From cd744c716f109927e51686f3ea8f1b036a0c53db Mon Sep 17 00:00:00 2001 From: Eric Litak Date: Sun, 13 Mar 2016 22:09:30 -0700 Subject: [PATCH] actual content --- nixos-infect | 159 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 159 insertions(+) mode change 100644 => 100755 nixos-infect diff --git a/nixos-infect b/nixos-infect old mode 100644 new mode 100755 index e5ca515..4c46db3 --- a/nixos-infect +++ b/nixos-infect @@ -1 +1,160 @@ #! /usr/bin/env bash +set -ex + +makeConf() { +# XXX NB remember to escape / $ ` in heredocs! +# TODO use appended archive or some curl-able tarball? +mkdir -p /etc/nixos/shared +cat > /etc/nixos/networking.nix < /etc/nixos/configuration.nix < /etc/nixos/hardware-configuration.nix < ]; + boot.loader.grub.devices = [ "/dev/vda" ]; + fileSystems."/" = { device = "/dev/vda1"; fsType = "ext4"; }; +} +EOF +#! /usr/bin/env bash +# NB put your semi-sensitive (not posted to github) configuration in a separate +# file and include it via this customConfig() function. e.g.: +# customConfig() { +# cat > /etc/nixos/custom.nix << EOF +# { config, lib, pkgs, ... }: { +# } +# EOF +# } +# +# then you can add the files in configuration.nix's imports above and run something like: +# cat customConfig nixos-infect | root@targethost bash +if [[ `type -t customConfig` == "function" ]]; then customConfig; fi +} + +makeSwap() { + if [[ ! -e /swap ]]; then + dd if=/dev/zero of=/swap bs=1M count=$((1024*2)) + chmod 0600 /swap + mkswap /swap + swapon /swap + fi +} + +bindSubs() { + for dir in dev proc run sys; do + mkdir $1/$dir + mount -R {,$1}/$dir + done +} + +makeConf +makeSwap + +apt-get install -y curl sudo rsync + +groupadd -r nixbld +seq 1 10 | xargs -I{} useradd -c "Nix build user {}" -d /var/empty -g nixbld -G nixbld -M -N -r -s `which nologin` nixbld{} + +# XXX force version 1.10 because 1.11 insists on nixexprs.tar.xz which is unavailable for older releases +#curl https://nixos.org/nix/install | sed -r 's|nix-([0-9.]+)|nix-1.10|g' | sh +curl https://nixos.org/nix/install | sh + +source ~/.nix-profile/etc/profile.d/nix.sh + +nix-channel --add https://nixos.org/channels/nixos-unstable nixos +nix-channel --update + +# XXX BUG encountered in latest unstable (no permission /bin/bash nonsense) +#nix-channel --add https://nixos.org/channels/nixos-15.09 nixpkgs +#nix-channel --update + +newRootImg=`mktemp` +newRootMount=`mktemp -d` +oldRootMount=`mktemp -d` + +export NIXOS_CONFIG=/etc/nixos/configuration.nix +nix-env -i -f /nix/var/nix/profiles/per-user/root/channels/nixpkgs/nixos \ + -A config.system.build.nixos-install \ + -A config.system.build.nixos-option \ + -A config.system.build.nixos-generate-config + +dd if=/dev/zero of=$newRootImg bs=1M count=$((1024*2)) +mkfs.ext4 $newRootImg +mount $newRootImg $newRootMount + +rsync -aR /./etc/nixos $newRootMount +nixos-install --root $newRootMount + +swapoff /swap || true +mount -B / $oldRootMount +# XXX bindmount causes /bin/bash permission BUG on many versions (nix 1.10-1.11, nixpkgs 15-16), so just use loopback img for now +#mount -B $newRoot $newRootMount +#bindSubs $newRootMount +rsync -a --delete --exclude=$(dirname $newRootMount) $newRootMount/ $oldRootMount + +# restore access to commands (not sure whih of these 3 are essential, nor if order matters XXX) +export PATH=/nix/var/nix/profiles/system/sw/bin:/nix/var/nix/profiles/system/sw/sbin +/nix/var/nix/profiles/system/activate +source /nix/var/nix/profiles/system/etc/profile + +# XXX temporary fix for name resolution +echo nameserver 8.8.4.4 > /etc/resolv.conf + +ip4s=$(ip address show dev eth0 | grep 'inet ' | sed -r 's|.*inet ([0-9.]+)/([0-9]+).*|{ address="\1"; prefixLength=\2; }|') +ip6s=$(ip address show dev eth0 | grep 'inet6 .*global' | sed -r 's|.*inet6 ([0-9a-f:]+)/([0-9]+).*|{ address="\1"; prefixLength=\2; }|') +gateway=$(ip route show dev eth0 | grep default | sed -r 's|default via ([0-9.]+).*|\1|') +gateway6=$(ip -6 route show dev eth0 | grep default | sed -r 's|default via ([0-9a-f:]+).*|\1|') +ether0=$(ip address show dev eth0 | grep link/ether | sed -r 's|.*link/ether ([0-9a-f:]+) .*|\1|') +ether1=$(ip address show dev eth1 | grep link/ether | sed -r 's|.*link/ether ([0-9a-f:]+) .*|\1|') + +cat > /etc/nixos/networking.nix < /proc/sysrq-trigger # sync +#echo b > /proc/sysrq-trigger # reboot -f better if i fix PATH?