1 files changed, 151 insertions, 107 deletions

diff --git a/hosts/vidhar/network/dhcp/default.nix b/hosts/vidhar/network/dhcp/default.nix
index 4151111d..e4c3f16e 100644
--- a/hosts/vidhar/network/dhcp/default.nix
+++ b/hosts/vidhar/network/dhcp/default.nix
@@ -1,9 +1,32 @@
-{ flake, config, pkgs, lib, ... }:
+{ flake, config, pkgs, lib, sources, ... }:
 
 with lib;
 
 let
   nfsrootBaseUrl = "http://nfsroot.vidhar.yggdrasil";
+  tftpIp = "10.141.0.1";
+  nfsIp = tftpIp;
+  ipxe = pkgs.ipxe.override {
+    additionalTargets = {
+      "bin-i386-efi/ipxe.efi" = "i386-ipxe.efi";
+    };
+    additionalOptions = [
+      "NSLOOKUP_CMD"
+      "PING_CMD"
+      "CONSOLE_CMD"
+    ];
+    embedScript = pkgs.writeText "yggdrasil.ipxe" ''
+      #!ipxe
+
+      cpair --background 9 1
+      cpair --background 9 3
+      cpair --background 9 6
+
+      set user-class iPXE-yggdrasil
+
+      autoboot
+    '';
+  };
 in {
   config = {
     services.kea = {
@@ -25,41 +48,67 @@ in {
           };
 
           client-classes = [
-            { name = "eostre-ipxe";
-              test = "hexstring(pkt4.mac, ':') == '00:d8:61:79:c5:40' and option[77].hex == 'iPXE'";
-              next-server = "10.141.0.1";
-              boot-file-name = "${nfsrootBaseUrl}/eostre.menu.ipxe";
+            # { name = "ipxe-eostre";
+            #   test = "hexstring(pkt4.mac, ':') == '00:d8:61:79:c5:40' and option[77].hex == 'iPXE-yggdrasil'";
+            #   next-server = tftpIp;
+            #   boot-file-name = "${nfsrootBaseUrl}/eostre.menu.ipxe";
+            #   only-if-required = true;
+            # }
+            { name = "ipxe-yggdrasil";
+              test = "option[77].hex == 'iPXE-yggdrasil'";
+              next-server = tftpIp;
+              boot-file-name = "${nfsrootBaseUrl}/installer-x86_64-linux.menu.ipxe";
               only-if-required = true;
             }
-            { name = "ipxe";
-              test = "option[77].hex == 'iPXE'";
-              next-server = "10.141.0.1";
-              boot-file-name = "${nfsrootBaseUrl}/installer-x86_64-linux.menu.ipxe";
+
+            { name = "uefi-http";
+              test = "option[client-system].hex == 0x0010";
+              option-data = [
+                { name = "vendor-class-identifier"; data = "HTTPClient"; }
+              ];
+              boot-file-name = "${nfsrootBaseUrl}/ipxe.efi";
               only-if-required = true;
             }
+
+            { name = "ipxe-uefi-64";
+              test = "option[77].hex == 'iPXE' and (substring(option[60].hex,0,20) == 'PXEClient:Arch:00007' or substring(option[60].hex,0,20) == 'PXEClient:Arch:00008' or substring(option[60].hex,0,20) == 'PXEClient:Arch:00009')";
+              boot-file-name = "${nfsrootBaseUrl}/ipxe.efi";
+              only-if-required = true;
+            }
+            { name = "ipxe-uefi-32";
+              test = "option[77].hex == 'iPXE' and (substring(option[60].hex,0,20) == 'PXEClient:Arch:00002' or substring(option[60].hex,0,20) == 'PXEClient:Arch:00006')";
+              boot-file-name = "${nfsrootBaseUrl}/i386-ipxe.efi";
+              only-if-required = true;
+            }
+            { name = "ipxe-legacy";
+              test = "option[77].hex == 'iPXE' and substring(option[60].hex,0,20) == 'PXEClient:Arch:00000'";
+              boot-file-name = "${nfsrootBaseUrl}/ipxe.lkrn";
+              only-if-required = true;
+            }
+
             { name = "uefi-64";
               test = "substring(option[60].hex,0,20) == 'PXEClient:Arch:00007' or substring(option[60].hex,0,20) == 'PXEClient:Arch:00008' or substring(option[60].hex,0,20) == 'PXEClient:Arch:00009'";
-              only-if-required = true;
               option-data = [
-                { name = "tftp-server-name"; data = "10.141.0.1"; }
+                { name = "tftp-server-name"; data = tftpIp; }
               ];
               boot-file-name = "ipxe.efi";
+              only-if-required = true;
             }
             { name = "uefi-32";
               test = "substring(option[60].hex,0,20) == 'PXEClient:Arch:00002' or substring(option[60].hex,0,20) == 'PXEClient:Arch:00006'";
-              only-if-required = true;
               option-data = [
-                { name = "tftp-server-name"; data = "10.141.0.1"; }
+                { name = "tftp-server-name"; data = tftpIp; }
               ];
               boot-file-name = "i386-ipxe.efi";
+              only-if-required = true;
             }
             { name = "legacy";
               test = "substring(option[60].hex,0,20) == 'PXEClient:Arch:00000'";
-              only-if-required = true;
               option-data = [
-                { name = "tftp-server-name"; data = "10.141.0.1"; }
+                { name = "tftp-server-name"; data = tftpIp; }
               ];
-              boot-file-name = "undionly.kpxe";
+              boot-file-name = "ipxe.lkrn";
+              only-if-required = true;
             }
           ];
 
@@ -207,40 +256,27 @@ in {
               }
             ];
           };
+          tsig-keys = [
+            { name = "local_key";
+              algorithm = "HMAC-SHA256";
+              secret-file = "/run/credentials/kea-dhcp-ddns-server.service/local_key";
+            }
+          ];
         };
       };
     };
 
     systemd.services.kea-dhcp-ddns-server = {
-      preStart = let
-        configLines = [
-          "<?include \"\${CREDENTIALS_DIRECTORY}/knot-tsig.json.frag\"?>"
-        ] ++ mapAttrsToList (k: v:
-          "\"${k}\": ${builtins.toJSON v}"
-        ) config.services.kea.dhcp-ddns.settings;
-
-        config-template = pkgs.writeText "dhcp-ddns.conf" ''
-          {"DhcpDdns": {
-            ${concatStringsSep ",\n  " configLines}
-          }}
-        '';
-      in ''
-        ${pkgs.envsubst}/bin/envsubst -i "${config-template}" -o "''${RUNTIME_DIRECTORY}/dhcp-ddns.conf"
-      '';
-
       serviceConfig = {
-        ExecStart = mkForce ''
-          ${pkgs.kea}/bin/kea-dhcp-ddns -c "''${RUNTIME_DIRECTORY}/dhcp-ddns.conf" ${escapeShellArgs config.services.kea.dhcp-ddns.extraArgs}
-        '';
         LoadCredential = [
-          "knot-tsig.json.frag:${config.sops.secrets."kea-knot-tsig.json.frag".path}"
+          "local_key:${config.sops.secrets."kea-knot-tsig".path}"
         ];
       };
     };
 
-    sops.secrets."kea-knot-tsig.json.frag" = {
+    sops.secrets."kea-knot-tsig" = {
       format = "binary";
-      sopsFile = ./knot-tsig.json.frag;
+      sopsFile = ./knot-tsig;
     };
 
     services.nginx.virtualHosts."nfsroot.vidhar.yggdrasil" = {
@@ -257,30 +293,31 @@ in {
               pkgs.symlinkJoin {
                 name = "installer-${system}";
                 paths = [
-                  (let
-                    installerBuild = (flake.nixosConfigurations.${"installer-${system}-nfsroot"}.extendModules {
+                  (builtins.addErrorContext "while evaluating installer-${system}-nfsroot" (let
+                    installerBuild' = (flake.nixosConfigurations.${"installer-${system}-nfsroot"}.extendModules {
                       modules = [
                         ({ ... }: {
-                          config.nfsroot.storeDevice = "10.141.0.1:nix-store";
+                          config.nfsroot.storeDevice = "${nfsIp}:nix-store";
                           config.nfsroot.registrationUrl = "${nfsrootBaseUrl}/installer-${system}/registration";
+                          config.system.nixos.label = "installer-${system}";
                         })
                       ];
-                    }).config.system.build;
-                  in builtins.toPath (pkgs.runCommandLocal "install-${system}" {} ''
+                    });
+                    installerBuild = installerBuild'.config.system.build;
+                  in builtins.toPath (pkgs.runCommandLocal "installer-${system}" {} ''
                     mkdir -p $out/installer-${system}
                     install -m 0444 -t $out/installer-${system} \
                       ${installerBuild.initialRamdisk}/initrd \
                       ${installerBuild.kernel}/bzImage \
                       ${installerBuild.netbootIpxeScript}/netboot.ipxe \
                       ${pkgs.closureInfo { rootPaths = installerBuild.storeContents; }}/registration
-                  ''))
-                  (pkgs.writeTextFile {
-                    name = "installer-${system}.menu.ipxe";
-                    destination = "/installer-${system}.menu.ipxe";
-                    text = ''
+                    install -m 0444 ${pkgs.writeText "installer-${system}.menu.ipxe" ''
+                      #!ipxe
+
                       :start
                       menu iPXE boot menu for installer-${system}
-                      item installer Boot installer-${system}
+                      item installer ${with installerBuild'; "${config.system.nixos.distroName} ${config.system.nixos.codeName} ${config.system.nixos.label} (Linux ${config.boot.kernelPackages.kernel.modDirVersion})"}
+                      item memtest memtest86plus
                       item netboot netboot.xyz
                       item shell iPXE shell
                       choose --timeout 0 --default installer selected || goto shell
@@ -291,65 +328,80 @@ in {
                       goto start
 
                       :installer
-                      chain ${nfsrootBaseUrl}/installer-${system}/netboot.ipxe
+                      chain installer-${system}/netboot.ipxe
                       goto start
 
                       :netboot
-                      chain --autofree ${nfsrootBaseUrl}/netboot.xyz.efi
+                      iseq ''${platform} efi && chain --autofree netboot.xyz.efi || chain --autofree netboot.xyz.lkrn
                       goto start
-                    '';
-                  })
+
+                      :memtest
+                      chain --autofree mt86plus.efi
+                      goto start
+                    ''} $out/installer-${system}.menu.ipxe
+                  '')))
                 ];
               }) ["x86_64-linux"]
             ) ++ [
-              (pkgs.linkFarm "netbootxyz-efi" [
-                { name = "netboot.xyz.efi"; path = pkgs.netbootxyz-efi; }
-              ])
-              (let
-                 eostreBuild = (flake.nixosConfigurations.eostre.extendModules {
-                   modules = [
-                     ({ ... }: {
-                       config.nfsroot.storeDevice = "10.141.0.1:nix-store";
-                       config.nfsroot.registrationUrl = "${nfsrootBaseUrl}/eostre/registration";
-                     })
-                   ];
-                 }).config.system.build;
-               in builtins.toPath (pkgs.runCommandLocal "eostre" {} ''
-                    mkdir -p $out/eostre
-                    install -m 0444 -t $out/eostre \
-                      ${eostreBuild.initialRamdisk}/initrd \
-                      ${eostreBuild.kernel}/bzImage \
-                      ${eostreBuild.netbootIpxeScript}/netboot.ipxe \
-                      ${pkgs.closureInfo { rootPaths = eostreBuild.storeContents; }}/registration
-                  ''))
-              (pkgs.writeTextFile {
-                name = "eostre.menu.ipxe";
-                destination = "/eostre.menu.ipxe";
-                text = ''
-                  set menu-timeout 5000
+              (pkgs.runCommandLocal "utils" {} ''
+                mkdir $out
+                install -m 0444 -t $out \
+                  ${ipxe}/{ipxe.efi,i386-ipxe.efi,ipxe.lkrn} \
+                  ${pkgs.memtest86plus}/mt86plus.efi
+                install -m 0444 ${sources.netbootxyz-efi.src} $out/netboot.xyz.efi
+                install -m 0444 ${sources.netbootxyz-lkrn.src} $out/netboot.xyz.lkrn
+              '')
+              # (builtins.addErrorContext "while evaluating eostre" (let
+              #    eostreBuild' = (flake.nixosConfigurations.eostre.extendModules {
+              #      modules = [
+              #        ({ ... }: {
+              #          config.nfsroot.storeDevice = "${nfsIp}:nix-store";
+              #          config.nfsroot.registrationUrl = "${nfsrootBaseUrl}/eostre/registration";
+              #          config.system.nixos.label = "eostre";
+              #        })
+              #      ];
+              #    });
+              #    eostreBuild = eostreBuild'.config.system.build;
+              #  in builtins.toPath (pkgs.runCommandLocal "eostre" {} ''
+              #       mkdir -p $out/eostre
+              #       install -m 0444 -t $out/eostre \
+              #         ${eostreBuild.initialRamdisk}/initrd \
+              #         ${eostreBuild.kernel}/bzImage \
+              #         ${eostreBuild.netbootIpxeScript}/netboot.ipxe \
+              #         ${pkgs.closureInfo { rootPaths = eostreBuild.storeContents; }}/registration
+              #       install -m 0444 ${pkgs.writeText "eostre.menu.ipxe" ''
+              #         #!ipxe
+
+              #         set menu-timeout 5000
 
-                  :start
-                  menu iPXE boot menu for eostre
-                  item eostre Boot eostre
-                  item netboot netboot.xyz
-                  item shell iPXE shell
-                  choose --timeout ''${menu-timeout} --default eostre selected || goto shell
-                  goto ''${selected}
+              #         :start
+              #         menu iPXE boot menu for eostre
+              #         item eostre ${with eostreBuild'; "${config.system.nixos.distroName} ${config.system.nixos.codeName} ${config.system.nixos.label} (Linux ${config.boot.kernelPackages.kernel.modDirVersion})"}
+              #         item memtest memtest86plus
+              #         item netboot netboot.xyz
+              #         item shell iPXE shell
+              #         choose --timeout ''${menu-timeout} --default eostre selected || goto shell
+              #         set menu-timeout 0
+              #         goto ''${selected}
 
-                  :shell
-                  shell
-                  set menu-timeout 0
-                  goto start
+              #         :shell
+              #         set menu-timeout 0
+              #         shell
+              #         goto start
 
-                  :eostre
-                  chain ${nfsrootBaseUrl}/eostre/netboot.ipxe
-                  goto start
+              #         :eostre
+              #         chain eostre/netboot.ipxe
+              #         goto start
 
-                  :netboot
-                  chain --autofree ${nfsrootBaseUrl}/netboot.xyz.efi
-                  goto start
-                '';
-              })
+              #         :netboot
+              #         iseq ''${platform} efi && chain --autofree netboot.xyz.efi || chain --autofree netboot.xyz.lkrn
+              #         goto start
+
+              #         :memtest
+              #         chain --autofree mt86plus.efi
+              #         goto start
+              #       ''} $out/eostre.menu.ipxe
+              #     '')))
             ];
         };
       };
@@ -360,20 +412,12 @@ in {
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig.ExecStart = let
-        ipxe = pkgs.ipxe.override {
-          additionalTargets = {
-            "bin-i386-efi/ipxe.efi" = "i386-ipxe.efi";
-          };
-          additionalOptions = [
-            "NSLOOKUP_CMD"
-          ];
-        };
         tftpRoot = pkgs.runCommandLocal "netboot" {} ''
           mkdir -p $out
           install -m 0444 -t $out \
-            ${ipxe}/ipxe.efi ${ipxe}/i386-ipxe.efi ${ipxe}/undionly.kpxe
+            ${ipxe}/{ipxe.efi,i386-ipxe.efi,ipxe.lkrn}
         '';
-      in "${pkgs.atftp}/sbin/atftpd --daemon --no-fork --bind-address=10.141.0.1 ${tftpRoot}";
+      in "${pkgs.atftp}/sbin/atftpd --daemon --no-fork --bind-address=${tftpIp} ${tftpRoot}";
     };
   };
 }