| author |  clover caruso <git@paperclover.net> 2026-10-03 21:10:14-07:00 |
| committer | clover caruso <git@paperclover.net> 2026-10-03 21:15:45-07:00 |
| log | 81fe4b4ac91d4d63a8aac700e5b9e89c52b0f29b |
| tree | cda67614c112a170faa0503e30fbcc81acb6a2e9 |
| parent | c64219e7951c831e93c786d0f5a74ad685f066d5 |
| signature | Signed by SSH key SHA256:52mNGHRsVFBDED9IAX5pe+LRWUefqTbxEReunq21QvU (~clover) |
Bundle an infra-2 installer with main and a cached dashboard
Add a BIOS and USB capable NixOS installer with migration tools and key-only SSH. Share Zenith’s existing public admin key between the live installer and installed system.
Assisted-by: gpt-64 files changed, 40 insertions(+), 2 deletions(-)
config/admin.pub created+1
| ... | ... | @@ -0,0 +1 @@ |
| 1 | ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMpxNpkRLTUijhd3HSaOvKYn2MWXEY+YEFdsPNZhBROn clo@sandwich.local |
flake.nix+23
| ... | ... | @@ -6,9 +6,32 @@ |
| 6 | 6 | outputs = { self, nixpkgs, ... }: { |
| 7 | 7 | packages.x86_64-linux.dashboard = nixpkgs.legacyPackages.x86_64-linux.callPackage ./nixos/dashboard.nix { }; |
| 8 | 8 | packages.x86_64-linux.dashboard-image = self.packages.x86_64-linux.dashboard.image; |
| 9 | packages.x86_64-linux.installer = self.nixosConfigurations.installer.config.system.build.isoImage; | |
| 9 | 10 | |
| 10 | 11 | packages.aarch64-darwin.qemu = nixpkgs.legacyPackages.aarch64-darwin.qemu; |
| 11 | 12 | |
| 13 | nixosConfigurations.installer = nixpkgs.lib.nixosSystem { | |
| 14 | system = "x86_64-linux"; | |
| 15 | modules = [ | |
| 16 | "${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix" | |
| 17 | ({ lib, pkgs, ... }: { | |
| 18 | networking.hostName = "infra-2-installer"; | |
| 19 | boot.zfs.forceImportRoot = false; | |
| 20 | users.users.root.openssh.authorizedKeys.keys = [ (lib.fileContents ./config/admin.pub) ]; | |
| 21 | services.openssh.settings = { | |
| 22 | PasswordAuthentication = false; | |
| 23 | KbdInteractiveAuthentication = false; | |
| 24 | }; | |
| 25 | nix.settings.experimental-features = [ "nix-command" "flakes" ]; | |
| 26 | environment.etc."infra-2".source = self; | |
| 27 | environment.systemPackages = [ | |
| 28 | (pkgs.callPackage ./nixos/pkl.nix { }) pkgs.python3 pkgs.rsync | |
| 29 | ]; | |
| 30 | isoImage.storeContents = [ self.packages.x86_64-linux.dashboard-image ]; | |
| 31 | }) | |
| 32 | ]; | |
| 33 | }; | |
| 34 | ||
| 12 | 35 | nixosConfigurations.vm = nixpkgs.lib.nixosSystem { |
| 13 | 36 | system = "x86_64-linux"; |
| 14 | 37 | modules = [ ./nixos/configuration.nix ./nixos/vm.nix ]; |
nixos/zenith.nix+2-2
| ... | ... | @@ -1,6 +1,6 @@ |
| 1 | { pkgs, ... }: | |
| 1 | { lib, pkgs, ... }: | |
| 2 | 2 | let |
| 3 | adminKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMpxNpkRLTUijhd3HSaOvKYn2MWXEY+YEFdsPNZhBROn clo@sandwich.local"; | |
| 3 | adminKey = lib.fileContents ../config/admin.pub; | |
| 4 | 4 | in |
| 5 | 5 | { |
| 6 | 6 | networking.hostName = "zenith"; |
readme.md+14
| ... | ... | @@ -37,6 +37,20 @@ at upload time. Their frozen contents are part of the release digest. |
| 37 | 37 | `main` joins the infra-2 and home-infra histories. Its tree contains infra-2; |
| 38 | 38 | the retired configuration remains available in the home-infra parent history. |
| 39 | 39 | |
| 40 | ## installer | |
| 41 | ||
| 42 | After publishing main, build the prepared USB image on an x86 Linux host: | |
| 43 | ||
| 44 | ```sh | |
| 45 | nix build --extra-experimental-features 'nix-command flakes' path:/opt/studio/main#installer | |
| 46 | ``` | |
| 47 | ||
| 48 | The ISO is in `result/iso/`. It boots a live installer with this Mac's SSH key, | |
| 49 | ZFS and migration tools, the uploaded repository at `/etc/infra-2`, and a cached | |
| 50 | dashboard image. It does not install automatically. The physical installation | |
| 51 | uses `#zenith` after generating its hardware configuration; the existing data | |
| 52 | pool and service state follow the [handoff](tools/legacy-handoff.md). | |
| 53 | ||
| 40 | 54 | ## filesystem layout |
| 41 | 55 | |
| 42 | 56 | The computer mounts the ZFS root dataset under `/srv`, meaning "server," loosely |