pyrox.dev
1# Configuration for Amazon EC2 instances. (Note that this file is a
2# misnomer - it should be "amazon-config.nix" or so, not
3# "amazon-image.nix", since it's used not only to build images but
4# also to reconfigure instances. However, we can't rename it because
5# existing "configuration.nix" files on EC2 instances refer to it.)
6
7{ config, lib, pkgs, ... }:
8
9with lib;
10
11let cfg = config.ec2; in
12
13{
14 imports = [ ../profiles/headless.nix ./ec2-data.nix ./amazon-init.nix ];
15
16 config = {
17
18 assertions = [
19 { assertion = cfg.hvm;
20 message = "Paravirtualized EC2 instances are no longer supported.";
21 }
22 ];
23
24 boot.growPartition = cfg.hvm;
25
26 fileSystems."/" = {
27 device = "/dev/disk/by-label/nixos";
28 autoResize = true;
29 };
30
31 boot.extraModulePackages =
32 [ config.boot.kernelPackages.ixgbevf
33 config.boot.kernelPackages.ena
34 ];
35 boot.initrd.kernelModules = [ "xen-blkfront" "xen-netfront" ];
36 boot.initrd.availableKernelModules = [ "ixgbevf" "ena" "nvme" ];
37 boot.kernelParams = mkIf cfg.hvm [ "console=ttyS0" ];
38
39 # Prevent the nouveau kernel module from being loaded, as it
40 # interferes with the nvidia/nvidia-uvm modules needed for CUDA.
41 # Also blacklist xen_fbfront to prevent a 30 second delay during
42 # boot.
43 boot.blacklistedKernelModules = [ "nouveau" "xen_fbfront" ];
44
45 # Generate a GRUB menu. Amazon's pv-grub uses this to boot our kernel/initrd.
46 boot.loader.grub.version = if cfg.hvm then 2 else 1;
47 boot.loader.grub.device = if cfg.hvm then "/dev/xvda" else "nodev";
48 boot.loader.grub.extraPerEntryConfig = mkIf (!cfg.hvm) "root (hd0)";
49 boot.loader.timeout = 0;
50
51 boot.initrd.network.enable = true;
52
53 # Mount all formatted ephemeral disks and activate all swap devices.
54 # We cannot do this with the ‘fileSystems’ and ‘swapDevices’ options
55 # because the set of devices is dependent on the instance type
56 # (e.g. "m1.large" has one ephemeral filesystem and one swap device,
57 # while "m1.large" has two ephemeral filesystems and no swap
58 # devices). Also, put /tmp and /var on /disk0, since it has a lot
59 # more space than the root device. Similarly, "move" /nix to /disk0
60 # by layering a unionfs-fuse mount on top of it so we have a lot more space for
61 # Nix operations.
62 boot.initrd.postMountCommands =
63 ''
64 metaDir=$targetRoot/etc/ec2-metadata
65 mkdir -m 0755 -p "$metaDir"
66
67 echo "getting EC2 instance metadata..."
68
69 if ! [ -e "$metaDir/ami-manifest-path" ]; then
70 wget -q -O "$metaDir/ami-manifest-path" http://169.254.169.254/1.0/meta-data/ami-manifest-path
71 fi
72
73 if ! [ -e "$metaDir/user-data" ]; then
74 wget -q -O "$metaDir/user-data" http://169.254.169.254/1.0/user-data && chmod 600 "$metaDir/user-data"
75 fi
76
77 if ! [ -e "$metaDir/hostname" ]; then
78 wget -q -O "$metaDir/hostname" http://169.254.169.254/1.0/meta-data/hostname
79 fi
80
81 if ! [ -e "$metaDir/public-keys-0-openssh-key" ]; then
82 wget -q -O "$metaDir/public-keys-0-openssh-key" http://169.254.169.254/1.0/meta-data/public-keys/0/openssh-key
83 fi
84
85 diskNr=0
86 diskForUnionfs=
87 for device in /dev/xvd[abcde]*; do
88 if [ "$device" = /dev/xvda -o "$device" = /dev/xvda1 ]; then continue; fi
89 fsType=$(blkid -o value -s TYPE "$device" || true)
90 if [ "$fsType" = swap ]; then
91 echo "activating swap device $device..."
92 swapon "$device" || true
93 elif [ "$fsType" = ext3 ]; then
94 mp="/disk$diskNr"
95 diskNr=$((diskNr + 1))
96 if mountFS "$device" "$mp" "" ext3; then
97 if [ -z "$diskForUnionfs" ]; then diskForUnionfs="$mp"; fi
98 fi
99 else
100 echo "skipping unknown device type $device"
101 fi
102 done
103
104 if [ -n "$diskForUnionfs" ]; then
105 mkdir -m 755 -p $targetRoot/$diskForUnionfs/root
106
107 mkdir -m 1777 -p $targetRoot/$diskForUnionfs/root/tmp $targetRoot/tmp
108 mount --bind $targetRoot/$diskForUnionfs/root/tmp $targetRoot/tmp
109
110 if [ "$(cat "$metaDir/ami-manifest-path")" != "(unknown)" ]; then
111 mkdir -m 755 -p $targetRoot/$diskForUnionfs/root/var $targetRoot/var
112 mount --bind $targetRoot/$diskForUnionfs/root/var $targetRoot/var
113
114 mkdir -p /unionfs-chroot/ro-nix
115 mount --rbind $targetRoot/nix /unionfs-chroot/ro-nix
116
117 mkdir -m 755 -p $targetRoot/$diskForUnionfs/root/nix
118 mkdir -p /unionfs-chroot/rw-nix
119 mount --rbind $targetRoot/$diskForUnionfs/root/nix /unionfs-chroot/rw-nix
120
121 unionfs -o allow_other,cow,nonempty,chroot=/unionfs-chroot,max_files=32768 /rw-nix=RW:/ro-nix=RO $targetRoot/nix
122 fi
123 fi
124 '';
125
126 boot.initrd.extraUtilsCommands =
127 ''
128 # We need swapon in the initrd.
129 copy_bin_and_libs ${pkgs.utillinux}/sbin/swapon
130 '';
131
132 # Don't put old configurations in the GRUB menu. The user has no
133 # way to select them anyway.
134 boot.loader.grub.configurationLimit = 0;
135
136 # Allow root logins only using the SSH key that the user specified
137 # at instance creation time.
138 services.openssh.enable = true;
139 services.openssh.permitRootLogin = "prohibit-password";
140
141 # Force getting the hostname from EC2.
142 networking.hostName = mkDefault "";
143
144 # Always include cryptsetup so that Charon can use it.
145 environment.systemPackages = [ pkgs.cryptsetup ];
146
147 boot.initrd.supportedFilesystems = [ "unionfs-fuse" ];
148
149 # EC2 has its own NTP server provided by the hypervisor
150 networking.timeServers = [ "169.254.169.123" ];
151 };
152}