...

1 files changed, 92 insertions, 0 deletions

diff --git a/installer/shell.nix b/installer/shell.nix
new file mode 100644
index 00000000..043f0ddc
--- /dev/null
+++ b/installer/shell.nix
@@ -0,0 +1,92 @@
+{ system, installerName, config
+, runCommand, makeWrapper, pixiecore, writeShellApplication, coreutils, busybox, nftables, mkShell
+}:
+
+let
+  pxeBuild = config.config.system.build;
+  pixiecore-wrapped = runCommand "pixiecore-${system}-${installerName}" {
+    nativeBuildInputs = [ makeWrapper ];
+  } ''
+    mkdir -p $out/bin
+    makeWrapper ${pixiecore}/bin/pixiecore $out/bin/pixiecore-${installerName} \
+      --add-flags boot \
+      --add-flags "${pxeBuild.kernel}/bzImage" --add-flags "${pxeBuild.netbootRamdisk}/initrd" \
+      --add-flags "--cmdline \"init=${pxeBuild.toplevel}/init loglevel=4\"" \
+      --add-flags "-dt" --add-flags "--status-port 64172" --add-flags "--port 64172" --add-flags "--dhcp-no-bind"
+  '';
+  udhcpd = writeShellApplication {
+    name = "udhcpd";
+
+    runtimeInputs = [ coreutils ];
+
+    text = ''
+      [[ -n "''${INTERFACE-}" ]] || exit 2
+
+      _LEASES_FILE=$(mktemp --tmpdir udhcpd.XXXXXXXXXX.leases)
+      exec ${busybox}/bin/udhcpd -f <(cat <<EOF
+        interface $INTERFACE
+        lease_file $_LEASES_FILE
+        start 10.0.0.128
+        end 10.0.0.254
+        max_leases 127
+        opt dns 8.8.8.8
+        option subnet 255.255.255.0
+        opt router 10.0.0.1
+        option lease 30
+      EOF
+      )
+    '';
+  };
+  nft_apply = writeShellApplication {
+    name = "pxe-nft-apply";
+
+    runtimeInputs = [ nftables ];
+
+    text = ''
+      [[ -n "''${INTERFACE-}" ]] || exit 2
+
+      exec nft -f - <<EOF
+        table inet filter {
+          chain forward_tmp {
+            iifname $INTERFACE oifname != {lo, wgrz, yggdrasil-wg-4, yggdrasil-wg-6, yggdrasil, ip6tnl, ip6gre, yggre-surtr-6, yggre-surtr-4, yggre-vidhar-4, virbr0} counter accept
+            oifname $INTERFACE ct state {established, related} counter accept
+          }
+
+          chain input_tmp {
+            iifname $INTERFACE udp dport {67,69,4011} counter accept
+            iifname $INTERFACE tcp dport 64172 counter accept
+          }
+        }
+
+        table ip nat {
+          chain postrouting_tmp {
+            iifname $INTERFACE oifname != $INTERFACE counter masquerade
+          }
+        }
+
+        table ip mss_clamp {
+          chain postrouting_tmp {
+            iifname $INTERFACE oifname != $INTERFACE tcp flags & (syn|rst) == syn counter tcp option maxseg size set rt mtu
+          }
+        }
+      EOF
+    '';
+  };
+  nft_flush = writeShellApplication {
+    name = "pxe-nft-flush";
+
+    runtimeInputs = [ nftables ];
+
+    text = ''
+      exec nft -f - <<EOF
+        flush chain inet filter forward_tmp
+        flush chain inet filter input_tmp
+        flush chain ip nat postrouting_tmp
+        flush chain ip mss_clamp postrouting_tmp
+      EOF
+    '';
+  };
+in mkShell {
+  name = installerName;
+  nativeBuildInputs = [ pixiecore-wrapped udhcpd nft_apply nft_flush ];
+}