istanbul: set root password

hosts/istanbul.mod.nix → hosts/istanbul/istanbul.mod.nix

@@ -1,6 +1,5 @@
 {
   self,
-  inputs,
   lib,
   ...
 }:
@@ -64,6 +63,9 @@ in
 
         boot.initrd.availableKernelModules.e1000e = true;
 
+        secrets.password.file = ./password.age;
+        users.users.root.hashedPasswordFile = config.secrets.password.path;
+
         persist.enable = true;
         persist.passwordFile = "/media/key/.bcachefs.key";
 
@@ -96,7 +98,7 @@ in
           };
         };
 
-        hardware.report = ./istanbul.report.json;
+        hardware.report = ./report.json;
         system.stateVersion = "25.11";
       }
     );
@@ -106,33 +108,43 @@ in
     modules = singleton (
       { pkgs, ... }:
       let
-        inherit (lib.attrsets) mapAttrsToList;
         inherit (lib.lists) singleton;
         inherit (lib.meta) getExe;
-        inherit (lib.strings) concatStringsSep;
 
         istanbul = self.nixosConfigurations.istanbul;
+
+        toplevel = istanbul.config.system.build.toplevel;
       in
       {
         imports = modules ++ singleton self.nixosModules.iso;
 
-        environment.etc."install-closure".source = pkgs.closureInfo {
-          rootPaths = [
-            istanbul.config.system.build.toplevel
-            istanbul.config.system.build.diskoScript
-          ];
-        };
-
         environment.systemPackages = [
-          (pkgs.writeShellScriptBin "install-istanbul" /* bash */ ''
-            set -euo pipefail
+          (pkgs.writeScriptBin "install-istanbul" /* nu */ ''
+            #!${getExe pkgs.nushell}
+
+            def main [] {
+              if (^id --user | into int) != 0 {
+                error make { msg: "install-istanbul must run as root" }
+              }
+
+              let mountpoint = "/mnt"
+
+              mkdir $mountpoint
+              # bcachefs format refuses unless the mount-point parent is 0755.
+              ^chmod 755 $mountpoint
+
+              DISKO_SKIP_SWAP=1 ^${istanbul.config.system.build.diskoScript}
+
+              (^nix copy
+                --no-check-sigs
+                --to $"local?root=($mountpoint)"
+                ${toplevel})
 
-            exec ${
-              getExe inputs.disko.packages.${pkgs.stdenv.hostPlatform.system}.disko-install
-            } --flake "${self}#istanbul" ${
-              istanbul.config.disko.devices.disk
-              |> mapAttrsToList (name: { device, ... }: ''--disk ${name} "${device}"'')
-              |> concatStringsSep " "
+              (^nixos-install
+                --no-channel-copy
+                --no-root-password
+                --system ${toplevel}
+                --root $mountpoint)
             }
           '')
 

hosts/istanbul/password.age

@@ -0,0 +1,13 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGV5a1UxdyBhU3Vx
+SWlDWStUbTVndm9qOEdKb2RxNEFvNks2K0NxSW1hcWY5SFordjFVCmhodDExMzYy
+Uk1rQkpEdkJJaURuTCs1dCtTR2pnTXlXSEZsVWRSK3hkbGcKLT4gc3NoLWVkMjU1
+MTkgQ3pxYlBRIGtBS1lHVW41UWhHL1NOU3c4TEgzWFkwWFRQYjZzd0pXZElNWWNE
+Zm5BRDQKbENFYXNkN01sd0haQ0w3SStjZUUxSm9hM05OMjIvQzhWR1poaEVsMWFs
+bwotPiA4fS1ncmVhc2UgfUxHMFlXCkdSY0JZUlVJdExCMm0vV01FYW1IZmwxbWhv
+TFVnb08vVXVWK1hMdUxaWFdQdmZ0ajJ6U09hdCtUR1VlUE4yWlcKT1JVdHljWThT
+QQotLS0gTXF2NkVCckF1M3hmRDRxYVVvNUdIVWFSeitzbGR1cmhkVE5XNndaZDl5
+awo5AO2/3XzJdTmZhD2NhKLDsO84YpVOcRQ+VmwhGLH1iSUmvMGEgsMEaW70Nd3f
+Pp0yuWjLwRfLXbDO5EhIhPhMiGx0b63JHbGJXERS6X5FGTJZQaklIER+NHes8/Sl
+TdRn4YLtgkOhkBql
+-----END AGE ENCRYPTED FILE-----

modules/network/password.env.age

@@ -1,20 +1,18 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDh5M1Q2dyBodm1n
-SHhkVk1UZzRzSmsxbWpNM2xJR0tzY3pqVXIyOXYzbWJ0WW5ELzNjCjczQWg0NzB6
-YncxbEZCZ0lpakRmN3lWMU13NDJlVVJkTWhzcjNueTdES1EKLT4gc3NoLWVkMjU1
-MTkgc3BGRlFBIGM5MURMVVlZOFRxUlVjNXpORlEzSWJrY1BWZGRsKy8wSXpmZzVz
-T2FURmcKZU43bWNYdHc2dUQ0NElKalNuTDhhR0lJcXRlS2NrNlI3NFpZaENEdVlu
-UQotPiBzc2gtZWQyNTUxOSBleWtVMXcgUWF5MEdQb2FxZHhqRXI1S0l3emZxZWUw
-RTNXdTl2cFVJWVRrZityRk96OApKY0M0enRITGpic21NSnE1MGtnUlB3YlRGbGMy
-K2V5dmVHaG1xUkxXQ3FBCi0+IHNzaC1lZDI1NTE5IGRBU2xCUSBRdG4wVU9Xd2xT
-a0VhMVljc3R2K3N4S3hycDg0d1FuNjZheDFRbDVjSEhFCnFGazJVVTJIYzd2cmpu
-MEJrRE9NYzYvWWhLbmliakF0MVAxYS9aZFNJRmcKLT4gc3NoLWVkMjU1MTkgQ3px
-YlBRIFNkYUtYN3BBSUhib2JSTzNiLzBXdFBwTlFaRS9ZYVJSQnV2Q0NyV3hHQzgK
-MmR2OXgzZWR5bHc0YU94cG1VT2dKdlVyL1hZYVJZSHhqcjhIbXdwMU1qdwotPiBw
-YEU2WGctZ3JlYXNlICouOjt2WVcgWSNRWkR4IGQzNyB0O1JpCmw2WHkrVVhlLy9L
-TjhwWG1MYm1kSVVwN1NxRlM5NG5uYXYyN2VuN0F2cHZTbUIzNXUzRTMzVWpzUVkw
-dys4ekEKYkl3anl3N3pLVGR0VVhDY2tMMlpmMDNtNVZVNEE1LzdhUHNhRGZuQTNv
-SElkY3hmUmNKd2txRQotLS0gTFIwZlFnQkl6TjZGWVJvR2pYeGRhL1lwWTd4ZGlR
-blpkNHVDWW5tN1NZWQrbGgOxs6LVVR80bV3+Y73gatQmQdI1UmPOV1YOK6xG5Y4D
-gBAotTtpjt4CpfNwh28i3A6A
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDh5M1Q2dyA1a0dP
+MXBieXpDL1FwMmpNWDhrSXFBVjg3OE9Sc1ZlTXRrc3pLZ1V0cDFJCjMrRUxTcDcy
+WVkrek5OcVRnMUdhVFAyS3FDZHl3S0x3cmJIMklrNnVWNncKLT4gc3NoLWVkMjU1
+MTkgc3BGRlFBIHlKa2grRXRObHNSRVdyRmVtU2Z6aWFJcjZFWmVyRHY0aENiZXpz
+bmNKVG8KS1RaZHVJWDBqZnVQRTRKSGpIQU9zWVlMd3VwaDY0dDU2OEdocVhLODFJ
+cwotPiBzc2gtZWQyNTUxOSBleWtVMXcgWmFwY0pPMWdwa0V1L3V2VFFQMlJ1NStI
+NDBxbWdSZHkxcFlWTHJ5QWRFOAp6bGY2MG5oMTU1N1NvSFBXaksvam9PT25tQjJH
+K0poRmdnSGtLV2t5VkhRCi0+IHNzaC1lZDI1NTE5IGRBU2xCUSBzbkNVaTFFVmtF
+d1dkTDdoRVUvL3h5VVJmSjE2MWpBNndrOU1tZmgrMjNrCjJzaXB2OGp1L1FyVXVa
+alJSMk9Vck5YQ2Rna1VYSnlrQkh6S0l1QnRJV3cKLT4gc3NoLWVkMjU1MTkgQ3px
+YlBRIGw3eTQ1NE4zMEJFQ1M2bnl3VXM1SGcyY1hvbzJIVzVHK05BZCtRQ3pjUkkK
+RGtZV2Z2c1hGaUhHbCsvZm56RDdIaUx2dkVWZFA1VmloOGVlMDVNcDAzSQotPiBL
+ZjBZLWdyZWFzZSA2JTpBcjJWJSBYe1hPICxIemxGRWoKd3JJYzlRQ3g3YVVJQkFH
+aVUvdE0KLS0tIDhRNjR3T1Y5K2FBbzk5bERKclRJeUJ5UG0zQW9xV3grOFZoMUxD
+RVBVS00KlJMr/A0p2G/1meotreWgSM6r8VCaweG8uTYjYpctfSI9v6IIp4zJje6b
+PORNBzk5SNhasQ==
 -----END AGE ENCRYPTED FILE-----

modules/radicle/radicle.age

@@ -1,27 +1,27 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDh5M1Q2dyBwbXBp
-ZkxEbEdWY0k4V29qMTZzWVNqNmE0aFNTQi9iZ2lwelNMdG93SXpvCjUrNFpCQ3B2
-QWF6MzlEOXZzalhhNHhpTXNUVzZtOUphL280THJPWkUzWU0KLT4gc3NoLWVkMjU1
-MTkgc3BGRlFBIGVacEd3TnM4c1M1WkRRNjhJY2ZhVFZsNnZ0YmJacjRLNHVZUGhk
-cFplaU0KNzZtczUwWmdjdlVteDgwN2Q1YzdwT3p6SVh3MGxlUllOZFV3WWRXNmpq
-dwotPiBzc2gtZWQyNTUxOSBleWtVMXcgZWY1NzlXTmpDbllnUytjeXBlQTRORFFm
-TWFxR2JnZExoQWEvaWxVM2ZGbwoyQVNCOVFtSFgwTXpQZitDLy9LY1NzREVSdVRD
-OGRvbzA5dUZSYVdZdkdJCi0+IHNzaC1lZDI1NTE5IGRBU2xCUSB2YjcwUUh1K2F0
-YklPTzNzeENCQnBVYVhlb2RBek8zZEkzdCtoTHVkd3hRCitNSlgzUkMwc2YzVFdj
-RVhOK20zWmpjYWcrM0JFSld4UXJ4Mm51NXFXU2sKLT4gc3NoLWVkMjU1MTkgQ3px
-YlBRIDN0ZmorK29UME05Yjk4c3Jsa3NSWWNJcWd3ZHBLR1hMclhVaXFOb3MyZ28K
-WC9pTXhMVWZSL0NkZktOK3dlTm1NS1I3Y2ZrZ2Q2bjAzd2NYUlVOT2ZTOAotPiB2
-ckFvLWdyZWFzZSAjUgp1cGhMM3lrVjJCaGlzdjV3L2o1Rko0eC9GdWFtUmwwelpV
-anVYUFNJK0ZVQUtKbGNibXJrcDJNY2xJQkcrYmFyCjhQcEM0bEdVelQwdGZLSkVW
-MWNHYTlscEZEVWRBRGtnTGcKLS0tIDRyQmREaCs0MTQrZFBWaWw3QUsxM2VvMndi
-dXlpYzZab0h1aVVPeXY3YTQKKXviQVPL4Wvhujj76/i8gbAI5eOvIIsS9v82TEYu
-0xUAuqf+sq9T2hAq1MkwUeSdpKrNKqDWS+MtWq2+NzSCsBkjIfLr8aspjUYzvb2k
-+n2mUcvtkkfZ5+fHAAfTsI7H7x+jvQb4idwVvScGI84UOZiR2s8S4zjVs1YHfuRa
-1CU3F81rYbnVuHlsxmZQerHEvUM9iQEnoXoG9BSHi3Z5IVCsqrc7G0hQEVnQ3dj0
-Lp+KUa0zvYEAjV6enZOPvCQZeGaqiWl72E6FpQg1XYXvP3SuLs7zSIzQP5w3Fyi5
-GYWPIhxNluXPn3buqj4q1td6X0e001S7bXFNm/3vbI7o1ZDn22sm68lkqLKaUfA7
-oPBq91N4bgEdYBPzxfMJKVhNT+Jze32znwlykw5D/+Nx//eXHRtlaKSPD52KLj5g
-v1XY3jz1/Ll5yZhYzs4/KqoJINBk7IFW+L3GnUoQcdOWo6ohqW6TzcXY2pPmP8tf
-1ySISI04zHpqctMUjmurbsE0dNeDGe9s4j9i0bwLzYOd6u558ex1jeKTE5j8b1zp
-kh3ziv2ZoU13qK6p+7zOId4=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDh5M1Q2dyBncW9t
+Q3hnQkVCUkFGMEk2djh3WHJrNlhSdi9tYll2RUZReDBFL01oTWhzCndYOUMrbjZp
+ZlVTYzJ0d0t2aUN6TTFObWE5TFBQaXBoc3lPWlZTK2I3eWcKLT4gc3NoLWVkMjU1
+MTkgc3BGRlFBIGE4clVRSU1wdVljYUxlcGhDVlRCRkdvSno3SE8xTEtCNjUvSVVo
+QnZmaW8KREoxR1dTRlRNejRHb3ZTVHhZTkdVcUZNWE01YW5sbTRIWmROL2lMSHJa
+OAotPiBzc2gtZWQyNTUxOSBleWtVMXcgWUltVTE5elRONlZ0WlVoSVluSjZJN0VN
+bXV0UmJOdzJUY0syRk9FTHhUbwovYThiOTZ3VTBvdEFnZnZKYlV1cEJLNlA4dndt
+NHRzUTVIMzUrNlMyR1JNCi0+IHNzaC1lZDI1NTE5IGRBU2xCUSA2UG90S2c3S0pC
+L2hLNmNkSU9WbU10azhmYk05bmF4TkdmV1lkYnl4WVFrCldhWjA1eGwwZzdOWDFo
+WXBjSENocWV0cTR3VmhkeUpYVGZPZ2g1dUdDL00KLT4gc3NoLWVkMjU1MTkgQ3px
+YlBRIDNCUGhGSFlPQmFoZlpYUTZFVTdTamd1TGtpLzZYZXd0UHRMSW5tamkyaVUK
+dzhpNlBuZkFucnE5a0doak9JdGY3YVVlMU8zMVUrQm1EQU1wa0c0eHhobwotPiBf
+YUFfTS1ncmVhc2UgJFUgIXYgLn1LPiBoJmxjfl02CndubVVJT05FWGcyZUI3TVFU
+bWEwaU9PMVR3c2N3VVU4Nm93ZHlxU3R3SDJGNDhkMllDWm5zWHpveTdoN0xVc20K
+anQxVjVlUTA4U0xtCi0tLSA1aFhXNUJSRWg5dGNQM08vU3ZyQ0RPSlorMDlYK2ww
+cVEwRlRSdlpaVW1nCq++4y2OBurcPJT2hsgERhcUJpopbayJ+TbLHflNxA9iwIph
++lTiKxLkwmK83jNnmVBavOnaO8gKJbAEigRl4m5fITDH0Orsk+Ao9O3vwwwjkC8H
+ocJKnANW4EUgNFe4x3/7I1QnZQmv8B1MhGRtNke5ckIHOe4QQGmPqDW4cLLrrprB
+YlG0XnjQ/RRzahYoQ9ob0PZtfZWXcBPFCPjvXHO8LScE6YJ/psAVkq3fD+m0ypk2
+zA9jIf32t19nsnFLZrabJTKK2e+QczYC2r7ZEUF4fVqRAyfo+zVjRHYOcFJOLBUR
+A5gg3NvC1B99O2xl/PtYkQmGuKHLfuNQ/liJuIAvDewvgNZIcht1z+K079m0YwjL
+vzHyGsjy5JlDWXW6qAP/pc/5lfeHMSFHTWYFRY24y3c5ACuu8yLXsB6pVONG5WDE
+cfB+K93yTwwu7ZHYukYU6YN+e2wq46AmBReEcGebVWw0m9H7Odh0Jy/EgJ9smwbJ
+rd6ooikizO7kNnY0YyHgx/rXHkkagT5NXvLj0wjZNZCYPQwrYhXUwmHDKMTzl0KN
+6vU4cRe/btRi2bvq
 -----END AGE ENCRYPTED FILE-----

modules/tailscale/tailscale.secret.age

@@ -1,20 +1,18 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDh5M1Q2dyBOZ2Z3
-d2dZaXdqajY3c3dBcEVub29CK2RkNThHVUlYcHN4OXQ1YnFVTFZrClFuYkdTU2h0
-MlRUY2ZHb0JYUGJBNWtjeFdmTjFadWR0T1d3YkV3RXhUQUkKLT4gc3NoLWVkMjU1
-MTkgc3BGRlFBIDlKZ3NNditlakZYM0o4WkJqYng1ZEhMb0F2YWg5N2VvOFR0VC9l
-ZTRkSGsKTWswYWZLMXFjbTVKdlJrSzNHMFpOak5mV2NvdDFhUWl6UmN1azZ3SlRG
-NAotPiBzc2gtZWQyNTUxOSBleWtVMXcgV3ZVUGRkM1N3WjdYQXpkcEpNR3p3dGZn
-LzFpell1dGFSVUNYbW1GYjl4TQprM2sxYWJKS2cycS9lQytWb2M3SndOOE1pOTJa
-T2hrNVcwMU1KU0pZQk5ZCi0+IHNzaC1lZDI1NTE5IGRBU2xCUSBlK25Td1hwWFZp
-T0gzcyt6UVpJVmt5dmZ5Ly82UnNSdTh3aHY2RnVENEVRCnU0aEI1MmgxbEp5NkNu
-SUIxMHk1bmZmTHNmWUEvNTZDRDFoSkdhTmdxVDAKLT4gc3NoLWVkMjU1MTkgQ3px
-YlBRIEI0OUpXNVdPa0VNRWxjQ2h4MXBWUjNjRnRsbnFTYTBVbVVUMTdHcDczQ1UK
-S040bW5ia0JhTnlJSEw2MGEvTGhNRHdSaGlMd1d2aEd6L0lmdG55RzFnQQotPiBa
-bGdCWy1ncmVhc2UgVyBcTEMvPiBaQD9MJGY1QAowdjdHVUtkdE1EZGhudk9rckFQ
-WXhoYVhaNjlIU2RDZExQVWlZcDZONyt3YzFISjJVaHlOY1RpeEV0bUdsblBqCmhu
-bnNXT2lOSjFGY0VwZTJBbkxKRy9UenY3ZzRhUWdnT2hKK2RFUDM1Q0pTNkFROUpW
-OAotLS0gejBrYlVDc0RvUXA5UDlIK1JEWTgwVWx4OWNmTDZsUS9nSldpQVZNSU5t
-UQpmjiRefTN03B+4a8gT5IXETAPCZxeDBQXV1MPDlQGUltuFEcetCCf95hiyre8D
-A/4ntck7o5BPzj/d26iMY7jCTbe6Qf5zJnJpH74w/FTJik/L3MZr2mQtJDqHJFCt
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDh5M1Q2dyBteTN5
+TXFOTjM4c2RpZnpnWmhXSm9EbHlyOTE1UXQ3QmpISEFHWXQxb3kwCjd1ajhDSXBt
+U2VaVjFKcTA2NzJFaU94S0ZQV1gyTWpYT0FBK0VRWndDa28KLT4gc3NoLWVkMjU1
+MTkgc3BGRlFBIHRZQ1JQV3NXNHNsNEprVFJHNmZ0dmQzT3cxRlVYWkdKQnFvSS9j
+dDA4MkUKUWtvNmZTNXU4Y3IrV05GallNNnVzYTIxZitTcy8ybHI4cFcwUmxvbHYx
+RQotPiBzc2gtZWQyNTUxOSBleWtVMXcgNTNEamhBV2t1NVhROXVFanhYUmRHajhV
+dnh4TlhFY2Q4WE81SlpPWGlscwpQQ3NQRmt5aGhwNXlKMG0wc1drMURXTzBNUnYy
+eHRFZldtaWpzUDV5d3NJCi0+IHNzaC1lZDI1NTE5IGRBU2xCUSBGU0N2M0trMWpw
+cjBhN3JtR0dCZ3F0Qmx1RExFVlNPeXkxdEdkcHlpeDI4CmpyVzVNVDYrWmRHY0FI
+UkNsSjNoQUNxL0RIYmhRVlJod1cvYU5LNFZpcVkKLT4gc3NoLWVkMjU1MTkgQ3px
+YlBRIGdwamJ0Mm1rdUVEMFA1WEFlRTYwbzVxYWJBN0F0emdRUDZWUjJQalROSFUK
+NXFNOUN6NXlYd2c4Qng1aVNLZE9hMFpBMzNVZEliVklUT2tQaElQN2JXMAotPiBV
+XXpcYS1ncmVhc2UgdyBcIEgKOC9IOE52bTQ4YTdlWWthZmYxWFFEYzdDdVEKLS0t
+IC9Mc3RJR21wNkI3REt2NGlrb3k1SzNVRTJyc2Q0d2JpWlFvRVhPQmRCZHcKohqj
+fuirt087kPPh6Nx83hsiXiO5ehxqrgBgo3j3MWx4zULv9nHuzk0y68Xs9f5N90Wt
+D+kqxRBgpe2FokTTBkvCSlqi0ER2VKvMkvSR1Chj4pilf3QdmUhD/cmV3w==
 -----END AGE ENCRYPTED FILE-----