improved dedicated hetzner server install script

scripts/hetzner-dedicated-wipe-and-install-nixos.sh

@@ -21,15 +21,37 @@
 # * We set a custom `configuration.nix` so that we can connect to the machine afterwards,
 #   inspired by https://nixos.wiki/wiki/Install_NixOS_on_Hetzner_Online
 # * This server has 2 HDDs.
-#   We put everything on RAID1.
+#   We encrypt all hard drives and put an LVM on it the main logical volume is mirrored
-#   Storage scheme: `partitions -> RAID -> LVM -> ext4`.
+#   Storage scheme: `partitions -> dm-crypt -> LVM -> ext4`.
+#
+#   ┌────────┐                      ┌────────┐
+#   │  sda1  │   ◄──── grub  ─────► │  sdb1  │
+#   ├────────┤                      ├────────┤
+#   │  sda2  │   ◄──── /boot ─────► │  sdb2  │
+#   ├────────┤                      ├────────┤
+#   │  sda3  ├───┐              ┌───┤  sdb3  │
+#   └────────┘   │              │   └────────┘
+#                │              │
+#   ┌────────────▼┐            ┌▼────────────┐
+#   │ a_encrypted │            │ b_encrypted │
+#   └────────┬────┘            └────┬────────┘
+#            │     ┌──────────┐     │
+#            └─────►  LVM vg  ◄─────┘
+#                  └────┬─────┘
+#                       │
+#         ┌─────────────▼──────────────┐
+#         │ root (mirrored/raid1)      │
+#         ├────────────────────────────┤
+#         │ nextcloud (mirrored/raid1) │
+#         ├────────────────────────────┤
+#         │ media (raid0)              │
+#         └────────────────────────────┘
 # * A root user with empty password is created, so that you can just login
 #   as root and press enter when using the Hetzner spider KVM.
 #   Of course that empty-password login isn't exposed to the Internet.
 #   Change the password afterwards to avoid anyone with physical access
 #   being able to login without any authentication.
 # * The script reboots at the end.
-
 # * does not use uefi (check if you can : efibootmgr)
 # Notes https://mazzo.li/posts/hetzner-zfs.html
 
@@ -44,6 +66,9 @@ set -x
 # Inspect existing disks
 lsblk
 
+# Cleanup
+# -------
+
 # Undo existing setups to allow running the script multiple times to iterate on it.
 # We allow these operations to fail for the case the script runs the first time.
 set +e
@@ -54,42 +79,23 @@ cryptsetup close a_encrypted
 cryptsetup close b_encrypted
 set -e
 
-
 # Stop all mdadm arrays that the boot may have activated.
 mdadm --stop --scan
 
-# Prevent mdadm from auto-assembling arrays.
-# Otherwise, as soon as we create the partition tables below, it will try to
-# re-assemple a previous RAID if any remaining RAID signatures are present,
-# before we even get the chance to wipe them.
-# From:
-#     https://unix.stackexchange.com/questions/166688/prevent-debian-from-auto-assembling-raid-at-boot/504035#504035
-# We use `>` because the file may already contain some detected RAID arrays,
-# which would take precedence over our `<ignore>`.
-echo 'AUTO -all
-ARRAY <ignore> UUID=00000000:00000000:00000000:00000000' > /etc/mdadm/mdadm.conf
-
 # Create partition tables (--script to not ask)
-#parted --script /dev/sda mklabel gpt
+# ---------------------------------------------
-#parted --script /dev/sdb mklabel gpt
-
-#parted /dev/sda -- mklabel gpt
-#parted /dev/sda -- mkpart ESP fat32 1MiB 512MiB
-#parted /dev/sda -- set 1 boot on
-#parted /dev/sda -- mkpart primary 512MiB 100%
 
 format() {
-  parted -s "$1" -- mklabel gpt
+  parted --script "$1" -- mklabel gpt
 
-  parted -s "$1" -- mkpart 'BIOS-boot-partition' 1MB 2MB set 1 bios_grub on
+  parted --script "$1" -- mkpart 'BIOS-boot-partition' 1MB 2MB set 1 bios_grub on
-  #parted -s "$1" -- mkpart 'boot' 2MB 512MiB
+  #parted --script "$1" -- mkpart 'boot' 2MB 512MiB
-  #parted -s "$1" -- mkpart ESP fat32 2MB 512MiB
+  #parted --script "$1" -- mkpart ESP fat32 2MB 512MiB
-  parted -s "$1" -- mkpart ESP fat32 2MB 512MiB set 2 boot on
+  parted --script "$1" -- mkpart 'boot' fat32 2MB 512MiB set 2 boot on
 
-  #parted -s "$1" -- mkpart ESP fat32 1MiB 512MiB
 
-  parted -s "$1" -- mkpart primary 512MiB 100%
+  parted --script "$1" -- mkpart primary 512MiB 100%
-  parted -s "$1" -- print
+  parted --script "$1" -- print
 }
 
 # In this particular machine we have two NVMe disks
@@ -97,26 +103,8 @@ format /dev/sda
 format /dev/sdb
 
 
-# Create partitions (--script to not ask)
-#
-# We create the 1MB BIOS boot partition at the front.
-#
-# Note we use "MB" instead of "MiB" because otherwise `--align optimal` has no effect;
-# as per documentation https://www.gnu.org/software/parted/manual/html_node/unit.html#unit:
-# > Note that as of parted-2.4, when you specify start and/or end values using IEC
-# > binary units like "MiB", "GiB", "TiB", etc., parted treats those values as exact
-#
-# Note: When using `mkpart` on GPT, as per
-#   https://www.gnu.org/software/parted/manual/html_node/mkpart.html#mkpart
-# the first argument to `mkpart` is not a `part-type`, but the GPT partition name:
-#   ... part-type is one of 'primary', 'extended' or 'logical', and may be specified only with 'msdos' or 'dvh' partition tables.
-#   A name must be specified for a 'gpt' partition table.
-# GPT partition names are limited to 36 UTF-16 chars, see https://en.wikipedia.org/wiki/GUID_Partition_Table#Partition_entries_(LBA_2-33).
-#parted --script --align optimal /dev/sda -- mklabel gpt mkpart 'BIOS-boot-partition' 1MB 2MB set 1 bios_grub on mkpart 'data-partition' 2MB '100%'
-#parted --script --align optimal /dev/sdb -- mklabel gpt mkpart 'BIOS-boot-partition' 1MB 2MB set 1 bios_grub on mkpart 'data-partition' 2MB '100%'
-
 # Relaod partitions
-#partprobe
+partprobe
 
 # Wait for all devices to exist
 udevadm settle --timeout=5 --exit-if-exists=/dev/sda1
@@ -126,31 +114,6 @@ udevadm settle --timeout=5 --exit-if-exists=/dev/sdb1
 udevadm settle --timeout=5 --exit-if-exists=/dev/sdb2
 udevadm settle --timeout=5 --exit-if-exists=/dev/sdb3
 
-# Wipe any previous RAID signatures
-#mdadm --zero-superblock --force /dev/sda2
-#mdadm --zero-superblock --force /dev/sdb2
-
-# Create RAIDs
-# Note that during creating and boot-time assembly, mdadm cares about the
-# host name, and the existence and contents of `mdadm.conf`!
-# This also affects the names appearing in /dev/md/ being different
-# before and after reboot in general (but we take extra care here
-# to pass explicit names, and set HOMEHOST for the rebooting system further
-# down, so that the names appear the same).
-# Almost all details of this are explained in
-#   https://bugzilla.redhat.com/show_bug.cgi?id=606481#c14
-# and the followup comments by Doug Ledford.
-#mdadm --create --run --verbose /dev/md0 --level=1 --raid-devices=2 --homehost=hetzner --name=root0 /dev/sda2 /dev/sdb2
-
-# Assembling the RAID can result in auto-activation of previously-existing LVM
-# groups, preventing the RAID block device wiping below with
-# `Device or resource busy`. So disable all VGs first.
-#vgchange -an
-
-# Wipe filesystem signatures that might be on the RAID from some
-# possibly existing older use of the disks (RAID creation does not do that).
-# See https://serverfault.com/questions/911370/why-does-mdadm-zero-superblock-preserve-file-system-information
-#wipefs -a /dev/md0
 
 # Disable RAID recovery. We don't want this to slow down machine provisioning
 # in the rescue mode. It can run in normal operation after reboot.
@@ -170,32 +133,31 @@ encrypt /dev/sdb "b"
 
 
 
+# /boot partitions
+# ----------------
+
+
+mkfs.fat -F 32 -n boot /dev/sda2
+mkfs.fat -F 32 -n boot /dev/sdb2
+
+
+
 # PVs
-#pvcreate /dev/md0
 
 pvcreate /dev/mapper/a_encrypted
 pvcreate /dev/mapper/b_encrypted
 
 # VGs
 vgcreate vg /dev/mapper/a_encrypted /dev/mapper/b_encrypted
-#vgcreate vg0 /dev/md0
+
 # LVs (--yes to automatically wipe detected file system signatures)
 
 # the root partition should be raid1
-#lvcreate --mirrors 1 --type raid1 -L 150G --nosync -n root vg
 lvcreate --mirrors 1 --type raid1 -L 150G -n root vg
 
 # Filesystems (-F to not ask on preexisting FS)
 mkfs.ext4 -F -L root /dev/mapper/vg-root
 
-#mkfs.ext4 -F -L boot /dev/sda2
-mkfs.fat -F 32 -n boot /dev/sda2
-#mkfs.vfat -n boot /dev/sda2
-
-#mkfs.ext4 -F -L boot /dev/sdb2
-mkfs.fat -F 32 -n boot /dev/sdb2
-#mkfs.vfat -n boot /dev/sdb2
-
 # Creating file systems changes their UUIDs.
 # Trigger udev so that the entries in /dev/disk/by-uuid get refreshed.
 # `nixos-generate-config` depends on those being up-to-date.
@@ -206,6 +168,7 @@ udevadm trigger
 udevadm settle --timeout=5 --exit-if-exists=/dev/disk/by-label/root
 
 # NixOS pre-installation mounts
+# -----------------------------
 
 # Mount target root partition
 mount /dev/disk/by-label/root /mnt
@@ -215,6 +178,7 @@ mount /dev/sda2 /mnt/boot-1
 mount /dev/sdb2 /mnt/boot-2
 
 # Installing nix
+# --------------
 
 # Installing nix requires `sudo`; the Hetzner rescue mode doesn't have it.
 apt-get install -y sudo
@@ -238,6 +202,9 @@ nix-env -iE "_: with import <nixpkgs/nixos> { configuration = {}; }; with config
 
 nixos-generate-config --root /mnt
 
+# Detect
+# ------
+
 # Find the name of the network interface that connects us to the Internet.
 # Inspired by https://unix.stackexchange.com/questions/14961/how-to-find-out-which-interface-am-i-using-for-connecting-to-the-internet/302613#302613
 RESCUE_INTERFACE=$(ip route get 8.8.8.8 | grep -Po '(?<=dev )(\S+)')
@@ -274,6 +241,7 @@ cat > /mnt/etc/nixos/configuration.nix <<EOF
 { config, pkgs, modulesPath, lib, ... }:
 let
   hostName = "hetzner";
+  # FIXME configure network driver
   # in rescue
   # apt install -y lshw
   # lshw -C network | grep -Poh 'driver=[[:alnum:]]+'
@@ -291,34 +259,20 @@ let
     gateway = "fe80::1"; # the ipv6 gateway
     prefixLength = 64;   # shown in the control panel
   };
-
 in
 {
   imports =
     [ # Include the results of the hardware scan.
-      # ./hardware-configuration.nix
+      ./hardware-configuration.nix
-
-      #  hardware-configuration content
-      {
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
     ];
 
-  boot.initrd.availableKernelModules = [ "ahci" "sd_mod" ];
+  # needed lvm for raid
   boot.initrd.kernelModules = [
     "dm-snapshot"
     "dm_mirror"
     "dm_raid"
     "dm_region_hash"
   ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  swapDevices = [ ];
-  powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand";
-
-      }
-    ];
 
   # Use GRUB2 as the boot loader.
   # We don't use systemd-boot because Hetzner uses BIOS legacy boot.
@@ -336,9 +290,9 @@ in
     { path = "/boot-2"; devices = [ "/dev/sdb" ]; }
   ];
 
-  # add later
+  # We want to still be able to boot without one of these
-  # fileSystems."/boot-1".options = [ "nofail" ];
+  fileSystems."/boot-1".options = [ "nofail" ];
-  # fileSystems."/boot-2".options = [ "nofail" ];
+  fileSystems."/boot-2".options = [ "nofail" ];
 
   boot.initrd.luks.reusePassphrases = true;
   boot.initrd.luks.devices = {
@@ -352,14 +306,6 @@ in
     };
   };
 
-  # root
-  # ----
-  fileSystems."/" = {
-    options = [ "noatime" "nodiratime" "discard" ];
-    device = "/dev/vg/root";
-    fsType = "ext4";
-  };
-
   networking.hostName = hostName;
 
   # Network configuration (Hetzner uses static IP assignments, and we don't use DHCP here)
@@ -404,7 +350,6 @@ in
       /etc/secrets/initrd/ssh_host_rsa_key
       /etc/secrets/initrd/ssh_host_ed25519_key
     ];
-
   };
 
 }