README

@@ -1,16 +1,8 @@
-On build device:
-* nix-build
-* (for LAN builds) nix-build --arg mlabs true
-
-On target device:
 * Enter BIOS, disable secure boot, enable UEFI PXE network boot
 * sudo auto-install
-* sudo reboot
 * Run memtest86
 * Copy device database to ~/artiq
 * Set timezone and kb layout
 * Comment out openssh.authorizedKeys.keys
+* sudo seal-off
 * history clear
-
-On build device:
-* cat sealoff.sh | ssh rabi@artiq "sudo sh"

default.nix

@@ -41,28 +41,23 @@ let
     nixos-generate-config --root /mnt
     cp ${./final}/* /mnt/etc/nixos
     nixos-install --no-root-password --flake /mnt/etc/nixos#artiq
+    reboot
     ''; 
 
-  customModule = mlabs:
-    let storeUrl = "https://nixbld.m-labs.hk" + (if mlabs then "?priority=10" else "");
-    in
-      {
-        system.stateVersion = "24.05";
-        environment.systemPackages = [ autoInstall pkgs.git ];
-        documentation.info.enable = false; # https://github.com/NixOS/nixpkgs/issues/124215
-        documentation.man.enable = false;
-        nix.settings.trusted-public-keys = ["nixbld.m-labs.hk-1:5aSRVA5b320xbNvu30tqxVPXpld73bhtOeH6uAjRyHc="];
-        nix.settings.substituters = [ storeUrl ];
-      };
+  customModule = {
+    system.stateVersion = "24.05";
+    environment.systemPackages = [ autoInstall pkgs.git ];
+    documentation.info.enable = false; # https://github.com/NixOS/nixpkgs/issues/124215
+    documentation.man.enable = false;
+    nix.settings.trusted-public-keys = ["nixbld.m-labs.hk-1:5aSRVA5b320xbNvu30tqxVPXpld73bhtOeH6uAjRyHc="];
+    nix.settings.substituters = ["https://nixbld.m-labs.hk"];
+  };
 
 in
-  { mlabs ? false }:
-    let module = customModule mlabs;
-    in
-      makeNetboot {
-        modules = [
-          <nixpkgs/nixos/modules/installer/netboot/netboot-minimal.nix>
-          module
-        ];
-        system = "x86_64-linux";
-      }
+  makeNetboot {
+    modules = [
+      <nixpkgs/nixos/modules/installer/netboot/netboot-minimal.nix>
+      customModule
+    ];
+    system = "x86_64-linux";
+  }

final/configuration.nix

@@ -1,6 +1,14 @@
 { config, pkgs, artiq, ... }:
 
-{
+let
+  sealOff = pkgs.writeShellScriptBin "seal-off"
+  ''
+  set -e
+  nixos-rebuild boot
+  nix-collect-garbage -d
+  '';
+
+in {
   imports =
     [
       ./hardware-configuration.nix
@@ -36,6 +44,7 @@
 
   nixpkgs.config.allowUnfree = true;
   environment.systemPackages = with pkgs; [
+    sealOff
     wget
     vim
     gitAndTools.gitFull

sealoff.sh

@@ -1,5 +0,0 @@
-#!/bin/sh
-
-set -e
-nixos-rebuild boot
-nix-collect-garbage -d