||||
|
fi
|
||||||
|
elif [[ $vesktop -eq 1 ]]; then
|
||||||
|
STR=$(swaymsg -t get_tree | grep vesktop || true)
|
||||||
|
if [ "$STR" == "" ]; then
|
||||||
|
exec vesktop
|
||||||
|
else
|
||||||
|
exec swaymsg '[app_id=vesktop]' kill
|
||||||
|
fi
|
||||||
|
elif [[ $spotifyplayer -eq 1 ]]; then
|
||||||
|
STR=$(swaymsg -t get_tree | jq -r 'recurse(.nodes[]) | select(.name == "__i3_scratch")' | grep spotifytui || true)
|
||||||
|
CHECK=$(swaymsg -t get_tree | grep spotifytui || true)
|
||||||
|
if [ "$CHECK" == "" ]; then
|
||||||
|
exec kitty --add-id spotifytui -T spotifytui -o confirm_os_window_close=0 spotify_player &
|
||||||
|
sleep 1
|
||||||
|
fi
|
||||||
|
if [ "$STR" == "" ]; then
|
||||||
|
exec swaymsg '[title="spotifytui"]' scratchpad show
|
||||||
|
else
|
||||||
|
exec swaymsg '[title="spotifytui"]' scratchpad show
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
'';
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,15 @@
|
||||||
{ self, name, writeShellApplication, kitty }:
|
{ name, writeShellApplication, kitty, ... }:
|
||||||
writeShellApplication {
|
writeShellApplication {
|
||||||
inherit name;
|
inherit name;
|
||||||
runtimeInputs = [ kitty ];
|
runtimeInputs = [ kitty ];
|
||||||
text = builtins.readFile "${self}/files/scripts/${name}.sh";
|
text = ''
|
||||||
|
# KITTIES=$(($(pgrep -P 1 kitty | wc -l) - 1))
|
||||||
|
|
||||||
|
# if ((KITTIES < 1)); then
|
||||||
|
# exec kitty -o confirm_os_window_close=0 zellij attach --create main
|
||||||
|
# else
|
||||||
|
# exec kitty -o confirm_os_window_close=0 zellij attach --create "temp $KITTIES"
|
||||||
|
# fi
|
||||||
|
exec kitty -o confirm_os_window_close=0 zellij
|
||||||
|
'';
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,31 @@
|
||||||
{ self, name, writeShellApplication, git }:
|
{ name, writeShellApplication, git, ... }:
|
||||||
writeShellApplication {
|
writeShellApplication {
|
||||||
inherit name;
|
inherit name;
|
||||||
runtimeInputs = [ git ];
|
runtimeInputs = [ git ];
|
||||||
text = builtins.readFile "${self}/files/scripts/${name}.sh";
|
text = ''
|
||||||
|
CFG=$(git --git-dir="$HOME"/.dotfiles/.git --work-tree="$HOME"/.dotfiles/ status -s | wc -l)
|
||||||
|
CSE=$(git --git-dir="$DOCUMENT_DIR_PRIV"/CSE_TUWIEN/.git --work-tree="$DOCUMENT_DIR_PRIV"/CSE_TUWIEN/ status -s | wc -l)
|
||||||
|
PASS=$(($(git --git-dir="$HOME"/.local/share/password-store/.git --work-tree="$HOME"/.local/share/password-store/ status -s | wc -l) + $(git --git-dir="$HOME"/.local/share/password-store/.git --work-tree="$HOME"/.local/share/password-store/ diff origin/main..HEAD | wc -l)))
|
||||||
|
|
||||||
|
if [[ $CFG != 0 ]]; then
|
||||||
|
CFG_STR='CONFIG'
|
||||||
|
else
|
||||||
|
CFG_STR=""
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ $CSE != 0 ]]; then
|
||||||
|
CSE_STR=' CSE'
|
||||||
|
else
|
||||||
|
CSE_STR=""
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ $PASS != 0 ]]; then
|
||||||
|
PASS_STR=' PASS'
|
||||||
|
else
|
||||||
|
PASS_STR=""
|
||||||
|
fi
|
||||||
|
|
||||||
|
OUT="$CFG_STR""$CSE_STR""$PASS_STR"
|
||||||
|
echo "$OUT"
|
||||||
|
'';
|
||||||
}
|
}
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue