feat: Add bcachefs support to thinkrac, add installer

.sops.yaml

@@ -22,3 +22,7 @@ creation_rules:
           - *thinkrac
         pgp:
           - *lotte
+  - path_regex: secrets/nixos\.yaml$
+    key_groups:
+      - pgp:
+          - *lotte

config/installer.nix

@@ -0,0 +1,9 @@
+{ pkgs, nixpkgs, ... }: {
+  imports = [
+    ./nix.nix
+    "${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix"
+  ];
+  networking.wireguard.interfaces."wg0".ips = [
+    "fd0d:a262:1fa6:e621:6ec2:1e4e:ce7f:d2af/64"
+  ];
+}

config/thinkrac.nix

@@ -15,7 +15,7 @@
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  boot.supportedFilesystems = [ "zfs" ];
+  boot.supportedFilesystems = [ "zfs" "bcachefs" ];
   boot.zfs.devNodes = "/dev/";
 
   services.zfs.trim.enable = true;
@@ -115,7 +115,7 @@
   nix.settings.cores = 4;
 
   # Disable kernel mitigations
-  # 
+  #
   # Rationale:
   # - device has a limited workload, consisting mostly of running trusted code and visiting trusted websites with an advertisement blocker
   # - device is battery powered (we want to spend more time in an idle state, as opposed to running user code or mitigating cpu bugs)

flake.nix

@@ -40,6 +40,10 @@ rec {
           name = "thinkrac"; # Thinkpad T470
           system = "x86_64-linux";
         }
+        {
+          name = "installer"; # The Installer DVD
+          system = "x86_64-linux";
+        }
         #{
         #  name = "rpi2"; # Raspberry Pi 2
         #  system = "armv7l-linux";
@@ -77,14 +81,15 @@ rec {
               };
           })
           systems);
-      hydraJobs = builtins.listToAttrs (map
+      hydraJobs = (builtins.listToAttrs (map
         ({ name, system }: {
           inherit name;
           value = {
             ${system} = nixosConfigurations.${name}.config.system.build.toplevel;
           };
         })
-        systems);
+        systems)) // {
+          installer.x86_64-linux = nixosConfigurations.installer.config.system.build.isoImage;
+        };
     };
 }
-

secrets/nixos.yaml

@@ -0,0 +1,22 @@
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2022-03-22T07:34:53Z"
+    mac: ENC[AES256_GCM,data:qexpKWUoslqtVRGIfIgUNGWKdR8bfaJoJAgycj2z2U/qFFB2i5B+9GQlMzY3gbgeScYS/+8qaJ29cU0W39o0dMkWr6JWNuFWmQN0SQJdbGlXHa5OTr87JXUJyoj3Y8nrhFmQI780ecYD9sFotJU+ZzTUMaSSHXusaBMidHzBipo=,iv:UD76d/a45b2nnfC0tQ/yBNRVLptAe2Z1g+ThEL0hMR8=,tag:PKDVfhVXORc7QknOPj1+Ww==,type:str]
+    pgp:
+        - created_at: "2022-03-22T07:34:36Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hF4DAAAAAAAAAAASAQdA2E+ZwHuCKAkxXgL5wDg08EYF3SEpbOcdgUr9jmXSSSMw
+            GNMd9bl08fTkiX74AInsAChM5E4tvkQCKOlpEkgw3i6277eDn9jzhL89avauln/E
+            0l4BaoeadgLGHA78dKYOZ1HPma3XT+mcEE8oW/owJ6F7MbzEBVe1zVu9kZ+YNBi8
+            kgMFzQD/gSUxJn/2ESl+EwdumrQ6zKsRPkVfVwU3nHVLpVu7OTTjaRBsurJdujqq
+            =/k/Q
+            -----END PGP MESSAGE-----
+          fp: 46C6A7E14BC7812E86C2700737FE303AAC2D06CD
+    unencrypted_suffix: _unencrypted
+    version: 3.7.1