nixos-images/nix/kexec-installer/module.nix

{ config, lib, modulesPath, pkgs, ... }:
let
  restore-network = pkgs.writers.writePython3 "restore-network" {
    flakeIgnore = ["E501"];
  } ./restore_routes.py;

  # does not link with iptables enabled
  iprouteStatic = pkgs.pkgsStatic.iproute2.override { iptables = null; };
in {
  imports = [
    (modulesPath + "/installer/netboot/netboot-minimal.nix")
  ];
  options = {
    system.kexec-installer.name = lib.mkOption {
      type = lib.types.str;
      default = "nixos-kexec-installer";
      description = ''
        The variant of the kexec installer to use.
      '';
    };
  };

  config = {
    # We are stateless, so just default to latest.
    system.stateVersion = config.system.nixos.version;

    # use latest kernel we can support to get more hardware support
    boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;

    # This is a variant of the upstream kexecScript that also allows embedding
    # a ssh key.
    system.build.kexecRun = pkgs.runCommand "kexec-run" {} ''
      install -D -m 0755 ${./kexec-run.sh} $out

      sed -i \
        -e 's|@init@|${config.system.build.toplevel}/init|' \
        -e 's|@kernelParams@|${lib.escapeShellArgs config.boot.kernelParams}|' \
        $out

      ${pkgs.shellcheck}/bin/shellcheck $out
    '';

    system.build.kexecTarball = pkgs.runCommand "kexec-tarball" {} ''
      mkdir kexec $out
      cp "${config.system.build.netbootRamdisk}/initrd" kexec/initrd
      cp "${config.system.build.kernel}/${config.system.boot.loader.kernelFile}" kexec/bzImage
      cp "${config.system.build.kexecRun}" kexec/run
      cp "${pkgs.pkgsStatic.kexec-tools}/bin/kexec" kexec/kexec
      cp "${iprouteStatic}/bin/ip" kexec/ip
      ${lib.optionalString (pkgs.hostPlatform == pkgs.buildPlatform) ''
        kexec/ip -V
        kexec/kexec --version
      ''}
      tar -czvf $out/${config.system.kexec-installer.name}-${pkgs.stdenv.hostPlatform.system}.tar.gz kexec
    '';

    # IPMI SOL console redirection stuff
    boot.kernelParams =
      [ "console=tty0" ] ++
      (lib.optional (pkgs.stdenv.hostPlatform.isAarch32 || pkgs.stdenv.hostPlatform.isAarch64) "console=ttyAMA0,115200") ++
      (lib.optional (pkgs.stdenv.hostPlatform.isRiscV) "console=ttySIF0,115200") ++
      [ "console=ttyS0,115200" ];

    documentation.enable = false;
    # Not really needed. Saves a few bytes and the only service we are running is sshd, which we want to be reachable.
    networking.firewall.enable = false;

    systemd.network.enable = true;
    networking.dhcpcd.enable = false;

    # for detection if we are on kexec
    environment.etc.is_kexec.text = "true";

    # for zapping of disko
    environment.systemPackages = [
      pkgs.jq
    ];

    systemd.services.restore-network = {
      before = [ "network-pre.target" ];
      wants = [ "network-pre.target" ];
      wantedBy = [ "multi-user.target" ];

      serviceConfig = {
        Type = "oneshot";
        RemainAfterExit = true;
        ExecStart = [
          "${restore-network} /root/network/addrs.json /root/network/routes-v4.json /root/network/routes-v6.json /etc/systemd/network"
        ];
      };

      unitConfig.ConditionPathExists = [
        "/root/network/addrs.json"
        "/root/network/routes-v4.json"
        "/root/network/routes-v6.json"
      ];
    };

    systemd.services.log-network-status = {
      wantedBy = [ "multi-user.target" ];
      # No point in restarting this. We just need this after boot
      restartIfChanged = false;

      serviceConfig = {
        Type = "oneshot";
        StandardOutput = "journal+console";
        ExecStart = [
          # Allow failures, so it still prints what interfaces we have even if we
          # not get online
          "-${pkgs.systemd}/lib/systemd/systemd-networkd-wait-online"
          "${pkgs.iproute2}/bin/ip -c addr"
          "${pkgs.iproute2}/bin/ip -c -6 route"
          "${pkgs.iproute2}/bin/ip -c -4 route"
        ];
      };
    };

    # Restore ssh host and user keys if they are available.
    # This avoids warnings of unknown ssh keys.
    boot.initrd.postMountCommands = ''
      mkdir -m 700 -p /mnt-root/root/.ssh
      mkdir -m 755 -p /mnt-root/etc/ssh
      mkdir -m 755 -p /mnt-root/root/network
      if [[ -f ssh/authorized_keys ]]; then
        install -m 400 ssh/authorized_keys /mnt-root/root/.ssh
      fi
      install -m 400 ssh/ssh_host_* /mnt-root/etc/ssh
      cp *.json /mnt-root/root/network/
    '';
  };
}