cdfe92a089
A built-in RGB+IR webcam (common on recent ThinkPads, e.g. the T14s AMD Gen 4) exposes its IR face-unlock sensor as a second, identically-named "Integrated Camera"; apps that pick it show a dark, 8-bit-greyscale image. nomarchy.hardware.camera.hideIrSensor disables that node on the V4L2 PipeWire path (WirePlumber monitor.v4l2.rules) so only the colour camera is offered, matched by card name (overridable irMatch). - libcamera is left untouched: an external camera you plug in is never affected, and surgical internal-only libcamera scoping isn't possible (its distinguishing props bind after the monitor rule runs). - Only the PipeWire node is hidden; the kernel /dev/video* stays open, so Howdy face-unlock still reads the IR sensor directly. - The installer's hardware-db.sh auto-detects a paired RGB+IR webcam from /sys/class/video4linux/*/name and bakes the toggle into system.nix; commented example added to the downstream template. Validated live on a T14s: collapses the four enumerated "Integrated Camera" entries to one colour source; the exact shipped regex disables the IR node (confirmed in the WirePlumber log) and leaves libcamera intact. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
690 lines
31 KiB
Bash
690 lines
31 KiB
Bash
#!/usr/bin/env bash
|
|
# nomarchy-install — guided installer for the Nomarchy live ISO.
|
|
#
|
|
# Partitions one disk (GPT + 1 GiB ESP + BTRFS, optional LUKS2) with disko,
|
|
# generates a downstream machine flake at /home/<user>/.nomarchy (one
|
|
# nomarchy.lib.mkFlake call — the flake the user never hand-edits), and
|
|
# runs nixos-install. Works offline: the ISO pins every flake input, and
|
|
# the target flake.lock is composed from the rev the ISO was built from.
|
|
#
|
|
# Ported from the previous iteration's installer/install.sh (3bdfc35) —
|
|
# the pre-wipe and ordering comments carry its hard-won fixes. v1 scope:
|
|
# single disk, UEFI only. Multi-disk RAID and impermanence live in git
|
|
# history when they're wanted back.
|
|
#
|
|
# Unattended mode (for CI/VM tests):
|
|
# NOMARCHY_UNATTENDED=1 NOMARCHY_DISK=/dev/vda NOMARCHY_USERNAME=me \
|
|
# NOMARCHY_PASSWORD=secret [NOMARCHY_HOSTNAME=nomarchy] \
|
|
# [NOMARCHY_TIMEZONE=UTC] [NOMARCHY_LUKS_PASSPHRASE=...] \
|
|
# [NOMARCHY_LOCALE=en_US.UTF-8] [NOMARCHY_KB_LAYOUT=us] [NOMARCHY_KB_VARIANT=] \
|
|
# [NOMARCHY_SWAP_GB=N (default: RAM size; 0 = none)] \
|
|
# [NOMARCHY_HW="auto"|"none"|"mod1 mod2"] [NOMARCHY_FINISH=none|reboot|poweroff]
|
|
# nomarchy-install
|
|
|
|
set -euo pipefail
|
|
|
|
# Baked in by the package wrapper:
|
|
# NOMARCHY_INSTALL_SHARE — disko-config.nix, hardware-db.sh,
|
|
# compose-lock.py, flake.lock, template/,
|
|
# hardware-modules.txt
|
|
# NOMARCHY_FLAKE_URL — flake URL written into the generated flake.nix
|
|
# NOMARCHY_REV — nomarchy rev this ISO was built from ("" if dirty)
|
|
# NOMARCHY_LOCKED_JSON / NOMARCHY_ORIGINAL_JSON — flake.lock node fields
|
|
SHARE="${NOMARCHY_INSTALL_SHARE:?not run via the packaged wrapper}"
|
|
|
|
UNATTENDED="${NOMARCHY_UNATTENDED:-0}"
|
|
LUKS_KEY_PATH="/tmp/nomarchy-luks.key"
|
|
|
|
# ─── UI helpers ─────────────────────────────────────────────────────────
|
|
header() { gum style --border rounded --padding "0 2" --margin "1 0" \
|
|
--border-foreground 212 "$@"; }
|
|
section() { gum style --foreground 212 --bold "── $* ──"; }
|
|
info() { gum style --foreground 245 " $*"; }
|
|
success() { gum style --foreground 42 " ✓ $*"; }
|
|
warn() { gum style --foreground 214 " ⚠ $*"; }
|
|
fail() { gum style --foreground 9 " ✗ $*"; exit 1; }
|
|
|
|
confirm() { # confirm <prompt> — auto-yes when unattended
|
|
[[ "$UNATTENDED" == "1" ]] && return 0
|
|
gum confirm "$1"
|
|
}
|
|
|
|
# ─── Environment checks ─────────────────────────────────────────────────
|
|
if [[ $EUID -ne 0 ]]; then
|
|
exec sudo --preserve-env "$0" "$@"
|
|
fi
|
|
|
|
# `sudo --preserve-env` (needed to carry the NOMARCHY_* vars) also drags in
|
|
# the live session user's HOME=/home/nomarchy. Root-run `nix` calls below
|
|
# would then scribble an eval cache + .nix-defexpr into /home/nomarchy —
|
|
# and the in-chroot one lands on the TARGET disk as a stray, orphaned
|
|
# /home/nomarchy (no such user on the installed system). Pin root's own
|
|
# HOME so every root nix invocation stays in /root; the user activation
|
|
# sets HOME=/home/$USERNAME explicitly and is unaffected.
|
|
export HOME=/root
|
|
|
|
header "Nomarchy installer" "NixOS, themed and ready to go."
|
|
|
|
[[ -d /sys/firmware/efi ]] \
|
|
|| fail "No UEFI firmware detected. v1 installs systemd-boot and needs UEFI (BIOS/legacy: see roadmap)."
|
|
command -v nixos-install >/dev/null \
|
|
|| fail "nixos-install not found — run this from the Nomarchy live ISO."
|
|
grep -q nomarchy-live /etc/hostname 2>/dev/null \
|
|
|| warn "This doesn't look like the Nomarchy live ISO; proceeding anyway."
|
|
|
|
# Offline-proof nix: disko's eval resolves <nixpkgs> (a dead channel on
|
|
# the live ISO) and flake commands may consult the global registry —
|
|
# point both at what the ISO already carries.
|
|
export NIX_PATH="nixpkgs=$NOMARCHY_NIXPKGS"
|
|
export NIX_CONFIG="flake-registry = $SHARE/registry.json"
|
|
|
|
# With no network, every substituter query is a DNS timeout + retry storm
|
|
# (and tickles a nix goal.cc assertion crash). Everything an install needs
|
|
# is pinned into the ISO — drop the binary caches and substitute from the
|
|
# live store's daemon instead. The explicit daemon substituter matters:
|
|
# nixos-install builds with --store /mnt and its own "auto?trusted=1"
|
|
# substituter resolves to the TARGET store (i.e. itself), so without
|
|
# this nothing flows from the ISO and nix bootstraps gcc from source.
|
|
NIXOS_INSTALL_OPTS=()
|
|
if ! timeout 3 bash -c '</dev/tcp/cache.nixos.org/443' 2>/dev/null; then
|
|
info "No network — substituting from the ISO store only."
|
|
NIX_CONFIG+=$'\nsubstituters =\nextra-substituters = daemon?trusted=1\nbuilders ='
|
|
# Must ALSO go through nixos-install as a flag: it passes its own
|
|
# --extra-substituters "auto?trusted=1", and flags override the env
|
|
# config for the same setting — without this the in-target build
|
|
# substitutes from itself (= nothing) and bootstraps gcc from source.
|
|
NIXOS_INSTALL_OPTS+=(--substituters "daemon?trusted=1")
|
|
fi
|
|
|
|
# ─── Disk selection ─────────────────────────────────────────────────────
|
|
section "Target disk"
|
|
|
|
# Never offer the medium we're running from.
|
|
live_disk=""
|
|
live_src=$(findmnt -no SOURCE /iso 2>/dev/null || true)
|
|
[[ -n "$live_src" ]] && live_disk=$(lsblk -no PKNAME "$live_src" 2>/dev/null || true)
|
|
|
|
mapfile -t disks < <(lsblk -dpno NAME,SIZE,MODEL,TYPE \
|
|
| awk -v skip="/dev/${live_disk:-NONE}" \
|
|
'$NF == "disk" && $1 != skip && $1 !~ /loop|zram|sr[0-9]/ {NF--; print}')
|
|
[[ ${#disks[@]} -gt 0 ]] || fail "No installable disks found."
|
|
|
|
if [[ "$UNATTENDED" == "1" ]]; then
|
|
TARGET_DISK="${NOMARCHY_DISK:?NOMARCHY_DISK required in unattended mode}"
|
|
else
|
|
choice=$(printf '%s\n' "${disks[@]}" \
|
|
| gum choose --header "Install Nomarchy on which disk? (EVERYTHING on it will be erased)")
|
|
TARGET_DISK="${choice%% *}"
|
|
fi
|
|
[[ -b "$TARGET_DISK" ]] || fail "$TARGET_DISK is not a block device."
|
|
info "Target: $TARGET_DISK"
|
|
|
|
# ─── Encryption ─────────────────────────────────────────────────────────
|
|
section "Disk encryption"
|
|
|
|
# LUKS is the default: full-disk encryption, and in exchange the machine
|
|
# logs you straight into the desktop (the passphrase already gates access).
|
|
LUKS_PASSPHRASE=""
|
|
if [[ "$UNATTENDED" == "1" ]]; then
|
|
LUKS_PASSPHRASE="${NOMARCHY_LUKS_PASSPHRASE:-}"
|
|
elif gum confirm --default=yes "Encrypt the disk with LUKS? (default — also enables passwordless desktop login)"; then
|
|
while true; do
|
|
p1=$(gum input --password --placeholder "LUKS passphrase (min 8 chars)")
|
|
[[ ${#p1} -ge 8 ]] || { warn "Too short."; continue; }
|
|
p2=$(gum input --password --placeholder "Repeat passphrase")
|
|
[[ "$p1" == "$p2" ]] && { LUKS_PASSPHRASE="$p1"; break; }
|
|
warn "Passphrases don't match."
|
|
done
|
|
fi
|
|
WITH_LUKS=false; [[ -n "$LUKS_PASSPHRASE" ]] && WITH_LUKS=true
|
|
info "Encryption: $([[ $WITH_LUKS == true ]] && echo "LUKS2 (desktop auto-login)" || echo none)"
|
|
|
|
# ─── Swap / hibernation ─────────────────────────────────────────────────
|
|
# A swapfile ≥ RAM on its own BTRFS subvolume makes hibernation possible;
|
|
# the resume offset is wired into the config below.
|
|
ram_gb=$(awk '/MemTotal/ {print int(($2 + 1048575) / 1048576)}' /proc/meminfo)
|
|
if [[ "$UNATTENDED" == "1" ]]; then
|
|
SWAP_GB="${NOMARCHY_SWAP_GB:-$ram_gb}"
|
|
else
|
|
SWAP_GB=$(gum input --value "$ram_gb" \
|
|
--placeholder "swap size in GiB (≥ RAM enables hibernation, 0 = none)")
|
|
fi
|
|
[[ "$SWAP_GB" =~ ^[0-9]+$ ]] || fail "Swap size must be a whole number of GiB."
|
|
info "Swap: $([[ "$SWAP_GB" == "0" ]] && echo none || echo "${SWAP_GB}G swapfile (hibernation-ready)")"
|
|
|
|
# ─── User account ───────────────────────────────────────────────────────
|
|
section "Your account"
|
|
|
|
if [[ "$UNATTENDED" == "1" ]]; then
|
|
USERNAME="${NOMARCHY_USERNAME:?}"
|
|
PASSWORD="${NOMARCHY_PASSWORD:?}"
|
|
HOSTNAME_="${NOMARCHY_HOSTNAME:-nomarchy}"
|
|
TIMEZONE="${NOMARCHY_TIMEZONE:-UTC}"
|
|
LOCALE="${NOMARCHY_LOCALE:-en_US.UTF-8}"
|
|
KB_LAYOUT="${NOMARCHY_KB_LAYOUT:-us}"
|
|
KB_VARIANT="${NOMARCHY_KB_VARIANT:-}"
|
|
else
|
|
while true; do
|
|
USERNAME=$(gum input --placeholder "username (lowercase, e.g. ada)")
|
|
[[ "$USERNAME" =~ ^[a-z_][a-z0-9_-]*$ ]] && break
|
|
warn "Invalid username (lowercase letters, digits, - and _)."
|
|
done
|
|
while true; do
|
|
PASSWORD=$(gum input --password --placeholder "password for $USERNAME")
|
|
[[ -n "$PASSWORD" ]] || { warn "Empty password."; continue; }
|
|
p2=$(gum input --password --placeholder "repeat password")
|
|
[[ "$PASSWORD" == "$p2" ]] && break
|
|
warn "Passwords don't match."
|
|
done
|
|
while true; do
|
|
HOSTNAME_=$(gum input --value "nomarchy" --placeholder "hostname")
|
|
[[ "$HOSTNAME_" =~ ^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?$ ]] && break
|
|
warn "Invalid hostname."
|
|
done
|
|
TIMEZONE=$(timedatectl list-timezones | gum filter --placeholder "timezone (type to search)" || echo UTC)
|
|
# Curated UTF-8 locales: the live system only generates en_US, so
|
|
# `locale -a` can't enumerate what the TARGET could use.
|
|
LOCALE=$(printf '%s\n' \
|
|
en_US en_GB de_DE fr_FR es_ES es_MX pt_PT pt_BR it_IT nl_NL \
|
|
pl_PL ru_RU uk_UA cs_CZ sk_SK sv_SE nb_NO da_DK fi_FI tr_TR \
|
|
el_GR hu_HU ro_RO bg_BG hr_HR sl_SI lt_LT lv_LV et_EE ja_JP \
|
|
ko_KR zh_CN zh_TW ar_EG he_IL hi_IN th_TH vi_VN id_ID \
|
|
| sed 's/$/.UTF-8/' \
|
|
| gum filter --placeholder "language / locale (type to search)" \
|
|
|| echo en_US.UTF-8)
|
|
KB_LAYOUT=$(localectl list-x11-keymap-layouts 2>/dev/null \
|
|
| gum filter --placeholder "keyboard layout (type to search)" \
|
|
|| echo us)
|
|
KB_VARIANT=""
|
|
if [[ "$KB_LAYOUT" != "us" ]] || gum confirm --default=No "Pick a keyboard variant (intl, nodeadkeys, …)?"; then
|
|
KB_VARIANT=$( { echo "(none)"; localectl list-x11-keymap-variants "$KB_LAYOUT" 2>/dev/null; } \
|
|
| gum filter --placeholder "variant for $KB_LAYOUT (pick '(none)' for the default)" \
|
|
|| echo "(none)")
|
|
[[ "$KB_VARIANT" == "(none)" ]] && KB_VARIANT=""
|
|
fi
|
|
fi
|
|
[[ "$USERNAME" =~ ^[a-z_][a-z0-9_-]*$ ]] || fail "Invalid username '$USERNAME'."
|
|
[[ -f "/usr/share/zoneinfo/$TIMEZONE" || -e "/etc/zoneinfo/$TIMEZONE" ]] \
|
|
|| timedatectl list-timezones 2>/dev/null | grep -qx "$TIMEZONE" \
|
|
|| warn "Timezone '$TIMEZONE' not verifiable; continuing."
|
|
HASHED_PASSWORD=$(printf '%s' "$PASSWORD" | mkpasswd -m sha-512 -s)
|
|
unset PASSWORD
|
|
info "User: $USERNAME @ $HOSTNAME_ ($TIMEZONE)"
|
|
info "Locale: $LOCALE · keyboard: $KB_LAYOUT${KB_VARIANT:+ ($KB_VARIANT)}"
|
|
|
|
# ─── Hardware profile ───────────────────────────────────────────────────
|
|
section "Hardware detection"
|
|
|
|
# shellcheck source=hardware-db.sh
|
|
source "$SHARE/hardware-db.sh"
|
|
|
|
HW_PROFILES=()
|
|
HW_NOMARCHY=() # NOMARCHY hardware.* assignments from detection
|
|
NPU_VENDOR="" # "intel" | "amd" if an NPU was detected (commented opt-in)
|
|
hw_mode="${NOMARCHY_HW:-auto}"
|
|
if [[ "$hw_mode" == "none" ]]; then
|
|
info "Hardware profiles skipped."
|
|
elif [[ "$hw_mode" != "auto" && "$UNATTENDED" == "1" ]]; then
|
|
read -ra HW_PROFILES <<< "$hw_mode"
|
|
else
|
|
detection=$(nomarchy_detect_hw || true)
|
|
if [[ -n "$detection" ]]; then
|
|
while IFS= read -r line; do
|
|
case "$line" in
|
|
MODULE\ *) HW_PROFILES+=("${line#MODULE }") ;;
|
|
NOMARCHY-NPU\ *) NPU_VENDOR="${line#NOMARCHY-NPU }" ;;
|
|
NOMARCHY\ *) HW_NOMARCHY+=("${line#NOMARCHY }") ;;
|
|
DETAIL\ *) info "→ ${line#DETAIL }" ;;
|
|
esac
|
|
done <<< "$detection"
|
|
fi
|
|
if [[ "$UNATTENDED" != "1" ]]; then
|
|
if [[ ${#HW_PROFILES[@]} -gt 0 ]] \
|
|
&& ! gum confirm "Use these nixos-hardware profiles: ${HW_PROFILES[*]}?"; then
|
|
HW_PROFILES=()
|
|
picked=$(gum filter --no-limit \
|
|
--placeholder "pick profiles manually (tab to select, enter to finish, esc for none)" \
|
|
< "$SHARE/hardware-modules.txt" || true)
|
|
[[ -n "$picked" ]] && mapfile -t HW_PROFILES <<< "$picked"
|
|
fi
|
|
fi
|
|
fi
|
|
info "Profiles: ${HW_PROFILES[*]:-(none)}"
|
|
|
|
# ─── Review & point of no return ────────────────────────────────────────
|
|
section "Review"
|
|
|
|
gum style --border normal --padding "0 2" \
|
|
"Disk: $TARGET_DISK (WILL BE ERASED)" \
|
|
"Encryption: $([[ $WITH_LUKS == true ]] && echo "LUKS2 + desktop auto-login" || echo none)" \
|
|
"Swap: $([[ "$SWAP_GB" == "0" ]] && echo none || echo "${SWAP_GB}G (hibernation)")" \
|
|
"User: $USERNAME" \
|
|
"Hostname: $HOSTNAME_" \
|
|
"Timezone: $TIMEZONE" \
|
|
"Hardware: ${HW_PROFILES[*]:-none}" \
|
|
"Snapshots: snapper timeline on /" \
|
|
"Source: nomarchy ${NOMARCHY_REV:0:12}${NOMARCHY_REV:+ }$([[ -z "${NOMARCHY_REV:-}" ]] && echo "(dirty tree) ")— pinned into the ISO, no network needed"
|
|
|
|
if [[ "$UNATTENDED" != "1" ]]; then
|
|
typed=$(gum input --placeholder "type the disk name ($(basename "$TARGET_DISK")) to confirm the wipe")
|
|
[[ "$typed" == "$(basename "$TARGET_DISK")" ]] || fail "Confirmation mismatch — aborting, nothing touched."
|
|
fi
|
|
|
|
# ─── Partitioning ───────────────────────────────────────────────────────
|
|
section "Partitioning"
|
|
|
|
# Pre-wipe: disko gates destructive steps on blkid — on a previously
|
|
# installed disk it would overlay the old GPT and skip mkfs on a stale
|
|
# ESP ("wrong fs type, bad superblock" at mount). Wipe first. Teardown
|
|
# order matters: mounts → swap → LUKS mappings → signatures.
|
|
prewipe() {
|
|
local drive="$1" name backing part
|
|
info "Pre-wiping $drive..."
|
|
umount -R /mnt 2>/dev/null || true
|
|
swapoff -a 2>/dev/null || true
|
|
if command -v dmsetup >/dev/null 2>&1; then
|
|
while read -r name _; do
|
|
[[ -n "$name" && "$name" != "No" ]] || continue
|
|
backing=$(cryptsetup status "$name" 2>/dev/null \
|
|
| awk '/^[[:space:]]*device:/ { print $2; exit }') || continue
|
|
[[ "$backing" == "$drive"* ]] || continue
|
|
info "closing stale LUKS mapping $name"
|
|
cryptsetup close "$name"
|
|
done < <(dmsetup ls --target crypt 2>/dev/null)
|
|
fi
|
|
for part in "${drive}"?*; do
|
|
# unmatched glob stays literal; -b filters it out
|
|
[[ -b "$part" ]] || continue
|
|
wipefs -af "$part" >/dev/null
|
|
done
|
|
wipefs -af "$drive" >/dev/null
|
|
sgdisk --zap-all "$drive" >/dev/null
|
|
# 16 MiB covers LUKS2 headers and the first BTRFS superblock —
|
|
# wipefs alone misses damaged variants.
|
|
dd if=/dev/zero of="$drive" bs=1M count=16 conv=fsync status=none
|
|
partprobe "$drive" 2>/dev/null || true
|
|
udevadm settle --timeout=30 || info "udevadm settle timed out; continuing."
|
|
if lsblk -no MOUNTPOINTS "$drive" 2>/dev/null | grep -qE '\S'; then
|
|
fail "$drive still has active mountpoints after pre-wipe."
|
|
fi
|
|
}
|
|
prewipe "$TARGET_DISK"
|
|
|
|
if [[ $WITH_LUKS == true ]]; then
|
|
install -m 600 /dev/null "$LUKS_KEY_PATH"
|
|
trap 'rm -f "$LUKS_KEY_PATH" 2>/dev/null || true' EXIT
|
|
printf '%s' "$LUKS_PASSPHRASE" > "$LUKS_KEY_PATH"
|
|
unset LUKS_PASSPHRASE
|
|
fi
|
|
|
|
disko_log=$(mktemp --suffix=.disko.log)
|
|
if ! disko --mode destroy,format,mount --yes-wipe-all-disks \
|
|
--argstr mainDrive "$TARGET_DISK" \
|
|
--arg withLuks "$WITH_LUKS" \
|
|
--argstr swapSize "${SWAP_GB}G" \
|
|
"$SHARE/disko-config.nix" >"$disko_log" 2>&1; then
|
|
tail -n 30 "$disko_log"
|
|
fail "disko failed — full log: $disko_log"
|
|
fi
|
|
rm -f "$LUKS_KEY_PATH" "$disko_log"
|
|
success "Disk partitioned and mounted at /mnt"
|
|
|
|
# Hibernation plumbing: the swapfile's physical offset goes into the
|
|
# kernel cmdline. Deactivate swap first so nixos-generate-config doesn't
|
|
# also emit a swapDevices entry (we write our own, with resume wiring).
|
|
RESUME_CONFIG=""
|
|
if [[ "$SWAP_GB" != "0" ]]; then
|
|
swapoff -a 2>/dev/null || true
|
|
resume_offset=$(btrfs inspect-internal map-swapfile -r /mnt/swap/swapfile)
|
|
root_uuid=$(findmnt -no UUID /mnt)
|
|
RESUME_CONFIG=$(cat <<NIX
|
|
|
|
# Swapfile (hibernation-ready: resume points into it).
|
|
swapDevices = [{ device = "/swap/swapfile"; }];
|
|
boot.resumeDevice = "/dev/disk/by-uuid/$root_uuid";
|
|
boot.kernelParams = [ "resume_offset=$resume_offset" ];
|
|
NIX
|
|
)
|
|
success "Swapfile created (resume offset $resume_offset)"
|
|
fi
|
|
|
|
# ─── Configuration generation ───────────────────────────────────────────
|
|
section "Generating configuration"
|
|
|
|
FLAKE_DIR="/mnt/home/$USERNAME/.nomarchy"
|
|
mkdir -p "$FLAKE_DIR"
|
|
|
|
nixos-generate-config --root /mnt
|
|
mv /mnt/etc/nixos/hardware-configuration.nix "$FLAKE_DIR/"
|
|
rm -rf /mnt/etc/nixos
|
|
|
|
cp "$SHARE/template/theme-state.json" "$FLAKE_DIR/"
|
|
|
|
# home.nix is generated (not copied from the template) so the chosen
|
|
# keyboard layout reaches the Hyprland session — standalone HM cannot
|
|
# read system.nix.
|
|
cat > "$FLAKE_DIR/home.nix" <<EOF
|
|
# Your user environment. The Nomarchy desktop (Hyprland, Waybar,
|
|
# Ghostty, theming engine, Stylix) comes from homeModules.nomarchy;
|
|
# tune it via the nomarchy.* options, add your own packages and
|
|
# programs below.
|
|
{ pkgs, ... }:
|
|
|
|
{
|
|
# Keyboard for the desktop session; console + LUKS prompt get the
|
|
# same layout from system.nix (xkb + console.useXkbConfig).
|
|
nomarchy.keyboard.layout = "$KB_LAYOUT";
|
|
nomarchy.keyboard.variant = "$KB_VARIANT";
|
|
|
|
# Examples:
|
|
# nomarchy.terminal = "kitty"; # swap the default terminal
|
|
# nomarchy.waybar.enable = false; # bring your own bar
|
|
# nomarchy.stylix.enable = false; # opt out of GTK/Qt theming
|
|
|
|
home.packages = with pkgs; [
|
|
# firefox
|
|
];
|
|
}
|
|
EOF
|
|
|
|
hw_nix=""
|
|
for p in "${HW_PROFILES[@]:-}"; do
|
|
[[ -n "$p" ]] && hw_nix+=" \"$p\""
|
|
done
|
|
|
|
cat > "$FLAKE_DIR/flake.nix" <<EOF
|
|
{
|
|
description = "$HOSTNAME_ — my Nomarchy machine";
|
|
|
|
# The only input. nixpkgs, home-manager etc. come pinned through it —
|
|
# tested together upstream. Generated by nomarchy-install; your machine
|
|
# lives in system.nix and home.nix, this file is never hand-edited.
|
|
inputs.nomarchy.url = "${NOMARCHY_FLAKE_URL}";
|
|
|
|
outputs = { nomarchy, ... }:
|
|
nomarchy.lib.mkFlake {
|
|
src = ./.;
|
|
username = "$USERNAME";
|
|
hardwareProfile = [$hw_nix ];
|
|
};
|
|
}
|
|
EOF
|
|
|
|
AUTOLOGIN_CONFIG=""
|
|
if [[ $WITH_LUKS == true ]]; then
|
|
AUTOLOGIN_CONFIG=$(cat <<NIX
|
|
|
|
# The LUKS passphrase already gates this machine — skip the second
|
|
# password prompt and boot straight into the desktop.
|
|
nomarchy.system.greeter.autoLogin = "$USERNAME";
|
|
NIX
|
|
)
|
|
fi
|
|
|
|
# Laptop power: power-profiles-daemon ships by default; mark this a laptop
|
|
# so battery-only features apply, and enable thermald on Intel. Keyed off
|
|
# the same battery probe that chose the common-pc-laptop hardware profile.
|
|
POWER_CONFIG=""
|
|
if [[ " ${HW_PROFILES[*]:-} " == *" common-pc-laptop "* ]]; then
|
|
power_lines=" # Laptop power management (power-profiles-daemon + menu/Waybar
|
|
# switcher). Uncomment to stop charging at 80% to extend battery life.
|
|
nomarchy.system.power.laptop = true;
|
|
# nomarchy.system.power.batteryChargeLimit = 80;"
|
|
if grep -q GenuineIntel /proc/cpuinfo 2>/dev/null; then
|
|
power_lines+="
|
|
nomarchy.system.power.thermal.enable = true; # thermald (Intel)"
|
|
fi
|
|
POWER_CONFIG=$(cat <<NIX
|
|
|
|
$power_lines
|
|
NIX
|
|
)
|
|
fi
|
|
|
|
# Hardware enablement (nomarchy.hardware.*): what hardware-db.sh detected
|
|
# above the nixos-hardware commons. Safe defaults active; the heavier or
|
|
# experimental opt-ins written commented for the user to flip on.
|
|
HARDWARE_CONFIG=""
|
|
if [[ ${#HW_NOMARCHY[@]} -gt 0 || -n "$NPU_VENDOR" ]]; then
|
|
has_intel=0; has_amd=0; has_fp=0; intel_guc_off=0; has_camera_ir=0
|
|
if [[ ${#HW_NOMARCHY[@]} -gt 0 ]]; then
|
|
for nm in "${HW_NOMARCHY[@]}"; do
|
|
case "$nm" in
|
|
hardware.intel.enable=true) has_intel=1 ;;
|
|
hardware.intel.guc=false) intel_guc_off=1 ;;
|
|
hardware.amd.enable=true) has_amd=1 ;;
|
|
hardware.fingerprint.enable=true) has_fp=1 ;;
|
|
hardware.camera.hideIrSensor=true) has_camera_ir=1 ;;
|
|
esac
|
|
done
|
|
fi
|
|
hw_lines=" # Hardware enablement (auto-detected). Safe defaults are active;
|
|
# the heavier opt-ins are commented — uncomment to turn them on."
|
|
if [[ $has_intel -eq 1 ]]; then
|
|
hw_lines+="
|
|
nomarchy.hardware.intel.enable = true; # GuC/HuC firmware (i915.enable_guc=3)"
|
|
if [[ $intel_guc_off -eq 1 ]]; then
|
|
hw_lines+="
|
|
nomarchy.hardware.intel.guc = false; # GPU on the xe driver → GuC is default-on"
|
|
fi
|
|
hw_lines+="
|
|
# nomarchy.hardware.intel.computeRuntime = true; # OpenCL/oneVPL GPU compute (opt-in)"
|
|
fi
|
|
if [[ $has_amd -eq 1 ]]; then
|
|
hw_lines+="
|
|
nomarchy.hardware.amd.enable = true; # amd-pstate EPP + radeonsi VA-API
|
|
# nomarchy.hardware.amd.rocm.enable = true; # ROCm GPU compute (multi-GB, opt-in)
|
|
# nomarchy.hardware.amd.rocm.gfxOverride = \"\"; # e.g. \"11.0.0\" for an unlisted iGPU"
|
|
fi
|
|
if [[ $has_fp -eq 1 ]]; then
|
|
hw_lines+="
|
|
nomarchy.hardware.fingerprint.enable = true; # fprintd (enroll: fprintd-enroll)
|
|
# nomarchy.hardware.fingerprint.pam = true; # use it for login + sudo (opt-in)"
|
|
fi
|
|
if [[ $has_camera_ir -eq 1 ]]; then
|
|
hw_lines+="
|
|
nomarchy.hardware.camera.hideIrSensor = true; # dual-sensor webcam: hide the IR node (color cam only)"
|
|
fi
|
|
if [[ -n "$NPU_VENDOR" ]]; then
|
|
hw_lines+="
|
|
# nomarchy.hardware.npu.enable = true; # $NPU_VENDOR NPU driver (experimental; userspace runtime BYO)
|
|
# nomarchy.hardware.latestKernel = true; # newest kernel if the NPU driver isn't in the shipped one"
|
|
fi
|
|
HARDWARE_CONFIG=$(cat <<NIX
|
|
|
|
$hw_lines
|
|
NIX
|
|
)
|
|
fi
|
|
|
|
# initialHashedPassword is safe to template: mkpasswd's alphabet is
|
|
# [a-zA-Z0-9./$] — no Nix string metacharacters.
|
|
cat > "$FLAKE_DIR/system.nix" <<EOF
|
|
# Your machine: hostname, users, services. The distro itself comes from
|
|
# Nomarchy (via flake.nix); override its defaults here with plain NixOS
|
|
# options, or the nomarchy.system.* toggles.
|
|
{ pkgs, username, ... }:
|
|
|
|
{
|
|
boot.loader.systemd-boot.enable = true;
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
|
|
networking.hostName = "$HOSTNAME_";
|
|
time.timeZone = "$TIMEZONE";
|
|
i18n.defaultLocale = "$LOCALE";
|
|
|
|
# One keyboard layout everywhere: xkb is the source of truth, and the
|
|
# distro defaults (console.useXkbConfig + the systemd initrd, set in
|
|
# the nomarchy module) derive the virtual console and the LUKS
|
|
# passphrase prompt from it — so only the chosen layout is written here.
|
|
# The Hyprland session reads the same layout from nomarchy.keyboard.* in
|
|
# home.nix.
|
|
services.xserver.xkb.layout = "$KB_LAYOUT";
|
|
services.xserver.xkb.variant = "$KB_VARIANT";
|
|
|
|
# Your login user — \`username\` flows in from flake.nix automatically.
|
|
users.users.\${username} = {
|
|
isNormalUser = true;
|
|
extraGroups = [ "wheel" "networkmanager" "video" "input" ];
|
|
initialHashedPassword = "$HASHED_PASSWORD";
|
|
};
|
|
$AUTOLOGIN_CONFIG$POWER_CONFIG$HARDWARE_CONFIG$RESUME_CONFIG
|
|
# Hourly/daily BTRFS timeline snapshots + nixos-rebuild-snap.
|
|
nomarchy.system.snapper.enable = true;
|
|
|
|
system.stateVersion = "26.05";
|
|
}
|
|
EOF
|
|
|
|
# The flake.lock: composed offline — nomarchy is path-locked to the very
|
|
# source the ISO carries (original stays the forge URL, so a later
|
|
# `nix flake update` on the installed machine re-resolves normally).
|
|
if ! python3 "$SHARE/compose-lock.py" "$SHARE/flake.lock" "$FLAKE_DIR/flake.lock" \
|
|
"$NOMARCHY_LOCKED_JSON" "$NOMARCHY_ORIGINAL_JSON"; then
|
|
warn "Offline lock composition failed — resolving over the network."
|
|
(cd "$FLAKE_DIR" && nix --extra-experimental-features "nix-command flakes" flake lock)
|
|
fi
|
|
|
|
# A flake worktree must be git-tracked (theme-state.json especially).
|
|
(
|
|
cd "$FLAKE_DIR"
|
|
git init -q
|
|
git add -A
|
|
git -c user.name="Nomarchy Installer" -c user.email="installer@nomarchy" \
|
|
commit -qm "Initial Nomarchy configuration"
|
|
)
|
|
|
|
# The user must own their flake — libgit2 refuses repositories owned by
|
|
# someone else, which breaks `home-manager switch` (and theme switching)
|
|
# outright. The first normal NixOS user is always 1000:users(100); the
|
|
# account doesn't exist in the target yet, so numeric ids it is.
|
|
chown -R 1000:100 "$FLAKE_DIR"
|
|
# The templates come out of the nix store mode 0444 and cp preserves
|
|
# that — without this the user owns home.nix but can't edit it.
|
|
chmod -R u+w "$FLAKE_DIR"
|
|
|
|
# /etc/nixos on the installed system points at the user-owned flake.
|
|
mkdir -p /mnt/etc
|
|
ln -sfn "/home/$USERNAME/.nomarchy" /mnt/etc/nixos
|
|
success "Configuration written to ~$USERNAME/.nomarchy"
|
|
|
|
# ─── Install ────────────────────────────────────────────────────────────
|
|
section "Installing (this takes a while)"
|
|
|
|
# Seed the target store with the flake source + all inputs so the first
|
|
# `nomarchy-theme-sync apply` (and the HM pre-activation below) work
|
|
# before the machine has ever seen a network. Two steps because
|
|
# `flake archive --to` enforces signatures and locally-evaluated source
|
|
# paths have none; plain `nix copy` accepts --no-check-sigs.
|
|
info "Seeding flake inputs into the target store..."
|
|
# path: (not git+file) — the flake dir is owned by the target user and
|
|
# root's libgit2 refuses repositories owned by someone else.
|
|
flake_paths=$(nix --extra-experimental-features "nix-command flakes" \
|
|
flake archive --json "path:$FLAKE_DIR" \
|
|
| python3 -c '
|
|
import json, sys
|
|
def walk(node):
|
|
yield node["path"]
|
|
for child in node.get("inputs", {}).values():
|
|
yield from walk(child)
|
|
print("\n".join(walk(json.load(sys.stdin))))' || true)
|
|
if [[ -n "$flake_paths" ]]; then
|
|
# shellcheck disable=SC2086
|
|
nix --extra-experimental-features "nix-command flakes" \
|
|
copy --no-check-sigs --to "local?root=/mnt" $flake_paths \
|
|
|| warn "input seeding failed — first rebuild will need network."
|
|
else
|
|
warn "flake archive failed — first rebuild will need network."
|
|
fi
|
|
|
|
# Offline: sidestep substituter plumbing entirely — make every ISO store
|
|
# path valid in the target store up front. nixos-install's in-target
|
|
# build then finds all build tools locally and only the per-machine
|
|
# config derivations are built. (Two earlier attempts to route this
|
|
# through substituters — env config and the forwarded --substituters
|
|
# flag — still left the plan building gcc from source.)
|
|
if [[ ${#NIXOS_INSTALL_OPTS[@]} -gt 0 ]]; then
|
|
info "Copying the ISO store into the target (offline install)..."
|
|
nix --extra-experimental-features nix-command \
|
|
copy --all --no-check-sigs --to "local?root=/mnt"
|
|
fi
|
|
|
|
nixos-install --no-root-passwd "${NIXOS_INSTALL_OPTS[@]}" --flake "path:$FLAKE_DIR#default"
|
|
success "System installed (bootloader in place)"
|
|
|
|
# Pre-activate the Home Manager generation so the FIRST boot lands in the
|
|
# fully themed desktop, not bare Hyprland. Best-effort: a failure here
|
|
# only costs the user one `home-manager switch` after logging in.
|
|
section "Baking the desktop"
|
|
|
|
# Build the generation HERE in the live environment, not in the chroot:
|
|
# the live store always carries the offline pin set, while the target
|
|
# store only gets the full ISO store on OFFLINE installs — an online
|
|
# install skips that copy, and the old in-chroot build (substituters
|
|
# deliberately empty) then tried to compile the world from source.
|
|
# Building against the live store is the exact path the live session's
|
|
# own theme switching exercises, online or off.
|
|
info "Building the desktop generation..."
|
|
hm_out=""
|
|
if hm_out=$(nix --extra-experimental-features "nix-command flakes" \
|
|
build --no-link --print-out-paths \
|
|
--option substituters "" \
|
|
"path:$FLAKE_DIR#homeConfigurations.$USERNAME.activationPackage"); then
|
|
nix --extra-experimental-features "nix-command flakes" \
|
|
copy --no-check-sigs --to "local?root=/mnt" "$hm_out" \
|
|
|| hm_out=""
|
|
fi
|
|
[[ -n "$hm_out" ]] || warn "live-side desktop build failed — retrying inside the chroot"
|
|
# NOT /mnt/tmp: nixos-enter mounts a fresh tmpfs over /tmp inside the
|
|
# chroot, which silently vaporizes any script staged there (cost us a
|
|
# full verification round to find). /root persists into the chroot.
|
|
cat > /mnt/root/nomarchy-hm-activate.sh <<EOF
|
|
set -ex
|
|
exec > /var/log/nomarchy-hm-preactivate.log 2>&1
|
|
export PATH=/run/current-system/sw/bin:\$PATH
|
|
# Keep root's nix state in /root, not a stray /home/nomarchy on the target.
|
|
export HOME=/root
|
|
# Normally pre-built in the live env and copied over; the in-chroot
|
|
# build (default substituters — the live-side build already proved the
|
|
# no-network case) is a last-resort fallback.
|
|
out="$hm_out"
|
|
if [ -z "\$out" ]; then
|
|
out=\$(nix --extra-experimental-features "nix-command flakes" \
|
|
build --no-link --print-out-paths \
|
|
"path:/home/$USERNAME/.nomarchy#homeConfigurations.$USERNAME.activationPackage")
|
|
fi
|
|
install -d -o "$USERNAME" -g users /nix/var/nix/profiles/per-user/$USERNAME
|
|
install -d -o "$USERNAME" -g users /nix/var/nix/gcroots/per-user/$USERNAME
|
|
# activate's profile ops need store access; as the user that means a
|
|
# daemon, and the chroot has none — run one for the duration.
|
|
nix-daemon &
|
|
daemon_pid=\$!
|
|
trap 'kill \$daemon_pid 2>/dev/null || true' EXIT
|
|
sleep 2
|
|
# BACKUP_EXT: collisions can't abort the activation (a stray
|
|
# autogenerated config gets moved aside instead).
|
|
runuser -u "$USERNAME" -- bash -lc \
|
|
"USER=$USERNAME HOME=/home/$USERNAME NIX_REMOTE=daemon HOME_MANAGER_BACKUP_EXT=bak \$out/activate"
|
|
EOF
|
|
if nixos-enter --root /mnt -- bash /root/nomarchy-hm-activate.sh; then
|
|
success "Desktop pre-activated — first boot is fully themed"
|
|
else
|
|
warn "Desktop pre-activation failed (see /var/log/nomarchy-hm-preactivate.log"
|
|
warn "on the installed system); after first login run:"
|
|
warn " home-manager switch --flake ~/.nomarchy -b bak"
|
|
tail -n 5 /mnt/var/log/nomarchy-hm-preactivate.log 2>/dev/null || true
|
|
fi
|
|
rm -f /mnt/root/nomarchy-hm-activate.sh
|
|
|
|
header "Nomarchy installed on $TARGET_DISK" \
|
|
"User: $USERNAME @ $HOSTNAME_" \
|
|
"Remove the USB stick when the machine is off."
|
|
|
|
finish="${NOMARCHY_FINISH:-ask}"
|
|
case "$finish" in
|
|
reboot) systemctl reboot ;;
|
|
poweroff) systemctl poweroff ;;
|
|
none) : ;;
|
|
*) confirm "Reboot into Nomarchy now?" && systemctl reboot || true ;;
|
|
esac
|