installe en 3 étapes avec swap sur disque cible, pour les PC à 4 Go de RAM

install.cmd

@@ -0,0 +1,256 @@
+@echo off
+setlocal enabledelayedexpansion
+
+REM Claude Code Windows CMD Bootstrap Script
+REM Installs Claude Code for environments where PowerShell is not available
+
+REM Parse command line argument
+set "TARGET=%~1"
+if "!TARGET!"=="" set "TARGET=latest"
+
+REM Validate target parameter
+if /i "!TARGET!"=="stable" goto :target_valid
+if /i "!TARGET!"=="latest" goto :target_valid
+echo !TARGET! | findstr /r "^[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*" >nul
+if !ERRORLEVEL! equ 0 goto :target_valid
+
+echo Usage: %0 [stable^|latest^|VERSION] >&2
+echo Example: %0 1.0.58 >&2
+exit /b 1
+
+:target_valid
+
+REM Check for 64-bit Windows
+if /i "%PROCESSOR_ARCHITECTURE%"=="AMD64" goto :arch_valid
+if /i "%PROCESSOR_ARCHITECTURE%"=="ARM64" goto :arch_valid
+if /i "%PROCESSOR_ARCHITEW6432%"=="AMD64" goto :arch_valid
+if /i "%PROCESSOR_ARCHITEW6432%"=="ARM64" goto :arch_valid
+
+echo Claude Code does not support 32-bit Windows. Please use a 64-bit version of Windows. >&2
+exit /b 1
+
+:arch_valid
+
+REM Set constants
+set "DOWNLOAD_BASE_URL=https://downloads.claude.ai/claude-code-releases"
+set "DOWNLOAD_DIR=%USERPROFILE%\.claude\downloads"
+REM Use native ARM64 binary on ARM64 Windows, x64 otherwise
+if /i "%PROCESSOR_ARCHITECTURE%"=="ARM64" (
+    set "PLATFORM=win32-arm64"
+) else (
+    set "PLATFORM=win32-x64"
+)
+
+REM Create download directory
+if not exist "!DOWNLOAD_DIR!" mkdir "!DOWNLOAD_DIR!"
+
+REM Check for curl availability
+curl --version >nul 2>&1
+if !ERRORLEVEL! neq 0 (
+    echo curl is required but not available. Please install curl or use PowerShell installer. >&2
+    exit /b 1
+)
+
+REM Always download latest version (which has the most up-to-date installer)
+call :download_file "!DOWNLOAD_BASE_URL!/latest" "!DOWNLOAD_DIR!\latest"
+if !ERRORLEVEL! neq 0 (
+    echo Failed to get latest version >&2
+    exit /b 1
+)
+
+REM Reject non-version content (e.g. an HTML error page) before it reaches the manifest URL
+findstr /r "^[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*" "!DOWNLOAD_DIR!\latest" >nul
+if !ERRORLEVEL! neq 0 (
+    del "!DOWNLOAD_DIR!\latest"
+    echo Failed to get a valid version from downloads.claude.ai - got unexpected content. >&2
+    echo This can happen if the download service is unreachable or not available in your region - see https://www.anthropic.com/supported-countries >&2
+    exit /b 1
+)
+
+REM Read version from file
+set /p VERSION=<"!DOWNLOAD_DIR!\latest"
+del "!DOWNLOAD_DIR!\latest"
+
+REM Download manifest
+call :download_file "!DOWNLOAD_BASE_URL!/!VERSION!/manifest.json" "!DOWNLOAD_DIR!\manifest.json"
+if !ERRORLEVEL! neq 0 (
+    echo Failed to get manifest >&2
+    exit /b 1
+)
+
+REM Extract checksum from manifest
+call :parse_manifest "!DOWNLOAD_DIR!\manifest.json" "!PLATFORM!"
+if !ERRORLEVEL! neq 0 (
+    echo Platform !PLATFORM! not found in manifest >&2
+    del "!DOWNLOAD_DIR!\manifest.json" 2>nul
+    exit /b 1
+)
+del "!DOWNLOAD_DIR!\manifest.json"
+
+REM Download binary
+set "BINARY_PATH=!DOWNLOAD_DIR!\claude-!VERSION!-!PLATFORM!.exe"
+call :download_file "!DOWNLOAD_BASE_URL!/!VERSION!/!PLATFORM!/claude.exe" "!BINARY_PATH!"
+if !ERRORLEVEL! neq 0 (
+    echo Failed to download binary >&2
+    if exist "!BINARY_PATH!" del "!BINARY_PATH!"
+    exit /b 1
+)
+
+REM Verify checksum
+call :verify_checksum "!BINARY_PATH!" "!EXPECTED_CHECKSUM!"
+if !ERRORLEVEL! neq 0 (
+    echo Checksum verification failed >&2
+    del "!BINARY_PATH!"
+    exit /b 1
+)
+
+REM Run claude install to set up launcher and shell integration
+echo Setting up Claude Code...
+"!BINARY_PATH!" install "!TARGET!"
+set "INSTALL_RESULT=!ERRORLEVEL!"
+
+REM Clean up downloaded file
+REM Wait a moment for any file handles to be released
+timeout /t 1 /nobreak >nul 2>&1
+del /f "!BINARY_PATH!" >nul 2>&1
+if exist "!BINARY_PATH!" (
+    echo Warning: Could not remove temporary file: !BINARY_PATH!
+)
+
+if !INSTALL_RESULT! neq 0 (
+    echo Installation failed >&2
+    exit /b 1
+)
+
+echo.
+echo Installation complete^^!
+echo.
+exit /b 0
+
+REM ============================================================================
+REM SUBROUTINES
+REM ============================================================================
+
+:download_file
+REM Downloads a file using curl
+REM Args: %1=URL, %2=OutputPath
+set "URL=%~1"
+set "OUTPUT=%~2"
+
+REM Capture stderr so a certificate-revocation failure can be detected below
+curl -fsSL "!URL!" -o "!OUTPUT!" 2>"!OUTPUT!.stderr"
+set "CURL_RESULT=!ERRORLEVEL!"
+if !CURL_RESULT! equ 0 goto :download_file_done
+
+REM Some networks (commonly corporate ones) block the endpoints Windows uses
+REM to check whether a TLS certificate has been revoked. curl's schannel
+REM backend then fails with CRYPT_E_NO_REVOCATION_CHECK (0x80092012) or
+REM CRYPT_E_REVOCATION_OFFLINE (0x80092013). Retry once with best-effort
+REM revocation checking - the soft-fail behavior browsers use: an unreachable
+REM revocation server is tolerated, but a certificate that is known to be
+REM revoked is still rejected.
+findstr /i /c:"0x80092012" /c:"0x80092013" "!OUTPUT!.stderr" >nul
+if !ERRORLEVEL! neq 0 (
+    type "!OUTPUT!.stderr" >&2
+    goto :download_file_done
+)
+
+echo This network appears to block certificate revocation checks. Retrying the download with best-effort revocation checking... >&2
+curl -fsSL --ssl-revoke-best-effort "!URL!" -o "!OUTPUT!"
+set "CURL_RESULT=!ERRORLEVEL!"
+REM If the retry also failed, re-emit the original error so the actionable
+REM schannel diagnostic is not lost
+if !CURL_RESULT! neq 0 type "!OUTPUT!.stderr" >&2
+
+:download_file_done
+del "!OUTPUT!.stderr" >nul 2>&1
+exit /b !CURL_RESULT!
+
+:parse_manifest
+REM Parse JSON manifest to extract checksum for platform
+REM Args: %1=ManifestPath, %2=Platform
+set "MANIFEST_PATH=%~1"
+set "PLATFORM_NAME=%~2"
+set "EXPECTED_CHECKSUM="
+
+REM Use findstr to find platform section, then look for checksum
+set "FOUND_PLATFORM="
+set "IN_PLATFORM_SECTION="
+
+REM Read the manifest line by line
+for /f "usebackq tokens=*" %%i in ("!MANIFEST_PATH!") do (
+    set "LINE=%%i"
+    
+    REM Check if this line contains our platform
+    echo !LINE! | findstr /c:"\"%PLATFORM_NAME%\":" >nul
+    if !ERRORLEVEL! equ 0 (
+        set "IN_PLATFORM_SECTION=1"
+    )
+    
+    REM If we're in the platform section, look for checksum
+    if defined IN_PLATFORM_SECTION (
+        echo !LINE! | findstr /c:"\"checksum\":" >nul
+        if !ERRORLEVEL! equ 0 (
+            REM Extract checksum value
+            for /f "tokens=2 delims=:" %%j in ("!LINE!") do (
+                set "CHECKSUM_PART=%%j"
+                REM Remove quotes, whitespace, and comma
+                set "CHECKSUM_PART=!CHECKSUM_PART: =!"
+                set "CHECKSUM_PART=!CHECKSUM_PART:"=!"
+                set "CHECKSUM_PART=!CHECKSUM_PART:,=!"
+                
+                REM Check if it looks like a SHA256 (64 hex chars)
+                if not "!CHECKSUM_PART!"=="" (
+                    call :check_length "!CHECKSUM_PART!" 64
+                    if !ERRORLEVEL! equ 0 (
+                        set "EXPECTED_CHECKSUM=!CHECKSUM_PART!"
+                        exit /b 0
+                    )
+                )
+            )
+        )
+        
+        REM Check if we've left the platform section (closing brace)
+        echo !LINE! | findstr /c:"}" >nul
+        if !ERRORLEVEL! equ 0 set "IN_PLATFORM_SECTION="
+    )
+)
+
+if "!EXPECTED_CHECKSUM!"=="" exit /b 1
+exit /b 0
+
+:check_length
+REM Check if string length equals expected length
+REM Args: %1=String, %2=ExpectedLength
+set "STR=%~1"
+set "EXPECTED_LEN=%~2"
+set "LEN=0"
+:count_loop
+if "!STR:~%LEN%,1!"=="" goto :count_done
+set /a LEN+=1
+goto :count_loop
+:count_done
+if %LEN%==%EXPECTED_LEN% exit /b 0
+exit /b 1
+
+:verify_checksum
+REM Verify file checksum using certutil
+REM Args: %1=FilePath, %2=ExpectedChecksum
+set "FILE_PATH=%~1"
+set "EXPECTED=%~2"
+
+for /f "skip=1 tokens=*" %%i in ('certutil -hashfile "!FILE_PATH!" SHA256') do (
+    set "ACTUAL=%%i"
+    set "ACTUAL=!ACTUAL: =!"
+    if "!ACTUAL!"=="CertUtil:Thecommandcompletedsuccessfully." goto :verify_done
+    if "!ACTUAL!" neq "" (
+        if /i "!ACTUAL!"=="!EXPECTED!" (
+            exit /b 0
+        ) else (
+            exit /b 1
+        )
+    )
+)
+
+:verify_done
+exit /b 1

installer/install.sh

@@ -24,48 +24,6 @@ for _ in $(seq 1 30); do
   sleep 1
 done
 
-# Installe en 3 étapes séparées (partition -> swap sur le disque cible ->
-# vrai build) au lieu d'un seul `disko-install`. Raison : disko-install
-# fait tout d'un coup dans le tmpfs RAM de l'environnement live, qui sature
-# sur les PC à peu de RAM (4 Go) avant même de toucher le disque cible.
-# Un swapfile posé sur /mnt (une fois partitionné) donne accès aux ~200 Go
-# du disque comme mémoire virtuelle pendant la vraie construction — méthode
-# documentée officiellement pour les machines à RAM limitée, voir
-# wiki.nixos.org/wiki/Swap et le manuel NixOS (section installation).
-#
-# Point non confirmé à 100% : que `disko` (seul, pas `disko-install`)
-# accepte le même `--disk main <device>` que `disko-install`. La doc de
-# référence de disko ne montre que `--argstr`, mais disko-install n'étant
-# qu'un wrapper autour de disko, c'est très probable que ça marche pareil.
-# Si la commande le refuse, l'erreur sera explicite.
-do_install() {
-  local flake_url="$1"
-  local attr="$2"
-
-  echo "Partitionnement de $DEVICE..."
-  nix run --no-write-lock-file --refresh 'github:nix-community/disko' -- \
-    --mode destroy,format,mount \
-    --flake "${flake_url}#${attr}" \
-    --disk main "$DEVICE"
-
-  echo "Swap temporaire sur le disque cible (RAM limitée sur certains PC du parc)..."
-  dd if=/dev/zero of=/mnt/.install-swapfile bs=1M count=4096 status=none
-  chmod 600 /mnt/.install-swapfile
-  mkswap /mnt/.install-swapfile
-  swapon /mnt/.install-swapfile
-
-  echo "Construction et installation du système (peut prendre plusieurs minutes)..."
-  # --no-channel-copy, --no-root-passwd : confirmés dans le man nixos-install
-  # (mankier.com/8/nixos-install, miroir du manuel officiel). Le mot de
-  # passe root est de toute façon déjà déclaré (initialPassword) dans la
-  # config cible, --no-root-passwd évite juste tout risque de prompt
-  # interactif qui bloquerait un install non surveillé.
-  nixos-install --root /mnt --flake "${flake_url}#${attr}" --no-channel-copy --no-root-passwd
-
-  swapoff /mnt/.install-swapfile
-  rm -f /mnt/.install-swapfile
-}
-
 echo "=== Installeur Nixos_Fleet ==="
 echo "1) PC de la flotte (générique)"
 echo "2) Poste utilisateur nommé"
@@ -101,7 +59,9 @@ case "$CHOICE" in
     # --- Branche flotte : rien d'autre à saisir -----------------------
     echo
     echo "Installation du profil générique 'usagers' sur $DEVICE..."
-    do_install "$FLEET_REPO" "usagers"
+    nix run --no-write-lock-file --refresh 'github:nix-community/disko#disko-install' -- --write-efi-boot-entries \
+      --flake "${FLEET_REPO}#usagers" \
+      --disk main "$DEVICE"
     ;;
 
   2)
@@ -134,7 +94,9 @@ case "$CHOICE" in
     if [[ "$ATTR" == *-luks ]]; then
       echo "Disque chiffré : disko va demander une passphrase LUKS pendant le partitionnement."
     fi
-    do_install "$AUTHED_URL" "$ATTR"
+    nix run --no-write-lock-file --refresh 'github:nix-community/disko#disko-install' -- --write-efi-boot-entries \
+      --flake "${AUTHED_URL}#${ATTR}" \
+      --disk main "$DEVICE"
 
     # Le système installé doit pouvoir continuer à tirer ses mises à jour
     # du repo privé tout seul : on lui laisse un netrc, jamais commité,

pxe-server/configuration.nix

@@ -41,9 +41,6 @@ in
   ];
 
   i18n.defaultLocale = "fr_FR.UTF-8";
-  # i18n.defaultLocale ne règle pas le clavier de la console — option
-  # séparée, absente jusqu'ici pour ce host (vérifié : wiki.nixos.org/wiki/Keyboard_Layout_Customization).
-  console.keyMap = "fr";
 
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;