nilsandClaude Opus 5.5
daa70fe7ac
nixosModules.image builds a GPT disk image with systemd-repart: ESP with a UKI carrying the store's verity root hash, an erofs /nix/store on a dm-verity partition, a tmpfs root, an immutable /etc overlay and an ext4 state partition on /var. No Nix on the device; it is replaced as a whole. The store is made with 4 KiB erofs blocks: systemd-repart passes the 512 byte sector size to mkfs.erofs, and libblkid cannot verify the checksum of such a superblock, so udev never reported the file system and the initrd waited forever for /dev/mapper/usr. examples/image (nix build .#image) is a hardware test build with a debug console password; checks.image boots the image under UEFI. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
59 lines
1.7 KiB
Nix
59 lines
1.7 KiB
Nix
# A bootable appliance image for trying the verity/read-only layout on real
|
|
# hardware (`nix build .#image`, then write image.raw to a disk). Same network
|
|
# shape as examples/desktop: one NIC, LAN untagged, PPPoE on VLAN 1001.
|
|
#
|
|
# DEBUGGING ONLY: root has the console password `testtest`, readable in the
|
|
# Nix store and this repository. Remove it before any real use.
|
|
{ lib, ... }:
|
|
{
|
|
imports = [ ../../modules/image ];
|
|
|
|
networking.hostName = "router";
|
|
system.stateVersion = "26.11";
|
|
|
|
# Generic UEFI PC: storage, USB keyboard and NIC drivers in the initrd.
|
|
boot.initrd.availableKernelModules = [
|
|
"ahci"
|
|
"nvme"
|
|
"xhci_pci"
|
|
"usb_storage"
|
|
"sd_mod"
|
|
"virtio_blk"
|
|
"virtio_pci"
|
|
"virtio_scsi"
|
|
];
|
|
|
|
users.users.root.openssh.authorizedKeys.keys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHqyMLgAhEdnrRrd2CeYbphGDMPq/cBDjFJ4q4ItZusn nils@Nilss-Mac-mini.mch.stinnesbeck.com"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBFxbNNk87tvMxruuKvrryK7iAdf4xgS4xFqjKejNAI6 nils@nixtop"
|
|
];
|
|
users.users.root.password = "testtest";
|
|
warnings = [
|
|
"examples/image: root has the well-known debug console password `testtest`; remove it before production use."
|
|
];
|
|
|
|
router = {
|
|
enable = true;
|
|
wan = {
|
|
interface = "enp2s0";
|
|
ipv4 = {
|
|
type = "pppoe";
|
|
pppoe = {
|
|
vlan = 1001;
|
|
username = "CHANGE-ME@isp.example";
|
|
passwordFile = "/var/lib/router/pppoe-password";
|
|
};
|
|
};
|
|
};
|
|
lans.main = {
|
|
interface = "enp2s0";
|
|
internet = true;
|
|
ipv4.address = "192.168.10.1";
|
|
dhcp.pool = {
|
|
start = "192.168.10.100";
|
|
end = "192.168.10.199";
|
|
};
|
|
};
|
|
};
|
|
}
|