Fix dev/prod split and dev ISOs; consolidate zero-touch installer

- Wire -dev variants to the radiantwave-dev input (?ref=dev); prod keeps main - Fix android-dev upgradeFlakeRef (was upgrading into production config) - Parameterize one installer module (zero-touch-installer.nix); replace the four near-duplicate ISO configs; mkIso pairs each ISO with its closure + disk layout, fixing commercial-dev/android-dev ISO eval errors - Add missing packages outputs (commercial-dev, android-dev, rpi, rpi-dev) - Set networking.hostName + system.configurationRevision per variant - Remove gitea access token and dead netrc/JWT config (repos are public) - Drop flake.lock update step from CI (lock updates are manual) - Refresh AGENTS.md: variants/ISO tables, facter report procedure, gotchas
2026-08-23 09:58:46 -05:00
parent 64b2a9cfc4
commit 65a6b256f9
8 changed files with 200 additions and 617 deletions
@@ -0,0 +1,120 @@
+# Parameterized zero-touch installer for kiosk USB images.
+#
+# Usage in flake.nix:
+#   (import ./zero-touch-installer.nix { targetConfig = "radiantwavekiosk"; })
+#
+# `targetConfig` must name an entry in self.nixosConfigurations. The target
+# closure and its disko partitioning script are derived from that config, so
+# an image can never install a mismatched system or format the wrong disk
+# layout as long as flake.nix pairs each ISO with its disk-config.nix.
+{ targetConfig }:
+{
+  pkgs,
+  inputs,
+  self,
+  ...
+}:
+let
+  cfg = self.nixosConfigurations.${targetConfig};
+  targetSystem = cfg.config.system.build.toplevel;
+  diskoScript = cfg.config.system.build.diskoScript;
+
+  # Keep in sync with myKey in configuration.nix.
+  adminKey =
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL4qWNZnYU5JaqR9c2qh6oFZktzVNBOx42PfDaGofCL6 cnclack@pm.me macbook";
+in
+{
+  nix.settings = {
+    experimental-features = [
+      "nix-command"
+      "flakes"
+    ];
+
+    substituters = [
+      "https://cache.nixos.org"
+    ];
+
+    flake-registry = "";
+
+    connect-timeout = 0;
+  };
+
+  nix.registry.nixpkgs = pkgs.lib.mkForce {
+    to = {
+      type = "path";
+      path = "${inputs.nixpkgs}";
+    };
+  };
+
+  environment.variables.KIOSK_FLAKE = "${self}";
+
+  networking.networkmanager.enable = true;
+
+  users.users.root.openssh.authorizedKeys.keys = [ adminKey ];
+
+  services.openssh.enable = true;
+
+  systemd.services.NetworkManager-wait-online.enable = false;
+
+  systemd.services.zero-touch-install = {
+    description = "Zero-Touch Kiosk Installation";
+
+    wantedBy = [ "multi-user.target" ];
+
+    # Make sure we own tty1 exclusively - getty@tty1 will otherwise
+    # try to spawn a login prompt on the same console.
+    conflicts = [ "getty@tty1.service" ];
+    after = [ "systemd-udev-settle.service" "getty@tty1.service" ];
+
+    path = with pkgs; [
+      nix
+      git
+      util-linux
+      nixos-install-tools
+      curl
+      networkmanager
+      mount
+      umount
+      disko
+    ];
+
+    environment = {
+      NIX_PATH = "nixpkgs=${inputs.nixpkgs}";
+      KIOSK_FLAKE = "${self}";
+      DISKO_SCRIPT = "${diskoScript}";
+    };
+
+    serviceConfig = {
+      StandardInput = "tty";
+      StandardOutput = "tty";
+      StandardError = "tty";
+      TTYPath = "/dev/tty1";
+      TTYReset = true;
+      TTYVHangup = true;
+      TTYVTDisallocate = true;
+    };
+
+    script = ''
+      set -euo pipefail
+
+      echo "Running disko script..."
+      echo "Script: $DISKO_SCRIPT"
+
+      ${diskoScript}
+
+      echo "Installing RadiantWave (${targetConfig})"
+      echo "Closure Path: ${targetSystem}"
+
+      nixos-install \
+        --system "${targetSystem}" \
+        --no-root-passwd \
+        --no-channel-copy
+
+      echo "============================================"
+      echo " Installation complete!"
+      echo " Please shut down and remove the flash drive before restarting"
+      echo "============================================"
+      sleep infinity
+    '';
+  };
+}