nixos/doc: Improve code listings
By adding prompts and replaceables and removing unnecessary indentation.
This commit is contained in:
parent
e1af37634b
commit
e6ce041cae
|
@ -14,18 +14,18 @@
|
||||||
<para>
|
<para>
|
||||||
You create a container with identifier <literal>foo</literal> as follows:
|
You create a container with identifier <literal>foo</literal> as follows:
|
||||||
<screen>
|
<screen>
|
||||||
# nixos-container create foo
|
<prompt># </prompt>nixos-container create <replaceable>foo</replaceable>
|
||||||
</screen>
|
</screen>
|
||||||
This creates the container’s root directory in
|
This creates the container’s root directory in
|
||||||
<filename>/var/lib/containers/foo</filename> and a small configuration file
|
<filename>/var/lib/containers/<replaceable>foo</replaceable></filename> and a small configuration file
|
||||||
in <filename>/etc/containers/foo.conf</filename>. It also builds the
|
in <filename>/etc/containers/<replaceable>foo</replaceable>.conf</filename>. It also builds the
|
||||||
container’s initial system configuration and stores it in
|
container’s initial system configuration and stores it in
|
||||||
<filename>/nix/var/nix/profiles/per-container/foo/system</filename>. You can
|
<filename>/nix/var/nix/profiles/per-container/<replaceable>foo</replaceable>/system</filename>. You can
|
||||||
modify the initial configuration of the container on the command line. For
|
modify the initial configuration of the container on the command line. For
|
||||||
instance, to create a container that has <command>sshd</command> running,
|
instance, to create a container that has <command>sshd</command> running,
|
||||||
with the given public key for <literal>root</literal>:
|
with the given public key for <literal>root</literal>:
|
||||||
<screen>
|
<screen>
|
||||||
# nixos-container create foo --config '
|
<prompt># </prompt>nixos-container create <replaceable>foo</replaceable> --config '
|
||||||
<xref linkend="opt-services.openssh.enable"/> = true;
|
<xref linkend="opt-services.openssh.enable"/> = true;
|
||||||
<link linkend="opt-users.users._name_.openssh.authorizedKeys.keys">users.users.root.openssh.authorizedKeys.keys</link> = ["ssh-dss AAAAB3N…"];
|
<link linkend="opt-users.users._name_.openssh.authorizedKeys.keys">users.users.root.openssh.authorizedKeys.keys</link> = ["ssh-dss AAAAB3N…"];
|
||||||
'
|
'
|
||||||
|
@ -34,7 +34,7 @@
|
||||||
as container IP. This behavior can be altered by setting <literal>--host-address</literal> and
|
as container IP. This behavior can be altered by setting <literal>--host-address</literal> and
|
||||||
<literal>--local-address</literal>:
|
<literal>--local-address</literal>:
|
||||||
<screen>
|
<screen>
|
||||||
# nixos-container create test --config-file test-container.nix \
|
<prompt># </prompt>nixos-container create test --config-file test-container.nix \
|
||||||
--local-address 10.235.1.2 --host-address 10.235.1.1
|
--local-address 10.235.1.2 --host-address 10.235.1.1
|
||||||
</screen>
|
</screen>
|
||||||
</para>
|
</para>
|
||||||
|
@ -42,7 +42,7 @@
|
||||||
<para>
|
<para>
|
||||||
Creating a container does not start it. To start the container, run:
|
Creating a container does not start it. To start the container, run:
|
||||||
<screen>
|
<screen>
|
||||||
# nixos-container start foo
|
<prompt># </prompt>nixos-container start <replaceable>foo</replaceable>
|
||||||
</screen>
|
</screen>
|
||||||
This command will return as soon as the container has booted and has reached
|
This command will return as soon as the container has booted and has reached
|
||||||
<literal>multi-user.target</literal>. On the host, the container runs within
|
<literal>multi-user.target</literal>. On the host, the container runs within
|
||||||
|
@ -51,7 +51,7 @@
|
||||||
Thus, if something went wrong, you can get status info using
|
Thus, if something went wrong, you can get status info using
|
||||||
<command>systemctl</command>:
|
<command>systemctl</command>:
|
||||||
<screen>
|
<screen>
|
||||||
# systemctl status container@foo
|
<prompt># </prompt>systemctl status container@<replaceable>foo</replaceable>
|
||||||
</screen>
|
</screen>
|
||||||
</para>
|
</para>
|
||||||
|
|
||||||
|
@ -59,22 +59,22 @@
|
||||||
If the container has started successfully, you can log in as root using the
|
If the container has started successfully, you can log in as root using the
|
||||||
<command>root-login</command> operation:
|
<command>root-login</command> operation:
|
||||||
<screen>
|
<screen>
|
||||||
# nixos-container root-login foo
|
<prompt># </prompt>nixos-container root-login <replaceable>foo</replaceable>
|
||||||
[root@foo:~]#
|
<prompt>[root@foo:~]#</prompt>
|
||||||
</screen>
|
</screen>
|
||||||
Note that only root on the host can do this (since there is no
|
Note that only root on the host can do this (since there is no
|
||||||
authentication). You can also get a regular login prompt using the
|
authentication). You can also get a regular login prompt using the
|
||||||
<command>login</command> operation, which is available to all users on the
|
<command>login</command> operation, which is available to all users on the
|
||||||
host:
|
host:
|
||||||
<screen>
|
<screen>
|
||||||
# nixos-container login foo
|
<prompt># </prompt>nixos-container login <replaceable>foo</replaceable>
|
||||||
foo login: alice
|
foo login: alice
|
||||||
Password: ***
|
Password: ***
|
||||||
</screen>
|
</screen>
|
||||||
With <command>nixos-container run</command>, you can execute arbitrary
|
With <command>nixos-container run</command>, you can execute arbitrary
|
||||||
commands in the container:
|
commands in the container:
|
||||||
<screen>
|
<screen>
|
||||||
# nixos-container run foo -- uname -a
|
<prompt># </prompt>nixos-container run <replaceable>foo</replaceable> -- uname -a
|
||||||
Linux foo 3.4.82 #1-NixOS SMP Thu Mar 20 14:44:05 UTC 2014 x86_64 GNU/Linux
|
Linux foo 3.4.82 #1-NixOS SMP Thu Mar 20 14:44:05 UTC 2014 x86_64 GNU/Linux
|
||||||
</screen>
|
</screen>
|
||||||
</para>
|
</para>
|
||||||
|
@ -85,18 +85,18 @@ Linux foo 3.4.82 #1-NixOS SMP Thu Mar 20 14:44:05 UTC 2014 x86_64 GNU/Linux
|
||||||
<literal>/var/lib/container/<replaceable>name</replaceable>/etc/nixos/configuration.nix</literal>,
|
<literal>/var/lib/container/<replaceable>name</replaceable>/etc/nixos/configuration.nix</literal>,
|
||||||
and run
|
and run
|
||||||
<screen>
|
<screen>
|
||||||
# nixos-container update foo
|
<prompt># </prompt>nixos-container update <replaceable>foo</replaceable>
|
||||||
</screen>
|
</screen>
|
||||||
This will build and activate the new configuration. You can also specify a
|
This will build and activate the new configuration. You can also specify a
|
||||||
new configuration on the command line:
|
new configuration on the command line:
|
||||||
<screen>
|
<screen>
|
||||||
# nixos-container update foo --config '
|
<prompt># </prompt>nixos-container update <replaceable>foo</replaceable> --config '
|
||||||
<xref linkend="opt-services.httpd.enable"/> = true;
|
<xref linkend="opt-services.httpd.enable"/> = true;
|
||||||
<xref linkend="opt-services.httpd.adminAddr"/> = "foo@example.org";
|
<xref linkend="opt-services.httpd.adminAddr"/> = "foo@example.org";
|
||||||
<xref linkend="opt-networking.firewall.allowedTCPPorts"/> = [ 80 ];
|
<xref linkend="opt-networking.firewall.allowedTCPPorts"/> = [ 80 ];
|
||||||
'
|
'
|
||||||
|
|
||||||
# curl http://$(nixos-container show-ip foo)/
|
<prompt># </prompt>curl http://$(nixos-container show-ip <replaceable>foo</replaceable>)/
|
||||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">…
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">…
|
||||||
</screen>
|
</screen>
|
||||||
However, note that this will overwrite the container’s
|
However, note that this will overwrite the container’s
|
||||||
|
@ -117,7 +117,7 @@ Linux foo 3.4.82 #1-NixOS SMP Thu Mar 20 14:44:05 UTC 2014 x86_64 GNU/Linux
|
||||||
by using <command>systemctl</command> on the container’s service unit. To
|
by using <command>systemctl</command> on the container’s service unit. To
|
||||||
destroy a container, including its file system, do
|
destroy a container, including its file system, do
|
||||||
<screen>
|
<screen>
|
||||||
# nixos-container destroy foo
|
<prompt># </prompt>nixos-container destroy <replaceable>foo</replaceable>
|
||||||
</screen>
|
</screen>
|
||||||
</para>
|
</para>
|
||||||
</section>
|
</section>
|
||||||
|
|
|
@ -8,7 +8,7 @@
|
||||||
<para>
|
<para>
|
||||||
You can enter rescue mode by running:
|
You can enter rescue mode by running:
|
||||||
<screen>
|
<screen>
|
||||||
# systemctl rescue</screen>
|
<prompt># </prompt>systemctl rescue</screen>
|
||||||
This will eventually give you a single-user root shell. Systemd will stop
|
This will eventually give you a single-user root shell. Systemd will stop
|
||||||
(almost) all system services. To get out of maintenance mode, just exit from
|
(almost) all system services. To get out of maintenance mode, just exit from
|
||||||
the rescue shell.
|
the rescue shell.
|
||||||
|
|
|
@ -16,12 +16,12 @@
|
||||||
disable the use of the binary cache by adding <option>--option
|
disable the use of the binary cache by adding <option>--option
|
||||||
use-binary-caches false</option>, e.g.
|
use-binary-caches false</option>, e.g.
|
||||||
<screen>
|
<screen>
|
||||||
# nixos-rebuild switch --option use-binary-caches false
|
<prompt># </prompt>nixos-rebuild switch --option use-binary-caches false
|
||||||
</screen>
|
</screen>
|
||||||
If you have an alternative binary cache at your disposal, you can use it
|
If you have an alternative binary cache at your disposal, you can use it
|
||||||
instead:
|
instead:
|
||||||
<screen>
|
<screen>
|
||||||
# nixos-rebuild switch --option binary-caches http://my-cache.example.org/
|
<prompt># </prompt>nixos-rebuild switch --option binary-caches <replaceable>http://my-cache.example.org/</replaceable>
|
||||||
</screen>
|
</screen>
|
||||||
</para>
|
</para>
|
||||||
</section>
|
</section>
|
||||||
|
|
|
@ -7,20 +7,20 @@
|
||||||
<para>
|
<para>
|
||||||
The system can be shut down (and automatically powered off) by doing:
|
The system can be shut down (and automatically powered off) by doing:
|
||||||
<screen>
|
<screen>
|
||||||
# shutdown
|
<prompt># </prompt>shutdown
|
||||||
</screen>
|
</screen>
|
||||||
This is equivalent to running <command>systemctl poweroff</command>.
|
This is equivalent to running <command>systemctl poweroff</command>.
|
||||||
</para>
|
</para>
|
||||||
<para>
|
<para>
|
||||||
To reboot the system, run
|
To reboot the system, run
|
||||||
<screen>
|
<screen>
|
||||||
# reboot
|
<prompt># </prompt>reboot
|
||||||
</screen>
|
</screen>
|
||||||
which is equivalent to <command>systemctl reboot</command>. Alternatively,
|
which is equivalent to <command>systemctl reboot</command>. Alternatively,
|
||||||
you can quickly reboot the system using <literal>kexec</literal>, which
|
you can quickly reboot the system using <literal>kexec</literal>, which
|
||||||
bypasses the BIOS by directly loading the new kernel into memory:
|
bypasses the BIOS by directly loading the new kernel into memory:
|
||||||
<screen>
|
<screen>
|
||||||
# systemctl kexec
|
<prompt># </prompt>systemctl kexec
|
||||||
</screen>
|
</screen>
|
||||||
</para>
|
</para>
|
||||||
<para>
|
<para>
|
||||||
|
|
|
@ -20,16 +20,16 @@
|
||||||
has booted, you can make the selected configuration the default for
|
has booted, you can make the selected configuration the default for
|
||||||
subsequent boots:
|
subsequent boots:
|
||||||
<screen>
|
<screen>
|
||||||
# /run/current-system/bin/switch-to-configuration boot</screen>
|
<prompt># </prompt>/run/current-system/bin/switch-to-configuration boot</screen>
|
||||||
</para>
|
</para>
|
||||||
|
|
||||||
<para>
|
<para>
|
||||||
Second, you can switch to the previous configuration in a running system:
|
Second, you can switch to the previous configuration in a running system:
|
||||||
<screen>
|
<screen>
|
||||||
# nixos-rebuild switch --rollback</screen>
|
<prompt># </prompt>nixos-rebuild switch --rollback</screen>
|
||||||
This is equivalent to running:
|
This is equivalent to running:
|
||||||
<screen>
|
<screen>
|
||||||
# /nix/var/nix/profiles/system-<replaceable>N</replaceable>-link/bin/switch-to-configuration switch</screen>
|
<prompt># </prompt>/nix/var/nix/profiles/system-<replaceable>N</replaceable>-link/bin/switch-to-configuration switch</screen>
|
||||||
where <replaceable>N</replaceable> is the number of the NixOS system
|
where <replaceable>N</replaceable> is the number of the NixOS system
|
||||||
configuration. To get a list of the available configurations, do:
|
configuration. To get a list of the available configurations, do:
|
||||||
<screen>
|
<screen>
|
||||||
|
|
|
@ -58,9 +58,9 @@ Jan 07 15:55:57 hagbard systemd[1]: Started PostgreSQL Server.
|
||||||
<para>
|
<para>
|
||||||
Units can be stopped, started or restarted:
|
Units can be stopped, started or restarted:
|
||||||
<screen>
|
<screen>
|
||||||
# systemctl stop postgresql.service
|
<prompt># </prompt>systemctl stop postgresql.service
|
||||||
# systemctl start postgresql.service
|
<prompt># </prompt>systemctl start postgresql.service
|
||||||
# systemctl restart postgresql.service
|
<prompt># </prompt>systemctl restart postgresql.service
|
||||||
</screen>
|
</screen>
|
||||||
These operations are synchronous: they wait until the service has finished
|
These operations are synchronous: they wait until the service has finished
|
||||||
starting or stopping (or has failed). Starting a unit will cause the
|
starting or stopping (or has failed). Starting a unit will cause the
|
||||||
|
|
|
@ -39,7 +39,7 @@ c3 - root (0)
|
||||||
can terminate a session in a way that ensures that all the session’s
|
can terminate a session in a way that ensures that all the session’s
|
||||||
processes are gone:
|
processes are gone:
|
||||||
<screen>
|
<screen>
|
||||||
# loginctl terminate-session c3
|
<prompt># </prompt>loginctl terminate-session c3
|
||||||
</screen>
|
</screen>
|
||||||
</para>
|
</para>
|
||||||
</chapter>
|
</chapter>
|
||||||
|
|
|
@ -25,7 +25,7 @@ xlink:href="https://nixos.org/nixpkgs/manual">Nixpkgs
|
||||||
and you run <command>nixos-rebuild</command>, specifying your own Nixpkgs
|
and you run <command>nixos-rebuild</command>, specifying your own Nixpkgs
|
||||||
tree:
|
tree:
|
||||||
<screen>
|
<screen>
|
||||||
# nixos-rebuild switch -I nixpkgs=/path/to/my/nixpkgs</screen>
|
<prompt># </prompt>nixos-rebuild switch -I nixpkgs=/path/to/my/nixpkgs</screen>
|
||||||
</para>
|
</para>
|
||||||
|
|
||||||
<para>
|
<para>
|
||||||
|
|
|
@ -126,13 +126,13 @@ nixpkgs.config.packageOverrides = pkgs:
|
||||||
<literal>mellanox</literal> drivers.
|
<literal>mellanox</literal> drivers.
|
||||||
</para>
|
</para>
|
||||||
|
|
||||||
<screen><![CDATA[
|
<screen>
|
||||||
$ nix-build '<nixpkgs>' -A linuxPackages.kernel.dev
|
<prompt>$ </prompt>nix-build '<nixpkgs>' -A linuxPackages.kernel.dev
|
||||||
$ nix-shell '<nixpkgs>' -A linuxPackages.kernel
|
<prompt>$ </prompt>nix-shell '<nixpkgs>' -A linuxPackages.kernel
|
||||||
$ unpackPhase
|
<prompt>$ </prompt>unpackPhase
|
||||||
$ cd linux-*
|
<prompt>$ </prompt>cd linux-*
|
||||||
$ make -C $dev/lib/modules/*/build M=$(pwd)/drivers/net/ethernet/mellanox modules
|
<prompt>$ </prompt>make -C $dev/lib/modules/*/build M=$(pwd)/drivers/net/ethernet/mellanox modules
|
||||||
# insmod ./drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.ko
|
<prompt># </prompt>insmod ./drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.ko
|
||||||
]]></screen>
|
</screen>
|
||||||
</section>
|
</section>
|
||||||
</chapter>
|
</chapter>
|
||||||
|
|
|
@ -11,7 +11,7 @@
|
||||||
you create an encrypted Ext4 file system on the device
|
you create an encrypted Ext4 file system on the device
|
||||||
<filename>/dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d</filename>:
|
<filename>/dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d</filename>:
|
||||||
<screen>
|
<screen>
|
||||||
# cryptsetup luksFormat /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d
|
<prompt># </prompt>cryptsetup luksFormat <replaceable>/dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d</replaceable>
|
||||||
|
|
||||||
WARNING!
|
WARNING!
|
||||||
========
|
========
|
||||||
|
@ -21,17 +21,17 @@ Are you sure? (Type uppercase yes): YES
|
||||||
Enter LUKS passphrase: ***
|
Enter LUKS passphrase: ***
|
||||||
Verify passphrase: ***
|
Verify passphrase: ***
|
||||||
|
|
||||||
# cryptsetup luksOpen /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d crypted
|
<prompt># </prompt>cryptsetup luksOpen <replaceable>/dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d</replaceable> <replaceable>crypted</replaceable>
|
||||||
Enter passphrase for /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d: ***
|
Enter passphrase for /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d: ***
|
||||||
|
|
||||||
# mkfs.ext4 /dev/mapper/crypted
|
<prompt># </prompt>mkfs.ext4 /dev/mapper/<replaceable>crypted</replaceable>
|
||||||
</screen>
|
</screen>
|
||||||
To ensure that this file system is automatically mounted at boot time as
|
To ensure that this file system is automatically mounted at boot time as
|
||||||
<filename>/</filename>, add the following to
|
<filename>/</filename>, add the following to
|
||||||
<filename>configuration.nix</filename>:
|
<filename>configuration.nix</filename>:
|
||||||
<programlisting>
|
<programlisting>
|
||||||
<link linkend="opt-boot.initrd.luks.devices._name_.device">boot.initrd.luks.devices.crypted.device</link> = "/dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d";
|
<link linkend="opt-boot.initrd.luks.devices._name_.device">boot.initrd.luks.devices.crypted.device</link> = "<replaceable>/dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d</replaceable>";
|
||||||
<xref linkend="opt-fileSystems"/>."/".device = "/dev/mapper/crypted";
|
<xref linkend="opt-fileSystems"/>."/".device = "/dev/mapper/<replaceable>crypted</replaceable>";
|
||||||
</programlisting>
|
</programlisting>
|
||||||
Should grub be used as bootloader, and <filename>/boot</filename> is located
|
Should grub be used as bootloader, and <filename>/boot</filename> is located
|
||||||
on an encrypted partition, it is necessary to add the following grub option:
|
on an encrypted partition, it is necessary to add the following grub option:
|
||||||
|
@ -45,11 +45,11 @@ Enter passphrase for /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d: ***
|
||||||
and add it as a new key to our existing device <filename>/dev/sda2</filename>:
|
and add it as a new key to our existing device <filename>/dev/sda2</filename>:
|
||||||
|
|
||||||
<screen>
|
<screen>
|
||||||
# export FIDO2_LABEL="/dev/sda2 @ $HOSTNAME"
|
<prompt># </prompt>export FIDO2_LABEL="<replaceable>/dev/sda2</replaceable> @ $HOSTNAME"
|
||||||
# fido2luks credential "$FIDO2_LABEL"
|
<prompt># </prompt>fido2luks credential "$FIDO2_LABEL"
|
||||||
f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7
|
f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7
|
||||||
|
|
||||||
# fido2luks -i add-key /dev/sda2 f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7
|
<prompt># </prompt>fido2luks -i add-key <replaceable>/dev/sda2</replaceable> <replaceable>f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7</replaceable>
|
||||||
Password:
|
Password:
|
||||||
Password (again):
|
Password (again):
|
||||||
Old password:
|
Old password:
|
||||||
|
@ -60,13 +60,13 @@ Added to key to device /dev/sda2, slot: 2
|
||||||
To ensure that this file system is decrypted using the FIDO2 compatible key, add the following to <filename>configuration.nix</filename>:
|
To ensure that this file system is decrypted using the FIDO2 compatible key, add the following to <filename>configuration.nix</filename>:
|
||||||
<programlisting>
|
<programlisting>
|
||||||
<link linkend="opt-boot.initrd.luks.fido2Support">boot.initrd.luks.fido2Support</link> = true;
|
<link linkend="opt-boot.initrd.luks.fido2Support">boot.initrd.luks.fido2Support</link> = true;
|
||||||
<link linkend="opt-boot.initrd.luks.devices._name_.fido2.credential">boot.initrd.luks.devices."/dev/sda2".fido2.credential</link> = "f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7";
|
<link linkend="opt-boot.initrd.luks.devices._name_.fido2.credential">boot.initrd.luks.devices."<replaceable>/dev/sda2</replaceable>".fido2.credential</link> = "<replaceable>f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7</replaceable>";
|
||||||
</programlisting>
|
</programlisting>
|
||||||
|
|
||||||
You can also use the FIDO2 passwordless setup, but for security reasons, you might want to enable it only when your device is PIN protected, such as <link xlink:href="https://trezor.io/">Trezor</link>.
|
You can also use the FIDO2 passwordless setup, but for security reasons, you might want to enable it only when your device is PIN protected, such as <link xlink:href="https://trezor.io/">Trezor</link>.
|
||||||
|
|
||||||
<programlisting>
|
<programlisting>
|
||||||
<link linkend="opt-boot.initrd.luks.devices._name_.fido2.passwordLess">boot.initrd.luks.devices."/dev/sda2".fido2.passwordLess</link> = true;
|
<link linkend="opt-boot.initrd.luks.devices._name_.fido2.passwordLess">boot.initrd.luks.devices."<replaceable>/dev/sda2</replaceable>".fido2.passwordLess</link> = true;
|
||||||
</programlisting>
|
</programlisting>
|
||||||
</para>
|
</para>
|
||||||
</section>
|
</section>
|
||||||
|
|
|
@ -62,24 +62,24 @@ uid = 1000;
|
||||||
<command>useradd</command>, <command>groupmod</command> and so on. For
|
<command>useradd</command>, <command>groupmod</command> and so on. For
|
||||||
instance, to create a user account named <literal>alice</literal>:
|
instance, to create a user account named <literal>alice</literal>:
|
||||||
<screen>
|
<screen>
|
||||||
# useradd -m alice</screen>
|
<prompt># </prompt>useradd -m <replaceable>alice</replaceable></screen>
|
||||||
To make all nix tools available to this new user use `su - USER` which opens
|
To make all nix tools available to this new user use `su - USER` which opens
|
||||||
a login shell (==shell that loads the profile) for given user. This will
|
a login shell (==shell that loads the profile) for given user. This will
|
||||||
create the ~/.nix-defexpr symlink. So run:
|
create the ~/.nix-defexpr symlink. So run:
|
||||||
<screen>
|
<screen>
|
||||||
# su - alice -c "true"</screen>
|
<prompt># </prompt>su - <replaceable>alice</replaceable> -c "true"</screen>
|
||||||
The flag <option>-m</option> causes the creation of a home directory for the
|
The flag <option>-m</option> causes the creation of a home directory for the
|
||||||
new user, which is generally what you want. The user does not have an initial
|
new user, which is generally what you want. The user does not have an initial
|
||||||
password and therefore cannot log in. A password can be set using the
|
password and therefore cannot log in. A password can be set using the
|
||||||
<command>passwd</command> utility:
|
<command>passwd</command> utility:
|
||||||
<screen>
|
<screen>
|
||||||
# passwd alice
|
<prompt># </prompt>passwd <replaceable>alice</replaceable>
|
||||||
Enter new UNIX password: ***
|
Enter new UNIX password: ***
|
||||||
Retype new UNIX password: ***
|
Retype new UNIX password: ***
|
||||||
</screen>
|
</screen>
|
||||||
A user can be deleted using <command>userdel</command>:
|
A user can be deleted using <command>userdel</command>:
|
||||||
<screen>
|
<screen>
|
||||||
# userdel -r alice</screen>
|
<prompt># </prompt>userdel -r <replaceable>alice</replaceable></screen>
|
||||||
The flag <option>-r</option> deletes the user’s home directory. Accounts
|
The flag <option>-r</option> deletes the user’s home directory. Accounts
|
||||||
can be modified using <command>usermod</command>. Unix groups can be managed
|
can be modified using <command>usermod</command>. Unix groups can be managed
|
||||||
using <command>groupadd</command>, <command>groupmod</command> and
|
using <command>groupadd</command>, <command>groupmod</command> and
|
||||||
|
|
|
@ -58,7 +58,7 @@
|
||||||
</programlisting>
|
</programlisting>
|
||||||
The X server can then be started manually:
|
The X server can then be started manually:
|
||||||
<screen>
|
<screen>
|
||||||
# systemctl start display-manager.service
|
<prompt># </prompt>systemctl start display-manager.service
|
||||||
</screen>
|
</screen>
|
||||||
</para>
|
</para>
|
||||||
<para>
|
<para>
|
||||||
|
|
|
@ -57,7 +57,7 @@
|
||||||
linkend="ch-configuration"/>. Changes to a module documentation
|
linkend="ch-configuration"/>. Changes to a module documentation
|
||||||
have to be checked to not break building the NixOS manual:
|
have to be checked to not break building the NixOS manual:
|
||||||
</para>
|
</para>
|
||||||
<programlisting>$ nix-build nixos/release.nix -A manual</programlisting>
|
<screen><prompt>$ </prompt>nix-build nixos/release.nix -A manual</screen>
|
||||||
</callout>
|
</callout>
|
||||||
</calloutlist>
|
</calloutlist>
|
||||||
</section>
|
</section>
|
||||||
|
|
|
@ -24,8 +24,8 @@
|
||||||
</para>
|
</para>
|
||||||
|
|
||||||
<screen>
|
<screen>
|
||||||
$ cd /path/to/nixpkgs/nixos/doc/manual
|
<prompt>$ </prompt>cd /path/to/nixpkgs/nixos/doc/manual
|
||||||
$ make
|
<prompt>$ </prompt>make
|
||||||
</screen>
|
</screen>
|
||||||
|
|
||||||
<para>
|
<para>
|
||||||
|
|
|
@ -27,13 +27,13 @@ networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||||
Setup the proxy environment variables in the shell where you are running
|
Setup the proxy environment variables in the shell where you are running
|
||||||
<literal>nixos-install</literal>.
|
<literal>nixos-install</literal>.
|
||||||
</para>
|
</para>
|
||||||
<programlisting>
|
<screen>
|
||||||
# proxy_url="http://user:password@proxy:port/"
|
<prompt># </prompt>proxy_url="http://user:password@proxy:port/"
|
||||||
# export http_proxy="$proxy_url"
|
<prompt># </prompt>export http_proxy="$proxy_url"
|
||||||
# export HTTP_PROXY="$proxy_url"
|
<prompt># </prompt>export HTTP_PROXY="$proxy_url"
|
||||||
# export https_proxy="$proxy_url"
|
<prompt># </prompt>export https_proxy="$proxy_url"
|
||||||
# export HTTPS_PROXY="$proxy_url"
|
<prompt># </prompt>export HTTPS_PROXY="$proxy_url"
|
||||||
</programlisting>
|
</screen>
|
||||||
</listitem>
|
</listitem>
|
||||||
</orderedlist>
|
</orderedlist>
|
||||||
|
|
||||||
|
|
|
@ -325,14 +325,14 @@ sudo /nix/var/nix/profiles/system/bin/switch-to-configuration boot
|
||||||
to boot on a USB rescue disk and do something along these lines:
|
to boot on a USB rescue disk and do something along these lines:
|
||||||
</para>
|
</para>
|
||||||
<screen>
|
<screen>
|
||||||
# mkdir root
|
<prompt># </prompt>mkdir root
|
||||||
# mount /dev/sdaX root
|
<prompt># </prompt>mount /dev/sdaX root
|
||||||
# mkdir root/nixos-root
|
<prompt># </prompt>mkdir root/nixos-root
|
||||||
# mv -v root/* root/nixos-root/
|
<prompt># </prompt>mv -v root/* root/nixos-root/
|
||||||
# mv -v root/nixos-root/old-root/* root/
|
<prompt># </prompt>mv -v root/nixos-root/old-root/* root/
|
||||||
# mv -v root/boot.bak root/boot # We had renamed this by hand earlier
|
<prompt># </prompt>mv -v root/boot.bak root/boot # We had renamed this by hand earlier
|
||||||
# umount root
|
<prompt># </prompt>umount root
|
||||||
# reboot</screen>
|
<prompt># </prompt>reboot</screen>
|
||||||
<para>
|
<para>
|
||||||
This may work as is or you might also need to reinstall the boot loader
|
This may work as is or you might also need to reinstall the boot loader
|
||||||
</para>
|
</para>
|
||||||
|
|
|
@ -67,32 +67,32 @@
|
||||||
<literal>nixos-20.03</literal> channel. To see which NixOS channel you’re
|
<literal>nixos-20.03</literal> channel. To see which NixOS channel you’re
|
||||||
subscribed to, run the following as root:
|
subscribed to, run the following as root:
|
||||||
<screen>
|
<screen>
|
||||||
# nix-channel --list | grep nixos
|
<prompt># </prompt>nix-channel --list | grep nixos
|
||||||
nixos https://nixos.org/channels/nixos-unstable
|
nixos https://nixos.org/channels/nixos-unstable
|
||||||
</screen>
|
</screen>
|
||||||
To switch to a different NixOS channel, do
|
To switch to a different NixOS channel, do
|
||||||
<screen>
|
<screen>
|
||||||
# nix-channel --add https://nixos.org/channels/<replaceable>channel-name</replaceable> nixos
|
<prompt># </prompt>nix-channel --add https://nixos.org/channels/<replaceable>channel-name</replaceable> nixos
|
||||||
</screen>
|
</screen>
|
||||||
(Be sure to include the <literal>nixos</literal> parameter at the end.) For
|
(Be sure to include the <literal>nixos</literal> parameter at the end.) For
|
||||||
instance, to use the NixOS 20.03 stable channel:
|
instance, to use the NixOS 20.03 stable channel:
|
||||||
<screen>
|
<screen>
|
||||||
# nix-channel --add https://nixos.org/channels/nixos-20.03 nixos
|
<prompt># </prompt>nix-channel --add https://nixos.org/channels/nixos-20.03 nixos
|
||||||
</screen>
|
</screen>
|
||||||
If you have a server, you may want to use the “small” channel instead:
|
If you have a server, you may want to use the “small” channel instead:
|
||||||
<screen>
|
<screen>
|
||||||
# nix-channel --add https://nixos.org/channels/nixos-20.03-small nixos
|
<prompt># </prompt>nix-channel --add https://nixos.org/channels/nixos-20.03-small nixos
|
||||||
</screen>
|
</screen>
|
||||||
And if you want to live on the bleeding edge:
|
And if you want to live on the bleeding edge:
|
||||||
<screen>
|
<screen>
|
||||||
# nix-channel --add https://nixos.org/channels/nixos-unstable nixos
|
<prompt># </prompt>nix-channel --add https://nixos.org/channels/nixos-unstable nixos
|
||||||
</screen>
|
</screen>
|
||||||
</para>
|
</para>
|
||||||
<para>
|
<para>
|
||||||
You can then upgrade NixOS to the latest version in your chosen channel by
|
You can then upgrade NixOS to the latest version in your chosen channel by
|
||||||
running
|
running
|
||||||
<screen>
|
<screen>
|
||||||
# nixos-rebuild switch --upgrade
|
<prompt># </prompt>nixos-rebuild switch --upgrade
|
||||||
</screen>
|
</screen>
|
||||||
which is equivalent to the more verbose <literal>nix-channel --update nixos;
|
which is equivalent to the more verbose <literal>nix-channel --update nixos;
|
||||||
nixos-rebuild switch</literal>.
|
nixos-rebuild switch</literal>.
|
||||||
|
|
|
@ -136,13 +136,13 @@
|
||||||
<filename>/mnt</filename>:
|
<filename>/mnt</filename>:
|
||||||
</para>
|
</para>
|
||||||
<screen>
|
<screen>
|
||||||
# nixos-enter --root /mnt
|
<prompt># </prompt>nixos-enter --root /mnt
|
||||||
</screen>
|
</screen>
|
||||||
<para>
|
<para>
|
||||||
Run a shell command:
|
Run a shell command:
|
||||||
</para>
|
</para>
|
||||||
<screen>
|
<screen>
|
||||||
# nixos-enter -c 'ls -l /; cat /proc/mounts'
|
<prompt># </prompt>nixos-enter -c 'ls -l /; cat /proc/mounts'
|
||||||
</screen>
|
</screen>
|
||||||
<para>
|
<para>
|
||||||
Run a non-shell command:
|
Run a non-shell command:
|
||||||
|
|
|
@ -33,7 +33,7 @@
|
||||||
<para>
|
<para>
|
||||||
This command shows the version of the currently active NixOS configuration.
|
This command shows the version of the currently active NixOS configuration.
|
||||||
For example:
|
For example:
|
||||||
<screen>$ nixos-version
|
<screen><prompt>$ </prompt>nixos-version
|
||||||
16.03.1011.6317da4 (Emu)
|
16.03.1011.6317da4 (Emu)
|
||||||
</screen>
|
</screen>
|
||||||
The version consists of the following elements:
|
The version consists of the following elements:
|
||||||
|
@ -111,7 +111,7 @@
|
||||||
<para>
|
<para>
|
||||||
Show the full SHA1 hash of the Git commit from which this configuration
|
Show the full SHA1 hash of the Git commit from which this configuration
|
||||||
was built, e.g.
|
was built, e.g.
|
||||||
<screen>$ nixos-version --hash
|
<screen><prompt>$ </prompt>nixos-version --hash
|
||||||
6317da40006f6bc2480c6781999c52d88dde2acf
|
6317da40006f6bc2480c6781999c52d88dde2acf
|
||||||
</screen>
|
</screen>
|
||||||
</para>
|
</para>
|
||||||
|
|
|
@ -69,10 +69,10 @@
|
||||||
access this single repository. You need the output of the generate pub file.
|
access this single repository. You need the output of the generate pub file.
|
||||||
</para>
|
</para>
|
||||||
<para>
|
<para>
|
||||||
<programlisting>
|
<screen>
|
||||||
# sudo ssh-keygen -N '' -t ed25519 -f /run/keys/id_ed25519_my_borg_repo
|
<prompt># </prompt>sudo ssh-keygen -N '' -t ed25519 -f /run/keys/id_ed25519_my_borg_repo
|
||||||
# cat /run/keys/id_ed25519_my_borg_repo
|
<prompt># </prompt>cat /run/keys/id_ed25519_my_borg_repo
|
||||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID78zmOyA+5uPG4Ot0hfAy+sLDPU1L4AiIoRYEIVbbQ/ root@nixos</programlisting>
|
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID78zmOyA+5uPG4Ot0hfAy+sLDPU1L4AiIoRYEIVbbQ/ root@nixos</screen>
|
||||||
</para>
|
</para>
|
||||||
<para>
|
<para>
|
||||||
Add the following snippet to your NixOS configuration:
|
Add the following snippet to your NixOS configuration:
|
||||||
|
|
|
@ -159,9 +159,9 @@ in
|
||||||
To switch to a specialised configuration
|
To switch to a specialised configuration
|
||||||
(e.g. <literal>fewJobsManyCores</literal>) at runtime, run:
|
(e.g. <literal>fewJobsManyCores</literal>) at runtime, run:
|
||||||
|
|
||||||
<programlisting>
|
<screen>
|
||||||
# sudo /run/current-system/specialisation/fewJobsManyCores/bin/switch-to-configuration test
|
<prompt># </prompt>sudo /run/current-system/specialisation/fewJobsManyCores/bin/switch-to-configuration test
|
||||||
</programlisting>
|
</screen>
|
||||||
'';
|
'';
|
||||||
type = types.attrsOf (types.submodule (
|
type = types.attrsOf (types.submodule (
|
||||||
{ ... }: {
|
{ ... }: {
|
||||||
|
|
Loading…
Reference in New Issue