098cd42ac8
Several installer reliability fixes that were left uncommitted:
- Impermanence + multi-disk LUKS: disko-config.nix names the main LUKS
mapping `crypted` for single-disk and `crypted_main` once extraDrives is
non-empty. The impermanence rollback hook used to hardcode `crypted`,
which made every multi-disk install fail to mount root in initrd. Added
a `nomarchy.system.impermanence.mainLuksName` option and wired the
installer to write the correct value into the generated system.nix
based on the drive count.
- Password no longer cleartext in /etc/nixos: installer now hashes the
user password with `mkpasswd -m sha-512` and emits
`initialHashedPassword` instead of `initialPassword`. Added mkpasswd to
the live ISO. Cleartext is unset immediately after hashing.
USER_PASSWORD_HASH is deliberately not persisted in --resume state —
configure_user re-prompts on resume.
- Revision pinning that actually works on the live ISO: `inputs.self`
strips .git in the Nix store copy, so `git rev-parse HEAD` would silently
return empty on a real install and the generated flake would track main.
Live ISO now writes `/etc/nomarchy-rev` from `inputs.self.rev` at build
time; install.sh reads it first, falls back to git, and aborts with a
loud confirmation prompt if both are empty (instead of silently
installing an unpinned system).
- Generated `/mnt/etc/nixos/state.json`: toggle scripts (nomarchy-tz-select,
nomarchy-setup-{fido2,fingerprint}, nomarchy-toggle-hybrid-gpu,
nomarchy-wifi-powersave) `jq` this file in place and fail hard if it
doesn't exist. Fresh installs now ship a schema-conformant file matching
lib/state-schema.nix.
- Unmount /mnt before exiting `finish()` regardless of reboot choice. Clean
unmount avoids dirty BTRFS on reboot; on "no", leaving /mnt mounted
blocked a second installer run on the same live ISO.
- Removed obsolete `installer/disko-btrfs-luks.nix` (superseded by
`disko-config.nix` per commit 3aadc36) and dropped its dangling
`docs/STRUCTURE.md` reference.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
98 lines
3.5 KiB
Nix
98 lines
3.5 KiB
Nix
{ config, pkgs, inputs, lib, ... }:
|
|
|
|
{
|
|
# Live-ISO defaults. The install.sh keymap step calls `hyprctl keyword
|
|
# input:kb_layout` at runtime so the user's pick takes effect during the
|
|
# install, and writes the chosen value into the *installed* system.
|
|
console.keyMap = lib.mkDefault "us";
|
|
i18n.defaultLocale = lib.mkDefault "en_US.UTF-8";
|
|
services.xserver.xkb.layout = lib.mkDefault "us";
|
|
|
|
# ISO Branding
|
|
isoImage.volumeID = lib.mkForce "NOMARCHY_LIVE";
|
|
isoImage.edition = lib.mkForce "graphical";
|
|
|
|
# Home Manager activation for the nixos live user is provided by the
|
|
# home-manager.nixosModules.home-manager module wired up in flake.nix.
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
git
|
|
gum
|
|
alacritty
|
|
parted
|
|
btrfs-progs
|
|
cryptsetup
|
|
mkpasswd
|
|
inputs.disko.packages.${pkgs.stdenv.hostPlatform.system}.disko
|
|
(pkgs.makeDesktopItem {
|
|
name = "install-nomarchy";
|
|
desktopName = "Install Nomarchy";
|
|
exec = "alacritty -e sudo /etc/install.sh";
|
|
terminal = false;
|
|
categories = [ "System" ];
|
|
})
|
|
];
|
|
|
|
# Ensure the live environment user has the necessary groups for graphical acceleration and audio
|
|
users.users.nixos.extraGroups = [ "wheel" "video" "render" "audio" "networkmanager" ];
|
|
|
|
# Graphics support for live environment.
|
|
#
|
|
# Force-loading every GPU driver in the initrd (amdgpu+radeon+nouveau+i915)
|
|
# panics most machines — only one of them can claim the GPU and the others
|
|
# explode. List them under `availableKernelModules` instead so udev only
|
|
# loads the one that matches the present hardware. We still force the AMD
|
|
# pair when Plymouth needs KMS early; `virtio_gpu` is auto-loaded when
|
|
# we're booted in QEMU via nomarchy-test-live-iso.
|
|
boot.initrd.availableKernelModules = [
|
|
"amdgpu" "radeon" "nouveau" "i915" "virtio_gpu"
|
|
];
|
|
services.xserver.videoDrivers = [ "amdgpu" "radeon" "nouveau" "modesetting" "fbdev" "virtio" ];
|
|
|
|
environment.etc."install.sh" = {
|
|
source = ../installer/install.sh;
|
|
mode = "0755";
|
|
};
|
|
|
|
environment.etc."hardware-db.sh" = {
|
|
source = ../installer/hardware-db.sh;
|
|
mode = "0644";
|
|
};
|
|
|
|
environment.etc."disko-config.nix" = {
|
|
source = ../installer/disko-config.nix;
|
|
};
|
|
|
|
environment.etc."nomarchy".source = inputs.self;
|
|
|
|
# Embed the git revision the ISO was built from so install.sh can pin the
|
|
# generated flake to the exact same commit. `inputs.self.rev` exists only
|
|
# when the flake is built from a clean git tree; from a dirty worktree we
|
|
# fall back to dirtyRev (which won't be resolvable by `git+https`, so the
|
|
# installer treats it as "unpinned"). Empty file = unpinned.
|
|
environment.etc."nomarchy-rev".text =
|
|
if inputs.self ? rev then inputs.self.rev
|
|
else "";
|
|
|
|
# Auto-login to the graphical session
|
|
services.displayManager.autoLogin.enable = true;
|
|
services.displayManager.autoLogin.user = "nixos";
|
|
|
|
# Allow passwordless sudo for the live user
|
|
security.sudo.wheelNeedsPassword = false;
|
|
|
|
# Override the upstream installer helpLine (says "NixOS", points nowhere
|
|
# useful for us). Shown on every TTY before login and again as the MOTD.
|
|
services.getty.helpLine = lib.mkForce ''
|
|
|
|
Welcome to the Nomarchy live environment.
|
|
|
|
To install Nomarchy: sudo /etc/install.sh
|
|
To preview the install: sudo /etc/install.sh --dry-run
|
|
To resume an interrupted run: sudo /etc/install.sh --resume
|
|
|
|
The graphical session autologins as 'nixos' (no password).
|
|
The 'nixos' and 'root' accounts have empty passwords.
|
|
'';
|
|
}
|