47 lines
2.1 KiB
Markdown
47 lines
2.1 KiB
Markdown
|
Yes — but you need **NixOS**, not just “minimal Nix.” Here’s the pragmatic path based on your flake:
|
|||
|
|
|
|||
|
|
**What’s missing right now**
|
|||
|
|
- There is **no hardware config** in the repo. You must generate one on the server and include it.
|
|||
|
|
- `sops-nix` expects the **age key file** `secrets/age/keys.txt` to exist **in your local checkout at build time** (it’s ignored, so you must place it manually).
|
|||
|
|
|
|||
|
|
**Recommended install flow (fresh NixOS install)**
|
|||
|
|
1. Boot the NixOS minimal ISO on the server and partition/mount as usual.
|
|||
|
|
2. Generate hardware config:
|
|||
|
|
```bash
|
|||
|
|
nixos-generate-config --root /mnt
|
|||
|
|
```
|
|||
|
|
3. Clone this repo into `/mnt/etc/nixos` (or `/mnt/etc/nixos/bucur`).
|
|||
|
|
4. Move the generated hardware file into the repo:
|
|||
|
|
```bash
|
|||
|
|
mv /mnt/etc/nixos/hardware-configuration.nix /mnt/etc/nixos/hosts/bucur-hardware.nix
|
|||
|
|
```
|
|||
|
|
5. Add it to the flake modules list and ignore it:
|
|||
|
|
- Add `./hosts/bucur-hardware.nix` to `modules` in `flake.nix`.
|
|||
|
|
- Add `/hosts/bucur-hardware.nix` to `.gitignore`.
|
|||
|
|
6. Place your age key in the repo (local‑only):
|
|||
|
|
```bash
|
|||
|
|
install -d -m 700 /mnt/etc/nixos/secrets/age
|
|||
|
|
install -m 600 /path/to/keys.txt /mnt/etc/nixos/secrets/age/keys.txt
|
|||
|
|
```
|
|||
|
|
7. Install using the flake:
|
|||
|
|
```bash
|
|||
|
|
nixos-install --flake /mnt/etc/nixos#bucur
|
|||
|
|
```
|
|||
|
|
8. Reboot, then SSH in as `tobias` using the key in `modules/users/tobias.nix`.
|
|||
|
|
|
|||
|
|
**Alternative (remote rebuild on existing NixOS)**
|
|||
|
|
- If the server is already running NixOS and you can SSH:
|
|||
|
|
```bash
|
|||
|
|
nixos-rebuild switch --flake /path/to/repo#bucur
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
**Important gotchas**
|
|||
|
|
- `services.openssh` disables passwords, so you must have the correct SSH key in `modules/users/tobias.nix`.
|
|||
|
|
- `sops-nix` will fail unless `secrets/age/keys.txt` exists in the checkout used to build.
|
|||
|
|
- `server.md` is ignored and no longer part of the repo/history.
|
|||
|
|
|
|||
|
|
If you want, I can:
|
|||
|
|
1. Add a `hosts/bucur-hardware.nix` placeholder + `.gitignore` entry now.
|
|||
|
|
2. Give you a copy‑paste install script tailored to your disk layout.
|
|||
|
|
|
|||
|
|
Tell me if the server is **fresh** or already running NixOS, and how you want to deploy (local install vs remote rebuild).
|