NixOS Rescue Iso with mainline kernel

a-rescue-iso.nix

{
  lib,
  pkgs,
  inputs,
  ...
}: {
  imports = [
    "${inputs.nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-graphical-plasma5.nix"
    "${inputs.nixpkgs}/nixos/modules/installer/cd-dvd/channel.nix"
  ];

  nix = {
    settings.experimental-features = ["nix-command" "flakes"];
    extraOptions = "experimental-features = nix-command flakes";
  };

  services = {
    openssh.settings.PermitRootLogin = lib.mkForce "yes";
    # TODO Add authorized Keys
  };

  boot = let
    version = "6.12-rc3";
    kernelPatches = pkgs.callPackage "${inputs.nixpkgs}/pkgs/os-specific/linux/kernel/patches.nix" {};
    ref = "6efbea77b390604a7be7364583e19cd2d6a1291b";
    linux_mainline = {
      buildLinux,
      fetchzip,
      ...
    } @ args:
      buildLinux {
        version = version;
        src = fetchzip {
          url = "https://git.kernel.org/torvalds/t/linux-${ref}.tar.gz";
          hash = "sha256-TP1sBMr34gAfIWD/LBlhorSebABUYsQE4OBuDFb348c=";
        };
        modDirVersion = lib.versions.pad 3 version;
        kernelPatches = [
          kernelPatches.bridge_stp_helper
          kernelPatches.request_key_helper
        ];
        extraMeta.branch = "master";
      };
    linuxMainlinePkg = pkgs.callPackage linux_mainline {};
    linuxMainlinePkgs = pkgs.recurseIntoAttrs (pkgs.linuxPackagesFor linuxMainlinePkg);
  in {
    kernelPackages = linuxMainlinePkgs;
    supportedFilesystems = lib.mkForce ["bcachefs" "btrfs" "vfat" "f2fs" "xfs" "ntfs" "cifs"];
  };

  users.extraUsers.root.hashedPassword = "$y$j9T$6eIwRNXAtlsVCP4x8GrQi1$PDbhjsbOGyIArOYtxtgc6u.w7I.M4iZbfk3pc7a4b93"; # nixos
  users.extraUsers.root.initialPassword = lib.mkForce null;
  users.extraUsers.root.initialHashedPassword = lib.mkForce null;

  systemd = {
    services.sshd.wantedBy = pkgs.lib.mkForce ["multi-user.target"];
    targets = {
      sleep.enable = false;
      suspend.enable = false;
      hibernate.enable = false;
      hybrid-sleep.enable = false;
    };
  };

  networking = {
    hostName = "rescue-iso";
  };
}

build.sh

nix build .#nixosConfigurations.rescue-iso.config.system.build.isoImage

flake.nix

{
  description = "flake for rescue-iso";

  inputs = {
    nixpkgs = {
      url = "github:nixos/nixpkgs/nixos-unstable";
    };
  };

  outputs = {
    self,
    nixpkgs,
    ...
  } @ inputs: let
    system = "x86_64-linux";
  in {
    nixosConfigurations = {
      rescue-iso = nixpkgs.lib.nixosSystem {
        inherit system;
        modules = [
          a-rescue-iso.nix
        ];
        specialArgs = {inherit inputs};
      };
    };
  };
}