netboot.nix

# This module creates netboot media containing the given NixOS
# configuration.
nfsPath:

{
  config,
  lib,
  pkgs,
  modulesPath,
  ...
}:

with lib;

{
  imports = [
    (modulesPath + "/profiles/base.nix")
  ];

  options = {
    netboot.nfsServer = lib.mkOption {
      type = lib.types.str;
      description = ''
        NFS Server IP Address
      '';
    };
  };

  config =
    let
      # Create the directory that contains the Nix store.
      nixStore = pkgs.callPackage ./make-store-dir.nix {
        # Closures to be copied to the Nix store, namely the init
        # script and the top-level system configuration directory.
        storeContents = [ config.system.build.toplevel ];
      };

      # Alternative: Create the squashfs image that contains the Nix store.
      squashfsStore = pkgs.callPackage ./make-squashfs.nix {
        storeContents = [ config.system.build.toplevel ];
        comp = "zstd -Xcompression-level 19";
        hydraBuildProduct = true;
      };
    in
    {
      documentation.man.enable = lib.mkOverride 500 true;
      hardware.enableRedistributableFirmware = lib.mkOverride 70 false;
      system.extraDependencies = lib.mkOverride 70 [ ];
      networking.networkmanager.enable = lib.mkOverride 500 false;

      hardware.enableAllHardware = true;

      # Don't build the GRUB menu builder script, since we don't need it
      # here and it causes a cyclic dependency.
      boot.loader.grub.enable = false;

      boot.initrd.network.enable = true;
      boot.initrd.network.flushBeforeStage2 = false; # otherwise NFS dosen't work
      networking.useDHCP = lib.mkForce true;

      boot.initrd.systemd.initrdBin = [
        pkgs.fuse
        pkgs.nfs-utils
      ];

      fileSystems."/" = mkImageMediaOverride {
        fsType = "tmpfs";
        options = [ "mode=0755" ];
      };

      fileSystems."/nix/pxe-server-squashfs" = mkImageMediaOverride {
        fsType = "nfs4";
        device = "${config.netboot.nfsServer}:/${nfsPath}";
        options = [
          "ro"
          "vers=4.2"
          "rsize=1048576"
          "hard"
          "intr"
          "nocto"
          "noatime"
          "actimeo=86400"
        ];
        neededForBoot = true;
      };

      fileSystems."/nix/.ro-store" = mkImageMediaOverride {
        depends = [
          "/nix/pxe-server-squashfs"
        ];
        fsType = "squashfs";
        device = "/sysroot/nix/pxe-server-squashfs/squashfs.squashfs";
        options = [
          "loop"
          "threads=multi"
        ];
        neededForBoot = true;
      };

      fileSystems."/nix/.rw-store" = mkImageMediaOverride {
        fsType = "tmpfs";
        options = [ "mode=0755" ];
        neededForBoot = true;
      };

      fileSystems."/nix/store" = mkImageMediaOverride {
        overlay = {
          lowerdir = [ "/nix/.ro-store" ];
          upperdir = "/nix/.rw-store/store";
          workdir = "/nix/.rw-store/work";
        };
        neededForBoot = true;
      };

      boot.kernelParams = [
        "ip=dhcp"
        "rd.shell"
        "rd.systemd.unit=emergency.target"
      ];

      boot.initrd.supportedFilesystems = [
        "nfs"
        "nfsv4"
      ];

      boot.initrd.availableKernelModules = [
        "squashfs"
        "overlay"
        "nfs"
        "nfsv4"
        "r8169"
        "e1000"
        "e1000e"
        "igb"
        "ixgbe"
        "tg3"
        "bnx2"
        "bnx2x"
      ];

      boot.initrd.kernelModules = [
        "loop"
        "overlay"
      ];

      system.build.nixStore = nixStore;
      system.build.squashfsStore = squashfsStore;

      # Create the initrd
      system.build.netbootRamdisk = pkgs.makeInitrdNG {
        inherit (config.boot.initrd) compressor compressorArgs;
        prepend = [ "${config.system.build.initialRamdisk}/initrd" ];
        contents = [ ];
      };

      boot.loader.timeout = 10;

      boot.postBootCommands = ''
        # After booting, register the contents of the Nix store
        # in the Nix database in the tmpfs.
        ${config.nix.package}/bin/nix-store --load-db < /nix/store/nix-path-registration

        # nixos-rebuild also requires a "system" profile and an
        # /etc/NIXOS tag.
        touch /etc/NIXOS
        ${config.nix.package}/bin/nix-env -p /nix/var/nix/profiles/system --set /run/current-system

        # Set password for user nixos if specified on cmdline
        # Allows using nixos-anywhere in headless environments
        for o in $(</proc/cmdline); do
          case "$o" in
            live.nixos.passwordHash=*)
              set -- $(IFS==; echo $o)
              ${pkgs.gnugrep}/bin/grep -q "root::" /etc/shadow && ${pkgs.shadow}/bin/usermod -p "$2" root
              ;;
            live.nixos.password=*)
              set -- $(IFS==; echo $o)
              ${pkgs.gnugrep}/bin/grep -q "root::" /etc/shadow && echo "root:$2" | ${pkgs.shadow}/bin/chpasswd
              ;;
          esac
        done
      '';

      boot.initrd.systemd.emergencyAccess = true;
    };
}