mac1: try catalina
Graham Christensen committed
Feb 22, 2021 at 00:06 UTC
cba415926154cb54c96697a6c8ce139524c9c70e
5 files changed
+332
-1
delft/network.nix
+9
-1
@@ -72,10 +72,18 @@ in {
72
73
mac1 = makeMac {
74
ip = "10.254.2.1";
75
- extra = {
75
+ extra = { pkgs, lib, ... }: {
76
imports = [
77
../macs/nodes/mac1.nix
78
];
79
+
80
+ macosGuest = {
81
+ guest = {
82
+ zvolName = lib.mkForce "rpool/catalina";
83
+ guestConfigDir = lib.mkForce ../macs/guest-catalina;
84
+ cloverImage = (pkgs.callPackage ../macs/dist/clover-catalina {}).clover-image;
85
+ };
86
+ };
87
};
88
};
89
macs/dist/clover-catalina/config.plist.template
new
+53
@@ -0,0 +1,53 @@
1
+<?xml version="1.0" encoding="UTF-8"?>
2
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3
+<plist version="1.0">
4
+<dict>
5
+ <key>Boot</key>
6
+ <dict>
7
+ <key>Arguments</key>
8
+ <string>@params@</string>
9
+ <key>DefaultVolume</key>
10
+ <string>system</string>
11
+ <key>Log</key>
12
+ <true/>
13
+ <key>Secure</key>
14
+ <false/>
15
+ <key>Timeout</key>
16
+ <integer>@timeout@</integer>
17
+ </dict>
18
+ <key>GUI</key>
19
+ <dict>
20
+ <key>Scan</key>
21
+ <dict>
22
+ <key>Entries</key>
23
+ <true/>
24
+ <key>Tool</key>
25
+ <true/>
26
+ </dict>
27
+ <key>ScreenResolution</key>
28
+ <string>@resolution@</string>
29
+ <key>Theme</key>
30
+ <string>embedded</string>
31
+ </dict>
32
+ <key>RtVariables</key>
33
+ <dict>
34
+ <key>BooterConfig</key>
35
+ <string>0x28</string>
36
+ <key>CsrActiveConfig</key>
37
+ <string>@csrFlag@</string>
38
+ </dict>
39
+ <key>SMBIOS</key>
40
+ <dict>
41
+ <key>Trust</key>
42
+ <false/>
43
+ </dict>
44
+ <key>SystemParameters</key>
45
+ <dict>
46
+ <key>InjectKexts</key>
47
+ <false/>
48
+ <key>InjectSystemID</key>
49
+ <true/>
50
+ </dict>
51
+</dict>
52
+</plist>
53
+
macs/dist/clover-catalina/default.nix
new
+89
@@ -0,0 +1,89 @@
1
+{ lib
2
+, runCommand
3
+, fetchurl
4
+, libguestfs
5
+, libguestfs-appliance
6
+, p7zip
7
+, resolution ? "1024x768"
8
+, csrFlag ? "0x3"
9
+, params ? "-v"
10
+, timeout ? "3"
11
+# https://github.com/Clover-EFI-Bootloader/clover/blob/6b8018b1fec958d672951f87cefd8b6cfd5318ac/rEFIt_UEFI/Platform/boot.h#L127-L135
12
+}:
13
+
14
+lib.fix (self: {
15
+ clover-image = runCommand "clover.qcow2" {
16
+ buildInputs = [ libguestfs ];
17
+ inherit resolution csrFlag params timeout;
18
+ LIBGUESTFS_PATH = libguestfs-appliance;
19
+ } ''
20
+ export HOME=$NIX_BUILD_TOP
21
+ mkdir work
22
+ cp --no-preserve=mode ${self.clover-iso} clover.iso
23
+ guestfish -a clover.iso -m "/dev/sda:/:norock" <<EOF
24
+ copy-out /EFI work
25
+ EOF
26
+ eval $(guestfish --listen)
27
+ guestfish --remote disk-create clover2.img qcow2 256M
28
+ guestfish --remote add clover2.img
29
+ time guestfish --remote run
30
+ guestfish --remote part-init /dev/sda gpt
31
+ guestfish --remote part-add /dev/sda p 2048 200000
32
+ guestfish --remote -- part-add /dev/sda p 202048 -2048
33
+ guestfish --remote part-set-gpt-type /dev/sda 1 C12A7328-F81F-11D2-BA4B-00A0C93EC93B
34
+ guestfish --remote part-set-bootable /dev/sda 1 true
35
+ guestfish --remote mkfs vfat /dev/sda1 label:EFI
36
+ guestfish --remote mkfs vfat /dev/sda2 label:clover
37
+ guestfish --remote mount /dev/sda2 /
38
+ guestfish --remote mkdir /ESP
39
+ guestfish --remote mount /dev/sda1 /ESP
40
+
41
+ guestfish --remote mkdir /ESP/EFI
42
+ guestfish --remote mkdir /ESP/EFI/CLOVER
43
+ guestfish --remote mkdir /ESP/EFI/CLOVER/kexts
44
+ guestfish --remote mkdir /ESP/EFI/CLOVER/kexts/Other
45
+ guestfish --remote copy-in work/EFI/BOOT /ESP/EFI
46
+ guestfish --remote copy-in work/EFI/CLOVER/CLOVERX64.efi /ESP/EFI/CLOVER
47
+
48
+ guestfish --remote copy-in work/EFI/CLOVER/drivers /ESP/EFI/CLOVER
49
+ guestfish --remote copy-in work/EFI/CLOVER/drivers/off/PartitionDxe.efi /ESP/EFI/CLOVER/drivers/UEFI
50
+ guestfish --remote copy-in work/EFI/CLOVER/drivers/off/ApfsDriverLoader.efi /ESP/EFI/CLOVER/drivers/UEFI
51
+
52
+ cp --no-preserve=mode ${self.startup-nsh} startup.nsh
53
+ guestfish --remote copy-in startup.nsh /
54
+
55
+ guestfish --remote copy-in work/EFI/CLOVER/drivers/off/AppleImageCodec.efi /ESP/EFI/CLOVER/drivers/UEFI
56
+ guestfish --remote copy-in work/EFI/CLOVER/drivers/off/FirmwareVolume.efi /ESP/EFI/CLOVER/drivers/UEFI
57
+ guestfish --remote copy-in work/EFI/CLOVER/drivers/off/AppleKeyAggregator.efi /ESP/EFI/CLOVER/drivers/UEFI
58
+ guestfish --remote copy-in work/EFI/CLOVER/drivers/off/AppleUITheme.efi /ESP/EFI/CLOVER/drivers/UEFI
59
+ guestfish --remote copy-in work/EFI/CLOVER/drivers/off/AppleKeyFeeder.efi /ESP/EFI/CLOVER/drivers/UEFI
60
+ guestfish --remote copy-in work/EFI/CLOVER/drivers/off/HashServiceFix.efi /ESP/EFI/CLOVER/drivers/UEFI
61
+
62
+ guestfish --remote copy-in work/EFI/CLOVER/drivers/UEFI/VBoxHfs.efi /ESP/EFI/CLOVER/drivers/UEFI
63
+ guestfish --remote copy-in work/EFI/CLOVER/drivers/UEFI/SMCHelper.efi /ESP/EFI/CLOVER/drivers/UEFI
64
+ guestfish --remote copy-in work/EFI/CLOVER/drivers/UEFI/FSInject.efi /ESP/EFI/CLOVER/drivers/UEFI
65
+ guestfish --remote copy-in work/EFI/CLOVER/drivers/UEFI/AptioInputFix.efi /ESP/EFI/CLOVER/drivers/UEFI
66
+
67
+ guestfish --remote copy-in work/EFI/CLOVER/tools /ESP/EFI/CLOVER
68
+ substituteAll ${./config.plist.template} work/config.plist
69
+ guestfish --remote copy-in work/config.plist /ESP/EFI/CLOVER
70
+ guestfish --remote rm /ESP/EFI/CLOVER/drivers/UEFI/AudioDxe.efi
71
+ guestfish --remote umount-all
72
+ guestfish --remote shutdown
73
+ mv clover2.img $out
74
+ '';
75
+ cloverVersion = "5130";
76
+ clover-iso-7z = fetchurl {
77
+ url = "https://github.com/CloverHackyColor/CloverBootloader/releases/download/${self.cloverVersion}/Clover-${self.cloverVersion}-X64.iso.7z";
78
+ sha256 = "0fv0mw03fjqvlhrnv9zixp88dm3ak4sjq84kfs7m6zglq83ar2lx";
79
+ };
80
+ clover-iso = runCommand "clover.iso" { buildInputs = [ p7zip ]; } ''
81
+ 7z x ${self.clover-iso-7z}
82
+ mv -v *.iso $out
83
+ '';
84
+ # https://github.com/kholia/OSX-KVM/blob/bda4cc8e698356510c27747b7a929339f450890c/Catalina/startup.nsh
85
+ startup-nsh = runCommand "startup.nsh" {} ''
86
+ echo "fs0:\EFI\CLOVER\CLOVERX64.efi" > $out
87
+ '';
88
+})
89
+
macs/guest-catalina/apply.sh
new
+108
@@ -0,0 +1,108 @@
1
+#!/usr/bin/env bash
2
+
3
+LOGHOST=10.172.170.1
4
+echo "apply started at $(date)" | nc -w0 -u $LOGHOST 1514
5
+
6
+printf "\n*.*\t@$LOGHOST:1514\n" | tee -a /etc/syslog.conf
7
+pkill syslog
8
+pkill asl
9
+
10
+exec 3>&1
11
+exec 2> >(nc -u $LOGHOST 1514)
12
+exec 1>&2
13
+
14
+PS4='${BASH_SOURCE}::${FUNCNAME[0]}::$LINENO '
15
+set -o pipefail
16
+set -ex
17
+date
18
+
19
+function finish {
20
+ set +e
21
+ cd /
22
+ sleep 1
23
+ umount -f /Volumes/CONFIG
24
+}
25
+trap finish EXIT
26
+
27
+cat <<EOF | tee -a /etc/ssh/sshd_config
28
+PermitRootLogin prohibit-password
29
+PasswordAuthentication no
30
+PermitEmptyPasswords no
31
+ChallengeResponseAuthentication no
32
+EOF
33
+
34
+launchctl stop com.openssh.sshd
35
+launchctl start com.openssh.sshd
36
+
37
+
38
+cd /Volumes/CONFIG
39
+
40
+cp -r ./etc/ssh/ssh_host_* /etc/ssh
41
+chown root:wheel /etc/ssh/ssh_host_*
42
+chmod 600 /etc/ssh/ssh_host_*
43
+cd /
44
+
45
+echo "%admin ALL = NOPASSWD: ALL" | tee /etc/sudoers.d/passwordless
46
+
47
+(
48
+ # Make this thing work as root
49
+ export USER=root
50
+ export HOME=~root
51
+ export ALLOW_PREEXISTING_INSTALLATION=1
52
+ env
53
+ curl -vL https://nixos.org/releases/nix/nix-2.3.10/install > ~nixos/install-nix
54
+ chmod +rwx ~nixos/install-nix
55
+ cat /dev/null | sudo -i -H -u nixos -- sh ~nixos/install-nix --daemon --darwin-use-unencrypted-nix-store-volume
56
+)
57
+
58
+(
59
+ # Make this thing work as root
60
+ export USER=root
61
+ export HOME=~root
62
+
63
+ . '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh'
64
+ env
65
+ ls -la /private || true
66
+ ls -la /private/var || true
67
+ ls -la /private/var/run || true
68
+ ln -s /private/var/run /run || true
69
+
70
+ # todo: clean up this channel business, which is complicated because
71
+ # channels on darwin are a bit ill defined and have a very bad UX.
72
+ # If me, Graham, the author of the multi-user darwin installer can't
73
+ # even figure this out, how can I possibly expect anybody else to know.
74
+ nix-channel --add https://github.com/LnL7/nix-darwin/archive/master.tar.gz darwin
75
+ nix-channel --add https://nixos.org/channels/nixpkgs-20.09-darwin nixpkgs
76
+ nix-channel --update
77
+
78
+ sudo -i -H -u nixos -- nix-channel --add https://github.com/LnL7/nix-darwin/archive/master.tar.gz darwin
79
+ sudo -i -H -u nixos -- nix-channel --add https://nixos.org/channels/nixpkgs-20.09-darwin nixpkgs
80
+ sudo -i -H -u nixos -- nix-channel --update
81
+
82
+ export NIX_PATH=$NIX_PATH:darwin=https://github.com/LnL7/nix-darwin/archive/master.tar.gz
83
+
84
+ installer=$(nix-build https://github.com/LnL7/nix-darwin/archive/master.tar.gz -A installer --no-out-link)
85
+ set +e
86
+ yes | sudo -i -H -u nixos -- $installer/bin/darwin-installer;
87
+ echo $?
88
+ set -e
89
+)
90
+
91
+(
92
+ export USER=root
93
+ export HOME=~root
94
+
95
+ rm -f /etc/nix/nix.conf
96
+ rm -f /etc/bashrc
97
+ ln -s /etc/static/bashrc /etc/bashrc
98
+ . /etc/static/bashrc
99
+ cat /Volumes/CONFIG/darwin-configuration.nix | sudo -u nixos -- tee ~nixos/.nixpkgs/darwin-configuration.nix
100
+
101
+ while ! sudo -i -H -u nixos -- nix ping-store; do
102
+ cat /var/log/nix-daemon.log
103
+ sleep 1
104
+ done
105
+
106
+ sudo -i -H -u nixos -- darwin-rebuild switch
107
+)
108
+
macs/guest-catalina/darwin-configuration.nix
new
+73
@@ -0,0 +1,73 @@
1
+{ config, lib, pkgs, ... }:
2
+
3
+with lib;
4
+
5
+let
6
+ sshKeys = rec {
7
+ hydra-queue-runner = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCyM48VC5fpjJssLI8uolFscP4/iEoMHfkPoT9R3iE3OEjadmwa1XCAiXUoa7HSshw79SgPKF2KbGBPEVCascdAcErZKGHeHUzxj7v3IsNjObouUOBbJfpN4DR7RQT28PZRsh3TvTWjWnA9vIrSY/BvAK1uezFRuObvatqAPMrw4c0DK+JuGuCNkKDGHLXNSxYBc5Pmr1oSU7/BDiHVjjyLIsAMIc20+q8SjWswKqL1mY193mN7FpUMBtZrd0Za9fMFRII9AofEIDTOayvOZM6+/1dwRWZXM6jhE6kaPPF++yromHvDPBnd6FfwODKLvSF9BkA3pO5CqrD8zs7ETmrV hydra-queue-runner@chef";
8
+ };
9
+ environment = concatStringsSep " "
10
+ [
11
+ "NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
12
+ ];
13
+
14
+ authorizedNixStoreKey = key:
15
+ "command=\"${environment} ${config.nix.package}/bin/nix-store --serve --write\" ${key}";
16
+in
17
+
18
+{
19
+ environment.systemPackages =
20
+ [
21
+ config.nix.package
22
+ ];
23
+
24
+ programs.bash.enable = true;
25
+ programs.bash.enableCompletion = false;
26
+
27
+ #services.activate-system.enable = true;
28
+
29
+ services.nix-daemon.enable = true;
30
+
31
+ nix.maxJobs = 4;
32
+ nix.buildCores = 1;
33
+ nix.gc.automatic = true;
34
+ nix.gc.interval = { Minute = 15; };
35
+ nix.gc.options = let
36
+ gbFree = 50;
37
+ in "--max-freed $((${toString gbFree} * 1024**3 - 1024 * $(df -P -k /nix/store | tail -n 1 | awk '{ print $4 }')))";
38
+
39
+ # If we drop below 20GiB during builds, free 20GiB
40
+ nix.extraOptions = ''
41
+ min-free = ${toString (30*1024*1024*1024)}
42
+ max-free = ${toString (50*1024*1024*1024)}
43
+ '';
44
+
45
+ environment.etc."per-user/root/ssh/authorized_keys".text = concatStringsSep "\n"
46
+ ([
47
+ (authorizedNixStoreKey sshKeys.hydra-queue-runner)
48
+ ]);
49
+
50
+
51
+ system.activationScripts.postActivation.text = ''
52
+ printf "disabling spotlight indexing... "
53
+ mdutil -i off -d / &> /dev/null
54
+ mdutil -E / &> /dev/null
55
+ echo "ok"
56
+
57
+ printf "configuring ssh keys for hydra on the root account... "
58
+ mkdir -p ~root/.ssh
59
+ cp -f /etc/per-user/root/ssh/authorized_keys ~root/.ssh/authorized_keys
60
+ chown root:wheel ~root ~root/.ssh ~root/.ssh/authorized_keys
61
+ echo "ok"
62
+ '';
63
+
64
+ launchd.daemons.prometheus-node-exporter = {
65
+ script = ''
66
+ exec ${pkgs.prometheus-node-exporter}/bin/node_exporter
67
+ '';
68
+
69
+ serviceConfig.KeepAlive = true;
70
+ serviceConfig.StandardErrorPath = "/var/log/prometheus-node-exporter.log";
71
+ serviceConfig.StandardOutPath = "/var/log/prometheus-node-exporter.log";
72
+ };
73
+}