erikandClaude Opus 4.8
f581203b57
- add nixos-images input; nixosConfigurations.kexec bakes in the ssh login key - build via config.system.build.kexecInstallerTarball - deploy: ./deploy kexec <host> streams the installer to /tmp and kexecs - works around ZimaOS RO root where nixos-anywhere ssh-copy-id fails Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
77 lines
3.0 KiB
Bash
Executable File
77 lines
3.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Deploy the jupiter NixOS config.
|
|
#
|
|
# ./deploy kexec <host> headless-only: for a read-only-root box (ZimaOS)
|
|
# where nixos-anywhere can't ssh-copy-id. Uploads a
|
|
# kexec installer (our SSH key baked in) to /tmp and
|
|
# boots into it. Then run `install`.
|
|
# ./deploy install <ip> first install onto a fresh box / running installer
|
|
# (nixos-anywhere). Wipes the OS disk. Ships host key.
|
|
# ./deploy [switch] [host] rebuild + activate on a running jupiter (default).
|
|
# ./deploy boot [host] stage for next boot, don't activate now.
|
|
# ./deploy test [host] activate without adding a boot entry.
|
|
#
|
|
# Runs from a non-NixOS host too (nixos-rebuild / nixos-anywhere via `nix run`).
|
|
set -euo pipefail
|
|
|
|
REPO="$(cd "$(dirname "$0")" && pwd)"
|
|
cd "$REPO"
|
|
export PATH="/nix/var/nix/profiles/default/bin:$PATH"
|
|
|
|
HOSTKEY="$HOME/.config/homelab/jupiter/ssh_host_ed25519_key"
|
|
|
|
cmd="${1:-switch}"
|
|
case "$cmd" in
|
|
switch|boot|test|install|kexec) shift || true ;;
|
|
*) cmd="switch" ;;
|
|
esac
|
|
|
|
case "$cmd" in
|
|
kexec)
|
|
host="${1:-}"
|
|
[ -n "$host" ] || { echo "usage: ./deploy kexec <ip-or-host>" >&2; exit 1; }
|
|
|
|
echo ">> building kexec installer (SSH key baked in)"
|
|
nix build .#nixosConfigurations.kexec.config.system.build.kexecInstallerTarball \
|
|
-o result-kexec
|
|
tb="$(ls result-kexec/*.tar.gz | head -1)"
|
|
|
|
echo ">> streaming installer to root@$host and kexec-ing (enter root password)"
|
|
echo " Extracted to /tmp (tmpfs); no compressed copy stored. SSH drops as"
|
|
echo " the box jumps into the RAM installer. Disks are untouched."
|
|
# Stream the tarball straight into remote tar to avoid a second 522MB copy.
|
|
ssh "root@$host" 'mkdir -p /tmp/k && tar -C /tmp/k -xzf - && /tmp/k/kexec/run' < "$tb" || true
|
|
|
|
echo ">> box is kexec-ing. Wait ~1-2 min for the installer + network, then:"
|
|
echo " ./deploy install $host"
|
|
;;
|
|
|
|
install)
|
|
host="${1:-}"
|
|
[ -n "$host" ] || { echo "usage: ./deploy install <ip-or-host>" >&2; exit 1; }
|
|
[ -f "$HOSTKEY" ] || { echo "missing host key: $HOSTKEY" >&2; exit 1; }
|
|
|
|
# Stage the pre-generated SSH host key so sops can decrypt on boot #1.
|
|
stage="$(mktemp -d)"
|
|
trap 'rm -rf "$stage"' EXIT
|
|
install -Dm600 "$HOSTKEY" "$stage/etc/ssh/ssh_host_ed25519_key"
|
|
install -Dm644 "$HOSTKEY.pub" "$stage/etc/ssh/ssh_host_ed25519_key.pub"
|
|
|
|
echo ">> nixos-anywhere onto root@$host (OS disk WILL be wiped)"
|
|
nix run github:nix-community/nixos-anywhere -- \
|
|
--flake ".#jupiter" \
|
|
--extra-files "$stage" \
|
|
--generate-hardware-config nixos-generate-config ./jupiter/hardware-configuration.nix \
|
|
--target-host "root@$host"
|
|
;;
|
|
|
|
switch|boot|test)
|
|
host="${1:-jupiter}"
|
|
echo ">> nixos-rebuild $cmd on darman@$host"
|
|
nix run nixpkgs#nixos-rebuild -- "$cmd" \
|
|
--flake ".#jupiter" \
|
|
--target-host "darman@$host" \
|
|
--use-remote-sudo
|
|
;;
|
|
esac
|