From b860f7c33acf4bec67f0bb9a06e095a4de603bf8 Mon Sep 17 00:00:00 2001
From: randogoth <kflux@posteo.de>
Date: Fri, 27 Mar 2026 16:47:27 +0300
Subject: [PATCH] fresh deploy

---
 deploy.md | 47 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)
 create mode 100644 deploy.md

diff --git a/deploy.md b/deploy.md
new file mode 100644
index 0000000..fcee793
--- /dev/null
+++ b/deploy.md
@@ -0,0 +1,47 @@
+Yes — but you need **NixOS**, not just “minimal Nix.” Here’s the pragmatic path based on your flake:
+
+**What’s missing right now**
+- There is **no hardware config** in the repo. You must generate one on the server and include it.
+- `sops-nix` expects the **age key file** `secrets/age/keys.txt` to exist **in your local checkout at build time** (it’s ignored, so you must place it manually).
+
+**Recommended install flow (fresh NixOS install)**
+1. Boot the NixOS minimal ISO on the server and partition/mount as usual.
+2. Generate hardware config:
+   ```bash
+   nixos-generate-config --root /mnt
+   ```
+3. Clone this repo into `/mnt/etc/nixos` (or `/mnt/etc/nixos/bucur`).
+4. Move the generated hardware file into the repo:
+   ```bash
+   mv /mnt/etc/nixos/hardware-configuration.nix /mnt/etc/nixos/hosts/bucur-hardware.nix
+   ```
+5. Add it to the flake modules list and ignore it:
+   - Add `./hosts/bucur-hardware.nix` to `modules` in `flake.nix`.
+   - Add `/hosts/bucur-hardware.nix` to `.gitignore`.
+6. Place your age key in the repo (local‑only):
+   ```bash
+   install -d -m 700 /mnt/etc/nixos/secrets/age
+   install -m 600 /path/to/keys.txt /mnt/etc/nixos/secrets/age/keys.txt
+   ```
+7. Install using the flake:
+   ```bash
+   nixos-install --flake /mnt/etc/nixos#bucur
+   ```
+8. Reboot, then SSH in as `tobias` using the key in `modules/users/tobias.nix`.
+
+**Alternative (remote rebuild on existing NixOS)**
+- If the server is already running NixOS and you can SSH:
+  ```bash
+  nixos-rebuild switch --flake /path/to/repo#bucur
+  ```
+
+**Important gotchas**
+- `services.openssh` disables passwords, so you must have the correct SSH key in `modules/users/tobias.nix`.
+- `sops-nix` will fail unless `secrets/age/keys.txt` exists in the checkout used to build.
+- `server.md` is ignored and no longer part of the repo/history.
+
+If you want, I can:
+1. Add a `hosts/bucur-hardware.nix` placeholder + `.gitignore` entry now.
+2. Give you a copy‑paste install script tailored to your disk layout.
+
+Tell me if the server is **fresh** or already running NixOS, and how you want to deploy (local install vs remote rebuild).
\ No newline at end of file