From 65dc95e52f4919423834efbbbbc8a94d9aefd2c4 Mon Sep 17 00:00:00 2001
From: Flo <max06.net@outlook.com>
Date: Sun, 24 Nov 2024 15:12:14 +0100
Subject: [PATCH 1/4] feat: Allow setting a password on cmdline for pxe boot

---
 nixos/modules/installer/netboot/netboot.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/nixos/modules/installer/netboot/netboot.nix b/nixos/modules/installer/netboot/netboot.nix
index adcc10316fea..fa477a11a4f7 100644
--- a/nixos/modules/installer/netboot/netboot.nix
+++ b/nixos/modules/installer/netboot/netboot.nix
@@ -141,6 +141,17 @@ with lib;
         # /etc/NIXOS tag.
         touch /etc/NIXOS
         ${config.nix.package}/bin/nix-env -p /nix/var/nix/profiles/system --set /run/current-system
+
+        # Set password for user nixos if specified on cmdline
+        # Allows using nixos-anywhere in headless environments
+        for o in $(</proc/cmdline); do
+          case "$o" in
+            live.nixos.passwd=*)
+              set -- $(IFS==; echo $o)
+              echo "nixos:$2" | ${pkgs.shadow}/bin/chpasswd
+              ;;
+          esac
+        done
       '';
 
   };

From 9a524549d64566b5f45107903a922d92511763a2 Mon Sep 17 00:00:00 2001
From: Flo <max06.net@outlook.com>
Date: Sun, 24 Nov 2024 22:39:56 +0100
Subject: [PATCH 2/4] Add passwordHash option

---
 nixos/modules/installer/netboot/netboot.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/installer/netboot/netboot.nix b/nixos/modules/installer/netboot/netboot.nix
index fa477a11a4f7..1706dbf455d6 100644
--- a/nixos/modules/installer/netboot/netboot.nix
+++ b/nixos/modules/installer/netboot/netboot.nix
@@ -146,9 +146,13 @@ with lib;
         # Allows using nixos-anywhere in headless environments
         for o in $(</proc/cmdline); do
           case "$o" in
-            live.nixos.passwd=*)
+            live.nixos.passwordHash=*)
               set -- $(IFS==; echo $o)
-              echo "nixos:$2" | ${pkgs.shadow}/bin/chpasswd
+              sed -i "s/nixos::/nixos:$2:/" /etc/shadow
+              ;;
+            live.nixos.password=*)
+              set -- $(IFS==; echo $o)
+              sed -i "s/nixos::/nixos:$(echo $2 | mkpasswd -m sha-512 -s):/" /etc/shadow
               ;;
           esac
         done

From f5080d12b384b58f70047a35fdc67ff90ba8490a Mon Sep 17 00:00:00 2001
From: Flo <max06.net@outlook.com>
Date: Thu, 28 Nov 2024 13:47:45 +0100
Subject: [PATCH 3/4] Rebuild password update functionality, add tests

---
 nixos/modules/installer/netboot/netboot.nix | 49 ++++++++++-----------
 nixos/tests/boot.nix                        | 18 +++++---
 2 files changed, 36 insertions(+), 31 deletions(-)

diff --git a/nixos/modules/installer/netboot/netboot.nix b/nixos/modules/installer/netboot/netboot.nix
index 1706dbf455d6..ae8655f407e6 100644
--- a/nixos/modules/installer/netboot/netboot.nix
+++ b/nixos/modules/installer/netboot/netboot.nix
@@ -131,33 +131,30 @@ with lib;
 
     boot.loader.timeout = 10;
 
-    boot.postBootCommands =
-      ''
-        # After booting, register the contents of the Nix store
-        # in the Nix database in the tmpfs.
-        ${config.nix.package}/bin/nix-store --load-db < /nix/store/nix-path-registration
+    boot.postBootCommands = ''
+      # After booting, register the contents of the Nix store
+      # in the Nix database in the tmpfs.
+      ${config.nix.package}/bin/nix-store --load-db < /nix/store/nix-path-registration
 
-        # nixos-rebuild also requires a "system" profile and an
-        # /etc/NIXOS tag.
-        touch /etc/NIXOS
-        ${config.nix.package}/bin/nix-env -p /nix/var/nix/profiles/system --set /run/current-system
-
-        # Set password for user nixos if specified on cmdline
-        # Allows using nixos-anywhere in headless environments
-        for o in $(</proc/cmdline); do
-          case "$o" in
-            live.nixos.passwordHash=*)
-              set -- $(IFS==; echo $o)
-              sed -i "s/nixos::/nixos:$2:/" /etc/shadow
-              ;;
-            live.nixos.password=*)
-              set -- $(IFS==; echo $o)
-              sed -i "s/nixos::/nixos:$(echo $2 | mkpasswd -m sha-512 -s):/" /etc/shadow
-              ;;
-          esac
-        done
-      '';
+      # nixos-rebuild also requires a "system" profile and an
+      # /etc/NIXOS tag.
+      touch /etc/NIXOS
+      ${config.nix.package}/bin/nix-env -p /nix/var/nix/profiles/system --set /run/current-system
 
+      # Set password for user nixos if specified on cmdline
+      # Allows using nixos-anywhere in headless environments
+      for o in $(</proc/cmdline); do
+        case "$o" in
+          live.nixos.passwordHash=*)
+            set -- $(IFS==; echo $o)
+            ${pkgs.gnugrep}/bin/grep -q "root::" /etc/shadow && ${pkgs.shadow}/bin/usermod -p "$2" root
+            ;;
+          live.nixos.password=*)
+            set -- $(IFS==; echo $o)
+            ${pkgs.gnugrep}/bin/grep -q "root::" /etc/shadow && echo "root:$2" | ${pkgs.shadow}/bin/chpasswd
+            ;;
+        esac
+      done
+    '';
   };
-
 }
diff --git a/nixos/tests/boot.nix b/nixos/tests/boot.nix
index 56f72dddf526..b73f9593e491 100644
--- a/nixos/tests/boot.nix
+++ b/nixos/tests/boot.nix
@@ -85,11 +85,19 @@ let
     let
       config = (import ../lib/eval-config.nix {
           inherit system;
-          modules =
-            [ ../modules/installer/netboot/netboot.nix
-              ../modules/testing/test-instrumentation.nix
-              { key = "serial"; }
-            ];
+          modules = [
+            ../modules/installer/netboot/netboot.nix
+            ../modules/testing/test-instrumentation.nix
+            {
+              boot.kernelParams = [
+                "serial"
+                "live.nixos.passwordHash=$6$jnwR50SkbLYEq/Vp$wmggwioAkfmwuYqd5hIfatZWS/bO6hewzNIwIrWcgdh7k/fhUzZT29Vil3ioMo94sdji/nipbzwEpxecLZw0d0" # "password"
+              ];
+            }
+            {
+              key = "serial";
+            }
+          ];
         }).config;
       ipxeBootDir = pkgs.symlinkJoin {
         name = "ipxeBootDir";

From dc8d92608d407c7f80a3cba8d4195aa1a0b7c36c Mon Sep 17 00:00:00 2001
From: Flo <max06.net@outlook.com>
Date: Thu, 28 Nov 2024 13:50:44 +0100
Subject: [PATCH 4/4] Add tests

---
 nixos/tests/boot.nix | 55 ++++++++++++++++++++++++--------------------
 1 file changed, 30 insertions(+), 25 deletions(-)

diff --git a/nixos/tests/boot.nix b/nixos/tests/boot.nix
index b73f9593e491..3ec8d3e5a3cf 100644
--- a/nixos/tests/boot.nix
+++ b/nixos/tests/boot.nix
@@ -111,34 +111,39 @@ let
         pxe = ipxeBootDir;
       } // extraConfig);
     in
-      makeTest {
-        name = "boot-netboot-" + name;
-        nodes = { };
-        testScript = ''
-            machine = create_machine("${startCommand}")
-            machine.start()
-            machine.wait_for_unit("multi-user.target")
-            machine.shutdown()
-          '';
-      };
-in {
-    uefiCdrom = makeBootTest "uefi-cdrom" {
-      uefi = true;
-      cdrom = "${iso}/iso/${iso.isoName}";
+    makeTest {
+      name = "boot-netboot-" + name;
+      nodes = { };
+      testScript = ''
+        machine = create_machine("${startCommand}")
+        machine.start()
+        machine.wait_for_unit("multi-user.target")
+        machine.succeed("grep 'serial' /proc/cmdline")
+        machine.succeed("grep 'live.nixos.passwordHash' /proc/cmdline")
+        machine.succeed("grep '$6$jnwR50SkbLYEq/Vp$wmggwioAkfmwuYqd5hIfatZWS/bO6hewzNIwIrWcgdh7k/fhUzZT29Vil3ioMo94sdji/nipbzwEpxecLZw0d0' /etc/shadow")
+        machine.shutdown()
+      '';
     };
+in
+{
+  uefiCdrom = makeBootTest "uefi-cdrom" {
+    uefi = true;
+    cdrom = "${iso}/iso/${iso.isoName}";
+  };
 
-    uefiUsb = makeBootTest "uefi-usb" {
-      uefi = true;
-      usb = "${iso}/iso/${iso.isoName}";
-    };
+  uefiUsb = makeBootTest "uefi-usb" {
+    uefi = true;
+    usb = "${iso}/iso/${iso.isoName}";
+  };
 
-    uefiNetboot = makeNetbootTest "uefi" {
-      uefi = true;
-    };
-} // lib.optionalAttrs (pkgs.stdenv.hostPlatform.system == "x86_64-linux") {
-    biosCdrom = makeBootTest "bios-cdrom" {
-      cdrom = "${iso}/iso/${iso.isoName}";
-    };
+  uefiNetboot = makeNetbootTest "uefi" {
+    uefi = true;
+  };
+}
+// lib.optionalAttrs (pkgs.stdenv.hostPlatform.system == "x86_64-linux") {
+  biosCdrom = makeBootTest "bios-cdrom" {
+    cdrom = "${iso}/iso/${iso.isoName}";
+  };
 
     biosUsb = makeBootTest "bios-usb" {
       usb = "${iso}/iso/${iso.isoName}";