wip

common/module.nix

@@ -15,6 +15,7 @@ in
     ./shell
     ./ssh.nix
     ./nix.nix
+    ./verify-system
   ];
   options = {
     vacu.rootCAs = mkOption { type = types.listOf types.str; };

common/nixos.nix

@@ -10,6 +10,7 @@
   imports = [
     ./module.nix
     ./common-but-not.nix
+    ./verify-system/nixos.nix
   ];
   options.vacu.underTest = lib.mkOption {
     default = false;

common/verify-system/default.nix

@@ -0,0 +1,35 @@
+{ pkgs, lib, config, ... }: let
+  inherit (lib) mkOption mkEnableOption types;
+  cfg = config.vacu.verifySystem;
+in {
+  options.vacu.verifySystem = {
+    enable = (mkEnableOption "verify system is what is expected") // { default = true; };
+    verifiers = mkOption {
+      default = {};
+      type = types.attrsOf (types.submodule ({ name, config, ... }: {
+        options = {
+          enable = mkEnableOption "Enable system ident check ${name}";
+	  name = mkOption { type = types.str; default = name; };
+	  script = mkOption { type = types.lines; default = "## system ident check ${config.name}"; };
+	};
+      }));
+    };
+
+    verifyAllScript = let
+      verifiers = (builtins.attrValues cfg.verifiers);
+      enabled = builtins.filter (s: s.enable) verifiers;
+      files = map (s: pkgs.writeText "vacu-verify-system-${s.name}.sh" s.script) enabled;
+      script = ''
+        ## vacu verify-system
+	for f in ${lib.concatStringsSep " " files}; do
+	  echo "verifying system with $f"
+	  if ! source $f; then
+	    echo "ERR: $f failed" >&2
+	    return 1
+	  fi
+	done
+      '';
+      scriptFile = pkgs.writeText "vacu-verify-system-all.sh" script;
+    in mkOption { readOnly = true; default = scriptFile; };
+  };
+}

common/verify-system/nixos.nix

@@ -0,0 +1,41 @@
+{ lib, config, pkgs, ... }: let
+  inherit (lib) mkOption types;
+in {
+  options.vacu.verifySystem.expectedMac = mkOption { type = types.nullOr (types.strMatching "[A-Fa-f0-9]{2}(:[A-Fa-f0-9]{2}){5}"); default = null; };
+  config = lib.mkIf config.vacu.verifySystem.enable {
+    system.activationScripts."00-verify-system" = {
+      text = "if ! source ${config.vacu.verifySystem.verifyAllScript}; then exit $?; fi";
+      supportsDryActivation = true;
+    };
+
+    vacu.verifySystem.verifiers = {
+      hostname = {
+        enable = lib.mkDefault true;
+	script = ''
+	  expected=${config.networking.hostName}
+	  actual=$(cat /proc/sys/kernel/hostname)
+	  if [[ "$expected" != "$actual" ]]; then
+	    echo "ERR: unexpected hostname; Trying to deploy to $expected but this is $actual" >&2
+	    return 1
+	  fi
+	'';
+       };
+       expectedMac = {
+         enable = config.vacu.verifySystem.expectedMac != null;
+	 script = ''
+	   expected=${lib.toUpper config.vacu.verifySystem.expectedMac}
+	   declare -a actual=($(${pkgs.iproute2}/bin/ip -j link | ${pkgs.jq}/bin/jq 'map(.address | ascii_upcase) | join("\n")' -r))
+	   for ifMac in "''${actual[@]}"; do
+             if [[ "$ifMac" == "$expected" ]]; then
+	       # all is well
+	       return 0
+	      fi
+	   done
+	   echo "ERR: Interface MAC address $expected not present, this may not be the system you intend to deploy to." >&2
+	   echo "     Found MAC addresses: ''${actual[*]}" >&2
+	   return 1
+	 '';
+       };
+     };
+  };
+}