diff options
Diffstat (limited to 'tv/2configs')
| -rw-r--r-- | tv/2configs/xu-qemu0.nix | 226 |
1 files changed, 226 insertions, 0 deletions
diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix new file mode 100644 index 0000000..8366036 --- /dev/null +++ b/tv/2configs/xu-qemu0.nix @@ -0,0 +1,226 @@ +{ config, lib, pkgs, ... }: + +let + # XXX cannot use config.build.host.name here because infinite recursion when + # defining krebs.hosts.${host-name}.nets.retiolum.aliases below. + host-name = "xu"; +in + +# usage: +# sudo -iu df xu-qemu0 +# set_password vnc correcthorze +# +# vncdo -s xu:1 type 'curl init.xu.r' key shift-\\ type sh key return +# +# http://vnc.xu/vnc_auto.html?port=5701&host=xu&password=correcthorze +# +# make [install] system=xu-qemu0 target_host=10.56.0.101 + + +with lib; + +{ + #networking.wireless.interfaces = [ "wlp3s0" ]; + + #networking.useNetworkd = true; + + #networking.dhcpcd.allowInterfaces = [ + # "qemubr0" + #]; + + #systemd.network.networks.wlp3s0 = { + # matchConfig.name = "wlp3s0"; + # networkConfig.Bridge = "qemubr0"; + #}; + + systemd.network.enable = true; + + systemd.network.netdevs.qemubr0 = { + netdevConfig = { + Name = "qemubr0"; + Kind = "bridge"; + }; + }; + + users.groups.qemu-users.gid = genid "qemu-users"; + users.users.df.extraGroups = [ "qemu-users" ]; + + environment.etc."qemu/bridge.conf".text = '' + allow qemubr0 + ''; + + krebs.per-user.tv.packages = [ + pkgs.vncdotool + ]; + + krebs.per-user.df.packages = [ + (pkgs.writeDashBin "xu-qemu0" '' + set -efux + img=$HOME/tmp/xu-qemu0.raw + if ! test -e "$img"; then + ${pkgs.coreutils}/bin/mkdir -p "$(${pkgs.coreutils}/bin/dirname "$img")" + ${pkgs.kvm}/bin/qemu-img create "$img" 10G + fi + exec ${pkgs.kvm}/bin/qemu-kvm \ + -monitor stdio \ + -boot order=cd \ + -cdrom ${pkgs.fetchurl { + url = https://nixos.org/releases/nixos/15.09/nixos-15.09.1012.9fe0c23/nixos-minimal-15.09.1012.9fe0c23-x86_64-linux.iso; + sha256 = "18bc9wrsrjnhj9rya75xliqkl99gxbsk4dmwqivhvwfzb5qb5yp9"; + }} \ + -m 1024 \ + -netdev bridge,br=qemubr0,id=hn0,helper=/var/setuid-wrappers/qemu-bridge-helper \ + -net nic,netdev=hn0,id=nic1,macaddr=52:54:00:12:34:56 \ + -drive file="$img",format=raw \ + -display vnc=:1,websocket=5701,password,lossy \ + -name xu-qemu0 \ + '') + ]; + + #TODO krebs.setuid.qemu-bridge-helper = { + # filename = "${pkgs.qemu}/libexec/qemu-bridge-helper"; + # owner = "root"; + # group = "qemu-users"; + # mode = "4710"; + #}; + system.activationScripts."krebs.setuid" = stringAfter [ "setuid" ] '' + src=${pkgs.execve "qemu-bridge-helper" { + filename = "${pkgs.qemu}/libexec/qemu-bridge-helper"; + }} + dst=${config.security.wrapperDir}/qemu-bridge-helper + cp "$src" "$dst" + chown root.qemu-users "$dst" + chmod 4710 "$dst" + ''; + + users.users.qemu-dnsmasq.uid = genid "qemu-dnsmasq"; + + # TODO need custom etc/dbus-1/system.d/dnsmasq.conf for different BusName + services.dbus.packages = [ pkgs.dnsmasq ]; + + systemd.services.qemu-dnsmasq = let + # bind-interfaces + conf = pkgs.writeText "qemu-dnsmasq.conf" '' + listen-address=10.56.0.1 + interface=qemubr0 + dhcp-range=10.56.0.200,10.56.0.250 + dhcp-no-override + dhcp-leasefile=/tmp/qemu-dnsmasq.leases + domain=${host-name}.local + dhcp-host=52:54:00:12:34:56,xu-qemu0,10.56.0.101,1440m + ''; + in { + after = [ "network.target" "systemd-resolved.service" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + Type = "dbus"; + BusName = "uk.org.thekelleys.dnsmasq"; + # -1 --enable-dbus[=uk.org.thekelleys.dnsmasq] + SyslogIdentifier = "qemu-dnsmasq"; + ExecStart = "${pkgs.dnsmasq}/bin/dnsmasq -1k -u qemu-dnsmasq -C ${conf}"; + ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID"; + PrivateTmp = "true"; + }; + restartTriggers = [ config.environment.etc.hosts.source ]; + }; + + + krebs.nginx.servers.init = { + server-names = [ + "init.${host-name}" + "init.${host-name}.r" + "init.${host-name}.retiolum" + ]; + extraConfig = '' + index init.txt; + root ${pkgs.writeTextFile { + name = "init-pages"; + text = '' + #! /bin/sh + set -efu + + dev=/dev/sda + pttype=dos # gpt + + case $pttype in + dos) + if ! test "$(blkid -o value -s PTTYPE "$dev")" = dos; then + parted -s "$dev" mklabel msdos + fi + if ! test "$(blkid -o value -s PARTLABEL "$dev"1)" = primary; then + parted -s "$dev" mkpart primary ext4 1MiB 513MiB + parted -s "$dev" set 1 boot on + fi + ;; + gpt) + if ! test "$(blkid -o value -s PTTYPE "$dev")" = gpt; then + parted -s "$dev" mklabel gpt + fi + if ! test "$(blkid -o value -s PARTLABEL "$dev"1)" = ESP; then + parted -s "$dev" mkpart ESP fat32 1MiB 513MiB + parted -s "$dev" set 1 boot on + fi + ;; + *) + echo "Error: bad pttype: $pttype" >&2 + exit -1 + esac + + if ! test "$(blkid -o value -s PARTLABEL "$dev"2)" = primary; then + parted -s "$dev" mkpart primary btrfs 513MiB 100% + fi + if ! test "$(blkid -o value -s TYPE "$dev"1)" = vfat; then + mkfs.vfat "$dev"1 + fi + if ! test "$(blkid -o value -s TYPE "$dev"2)" = btrfs; then + mkfs.btrfs "$dev"2 + fi + + parted "$dev" print + + if ! test "$(lsblk -n -o MOUNTPOINT "$dev"2)" = /mnt; then + mount "$dev"2 /mnt + fi + if ! test "$(lsblk -n -o MOUNTPOINT "$dev"1)" = /mnt/boot; then + mkdir -m 0000 -p /mnt/boot + mount "$dev"1 /mnt/boot + fi + + lsblk "$dev" + + key=${shell.escape config.krebs.users.tv-xu.pubkey} + + if [ "$(cat /root/.ssh/authorized_keys 2>/dev/null)" != "$key" ]; then + mkdir -p /root/.ssh + echo "$key" > /root/.ssh/authorized_keys + fi + systemctl start sshd + ip route + echo READY. + ''; + destination = "/init.txt"; + }}; + ''; + }; + + + krebs.hosts.${host-name}.nets.retiolum.aliases = [ + "init.${host-name}.r" + "init.${host-name}.retiolum" + "vnc.${host-name}.r" + "vnc.${host-name}.retiolum" + ]; + + krebs.nginx.servers.noVNC = { + server-names = [ + "vnc.${host-name}" + "vnc.${host-name}.r" + "vnc.${host-name}.retiolum" + ]; + #rewrite ^([^.]*)$ /vnc_auto.html?host=localhost&port=5701; + locations = singleton (nameValuePair "/" '' + index vnc.html; + root ${pkgs.noVNC}; + ''); + }; +} |