commit 362d1d6218e04aad7d9bbf93227d227666f29e6d · pyrox.dev/nixpkgs

+10

nixos/maintainers/scripts/oci/create-image.sh

···

       1
       +
       #! /usr/bin/env bash

     

       2
       +
       

     

       3
       +
       export NIX_PATH=nixpkgs=$(dirname $(readlink -f $0))/../../../..

     

       4
       +
       export NIXOS_CONFIG=$(dirname $(readlink -f $0))/../../../modules/virtualisation/oci-image.nix

     

       5
       +
       

     

       6
       +
       nix-build '<nixpkgs/nixos>' \

     

       7
       +
          -A config.system.build.OCIImage \

     

       8
       +
          --argstr system x86_64-linux \

     

       9
       +
          --option system-features kvm \

     

       10
       +
          -o oci-image

+98

nixos/maintainers/scripts/oci/upload-image.sh

···

       1
       +
       #! /usr/bin/env bash

     

       2
       +
       

     

       3
       +
       script_dir="$(dirname $(readlink -f $0))"

     

       4
       +
       nixpkgs_root="$script_dir/../../../.."

     

       5
       +
       export NIX_PATH="nixpkgs=$nixpkgs_root"

     

       6
       +
       

     

       7
       +
       cat - <<EOF

     

       8
       +
       This script will locally build a NixOS image and upload it as a Custom Image

     

       9
       +
       using oci-cli. Make sure that an API key for the tenancy administrator has been

     

       10
       +
       added to '~/.oci'.

     

       11
       +
       For more info about configuring oci-cli, please visit

     

       12
       +
       https://docs.cloud.oracle.com/iaas/Content/API/Concepts/apisigningkey.htm#Required_Keys_and_OCIDs

     

       13
       +
       

     

       14
       +
       EOF

     

       15
       +
       

     

       16
       +
       qcow="oci-image/nixos.qcow2"

     

       17
       +
       if [ ! -f "$qcow" ]; then

     

       18
       +
           echo "OCI image $qcow does not exist"

     

       19
       +
           echo "Building image with create-image.sh"

     

       20
       +
           "$script_dir/create-image.sh"

     

       21
       +
           [ -f "$qcow" ] || { echo "Build failed: image not present after build"; exit 1; }

     

       22
       +
       else

     

       23
       +
           echo "Using prebuilt image $qcow"

     

       24
       +
       fi

     

       25
       +
       

     

       26
       +
       cli="$(

     

       27
       +
         nix-build '<nixpkgs>' \

     

       28
       +
           --no-out-link \

     

       29
       +
           -A oci-cli

     

       30
       +
       )"

     

       31
       +
       

     

       32
       +
       PATH="$cli/bin:$PATH"

     

       33
       +
       bucket="_TEMP_NIXOS_IMAGES_$RANDOM"

     

       34
       +
       

     

       35
       +
       echo "Creating a temporary bucket"

     

       36
       +
       root_ocid="$(

     

       37
       +
         oci iam compartment list \

     

       38
       +
         --all \

     

       39
       +
         --compartment-id-in-subtree true \

     

       40
       +
         --access-level ACCESSIBLE \

     

       41
       +
         --include-root \

     

       42
       +
         --raw-output \

     

       43
       +
         --query "data[?contains(\"id\",'tenancy')].id | [0]"

     

       44
       +
       )"

     

       45
       +
       bucket_ocid=$(

     

       46
       +
         oci os bucket create \

     

       47
       +
           -c "$root_ocid" \

     

       48
       +
           --name "$bucket" \

     

       49
       +
           --raw-output \

     

       50
       +
           --query "data.id"

     

       51
       +
       )

     

       52
       +
       # Clean up bucket on script termination

     

       53
       +
       trap 'echo Removing temporary bucket; oci os bucket delete --force --name "$bucket"' INT TERM EXIT

     

       54
       +
       

     

       55
       +
       echo "Uploading image to temporary bucket"

     

       56
       +
       oci os object put -bn "$bucket" --file "$qcow"

     

       57
       +
       

     

       58
       +
       echo "Importing image as a Custom Image"

     

       59
       +
       bucket_ns="$(oci os ns get --query "data" --raw-output)"

     

       60
       +
       image_id="$(

     

       61
       +
         oci compute image import from-object \

     

       62
       +
           -c "$root_ocid" \

     

       63
       +
           --namespace "$bucket_ns" \

     

       64
       +
           --bucket-name "$bucket" \

     

       65
       +
           --name nixos.qcow2 \

     

       66
       +
           --operating-system NixOS \

     

       67
       +
           --source-image-type QCOW2 \

     

       68
       +
           --launch-mode PARAVIRTUALIZED \

     

       69
       +
           --display-name NixOS \

     

       70
       +
           --raw-output \

     

       71
       +
           --query "data.id"

     

       72
       +
       )"

     

       73
       +
       

     

       74
       +
       cat - <<EOF

     

       75
       +
       Image created! Please mark all available shapes as compatible with this image by

     

       76
       +
       visiting the following link and by selecting the 'Edit Details' button on:

     

       77
       +
       https://cloud.oracle.com/compute/images/$image_id

     

       78
       +
       EOF

     

       79
       +
       

     

       80
       +
       # Workaround until https://github.com/oracle/oci-cli/issues/399 is addressed

     

       81
       +
       echo "Sleeping for 15 minutes before cleaning up files in the temporary bucket"

     

       82
       +
       sleep $((15 * 60))

     

       83
       +
       

     

       84
       +
       echo "Deleting image from bucket"

     

       85
       +
       par_id="$(

     

       86
       +
         oci os preauth-request list \

     

       87
       +
           --bucket-name "$bucket" \

     

       88
       +
           --raw-output \

     

       89
       +
           --query "data[0].id"

     

       90
       +
       )"

     

       91
       +
       

     

       92
       +
       if [[ -n $par_id ]]; then

     

       93
       +
         oci os preauth-request delete \

     

       94
       +
           --bucket-name "$bucket" \

     

       95
       +
           --par-id "$par_id"

     

       96
       +
       fi

     

       97
       +
       

     

       98
       +
       oci os object delete -bn "$bucket" --object-name nixos.qcow2 --force

+39

nixos/modules/virtualisation/oci-common.nix

···

       1
       +
       { lib, pkgs, ... }:

     

       2
       +
       

     

       3
       +
       with lib;

     

       4
       +
       {

     

       5
       +
         imports = [ ../profiles/qemu-guest.nix ];

     

       6
       +
       

     

       7
       +
         # Taken from /proc/cmdline of Ubuntu 20.04.2 LTS on OCI

     

       8
       +
         boot.kernelParams = [

     

       9
       +
           "console=tty1"

     

       10
       +
           "console=ttyS0"

     

       11
       +
           "nvme.shutdown_timeout=10"

     

       12
       +
           "libiscsi.debug_libiscsi_eh=1"

     

       13
       +
           "crash_kexec_post_notifiers"

     

       14
       +
         ];

     

       15
       +
       

     

       16
       +
         boot.growPartition = true;

     

       17
       +
       

     

       18
       +
         fileSystems."/" = {

     

       19
       +
           device = "/dev/disk/by-label/nixos";

     

       20
       +
           fsType = "ext4";

     

       21
       +
           autoResize = true;

     

       22
       +
         };

     

       23
       +
       

     

       24
       +
         boot.loader.grub = {

     

       25
       +
           version = 2;

     

       26
       +
           device = "/dev/sda";

     

       27
       +
           splashImage = null;

     

       28
       +
           extraConfig = ''

     

       29
       +
             serial --unit=0 --speed=115200 --word=8 --parity=no --stop=1

     

       30
       +
             terminal_input --append serial

     

       31
       +
             terminal_output --append serial

     

       32
       +
           '';

     

       33
       +
         };

     

       34
       +
       

     

       35
       +
         # https://docs.oracle.com/en-us/iaas/Content/Compute/Tasks/configuringntpservice.htm#Configuring_the_Oracle_Cloud_Infrastructure_NTP_Service_for_an_Instance

     

       36
       +
         networking.timeServers = [ "169.254.169.254" ];

     

       37
       +
       

     

       38
       +
         services.openssh.enable = true;

     

       39
       +
       }

+12

nixos/modules/virtualisation/oci-config-user.nix

···

       1
       +
       { modulesPath, ... }:

     

       2
       +
       

     

       3
       +
       {

     

       4
       +
         # To build the configuration or use nix-env, you need to run

     

       5
       +
         # either nixos-rebuild --upgrade or nix-channel --update

     

       6
       +
         # to fetch the nixos channel.

     

       7
       +
       

     

       8
       +
         # This configures everything but bootstrap services,

     

       9
       +
         # which only need to be run once and have already finished

     

       10
       +
         # if you are able to see this comment.

     

       11
       +
         imports = [ "${modulesPath}/virtualisation/oci-common.nix" ];

     

       12
       +
       }

+49

nixos/modules/virtualisation/oci-image.nix

···

       1
       +
       

     

       2
       +
       { config, lib, pkgs, ... }:

     

       3
       +
       

     

       4
       +
       with lib;

     

       5
       +
       

     

       6
       +
       {

     

       7
       +
         imports = [ ./oci-common.nix ];

     

       8
       +
       

     

       9
       +
         config = {

     

       10
       +
           system.build.OCIImage = import ../../lib/make-disk-image.nix {

     

       11
       +
             inherit config lib pkgs;

     

       12
       +
             name = "oci-image";

     

       13
       +
             configFile = ./oci-config-user.nix;

     

       14
       +
             format = "qcow2";

     

       15
       +
             diskSize = 8192;

     

       16
       +
           };

     

       17
       +
       

     

       18
       +
           systemd.services.fetch-ssh-keys = {

     

       19
       +
             description = "Fetch authorized_keys for root user";

     

       20
       +
       

     

       21
       +
             wantedBy = [ "sshd.service" ];

     

       22
       +
             before = [ "sshd.service" ];

     

       23
       +
       

     

       24
       +
             after = [ "network-online.target" ];

     

       25
       +
             wants = [ "network-online.target" ];

     

       26
       +
       

     

       27
       +
             path  = [ pkgs.coreutils pkgs.curl ];

     

       28
       +
             script = ''

     

       29
       +
               mkdir -m 0700 -p /root/.ssh

     

       30
       +
               if [ -f /root/.ssh/authorized_keys ]; then

     

       31
       +
                 echo "Authorized keys have already been downloaded"

     

       32
       +
               else

     

       33
       +
                 echo "Downloading authorized keys from Instance Metadata Service v2"

     

       34
       +
                 curl -s -S -L \

     

       35
       +
                   -H "Authorization: Bearer Oracle" \

     

       36
       +
                   -o /root/.ssh/authorized_keys \

     

       37
       +
                   http://169.254.169.254/opc/v2/instance/metadata/ssh_authorized_keys

     

       38
       +
                 chmod 600 /root/.ssh/authorized_keys

     

       39
       +
               fi

     

       40
       +
             '';

     

       41
       +
             serviceConfig = {

     

       42
       +
               Type = "oneshot";

     

       43
       +
               RemainAfterExit = true;

     

       44
       +
               StandardError = "journal+console";

     

       45
       +
               StandardOutput = "journal+console";

     

       46
       +
             };

     

       47
       +
           };

     

       48
       +
         };

     

       49
       +
       }