On build device:
* nix-build
* (for LAN builds) nix-build --arg mlabs true

On target device:
* Enter BIOS, disable secure boot, enable UEFI PXE network boot
* sudo auto-install
* sudo reboot
* Run memtest86
* Copy device database to ~/artiq
* Set timezone and kb layout
* Comment out openssh.authorizedKeys.keys
* history clear

On build device:
* cat sealoff.sh | ssh rabi@artiq "sudo sh"