mirror of
https://github.com/nix-community/nixos-anywhere.git
synced 2024-09-11 16:45:28 +03:00
Merge #34
34: nixos-remote.sh: generate temporary ssh-key r=Mic92 a=Mic92 Co-authored-by: lassulus <lassulus@lassul.us> Co-authored-by: Jörg Thalheim <joerg@thalheim.io>
This commit is contained in:
commit
6fdd010b51
@ -42,8 +42,6 @@ Options:
|
||||
* -s, --store-paths
|
||||
set the store paths to the disko-script and nixos-system directly
|
||||
if this is give, flake is not needed
|
||||
* --no-ssh-copy
|
||||
skip copying ssh-keys to target system
|
||||
* --no-reboot
|
||||
do not reboot after installation, allowing further customization of the target installation.
|
||||
* --kexec url
|
||||
|
@ -10,8 +10,6 @@ Options:
|
||||
* -s, --store-paths
|
||||
set the store paths to the disko-script and nixos-system directly
|
||||
if this is give, flake is not needed
|
||||
* --no-ssh-copy
|
||||
skip copying ssh-keys to target system
|
||||
* --kexec url
|
||||
use another kexec tarball to bootstrap NixOS
|
||||
* --debug
|
||||
|
18
flake.lock
18
flake.lock
@ -43,11 +43,11 @@
|
||||
},
|
||||
"nixos-2211": {
|
||||
"locked": {
|
||||
"lastModified": 1674079783,
|
||||
"narHash": "sha256-RKenhBhPXBOE+iOD+2DfOU+QRZvMZjedkZCQiZmHwnk=",
|
||||
"lastModified": 1674463419,
|
||||
"narHash": "sha256-5PIilc8vqmz7jMwpr+pqCz07L+q0eR2vdwNEUkRxwE8=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "f664029d68acdffe8d86e98a295b2d8303369353",
|
||||
"rev": "6eb2af1b88814ca90e6a33761ff71ffd6c360839",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@ -63,11 +63,11 @@
|
||||
"nixos-unstable": "nixos-unstable"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1674091005,
|
||||
"narHash": "sha256-HOdxpFfF2Nu/siZtVlXG0sO/R6AjAkjA07afzpnFqfY=",
|
||||
"lastModified": 1674574673,
|
||||
"narHash": "sha256-Bttq9LGgSaqjC7nn8AHRbuKYqe2foDK+0EXWTn9tZQw=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nixos-images",
|
||||
"rev": "acbbb3494fdf4d7f8f8e8832beeab9c448563e9b",
|
||||
"rev": "b9b667b8b4a8d0c379b39c46408a8a5832195609",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@ -78,11 +78,11 @@
|
||||
},
|
||||
"nixos-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1673954326,
|
||||
"narHash": "sha256-oAKwsXTptcY6gRCBxJlZ+W1BrZHNr9a28+4fQMLuRu0=",
|
||||
"lastModified": 1674365217,
|
||||
"narHash": "sha256-lL3qUbAr/tnt/xGk1MTc8xuOTKqErqubYha4vhjA4+g=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "8fc3a1dcc98d3603221d4afd239e666eeedb6141",
|
||||
"rev": "6c582bdf390948a6be049e81ecbab81bb160a5d3",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
@ -11,8 +11,6 @@ Options:
|
||||
* -s, --store-paths
|
||||
set the store paths to the disko-script and nixos-system directly
|
||||
if this is give, flake is not needed
|
||||
* --no-ssh-copy
|
||||
skip copying ssh-keys to target system
|
||||
* --no-reboot
|
||||
do not reboot after installation, allowing further customization of the target installation.
|
||||
* --kexec url
|
||||
@ -49,9 +47,10 @@ nix_options=(
|
||||
"--no-write-lock-file"
|
||||
)
|
||||
substitute_on_destination=y
|
||||
nix_copy_options=()
|
||||
|
||||
declare -A disk_encryption_keys
|
||||
declare -a nix_copy_options
|
||||
declare -a ssh_copy_id_args
|
||||
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
@ -76,9 +75,6 @@ while [[ $# -gt 0 ]]; do
|
||||
kexec_url=$2
|
||||
shift
|
||||
;;
|
||||
--no-ssh-copy-id)
|
||||
no_ssh_copy=y
|
||||
;;
|
||||
--debug)
|
||||
enable_debug="-x"
|
||||
print_build_logs=y
|
||||
@ -126,14 +122,6 @@ while [[ $# -gt 0 ]]; do
|
||||
shift
|
||||
done
|
||||
|
||||
# ssh wrapper
|
||||
timeout_ssh_() {
|
||||
timeout 10 ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$ssh_connection" "$@"
|
||||
}
|
||||
ssh_() {
|
||||
ssh -T -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$ssh_connection" "$@"
|
||||
}
|
||||
|
||||
if [[ ${print_build_logs-n} == "y" ]]; then
|
||||
nix_options+=("-L")
|
||||
fi
|
||||
@ -142,8 +130,16 @@ if [[ ${substitute_on_destination-n} == "y" ]]; then
|
||||
nix_copy_options+=("--substitute-on-destination")
|
||||
fi
|
||||
|
||||
# ssh wrapper
|
||||
timeout_ssh_() {
|
||||
timeout 10 ssh -i "$ssh_key_dir"/nixos-remote -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$ssh_connection" "$@"
|
||||
}
|
||||
ssh_() {
|
||||
ssh -T -i "$ssh_key_dir"/nixos-remote -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$ssh_connection" "$@"
|
||||
}
|
||||
|
||||
nix_copy() {
|
||||
NIX_SSHOPTS='-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no' nix copy \
|
||||
NIX_SSHOPTS="-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i $ssh_key_dir/nixos-remote" nix copy \
|
||||
"${nix_options[@]}" \
|
||||
"${nix_copy_options[@]}" \
|
||||
"$@"
|
||||
@ -160,6 +156,12 @@ if [[ -z ${ssh_connection-} ]]; then
|
||||
abort "ssh-host must be set"
|
||||
fi
|
||||
|
||||
# we generate a temporary ssh keypair that we can use during nixos-remote
|
||||
ssh_key_dir=$(mktemp -d)
|
||||
trap 'rm -rf "$ssh_key_dir"' EXIT
|
||||
mkdir -p "$ssh_key_dir"
|
||||
ssh-keygen -t ed25519 -f "$ssh_key_dir"/nixos-remote -P "" -C "nixos-remote" >/dev/null
|
||||
|
||||
# parse flake nixos-install style syntax, get the system attr
|
||||
if [[ -n ${flake-} ]]; then
|
||||
if [[ $flake =~ ^(.*)\#([^\#\"]*)$ ]]; then
|
||||
@ -167,22 +169,45 @@ if [[ -n ${flake-} ]]; then
|
||||
flakeAttr="${BASH_REMATCH[2]}"
|
||||
fi
|
||||
if [[ -z ${flakeAttr-} ]]; then
|
||||
echo "Please specify the name of the NixOS configuration to be installed, as a URI fragment in the flake-uri."
|
||||
echo 'For example, to use the output nixosConfigurations.foo from the flake.nix, append "#foo" to the flake-uri.'
|
||||
echo "Please specify the name of the NixOS configuration to be installed, as a URI fragment in the flake-uri." >&2
|
||||
echo 'For example, to use the output nixosConfigurations.foo from the flake.nix, append "#foo" to the flake-uri.' >&2
|
||||
exit 1
|
||||
fi
|
||||
disko_script=$(nix_build "${flake}#nixosConfigurations.${flakeAttr}.config.system.build.disko")
|
||||
nixos_system=$(nix_build "${flake}#nixosConfigurations.${flakeAttr}.config.system.build.toplevel")
|
||||
elif [[ -n ${disko_script-} ]] && [[ -n ${nixos_system-} ]]; then
|
||||
if [[ ! -e ${disko_script} ]] || [[ ! -e ${nixos_system} ]]; then
|
||||
echo "${disko_script} and ${nixos_system} must be existing store-paths"
|
||||
exit 1
|
||||
abort "${disko_script} and ${nixos_system} must be existing store-paths"
|
||||
fi
|
||||
:
|
||||
else
|
||||
abort "flake must be set"
|
||||
fi
|
||||
|
||||
if [[ -n ${SSH_PRIVATE_KEY-} ]]; then
|
||||
sshPrivateKeyFile=$(mktemp)
|
||||
trap 'rm "$sshPrivateKeyFile"' EXIT
|
||||
(
|
||||
umask 077
|
||||
printf '%s' "$SSH_PRIVATE_KEY" >"$sshPrivateKeyFile"
|
||||
)
|
||||
unset SSH_AUTH_SOCK # don't use system agent if key was supplied
|
||||
ssh_copy_id_args+=(-o "IdentityFile=${sshPrivateKeyFile}")
|
||||
ssh_copy_id_args+=(-f)
|
||||
fi
|
||||
|
||||
until
|
||||
ssh-copy-id \
|
||||
-i "$ssh_key_dir"/nixos-remote.pub \
|
||||
-o ConnectTimeout=10 \
|
||||
-o UserKnownHostsFile=/dev/null \
|
||||
-o StrictHostKeyChecking=no \
|
||||
"${ssh_copy_id_args[@]}" \
|
||||
"$ssh_connection"
|
||||
do
|
||||
sleep 3
|
||||
done
|
||||
|
||||
import_facts() {
|
||||
local facts filtered_facts
|
||||
if ! facts=$(
|
||||
@ -205,7 +230,7 @@ has_curl=\$(has curl)
|
||||
FACTS
|
||||
SSH
|
||||
); then
|
||||
return 1
|
||||
exit 1
|
||||
fi
|
||||
filtered_facts=$(echo "$facts" | grep -E '^(has|is)_[a-z0-9_]+=\S+')
|
||||
if [[ -z $filtered_facts ]]; then
|
||||
@ -216,10 +241,7 @@ SSH
|
||||
export $(echo "$filtered_facts" | xargs)
|
||||
}
|
||||
|
||||
# wait for machine to become reachable (possibly forever)
|
||||
until import_facts; do
|
||||
sleep 5
|
||||
done
|
||||
import_facts
|
||||
|
||||
if [[ ${has_tar-n} == "n" ]]; then
|
||||
abort "no tar command found, but required to unpack kexec tarball"
|
||||
@ -236,10 +258,6 @@ if [[ ${is_arch-n} != "x86_64" ]] && [[ $kexec_url == "$default_kexec_url" ]]; t
|
||||
abort "The default kexec image only support x86_64 cpus. Checkout https://github.com/numtide/nixos-remote/#using-your-own-kexec-image for more information."
|
||||
fi
|
||||
|
||||
if [[ ${is_kexec-n} != "y" ]] && [[ ${no_ssh_copy-n} != "y" ]]; then
|
||||
ssh-copy-id -o ConnectTimeout=10 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$ssh_connection"
|
||||
fi
|
||||
|
||||
if [[ ${is_kexec-n} == "n" ]] && [[ ${is_installer-n} == "n" ]]; then
|
||||
ssh_ <<SSH
|
||||
set -efu ${enable_debug}
|
||||
@ -279,6 +297,9 @@ nix_copy --to "ssh://$ssh_connection" "$disko_script"
|
||||
ssh_ "$disko_script"
|
||||
|
||||
if [[ ${stop_after_disko-n} == "y" ]]; then
|
||||
# Should we also do this for `--no-reboot`?
|
||||
echo "WARNING: leaving temporary ssh key at '$ssh_key_dir/nixos-remote' to login to the machine" >&2
|
||||
trap - EXIT
|
||||
exit 0
|
||||
fi
|
||||
|
||||
|
@ -2,14 +2,24 @@
|
||||
name = "from-nixos-with-sudo";
|
||||
nodes = {
|
||||
installer = ./modules/installer.nix;
|
||||
installed = ./modules/installed.nix;
|
||||
installed = {
|
||||
services.openssh.enable = true;
|
||||
virtualisation.memorySize = 4096;
|
||||
|
||||
users.users.nixos = {
|
||||
isNormalUser = true;
|
||||
openssh.authorizedKeys.keyFiles = [ ./modules/ssh-keys/ssh.pub ];
|
||||
extraGroups = [ "wheel" ];
|
||||
};
|
||||
security.sudo.enable = true;
|
||||
security.sudo.wheelNeedsPassword = false;
|
||||
};
|
||||
};
|
||||
testScript = ''
|
||||
start_all()
|
||||
installer.succeed("echo super-secret > /tmp/disk-1.key")
|
||||
output = installer.succeed("""
|
||||
nixos-remote \
|
||||
--no-ssh-copy-id \
|
||||
--debug \
|
||||
--kexec /etc/nixos-remote/kexec-installer \
|
||||
--stop-after-disko \
|
||||
|
@ -2,7 +2,12 @@
|
||||
name = "from-nixos";
|
||||
nodes = {
|
||||
installer = ./modules/installer.nix;
|
||||
installed = ./modules/installed.nix;
|
||||
installed = {
|
||||
services.openssh.enable = true;
|
||||
virtualisation.memorySize = 4096;
|
||||
|
||||
users.users.root.openssh.authorizedKeys.keyFiles = [ ./modules/ssh-keys/ssh.pub ];
|
||||
};
|
||||
};
|
||||
testScript = ''
|
||||
def create_test_machine(oldmachine=None, args={}): # taken from <nixpkgs/nixos/tests/installer.nix>
|
||||
@ -19,7 +24,6 @@
|
||||
installer.succeed("echo value > /tmp/extra-files/var/lib/secrets/key")
|
||||
installer.succeed("""
|
||||
nixos-remote \
|
||||
--no-ssh-copy-id \
|
||||
--debug \
|
||||
--kexec /etc/nixos-remote/kexec-installer \
|
||||
--extra-files /tmp/extra-files \
|
||||
|
@ -1,12 +0,0 @@
|
||||
{
|
||||
virtualisation.memorySize = 4096;
|
||||
services.openssh.enable = true;
|
||||
users.users.root.openssh.authorizedKeys.keyFiles = [ ./ssh-keys/ssh.pub ];
|
||||
users.users.nixos = {
|
||||
isNormalUser = true;
|
||||
openssh.authorizedKeys.keyFiles = [ ./ssh-keys/ssh.pub ];
|
||||
extraGroups = [ "wheel" ];
|
||||
};
|
||||
security.sudo.enable = true;
|
||||
security.sudo.wheelNeedsPassword = false;
|
||||
}
|
Loading…
Reference in New Issue
Block a user