diff options
Diffstat (limited to 'scripts')
| -rw-r--r-- | scripts/default.nix | 33 | ||||
| -rw-r--r-- | scripts/install.sh | 83 | ||||
| -rw-r--r-- | scripts/setup.sh | 108 |
3 files changed, 160 insertions, 64 deletions
diff --git a/scripts/default.nix b/scripts/default.nix new file mode 100644 index 0000000..983216d --- /dev/null +++ b/scripts/default.nix @@ -0,0 +1,33 @@ +{ pkgs }: +let + commonInputs = with pkgs; [ + git + gnupg + sops + nix + coreutils + util-linux + nixos-facter + ]; +in +{ + install = pkgs.writeShellApplication { + name = "nixos-install"; + runtimeInputs = commonInputs ++ [ pkgs.disko-install ]; + text = builtins.readFile ./install.sh; + }; + + setup = pkgs.writeShellApplication { + name = "nixos-setup"; + runtimeInputs = + commonInputs + ++ (with pkgs; [ + ssh-to-age + ripgrep + sd + nh + fd + ]); + text = builtins.readFile ./setup.sh; + }; +} diff --git a/scripts/install.sh b/scripts/install.sh index 9173646..8a8c3d7 100644 --- a/scripts/install.sh +++ b/scripts/install.sh @@ -3,25 +3,23 @@ set -euo pipefail # --- Defaults --- HOSTNAME="" -MAIN_DISK="/dev/nvme0n1" -STORAGE_DISK="" +DISKS=() +KEY_LOCATION="./private.asc" REPO_URL="https://codeberg.org/adikro/nixos-config.git" -TEMP_CONFIG="/tmp/config/etc/nixos-config" +TEMP_CONFIG="/tmp/config/etc/nixos" USE_FACTER=true WRITE_EFI=true # --- Parse Arguments --- -# Added 'g' (generate-config) and 'n' (no-efi) to options -PARSED_ARGS=$(getopt -z -o h:m:s:r:c:gn --long hostname:,main:,storage:,repo:,config:,generate-config,no-efi -- "$@") +PARSED_ARGS=$(getopt -o h:d:r:k:gn --long hostname:,disk:,repo:,key:,generate-config,no-efi -- "$@") eval set -- "$PARSED_ARGS" while true; do case "$1" in -h|--hostname) HOSTNAME="$2"; shift 2 ;; - -m|--main) MAIN_DISK="$2"; shift 2 ;; - -s|--storage) STORAGE_DISK="$2"; shift 2 ;; + -d|--disk) DISKS+=("$2"); shift 2 ;; -r|--repo) REPO_URL="$2"; shift 2 ;; - -c|--config) TEMP_CONFIG="$2"; shift 2 ;; + -k|--key) KEY_LOCATION="$2"; shift 2 ;; -g|--generate-config) USE_FACTER=false; shift ;; -n|--no-efi) WRITE_EFI=false; shift ;; --) shift; break ;; @@ -30,9 +28,13 @@ while true; do done # --- Validation --- -if [[ -z "$HOSTNAME" || -z "$MAIN_DISK" ]]; then - echo "Usage: sudo ./install.sh --hostname <name> [options]" - echo "Options: --main <disk> --storage <disk> --repo <url> --config <path> --generate-config --no-efi" +if [[ -z "$HOSTNAME" || ${#DISKS[@]} -eq 0 ]]; then + echo "Usage: sudo nix run .#install -- -h <name> -d main:/dev/nvme0n1 [-d storage:/dev/sda]" + exit 1 +fi + +if [[ ! -f "$KEY_LOCATION" ]]; then + echo "Error: Private key not found at $KEY_LOCATION. Cannot proceed without GPG." exit 1 fi @@ -40,17 +42,15 @@ fi echo "------------------------------------------------------------" echo "INSTALLATION PLAN" echo " Hostname: $HOSTNAME" -echo " Main Disk: $MAIN_DISK" -echo " Storage Disk: ${STORAGE_DISK:-None}" -echo " Hardware Mode: $([ "$USE_FACTER" = true ] && echo "Facter" || echo "Legacy Generate-Config")" -echo " Write EFI: $WRITE_EFI" -echo " Repo URL: $REPO_URL" +echo " Target Disks:" +for disk in "${DISKS[@]}"; do echo " - $disk"; done echo "------------------------------------------------------------" -read -p "Proceed with formatting? (y/N): " confirm +read -p "Warning: This will format the disks listed above. Proceed? (y/N): " confirm [[ "$confirm" != [yY] ]] && exit 1 -echo "### 1. Preparing GPG ###" -gpg --import ./private.asc || echo "GPG key already present." +echo "### 1. Importing GPG Key ###" +export GPG_TTY=$(tty) +gpg --import "$KEY_LOCATION" echo "### 2. Cloning Configuration ###" sudo rm -rf "$TEMP_CONFIG" @@ -58,44 +58,31 @@ git clone "$REPO_URL" "$TEMP_CONFIG" cd "$TEMP_CONFIG" echo "### 3. Hardware Configuration ###" -mkdir -p "./hosts/$HOSTNAME" +HOST_DIR="./hosts/$HOSTNAME" +mkdir -p "$HOST_DIR" if [ "$USE_FACTER" = true ]; then - echo "Running Facter scan..." - # Note: Using your specified format for the command - sudo nix run github:nix-community/nixos-facter -- -o "./hosts/$HOSTNAME/facter.json" - git add "./hosts/$HOSTNAME/facter.json" + nixos-facter -o "$HOST_DIR/facter.json" + git add "$HOST_DIR/facter.json" else - echo "Generating legacy hardware config..." sudo nixos-generate-config --no-filesystems --root /tmp/nixos-gen-root - sudo mv /tmp/nixos-gen-root/etc/nixos/hardware-configuration.nix "./hosts/$HOSTNAME/hardware-configuration.nix" - sudo rm -rf /tmp/nixos-gen-root - git add "./hosts/$HOSTNAME/hardware-configuration.nix" + mv /tmp/nixos-gen-root/etc/nixos/hardware-configuration.nix "$HOST_DIR/hardware-configuration.nix" + git add "$HOST_DIR/hardware-configuration.nix" fi echo "### 4. SOPS Key Extraction ###" -if [[ -n "$STORAGE_DISK" ]]; then - echo "Extracting storage_key..." - nix shell nixpkgs#sops -c sops -d --extract '["storage_key"]' secrets.yaml > /tmp/storage.key +if printf '%s\n' "${DISKS[@]}" | rg -qv "^main:"; then + sops -d --extract '["crypt_key"]' secrets/secrets.yaml > /tmp/crypt.key fi echo "### 5. Disko Install ###" -DISKO_ARGS=( - --flake ".#$HOSTNAME" - --disk main "$MAIN_DISK" -) - -# Conditionally add the EFI flag -if [ "$WRITE_EFI" = true ]; then - DISKO_ARGS+=(--write-efi-boot-entries) -fi - -# Append storage disk if defined -if [[ -n "$STORAGE_DISK" ]]; then - DISKO_ARGS+=(--disk storage "$STORAGE_DISK") -fi +DISKO_ARGS=(--flake ".#$HOSTNAME") +for pair in "${DISKS[@]}"; do + IFS=":" read -r D_NAME D_DEV <<< "$pair" + DISKO_ARGS+=(--disk "$D_NAME" "$D_DEV") +done +[[ "$WRITE_EFI" == true ]] && DISKO_ARGS+=(--write-efi-boot-entries) -sudo nix run 'github:nix-community/disko/latest#disko-install' -- "${DISKO_ARGS[@]}" +sudo disko-install "${DISKO_ARGS[@]}" -echo "------------------------------------------------------------" -echo "INSTALL COMPLETE. Remove pendrive and reboot." +echo "INSTALL COMPLETE. Reboot and run setup script." diff --git a/scripts/setup.sh b/scripts/setup.sh index a3b0cb2..fb9a603 100644 --- a/scripts/setup.sh +++ b/scripts/setup.sh @@ -1,22 +1,98 @@ #!/usr/bin/env bash -# Automate the post-reboot steps -sudo mkdir -p /mnt/usb && sudo mount /dev/sdb1 /mnt/usb -gpg --import /mnt/usb/private.asc -gpg --import /mnt/usb/public.asc -gpg --import-ownertrust /mnt/usb/trust.txt +set -euo pipefail -# Setup the repo properly +# --- Defaults --- +HOSTNAME=$(hostname) +USB_DEVICE="" +REPO_URL="git@codeberg.org:adikro/nixos-config.git" +KEY_LOCATION="" +USE_FACTER=true + +# --- Parse Arguments --- +PARSED_ARGS=$(getopt -o u:h:r:k:g --long usb:,hostname:,repo:,key:,generate-config -- "$@") +eval set -- "$PARSED_ARGS" + +while true; do + case "$1" in + -u|--usb) USB_DEVICE="$2"; shift 2 ;; + -h|--hostname) HOSTNAME="$2"; shift 2 ;; + -r|--repo) REPO_URL="$2"; shift 2 ;; + -k|--key) KEY_LOCATION="$2"; shift 2 ;; + -g|--generate-config) USE_FACTER=false; shift ;; + --) shift; break ;; + *) echo "Internal error!"; exit 1 ;; + esac +done + +echo "### 1. GPG Key Preparation ###" +export GPG_TTY=$(tty) + +if [[ -n "$KEY_LOCATION" ]]; then + gpg --import "$KEY_LOCATION" +elif [[ -n "$USB_DEVICE" ]]; then + echo "Mounting $USB_DEVICE..." + sudo mkdir -p /mnt/usb + findmnt -rno SOURCE "$USB_DEVICE" >/dev/null || sudo mount "$USB_DEVICE" /mnt/usb + + echo "Searching USB for private.asc..." + KEY_FILE=$(sudo fd -H -t f "private.asc" /mnt/usb --max-results 1) + + if [[ -n "$KEY_FILE" ]]; then + KEY_DIR=$(dirname "$KEY_FILE") + echo "Found keys in $KEY_DIR. Importing..." + ( + cd "$KEY_DIR" + gpg --import private.asc + [[ -f "public.asc" ]] && gpg --import public.asc + [[ -f "trust.txt" ]] && gpg --import-ownertrust trust.txt + ) + else + echo "Error: private.asc not found on $USB_DEVICE" + sudo umount /mnt/usb; exit 1 + fi + sudo umount /mnt/usb +else + gpg -K | grep -q "sec" || { echo "No keys found. Use --usb or --key."; exit 1; } +fi + +echo "### 2. Repo Setup ###" sudo mkdir -p /etc/nixos -sudo chown -R $USER:users /etc/nixos -git clone git@codeberg.org:adikro/nixos-config.git /etc/nixos +sudo chown -R "$USER":users /etc/nixos +[[ ! -d "/etc/nixos/.git" ]] && git clone "$REPO_URL" /etc/nixos +cd /etc/nixos -# Fix hardware config for the actual live system -sudo rm /etc/nixos/hosts/desktop/hardware-configuration.nix -sudo nixos-generate-config --no-filesystems --root / -# Move it to the right place -sudo mv /etc/nixos/hardware-configuration.nix /etc/nixos/hosts/desktop/ +echo "### 3. Hardware Refresh ###" +HOST_DIR="./hosts/$HOSTNAME" +mkdir -p "$HOST_DIR" +if [ "$USE_FACTER" = true ]; then + nixos-facter -o "$HOST_DIR/facter.json" +else + sudo nixos-generate-config --no-filesystems --root / + mv /etc/nixos/hardware-configuration.nix "$HOST_DIR/hardware-configuration.nix" +fi -# Update SOPS with new SSH key +echo "### 4. SOPS Rotation ###" NEW_AGE=$(ssh-to-age < /etc/ssh/ssh_host_ed25519_key.pub) -echo "New Age Key: $NEW_AGE" -# You'll still need to manually edit .sops.yaml unless you use 'sed' to replace the key +if grep -q "&host_$HOSTNAME" .sops.yaml; then + sd "(&host_$HOSTNAME\s+-) age1.*" "\$1 $NEW_AGE" .sops.yaml +else + sd "(keys:\n)" "\$1 - &host_$HOSTNAME $NEW_AGE\n" .sops.yaml + sd "(age:\n(.*\n)*?\s+age:\n)" "\$1 - *host_$HOSTNAME\n" .sops.yaml +fi + +sops updatekeys secrets/secrets.yaml -y + +echo "### 5. System Rebuild ###" +git add . +nh os switch . -u -H "$HOSTNAME" + +echo "### 6. Git Finalization ###" +[[ $(git remote) =~ "origin" ]] && git remote rename origin codeberg +git remote set-url codeberg "$REPO_URL" +git add . +git commit -m "chore($HOSTNAME): hardware refresh and sops rotation" || echo "No changes." + +read -p "Push to Codeberg? (y/N): " push_confirm +[[ "$push_confirm" == [yY] ]] && git push -u codeberg main + +echo "SETUP COMPLETE. Rebooting is recommended." |