From 02abf4ed0131237c25e0a10db50fa4c41a902a50 Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Sun, 14 Jul 2024 17:53:13 -0600
Subject: sys: final merge of dmz, hv into sys

---
 sys/boot/stack/btrfs-toplevel-multidrive.nix      | 94 ++++++++++++++++++++++
 sys/boot/stack/default.nix                        |  6 ++
 sys/boot/stack/luks-ext4-fscrypt-impermanence.nix | 96 +++++++++++++++++++++++
 3 files changed, 196 insertions(+)
 create mode 100644 sys/boot/stack/btrfs-toplevel-multidrive.nix
 create mode 100644 sys/boot/stack/default.nix
 create mode 100644 sys/boot/stack/luks-ext4-fscrypt-impermanence.nix

(limited to 'sys/boot/stack')

diff --git a/sys/boot/stack/btrfs-toplevel-multidrive.nix b/sys/boot/stack/btrfs-toplevel-multidrive.nix
new file mode 100644
index 0000000..1dbfa14
--- /dev/null
+++ b/sys/boot/stack/btrfs-toplevel-multidrive.nix
@@ -0,0 +1,94 @@
+{ config, lib, ... }:
+with lib; let
+  cfg = config.local.boot.stack.btrfsToplevelMultidrive;
+in
+{
+  options.local.boot.stack.btrfsToplevelMultidrive = {
+    enable = mkEnableOption "filesystem stack: persistent btrfs toplevel with optional hdd drive";
+
+    toplevel = {
+      device = mkOption {
+        type = types.str;
+      };
+
+      ssd = mkOption {
+        type = types.bool;
+      };
+
+      snapshot = mkOption {
+        type = types.bool;
+        default = false;
+      };
+
+      root = mkOption {
+        type = types.str;
+      };
+
+      pivot = mkOption {
+        type = types.str;
+        default = "/";
+      };
+    };
+
+    secondary = {
+      device = mkOption {
+        type = types.str;
+      };
+
+      ssd = mkOption {
+        type = types.bool;
+      };
+
+      snapshot = mkOption {
+        type = types.bool;
+        default = false;
+      };
+
+      home = mkOption {
+        type = types.str;
+      };
+
+      pivot = mkOption {
+        type = types.str;
+        default = "/";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    local.btrfs = {
+      mounts = {
+        "/" = {
+          inherit (cfg.toplevel) device ssd;
+          subvol = cfg.toplevel.root;
+        };
+
+        "/toplevel" = {
+          inherit (cfg.toplevel) device ssd;
+          subvol = cfg.toplevel.pivot;
+        };
+
+        #FIXME: Este nombre es legacy
+        "/hdd" = {
+          inherit (cfg.secondary) device ssd;
+          subvol = cfg.secondary.pivot;
+        };
+
+        "/home" = {
+          inherit (cfg.secondary) device ssd;
+          subvol = cfg.secondary.home;
+        };
+      };
+
+      snapper = optionalAttrs cfg.toplevel.snapshot
+        {
+          root = "/";
+        } // optionalAttrs cfg.secondary.snapshot {
+        home = "/home";
+      };
+    };
+
+    # Asegura que /hdd sea descifrado antes de intentar montar /home
+    fileSystems."/home".depends = [ "/hdd" ];
+  };
+}
diff --git a/sys/boot/stack/default.nix b/sys/boot/stack/default.nix
new file mode 100644
index 0000000..ff211e6
--- /dev/null
+++ b/sys/boot/stack/default.nix
@@ -0,0 +1,6 @@
+{
+  imports = [
+    ./btrfs-toplevel-multidrive.nix
+    ./luks-ext4-fscrypt-impermanence.nix
+  ];
+}
diff --git a/sys/boot/stack/luks-ext4-fscrypt-impermanence.nix b/sys/boot/stack/luks-ext4-fscrypt-impermanence.nix
new file mode 100644
index 0000000..72336d6
--- /dev/null
+++ b/sys/boot/stack/luks-ext4-fscrypt-impermanence.nix
@@ -0,0 +1,96 @@
+{ config, lib, pkgs, ... }:
+with lib; let
+  cfg = config.local.boot.stack.luksExt4FscryptImpermanence;
+in
+{
+  options.local.boot.stack.luksExt4FscryptImpermanence = {
+    enable = mkEnableOption "filesystem stack: whatever LUKS approach+ext4+impermanence with per-boot keys";
+
+    target = mkOption {
+      type = types.str;
+    };
+  };
+
+  # - boot device
+  #   - some unknown fs, probably vfat
+  #     - detached luks header file
+  #
+  # - toplevel device
+  #   - headerless luks
+  #     - /toplevel (ext4)
+  #       - /toplevel/nix
+  #       - /toplevel/persist
+  #       - /toplevel/boot-archive.pub
+  #       - /toplevel/boot-keys
+  #         - /toplevel/boot-keys/2000-01-01T00:00:00-06:00.key.crypt (encrypted for /toplevel/boot-archive.pub)
+  #         - /toplevel/boot-keys/...
+  #         - /toplevel/boot-keys/last.key.crypt -> 2000-01-01T00:00:00-06:00.key.crypt
+  #       - /toplevel/boots
+  #         - /toplevel/boots/2000-01-01T00:00:00-06:00 (raw protector in last.key.crypt)
+  #         - /toplevel/boots/...
+  #         - /toplevel/boots/last -> 2000-01-01T00:00:00-06:00 (mounted as /)
+  config = mkIf cfg.enable {
+    boot.initrd.luks.devices.${cfg.target}.postOpenCommands =
+      let
+        fscryptctl = "${pkgs.fscryptctl}/bin/fscryptctl";
+      in
+      ''
+        # FIXME: posiblemente algunos --make-* son innecesarios a partir de aquí
+        mkdir -p /mnt-root /mnt-toplevel
+        mount -o noatime /dev/mapper/${cfg.target} /mnt-toplevel
+        mount --make-private /mnt-toplevel
+
+        boot_stamp="$(date -Is)"
+        root_from_toplevel="/mnt-toplevel/boots/$boot_stamp"
+
+        mkdir -p "$root_from_toplevel" /mnt-toplevel/boot-keys
+        chmod 700 /mnt-toplevel/boot-keys
+
+        head -c64 /dev/urandom >/boot-key
+        key_id=$(${fscryptctl} add_key /mnt-toplevel </boot-key)
+        ${fscryptctl} set_policy "$key_id" "$root_from_toplevel"
+        (umask 077; test -f /mnt-toplevel/boot-archive.pub && \
+          ${pkgs.openssl}/bin/openssl pkeyutl -encrypt \
+          -in /boot-key -pubin -inkey /mnt-toplevel/boot-archive.pub \
+          -out "/mnt-toplevel/boot-keys/$boot_stamp.key.crypt")
+        rm -f /boot-key
+
+        ln -Tsf "$boot_stamp" /mnt-toplevel/boots/last
+        ln -Tsf "$boot_stamp.key.crypt" /mnt-toplevel/boot-keys/last.key.crypt
+
+        mount --bind "$root_from_toplevel" /mnt-root
+        mount --make-shared /mnt-root
+
+        # mount --move es mala idea, ya que "moving a mount residing under a
+        # shared mount is unsupported"
+        mkdir -p /mnt-root/toplevel
+        mount --bind /mnt-toplevel /mnt-root/toplevel
+        mount --make-private /mnt-root/toplevel
+        umount /mnt-toplevel
+      '';
+
+    fileSystems = {
+      "/" = {
+        device = "none";
+        fsType = "ext4";
+        options = [ "remount" ];
+      };
+
+      "/nix" = {
+        device = "/persist/nix";
+        options = [ "bind" ];
+      };
+
+      "/persist" = {
+        device = "/toplevel/persist";
+        options = [ "bind" ];
+        neededForBoot = true;
+      };
+    };
+
+    local.boot = {
+      fscrypt.enable = true;
+      impermanence.enable = true;
+    };
+  };
+}
-- 
cgit v1.2.3