blob: 08d78ade44ea218687ecb11e785b893ab5a370eb (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
|
{
config,
lib,
pkgs,
...
}:
with lib;
let
useHostResolvConf = config.networking.resolvconf.enable && config.networking.useHostResolvConf;
bootStage2 = pkgs.replaceVarsWith {
src = ./stage-2-init.sh;
isExecutable = true;
replacements = {
shell = "${pkgs.bash}/bin/bash";
systemConfig = null; # replaced in ../activation/top-level.nix
inherit (config.boot) systemdExecutable stage2Greeting;
nixStoreMountOpts = lib.concatStringsSep " " (map lib.escapeShellArg config.boot.nixStoreMountOpts);
inherit useHostResolvConf;
inherit (config.system.build) earlyMountScript;
path = lib.makeBinPath (
[
pkgs.coreutils
pkgs.util-linux
]
++ lib.optional useHostResolvConf pkgs.openresolv
);
postBootCommands = pkgs.writeText "local-cmds" ''
${config.boot.postBootCommands}
'';
};
};
in
{
imports = [
(lib.mkRemovedOptionModule
[
"boot"
"readOnlyNixStore"
]
"Please use the `boot.nixStoreMountOpts' option to define mount options for the Nix store, including 'ro'"
)
];
options = {
boot = {
postBootCommands = mkOption {
default = "";
example = "rm -f /var/log/messages";
type = types.lines;
description = ''
Shell commands to be executed just before systemd is started.
'';
};
nixStoreMountOpts = mkOption {
type = types.listOf types.nonEmptyStr;
default = [
"x-initrd.mount"
"ro"
"nodev"
"nosuid"
];
description = ''
Defines the mount options used on a bind mount for the {file}`/nix/store`.
This affects the whole system except the nix store daemon, which will undo the bind mount.
`ro` enforces immutability of the Nix store.
The store daemon should already not put device mappers or suid binaries in the store,
meaning `nosuid` and `nodev` enforce what should already be the case.
'';
};
systemdExecutable = mkOption {
default = "/run/current-system/systemd/lib/systemd/systemd";
type = types.str;
description = ''
The program to execute to start systemd.
'';
};
stage2Greeting = mkOption {
type = types.str;
default = "<<< ${config.system.nixos.distroName} Stage 2 >>>";
defaultText = literalExpression ''"<<< ''${config.system.nixos.distroName} Stage 2 >>>"'';
description = ''
The greeting message displayed during NixOS stage 2 boot.
'';
};
extraSystemdUnitPaths = mkOption {
default = [ ];
type = types.listOf types.str;
description = ''
Additional paths that get appended to the SYSTEMD_UNIT_PATH environment variable
that can contain mutable unit files.
'';
};
};
};
config = {
system.build.bootStage2 = bootStage2;
};
}
|
