feat: add riscv64-linux image

Flake lock file updates:

• Updated input 'nixos-stable':
    'github:NixOS/nixpkgs/c0b1da36f7c34a7146501f684e9ebdf15d2bebf8?narHash=sha256-WLxED18lodtQiayIPDE5zwAfkPJSjHJ35UhZ8h3cJUg%3D' (2024-10-14)
  → 'github:NixOS/nixpkgs/4eb33fe664af7b41a4c446f87d20c9a0a6321fa3?narHash=sha256-LDiPhQ3l%2BfBjRATNtnuDZsBS7hqoBtPkKBkhpoBHv3I%3D' (2024-10-17)
• Updated input 'nixos-unstable':
    'github:NixOS/nixpkgs/8f1d45587bd9af3dbf5146aa8a1347e20421597b?narHash=sha256-6sIuRVqVMHq9ZwcEVdpf2BuZeuLIUgvFznhIfsc75Jo%3D' (2024-10-16)
  → 'github:NixOS/nixpkgs/e3f55158e7587c5a5fdb0e86eb7ca4f455f0928f?narHash=sha256-3GNZr0V4b19RZ5mlyiY/4F8N2pzitvjDU6aHMWjAqLI%3D' (2024-10-20)

.github/workflows/build.yml

@@ -11,7 +11,7 @@ jobs:
       fail-fast: false
       matrix:
         tag:
-          - nixos-23.11
+          - nixos-24.05
           - nixos-unstable
         os:
           - nscloud-ubuntu-22.04-arm64-4x16
@@ -19,7 +19,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - uses: actions/checkout@v4
-    - uses: cachix/install-nix-action@v26
+    - uses: cachix/install-nix-action@v30
       with:
         nix_path: nixpkgs=https://github.com/NixOS/nixpkgs/archive/nixpkgs-unstable.tar.gz
     - name: Build image

.github/workflows/update-flake-lock.yml

@@ -11,9 +11,9 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
       - name: Install Nix
-        uses: cachix/install-nix-action@v26
+        uses: cachix/install-nix-action@v30
       - name: Update flake.lock
-        uses: DeterminateSystems/update-flake-lock@v21
+        uses: DeterminateSystems/update-flake-lock@v24
         with:
           pr-labels: |
             merge-queue

.mergify.yml

@@ -1,7 +1,7 @@
 queue_rules:
   - name: default
     merge_conditions:
-      - check-success=buildbot/nix-eval
+      - check-success=buildbot/nix-build
 defaults:
   actions:
     queue:

README.md

@@ -11,10 +11,10 @@ Kexec is a mechanism in Linux to load a new kernel from a running Linux to
 replace the current kernel. This is useful for booting the Nixos installer from
 existing Linux distributions, such as server provider that do not offer a NixOS
 option. After running kexec, the NixOS installer exists only in memory. At the
-time of writing, this requires at least 1GB of physical RAM (swap does not
-count) in the system. If not enough RAM is available, the initrd cannot be
-loaded. Because the NixOS runs only in RAM, users can reformat all the system's
-discs to prepare for a new NixOS installation.
+time of writing, this requires secure boot off in BIOS settings and at least 1GB
+of physical RAM (swap does not count) in the system. If not enough RAM is available,
+the initrd cannot be loaded. Because the NixOS runs only in RAM, users can reformat
+all the system's discs to prepare for a new NixOS installation.
 
 It can be booted as follows by running these commands as root:
 

build-images.sh

@@ -5,8 +5,8 @@ set -xeuo pipefail
 shopt -s lastpipe
 
 build_netboot_image() {
-  declare -r tag=$1 arch=$2 tmp=$3
-  img=$(nix build --print-out-paths --option accept-flake-config true -L ".#packages.${arch}.netboot-${tag//./}")
+  declare -r tag=$1 channel=$2 arch=$3 tmp=$4
+  img=$(nix build --print-out-paths --option accept-flake-config true -L ".#packages.${arch}.netboot-nixos-${channel//./}")
   kernel=$(echo "$img"/*Image)
   kernelName=$(basename "$kernel")
   ln -s "$kernel" "$tmp/$kernelName-$arch"
@@ -22,14 +22,14 @@ build_netboot_image() {
 }
 
 build_kexec_installer() {
-  declare -r tag=$1 arch=$2 tmp=$3 variant=$4
-  out=$(nix build --print-out-paths --option accept-flake-config true -L ".#packages.${arch}.kexec-installer-${tag//./}${variant}")
+  declare -r channel=$1 arch=$2 tmp=$3 variant=$4
+  out=$(nix build --print-out-paths --option accept-flake-config true -L ".#packages.${arch}.kexec-installer-nixos-${channel}${variant}")
   echo "$out/nixos-kexec-installer${variant}-$arch.tar.gz"
 }
 
 build_image_installer() {
-  declare -r tag=$1 arch=$2 tmp=$3
-  out=$(nix build --print-out-paths --option accept-flake-config true -L ".#packages.${arch}.image-installer-${tag//./}")
+  declare -r channel=$1 arch=$2 tmp=$3
+  out=$(nix build --print-out-paths --option accept-flake-config true -L ".#packages.${arch}.image-installer-nixos-${channel//./}")
   echo "$out/iso/nixos-installer-${arch}.iso"
 }
 
@@ -38,10 +38,11 @@ main() {
   tmp="$(mktemp -d)"
   trap 'rm -rf -- "$tmp"' EXIT
   (
-    build_kexec_installer "$tag" "$arch" "$tmp" ""
-    build_kexec_installer "$tag" "$arch" "$tmp" "-noninteractive"
-    build_netboot_image "$tag" "$arch" "$tmp"
-    build_image_installer "$tag" "$arch" "$tmp"
+    channel=$(if [[ "$tag" == nixos-unstable ]]; then echo "unstable"; else echo "stable"; fi)
+    build_kexec_installer "$channel" "$arch" "$tmp" ""
+    build_kexec_installer "$channel" "$arch" "$tmp" "-noninteractive"
+    build_netboot_image "$tag" "$channel" "$arch" "$tmp"
+    build_image_installer "$channel" "$arch" "$tmp"
   ) | readarray -t assets
   for asset in "${assets[@]}"; do
     pushd "$(dirname "$asset")"

flake.lock

@@ -1,28 +1,28 @@
 {
   "nodes": {
-    "nixos-2311": {
+    "nixos-stable": {
       "locked": {
-        "lastModified": 1715818734,
-        "narHash": "sha256-WvAJWCwPj/6quKcsgsvQYyZRxV8ho/yUzj0HZQ34DVU=",
+        "lastModified": 1729181673,
+        "narHash": "sha256-LDiPhQ3l+fBjRATNtnuDZsBS7hqoBtPkKBkhpoBHv3I=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "95742536dc6debb5a8b8b78b27001c38f369f1e7",
+        "rev": "4eb33fe664af7b41a4c446f87d20c9a0a6321fa3",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "release-23.11",
+        "ref": "nixos-24.05",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixos-unstable": {
       "locked": {
-        "lastModified": 1715777523,
-        "narHash": "sha256-S6g1OWbKXswOMoTssq3aOm4OhxhlKoIwEAXWmU57vts=",
+        "lastModified": 1729450260,
+        "narHash": "sha256-3GNZr0V4b19RZ5mlyiY/4F8N2pzitvjDU6aHMWjAqLI=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c029b7f004009923bbfc90bbc31263cd4b08759f",
+        "rev": "e3f55158e7587c5a5fdb0e86eb7ca4f455f0928f",
         "type": "github"
       },
       "original": {
@@ -34,7 +34,7 @@
     },
     "root": {
       "inputs": {
-        "nixos-2311": "nixos-2311",
+        "nixos-stable": "nixos-stable",
         "nixos-unstable": "nixos-unstable"
       }
     }

flake.nix

@@ -2,48 +2,51 @@
   description = "NixOS images";
 
   inputs.nixos-unstable.url = "github:NixOS/nixpkgs/nixos-unstable-small";
-  inputs.nixos-2311.url = "github:NixOS/nixpkgs/release-23.11";
+  inputs.nixos-stable.url = "github:NixOS/nixpkgs/nixos-24.05";
 
-  nixConfig.extra-substituters = [ "https://numtide.cachix.org" ];
-  nixConfig.extra-trusted-public-keys = [ "numtide.cachix.org-1:2ps1kLBUWjxIneOy1Ik6cQjb41X0iXVXeHigGmycPPE=" ];
+  nixConfig.extra-substituters = [ "https://nix-community.cachix.org" ];
+  nixConfig.extra-trusted-public-keys = [ "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" ];
 
-  outputs = { self, nixos-unstable, nixos-2311 }:
+  outputs = { self, nixos-unstable, nixos-stable }:
     let
-      supportedSystems = [ "aarch64-linux" "x86_64-linux" ];
+      supportedSystems = [ "riscv64-linux" ];
       forAllSystems = nixos-unstable.lib.genAttrs supportedSystems;
     in
     {
+      hydraJobs = { inherit (self) checks; };
       packages = forAllSystems (system:
         let
           netboot = nixpkgs: (import (nixpkgs + "/nixos/release.nix") { }).netboot.${system};
-          kexec-installer = nixpkgs: modules: (nixpkgs.legacyPackages.${system}.nixos (modules ++ [ self.nixosModules.kexec-installer ])).config.system.build.kexecTarball;
+          kexec-installer = nixpkgs: module: (nixpkgs.legacyPackages.${system}.nixos [ module self.nixosModules.kexec-installer ]).config.system.build.kexecTarball;
           netboot-installer = nixpkgs: (nixpkgs.legacyPackages.${system}.nixos [ self.nixosModules.netboot-installer ]).config.system.build.netboot;
           image-installer = nixpkgs: (nixpkgs.legacyPackages.${system}.nixos [ self.nixosModules.image-installer ]).config.system.build.isoImage;
         in
         {
           netboot-nixos-unstable = netboot nixos-unstable;
-          netboot-nixos-2311 = netboot nixos-2311;
-          kexec-installer-nixos-unstable = kexec-installer nixos-unstable [ ];
-          kexec-installer-nixos-2311 = kexec-installer nixos-2311 [ ];
+          netboot-nixos-stable = netboot nixos-stable;
+          kexec-installer-nixos-unstable = kexec-installer nixos-unstable {};
+          kexec-installer-nixos-stable = kexec-installer nixos-stable {};
 
           image-installer-nixos-unstable = image-installer nixos-unstable;
-          image-installer-nixos-2311 = image-installer nixos-2311;
+          image-installer-nixos-stable = image-installer nixos-stable;
 
-          kexec-installer-nixos-unstable-noninteractive = kexec-installer nixos-unstable [
-            {
-              system.kexec-installer.name = "nixos-kexec-installer-noninteractive";
-            }
-            self.nixosModules.noninteractive
-          ];
-          kexec-installer-nixos-2311-noninteractive = kexec-installer nixos-2311 [
-            {
-              system.kexec-installer.name = "nixos-kexec-installer-noninteractive";
-            }
-            self.nixosModules.noninteractive
-          ];
+          kexec-installer-nixos-unstable-noninteractive = kexec-installer nixos-unstable {
+            _file = __curPos.file;
+            system.kexec-installer.name = "nixos-kexec-installer-noninteractive";
+            imports = [
+              self.nixosModules.noninteractive
+            ];
+          };
+          kexec-installer-nixos-stable-noninteractive = kexec-installer nixos-stable {
+            _file = __curPos.file;
+            system.kexec-installer.name = "nixos-kexec-installer-noninteractive";
+            imports = [
+              self.nixosModules.noninteractive
+            ];
+          };
 
           netboot-installer-nixos-unstable = netboot-installer nixos-unstable;
-          netboot-installer-nixos-2311 = netboot-installer nixos-2311;
+          netboot-installer-nixos-stable = netboot-installer nixos-stable;
         });
       nixosModules = {
         kexec-installer = ./nix/kexec-installer/module.nix;
@@ -58,24 +61,25 @@
           packages = forAllSystems (system: nixos-unstable.lib.mapAttrs' (n: nixos-unstable.lib.nameValuePair "package-${n}") self.packages.${system});
           checks =
             let
-              pkgs = nixos-unstable.legacyPackages.x86_64-linux;
+              pkgsUnstable = nixos-unstable.legacyPackages.riscv64-linux;
+              pkgsStable = nixos-stable.legacyPackages.riscv64-linux;
+
+              bootTests = pkgs: channel: suffix: pkgs.lib.mapAttrs' (name: pkgs.lib.nameValuePair "${name}${suffix}") (pkgs.callPackages ./nix/image-installer/tests.nix {
+                nixpkgs = channel;
+                nixosModules = self.nixosModules;
+              });
             in
             {
-              kexec-installer-unstable = pkgs.callPackage ./nix/kexec-installer/test.nix {
-                kexecTarball = self.packages.x86_64-linux.kexec-installer-nixos-unstable-noninteractive;
+              kexec-installer-unstable = pkgsUnstable.callPackage ./nix/kexec-installer/test.nix {
+                kexecTarball = self.packages.riscv64-linux.kexec-installer-nixos-unstable-noninteractive;
               };
-              shellcheck = pkgs.runCommand "shellcheck"
-                {
-                  nativeBuildInputs = [ pkgs.shellcheck ];
-                } ''
-                shellcheck ${(pkgs.nixos [self.nixosModules.kexec-installer]).config.system.build.kexecRun}
-                touch $out
-              '';
-              kexec-installer-2311 = nixos-2311.legacyPackages.x86_64-linux.callPackage ./nix/kexec-installer/test.nix {
-                kexecTarball = self.packages.x86_64-linux.kexec-installer-nixos-2311-noninteractive;
+
+              kexec-installer-stable = nixos-stable.legacyPackages.riscv64-linux.callPackage ./nix/kexec-installer/test.nix {
+                kexecTarball = self.packages.riscv64-linux.kexec-installer-nixos-stable-noninteractive;
               };
-            };
+            } // (bootTests pkgsUnstable nixos-unstable "-nixos-unstable")
+              // (bootTests pkgsStable nixos-stable "-nixos-stable");
         in
-        nixos-unstable.lib.recursiveUpdate packages { x86_64-linux = checks; };
+        nixos-unstable.lib.recursiveUpdate packages { riscv64-linux = checks; };
     };
 }

garnix.yaml

@@ -1,5 +0,0 @@
-builds:
-  include:
-  - '*.x86_64-linux.*'
-  - '*.aarch64-linux.*'
-  - nixosConfigurations.*

nix/image-installer/module.nix

@@ -40,8 +40,9 @@ in
   imports = [
     (modulesPath + "/installer/cd-dvd/installation-cd-base.nix")
     ../installer.nix
-    ./wifi.nix
+    ../noveau-workaround.nix
     ./hidden-ssh-announcement.nix
+    ./wifi.nix
   ];
   systemd.tmpfiles.rules = [ "d /var/shared 0777 root root - -" ];
   services.openssh.settings.PermitRootLogin = "yes";

nix/image-installer/tests.nix

@@ -0,0 +1,105 @@
+{
+  pkgs,
+  lib,
+  nixpkgs,
+  nixos,
+  nixosModules,
+}:
+
+let
+  testConfig = (
+    nixos [
+      (
+        { modulesPath, ... }:
+        {
+          imports = [
+            nixosModules.image-installer
+            "${modulesPath}/testing/test-instrumentation.nix"
+          ];
+        }
+      )
+    ]
+  );
+  iso = testConfig.config.system.build.isoImage;
+  mkStartCommand =
+    {
+      memory ? 2048,
+      cdrom ? null,
+      usb ? null,
+      uefi ? false,
+      extraFlags ? [ ],
+    }:
+    let
+      qemu-common = import (nixpkgs + "/nixos/lib/qemu-common.nix") { inherit lib pkgs; };
+      qemu = qemu-common.qemuBinary pkgs.qemu_test;
+
+      flags =
+        [
+          "-m"
+          (toString memory)
+          "-netdev"
+          "user,id=net0"
+          "-device"
+          "virtio-net-pci,netdev=net0"
+        ]
+        ++ lib.optionals (cdrom != null) [
+          "-cdrom"
+          cdrom
+        ]
+        ++ lib.optionals (usb != null) [
+          "-device"
+          "usb-ehci"
+          "-drive"
+          "id=usbdisk,file=${usb},if=none,readonly"
+          "-device"
+          "usb-storage,drive=usbdisk"
+        ]
+        ++ lib.optionals uefi [
+          "-drive"
+          "if=pflash,format=raw,unit=0,readonly=on,file=${pkgs.OVMF.firmware}"
+          "-drive"
+          "if=pflash,format=raw,unit=1,readonly=on,file=${pkgs.OVMF.variables}"
+        ]
+        ++ extraFlags;
+
+      flagsStr = lib.concatStringsSep " " flags;
+    in
+    "${qemu} ${flagsStr}";
+
+  makeBootTest =
+    name: config:
+    let
+      startCommand = mkStartCommand config;
+    in
+    pkgs.testers.runNixOSTest {
+      name = "boot-${name}";
+      nodes = { };
+      testScript = ''
+        machine = create_machine("${startCommand}")
+        machine.start()
+        machine.wait_for_unit("multi-user.target")
+        machine.succeed("nix store verify --no-trust -r --option experimental-features nix-command /run/current-system")
+
+        machine.shutdown()
+      '';
+    };
+in
+{
+  uefi-cdrom = makeBootTest "uefi-cdrom" {
+    uefi = true;
+    cdrom = "${iso}/iso/nixos-installer-${pkgs.hostPlatform.system}.iso";
+  };
+
+  uefi-usb = makeBootTest "uefi-usb" {
+    uefi = true;
+    usb = "${iso}/iso/nixos-installer-${pkgs.hostPlatform.system}.iso";
+  };
+
+  bios-cdrom = makeBootTest "bios-cdrom" {
+    cdrom = "${iso}/iso/nixos-installer-${pkgs.hostPlatform.system}.iso";
+  };
+
+  bios-usb = makeBootTest "bios-usb" {
+    usb = "${iso}/iso/nixos-installer-${pkgs.hostPlatform.system}.iso";
+  };
+}

nix/installer.nix

@@ -2,43 +2,42 @@
   config,
   lib,
   pkgs,
-  modulesPath,
   ...
 }:
-let
-  # can be dropped after 23.11 is removed
-  hasPerlless = builtins.pathExists "${modulesPath}/profiles/perlless.nix";
-in
 {
+  imports = [
+#    ./latest-zfs-kernel.nix
+    ./nix-settings.nix
+  ];
   # more descriptive hostname than just "nixos"
   networking.hostName = lib.mkDefault "nixos-installer";
 
   # We are stateless, so just default to latest.
   system.stateVersion = config.system.nixos.version;
 
+  # Enable bcachefs support
+  boot.supportedFilesystems.bcachefs = lib.mkDefault true;
+
   # use latest kernel we can support to get more hardware support
-  boot.kernelPackages =
-    lib.mkDefault
-      (pkgs.zfs.override { removeLinuxDRM = pkgs.hostPlatform.isAarch64; }).latestCompatibleLinuxPackages;
-  boot.zfs.removeLinuxDRM = lib.mkDefault pkgs.hostPlatform.isAarch64;
+#  boot.zfs.package = pkgs.zfsUnstable;
 
   documentation.enable = false;
+  documentation.man.man-db.enable = false;
+
+  # make it easier to debug boot failures
+  boot.initrd.systemd.emergencyAccess = true;
 
   environment.systemPackages = [
+    pkgs.nixos-install-tools
     # for zapping of disko
     pkgs.jq
     # for copying extra files of nixos-anywhere
     pkgs.rsync
-  ];
+    # alternative to nixos-generate-config
+    # TODO: use nixpkgs again after next nixos release
+    (pkgs.callPackage ./nixos-facter.nix {})
 
-  imports = [
-    ./nix-settings.nix
-    # reduce closure size by removing perl
-  ] ++ lib.optionals hasPerlless [
-    "${modulesPath}/profiles/perlless.nix"
-    # We relax the perl check in perlless.nix as not all images are actually perlless
-    # and we also want to allow users to install perl if they need it.
-    { system.forbiddenDependenciesRegexes = lib.mkForce []; }
+    pkgs.disko
   ];
 
   # Don't add nixpkgs to the image to save space, for our intended use case we don't need it

nix/kexec-installer/kexec-run.sh

@@ -1,6 +1,19 @@
 #!/bin/sh
 
 set -ex
+
+kexec_extra_flags=""
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+  --kexec-extra-flags)
+    kexec_extra_flags="$2"
+    shift
+    ;;
+  esac
+  shift
+done
+
 # provided by nix
 init="@init@"
 kernelParams="@kernelParams@"
@@ -65,10 +78,12 @@ if printf "%s\n" "6.1" "$(uname -r)" | sort -c -V 2>&1; then
   kexecSyscallFlags="--kexec-syscall-auto"
 fi
 
-if ! "$SCRIPT_DIR/kexec" --load "$SCRIPT_DIR/bzImage" \
-  "$kexecSyscallFlags" \
-  --initrd="$SCRIPT_DIR/initrd" --no-checks \
-  --command-line "init=$init $kernelParams"; then
+if ! sh -c "'$SCRIPT_DIR/kexec' --load '$SCRIPT_DIR/bzImage' \
+  $kexecSyscallFlags \
+  $kexec_extra_flags \
+  --initrd='$SCRIPT_DIR/initrd' --no-checks \
+  --command-line 'init=$init $kernelParams'"
+then
   echo "kexec failed, dumping dmesg"
   dmesg | tail -n 100
   exit 1
@@ -84,4 +99,4 @@ else
 fi
 # We will kexec in background so we can cleanly finish the script before the hosts go down.
 # This makes integration with tools like terraform easier.
-nohup sh -c "sleep 6 && '$SCRIPT_DIR/kexec' -e" &
+nohup sh -c "sleep 6 && '$SCRIPT_DIR/kexec' -e ${kexec_extra_flags}" &

nix/kexec-installer/local-network-restore-test.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env -S nix shell --inputs-from .# nixos-unstable#bash nixos-unstable#iproute2 nixos-unstable#findutils nixos-unstable#coreutils nixos-unstable#python3 nixos-unstable#jq --command bash
+
+set -eu
+SCRIPT_DIR=$(dirname "$(readlink -f "$0")")
+
+# This script can be used to see what network configuration would be restored by the restore_routes.py script for the current system.
+
+tmp=$(mktemp -d)
+trap "rm -rf $tmp" EXIT
+ip --json address >"$tmp/addrs.json"
+ip -6 --json route >"$tmp/routes-v6.json"
+ip -4 --json route >"$tmp/routes-v4.json"
+python3 "$SCRIPT_DIR/restore_routes.py" "$tmp/addrs.json" "$tmp/routes-v4.json" "$tmp/routes-v6.json" "$tmp"
+ls -la "$tmp"
+
+find "$tmp" -type f -name "*.json" -print0 | while IFS= read -r -d '' file; do
+  echo -e "\033[0;31m$(basename "$file")\033[0m"
+  jq . "$file"
+  echo ""
+done
+
+find "$tmp" -type f -name "*.network" -print0 | while IFS= read -r -d '' file; do
+  echo -e "\033[0;31m$(basename "$file")\033[0m"
+  cat "$file"
+  echo ""
+done

nix/kexec-installer/module.nix

@@ -1,7 +1,14 @@
 { config, lib, modulesPath, pkgs, ... }:
 let
-  restore-network = pkgs.writers.writePython3 "restore-network" { flakeIgnore = [ "E501" ]; }
-    ./restore_routes.py;
+  writePython3 = pkgs.writers.makePythonWriter
+    pkgs.python3Minimal pkgs.python3Packages pkgs.buildPackages.python3Packages;
+
+  # writePython3Bin takes the same arguments as writePython3 but outputs a directory (like writeScriptBin)
+  writePython3Bin = name: writePython3 "/bin/${name}";
+
+  restore-network = writePython3Bin "restore-network" {
+     flakeIgnore = [ "E501" ];
+  } ./restore_routes.py;
 
   # does not link with iptables enabled
   iprouteStatic = pkgs.pkgsStatic.iproute2.override { iptables = null; };
@@ -14,6 +21,7 @@ in
     ../serial.nix
     ../restore-remote-access.nix
   ];
+
   options = {
     system.kexec-installer.name = lib.mkOption {
       type = lib.types.str;
@@ -25,6 +33,7 @@ in
   };
 
   config = {
+    boot.initrd.compressor = "xz";
     # This is a variant of the upstream kexecScript that also allows embedding
     # a ssh key.
     system.build.kexecRun = pkgs.runCommand "kexec-run" { } ''
@@ -64,7 +73,7 @@ in
         Type = "oneshot";
         RemainAfterExit = true;
         ExecStart = [
-          "${restore-network} /root/network/addrs.json /root/network/routes-v4.json /root/network/routes-v6.json /etc/systemd/network"
+          "${restore-network}/bin/restore-network /root/network/addrs.json /root/network/routes-v4.json /root/network/routes-v6.json /etc/systemd/network"
         ];
       };
 

nix/kexec-installer/restore_routes.py

@@ -1,34 +1,80 @@
 import json
 import sys
 from pathlib import Path
-from typing import Any
+from typing import Any, Iterator
+from dataclasses import dataclass
 
 
-def filter_interfaces(network: list[dict[str, Any]]) -> list[dict[str, Any]]:
-    output = []
+@dataclass
+class Address:
+    address: str
+    family: str
+    prefixlen: int
+    preferred_life_time: int = 0
+    valid_life_time: int = 0
+
+
+@dataclass
+class Interface:
+    name: str
+    ifname: str | None
+    mac_address: str
+    dynamic_addresses: list[Address]
+    static_addresses: list[Address]
+    static_routes: list[dict[str, Any]]
+
+
+def filter_interfaces(network: list[dict[str, Any]]) -> list[Interface]:
+    interfaces = []
     for net in network:
         if net.get("link_type") == "loopback":
             continue
-        if not net.get("address"):
+        if not (mac_address := net.get("address")):
             # We need a mac address to match devices reliable
             continue
-        addr_info = []
-        has_dynamic_address = False
-        for addr in net.get("addr_info", []):
+        static_addresses = []
+        dynamic_addresses = []
+        for info in net.get("addr_info", []):
             # no link-local ipv4/ipv6
-            if addr.get("scope") == "link":
+            if info.get("scope") == "link":
                 continue
-            # do not explicitly configure addresses from dhcp or router advertisement
-            if addr.get("dynamic", False):
-                has_dynamic_address = True
+            if (preferred_life_time := info.get("preferred_life_time")) is None:
+                continue
+            if (valid_life_time := info.get("valid_life_time")) is None:
+                continue
+            if (prefixlen := info.get("prefixlen")) is None:
+                continue
+            if (family := info.get("family")) not in ["inet", "inet6"]:
+                continue
+            if (local := info.get("local")) is None:
+                continue
+            if (dynamic := info.get("dynamic", False)) is None:
                 continue
-            else:
-                addr_info.append(addr)
-        if addr_info != [] or has_dynamic_address:
-            net["addr_info"] = addr_info
-            output.append(net)
 
-    return output
+            address = Address(
+                address=local,
+                family=family,
+                prefixlen=prefixlen,
+                preferred_life_time=preferred_life_time,
+                valid_life_time=valid_life_time,
+            )
+
+            if dynamic:
+                dynamic_addresses.append(address)
+            else:
+                static_addresses.append(address)
+        interfaces.append(
+            Interface(
+                name=net.get("ifname", mac_address.replace(":", "-")),
+                ifname=net.get("ifname"),
+                mac_address=mac_address,
+                dynamic_addresses=dynamic_addresses,
+                static_addresses=static_addresses,
+                static_routes=[],
+            )
+        )
+
+    return interfaces
 
 
 def filter_routes(routes: list[dict[str, Any]]) -> list[dict[str, Any]]:
@@ -42,38 +88,54 @@ def filter_routes(routes: list[dict[str, Any]]) -> list[dict[str, Any]]:
     return filtered
 
 
+def find_most_recent_v4_lease(addresses: list[Address]) -> Address | None:
+    most_recent_address = None
+    most_recent_lifetime = -1
+    for addr in addresses:
+        if addr.family == "inet6":
+            continue
+        lifetime = max(addr.preferred_life_time, addr.valid_life_time)
+        if lifetime > most_recent_lifetime:
+            most_recent_lifetime = lifetime
+            most_recent_address = addr
+    return most_recent_address
+
+
+def generate_routes(
+    interface: Interface, routes: list[dict[str, Any]]
+) -> Iterator[str]:
+    for route in routes:
+        if interface.ifname is None or route.get("dev") != interface.ifname:
+            continue
+
+        # we may ignore on-link default routes here, but I don't see how
+        # they would be useful for internet connectivity anyway
+
+        yield "[Route]"
+        if route.get("dst") != "default":
+            # can be skipped for default routes
+            yield f"Destination = {route['dst']}"
+        gateway = route.get("gateway")
+        # route v4 via v6
+        route_via = route.get("via")
+        if route_via and route_via.get("family") == "inet6":
+            gateway = route_via.get("host")
+            if route.get("dst") == "default":
+                yield "Destination = 0.0.0.0/0"
+        if gateway:
+            yield f"Gateway = {gateway}"
+
+
 def generate_networkd_units(
-    interfaces: list[dict[str, Any]], routes: list[dict[str, Any]], directory: Path
+    interfaces: list[Interface], routes: list[dict[str, Any]], directory: Path
 ) -> None:
     directory.mkdir(exist_ok=True)
     for interface in interfaces:
-        name = f"00-{interface['ifname']}.network"
-        addresses = [
-            f"Address = {addr['local']}/{addr['prefixlen']}"
-            for addr in interface.get("addr_info", [])
-        ]
-
-        route_sections = []
-        for route in routes:
-            if route.get("dev", "nodev") != interface.get("ifname", "noif"):
-                continue
-
-            route_section = "[Route]\n"
-            if route.get("dst") != "default":
-                # can be skipped for default routes
-                route_section += f"Destination = {route['dst']}\n"
-            gateway = route.get("gateway")
-            if gateway:
-                route_section += f"Gateway = {gateway}\n"
-
-            # we may ignore on-link default routes here, but I don't see how
-            # they would be useful for internet connectivity anyway
-            route_sections.append(route_section)
-
         # FIXME in some networks we might not want to trust dhcp or router advertisements
-        unit = f"""
+        unit_sections = [
+            f"""
 [Match]
-MACAddress = {interface["address"]}
+MACAddress = {interface.mac_address}
 
 [Network]
 # both ipv4 and ipv6
@@ -83,12 +145,24 @@ LLDP = yes
 # ipv6 router advertisements
 IPv6AcceptRA = yes
 # allows us to ping "nixos.local"
-MulticastDNS = yes
+MulticastDNS = yes"""
+        ]
+        unit_sections.extend(
+            f"Address = {addr.address}/{addr.prefixlen}"
+            for addr in interface.static_addresses
+        )
+        unit_sections.extend(generate_routes(interface, routes))
+        most_recent_v4_lease = find_most_recent_v4_lease(interface.dynamic_addresses)
+        if most_recent_v4_lease:
+            unit_sections.append("[DHCPv4]")
+            unit_sections.append(f"RequestAddress = {most_recent_v4_lease.address}")
 
-"""
-        unit += "\n".join(addresses)
-        unit += "\n" + "\n".join(route_sections)
-        (directory / name).write_text(unit)
+        # trailing newline at the end
+        unit_sections.append("")
+
+        (directory / f"00-{interface.name}.network").write_text(
+            "\n".join(unit_sections)
+        )
 
 
 def main() -> None:

nix/kexec-installer/test.nix

@@ -1,32 +1,24 @@
 { pkgs
 , lib
 , kexecTarball
+, nixos-facter ? null
 }:
 
-let
-  makeTest = import (pkgs.path + "/nixos/tests/make-test-python.nix");
-  makeTest' = args: makeTest args {
-    inherit pkgs;
-    inherit (pkgs) system;
-  };
-in
-makeTest' {
+pkgs.testers.runNixOSTest {
   name = "kexec-installer";
   meta = with pkgs.lib.maintainers; {
     maintainers = [ mic92 ];
   };
 
   nodes = {
-    node1 = { modulesPath, ... }: {
+    node1 = { modulesPath, pkgs, ... }: {
       virtualisation.vlans = [ ];
-      environment.noXlibs = false; # avoid recompilation
       imports = [
         (modulesPath + "/profiles/minimal.nix")
       ];
 
       system.extraDependencies = [ kexecTarball ];
-      # TODO: remove the conditional after 23.11 is end-of-life
-      virtualisation.memorySize = 1 * 1024 + (if (lib.versionOlder lib.version "24.05pre") then 256 else 0);
+      virtualisation.memorySize = 1 * 1024;
       virtualisation.diskSize = 4 * 1024;
       virtualisation.forwardPorts = [{
         host.port = 2222;
@@ -55,10 +47,17 @@ makeTest' {
               "192.168.42.1/24"
               "42::1/64"
             ];
-            routes = [
+            routes = if pkgs.lib.versionAtLeast lib.version "24.11" then [
+              { Destination = "192.168.43.0/24"; }
+              { Destination = "192.168.44.0/24"; Gateway = "192.168.43.1"; }
+              { Destination = "192.168.45.0/24"; Gateway = "43::1"; }
+              { Destination = "43::0/64"; }
+              { Destination = "44::1/64"; Gateway = "43::1"; }
+            ] else [
               # Some static routes that we want to see in the kexeced image
               { routeConfig = { Destination = "192.168.43.0/24"; }; }
               { routeConfig = { Destination = "192.168.44.0/24"; Gateway = "192.168.43.1"; }; }
+              { routeConfig = { Destination = "192.168.45.0/24"; Gateway = "43::1"; }; }
               { routeConfig = { Destination = "43::0/64"; }; }
               { routeConfig = { Destination = "44::1/64"; Gateway = "43::1"; }; }
             ];
@@ -66,10 +65,14 @@ makeTest' {
           };
         };
       };
+    } // lib.optionalAttrs (lib.versionOlder lib.version "24.11pre") {
+      # avoid second overlay
+      environment.noXlibs = false;
     };
   };
 
-  testScript = ''
+  testScript = /*python*/ ''
+    import json
     import time
     import subprocess
     import socket
@@ -164,6 +167,11 @@ makeTest' {
     host = ssh(["hostname"], stdout=subprocess.PIPE).stdout.strip()
     assert host == "nixos-installer", f"hostname is {host}, not nixos-installer"
 
+    has_nixos_facter=${if nixos-facter != null then "True" else "False"}
+    if has_nixos_facter == True:
+        data = json.loads(ssh(["nixos-facter"], stdout=subprocess.PIPE).stdout)
+        assert data["virtualisation"] == "kvm", f"virtualisation is {data['virtualisation']}, not kvm"
+
     host_ed25519_after = ssh(["cat", "/etc/ssh/ssh_host_ed25519_key.pub"], stdout=subprocess.PIPE).stdout.strip()
     assert host_ed25519_before == host_ed25519_after, f"'{host_ed25519_before}' != '{host_ed25519_after}'"
 
@@ -186,6 +194,10 @@ makeTest' {
     print(out)
     assert "192.168.44.2 via 192.168.43.1" in out, f"route to `192.168.44.2 via 192.168.43.1` not found: {out}"
 
+    out = ssh(["ip", "route", "get", "192.168.45.2"], stdout=subprocess.PIPE).stdout
+    print(out)
+    assert "192.168.45.2 via inet6 43::1" in out, f"route to `192.168.45.2 via inet6 43::1` not found: {out}"
+
     out = ssh(["ip", "route", "get", "43::2"], stdout=subprocess.PIPE).stdout
     print(out)
     assert "43::2 from :: dev" in out, f"route `43::2 from dev` not found: {out}"

nix/latest-zfs-kernel.nix

@@ -0,0 +1,26 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+
+let
+  isUnstable = config.boot.zfs.package == pkgs.zfsUnstable;
+  zfsCompatibleKernelPackages = lib.filterAttrs (
+    name: kernelPackages:
+    (builtins.match "linux_[0-9]+_[0-9]+" name) != null
+    && (builtins.tryEval kernelPackages).success
+    && (
+      (!isUnstable && !kernelPackages.zfs.meta.broken)
+      || (isUnstable && !kernelPackages.zfs_unstable.meta.broken)
+    )
+  ) pkgs.linuxKernel.packages;
+  latestKernelPackage = lib.last (
+    lib.sort (a: b: (lib.versionOlder a.kernel.version b.kernel.version)) (builtins.attrValues zfsCompatibleKernelPackages)
+  );
+in
+{
+  # Note this might jump back and worth as kernel get added or removed.
+  boot.kernelPackages = latestKernelPackage;
+}

nix/nix-settings.nix

@@ -5,11 +5,7 @@
   nix.settings.connect-timeout = 5;
 
   # Enable flakes
-  nix.settings.experimental-features = [
-    "nix-command"
-    "flakes"
-    "repl-flake"
-  ];
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
 
   # The default at 10 is rarely enough.
   nix.settings.log-lines = lib.mkDefault 25;

nix/nixos-facter.nix

@@ -0,0 +1,71 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  hwinfo,
+  libusb1,
+  gcc,
+  pkg-config,
+  util-linux,
+  pciutils,
+  stdenv,
+}:
+let
+  # We are waiting on some changes to be merged upstream: https://github.com/openSUSE/hwinfo/pulls
+  hwinfoOverride = hwinfo.overrideAttrs {
+    src = fetchFromGitHub {
+      owner = "numtide";
+      repo = "hwinfo";
+      rev = "a559f34934098d54096ed2078e750a8245ae4044";
+      hash = "sha256-3abkWPr98qXXQ17r1Z43gh2M5hl/DHjW2hfeWl+GSAs=";
+    };
+  };
+in
+buildGoModule rec {
+  pname = "nixos-facter";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "numtide";
+    repo = "nixos-facter";
+    rev = "v${version}";
+    hash = "sha256-vlPmvCrgX64dcf//BPtQszBt7dkq35JpgQg+/LW0AqM=";
+  };
+
+  vendorHash = "sha256-5leiTNp3FJmgFd0SKhu18hxYZ2G9SuQPhZJjki2SDVs=";
+
+  CGO_ENABLED = 1;
+
+  buildInputs = [
+    libusb1
+    hwinfoOverride
+  ];
+
+  nativeBuildInputs = [
+    gcc
+    pkg-config
+  ];
+
+  runtimeInputs = [
+    libusb1
+    util-linux
+    pciutils
+  ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X git.numtide.com/numtide/nixos-facter/build.Name=nixos-facter"
+    "-X git.numtide.com/numtide/nixos-facter/build.Version=v${version}"
+    "-X github.com/numtide/nixos-facter/pkg/build.System=${stdenv.hostPlatform.system}"
+  ];
+
+  meta = {
+    description = "Declarative hardware configuration for NixOS";
+    homepage = "https://github.com/numtide/nixos-facter";
+    license = lib.licenses.gpl3Plus;
+    maintainers = [ lib.maintainers.brianmcgee ];
+    mainProgram = "nixos-facter";
+    platforms = lib.platforms.linux;
+  };
+}

nix/no-bootloaders.nix

@@ -1,8 +1,7 @@
-{
-  # HACK: Drop this once, we have https://github.com/NixOS/nixpkgs/pull/312863 merged
-
-  # Both syslinux and grub also reference perl
-  nixpkgs.overlays = [
+{ lib, ... }: {
+  # HACK: Drop this, once we have 24.11 everywhere
+  nixpkgs.overlays = lib.optionals (lib.versionOlder lib.version "24.11pre") [
+    # Both syslinux and grub also reference perl
     (final: prev: {
       # we don't need grub: save ~ 60MB
       grub2 = prev.coreutils;

nix/noninteractive.nix

@@ -1,7 +1,7 @@
 # This module optimizes for non-interactive deployments by remove some store paths
 # which are primarily useful for interactive installations.
 
-{ lib, pkgs, ... }:
+{ lib, pkgs, modulesPath, ... }:
 {
   disabledModules = [
     # This module adds values to multiple lists (systemPackages, supportedFilesystems)
@@ -10,8 +10,14 @@
   ];
 
   imports = [
-    ./zfs-minimal.nix
+#    ./zfs-minimal.nix
     ./no-bootloaders.nix
+    ./python-minimal.nix
+    ./noveau-workaround.nix
+    # reduce closure size by removing perl
+    "${modulesPath}/profiles/perlless.nix"
+    # FIXME: we still are left with nixos-generate-config due to nixos-install-tools
+    { system.forbiddenDependenciesRegexes = lib.mkForce []; }
   ];
 
   # among others, this prevents carrying a stdenv with gcc in the image
@@ -24,10 +30,29 @@
   programs.nano.enable = false;
 
   # prevents strace
-  environment.defaultPackages = lib.mkForce [ pkgs.rsync pkgs.parted pkgs.gptfdisk ];
+  environment.defaultPackages = lib.mkForce [
+    pkgs.rsync
+    pkgs.parted
+    pkgs.gptfdisk
+    pkgs.e2fsprogs
+  ];
+
+  # normal users are not allowed with sys-users
+  # see https://github.com/NixOS/nixpkgs/pull/328926
+  users.users.nixos = {
+    isSystemUser = true;
+    isNormalUser = lib.mkForce false;
+    shell = "/run/current-system/sw/bin/bash";
+    group = "nixos";
+  };
+  users.groups.nixos = {};
+
+  # we prefer root as this is also what we use in nixos-anywhere
+  services.getty.autologinUser = lib.mkForce "root";
 
   # we are missing this from base.nix
   boot.supportedFilesystems = [
+    "ext4"
     "btrfs"
     # probably not needed but does not seem to increase closure size
     "cifs"

nix/noveau-workaround.nix

@@ -0,0 +1,4 @@
+{
+  # fixes blank screen on boot for some cards
+  boot.kernelParams = [ "nouveau.modeset=0" ];
+}

nix/python-minimal.nix

@@ -0,0 +1,10 @@
+{
+  nixpkgs.overlays = [
+    (final: prev: {
+      bcachefs-tools = prev.bcachefs-tools.override { python3 = final.python3Minimal; };
+      cifs-utils = prev.cifs-utils.override { python3 = final.python3Minimal; };
+      nfs-utils = prev.nfs-utils.override { python3 = final.python3Minimal; };
+      talloc = prev.talloc.override { python3 = final.python3Minimal; };
+    })
+  ];
+}

nix/restore-remote-access.nix

@@ -1,10 +1,6 @@
-{ lib, ... }:
-let
-  is2405 = lib.versionAtLeast lib.version "24.05pre";
-in
 {
   # We have a bug in 23.11 in combination with netboot.
-  boot.initrd.systemd.enable = is2405;
+  boot.initrd.systemd.enable = true;
   boot.initrd.systemd.services.restore-state-from-initrd = {
     unitConfig = {
       DefaultDependencies = false;
@@ -30,17 +26,4 @@ in
       fi
     '';
   };
-  boot.initrd.postMountCommands = lib.mkIf (!is2405) ''
-      mkdir -m 700 -p /mnt-root/root/.ssh
-      mkdir -m 755 -p /mnt-root/etc/ssh
-      mkdir -m 755 -p /mnt-root/root/network
-      if [[ -f ssh/authorized_keys ]]; then
-        install -m 400 ssh/authorized_keys /mnt-root/root/.ssh
-      fi
-      install -m 400 ssh/ssh_host_* /mnt-root/etc/ssh
-      cp *.json /mnt-root/root/network/
-      if [[ -f machine-id ]]; then
-        cp machine-id /mnt-root/etc/machine-id
-      fi
-  '';
 }

nix/zfs-minimal.nix

@@ -1,9 +1,11 @@
 { config, lib, pkgs, ... }:
 # incorperate a space-optimized version of zfs
 let
-  zfs = pkgs.zfs.override {
+  zfs = pkgs.zfsUnstable.override {
     # this overrides saves 10MB
     samba = pkgs.coreutils;
+
+    python3 = pkgs.python3Minimal;
   };
 in
 {
@@ -13,20 +15,7 @@ in
   environment.defaultPackages = lib.mkForce [ zfs ]; # this merges with outer noninteractive module.
 
   boot.kernelModules = [ "zfs" ];
-  boot.extraModulePackages = [
-    (config.boot.kernelPackages.zfs.override {
-      inherit (config.boot.zfs) removeLinuxDRM;
-    })
-  ];
-
-  boot.kernelPatches = lib.optional (config.boot.zfs.removeLinuxDRM && pkgs.stdenv.hostPlatform.system == "aarch64-linux") {
-    name = "export-neon-symbols-as-gpl";
-    patch = pkgs.fetchpatch {
-      url = "https://github.com/torvalds/linux/commit/aaeca98456431a8d9382ecf48ac4843e252c07b3.patch";
-      hash = "sha256-L2g4G1tlWPIi/QRckMuHDcdWBcKpObSWSRTvbHRIwIk=";
-      revert = true;
-    };
-  };
+  boot.extraModulePackages = [ config.boot.kernelPackages.zfs_unstable ];
 
   networking.hostId = lib.mkDefault "8425e349";
 }