Commit 61d2fe14adca
Changed files (2)
imperative
kyushu
imperative/kyushu/bootstrap.sh
@@ -137,27 +137,100 @@ POLICY
log_info "SELinux policy installed"
}
-# --- Phase 4: System-manager ---
+# --- Phase 4: System config files ---
+# These were previously managed by system-manager, but its activation
+# clobbers /etc/profile.d, /etc/systemd/system, and /etc/tmpfiles.d
+# with nix-store symlinks, breaking Fedora's shell/NSS setup.
+# Instead, we write the 4 useful files directly.
-build_and_activate() {
- log_info "Building system-manager config: $SYSTEM_CONFIG"
+setup_system_configs() {
+ log_info "Writing system config files..."
- # Ensure nix is in PATH
- if ! command -v nix &>/dev/null; then
- # shellcheck disable=SC1091
- . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+ # /etc/hosts — VPN hostnames
+ log_info "Writing /etc/hosts..."
+ sudo tee /etc/hosts >/dev/null <<-'EOF'
+ 127.0.0.1 localhost
+ ::1 localhost
+ 10.100.0.1 carthage.vpn
+ 10.100.0.14 okinawa.vpn
+ 10.100.0.16 sakhalin.vpn
+ 10.100.0.17 aomi.vpn
+ 10.100.0.19 kyushu.vpn
+ 10.100.0.2 shikoku.vpn
+ 10.100.0.49 aion.vpn
+ 10.100.0.5 hokkaido.vpn
+ 10.100.0.50 rhea.vpn
+ 10.100.0.64 osaka.vpn
+ 10.100.0.65 suzu.vpn
+ 10.100.0.8 wakasu.vpn
+ 10.100.0.80 nagoya.vpn
+ 10.100.0.81 hass.vpn
+ 10.100.0.82 demeter.vpn
+ 10.100.0.83 athena.vpn
+ 10.100.0.89 aix.vpn
+ 192.168.1.115 hokkaido.home
+ 192.168.1.181 hass.home
+ 192.168.1.182 demeter.home
+ 192.168.1.183 athena.home
+ 192.168.1.20 synodine.home
+ 192.168.1.23 aomi.home
+ 192.168.1.24 shikoku.home
+ 192.168.1.36 kyushu.home
+ 192.168.1.42 okinawa.home
+ 192.168.1.49 aion.home
+ 192.168.1.50 rhea.home
+ 192.168.1.68 kyushu.home
+ 192.168.1.70 sakhalin.home
+ 192.168.1.80 nagoya.home
+ EOF
+
+ # /etc/wireguard/wg0.conf
+ log_info "Writing /etc/wireguard/wg0.conf..."
+ sudo mkdir -p /etc/wireguard
+ sudo tee /etc/wireguard/wg0.conf >/dev/null <<-'EOF'
+ [Interface]
+ PostUp = wg set %i private-key /etc/wireguard/private.key
+ Address = 10.100.0.19/24
+
+ [Peer]
+ PublicKey = PQD1dtxhy9NMbmfy2OQPeLiQg0Alcfa1Mo4HVN5WqgA=
+ AllowedIPs = 10.100.0.0/24
+ Endpoint = 46.224.100.116:51820
+ PersistentKeepalive = 25
+ EOF
+ sudo chmod 600 /etc/wireguard/wg0.conf
+
+ # /etc/nix/nix.custom.conf
+ log_info "Writing /etc/nix/nix.custom.conf..."
+ if [[ -f /etc/nix/nix.custom.conf ]]; then
+ # Determinate installer owns this file; append if our settings are missing
+ if ! grep -q 'trusted-users' /etc/nix/nix.custom.conf 2>/dev/null; then
+ sudo tee -a /etc/nix/nix.custom.conf >/dev/null <<-'EOF'
+ trusted-users = root @wheel
+ extra-substituters = http://okinawa.vpn:5000
+ extra-trusted-public-keys = cache.okinawa.home:gp+IG0OaO4L/J0drL8OwmDtMPmdUq4kfLwg3mR8BkCs=
+ EOF
+ fi
fi
- cd "$REPO_PATH"
+ # NetworkManager dispatcher — preserve WireGuard route under RH VPN
+ log_info "Writing NetworkManager dispatcher script..."
+ sudo mkdir -p /etc/NetworkManager/dispatcher.d
+ sudo tee /etc/NetworkManager/dispatcher.d/99-wireguard-route >/dev/null <<-'SCRIPT'
+ #!/bin/bash
+ INTERFACE="$1"
+ ACTION="$2"
+ if [[ "$INTERFACE" == "tun0" && "$ACTION" == "vpn-up" ]]; then
+ # Find the VPN routing table (usually 75)
+ TABLE=$(ip rule show | grep -oP 'lookup \K[0-9]+' | head -1)
+ if [[ -n "$TABLE" && "$TABLE" != "local" ]]; then
+ ip route add 10.100.0.0/24 dev wg0 table "$TABLE" 2>/dev/null || true
+ fi
+ fi
+ SCRIPT
+ sudo chmod 755 /etc/NetworkManager/dispatcher.d/99-wireguard-route
- local system_path
- system_path=$(nix build ".#systemConfigs.${SYSTEM_CONFIG}" --no-link --print-out-paths)
-
- log_info "Built: $system_path"
- log_info "Activating system-manager..."
- sudo "${system_path}/bin/activate"
-
- log_info "System-manager activated!"
+ log_info "System config files written!"
}
# --- Phase 5: Native apps (dnf/flatpak) ---
@@ -257,6 +330,8 @@ setup_unscd() {
local tmpdir
tmpdir=$(mktemp -d)
curl -sSL https://busybox.net/~vda/unscd/nscd-0.54.c -o "${tmpdir}/nscd.c"
+ # Newer glibc removed __nss_disable_nscd from headers; provide a stub
+ sed -i '/^void __nss_disable_nscd(/c\void __nss_disable_nscd(void (*hell)(size_t, struct traced_file*)) {}' "${tmpdir}/nscd.c"
gcc -O2 -o "${tmpdir}/unscd" "${tmpdir}/nscd.c"
sudo install -m 755 "${tmpdir}/unscd" /usr/local/sbin/unscd
rm -rf "${tmpdir}"
@@ -362,13 +437,11 @@ print_summary() {
log_info "║ Kyushu (Fedora CSB) Bootstrap Done ║"
log_info "╠═══════════════════════════════════════════╣"
log_info "║ Nix: ✓ installed ║"
- log_info "║ System-manager: ✓ activated ║"
+ log_info "║ System configs: ✓ written ║"
log_info "║ Home-manager: ✓ activated ║"
log_info "║ Native apps: ✓ installed ║"
log_info "╠═══════════════════════════════════════════╣"
- log_info "║ Rebuild system: ║"
- log_info "║ nix build .#systemConfigs.kyushu ║"
- log_info "║ sudo ./result/bin/activate ║"
+ log_info "║ Rebuild home: ║"
log_info "║ Rebuild home: ║"
log_info "║ home-manager switch --flake .#vdemeest@kyushu ║"
log_info "╚═══════════════════════════════════════════╝"
@@ -390,7 +463,7 @@ main() {
install_native_apps
setup_tpm
setup_unscd
- build_and_activate
+ setup_system_configs
setup_wireguard
setup_shell
setup_home_manager
imperative/kyushu/README.md
@@ -1,17 +1,21 @@
# Kyushu — Fedora CSB + Nix
-ThinkPad X1 Carbon Gen 9 running Red Hat CSB (Fedora), managed with Nix
-system-manager and home-manager.
+ThinkPad X1 Carbon Gen 12 running Red Hat CSB (Fedora), managed with Nix
+home-manager and manual system config files.
## Architecture
```
Fedora CSB (base OS, IT-managed)
└── Nix (Determinate installer)
- ├── system-manager → WireGuard config, nix.custom.conf
- └── home-manager → shell, editors, dev tools, syncthing
+ ├── home-manager → shell, editors, dev tools, syncthing
+ └── Manual configs → /etc/hosts, WireGuard, nix.custom.conf, NM dispatcher
```
+Note: system-manager is intentionally NOT used — its activation clobbers
+`/etc/profile.d`, `/etc/systemd/system`, and `/etc/tmpfiles.d` with nix-store
+symlinks, breaking Fedora's shell and NSS/LDAP setup.
+
## Bootstrap
From another machine with SSH access to kyushu:
@@ -38,28 +42,37 @@ setup_tpm
```bash
cd ~/src/home
-# System-manager (WireGuard config, nix settings)
-nix build .#systemConfigs.kyushu && sudo ./result/bin/activate
-
# Home-manager (dev tools, shell, emacs, syncthing)
home-manager switch --flake .#vdemeest@kyushu
```
+System config files (`/etc/hosts`, WireGuard, etc.) are written once by
+the bootstrap. To update them, re-run the relevant phase:
+
+```bash
+source imperative/kyushu/bootstrap.sh
+setup_system_configs
+```
+
## WireGuard
+
+The bootstrap writes `/etc/wireguard/wg0.conf`. You need to place the
+private key manually:
+
+```bash
+# Restore backed-up key (same pubkey, no globals.nix update needed)
+sudo cp ~/tmp/kyushu-wg-private.key /etc/wireguard/private.key
+sudo chmod 600 /etc/wireguard/private.key
+sudo systemctl restart wg-quick@wg0
+```
-The system-manager config writes `/etc/wireguard/wg0.conf` but uses a
-placeholder for the private key. After first activation:
+Or generate a new keypair:
```bash
-# Option 1: Generate a new keypair, then update globals.nix
wg genkey | sudo tee /etc/wireguard/private.key
sudo cat /etc/wireguard/private.key | wg pubkey
# → update globals.nix machines.kyushu.net.vpn.pubkey
# (current VPN IP: 10.100.0.19)
-
-# Option 2: Restore backed-up key (if same pubkey)
-sudo cp /path/to/backup/private.key /etc/wireguard/
-
sudo chmod 600 /etc/wireguard/private.key
sudo systemctl restart wg-quick@wg0
```
@@ -70,13 +83,9 @@ After home-manager activation, Syncthing runs as a user service. The
device ID needs to be updated in `globals.nix` after first run:
```bash
-# Get the current device ID
curl -s http://localhost:8384/rest/system/status | jq -r .myID
```
-Update `globals.nix` with the new device ID, then deploy to other hosts
-so they accept the new kyushu.
-
## Passage
After WireGuard is up and the passage store is cloned:
@@ -85,11 +94,9 @@ After WireGuard is up and the passage store is cloned:
2. Add the public key to `.age-recipients` in the passage store
3. Remove the old kyushu TPM pubkey
4. Run `passage reencrypt` from a machine with YubiKey #1
- (needed for `redhat/ldap` which only has YubiKey + aomi TPM recipients)
## Differences from aomi
- **No CRC** — no local OpenShift cluster needed
- **No lid-close override** — default suspend behavior is fine
-- Same shared work-Fedora profile (`home/common/profiles/work-fedora.nix`,
- `systems/common/fedora-work/system.nix`)
+- **No system-manager** — config files written directly by bootstrap