free target env of seal-off command

README

@@ -1,8 +1,16 @@
+On build device:
+* nix-build
+* (for LAN builds) nix-build --arg mlabs true
+
+On target device:
 * Enter BIOS, disable secure boot, enable UEFI PXE network boot
 * sudo auto-install
+* sudo reboot
 * Run memtest86
 * Copy device database to ~/artiq
 * Set timezone and kb layout
 * Comment out openssh.authorizedKeys.keys
-* sudo seal-off
 * history clear
+
+On build device:
+* cat sealoff.sh | ssh rabi@artiq "sudo sh"

default.nix

@@ -41,23 +41,28 @@ let
     nixos-generate-config --root /mnt
     cp ${./final}/* /mnt/etc/nixos
     nixos-install --no-root-password --flake /mnt/etc/nixos#artiq
-    reboot
     ''; 
 
-  customModule = {
+  customModule = mlabs:
-    system.stateVersion = "24.05";
+    let storeUrl = "https://nixbld.m-labs.hk" + (if mlabs then "?priority=10" else "");
-    environment.systemPackages = [ autoInstall pkgs.git ];
+    in
-    documentation.info.enable = false; # https://github.com/NixOS/nixpkgs/issues/124215
+      {
-    documentation.man.enable = false;
+        system.stateVersion = "24.05";
-    nix.settings.trusted-public-keys = ["nixbld.m-labs.hk-1:5aSRVA5b320xbNvu30tqxVPXpld73bhtOeH6uAjRyHc="];
+        environment.systemPackages = [ autoInstall pkgs.git ];
-    nix.settings.substituters = ["https://nixbld.m-labs.hk"];
+        documentation.info.enable = false; # https://github.com/NixOS/nixpkgs/issues/124215
-  };
+        documentation.man.enable = false;
+        nix.settings.trusted-public-keys = ["nixbld.m-labs.hk-1:5aSRVA5b320xbNvu30tqxVPXpld73bhtOeH6uAjRyHc="];
+        nix.settings.substituters = [ storeUrl ];
+      };
 
 in
-  makeNetboot {
+  { mlabs ? false }:
-    modules = [
+    let module = customModule mlabs;
-      <nixpkgs/nixos/modules/installer/netboot/netboot-minimal.nix>
+    in
-      customModule
+      makeNetboot {
-    ];
+        modules = [
-    system = "x86_64-linux";
+          <nixpkgs/nixos/modules/installer/netboot/netboot-minimal.nix>
-  }
+          module
+        ];
+        system = "x86_64-linux";
+      }

final/configuration.nix

@@ -1,14 +1,6 @@
 { config, pkgs, artiq, ... }:
 
-let
+{
-  sealOff = pkgs.writeShellScriptBin "seal-off"
-  ''
-  set -e
-  nixos-rebuild boot
-  nix-collect-garbage -d
-  '';
-
-in {
   imports =
     [
       ./hardware-configuration.nix
@@ -44,7 +36,6 @@ in {
 
   nixpkgs.config.allowUnfree = true;
   environment.systemPackages = with pkgs; [
-    sealOff
     wget
     vim
     gitAndTools.gitFull

sealoff.sh

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+set -e
+nixos-rebuild boot
+nix-collect-garbage -d