NeilClack
65a6b256f9
- Wire -dev variants to the radiantwave-dev input (?ref=dev); prod keeps main - Fix android-dev upgradeFlakeRef (was upgrading into production config) - Parameterize one installer module (zero-touch-installer.nix); replace the four near-duplicate ISO configs; mkIso pairs each ISO with its closure + disk layout, fixing commercial-dev/android-dev ISO eval errors - Add missing packages outputs (commercial-dev, android-dev, rpi, rpi-dev) - Set networking.hostName + system.configurationRevision per variant - Remove gitea access token and dead netrc/JWT config (repos are public) - Drop flake.lock update step from CI (lock updates are manual) - Refresh AGENTS.md: variants/ISO tables, facter report procedure, gotchas
121 lines
2.9 KiB
Nix
121 lines
2.9 KiB
Nix
# Parameterized zero-touch installer for kiosk USB images.
|
|
#
|
|
# Usage in flake.nix:
|
|
# (import ./zero-touch-installer.nix { targetConfig = "radiantwavekiosk"; })
|
|
#
|
|
# `targetConfig` must name an entry in self.nixosConfigurations. The target
|
|
# closure and its disko partitioning script are derived from that config, so
|
|
# an image can never install a mismatched system or format the wrong disk
|
|
# layout as long as flake.nix pairs each ISO with its disk-config.nix.
|
|
{ targetConfig }:
|
|
{
|
|
pkgs,
|
|
inputs,
|
|
self,
|
|
...
|
|
}:
|
|
let
|
|
cfg = self.nixosConfigurations.${targetConfig};
|
|
targetSystem = cfg.config.system.build.toplevel;
|
|
diskoScript = cfg.config.system.build.diskoScript;
|
|
|
|
# Keep in sync with myKey in configuration.nix.
|
|
adminKey =
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL4qWNZnYU5JaqR9c2qh6oFZktzVNBOx42PfDaGofCL6 cnclack@pm.me macbook";
|
|
in
|
|
{
|
|
nix.settings = {
|
|
experimental-features = [
|
|
"nix-command"
|
|
"flakes"
|
|
];
|
|
|
|
substituters = [
|
|
"https://cache.nixos.org"
|
|
];
|
|
|
|
flake-registry = "";
|
|
|
|
connect-timeout = 0;
|
|
};
|
|
|
|
nix.registry.nixpkgs = pkgs.lib.mkForce {
|
|
to = {
|
|
type = "path";
|
|
path = "${inputs.nixpkgs}";
|
|
};
|
|
};
|
|
|
|
environment.variables.KIOSK_FLAKE = "${self}";
|
|
|
|
networking.networkmanager.enable = true;
|
|
|
|
users.users.root.openssh.authorizedKeys.keys = [ adminKey ];
|
|
|
|
services.openssh.enable = true;
|
|
|
|
systemd.services.NetworkManager-wait-online.enable = false;
|
|
|
|
systemd.services.zero-touch-install = {
|
|
description = "Zero-Touch Kiosk Installation";
|
|
|
|
wantedBy = [ "multi-user.target" ];
|
|
|
|
# Make sure we own tty1 exclusively - getty@tty1 will otherwise
|
|
# try to spawn a login prompt on the same console.
|
|
conflicts = [ "getty@tty1.service" ];
|
|
after = [ "systemd-udev-settle.service" "getty@tty1.service" ];
|
|
|
|
path = with pkgs; [
|
|
nix
|
|
git
|
|
util-linux
|
|
nixos-install-tools
|
|
curl
|
|
networkmanager
|
|
mount
|
|
umount
|
|
disko
|
|
];
|
|
|
|
environment = {
|
|
NIX_PATH = "nixpkgs=${inputs.nixpkgs}";
|
|
KIOSK_FLAKE = "${self}";
|
|
DISKO_SCRIPT = "${diskoScript}";
|
|
};
|
|
|
|
serviceConfig = {
|
|
StandardInput = "tty";
|
|
StandardOutput = "tty";
|
|
StandardError = "tty";
|
|
TTYPath = "/dev/tty1";
|
|
TTYReset = true;
|
|
TTYVHangup = true;
|
|
TTYVTDisallocate = true;
|
|
};
|
|
|
|
script = ''
|
|
set -euo pipefail
|
|
|
|
echo "Running disko script..."
|
|
echo "Script: $DISKO_SCRIPT"
|
|
|
|
${diskoScript}
|
|
|
|
echo "Installing RadiantWave (${targetConfig})"
|
|
echo "Closure Path: ${targetSystem}"
|
|
|
|
nixos-install \
|
|
--system "${targetSystem}" \
|
|
--no-root-passwd \
|
|
--no-channel-copy
|
|
|
|
echo "============================================"
|
|
echo " Installation complete!"
|
|
echo " Please shut down and remove the flash drive before restarting"
|
|
echo "============================================"
|
|
sleep infinity
|
|
'';
|
|
};
|
|
}
|