Automatically build (netboot) images for NixOS [maintainer=@Mic92]

Find a file

github-actions[bot] f63f58eecb flake.lock: Update Flake lock file updates: • Updated input 'nixos-stable': 'github:NixOS/nixpkgs/1719f27dd95fd4206afb9cec9f415b539978827e?narHash=sha256-9/79hjQc9%2BxyH%2BQxeMcRsA6hDyw6Z9Eo1/oxjvwirLk%3D' (2024-09-30) → 'github:NixOS/nixpkgs/ecbc1ca8ffd6aea8372ad16be9ebbb39889e55b6?narHash=sha256-PbDWAIjKJdlVg%2BqQRhzdSor04bAPApDqIv2DofTyynk%3D' (2024-10-06) • Updated input 'nixos-unstable': 'github:NixOS/nixpkgs/35d02934a17a4fdc53a8857826ed35f3694e5f1c?narHash=sha256-%2Bt0jCdN1AFWLpi%2BXwHK4r/Jp%2BpJfo9ePHIy%2B4/BUCI4%3D' (2024-10-02) → 'github:NixOS/nixpkgs/ff0da78cfd41aa1784910ce1fea89119822013ce?narHash=sha256-E9JaDKGi21oUypH0P9881lbkhi6USNJ6XL2tFzU5uuE%3D' (2024-10-06)		2024-10-07 01:39:04 +00:00
.github	build(deps): bump cachix/install-nix-action from V28 to 29	2024-09-30 10:03:47 +00:00
nix	nixos-facter: switch back to main	2024-09-26 17:10:53 +00:00
.mergify.yml	ci(Mergify): configuration update	2024-09-20 13:04:54 +10:00
build-images.sh	ci: fixup attribute names	2024-06-07 14:09:13 +02:00
flake.lock	flake.lock: Update	2024-10-07 01:39:04 +00:00
flake.nix	add boot tests for iso	2024-09-18 17:39:45 +02:00
LICENSE	Initial commit	2021-06-10 05:52:46 +01:00
README.md	Update README.md	2024-09-07 10:27:29 +05:00

README.md

nixos-images

Automatically weekly updated images for NixOS. This project is intended to extend the images created by hydra.nixos.org. We are currently creating the images listed below:

Kexec tarballs

These images are used for unattended remote installation in nixos-anywhere.

Kexec is a mechanism in Linux to load a new kernel from a running Linux to replace the current kernel. This is useful for booting the Nixos installer from existing Linux distributions, such as server provider that do not offer a NixOS option. After running kexec, the NixOS installer exists only in memory. At the time of writing, this requires secure boot off in BIOS settings and at least 1GB of physical RAM (swap does not count) in the system. If not enough RAM is available, the initrd cannot be loaded. Because the NixOS runs only in RAM, users can reformat all the system's discs to prepare for a new NixOS installation.

It can be booted as follows by running these commands as root:

curl -L https://github.com/nix-community/nixos-images/releases/download/nixos-unstable/nixos-kexec-installer-noninteractive-x86_64-linux.tar.gz | tar -xzf- -C /root
/root/kexec/run

The kexec installer comes with the following features:

Re-uses ssh host keys from the sshd to not break .ssh/known_hosts
Authorized ssh keys are read from /root/.ssh/authorized_keys, /root/.ssh/authorized_keys2 and /etc/ssh/authorized_keys.d/root
Static ip addresses and routes are restored after reboot. Interface that had dynamic addresses before are configured with DHCP and to accept prefixes from ipv6 router advertisement

The actual kexec happens with a slight delay (6s). This allows for easier integration into automated nixos installation scripts, since you can cleanly disconnect from the running machine before the kexec takes place. The tarball is also designed to be run from NixOS, which can be useful for new installations

Iso installer images

This image allows to boot a NixOS installer off a USB-Stick. This installer has been optimized for remote installation i.e. with nixos-anywhere and clan notably:

Enables openssh by default
Generates a random root password on each login
Enables a Tor hidden SSH service so that by using the torify ssh <hash>.onion, one can log in from remote machines.
Prints a QR-Code that contains local addresses, the root password
Includes the IWD deamon for easier wifi setups:
- Run iwctl in the terminal for an interactive wifi setup interface.

Netboot images

You can boot the netboot image using this ipxe script. It consists of the kernel image and initrd.