From 3914a29e0c2a83a66cbbea4903afa86bad78f059 Mon Sep 17 00:00:00 2001 From: Simon Gardling Date: Tue, 2 Dec 2025 00:56:44 -0500 Subject: [PATCH] persistent: streamline installation process with persistent.tar --- install.sh | 35 ++++++++++++++++++++++++++++++++--- secrets/persistent.tar | Bin 0 -> 4702 bytes 2 files changed, 32 insertions(+), 3 deletions(-) create mode 100644 secrets/persistent.tar diff --git a/install.sh b/install.sh index 4ce0ac2..384f6c2 100755 --- a/install.sh +++ b/install.sh @@ -18,13 +18,15 @@ fi echo "Installing NixOS to $DISK using flake at $FLAKE_DIR" -# Create temporary directory for secureboot keys +# Create temporary directories mkdir -p /tmp/secureboot +mkdir -p /tmp/persistent # Function to cleanup on exit cleanup() { echo "Cleaning up..." rm -rf /tmp/secureboot 2>/dev/null || true + rm -rf /tmp/persistent 2>/dev/null || true } trap cleanup EXIT @@ -40,6 +42,15 @@ nix-shell -p age --run "age -d -i '$FLAKE_DIR/usb-secrets/usb-secrets-key' '$FLA echo "Secureboot keys extracted" +# Extract persistent partition secrets +echo "Extracting persistent partition contents..." +if [[ -f "$FLAKE_DIR/secrets/persistent.tar" ]]; then + tar -xzf "$FLAKE_DIR/secrets/persistent.tar" -C /tmp/persistent + echo "Persistent partition contents extracted" +else + echo "Warning: persistent.tar not found, skipping persistent secrets" +fi + # Check if disko-install is available if ! command -v disko-install >/dev/null 2>&1; then echo "Running disko-install via nix..." @@ -50,10 +61,28 @@ fi echo "Running disko-install to partition, format, and install NixOS..." +# Build the extra-files arguments +EXTRA_FILES_ARGS=( + --extra-files /tmp/secureboot /etc/secureboot + --extra-files "$FLAKE_DIR/usb-secrets/usb-secrets-key" /mnt/usb-secrets/usb-secrets-key +) + +# Add each top-level item from persistent separately to avoid nesting +# cp -ar creates /dst/src when copying directories, so we need to copy each item +# +# Also disko-install actually copies the files from extra-files, so we are good here +if [[ -d /tmp/persistent ]] && [[ -n "$(ls -A /tmp/persistent 2>/dev/null)" ]]; then + for item in /tmp/persistent/*; do + if [[ -e "$item" ]]; then + basename=$(basename "$item") + EXTRA_FILES_ARGS+=(--extra-files "$item" "/persistent/$basename") + fi + done +fi + # Run disko-install with secureboot keys available sudo $DISKO_INSTALL \ --mode format \ --flake "$FLAKE_DIR#muffin" \ --disk main "$DISK" \ - --extra-files /tmp/secureboot /etc/secureboot \ - --extra-files "$FLAKE_DIR/usb-secrets/usb-secrets-key" /mnt/usb-secrets/usb-secrets-key + "${EXTRA_FILES_ARGS[@]}" diff --git a/secrets/persistent.tar b/secrets/persistent.tar new file mode 100644 index 0000000000000000000000000000000000000000..aa191e5b4d31c39e0840532b4a65adfd07546e3d GIT binary patch literal 4702 zcmZQ@_Y83kiVO&0;CD^w|L{OqHzV*{#EBU~v+tj&dZ?j#Lg7Y0)HKPvCmhTk81SE+ z=;Y70BRuJlzxHJFK4JUon|voa^n}^!YpE_+_=;`b&7#uX{nDrE*36pwdzHZJaMPKd zfB(-7T75q+kYTgrD)SjVl6$3phZ}EyK1cXs9gF?_9#N0|}szsYz_`034QciDuWc!YmS=-*Z+!nt4l*}8?{N!vm*gOg`WPxvc) zCgPNGt7e17&H~kkvpZ@`vQ8*|n=LE(Z_&K1ISKQXtm?9yY;+l4h_&sG(ondfsB_0= zWwp0T+p?ts>HhD!@81j&**Mk1xZ%oj$vbS@j&InM|M^pa@b((R$m# zo!2;3qVNR!9*fDf??3!t<-5M@?ZjnQ=CqsL{d_9?%oTB`Jyr#6Nzo4Cyy)n9+n}udxQJ6mL~Lsm-*f4cC%yw0Gu$GtS4%4)5idbZF0vzg<;trfgg{mCxQ~i};_`*;Yxc zQQr$*+ev=bZ9H*L#&XuNyHn53&kNrnJlAsC@qe<-iyuBwoPSwgx%ttZgp+Hk*C|9s zeRxp1!ejq&jY;idYlF?LJX6G~f3hy_epI>5(#gzzxh6YHmf`HT+RP11C)VBYxIg7c z=9hHajWxzMdGBX^OKr^HXXm=h_h@VKWHBkDD*?@oMJbj{yvKV|6CTQ*4{9&@;#nYk zc(X$2)!p_HXHR;psB4u=xv+qhr|11!{nPvH*7sZ#VB4=ATl~Zvpd0Iut)iA@edrmnzBp69@Ox$+u{hB+M_RX5S=j`Q3-lN?- zD`$F4um02I^nB;0Yeghh-{ zZteZA5>IYw&tI*+Ghx%I*7tloELu;eRLOTUF*^7CU&eot)JvncBz0x1HX7;Om)v4;TOQKk0l}p)yuT;a}psjQY8a z9Wh5(&V7@-lKaht-QibP2W$Mz8F6=#SeFTYntR?bwsfx6Zm~@98FTNpbMoagb=O|E zd$4+4+QjPEy-PlKW^Al9PMd7$*7RLBKKX}*@vm)~wOf6wds;XCD7*UJIm)r>$E4?h zsj-fm6|cFNc&BVX?BU*;x#20#viFr=Yu~wqt(D&S<8V+%oN3hiUCZ9xUg^~yd|E|c zE#LO&!pg$g%C|k&$xq^5^p08nSDQiT*}osn=A|v%>XzF2p>D^y*|P7~-OgAZc0Bb( zW?7W{MBm`BP4g01ZMmYX#b>kBdMy?1dL6-fzR6?C%cyY2&brd2;d{^j)%)=Keu`^i z<-aeB^+ZHoKQLb!5Vdd9UDy5h_;lW}y2<{}JZd3r`s9MVN3Ge<^jw`j-3dnN8JSmv zW-*<-D;NGn*8iW;@~I{l_N}n8ja7P3TM<$q>$mRV6wSZ(fBA*?O10`Ok=*Rl zX^(ib}uY!Q)PjHAM5=ahmSf0E@!*!I(@zCV-xXZ&)p2=QqNs-j{KnX_ovrw-f1G$<#RPl zV)EwS<7D5^{IfZrIrFQ`>F4t~nEY4UOzqxK_xyCfRlK{|<{6P6el6a7zAL!b;z@`? z&GLU-e5a~S)59MLc26d0?m?d>05Sp2&BNayE?-fgO{ zUmiX9*o|-QCUHe~w};^+Dn0Ud@))F&atuCyu-hf{x^lT~P*CWS$=lKWXWmu}{KCd7Q%!2{n9``PJt72DO^)>Bzg9$Ogx@WRj6Uuy;4%re%M z_3v-lGU+6r?Zvx?)n?zGaZmdG@+piKEm2~}blevHTfR%9>l)96QzjoZ=KNRFvtTHi z`DIdi`hqm+BW4@BpLjS#E>&(TxV&ukK7ov*R%d3Kv`_0O+A_O6W{#X?hm=_Uo3s*(Z!cyJa8A zp7N}CQQp42A<_2JU)Ez%o^Fvl->UY?^9dy^Y_ho5xAo%52O8)1GF<4~z2j%Z7mM&K z4L_Z_cYe9WsG}r%zN(;T2hX9s-=FQNX1rU!z?9#Y?f1ELmwx8kTvkoJvqwMWmiZ>F zL|KuCQzl72mX-f|P=xokhT%lLlQT}tQJf#LyKdLlm=}cdeS7p;L6-HD+64ImV%H7V;O?;Soi)dH?9_aF@{gD1^}5Mw%LHwwIB>aMP*y8c zJ{M4$`r(!2t`!qLt$UgFXWP@{h8r=_PfD9ax3Bn6clO=fnJ;ZP?_K$noqsi2OZc;& zEt{opq$=mcSM`p|E4(MqE=kldf9|>|qQ)67xG=@Mm4VOu@{E0|8mD z1isz!7p-cjIvZa8QnK~S(y0pqf?6xqoc+JM((&N7I*q?iQ~po?Q7vR4?C{6>QLTAs zucUl^lkEk5&)LQIt zYHow04Aayl4kxy9{NT=B`sZd&T>Z)h%Uz4DTYhP?ZGXgATb|`OrTp=%U0RjLKhAG^ zaPOwezlUwxzaOd1?a^W^dw3&t^WMW}zn<-%R&SFhr?b~s{PeuA^6MGP-g0kO*SG30 zKN73?J4d{i|K0N3JDN9aFJE26uJ9tUVb0``<*R?!mMdzzvu@H8JpS=OU0-n#x5%Q* z&7CuBwfz&NV&5Kp?a$P;?m@1%a8}vE+f!tpv3GgS?7l2kfAB~VSNJJW``uRq(pKK` zcptFmzwR!_$){H)wqz_n?|*l9aO8Xo>r6Ythjq4m7HRrV6a~d!=sn)BGwB^m&55#m zjZ1dS%IxShdofSo_|%EhuKkwap5I-QK5=zW;>%Q?f2-YZuIE;|YWiT!X2GqOZ|(3< z|Lz=K!e4DSCo|NS^w=34aQO1#cPGyz-uJ59S|rLo zfkpAqeb&u_fr~6^dPT#ti$mOG-S>RZGud*L?Zb5KM=8!B?lTuoXx?-{NjXWq^^Ss)`gcTJUm?cZxG zyX!88{n?Oz&E;OsDc|Q^hXa>?opJv&%a12VC5`VabC#A$;uGOduXg%zKv({({A!&9 z!RnqrcBiYpd^zu<<;-zvgV9!Jy{EHYTi)t%nzLAV*~cR>PwPVE{r<$??9T7ICL+SE zqii^>pl|89v@IU-a~qa=%w?YSaz|O-M3vWf)$=X=_*=~aERUC@ZJ$xh%_--VxS`=% z58sKpSEl#p>CM3#(ph{CPVyp)TswBF5&OJ7(6- zvCREBWnE^hO@5wrx$fzxU_O8AsYefn_Lgq8u=w2+`bH_jd|8CW^yJw5b$ex#%Ca`U zy62Mly-_S{{UeQ48|9vJa)%Vk+}huHobS+`TuZBYf5f`|yw|6iiNL9jiv+bpu`V$YrFvN7=r#?Q7(?>+d>WMOmC#@HWk9u{}r%Jh92cwUxm z*@n0SjNe|_Mb-aYd{^LimfCy8$2;DBNo!5JBV@vPF>Q12f*-l&9;$8cwk_#i=`Xoy z3R7g+Hl?|A0fzHLfJ;%;X8AANdvW<*)2VAPb_B;_5UiV5M1TUsuu zMBNSkt2iS*LHux-#)4}cyAqz|Zl7|5X}+%6ipf^SqRmzZ?e6K;Bt;*LI6kQ^`4(S` zrITN?>E{cVugu@gt{hm&(v-ut|xvsfN=El#?Uo1Yy)*qZ5w)J4H?Ydh94RwyI z{QOfn=KRaQyXeA9mI(IZy;u6UN=`3YQ|aroSwLR*VpH%+e!JKUtE?OZi&x_{{+#^NX6l|CBOX1A?AY@yzH zX3@pqGcrrHYqTdmvOiSVSnmETnWb-&@<#QHkXu#jO`R7jv+uen`?1nXKH8so