configuration.nix

@@ -1,7 +1,10 @@
 { pkgs, lib, ... }:
 
 {
+  # Work-around for running out of space on /boot
+  disabledModules = [ "system/boot/loader/raspberrypi/raspberrypi.nix" ];
   imports = [
+    ./modules/system/boot/loader/raspberrypi/raspberrypi.nix
     ./hardware-configuration.nix
     ./inquisitor.nix
   ];
@@ -41,7 +44,6 @@
     zip unzip
     tinc_pre
   ];
-  environment.variables.EDITOR = "vim";
 
   # SSH config. Change passwordAuthentication if you want to log in with a password.
   services.openssh = {

hardware-configuration.nix

@@ -1,6 +1,9 @@
 { config, pkgs, lib, ... }:
 
 {
+  disabledModules = [ "system/boot/loader/raspberrypi/raspberrypi.nix" ];
+  imports = [ ./modules/system/boot/loader/raspberrypi/raspberrypi.nix ];
+
   boot.loader.grub.enable = false;
   boot.loader.raspberryPi = {
     enable = true;
@@ -16,6 +19,7 @@
       boot_delay=10
     '';
   };
+  boot.loader.systemd-boot.configurationLimit = 1;
 
   # This is necessary for the rpi3.
   boot.kernelPackages = pkgs.linuxPackages_rpi4;

inquisitor.nix

@@ -5,19 +5,14 @@ let
   inquisitorSource = pkgs.fetchFromGitHub {
     owner = "Jaculabilis";
     repo = "Inquisitor";
-    rev = "a6d961aba948d3a682dbde12dbaa8805eadbbd84";
+    rev = "5d0c5b1ae33b06a2dd82befcbefd02ad03d742f3";
-    sha256 = "10n6c5zvi27f92b7am0rrdizxz0mlp3rw1y1jyd44b57ykk7x6fr";
+    sha256 = "02ldawycs6wf4y9d94y0f2mhsjfy7kp6j779bia7akyy4iihrib4";
   };
   inquisitor = pkgs.callPackage inquisitorSource {};
 
   # Define the inquisitor data directory
   inquisiDir = "/var/lib/inquisitor";
 
-  # Define an scp helper for executing in cron jobs
-  scp-helper = pkgs.writeShellScriptBin "scp-helper" ''
-    ${pkgs.openssh}/bin/scp -i ${inquisiDir}/inquisitor.key -oStrictHostKeyChecking=no "$@"
-  '';
-
   # Define the inquisitor service user
   inquisitorUser = {
     name = "inquisitor";
@@ -51,12 +46,6 @@ let
 
     # Ensure the service owns the folders
     chown -R ${inquisitorUser.name} ${inquisiDir}
-
-    # Ensure the scp helper is present
-    if [ -f ${inquisiDir}/scp-helper ]; then
-      rm ${inquisiDir}/scp-helper
-    fi
-    ln -s -t ${inquisiDir} ${scp-helper}/bin/scp-helper
   '';
 
   # Create a run script for the server
@@ -65,7 +54,6 @@ let
     ${inquisitor}/bin/gunicorn \
       --bind=localhost:24133 \
       --workers=4 \
-      --timeout 120 \
       --log-level debug \
       "inquisitor.app:wsgi()"
   '';

modules/system/boot/loader/raspberrypi/raspberrypi-builder.nix

@@ -0,0 +1,13 @@
+{ pkgs, configTxt }:
+
+pkgs.substituteAll {
+  src = ./raspberrypi-builder.sh;
+  isExecutable = true;
+  #postInstall = "shellcheck $out";
+  #nativeBuildInputs = [ pkgs.buildPackages.shellcheck ];
+
+  inherit (pkgs.buildPackages) bash;
+  path = with pkgs.buildPackages; [coreutils gnused gnugrep];
+  firmware = pkgs.raspberrypifw;
+  inherit configTxt;
+}

modules/system/boot/loader/raspberrypi/raspberrypi-builder.sh

@@ -0,0 +1,179 @@
+#! @bash@/bin/bash
+
+# This can end up being called disregarding the shebang.
+set -e
+
+shopt -s nullglob
+
+export PATH=/empty
+for i in @path@; do PATH=$PATH:$i/bin; done
+
+usage() {
+    echo "usage: $0 -c <path-to-default-configuration> [-d <boot-dir>] [-g <num-generations>]" >&2
+    exit 1
+}
+
+default=                # Default configuration
+target=/boot            # Target directory
+numGenerations=0        # Number of other generations to include in the menu
+
+while getopts "c:d:g:" opt; do
+    case "$opt" in
+        c) default="$OPTARG" ;;
+        d) target="$OPTARG" ;;
+        g) numGenerations="$OPTARG" ;;
+        \?) usage ;;
+    esac
+done
+
+echo "updating the boot generations directory..."
+
+mkdir -p "$target/old"
+
+# Convert a path to a file in the Nix store such as
+# /nix/store/<hash>-<name>/file to <hash>-<name>-<file>.
+cleanName() {
+    local path="$1"
+    echo "$path" | sed 's|^/nix/store/||' | sed 's|/|-|g'
+}
+
+atomicCopy() {
+    local src="$1"
+    local dst="$2"
+    local dstTmp=$dst.tmp.$$
+    cp "$src" "$dstTmp"
+    mv "$dstTmp" "$dst"
+}
+
+# Copy a file from the Nix store to $target/nixos.
+declare -A filesCopied
+
+copyToOldDir() {
+    local src dst
+    src=$(readlink -f "$1")
+    dst="$target/old/$(cleanName "$src")"
+    # Don't copy the file if $dst already exists.  This means that we
+    # have to create $dst atomically to prevent partially copied
+    # kernels or initrd if this script is ever interrupted.
+    if ! test -e "$dst"; then
+        atomicCopy "$src" "$dst"
+    fi
+    filesCopied[$dst]=1
+}
+
+copyDtbDir() {
+    local dtb_dir="$1"
+    local dst_dir="$2"
+    mkdir -p "$dst_dir"
+    for dtb in "$dtb_dir"/{broadcom,}/bcm*.dtb; do
+        local dst
+        dst="$dst_dir/$(basename "$dtb")"
+        local dstTmp=$dst.tmp.$$
+        cp "$dtb" "$dstTmp"
+        mv "$dstTmp" "$dst"
+        filesCopied[$dst]=1
+    done
+    filesCopied[$dst_dir]=1
+}
+
+cpMarked() {
+    local src="$1"
+    local dst="$2"
+    cp "$src" "$dst"
+    filesCopied[$dst]=1
+}
+
+echoMarked() {
+    local src="$1"
+    local dst="$2"
+    echo "$src" >"$dst"
+    filesCopied[$dst]=1
+}
+
+# Copy its kernel, initrd and dtbs to $target/old
+addEntry() {
+    local path
+    path=$(readlink -f "$1")
+    local tag="$2" # Generation number or 'default'
+
+    if ! test -e "$path/kernel" -a -e "$path/initrd"; then
+        return
+    fi
+
+    local kernel initrd dtb_path init kernel_params
+    kernel=$(readlink -f "$path/kernel")
+    initrd=$(readlink -f "$path/initrd")
+    dtb_path=$(readlink -f "$path/dtbs")
+    init=$(readlink -f "$path/init")
+    kernel_params=$(readlink -f "$path/kernel-params")
+
+    if [ "$tag" = "default" ]; then
+        atomicCopy "$kernel" "$target/kernel.img"
+        atomicCopy "$initrd" "$target/initrd"
+        copyDtbDir "$dtb_path" "$target"
+        atomicCopy "$init" "$target/nixos-init"
+
+        tmpFile="$target/cmdline.txt.$$"
+        echo "$(cat "$kernel_params") init=$init" >"$tmpFile"
+        mv -f "$tmpFile" "$target/cmdline.txt"
+    else
+        copyToOldDir "$kernel"
+        copyToOldDir "$initrd"
+
+        copyDtbDir "$dtb_path" "$target/old/$(cleanName "$dtb_path")"
+
+        echoMarked "$path" "$target/old/$generation-system"
+        echoMarked "$init" "$target/old/$generation-init"
+        cpMarked "$kernel_params" "$target/old/$generation-cmdline.txt"
+        echoMarked "$initrd" "$target/old/$generation-initrd"
+        echoMarked "$kernel" "$target/old/$generation-kernel"
+        echoMarked "$dtb_path" "$target/old/$generation-dtbs"
+    fi
+}
+
+addEntry "$default" default
+
+if [ "$numGenerations" -gt 0 ]; then
+    # Add up to $numGenerations generations of the system profile to $target/old,
+    # in reverse (most recent to least recent) order.
+    for generation in $(
+            (cd /nix/var/nix/profiles && ls -d system-*-link) \
+            | sed 's/system-\([0-9]\+\)-link/\1/' \
+            | sort -n -r \
+            | head -n "$numGenerations"); do
+        link=/nix/var/nix/profiles/system-$generation-link
+        addEntry "$link" "$generation"
+    done
+fi
+
+# Add the firmware files
+fwdir=@firmware@/share/raspberrypi/boot/
+atomicCopy $fwdir/bootcode.bin  "$target/bootcode.bin"
+atomicCopy $fwdir/fixup.dat     "$target/fixup.dat"
+atomicCopy $fwdir/fixup4.dat    "$target/fixup4.dat"
+atomicCopy $fwdir/fixup4cd.dat  "$target/fixup4cd.dat"
+atomicCopy $fwdir/fixup4db.dat  "$target/fixup4db.dat"
+atomicCopy $fwdir/fixup4x.dat   "$target/fixup4x.dat"
+atomicCopy $fwdir/fixup_cd.dat  "$target/fixup_cd.dat"
+atomicCopy $fwdir/fixup_db.dat  "$target/fixup_db.dat"
+atomicCopy $fwdir/fixup_x.dat   "$target/fixup_x.dat"
+atomicCopy $fwdir/start.elf     "$target/start.elf"
+atomicCopy $fwdir/start4.elf    "$target/start4.elf"
+atomicCopy $fwdir/start4cd.elf  "$target/start4cd.elf"
+atomicCopy $fwdir/start4db.elf  "$target/start4db.elf"
+atomicCopy $fwdir/start4x.elf   "$target/start4x.elf"
+atomicCopy $fwdir/start_cd.elf  "$target/start_cd.elf"
+atomicCopy $fwdir/start_db.elf  "$target/start_db.elf"
+atomicCopy $fwdir/start_x.elf   "$target/start_x.elf"
+
+# Add the config.txt
+atomicCopy @configTxt@ "$target/config.txt"
+
+# Remove obsolete files from $target and $target/nixos.
+for fn in "$target"/old/* "$target"/bcm*.dtb "$target"/cmdline.txt.*; do
+    if ! test "${filesCopied[$fn]}" = 1; then
+        echo "Removing no longer needed boot file: $fn"
+        chmod +w -- "$fn"
+        rm -rf -- "$fn"
+    fi
+done

modules/system/boot/loader/raspberrypi/raspberrypi.nix

@@ -0,0 +1,107 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.boot.loader.raspberryPi;
+
+  inherit (pkgs.stdenv.hostPlatform) platform;
+
+  builderUboot = import ./uboot-builder.nix { inherit pkgs configTxt; inherit (cfg) version; };
+  builderGeneric = import ./raspberrypi-builder.nix { inherit pkgs configTxt; };
+
+  builder =
+    if cfg.uboot.enable then
+      "${builderUboot} -g ${toString cfg.configurationLimit} -t ${timeoutStr} -c"
+    else
+      "${builderGeneric} -g ${toString cfg.configurationLimit} -c";
+
+  blCfg = config.boot.loader;
+  timeoutStr = if blCfg.timeout == null then "-1" else toString blCfg.timeout;
+
+  isAarch64 = pkgs.stdenv.hostPlatform.isAarch64;
+  optional = pkgs.stdenv.lib.optionalString;
+
+  configTxt =
+    pkgs.writeText "config.txt" (''
+      # U-Boot used to need this to work, regardless of whether UART is actually used or not.
+      # TODO: check when/if this can be removed.
+      enable_uart=1
+
+      # Prevent the firmware from smashing the framebuffer setup done by the mainline kernel
+      # when attempting to show low-voltage or overtemperature warnings.
+      avoid_warnings=1
+    '' + optional isAarch64 ''
+      # Boot in 64-bit mode.
+      arm_64bit=1
+    '' + (if cfg.uboot.enable then ''
+      kernel=u-boot-rpi.bin
+    '' else ''
+      kernel=kernel.img
+      initramfs initrd followkernel
+    '') + optional (cfg.firmwareConfig != null) cfg.firmwareConfig);
+
+in
+
+{
+  options = {
+
+    boot.loader.raspberryPi = {
+      enable = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          Whether to create files with the system generations in
+          <literal>/boot</literal>.
+          <literal>/boot/old</literal> will hold files from old generations.
+        '';
+      };
+
+      version = mkOption {
+        default = 2;
+        type = types.enum [ 0 1 2 3 4 ];
+        description = ''
+        '';
+      };
+
+      configurationLimit = mkOption {
+        default = 20;
+        example = 10;
+        type = types.int;
+        description = ''
+          Maximum number of configurations in the boot menu.
+        '';
+      };
+
+      uboot = {
+        enable = mkOption {
+          default = false;
+          type = types.bool;
+          description = ''
+            Enable using uboot as bootmanager for the raspberry pi.
+          '';
+        };
+      };
+
+      firmwareConfig = mkOption {
+        default = null;
+        type = types.nullOr types.lines;
+        description = ''
+          Extra options that will be appended to <literal>/boot/config.txt</literal> file.
+          For possible values, see: https://www.raspberrypi.org/documentation/configuration/config-txt/
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = singleton {
+      assertion = !pkgs.stdenv.hostPlatform.isAarch64 || cfg.version >= 3;
+      message = "Only Raspberry Pi >= 3 supports aarch64.";
+    };
+
+    system.build.installBootLoader = builder;
+    system.boot.loader.id = "raspberrypi";
+    system.boot.loader.kernelFile = platform.kernelTarget;
+  };
+}