pyrox.dev
1# Configuration for Amazon EC2 instances. (Note that this file is a
2# misnomer - it should be "amazon-config.nix" or so, not
3# "amazon-image.nix", since it's used not only to build images but
4# also to reconfigure instances. However, we can't rename it because
5# existing "configuration.nix" files on EC2 instances refer to it.)
6
7{ config, lib, pkgs, ... }:
8
9with lib;
10
11let cfg = config.ec2; in
12
13{
14 imports = [ ../profiles/headless.nix ./ec2-data.nix ./amazon-grow-partition.nix ./amazon-init.nix ];
15
16 config = {
17
18 fileSystems."/" = {
19 device = "/dev/disk/by-label/nixos";
20 autoResize = true;
21 };
22
23 boot.initrd.kernelModules = [ "xen-blkfront" "xen-netfront" ];
24 boot.kernelParams = mkIf cfg.hvm [ "console=ttyS0" ];
25
26 # Prevent the nouveau kernel module from being loaded, as it
27 # interferes with the nvidia/nvidia-uvm modules needed for CUDA.
28 # Also blacklist xen_fbfront to prevent a 30 second delay during
29 # boot.
30 boot.blacklistedKernelModules = [ "nouveau" "xen_fbfront" ];
31
32 # Generate a GRUB menu. Amazon's pv-grub uses this to boot our kernel/initrd.
33 boot.loader.grub.version = if cfg.hvm then 2 else 1;
34 boot.loader.grub.device = if cfg.hvm then "/dev/xvda" else "nodev";
35 boot.loader.grub.timeout = 0;
36 boot.loader.grub.extraPerEntryConfig = mkIf (!cfg.hvm) "root (hd0)";
37
38 boot.initrd.postDeviceCommands =
39 ''
40 # Force udev to exit to prevent random "Device or resource busy
41 # while trying to open /dev/xvda" errors from fsck.
42 udevadm control --exit || true
43 kill -9 -1
44 '';
45
46 boot.initrd.network.enable = true;
47
48 # Mount all formatted ephemeral disks and activate all swap devices.
49 # We cannot do this with the ‘fileSystems’ and ‘swapDevices’ options
50 # because the set of devices is dependent on the instance type
51 # (e.g. "m1.large" has one ephemeral filesystem and one swap device,
52 # while "m1.large" has two ephemeral filesystems and no swap
53 # devices). Also, put /tmp and /var on /disk0, since it has a lot
54 # more space than the root device. Similarly, "move" /nix to /disk0
55 # by layering a unionfs-fuse mount on top of it so we have a lot more space for
56 # Nix operations.
57 boot.initrd.postMountCommands =
58 ''
59 metaDir=$targetRoot/etc/ec2-metadata
60 mkdir -m 0755 -p "$metaDir"
61
62 echo "getting EC2 instance metadata..."
63
64 if ! [ -e "$metaDir/ami-manifest-path" ]; then
65 wget -q -O "$metaDir/ami-manifest-path" http://169.254.169.254/1.0/meta-data/ami-manifest-path
66 fi
67
68 if ! [ -e "$metaDir/user-data" ]; then
69 wget -q -O "$metaDir/user-data" http://169.254.169.254/1.0/user-data
70 chmod 600 "$metaDir/user-data"
71 fi
72
73 if ! [ -e "$metaDir/hostname" ]; then
74 wget -q -O "$metaDir/hostname" http://169.254.169.254/1.0/meta-data/hostname
75 fi
76
77 if ! [ -e "$metaDir/public-keys-0-openssh-key" ]; then
78 wget -q -O "$metaDir/public-keys-0-openssh-key" http://169.254.169.254/1.0/meta-data/public-keys/0/openssh-key
79 fi
80
81 diskNr=0
82 diskForUnionfs=
83 for device in /dev/xvd[abcde]*; do
84 if [ "$device" = /dev/xvda -o "$device" = /dev/xvda1 ]; then continue; fi
85 fsType=$(blkid -o value -s TYPE "$device" || true)
86 if [ "$fsType" = swap ]; then
87 echo "activating swap device $device..."
88 swapon "$device" || true
89 elif [ "$fsType" = ext3 ]; then
90 mp="/disk$diskNr"
91 diskNr=$((diskNr + 1))
92 echo "mounting $device on $mp..."
93 if mountFS "$device" "$mp" "" ext3; then
94 if [ -z "$diskForUnionfs" ]; then diskForUnionfs="$mp"; fi
95 fi
96 else
97 echo "skipping unknown device type $device"
98 fi
99 done
100
101 if [ -n "$diskForUnionfs" ]; then
102 mkdir -m 755 -p $targetRoot/$diskForUnionfs/root
103
104 mkdir -m 1777 -p $targetRoot/$diskForUnionfs/root/tmp $targetRoot/tmp
105 mount --bind $targetRoot/$diskForUnionfs/root/tmp $targetRoot/tmp
106
107 if [ "$(cat "$metaDir/ami-manifest-path")" != "(unknown)" ]; then
108 mkdir -m 755 -p $targetRoot/$diskForUnionfs/root/var $targetRoot/var
109 mount --bind $targetRoot/$diskForUnionfs/root/var $targetRoot/var
110
111 mkdir -p /unionfs-chroot/ro-nix
112 mount --rbind $targetRoot/nix /unionfs-chroot/ro-nix
113
114 mkdir -m 755 -p $targetRoot/$diskForUnionfs/root/nix
115 mkdir -p /unionfs-chroot/rw-nix
116 mount --rbind $targetRoot/$diskForUnionfs/root/nix /unionfs-chroot/rw-nix
117
118 unionfs -o allow_other,cow,nonempty,chroot=/unionfs-chroot,max_files=32768 /rw-nix=RW:/ro-nix=RO $targetRoot/nix
119 fi
120 fi
121 '';
122
123 boot.initrd.extraUtilsCommands =
124 ''
125 # We need swapon in the initrd.
126 copy_bin_and_libs ${pkgs.utillinux}/sbin/swapon
127 '';
128
129 # Don't put old configurations in the GRUB menu. The user has no
130 # way to select them anyway.
131 boot.loader.grub.configurationLimit = 0;
132
133 # Allow root logins only using the SSH key that the user specified
134 # at instance creation time.
135 services.openssh.enable = true;
136 services.openssh.permitRootLogin = "without-password";
137
138 # Force getting the hostname from EC2.
139 networking.hostName = mkDefault "";
140
141 # Always include cryptsetup so that Charon can use it.
142 environment.systemPackages = [ pkgs.cryptsetup ];
143
144 boot.initrd.supportedFilesystems = [ "unionfs-fuse" ];
145 };
146}