bucur/deploy.md

Yes — but you need NixOS, not just “minimal Nix.” Here’s the pragmatic path based on your flake:

What’s missing right now

• There is no hardware config in the repo. You must generate one on the server and include it.
• sops-nix expects the age key file secrets/age/keys.txt to exist in your local checkout at build time (it’s ignored, so you must place it manually).

Recommended install flow (fresh NixOS install)

1. Boot the NixOS minimal ISO on the server and partition/mount as usual.
2. Generate hardware config:

   nixos-generate-config --root /mnt
   

3. Clone this repo into /mnt/etc/nixos (or /mnt/etc/nixos/bucur).
4. Move the generated hardware file into the repo:

   mv /mnt/etc/nixos/hardware-configuration.nix /mnt/etc/nixos/hosts/bucur-hardware.nix
   

5. Add it to the flake modules list and ignore it:
   • Add ./hosts/bucur-hardware.nix to modules in flake.nix.
   • Add /hosts/bucur-hardware.nix to .gitignore.
6. Place your age key in the repo (local‑only):

   install -d -m 700 /mnt/etc/nixos/secrets/age
   install -m 600 /path/to/keys.txt /mnt/etc/nixos/secrets/age/keys.txt
   

7. Install using the flake:

   nixos-install --flake /mnt/etc/nixos#bucur
   

8. Reboot, then SSH in as tobias using the key in modules/users/tobias.nix.

Alternative (remote rebuild on existing NixOS)

• If the server is already running NixOS and you can SSH:

  nixos-rebuild switch --flake /path/to/repo#bucur
  

Important gotchas

• services.openssh disables passwords, so you must have the correct SSH key in modules/users/tobias.nix.
• sops-nix will fail unless secrets/age/keys.txt exists in the checkout used to build.
• server.md is ignored and no longer part of the repo/history.

If you want, I can:

1. Add a hosts/bucur-hardware.nix placeholder + .gitignore entry now.
2. Give you a copy‑paste install script tailored to your disk layout.

Tell me if the server is fresh or already running NixOS, and how you want to deploy (local install vs remote rebuild).