Mic92/stockholm
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

l hilum.r: pass luks passphrase in flash script

Browse Source
This commit is contained in:
lassulus 2023-01-26 23:46:51 +01:00
parent f10b0ca342
commit 34360eb931
3 changed files with 21 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
lass/1systems/hilum/disk.nix
View File

@ -1,4 +1,4 @@
{ lib, disk, ... }: { lib, disk, keyFile, ... }:
{ {
disk = { disk = {
main = { main = {
@ -37,7 +37,7 @@
content = { content = {
type = "luks"; type = "luks";
name = "hilum_luks"; name = "hilum_luks";
# keyFile = "/tmp/secret.key"; keyFile = keyFile;
content = { content = {
type = "filesystem"; type = "filesystem";
format = "xfs"; format = "xfs";

14
lass/1systems/hilum/flash-stick.sh Normal file → Executable file
View File

@ -4,14 +4,24 @@ set -efux
disk=$1 disk=$1
export NIXPKGS_ALLOW_UNFREE=1 export NIXPKGS_ALLOW_UNFREE=1
(umask 077; pass show admin/hilum/luks > /tmp/hilum.luks)
trap 'rm -f /tmp/hilum.luks' EXIT
stockholm_root=$(git rev-parse --show-toplevel) stockholm_root=$(git rev-parse --show-toplevel)
ssh root@localhost -t -- $(nix-build \ ssh root@localhost -t -- $(nix-build \
--no-out-link \ --no-out-link \
-I nixpkgs=/var/src/nixpkgs \ -I nixpkgs=/var/src/nixpkgs \
-I stockholm="$stockholm_root" \ -I stockholm="$stockholm_root" \
-I secrets="$stockholm_root"/lass/2configs/tests/dummy-secrets \ -I secrets="$stockholm_root"/lass/2configs/tests/dummy-secrets \
-E "with import <nixpkgs> {}; (pkgs.nixos [ { mainDisk = \"$disk\"; disko.rootMountPoint = \"/mnt/hilum\"; } ./physical.nix ]).mountScript" -E "with import <nixpkgs> {}; (pkgs.nixos [
{
luksPassFile = \"/tmp/hilum.luks\";
mainDisk = \"$disk\";
disko.rootMountPoint = \"/mnt/hilum\";
}
./physical.nix
]).disko"
) )
rm -f /tmp/hilum.luks
$(nix-build \ $(nix-build \
--no-out-link \ --no-out-link \
-I nixpkgs=/var/src/nixpkgs \ -I nixpkgs=/var/src/nixpkgs \
@ -21,7 +31,7 @@ $(nix-build \
--arg force true --arg force true
) )
ssh root@localhost << SSH ssh root@localhost << SSH
nixos-install --no-root-password --root /mnt/hilum -I /var/src NIXOS_CONFIG=/mnt/hilum/var/src/nixos-config nixos-install --no-root-password --root /mnt/hilum -I /var/src
nixos-enter --root /mnt/hilum -- nixos-rebuild -I /var/src switch --install-bootloader nixos-enter --root /mnt/hilum -- nixos-rebuild -I /var/src switch --install-bootloader
umount -Rv /mnt/hilum umount -Rv /mnt/hilum
SSH SSH

7
lass/1systems/hilum/physical.nix
View File

@ -12,11 +12,18 @@
}; };
config.environment.etc.hilum-disk.text = config.mainDisk; config.environment.etc.hilum-disk.text = config.mainDisk;
} }
{
options.luksPassFile = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
};
}
]; ];
disko.devices = import ./disk.nix { disko.devices = import ./disk.nix {
inherit lib; inherit lib;
disk = config.mainDisk; disk = config.mainDisk;
keyFile = config.luksPassFile;
}; };
boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "xhci_pci" "usb_storage" "sd_mod" "sdhci_pci" ]; boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "xhci_pci" "usb_storage" "sd_mod" "sdhci_pci" ];