randogoth/bucur
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add jirorian Nostr image upload service

Browse source 
Adds the jirorian NixOS module (systemd service, sops secrets, Caddy
fragment), wires it into the flake as a Codeberg input, fixes the Caddy
glob import path, and encrypts all five R2/Nostr secrets into bucur.yaml.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
randogoth 2026-06-08 10:09:30 +03:00
parent 3ae266293f
commit e8dcc49320
6 changed files with 88 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

47
deploy.md
View file

@ -1,47 +0,0 @@
Yes — but you need **NixOS**, not just “minimal Nix.” Here’s the pragmatic path based on your flake:
**What’s missing right now**
- There is **no hardware config** in the repo. You must generate one on the server and include it.
- `sops-nix` expects the **age key file** `secrets/age/keys.txt` to exist **in your local checkout at build time** (it’s ignored, so you must place it manually).
**Recommended install flow (fresh NixOS install)**
1. Boot the NixOS minimal ISO on the server and partition/mount as usual.
2. Generate hardware config:
```bash
nixos-generate-config --root /mnt
```
3. Clone this repo into `/mnt/etc/nixos` (or `/mnt/etc/nixos/bucur`).
4. Move the generated hardware file into the repo:
```bash
mv /mnt/etc/nixos/hardware-configuration.nix /mnt/etc/nixos/hosts/bucur-hardware.nix
```
5. Add it to the flake modules list and ignore it:
- Add `./hosts/bucur-hardware.nix` to `modules` in `flake.nix`.
- Add `/hosts/bucur-hardware.nix` to `.gitignore`.
6. Place your age key in the repo (local‑only):
```bash
install -d -m 700 /mnt/etc/nixos/secrets/age
install -m 600 /path/to/keys.txt /mnt/etc/nixos/secrets/age/keys.txt
```
7. Install using the flake:
```bash
nixos-install --flake /mnt/etc/nixos#bucur
```
8. Reboot, then SSH in as `tobias` using the key in `modules/users/tobias.nix`.
**Alternative (remote rebuild on existing NixOS)**
- If the server is already running NixOS and you can SSH:
```bash
nixos-rebuild switch --flake /path/to/repo#bucur
```
**Important gotchas**
- `services.openssh` disables passwords, so you must have the correct SSH key in `modules/users/tobias.nix`.
- `sops-nix` will fail unless `secrets/age/keys.txt` exists in the checkout used to build.
- `server.md` is ignored and no longer part of the repo/history.
If you want, I can:
1. Add a `hosts/bucur-hardware.nix` placeholder + `.gitignore` entry now.
2. Give you a copy‑paste install script tailored to your disk layout.
Tell me if the server is **fresh** or already running NixOS, and how you want to deploy (local install vs remote rebuild).