Add darwin-configuration.nix for mac mini m1
Rob Vermaas committed
Dec 13, 2021 at 21:48 UTC
00d2dd3c4fb3153df9bcb253113515c3a4bbe564
2 files changed
+186
macs/macmini-m1/apply.sh
new
+94
@@ -0,0 +1,94 @@
1
+#!/usr/bin/env bash
2
+
3
+echo "apply started at $(date)" | nc -w0 -u 10.172.170.1 1514
4
+
5
+printf '\n*.*\t@10.172.170.1:1514\n' | tee -a /etc/syslog.conf
6
+pkill syslog
7
+pkill asl
8
+
9
+exec 3>&1
10
+exec 2> >(nc -u 10.172.170.1 1514)
11
+exec 1>&2
12
+
13
+PS4='${BASH_SOURCE}::${FUNCNAME[0]}::$LINENO '
14
+set -o pipefail
15
+set -ex
16
+date
17
+
18
+cat <<EOF | tee -a /etc/ssh/sshd_config
19
+PermitRootLogin prohibit-password
20
+PasswordAuthentication no
21
+PermitEmptyPasswords no
22
+ChallengeResponseAuthentication no
23
+EOF
24
+
25
+launchctl stop com.openssh.sshd
26
+launchctl start com.openssh.sshd
27
+
28
+
29
+cd /
30
+
31
+echo "%admin ALL = NOPASSWD: ALL" | tee /etc/sudoers.d/passwordless
32
+
33
+(
34
+ # Make this thing work as root
35
+ export USER=root
36
+ export HOME=~root
37
+ export ALLOW_PREEXISTING_INSTALLATION=1
38
+ env
39
+ curl -vL https://nixos.org/releases/nix/nix-2.3.3/install > ~nixos/install-nix
40
+ chmod +rwx ~nixos/install-nix
41
+ cat /dev/null | sudo -i -H -u nixos -- sh ~nixos/install-nix --daemon
42
+)
43
+
44
+(
45
+ # Make this thing work as root
46
+ export USER=root
47
+ export HOME=~root
48
+
49
+ . '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh'
50
+ env
51
+ ls -la /private || true
52
+ ls -la /private/var || true
53
+ ls -la /private/var/run || true
54
+ ln -s /private/var/run /run || true
55
+
56
+ # todo: clean up this channel business, which is complicated because
57
+ # channels on darwin are a bit ill defined and have a very bad UX.
58
+ # If me, Graham, the author of the multi-user darwin installer can't
59
+ # even figure this out, how can I possibly expect anybody else to know.
60
+ nix-channel --add https://github.com/LnL7/nix-darwin/archive/master.tar.gz darwin
61
+ nix-channel --add https://nixos.org/channels/nixpkgs-20.09-darwin nixpkgs
62
+ nix-channel --update
63
+
64
+ sudo -i -H -u nixos -- nix-channel --add https://github.com/LnL7/nix-darwin/archive/master.tar.gz darwin
65
+ sudo -i -H -u nixos -- nix-channel --add https://nixos.org/channels/nixpkgs-20.09-darwin nixpkgs
66
+ sudo -i -H -u nixos -- nix-channel --update
67
+
68
+ export NIX_PATH=$NIX_PATH:darwin=https://github.com/LnL7/nix-darwin/archive/master.tar.gz
69
+
70
+ installer=$(nix-build https://github.com/LnL7/nix-darwin/archive/master.tar.gz -A installer --no-out-link)
71
+ set +e
72
+ yes | sudo -i -H -u nixos -- $installer/bin/darwin-installer;
73
+ echo $?
74
+ set -e
75
+)
76
+
77
+(
78
+ export USER=root
79
+ export HOME=~root
80
+
81
+ rm -f /etc/nix/nix.conf
82
+ rm -f /etc/bashrc
83
+ ln -s /etc/static/bashrc /etc/bashrc
84
+ . /etc/static/bashrc
85
+ cat /Volumes/CONFIG/darwin-configuration.nix | sudo -u nixos -- tee ~nixos/.nixpkgs/darwin-configuration.nix
86
+
87
+ while ! sudo -i -H -u nixos -- nix ping-store; do
88
+ cat /var/log/nix-daemon.log
89
+ sleep 1
90
+ done
91
+
92
+ sudo -i -H -u nixos -- darwin-rebuild switch
93
+)
94
+
macs/macmini-m1/darwin-configuration.nix
new
+92
@@ -0,0 +1,92 @@
1
+{ config, lib, pkgs, ... }:
2
+
3
+with lib;
4
+
5
+let
6
+ sshKeys = rec {
7
+ hydra-queue-runner = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCyM48VC5fpjJssLI8uolFscP4/iEoMHfkPoT9R3iE3OEjadmwa1XCAiXUoa7HSshw79SgPKF2KbGBPEVCascdAcErZKGHeHUzxj7v3IsNjObouUOBbJfpN4DR7RQT28PZRsh3TvTWjWnA9vIrSY/BvAK1uezFRuObvatqAPMrw4c0DK+JuGuCNkKDGHLXNSxYBc5Pmr1oSU7/BDiHVjjyLIsAMIc20+q8SjWswKqL1mY193mN7FpUMBtZrd0Za9fMFRII9AofEIDTOayvOZM6+/1dwRWZXM6jhE6kaPPF++yromHvDPBnd6FfwODKLvSF9BkA3pO5CqrD8zs7ETmrV hydra-queue-runner@chef";
8
+ rob = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDHp3/OZP2nRS5bM9E1xN8Q2L398kC+m4guORjKsmGjwnnHvYnTml5puE2ogl8Wdenbk7hf82+vKyB+Tktrhx+IBSym4lY+czR6W+39hlPYdLbi980yxYT9KEMSyMWJEgPVJ1BZvHqsHQiad/L3eoPmAIMDmcn4mLh9rya5/oMW/ZgsA6j28ClvWkDRyaTmTLOa0Im4nLoSbdo8kJqU+JX/YcXlMKUvFfdMcj4T9YYwV98LPWHnEHFmjtBBUXRUAIESMXS6pm3Pep3czkKUL4UF0u9f17b40OWlLOF4IQWE2jM9yK09DiIQUzeU2XKRNW116DnmDL5QIRNrYnhkYeeQI3U6WnVTPdTU9kBVTDjhM+6U6/LClGJaWiglwwrzHtVELHgMi280qRefQEftb4CI/IbcPNAxetJevV68I5NAjfdnmMx8YbhfIiEqAJtBi4TvoH7HjDH+72+ZFjQ10fpz/p+DgUtiNlRKz8tXSZ+mbLuhmOJOxtGQTH3viYbSpG/4F9uKW1ekX0RMyRxVvpjMxHtCL4daJI4RTHFXy4R16OKAlYe7gs9sqv7O0IujLJPex/rnN2U4syGaSH5q3UnGxci6qgn8yLEhSP+Gj0xdv5H3fVjr/kNNZGWDOz6nDUaJT+eWlmWU7hOvm0ricrz9GEPUTQ0Rh70sWTQFq3poWQ== cardno:000606167509";
9
+ rob-build = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCoQ7lzDDNH+8VZsw2SQ58EWrfLdeJKQHTQAqOOgOkfXtCt5WeWsdEFovrX2Wt4di6lgX4EH9xRp+1Owv5+WCorgPIdqACqS8nfcFZdy5TgPDNnK0ZpHaud7do8zrHkOqUBQ4mvfcr3mZ+aYxA03jGOAKR7aifInjzHF3bgyG5S6W1o9YxJ8bG3RLpAn1BZOs9diMkyD3vyb3oPo5vhf3U09Af0H3dnZUaAuKUAxN9HKoRg/DpuixkfbwGDHUvwxpypbPTBGzUv/F8m4irjw4rZGopZJn8rGwf9vHhq6OjIAta+/oArqkRovXN/DVcTDWCYS+vMGesOjRpTXQyqCxdR1wxi79UQlSxvYBuk7mw5SqCRya/kIDNC9J8h/KA9MCUFbkHmVxqjq+KLWYTHntem6SqZHpt+8QkypGuzJ2EPvaPBk9JqYfNRIX2dFjLVth0idWp8JeaGyFBUWDY9d5B+/9+jWY+Ze/t9xP40W7ca73XZsJSoJuwyNOu6XgQf9O0=";
10
+ grahamc = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB2LEAcTqOhZ3+zv6/VO+4Tts5pkm/tnDt0TIaIAVr+O\nssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILBPW2syaEH82DrqIl8/7/ypTgyfK8CRRTBEA4AmMB1l";
11
+ };
12
+ environment = concatStringsSep " "
13
+ [
14
+ "NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
15
+ ];
16
+
17
+ authorizedNixStoreKey = key:
18
+ "command=\"${environment} ${config.nix.package}/bin/nix-store --serve --write\" ${key}";
19
+in
20
+
21
+{
22
+ environment.systemPackages =
23
+ [
24
+ config.nix.package
25
+ ];
26
+
27
+ programs.bash.enable = true;
28
+ programs.bash.enableCompletion = false;
29
+
30
+ #services.activate-system.enable = true;
31
+
32
+ services.nix-daemon.enable = true;
33
+ nix.gc.user = "root";
34
+
35
+ nix.maxJobs = 8;
36
+ nix.buildCores = 1;
37
+ nix.gc.automatic = true;
38
+ nix.gc.interval = { Minute = 15; };
39
+ nix.gc.options = let
40
+ gbFree = 50;
41
+ in "--max-freed $((${toString gbFree} * 1024**3 - 1024 * $(df -P -k /nix/store | tail -n 1 | awk '{ print $4 }')))";
42
+
43
+ # If we drop below 20GiB during builds, free 20GiB
44
+ nix.extraOptions = ''
45
+ min-free = ${toString (30*1024*1024*1024)}
46
+ max-free = ${toString (50*1024*1024*1024)}
47
+ extra-platforms = aarch64-darwin
48
+ '';
49
+
50
+ environment.etc."per-user/root/ssh/authorized_keys".text = concatStringsSep "\n"
51
+ ([
52
+ (authorizedNixStoreKey sshKeys.hydra-queue-runner)
53
+ (authorizedNixStoreKey sshKeys.rob-build)
54
+ (authorizedNixStoreKey sshKeys.grahamc)
55
+ ]);
56
+
57
+ environment.etc."per-user/nixos/ssh/authorized_keys".text = concatStringsSep "\n"
58
+ ([
59
+ sshKeys.rob
60
+ sshKeys.grahamc
61
+ ]);
62
+
63
+ system.activationScripts.postActivation.text = ''
64
+ printf "disabling spotlight indexing... "
65
+ mdutil -i off -d / &> /dev/null
66
+ mdutil -E / &> /dev/null
67
+ echo "ok"
68
+
69
+ printf "configuring ssh keys for hydra on the root account... "
70
+ mkdir -p ~root/.ssh
71
+ cp -f /etc/per-user/root/ssh/authorized_keys ~root/.ssh/authorized_keys
72
+ chown root:wheel ~root ~root/.ssh ~root/.ssh/authorized_keys
73
+ echo "ok"
74
+
75
+ printf "configuring ssh keys for rob on the nixos account... "
76
+ mkdir -p ~nixos/.ssh
77
+ cp -f /etc/per-user/nixos/ssh/authorized_keys ~nixos/.ssh/authorized_keys
78
+ chown nixos:staff ~nixos/.ssh ~nixos/.ssh/authorized_keys
79
+ echo "ok"
80
+ '';
81
+
82
+ launchd.daemons.prometheus-node-exporter = {
83
+ script = ''
84
+ exec ${pkgs.prometheus-node-exporter}/bin/node_exporter
85
+ '';
86
+
87
+ serviceConfig.KeepAlive = true;
88
+ serviceConfig.StandardErrorPath = "/var/log/prometheus-node-exporter.log";
89
+ serviceConfig.StandardOutPath = "/var/log/prometheus-node-exporter.log";
90
+ };
91
+}
92
+