nixos-config

This repository holds my NixOS configuration. It is fully reproducible, flakes based, and position-independent, ...

used flakes:

image generation: nixos-generators
disk partitioning: disko
secrets: sops-nix
deployment: nixinate, see usage
formatting: git-hooks
install: nixos-anywhere

Structure

.
├── images       # custom image generations
├── machines     # machine definitions
├── modules      # own nix-options, to modularize services/hardware/...
├── overlays     # overlays
├── pkgs         # own packages, which are not available in nixpkgs
└── profiles     # summarize module collections into single options

Usage

updating:
```
nix flake update
```
deployment/update:
```
nix run .#<flake>
```
secrets:
```
sops ./machines/<host>/secrets.yaml
```

images:

nix build .#install-iso
nix build .#aarch64-install --system aarch64-linux

vms:

nixos-rebuild build-vm --flake .#<flake>

(re-)install:

make sure you have ssh-root access to the machine and the ssh-key is used properly. (It does not matter what system is installed before.)

generate config (only needed for new host)

get nixos-generate-config to run via nix and execute
```
nixos-generate-config --no-filesystems --root $(mktemp -d)
```
reuse the hardware-configuration.nix to create a new machine with its flake.

setup secrets

new host

then prepare the secrets in the following layout:

# enter disk encryption key
(umask 077; echo "my-super-safe-password" > /tmp/disk.key)

temp=$(mktemp -d)
# ssh-host keys
install -d -m755 "$temp/etc/ssh"
install -d -m755 "$temp/etc/secrets/initrd"
ssh-keygen -o -a 100 -N "" -t rsa     -b 4096 -f "$temp/etc/ssh/ssh_host_rsa_key"
ssh-keygen -o -a 100 -N "" -t ed25519         -f "$temp/etc/ssh/ssh_host_ed25519_key"
ssh-keygen -o -a 100 -N "" -t ed25519         -f "$temp/etc/secrets/initrd/ssh_host_ed25519_key"

existing host

(umask 077; echo "my-super-safe-password" > /tmp/disk.key)
temp=$(mktemp -d)
find $temp -printf '%M %p\n'

should result in something looking like this

drwx------ $temp
drwxr-xr-x $temp/etc
drwxr-xr-x $temp/etc/ssh
-rw------- $temp/etc/ssh/ssh_host_rsa_key
-rw------- $temp/etc/ssh/ssh_host_ed25519_key
-rw-r--r-- $temp/etc/ssh/ssh_host_rsa_key.pub
-rw-r--r-- $temp/etc/ssh/ssh_host_ed25519_key.pub
drwxr-xr-x $temp/etc/secrets
drwxr-xr-x $temp/etc/secrets/initrd
-rw------- $temp/etc/secrets/initrd/ssh_host_ed25519_key
-rw-r--r-- $temp/etc/secrets/initrd/ssh_host_ed25519_key.pub

execute install

now simply install by executing (this will delete all data!):

nix run github:nix-community/nixos-anywhere -- \
    --disko-mode disko \
    --disk-encryption-keys /tmp/disk.key /tmp/disk.key \
    --extra-files "$temp" \
    --flake .#<flake> \
    root@<host>

4.3 KiB Raw Blame History

nixos-config

Structure

Usage

Inspired by

4.3 KiB

Raw Blame History