fixed ssh keys

2025-12-05 21:51:51 +00:00 · 2023-11-19 03:54:23 +00:00
parent 362fc6d0a2
commit 1697abccbf
8 changed files with 487 additions and 30 deletions
--- a/README.md
+++ b/README.md
@@ -1 +1,22 @@
-# nixos-cluster
+# NixOS on ODROID-M1
+
+(based on https://github.com/povik/nixos-on-odroid-n2 and hellabyte's work here https://discourse.nixos.org/t/newbie-installs-nixos-on-an-arm-sbc-or-how-patience-is-a-virtue/35020)
+
+These are configuration files which make it easier to set up and maintain a NixOS installation on an ODROID-M1 single-board computer.
+
+The system is set up to be loaded through Petitboot.
+
+Kernel is mainline.
+
+Patches are welcome!
+
+## Building an initial SD/MMC image
+
+On an aarch64 system (or with aarch64 emulation):
+
+`nix build .#images.m1`
+
+On an aarch64 system:
+
+`nix build --option system aarch64-linux --option sandbox false .#images.m1`
+
--- a/configuration.nix
+++ b/configuration.nix
@@ -0,0 +1,118 @@
+# Edit this configuration file to define what should be installed on
+# your system. Help is available in the configuration.nix(5) man page, on
+# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
+
+{ config, lib, pkgs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+    ];
+
+  # Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
+  boot.loader.grub.enable = false;
+  # Enables the generation of /boot/extlinux/extlinux.conf
+  boot.loader.generic-extlinux-compatible.enable = true;
+
+  # networking.hostName = "nixos"; # Define your hostname.
+  # Pick only one of the below networking options.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+  # networking.networkmanager.enable = true;  # Easiest to use and most distros use this by default.
+
+  # Set your time zone.
+  # time.timeZone = "Europe/Amsterdam";
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Select internationalisation properties.
+  # i18n.defaultLocale = "en_US.UTF-8";
+  # console = {
+  #   font = "Lat2-Terminus16";
+  #   keyMap = "us";
+  #   useXkbConfig = true; # use xkb.options in tty.
+  # };
+
+  # Enable the X11 windowing system.
+  # services.xserver.enable = true;
+
+
+  
+
+  # Configure keymap in X11
+  # services.xserver.xkb.layout = "us";
+  # services.xserver.xkb.options = "eurosign:e,caps:escape";
+
+  # Enable CUPS to print documents.
+  # services.printing.enable = true;
+
+  # Enable sound.
+  # sound.enable = true;
+  # hardware.pulseaudio.enable = true;
+
+  # Enable touchpad support (enabled default in most desktopManager).
+  # services.xserver.libinput.enable = true;
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  # users.users.alice = {
+  #   isNormalUser = true;
+  #   extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+  #   packages = with pkgs; [
+  #     firefox
+  #     tree
+  #   ];
+  # };
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  # environment.systemPackages = with pkgs; [
+  #   vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+  #   wget
+  # ];
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  # services.openssh.enable = true;
+
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ... ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  #
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  #
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system.
+  #
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  #
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  #
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
+  system.stateVersion = "23.11"; # Did you read the comment?
+
+}
+
--- a/default.nix
+++ b/default.nix
@@ -48,16 +48,7 @@
            experimental-features = nix-command flakes
          '';

-          # includes this flake in the live iso : "/etc/nixcfg"
-          environment.etc.nixcfg.source =
-            builtins.filterSource
-              (path: type:
-                baseNameOf path
-                != ".git"
-                && type != "symlink"
-                && !(pkgs.lib.hasSuffix ".qcow2" path)
-                && baseNameOf path != "secrets")
-              ../.;
+      system.stateVersion = "23.11"; # Did you read the comment?


      services.openssh = {
--- a/flake.lock
+++ b/flake.lock
@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1699963925,
+        "narHash": "sha256-LE7OV/SwkIBsCpAlIPiFhch/J+jBDGEZjNfdnzCnCrY=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "bf744fe90419885eefced41b3e5ae442d732712d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
--- a/flake.nix
+++ b/flake.nix
@@ -1,27 +1,158 @@
 {
-  description = "nix-configurations";
+  inputs = {
+    # nixpkgs.url = "github:NixOS/nixpkgs/nixos-22.05";
+    # nixpkgs.url = "github:NixOS/nixpkgs/nixos-22.11";
+    #nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.05";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";

-   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
  };

-  outputs = { self, nixpkgs, ... }@inputs: 
-  let 
-    globalModules = [ 
-      { 
-        system.configurationRevision = self.rev or self.dirtyRev or null; 
-      }
-      ./default.nix 
-    ];
-  in
-  {
-    nixosConfigurations = {
-      odroid8 = nixpkgs.lib.nixosSystem {
-        system = "aarch64-linux";
-        modules = globalModules
-          ++ [ ./hosts/odroid8.nix ];
-      };
+  outputs = { nixpkgs, ... }: let
+    system = "x86_64-linux";
+    pkgs = import nixpkgs {
+      inherit system;
+    };
+    lib = nixpkgs.lib;
+
+  
+
+  in rec {
+    formatter.x86_64-linux = nixpkgs.legacyPackages.aarch64-linux.nixpkgs-fmt;
+
+    devShell.${system} = pkgs.mkShell {
+      buildInputs = with pkgs; [
+        rsync
+        zstd
+      ];
    };

+    nixosConfigurations.m1 = lib.nixosSystem {
+      system = "aarch64-linux";
+
+      modules = [
+      ({ pkgs, config, ... }: {
+
+          imports = [
+            ./kboot-conf
+            # "${nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64-installer.nix"
+            "${nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix"
+
+          ];
+
+          sdImage = {
+            #compressImage = false;
+            populateFirmwareCommands = let
+              configTxt = pkgs.writeText "README" ''
+              Nothing to see here. This empty partition is here because I don't know how to turn its creation off.
+              '';
+            in ''
+              cp ${configTxt} firmware/README
+            '';
+            populateRootCommands = ''
+              ${config.boot.loader.kboot-conf.populateCmd} -c ${config.system.build.toplevel} -d ./files/kboot.conf
+            '';
+            };
+
+          system.stateVersion = "23.11";
+          #boot.loader.grub.enable = false;
+          boot.loader.kboot-conf.enable = true;
+          # Use kernel >6.6 
+          boot.kernelPackages = pkgs.linuxPackages_latest;
+          # Stop ZFS breasking the build
+          boot.supportedFilesystems = lib.mkForce [ "btrfs" "cifs" "f2fs" "jfs" "ntfs" "reiserfs" "vfat" "xfs" ];
+
+          # I'm not completely sure if some of these could be omitted,
+          # but want to make sure disk access works
+          boot.initrd.availableKernelModules = [
+            "nvme"
+            "nvme-core"
+            "phy-rockchip-naneng-combphy"
+            "phy-rockchip-snps-pcie3"
+          ];
+          # Petitboot uses this port and baud rate on the boards serial port,
+          # it's probably good to keep the options same for the running
+          # kernel for serial console access to work well
+          boot.kernelParams = [ "console=ttyS2,1500000" ];       
+          hardware.deviceTree.name = "rockchip/rk3568-odroid-m1.dtb";
+          
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  environment.systemPackages = [
+    pkgs.git
+    pkgs.treefmt
+
+ ];
+
+    fileSystems."/mnt/Public" = {
+        device = "//192.168.1.109/Public";
+        fsType = "cifs";
+        # options = ["uid=0,gid=1000"];
+        options = ["guest" "uid=1000"];
+    };
+
+
+systemd.services.setleds = {
+  script = ''
+    echo "Setting Odroid LEDs"
+    echo none > /sys/class/leds/blue\:heartbeat/trigger
+    cat /sys/class/leds/blue\:heartbeat/trigger
+  '';
+  wantedBy = [ "multi-user.target" ];
+};
+virtualisation.docker.enable = true;
+services.nomad = {
+        package = pkgs.nomad_1_6;
+        dropPrivileges = false;
+ 	enableDocker = true;
+	enable = true;
+        settings = {
+client = {
+    enabled = true;
+    node_class = "";
+    no_host_uuid = false;
+    servers = ["192.168.1.221:4647" "192.168.1.225:4647" "192.168.1.226:4647" "192.168.1.227:4647" "192.168.1.222:4647" "192.168.1.223:4647" "192.168.1.224:4647"];
+    max_kill_timeout = "30s";
+    network_speed = 0;
+    cpu_total_compute = 0;
+    gc_interval = "1m";
+    gc_disk_usage_threshold = 80;
+    gc_inode_usage_threshold = 70;
+    gc_parallel_destroys = 2;
+    reserved = {
+        cpu = 0;
+        memory = 200;
+        disk = 0;
+    };
+    options = {
+        "docker.caps.whitelist" = "SYS_ADMIN,NET_ADMIN,chown,dac_override,fsetid,fowner,mknod,net_raw,setgid,setuid,setfcap,setpcap,net_bind_service,sys_chroot,kill,audit_write,sys_module";
+        "driver.raw_exec.enable" = "1";
+        "docker.volumes.enabled" = "True";
+        "docker.privileged.enabled" = "true";
+        "docker.auth.config" = "/root/.docker/config.json";
+    };
+    };
+};
+
+
+
+};
+
+
+
+
+
+
+
+      services.openssh = {
+            enable = true;
+            settings.PermitRootLogin = "yes";
+          };
+          users.extraUsers.root.initialPassword = lib.mkForce "test123";
+        })
+      ];
+    };
+
+    images = {
+      m1 = nixosConfigurations.m1.config.system.build.sdImage;
+    };
  };
 }
--- a/hosts/odroid8/default.nix
+++ b/hosts/odroid8/default.nix
@@ -1,6 +1,7 @@
 { lib, pkgs, config, inputs,  ... }: {

  imports = [
+    ./hardware-configuration.nix
  ];

  nixpkgs.hostPlatform.system = "aarch64-linux";
--- a/hosts/odroid8/hardware-configuration.nix
+++ b/hosts/odroid8/hardware-configuration.nix
@@ -0,0 +1,157 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "nvme" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/44444444-4444-4444-8888-888888888888";
+      fsType = "ext4";
+    };
+
+  fileSystems."/mnt/Public" =
+    { device = "//192.168.1.109/Public";
+      fsType = "cifs";
+    };
+
+  fileSystems."/var/lib/nomad/alloc/c745de59-e3b3-18ef-df73-6fc001bb9dd0/init/secrets" =
+    { device = "tmpfs";
+      fsType = "tmpfs";
+    };
+
+  fileSystems."/var/lib/nomad/alloc/c745de59-e3b3-18ef-df73-6fc001bb9dd0/init/private" =
+    { device = "tmpfs";
+      fsType = "tmpfs";
+    };
+
+  fileSystems."/var/lib/nomad/alloc/c745de59-e3b3-18ef-df73-6fc001bb9dd0/finalsync/secrets" =
+    { device = "tmpfs";
+      fsType = "tmpfs";
+    };
+
+  fileSystems."/var/lib/nomad/alloc/c745de59-e3b3-18ef-df73-6fc001bb9dd0/finalsync/private" =
+    { device = "tmpfs";
+      fsType = "tmpfs";
+    };
+
+  fileSystems."/var/lib/nomad/alloc/d54a8ecf-1c4d-5fdf-f2c7-aa3992474498/setup/secrets" =
+    { device = "tmpfs";
+      fsType = "tmpfs";
+    };
+
+  fileSystems."/var/lib/nomad/alloc/d54a8ecf-1c4d-5fdf-f2c7-aa3992474498/setup/private" =
+    { device = "tmpfs";
+      fsType = "tmpfs";
+    };
+
+  fileSystems."/var/lib/nomad/alloc/d54a8ecf-1c4d-5fdf-f2c7-aa3992474498/tidy/secrets" =
+    { device = "tmpfs";
+      fsType = "tmpfs";
+    };
+
+  fileSystems."/var/lib/nomad/alloc/d54a8ecf-1c4d-5fdf-f2c7-aa3992474498/tidy/private" =
+    { device = "tmpfs";
+      fsType = "tmpfs";
+    };
+
+  fileSystems."/var/lib/nomad/alloc/d42e04fb-40c1-09a1-5470-ccde18a4f712/setup/secrets" =
+    { device = "tmpfs";
+      fsType = "tmpfs";
+    };
+
+  fileSystems."/var/lib/nomad/alloc/d42e04fb-40c1-09a1-5470-ccde18a4f712/setup/private" =
+    { device = "tmpfs";
+      fsType = "tmpfs";
+    };
+
+  fileSystems."/var/lib/nomad/alloc/d42e04fb-40c1-09a1-5470-ccde18a4f712/tidy/secrets" =
+    { device = "tmpfs";
+      fsType = "tmpfs";
+    };
+
+  fileSystems."/var/lib/nomad/alloc/d42e04fb-40c1-09a1-5470-ccde18a4f712/tidy/private" =
+    { device = "tmpfs";
+      fsType = "tmpfs";
+    };
+
+  fileSystems."/var/lib/nomad/alloc/280583b0-7b32-da09-5b6a-959362990ff8/setup/secrets" =
+    { device = "tmpfs";
+      fsType = "tmpfs";
+    };
+
+  fileSystems."/var/lib/nomad/alloc/280583b0-7b32-da09-5b6a-959362990ff8/setup/private" =
+    { device = "tmpfs";
+      fsType = "tmpfs";
+    };
+
+  fileSystems."/var/lib/nomad/alloc/280583b0-7b32-da09-5b6a-959362990ff8/tidy/secrets" =
+    { device = "tmpfs";
+      fsType = "tmpfs";
+    };
+
+  fileSystems."/var/lib/nomad/alloc/280583b0-7b32-da09-5b6a-959362990ff8/tidy/private" =
+    { device = "tmpfs";
+      fsType = "tmpfs";
+    };
+
+  fileSystems."/var/lib/nomad/alloc/0dc89489-57e5-a625-2771-023ee19d9e95/setup/secrets" =
+    { device = "tmpfs";
+      fsType = "tmpfs";
+    };
+
+  fileSystems."/var/lib/nomad/alloc/0dc89489-57e5-a625-2771-023ee19d9e95/setup/private" =
+    { device = "tmpfs";
+      fsType = "tmpfs";
+    };
+
+  fileSystems."/var/lib/nomad/alloc/0dc89489-57e5-a625-2771-023ee19d9e95/tidy/secrets" =
+    { device = "tmpfs";
+      fsType = "tmpfs";
+    };
+
+  fileSystems."/var/lib/nomad/alloc/0dc89489-57e5-a625-2771-023ee19d9e95/tidy/private" =
+    { device = "tmpfs";
+      fsType = "tmpfs";
+    };
+
+  fileSystems."/var/lib/nomad/alloc/9afdf338-fcbd-d955-f3fe-5d0e45f25a5c/setup/secrets" =
+    { device = "tmpfs";
+      fsType = "tmpfs";
+    };
+
+  fileSystems."/var/lib/nomad/alloc/9afdf338-fcbd-d955-f3fe-5d0e45f25a5c/setup/private" =
+    { device = "tmpfs";
+      fsType = "tmpfs";
+    };
+
+  fileSystems."/var/lib/nomad/alloc/9afdf338-fcbd-d955-f3fe-5d0e45f25a5c/tidy/secrets" =
+    { device = "tmpfs";
+      fsType = "tmpfs";
+    };
+
+  fileSystems."/var/lib/nomad/alloc/9afdf338-fcbd-d955-f3fe-5d0e45f25a5c/tidy/private" =
+    { device = "tmpfs";
+      fsType = "tmpfs";
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.docker0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.end0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
+}
--- a/treefmt.toml
+++ b/treefmt.toml
@@ -0,0 +1,11 @@
+# One CLI to format the code tree - https://github.com/numtide/treefmt
+
+[formatter.mylanguage]
+# Formatter to run
+command = "command-to-run"
+# Command-line arguments for the command
+options = []
+# Glob pattern of files to include
+includes = [ "*.<language-extension>" ]
+# Glob patterns of files to exclude
+excludes = []