Commit 27d84996f88b
Changed files (4)
imperative/kyushu/bootstrap.sh
@@ -138,99 +138,29 @@ POLICY
}
# --- Phase 4: System config files ---
-# These were previously managed by system-manager, but its activation
-# clobbers /etc/profile.d, /etc/systemd/system, and /etc/tmpfiles.d
-# with nix-store symlinks, breaking Fedora's shell/NSS setup.
-# Instead, we write the 4 useful files directly.
+# Generated by nix from globals.nix, deployed without system-manager.
+# system-manager's activation clobbers /etc/profile.d, /etc/systemd/system,
+# and /etc/tmpfiles.d with nix-store symlinks, breaking Fedora's shell/NSS.
setup_system_configs() {
- log_info "Writing system config files..."
+ log_info "Building and deploying system config files..."
- # /etc/hosts — VPN hostnames
- log_info "Writing /etc/hosts..."
- sudo tee /etc/hosts >/dev/null <<-'EOF'
- 127.0.0.1 localhost
- ::1 localhost
- 10.100.0.1 carthage.vpn
- 10.100.0.14 okinawa.vpn
- 10.100.0.16 sakhalin.vpn
- 10.100.0.17 aomi.vpn
- 10.100.0.19 kyushu.vpn
- 10.100.0.2 shikoku.vpn
- 10.100.0.49 aion.vpn
- 10.100.0.5 hokkaido.vpn
- 10.100.0.50 rhea.vpn
- 10.100.0.64 osaka.vpn
- 10.100.0.65 suzu.vpn
- 10.100.0.8 wakasu.vpn
- 10.100.0.80 nagoya.vpn
- 10.100.0.81 hass.vpn
- 10.100.0.82 demeter.vpn
- 10.100.0.83 athena.vpn
- 10.100.0.89 aix.vpn
- 192.168.1.115 hokkaido.home
- 192.168.1.181 hass.home
- 192.168.1.182 demeter.home
- 192.168.1.183 athena.home
- 192.168.1.20 synodine.home
- 192.168.1.23 aomi.home
- 192.168.1.24 shikoku.home
- 192.168.1.36 kyushu.home
- 192.168.1.42 okinawa.home
- 192.168.1.49 aion.home
- 192.168.1.50 rhea.home
- 192.168.1.68 kyushu.home
- 192.168.1.70 sakhalin.home
- 192.168.1.80 nagoya.home
- EOF
-
- # /etc/wireguard/wg0.conf
- log_info "Writing /etc/wireguard/wg0.conf..."
- sudo mkdir -p /etc/wireguard
- sudo tee /etc/wireguard/wg0.conf >/dev/null <<-'EOF'
- [Interface]
- PostUp = wg set %i private-key /etc/wireguard/private.key
- Address = 10.100.0.19/24
-
- [Peer]
- PublicKey = PQD1dtxhy9NMbmfy2OQPeLiQg0Alcfa1Mo4HVN5WqgA=
- AllowedIPs = 10.100.0.0/24
- Endpoint = 46.224.100.116:51820
- PersistentKeepalive = 25
- EOF
- sudo chmod 600 /etc/wireguard/wg0.conf
-
- # /etc/nix/nix.custom.conf
- log_info "Writing /etc/nix/nix.custom.conf..."
- if [[ -f /etc/nix/nix.custom.conf ]]; then
- # Determinate installer owns this file; append if our settings are missing
- if ! grep -q 'trusted-users' /etc/nix/nix.custom.conf 2>/dev/null; then
- sudo tee -a /etc/nix/nix.custom.conf >/dev/null <<-'EOF'
- trusted-users = root @wheel
- extra-substituters = http://okinawa.vpn:5000
- extra-trusted-public-keys = cache.okinawa.home:gp+IG0OaO4L/J0drL8OwmDtMPmdUq4kfLwg3mR8BkCs=
- EOF
- fi
+ # Ensure nix is in PATH
+ if ! command -v nix &>/dev/null; then
+ # shellcheck disable=SC1091
+ . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
fi
- # NetworkManager dispatcher — preserve WireGuard route under RH VPN
- log_info "Writing NetworkManager dispatcher script..."
- sudo mkdir -p /etc/NetworkManager/dispatcher.d
- sudo tee /etc/NetworkManager/dispatcher.d/99-wireguard-route >/dev/null <<-'SCRIPT'
- #!/bin/bash
- INTERFACE="$1"
- ACTION="$2"
- if [[ "$INTERFACE" == "tun0" && "$ACTION" == "vpn-up" ]]; then
- # Find the VPN routing table (usually 75)
- TABLE=$(ip rule show | grep -oP 'lookup \K[0-9]+' | head -1)
- if [[ -n "$TABLE" && "$TABLE" != "local" ]]; then
- ip route add 10.100.0.0/24 dev wg0 table "$TABLE" 2>/dev/null || true
- fi
- fi
- SCRIPT
- sudo chmod 755 /etc/NetworkManager/dispatcher.d/99-wireguard-route
+ cd "$REPO_PATH"
- log_info "System config files written!"
+ local config_path
+ config_path=$(nix build ".#fedoraConfigs.${SYSTEM_CONFIG}" --no-link --print-out-paths)
+
+ log_info "Built: $config_path"
+ log_info "Deploying config files..."
+ sudo "${config_path}/deploy"
+
+ log_info "System config files deployed!"
}
# --- Phase 5: Native apps (dnf/flatpak) ---
systems/common/fedora-work/gen-configs.nix
@@ -0,0 +1,77 @@
+# Generate system config files for Fedora work hosts without system-manager.
+# Usage: nix build .#fedoraConfigs.<hostname>
+# Then: sudo ./result/deploy
+{
+ lib,
+ pkgs,
+ globals,
+ libx,
+ hostname,
+}:
+let
+ machine = globals.machines.${hostname};
+ hostsEntries = libx.hostConfigs globals.machines;
+ hostsFile = lib.concatStringsSep "\n" (
+ lib.mapAttrsToList (ip: names: "${ip} ${lib.concatStringsSep " " names}") hostsEntries
+ );
+
+ hosts = pkgs.writeText "hosts" ''
+ 127.0.0.1 localhost
+ ::1 localhost
+ ${hostsFile}
+ '';
+
+ wgConf = pkgs.writeText "wg0.conf" ''
+ [Interface]
+ PostUp = wg set %i private-key /etc/wireguard/private.key
+ Address = ${builtins.head machine.net.vpn.ips}/24
+
+ [Peer]
+ PublicKey = ${globals.machines.carthage.net.vpn.pubkey}
+ AllowedIPs = 10.100.0.0/24
+ Endpoint = ${globals.net.vpn.endpoint}:51820
+ PersistentKeepalive = 25
+ '';
+
+ nixCustomConf = pkgs.writeText "nix.custom.conf" ''
+ trusted-users = root @wheel
+ extra-substituters = http://okinawa.vpn:5000
+ extra-trusted-public-keys = cache.okinawa.home:gp+IG0OaO4L/J0drL8OwmDtMPmdUq4kfLwg3mR8BkCs=
+ '';
+
+ nmDispatcher = pkgs.writeScript "99-wireguard-route" ''
+ #!/bin/bash
+ INTERFACE="$1"
+ ACTION="$2"
+ if [[ "$INTERFACE" == "tun0" && "$ACTION" == "vpn-up" ]]; then
+ TABLE=$(ip rule show | grep -oP 'lookup \K[0-9]+' | head -1)
+ if [[ -n "$TABLE" && "$TABLE" != "local" ]]; then
+ ip route add 10.100.0.0/24 dev wg0 table "$TABLE" 2>/dev/null || true
+ fi
+ fi
+ '';
+
+ deployScript = pkgs.writeShellScript "deploy-configs" ''
+ set -euo pipefail
+ echo "Deploying system configs for ${hostname}..."
+ install -m 0644 ${hosts} /etc/hosts
+ mkdir -p /etc/wireguard
+ install -m 0600 ${wgConf} /etc/wireguard/wg0.conf
+ if [ -f /etc/nix/nix.custom.conf ]; then
+ if ! grep -q 'trusted-users' /etc/nix/nix.custom.conf 2>/dev/null; then
+ cat ${nixCustomConf} >> /etc/nix/nix.custom.conf
+ fi
+ fi
+ mkdir -p /etc/NetworkManager/dispatcher.d
+ install -m 0755 ${nmDispatcher} /etc/NetworkManager/dispatcher.d/99-wireguard-route
+ echo "Done!"
+ '';
+in
+pkgs.runCommand "fedora-configs-${hostname}" { } ''
+ mkdir -p $out/etc/wireguard $out/etc/NetworkManager/dispatcher.d $out/etc/nix
+ cp ${hosts} $out/etc/hosts
+ cp ${wgConf} $out/etc/wireguard/wg0.conf
+ cp ${nixCustomConf} $out/etc/nix/nix.custom.conf
+ cp ${nmDispatcher} $out/etc/NetworkManager/dispatcher.d/99-wireguard-route
+ cp ${deployScript} $out/deploy
+''
flake.nix
@@ -138,6 +138,30 @@
praetorian = inputs.praetorian.nixosModules.praetorian;
};
+ # Fedora config files (no system-manager, just the useful files)
+ fedoraConfigs =
+ let
+ mkFedoraConfigs =
+ hostname:
+ let
+ pkgs = import inputs.nixpkgs { system = "x86_64-linux"; };
+ globals = import ./globals.nix {
+ inherit (inputs.nixpkgs) lib;
+ inherit hostname;
+ };
+ fedoraLibx = import ./lib/functions.nix { inherit (inputs.nixpkgs) lib; };
+ in
+ import ./systems/common/fedora-work/gen-configs.nix {
+ inherit (inputs.nixpkgs) lib;
+ inherit pkgs globals hostname;
+ libx = fedoraLibx;
+ };
+ in
+ {
+ kyushu = mkFedoraConfigs "kyushu";
+ aomi = mkFedoraConfigs "aomi";
+ };
+
# system-manager configurations
systemConfigs = {
aion = libx.mkSystemManager {
Makefile
@@ -56,32 +56,24 @@ home/%/switch: FORCE ## Switch a home-manager config (e.g., make home/vdemeest@a
nix run home-manager -- switch --flake .#$* -b backup
.PHONY: host/aomi/build
-host/aomi/build: ## Build home-manager + system-manager for aomi
+host/aomi/build: ## Build home-manager + system configs for aomi
nix build .#homeConfigurations.vdemeest@aomi.activationPackage --no-link
- nix build .#systemConfigs.aomi --no-link
+ nix build .#fedoraConfigs.aomi --no-link
.PHONY: host/aomi/switch
-host/aomi/switch: ## Switch home-manager + system-manager for aomi
- nix run home-manager -- switch --flake .#vdemeest@aomi -b backup
- nix build .#systemConfigs.aomi && sudo ./result/bin/activate
-
-.PHONY: home/aomi/switch
-home/aomi/switch: ## Switch home-manager config for aomi (home only)
+host/aomi/switch: ## Switch home-manager + system configs for aomi
nix run home-manager -- switch --flake .#vdemeest@aomi -b backup
+ nix build .#fedoraConfigs.aomi && sudo ./result/deploy
.PHONY: host/kyushu/build
-host/kyushu/build: ## Build home-manager + system-manager for kyushu
+host/kyushu/build: ## Build home-manager + system configs for kyushu
nix build .#homeConfigurations.vdemeest@kyushu.activationPackage --no-link
- nix build .#systemConfigs.kyushu --no-link
+ nix build .#fedoraConfigs.kyushu --no-link
.PHONY: host/kyushu/switch
-host/kyushu/switch: ## Switch home-manager + system-manager for kyushu
- nix run home-manager -- switch --flake .#vdemeest@kyushu -b backup
- nix build .#systemConfigs.kyushu && sudo ./result/bin/activate
-
-.PHONY: home/kyushu/switch
-home/kyushu/switch: ## Switch home-manager config for kyushu (home only)
+host/kyushu/switch: ## Switch home-manager + system configs for kyushu
nix run home-manager -- switch --flake .#vdemeest@kyushu -b backup
+ nix build .#fedoraConfigs.kyushu && sudo ./result/deploy
##@ Local System Operations