commit 8fc56ded4bc2cbdaddf58f608099d04573ee992f
parent 65b5e3481384f7d0413464b51563596200c1ee47
Author: Tomas Hlavaty <tom@logand.com>
Date: Wed, 24 Dec 2025 21:18:12 +0100
update
Diffstat:
| M | README | | | 149 | ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++------------- |
1 file changed, 126 insertions(+), 23 deletions(-)
diff --git a/README b/README
@@ -1,26 +1,80 @@
# NixOS Notes
+## WiFi from Command Line
+
+ $ ip a
+ $ sudo bash -c 'wpa_supplicant -B -i iface -c <(wpa_passphrase ssid key)'
+
+Without passphrase is more complex: create file /tmp/cbase.wifi with
+the following contents:
+
+ network={
+ ssid="c-base-public"
+ key_mgmt=NONE
+ }
+
+ $ sudo wpa_supplicant -i wlp3s0 -c /tmp/cbase.wifi
+
## Installation
+Network connection is needed for installation.
+Use cable ethernet or wifi.
+
+Prepare installation disk
+
+https://nixos.org
+
+ $ cd ~/Downloads
+ $ wget https://channels.nixos.org/nixos-22.05/latest-nixos-minimal-x86_64-linux.iso
+ $ wget https://channels.nixos.org/nixos-22.05/latest-nixos-minimal-x86_64-linux.iso.sha256
+ $ cat latest-nixos-minimal-x86_64-linux.iso.sha256
+ $ mv latest-nixos-minimal-x86_64-linux.iso nixos-minimal-22.05.3050.d86a4619b7e-x86_64-linux.iso
+ $ sha256sum -c latest-nixos-minimal-x86_64-linux.iso.sha256
+
+insert usb stick
+
+ $ dmesg | tail
+ $ lsblk
+ $ sudo ddrescue --force nixos-minimal-22.05.3050.d86a4619b7e-x86_64-linux.iso /dev/sdX
+ #$ sudo dd if=nixos-minimal-22.05.3050.d86a4619b7e-x86_64-linux.iso of=/dev/sdX
+ $ lsblk
+
+boot from the usb stick above
+
+ $ sudo su -
+ # setfont ter-i32n
+
+ensure internet connection works:
+
+ # ping 1.1.1.1
+
+(If not, configure wifi, see above.)
+
Partition Disk
+dos label: 1 partition enough
+gpt label: needs grub partition + root + boot
+
# lsblk
# parted /dev/sdX -- p
# parted /dev/sdX -- mklabel gpt
# parted /dev/sdX -- mkpart primary 1024MiB 100%
- # parted /dev/sdX -- mkpart ESP fat32 256MiB 1024MiB
- # parted /dev/sdX -- mkpart GRUB 1MiB 256MiB
+ # parted /dev/sdX -- mkpart ESP fat32 1MiB 1024MiB
# parted /dev/sdX -- set 2 esp on
# parted /dev/sdX -- set 2 boot on
- # parted /dev/sdX -- set 3 bios_grub on
# parted /dev/sdX -- align-check optimal 1
+ # lsblk
Format Disks
# mkfs.vfat -F32 /dev/sdX2
# cryptsetup -v luksFormat /dev/sdX1
# cryptsetup luksOpen /dev/sdX1 luksroot
- # mkfs.nilfs2 -L root /dev/mapper/luksroot
+ # lsblk
+
+ # mkfs.ext4 -L root /dev/mapper/luksroot
+ or
+ # nix-shell -p nilfs-utils --run 'mkfs.nilfs2 -L root /dev/mapper/luksroot'
Mount Disks
@@ -31,24 +85,42 @@ Mount Disks
Install NixOS
# nixos-generate-config --root /mnt
- # ...edit /mnt/etc/nixos/configuration.nix
- # nixos-install
- # ...set root password
- # reboot
-## WiFi from Command Line
+edit /mnt/etc/nixos/configuration.nix
- $ sudo wpa_supplicant -B -i iface -c <(wpa_passphrase ssid key)
+ # nix-shell -p emacs-nox --run 'emacs /mnt/etc/nixos/configuration.nix'
-Without passphrase is more complex: create file /tmp/cbase.wifi with
-the following contents:
-
- network={
- ssid="c-base-public"
- key_mgmt=NONE
- }
+ boot.loader.systemd-boot.enable = true;
+ boot.loader.efi.canTouchEfiVariables = true;
+ boot.supportedFilesystems = ["nilfs2"];
+ boot.initrd.kernelModules = ["nilfs2"];
- $ sudo wpa_supplicant -i wlp3s0 -c /tmp/cbase.wifi
+ networking.hostName = "foo";
+ networking.wireless = {
+ enable = true;
+ networks = {
+ foo = {psk = "bar";};
+ c-base-public = {};
+ };
+ };
+
+ services.openssh = {
+ enable = true;
+ permitRootLogin = "yes";
+ passwordAuthentication = true;
+ forwardX11 = false;
+ extraConfig = ''
+ useDNS = no
+ '';
+ };
+ users.mutableUsers = false;
+ # nix-shell -p mkpasswd --run 'mkpasswd -m SHA-512 -s'
+ users.users.root.initialHashedPassword = "hashed-password-from-above";
+
+and start installation:
+
+ # nixos-install --no-root-passwd
+ # reboot
## Backups
@@ -69,19 +141,19 @@ the following contents:
There are several deployment tools for nixos each with pros and cons.
-- nixops: tried it, didn't like it. too stateful and fragile.
+- nixops: tried it, didn't like it. Too stateful and fragile.
-- hail: did not try. looks abandoned. pulls updates from hydra.
+- hail: did not try. Looks abandoned. Pulls updates from hydra.
-- morph: did not try. looks complex.
+- morph: did not try. Looks complex.
-- krops: did not try. actively used. builds remotely, which I don't
+- krops: did not try. Actively used. Builds remotely, which I don't
want. A production server should serve specific purpose and things
which don't serve that purpose should not be there, i.e. I don't
want to build there anything and I don't want the build artefacts to
be stored there.
-- nixos-rebuild: nixos native command. supports deploying to other
+- nixos-rebuild: nixos native command. Supports deploying to other
machines but doesn't do substitutes, which is a major flaw on
asymetric connections with bad upload speed.
@@ -202,3 +274,34 @@ What I do, for example, for tinc:
- deploy the tinc service for the second time, this time with the
public key already filled in
+
+## Recover Lost Password
+
+TODO systemd-boot?
+
+GRUB:
+
+- press e to edit kernel setting
+
+- add init=/bin/sh to the end
+
+- fsck root file system
+
+- mount -o remount,rw /
+
+- passwd root
+
+- mount -o remount,ro /
+
+- reboot -d -f (exec /sbin/init should work)
+
+LILO:
+
+- Linux init=/bin/sh at the end of LILO boot prompt (hold shift while
+ booting)
+
+- other steps are the same
+
+YABOOT:
+
+- Linux init=/bin/sh at yaboot prompt
