Compare commits
27 Commits
df2bc27f54
...
bootloader
| Author | SHA1 | Date | |
|---|---|---|---|
524dafd513
|
|||
|
db1e9c15ac
|
|||
|
f4b9eff715
|
|||
|
325b863238
|
|||
|
79a67284af
|
|||
|
fae6b25137
|
|||
|
4a59f6b57c
|
|||
|
4771d8c7d6
|
|||
|
2fc05cdfd0
|
|||
|
ac0958db60
|
|||
|
5f8f1ee138
|
|||
|
9f38c2a25b
|
|||
|
b42c838957
|
|||
|
089f6e8b86
|
|||
|
6772afb845
|
|||
|
e9755d41c6
|
|||
|
68411d9459
|
|||
|
7fd5b790ff
|
|||
|
37bca1fdd1
|
|||
|
75ca09949c
|
|||
|
2fcdee5d81
|
|||
|
c01f797e79
|
|||
|
59a2bfa126
|
|||
|
e486bb28b0
|
|||
|
d33fd60ce4
|
|||
|
37428d922b
|
|||
|
b1cfe1e31b
|
@@ -3,11 +3,23 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
inputs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.features.bootloader;
|
||||
keyDir = "/etc/secrets/initrd";
|
||||
|
||||
mkIpString =
|
||||
{
|
||||
address,
|
||||
gateway,
|
||||
netmask,
|
||||
interface,
|
||||
...
|
||||
}:
|
||||
"${address}::${gateway}:${netmask}::${interface}:none";
|
||||
in
|
||||
{
|
||||
imports = [ inputs.lanzaboote.nixosModules.lanzaboote ];
|
||||
@@ -22,12 +34,89 @@
|
||||
];
|
||||
default = "systemd-boot";
|
||||
};
|
||||
|
||||
configurationLimit = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 10;
|
||||
};
|
||||
|
||||
consoleFont = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "ter-v32n";
|
||||
};
|
||||
|
||||
resumeDevice = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = null;
|
||||
};
|
||||
|
||||
initrdSsh = {
|
||||
enable = lib.mkEnableOption "remote LUKS unlock via ssh in initrd";
|
||||
|
||||
networkModule = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
};
|
||||
|
||||
ip = {
|
||||
enable = lib.mkEnableOption "static IP for initrd (otherwise DHCP)";
|
||||
|
||||
address = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
};
|
||||
|
||||
gateway = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
};
|
||||
|
||||
netmask = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "255.255.255.0";
|
||||
};
|
||||
|
||||
interface = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
};
|
||||
};
|
||||
|
||||
authorizedKeys = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
default = [ ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable (
|
||||
lib.mkMerge [
|
||||
{
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
# lanzaboote inherits editor + configurationLimit from systemd-boot.*
|
||||
boot.loader.systemd-boot = {
|
||||
editor = false;
|
||||
inherit (cfg) configurationLimit;
|
||||
};
|
||||
|
||||
boot.initrd.systemd.enable = true;
|
||||
|
||||
# block simpledrm so fbcon defers until the gpu driver binds; avoids
|
||||
# the simpledrm -> real-driver fbcon transition that mangles console
|
||||
# text and leaves the luks prompt typing offset from the visible
|
||||
# surface. hosts must put the gpu driver in initrd (nixos-hardware
|
||||
# does this for amd; manual hardware.amdgpu.initrd.enable on others)
|
||||
boot.kernelParams = [ "initcall_blacklist=simpledrm_platform_driver_init" ];
|
||||
|
||||
# verbose boot: kernel messages and systemd unit lines visible end
|
||||
# to end. trade-off: the luks prompt will be interleaved with the
|
||||
# last few "Starting/Started ..." lines (no upstream fix exists
|
||||
# without plymouth). boot.initrd.verbose is a no-op under
|
||||
# systemd-initrd, so not set here.
|
||||
|
||||
# readable luks prompt at panel-native dpi
|
||||
console = {
|
||||
earlySetup = true;
|
||||
font = cfg.consoleFont;
|
||||
packages = [ pkgs.terminus_font ];
|
||||
};
|
||||
}
|
||||
|
||||
(lib.mkIf (cfg.mode == "systemd-boot") {
|
||||
@@ -41,6 +130,43 @@
|
||||
pkiBundle = "/var/lib/sbctl";
|
||||
};
|
||||
})
|
||||
|
||||
(lib.mkIf (cfg.resumeDevice != null) {
|
||||
boot.resumeDevice = cfg.resumeDevice;
|
||||
})
|
||||
|
||||
(lib.mkIf cfg.initrdSsh.enable {
|
||||
boot.initrd.systemd.settings.Manager.DefaultDeviceTimeoutSec = "infinity";
|
||||
|
||||
boot.initrd.availableKernelModules = [ cfg.initrdSsh.networkModule ];
|
||||
|
||||
boot.kernelParams = lib.mkIf cfg.initrdSsh.ip.enable [
|
||||
"ip=${mkIpString cfg.initrdSsh.ip}"
|
||||
];
|
||||
|
||||
boot.initrd.network = {
|
||||
enable = true;
|
||||
ssh = {
|
||||
enable = true;
|
||||
port = 22;
|
||||
hostKeys = [
|
||||
"${keyDir}/ssh_host_rsa_key"
|
||||
"${keyDir}/ssh_host_ed25519_key"
|
||||
];
|
||||
inherit (cfg.initrdSsh) authorizedKeys;
|
||||
};
|
||||
};
|
||||
|
||||
# forward LUKS password prompt to the ssh session (systemd-initrd idiom)
|
||||
boot.initrd.systemd.users.root.shell = "/bin/systemd-tty-ask-password-agent";
|
||||
|
||||
boot.initrd.systemd.network.networks = lib.mkIf (!cfg.initrdSsh.ip.enable) {
|
||||
"10-initrd" = {
|
||||
matchConfig.Driver = cfg.initrdSsh.networkModule;
|
||||
networkConfig.DHCP = "yes";
|
||||
};
|
||||
};
|
||||
})
|
||||
]
|
||||
);
|
||||
};
|
||||
|
||||
@@ -71,6 +71,12 @@
|
||||
];
|
||||
};
|
||||
|
||||
# honor persist_mode so electron apps don't re-prompt for screencast every login
|
||||
systemd.user.services.xdg-desktop-portal-wlr.environment.XDPW_PERSIST_MODE = "permanent";
|
||||
|
||||
# enable ozone/wayland for electron apps so idle detection works
|
||||
environment.sessionVariables.NIXOS_OZONE_WL = "1";
|
||||
|
||||
fonts.packages = with pkgs; [
|
||||
font-awesome
|
||||
nerd-fonts.jetbrains-mono
|
||||
@@ -99,7 +105,11 @@
|
||||
# bluetooth
|
||||
(lib.mkIf cfg.bluetooth.enable {
|
||||
hardware.bluetooth.enable = true;
|
||||
services.blueman.enable = true;
|
||||
services.blueman = {
|
||||
enable = true;
|
||||
# TEMP:(@janezicmatej) workaround for nixpkgs#514705, fix in nixpkgs#517250
|
||||
withApplet = false;
|
||||
};
|
||||
})
|
||||
|
||||
# apps
|
||||
@@ -114,7 +124,7 @@
|
||||
bolt-launcher
|
||||
libnotify
|
||||
bibata-cursors
|
||||
vesktop
|
||||
discord
|
||||
rocketchat-desktop
|
||||
telegram-desktop
|
||||
slack
|
||||
@@ -256,7 +266,7 @@
|
||||
|
||||
# app deep links
|
||||
"x-scheme-handler/tg" = "org.telegram.desktop.desktop";
|
||||
"x-scheme-handler/discord" = "vesktop.desktop";
|
||||
"x-scheme-handler/discord" = "discord.desktop";
|
||||
"x-scheme-handler/slack" = "slack.desktop";
|
||||
};
|
||||
};
|
||||
|
||||
@@ -1,87 +0,0 @@
|
||||
{
|
||||
nixos =
|
||||
{ lib, config, ... }:
|
||||
let
|
||||
cfg = config.features.initrd-ssh;
|
||||
keyDir = "/etc/secrets/initrd";
|
||||
|
||||
mkIpString =
|
||||
{
|
||||
address,
|
||||
gateway,
|
||||
netmask,
|
||||
interface,
|
||||
...
|
||||
}:
|
||||
"${address}::${gateway}:${netmask}::${interface}:none";
|
||||
in
|
||||
{
|
||||
options.features.initrd-ssh = {
|
||||
enable = lib.mkEnableOption "initrd ssh";
|
||||
|
||||
ip = {
|
||||
enable = lib.mkEnableOption "static IP for initrd (otherwise DHCP)";
|
||||
|
||||
address = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
};
|
||||
|
||||
gateway = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
};
|
||||
|
||||
netmask = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "255.255.255.0";
|
||||
};
|
||||
|
||||
interface = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
};
|
||||
};
|
||||
|
||||
authorizedKeys = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
default = [ ];
|
||||
};
|
||||
|
||||
networkModule = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
boot.initrd.availableKernelModules = [ cfg.networkModule ];
|
||||
boot.initrd.kernelModules = [ cfg.networkModule ];
|
||||
boot.kernelParams = lib.mkIf cfg.ip.enable [
|
||||
"ip=${mkIpString cfg.ip}"
|
||||
];
|
||||
|
||||
boot.initrd.systemd.enable = true;
|
||||
|
||||
boot.initrd.network = {
|
||||
enable = true;
|
||||
ssh = {
|
||||
enable = true;
|
||||
port = 22;
|
||||
hostKeys = [
|
||||
"${keyDir}/ssh_host_rsa_key"
|
||||
"${keyDir}/ssh_host_ed25519_key"
|
||||
];
|
||||
inherit (cfg) authorizedKeys;
|
||||
};
|
||||
};
|
||||
|
||||
# systemd-networkd retries DHCP indefinitely, unlike udhcpc
|
||||
boot.initrd.systemd.network.networks = lib.mkIf (!cfg.ip.enable) {
|
||||
"10-initrd" = {
|
||||
matchConfig.Driver = cfg.networkModule;
|
||||
networkConfig.DHCP = "yes";
|
||||
};
|
||||
};
|
||||
|
||||
# forward LUKS password prompt to the SSH session
|
||||
boot.initrd.systemd.users.root.shell = "/bin/systemd-tty-ask-password-agent";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -39,6 +39,7 @@
|
||||
|
||||
programs.neovim = {
|
||||
enable = true;
|
||||
sideloadInitLua = true;
|
||||
vimAlias = true;
|
||||
defaultEditor = true;
|
||||
package = inputs.neovim-nightly-overlay.packages.${pkgs.stdenv.hostPlatform.system}.default;
|
||||
|
||||
@@ -8,11 +8,6 @@
|
||||
options.features.power = {
|
||||
enable = lib.mkEnableOption "laptop power management";
|
||||
|
||||
resumeDevice = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = null;
|
||||
};
|
||||
|
||||
lidSwitch = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "suspend-then-hibernate";
|
||||
@@ -40,8 +35,6 @@
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
boot.resumeDevice = lib.mkIf (cfg.resumeDevice != null) cfg.resumeDevice;
|
||||
|
||||
services.logind.settings.Login = {
|
||||
HandleLidSwitch = cfg.lidSwitch;
|
||||
HandlePowerKey = cfg.powerKey;
|
||||
|
||||
@@ -43,19 +43,15 @@
|
||||
config = lib.mkIf cfg.enable (
|
||||
lib.mkMerge [
|
||||
{
|
||||
services.qemuGuest.enable = true;
|
||||
services.spice-vdagentd.enable = lib.mkIf (!cfg.headless) true;
|
||||
|
||||
boot.kernelParams = lib.mkIf cfg.headless [ "console=ttyS0,115200" ];
|
||||
|
||||
# 9p autoloads on first mount
|
||||
boot.initrd.availableKernelModules = [
|
||||
"9p"
|
||||
"9pnet_virtio"
|
||||
];
|
||||
boot.kernelModules = [
|
||||
"9p"
|
||||
"9pnet_virtio"
|
||||
];
|
||||
|
||||
networking = {
|
||||
useDHCP = true;
|
||||
@@ -68,7 +64,6 @@
|
||||
curl
|
||||
wget
|
||||
htop
|
||||
sshfs
|
||||
];
|
||||
}
|
||||
|
||||
|
||||
120
flake.lock
generated
120
flake.lock
generated
@@ -54,11 +54,11 @@
|
||||
"base16-helix": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1760703920,
|
||||
"narHash": "sha256-m82fGUYns4uHd+ZTdoLX2vlHikzwzdu2s2rYM2bNwzw=",
|
||||
"lastModified": 1776754714,
|
||||
"narHash": "sha256-E3OAK27smtATTmX45uoTSRsVD+Y+ZiVVfgM/tjpbtYg=",
|
||||
"owner": "tinted-theming",
|
||||
"repo": "base16-helix",
|
||||
"rev": "d646af9b7d14bff08824538164af99d0c521b185",
|
||||
"rev": "4d508123037e7851ad36ebf7d9c48b0e9e1eb581",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -106,11 +106,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1776613567,
|
||||
"narHash": "sha256-gC9Cp5ibBmGD5awCA9z7xy6MW6iJufhazTYJOiGlCUI=",
|
||||
"lastModified": 1777713215,
|
||||
"narHash": "sha256-8GzXDOXckDWwST8TY5DbwYFjdvQLlP7K9CLSVx6iTTo=",
|
||||
"owner": "nix-community",
|
||||
"repo": "disko",
|
||||
"rev": "32f4236bfc141ae930b5ba2fb604f561fed5219d",
|
||||
"rev": "63b4e7e6cf75307c1d26ac3762b886b5b0247267",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -122,11 +122,11 @@
|
||||
"firefox-gnome-theme": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1775176642,
|
||||
"narHash": "sha256-2veEED0Fg7Fsh81tvVDNYR6SzjqQxa7hbi18Jv4LWpM=",
|
||||
"lastModified": 1776136500,
|
||||
"narHash": "sha256-r0gN2brVWA351zwMV0Flmlcd6SGMvYqFbvC3DfKFM8Y=",
|
||||
"owner": "rafaelmardojai",
|
||||
"repo": "firefox-gnome-theme",
|
||||
"rev": "179704030c5286c729b5b0522037d1d51341022c",
|
||||
"rev": "0f8ba203d475587f477e7ae12661bd8459e225b7",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -156,11 +156,11 @@
|
||||
"nixpkgs-lib": "nixpkgs-lib"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1775087534,
|
||||
"narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
|
||||
"lastModified": 1777988971,
|
||||
"narHash": "sha256-qIoWPDs+0/8JecyYgE3gpKQxW/4bLW/gp45vow9ioCQ=",
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
|
||||
"rev": "0678d8986be1661af6bb555f3489f2fdfc31f6ff",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -177,11 +177,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1775087534,
|
||||
"narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
|
||||
"lastModified": 1777988971,
|
||||
"narHash": "sha256-qIoWPDs+0/8JecyYgE3gpKQxW/4bLW/gp45vow9ioCQ=",
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
|
||||
"rev": "0678d8986be1661af6bb555f3489f2fdfc31f6ff",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -273,11 +273,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1776661682,
|
||||
"narHash": "sha256-X32LTSDqUdVqMy85WYdRgyt0I75wc4Lhi9j+lrCDR8w=",
|
||||
"lastModified": 1778248595,
|
||||
"narHash": "sha256-dhFgEjoeJMYN/7OY6xfxS799YB4IjbbYXTjyGIJyLpc=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "4bfce11ea820df0359f73736fd59c7e8f53641a6",
|
||||
"rev": "fdb2ccba9d5e1238d32e0c4a3ec1a277efa80c1d",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -317,11 +317,11 @@
|
||||
"nixpkgs": "nixpkgs"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1776643520,
|
||||
"narHash": "sha256-O6lIvHkvuYNG7WovtyOGu+Z1vYkr/DB2YDF6PchsT/A=",
|
||||
"lastModified": 1778285091,
|
||||
"narHash": "sha256-4YwkGkjvLD0EB7rQGCRA9J/zgwrnTL20dJd7Wmnicj0=",
|
||||
"owner": "nix-community",
|
||||
"repo": "neovim-nightly-overlay",
|
||||
"rev": "4a27c9c5416c624fc35ec0607a9f7ddeb59e7c99",
|
||||
"rev": "cca2a2d1c03f763fdcd7066791363d792313c641",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -333,11 +333,11 @@
|
||||
"neovim-src": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1776639951,
|
||||
"narHash": "sha256-R/STk7D50lC0W6DTu/L+U3IYbd/IJFgikGdwrHbJXU4=",
|
||||
"lastModified": 1778266020,
|
||||
"narHash": "sha256-qoydKalrn/QGsGYVRicz0Hzb7bfGmV7Z9CnVONXN/Lc=",
|
||||
"owner": "neovim",
|
||||
"repo": "neovim",
|
||||
"rev": "5f6abd34f5c12534df0d79ee3507d40106ad505d",
|
||||
"rev": "b7d8a41d91dcfebe9a5f3d0cf2f0bb0b8d59e32e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -348,11 +348,11 @@
|
||||
},
|
||||
"nixos-hardware": {
|
||||
"locked": {
|
||||
"lastModified": 1775490113,
|
||||
"narHash": "sha256-2ZBhDNZZwYkRmefK5XLOusCJHnoeKkoN95hoSGgMxWM=",
|
||||
"lastModified": 1778143761,
|
||||
"narHash": "sha256-lkesY6x2X2qxlqLM7CT2iM/0rP2JB7fruPN3h8POXmI=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixos-hardware",
|
||||
"rev": "c775c2772ba56e906cbeb4e0b2db19079ef11ff7",
|
||||
"rev": "3bcaa367d4c550d687a17ac792fd5cda214ee871",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -364,11 +364,11 @@
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1776329215,
|
||||
"narHash": "sha256-a8BYi3mzoJ/AcJP8UldOx8emoPRLeWqALZWu4ZvjPXw=",
|
||||
"lastModified": 1778124196,
|
||||
"narHash": "sha256-pYEytCNic/czazbV9r3tbQ6BZzqRBg/41x2dIC5ymOo=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "b86751bc4085f48661017fa226dee99fab6c651b",
|
||||
"rev": "68a8af93ff4297686cb68880845e61e5e2e41d92",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -380,11 +380,11 @@
|
||||
},
|
||||
"nixpkgs-lib": {
|
||||
"locked": {
|
||||
"lastModified": 1774748309,
|
||||
"narHash": "sha256-+U7gF3qxzwD5TZuANzZPeJTZRHS29OFQgkQ2kiTJBIQ=",
|
||||
"lastModified": 1777168982,
|
||||
"narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nixpkgs.lib",
|
||||
"rev": "333c4e0545a6da976206c74db8773a1645b5870a",
|
||||
"rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -395,11 +395,11 @@
|
||||
},
|
||||
"nixpkgs-master": {
|
||||
"locked": {
|
||||
"lastModified": 1776662323,
|
||||
"narHash": "sha256-Gkexeq/VVRE4kxElVRv+m4mwKFcFhyWrmOmfbCM/KSE=",
|
||||
"lastModified": 1778360830,
|
||||
"narHash": "sha256-tD44tgf123UcERx3cC91rwefFmGmlTd2M1QdL6d5iLc=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "83604aae06f90be32437da472e2a8d9ebf7f10ff",
|
||||
"rev": "82cbc979e10cf2b893566a0f259daf5e1f26c887",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -411,11 +411,11 @@
|
||||
},
|
||||
"nixpkgs-stable": {
|
||||
"locked": {
|
||||
"lastModified": 1776434932,
|
||||
"narHash": "sha256-gyqXNMgk3sh+ogY5svd2eNLJ6oEwzbAeaoBrrxD0lKk=",
|
||||
"lastModified": 1778003029,
|
||||
"narHash": "sha256-q/nkKLDtHIyLjZpKhWk3cSK5IYsFqtMd6UtXF3ddjgA=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "c7f47036d3df2add644c46d712d14262b7d86c0c",
|
||||
"rev": "0c88e1f2bdb93d5999019e99cb0e61e1fe2af4c5",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -427,11 +427,11 @@
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1776169885,
|
||||
"narHash": "sha256-l/iNYDZ4bGOAFQY2q8y5OAfBBtrDAaPuRQqWaFHVRXM=",
|
||||
"lastModified": 1777954456,
|
||||
"narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "4bd9165a9165d7b5e33ae57f3eecbcb28fb231c9",
|
||||
"rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -453,11 +453,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1775228139,
|
||||
"narHash": "sha256-ebbeHmg+V7w8050bwQOuhmQHoLOEOfqKzM1KgCTexK4=",
|
||||
"lastModified": 1777598946,
|
||||
"narHash": "sha256-X239dAGaU1+gfDj8jKH8GzlqKMcxaVfXOio+uzBOkeE=",
|
||||
"owner": "nix-community",
|
||||
"repo": "NUR",
|
||||
"rev": "601971b9c89e0304561977f2c28fa25e73aa7132",
|
||||
"rev": "5d55af01c0f86be583931fe99207fc56c14134b3",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -550,11 +550,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1776119890,
|
||||
"narHash": "sha256-Zm6bxLNnEOYuS/SzrAGsYuXSwk3cbkRQZY0fJnk8a5M=",
|
||||
"lastModified": 1777944972,
|
||||
"narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
|
||||
"owner": "Mic92",
|
||||
"repo": "sops-nix",
|
||||
"rev": "d4971dd58c6627bfee52a1ad4237637c0a2fb0cd",
|
||||
"rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -583,11 +583,11 @@
|
||||
"tinted-zed": "tinted-zed"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1776170745,
|
||||
"narHash": "sha256-Tl1aZVP5EIlT+k0+iAKH018GLHJpLz3hhJ0LNQOWxCc=",
|
||||
"lastModified": 1778104276,
|
||||
"narHash": "sha256-/DSSnU0LLmOTG/OCgGwYpxP6+5YvxRx2g/GhI4x6aCU=",
|
||||
"owner": "danth",
|
||||
"repo": "stylix",
|
||||
"rev": "e3861617645a43c9bbefde1aa6ac54dd0a44bfa9",
|
||||
"rev": "18ed8d270231e067fe2739998479ed5d7c659c2c",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -630,11 +630,11 @@
|
||||
"tinted-schemes": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1772661346,
|
||||
"narHash": "sha256-4eu3LqB9tPqe0Vaqxd4wkZiBbthLbpb7llcoE/p5HT0=",
|
||||
"lastModified": 1777041405,
|
||||
"narHash": "sha256-BAGZ7ObFV/9Z61OJZun7ifPyhkuHqNuW1QIhQ8LuzCo=",
|
||||
"owner": "tinted-theming",
|
||||
"repo": "schemes",
|
||||
"rev": "13b5b0c299982bb361039601e2d72587d6846294",
|
||||
"rev": "5f868b3a338b6904c47f3833b9c411be641983a8",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -646,11 +646,11 @@
|
||||
"tinted-tmux": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1772934010,
|
||||
"narHash": "sha256-x+6+4UvaG+RBRQ6UaX+o6DjEg28u4eqhVRM9kpgJGjQ=",
|
||||
"lastModified": 1777169200,
|
||||
"narHash": "sha256-h7dDbIzP5hDr9v97w9PL6jdAgXawmj6krcH+959rqpU=",
|
||||
"owner": "tinted-theming",
|
||||
"repo": "tinted-tmux",
|
||||
"rev": "c3529673a5ab6e1b6830f618c45d9ce1bcdd829d",
|
||||
"rev": "f798c2dce44ef815bb6b8f05a82135c7942d35ac",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -662,11 +662,11 @@
|
||||
"tinted-zed": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1772909925,
|
||||
"narHash": "sha256-jx/5+pgYR0noHa3hk2esin18VMbnPSvWPL5bBjfTIAU=",
|
||||
"lastModified": 1777463218,
|
||||
"narHash": "sha256-Bhkozqtq3BKLqWTlmKm8uAptfX4aRGI8QX3eEL54Vpc=",
|
||||
"owner": "tinted-theming",
|
||||
"repo": "base16-zed",
|
||||
"rev": "b4d3a1b3bcbd090937ef609a0a3b37237af974df",
|
||||
"rev": "5768d08ed2e7944a26a958868cdb073cb8856dae",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
||||
@@ -55,7 +55,6 @@ in
|
||||
"git"
|
||||
"gnupg"
|
||||
"harmonia"
|
||||
"initrd-ssh"
|
||||
"localisation"
|
||||
"neovim"
|
||||
"networkmanager"
|
||||
@@ -124,6 +123,7 @@ in
|
||||
"localisation"
|
||||
"networkmanager"
|
||||
"nix-settings"
|
||||
"onepassword"
|
||||
"sway"
|
||||
"udev"
|
||||
"zsh"
|
||||
|
||||
@@ -1,5 +1,7 @@
|
||||
_:
|
||||
{ inputs, ... }:
|
||||
|
||||
{
|
||||
flake.overlays.default = _: _: { };
|
||||
flake.overlays.default = final: _prev: {
|
||||
inherit (inputs.nixpkgs-stable.legacyPackages.${final.stdenv.hostPlatform.system}) mcp-nixos;
|
||||
};
|
||||
}
|
||||
|
||||
@@ -13,19 +13,38 @@
|
||||
documentation.enable = false;
|
||||
environment.defaultPackages = [ ];
|
||||
|
||||
# compressed qcow2, no channel copy
|
||||
# qcow2, no channel copy; post-processed with parallel zstd on qcow2 v3
|
||||
# (~half the size of zlib v2, faster decompress)
|
||||
image.modules.qemu =
|
||||
{ config, modulesPath, ... }:
|
||||
{
|
||||
system.build.image = lib.mkForce (
|
||||
import (modulesPath + "/../lib/make-disk-image.nix") {
|
||||
inherit lib config pkgs;
|
||||
inherit (config.virtualisation) diskSize;
|
||||
let
|
||||
rawImage = import (modulesPath + "/../lib/make-disk-image.nix") {
|
||||
inherit lib config pkgs;
|
||||
inherit (config.virtualisation) diskSize;
|
||||
inherit (config.image) baseName;
|
||||
format = "qcow2";
|
||||
copyChannel = false;
|
||||
partitionTableType = "legacy";
|
||||
};
|
||||
inherit (config.image) baseName;
|
||||
format = "qcow2-compressed";
|
||||
copyChannel = false;
|
||||
partitionTableType = "legacy";
|
||||
}
|
||||
in
|
||||
pkgs.runCommand baseName { nativeBuildInputs = [ pkgs.qemu-utils ]; } ''
|
||||
mkdir -p $out
|
||||
# qemu-img caps -m at 16
|
||||
cores="''${NIX_BUILD_CORES:-4}"
|
||||
[ "$cores" -gt 0 ] || cores=4
|
||||
[ "$cores" -gt 16 ] && cores=16
|
||||
qemu-img convert \
|
||||
-f qcow2 \
|
||||
-O qcow2 \
|
||||
-c \
|
||||
-o compression_type=zstd \
|
||||
-m "$cores" \
|
||||
${rawImage}/${baseName}.qcow2 \
|
||||
$out/${baseName}.qcow2
|
||||
''
|
||||
);
|
||||
};
|
||||
|
||||
@@ -70,7 +89,7 @@
|
||||
features.neovim.dotfiles = inputs.nvim;
|
||||
|
||||
# ensure .config exists with correct ownership before automount
|
||||
systemd.tmpfiles.rules = [ "d /home/matej/.config 0755 matej users -" ];
|
||||
systemd.tmpfiles.rules = [ "d /home/matej/.config 0700 matej users -" ];
|
||||
|
||||
# TODO:(@janezicmatej) replace ssh with virtio-console (hvc0) when qemu 11.0 lands
|
||||
# https://www.mail-archive.com/qemu-devel@nongnu.org/msg1162844.html
|
||||
|
||||
@@ -10,15 +10,13 @@
|
||||
inputs.nixos-hardware.nixosModules.framework-16-amd-ai-300-series
|
||||
];
|
||||
|
||||
features.bootloader.resumeDevice = "/dev/mapper/vg0-swap";
|
||||
features.desktop.bluetooth.enable = true;
|
||||
features.gnupg.yubikey.enable = true;
|
||||
features.udev = {
|
||||
ledger.enable = true;
|
||||
keyboard-zsa.enable = true;
|
||||
};
|
||||
features.power.resumeDevice = "/dev/disk/by-uuid/ff4750e7-3a9f-42c2-bb68-c458a6560540";
|
||||
|
||||
boot.kernelParams = [ "pcie_aspm.policy=powersupersave" ];
|
||||
|
||||
programs.nix-ld.libraries = options.programs.nix-ld.libraries.default;
|
||||
|
||||
|
||||
@@ -37,10 +37,7 @@
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/42D9-FAFD";
|
||||
fsType = "vfat";
|
||||
options = [
|
||||
"fmask=0022"
|
||||
"dmask=0022"
|
||||
];
|
||||
options = [ "umask=0077" ];
|
||||
};
|
||||
|
||||
swapDevices = [
|
||||
|
||||
@@ -6,23 +6,29 @@
|
||||
|
||||
{
|
||||
features.nix-settings.towerCache.enable = false;
|
||||
features.bootloader.mode = "lanzaboote";
|
||||
features.bootloader = {
|
||||
mode = "lanzaboote";
|
||||
initrdSsh = {
|
||||
enable = true;
|
||||
networkModule = "r8169";
|
||||
authorizedKeys = userKeys.sshAuthorizedKeys;
|
||||
};
|
||||
};
|
||||
features.desktop.bluetooth.enable = true;
|
||||
features.gnupg.yubikey.enable = true;
|
||||
features.udev = {
|
||||
ledger.enable = true;
|
||||
keyboard-zsa.enable = true;
|
||||
};
|
||||
features.initrd-ssh = {
|
||||
networkModule = "r8169";
|
||||
authorizedKeys = userKeys.sshAuthorizedKeys;
|
||||
};
|
||||
|
||||
# nix store signing
|
||||
sops.secrets.nix-signing-key.sopsFile = ../../secrets/tower.yaml;
|
||||
nix.settings.secret-key-files = [ config.sops.secrets.nix-signing-key.path ];
|
||||
|
||||
boot.kernelParams = [ "btusb.reset=1" ];
|
||||
# pairs with bootloader's simpledrm initcall blacklist: amdgpu owns fbcon
|
||||
# from the start, no driver-swap mode-set
|
||||
hardware.amdgpu.initrd.enable = true;
|
||||
|
||||
services.udisks2.enable = true;
|
||||
|
||||
|
||||
33
justfile
33
justfile
@@ -2,31 +2,20 @@
|
||||
default:
|
||||
@just --list
|
||||
|
||||
# rebuild and switch
|
||||
switch config="":
|
||||
nixos-rebuild switch --flake .{{ if config != "" { "#" + config } else { "" } }} --sudo
|
||||
|
||||
# fetch flake inputs
|
||||
sync:
|
||||
nix flake prefetch-inputs
|
||||
# rebuild the system
|
||||
rebuild op="switch" host=`hostname`:
|
||||
nixos-rebuild {{op}} --flake .#{{host}} --sudo
|
||||
|
||||
# update flake inputs
|
||||
update:
|
||||
nix flake update
|
||||
|
||||
# update flake inputs, rebuild and switch
|
||||
bump: update switch
|
||||
|
||||
# update a package to latest version
|
||||
update-package pkg:
|
||||
bash packages/{{pkg}}/update.sh
|
||||
|
||||
# update all packages with update scripts
|
||||
update-package-all:
|
||||
update-package:
|
||||
@for script in packages/*/update.sh; do bash "$script"; done
|
||||
|
||||
# build all packages and hosts
|
||||
build:
|
||||
check:
|
||||
nix flake check
|
||||
|
||||
# build installation iso
|
||||
@@ -37,10 +26,6 @@ iso:
|
||||
ephvm *ARGS:
|
||||
bash scripts/ephvm-run.sh {{ARGS}}
|
||||
|
||||
# ssh into running ephemeral VM
|
||||
ephvm-ssh port="2222":
|
||||
ssh -p {{port}} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null matej@localhost
|
||||
|
||||
# provision a host with nixos-anywhere
|
||||
provision host ip:
|
||||
#!/usr/bin/env bash
|
||||
@@ -59,9 +44,9 @@ provision host ip:
|
||||
ssh root@{{ip}} reboot
|
||||
|
||||
# deploy config to a remote host
|
||||
deploy host remote=host:
|
||||
nixos-rebuild switch --flake .#{{host}} --target-host {{remote}} --sudo --ask-sudo-password
|
||||
deploy op="switch" host=`hostname` remote=host:
|
||||
nixos-rebuild {{op}} --flake .#{{host}} --target-host {{remote}} --sudo --ask-sudo-password
|
||||
|
||||
# garbage collect old generations
|
||||
clean:
|
||||
sudo nix-collect-garbage $(nix eval --raw -f ./nix.nix nix.gc.options)
|
||||
clean host=`hostname`:
|
||||
sudo nix-collect-garbage $(nix eval --raw .#nixosConfigurations.{{host}}.config.nix.gc.options)
|
||||
|
||||
@@ -87,6 +87,17 @@ nixpkgs.lib.nixosSystem {
|
||||
{ nixpkgs.config.allowUnfree = true; }
|
||||
{ networking.hostName = name; }
|
||||
|
||||
# TEMP:(@janezicmatej) temporary mitigation for dirty frag
|
||||
# blocks esp4/esp6 (CVE-2026-43284) and rxrpc (CVE-2026-43500)
|
||||
# remove once nixpkgs ships a kernel with f4c50a4034e6 and the rxrpc fix
|
||||
{
|
||||
boot.blacklistedKernelModules = [
|
||||
"esp4"
|
||||
"esp6"
|
||||
"rxrpc"
|
||||
];
|
||||
}
|
||||
|
||||
featureEnableModule
|
||||
hostConfig
|
||||
]
|
||||
|
||||
33
nix.nix
33
nix.nix
@@ -1,33 +0,0 @@
|
||||
{
|
||||
nix = {
|
||||
settings = {
|
||||
experimental-features = [
|
||||
"nix-command"
|
||||
"flakes"
|
||||
];
|
||||
download-buffer-size = 2 * 1024 * 1024 * 1024;
|
||||
warn-dirty = false;
|
||||
substituters = [
|
||||
"https://cache.nixos.org"
|
||||
"https://nix-community.cachix.org?priority=45"
|
||||
"http://tower:5000?priority=50"
|
||||
];
|
||||
trusted-public-keys = [
|
||||
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
|
||||
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
|
||||
"matej.nix-1:TdbemLVYblvAxqJcwb3mVKmmr3cfzXbMcZHE5ILnZDE="
|
||||
];
|
||||
};
|
||||
|
||||
gc = {
|
||||
automatic = true;
|
||||
dates = "monthly";
|
||||
options = "--delete-older-than 30d";
|
||||
};
|
||||
|
||||
optimise = {
|
||||
automatic = true;
|
||||
dates = [ "monthly" ];
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
let
|
||||
inherit (pkgs) stdenv lib;
|
||||
version = "2.1.114";
|
||||
version = "2.1.138";
|
||||
|
||||
# upstream ships platform-native binaries as separate npm packages under
|
||||
# @anthropic-ai/claude-code-<platform>; the wrapper package is just a
|
||||
@@ -10,19 +10,19 @@ let
|
||||
sources = {
|
||||
"x86_64-linux" = {
|
||||
slug = "linux-x64";
|
||||
hash = "sha256-gejcdjRzKnWsvLzxJLfdjr+PeYdOR9tkCOL8owuJuf8=";
|
||||
hash = "sha256-MGYEPPO4O84Egb5Ym/9f56l+TzPqogpSabosvHTIJZg=";
|
||||
};
|
||||
"aarch64-linux" = {
|
||||
slug = "linux-arm64";
|
||||
hash = "sha256-atThX6FuIJe0t7pQRd76ZIVCPd+AKfkLl1a48eLglQE=";
|
||||
hash = "sha256-LWBtOAjPDFtLP93TNrsd8bPHJd7VKK6J90CRxUp1/XQ=";
|
||||
};
|
||||
"x86_64-darwin" = {
|
||||
slug = "darwin-x64";
|
||||
hash = "sha256-1tUHaaE4AI8r7W+vS4wCKTH3OjDOxMRtSzyUt+LHhAs=";
|
||||
hash = "sha256-tkupKzb+XAPmdCRNoT90cfVLKUar3FCTRgufiMVuVPc=";
|
||||
};
|
||||
"aarch64-darwin" = {
|
||||
slug = "darwin-arm64";
|
||||
hash = "sha256-Nx0I2PZgoLeI43c5O4rlyPgEQGDom3RO5pemV9V1vqg=";
|
||||
hash = "sha256-jmB4t11BI1LKanuuXRJv5IBe8a9gSrFvTMP3KarsioU=";
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
@@ -27,14 +27,32 @@ info() {
|
||||
|
||||
# globals for cleanup trap
|
||||
CLEANUP_OVERLAY=""
|
||||
CLEANUP_TMPDIR=""
|
||||
QEMU_PID=""
|
||||
VM_READY=false
|
||||
cleanup() {
|
||||
[ -n "$QEMU_PID" ] && kill "$QEMU_PID" 2>/dev/null && wait "$QEMU_PID" 2>/dev/null
|
||||
[ -n "$CLEANUP_OVERLAY" ] && rm -rf "$CLEANUP_OVERLAY"
|
||||
# preserve tmpdir on abnormal exit so the qemu log survives for inspection
|
||||
if [ -n "$CLEANUP_TMPDIR" ]; then
|
||||
if [ "$VM_READY" = true ]; then
|
||||
rm -rf "$CLEANUP_TMPDIR"
|
||||
else
|
||||
echo "qemu log preserved: $CLEANUP_TMPDIR/qemu.log" >&2
|
||||
fi
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
trap cleanup EXIT
|
||||
|
||||
# returns 0 once the guest's sshd is speaking (first bytes are "SSH-")
|
||||
awaiting_ssh_banner() {
|
||||
local port="$1"
|
||||
local banner
|
||||
banner=$(timeout 2 bash -c "exec 3<>/dev/tcp/localhost/$port; head -c 4 <&3" 2>/dev/null) || return 1
|
||||
[ "$banner" = "SSH-" ]
|
||||
}
|
||||
|
||||
usage() {
|
||||
cat <<EOF
|
||||
Usage: ephvm-run.sh [options]
|
||||
@@ -55,6 +73,8 @@ EOF
|
||||
main() {
|
||||
setup_colors
|
||||
|
||||
[ "$EUID" -eq 0 ] && die "ephvm-run.sh must not run as root"
|
||||
|
||||
local ssh_port="" memory=4G cpus=2 claude=true disk_size="" serial=false
|
||||
local -a mounts=()
|
||||
|
||||
@@ -110,15 +130,13 @@ main() {
|
||||
CLEANUP_OVERLAY=$(mktemp -d)
|
||||
local overlay="$CLEANUP_OVERLAY/overlay.qcow2"
|
||||
qemu-img create -f qcow2 -b "$(realpath "$image")" -F qcow2 "$overlay" "$disk_size"
|
||||
drive_arg="file=$overlay,format=qcow2"
|
||||
drive_arg="if=none,id=hd0,file=$overlay,format=qcow2,cache=writeback,aio=threads,discard=unmap,detect-zeroes=unmap"
|
||||
else
|
||||
drive_arg="file=$image,format=qcow2,snapshot=on"
|
||||
drive_arg="if=none,id=hd0,file=$image,format=qcow2,snapshot=on,cache=writeback,aio=threads,discard=unmap,detect-zeroes=unmap"
|
||||
fi
|
||||
|
||||
command -v qemu-system-x86_64 &>/dev/null || die "qemu-system-x86_64 not found"
|
||||
|
||||
local accel="tcg"
|
||||
[ -r /dev/kvm ] && accel="kvm"
|
||||
[ -r /dev/kvm ] || die "/dev/kvm not readable; kvm is required"
|
||||
|
||||
# auto-allocate ssh port unless serial mode
|
||||
if [ "$serial" = false ] && [ -z "$ssh_port" ]; then
|
||||
@@ -128,28 +146,33 @@ main() {
|
||||
done
|
||||
fi
|
||||
|
||||
local nic_arg="user"
|
||||
local nic_arg="user,model=virtio-net-pci"
|
||||
if [ -n "$ssh_port" ]; then
|
||||
nic_arg="user,hostfwd=tcp::${ssh_port}-:22"
|
||||
nic_arg="user,model=virtio-net-pci,hostfwd=tcp:127.0.0.1:${ssh_port}-:22"
|
||||
fi
|
||||
|
||||
local -a qemu_args=(
|
||||
qemu-system-x86_64
|
||||
-accel "$accel"
|
||||
-accel kvm
|
||||
-cpu host
|
||||
-m "$memory"
|
||||
-smp "$cpus"
|
||||
-drive "$drive_arg"
|
||||
-device "virtio-blk-pci,drive=hd0"
|
||||
-device virtio-rng-pci
|
||||
-nic "$nic_arg"
|
||||
-nographic
|
||||
-sandbox "on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny"
|
||||
)
|
||||
|
||||
if [ "$accel" != "tcg" ]; then
|
||||
qemu_args+=(-cpu host)
|
||||
fi
|
||||
|
||||
local fs_id=0 mount_path name tag
|
||||
for mount_path in "${mounts[@]}"; do
|
||||
[ -e "$mount_path" ] || die "--mount path does not exist: $mount_path"
|
||||
mount_path=$(realpath "$mount_path")
|
||||
# qemu parses -virtfs as csv, a comma in the path would inject options
|
||||
case "$mount_path" in
|
||||
*,*) die "--mount path may not contain commas: $mount_path" ;;
|
||||
esac
|
||||
name=$(basename "$mount_path")
|
||||
tag="m_${name:0:29}"
|
||||
qemu_args+=(
|
||||
@@ -163,6 +186,9 @@ main() {
|
||||
mkdir -p "$CLAUDE_CONFIG_DIR"
|
||||
local claude_dir
|
||||
claude_dir=$(realpath "$CLAUDE_CONFIG_DIR")
|
||||
case "$claude_dir" in
|
||||
*,*) die "claude config dir may not contain commas: $claude_dir" ;;
|
||||
esac
|
||||
|
||||
qemu_args+=(
|
||||
-virtfs "local,path=$claude_dir,mount_tag=claude,security_model=none,id=fs${fs_id}"
|
||||
@@ -171,27 +197,38 @@ main() {
|
||||
fi
|
||||
|
||||
info "---"
|
||||
info "Accel: $accel"
|
||||
[ -n "$ssh_port" ] && info "SSH: ssh -p $ssh_port matej@localhost"
|
||||
info "---"
|
||||
|
||||
if [ "$serial" = true ]; then
|
||||
exec "${qemu_args[@]}"
|
||||
fi
|
||||
|
||||
CLEANUP_TMPDIR=$(mktemp -d)
|
||||
local qemu_log="$CLEANUP_TMPDIR/qemu.log"
|
||||
|
||||
# start qemu in background and auto-ssh
|
||||
"${qemu_args[@]}" &>/dev/null &
|
||||
"${qemu_args[@]}" &>"$qemu_log" &
|
||||
QEMU_PID=$!
|
||||
|
||||
# throwaway ssh key (vm accepts any key via AuthorizedKeysCommand)
|
||||
local ssh_key="$CLEANUP_TMPDIR/id_ed25519"
|
||||
ssh-keygen -t ed25519 -f "$ssh_key" -N "" -q
|
||||
|
||||
info "waiting for vm (port $ssh_port)..."
|
||||
local attempts=0
|
||||
while ! (echo > /dev/tcp/localhost/"$ssh_port") 2>/dev/null; do
|
||||
# poll for the real SSH banner, not TCP accept: qemu's user-mode nic
|
||||
# accepts host-side the moment qemu starts, well before guest sshd is up
|
||||
while ! awaiting_ssh_banner "$ssh_port"; do
|
||||
attempts=$((attempts + 1))
|
||||
[ $attempts -gt 60 ] && die "vm did not become ready in 60s"
|
||||
[ $attempts -gt 120 ] && die "vm did not become ready in 60s"
|
||||
kill -0 "$QEMU_PID" 2>/dev/null || die "qemu exited unexpectedly"
|
||||
sleep 1
|
||||
sleep 0.5
|
||||
done
|
||||
VM_READY=true
|
||||
|
||||
ssh -p "$ssh_port" -t \
|
||||
-i "$ssh_key" \
|
||||
-o StrictHostKeyChecking=no \
|
||||
-o UserKnownHostsFile=/dev/null \
|
||||
-o LogLevel=ERROR \
|
||||
|
||||
Reference in New Issue
Block a user