2023-11-05 17:43:32 +00:00
# nixos-servers
2024-03-09 10:44:29 +00:00
Nix definitions to configure our servers at home.
2023-11-05 17:43:32 +00:00
2024-02-10 22:14:10 +00:00
## Acknowledgements
- [deploy-rs ](https://github.com/serokell/deploy-rs ): NixOS deploy tool with rollback functionality
- [disko ](https://github.com/nix-community/disko ): declarative disk partitioning
- [dns.nix ](https://github.com/kirelagin/dns.nix ): A Nix DSL for defining DNS zones
2024-03-02 13:10:36 +00:00
- [flake-utils ](https://github.com/numtide/flake-utils ): Handy utilities to develop Nix flakes
2024-05-19 12:05:20 +00:00
- [nixos-hardware ](https://github.com/NixOS/nixos-hardware ): Hardware-specific NixOS modules. Doing the heavy lifting for our Raspberry Pi
- [kubenix ](https://kubenix.org/ ): declare and deploy Kubernetes resources using Nix
- [nixhelm ](https://github.com/farcaller/nixhelm ): Nix-digestible Helm charts
2024-06-15 20:27:07 +00:00
- [sops-nix ](https://github.com/Mic92/sops-nix ): Sops secret management for Nix
2023-12-29 11:51:42 +00:00
2024-02-10 22:14:10 +00:00
## Installation
2023-12-29 11:51:42 +00:00
2024-02-10 22:14:10 +00:00
### Prerequisites
2023-11-05 18:03:44 +00:00
2023-11-15 12:24:06 +00:00
1. Install the Nix package manager or NixOS ([link](https://nixos.org/download))
2. Enable flake and nix commands ([link](https://nixos.wiki/wiki/Flakes#Enable_flakes_permanently_in_NixOS))
2023-11-13 21:44:43 +00:00
2024-02-10 22:14:10 +00:00
### Bootstrapping
2023-11-13 21:44:43 +00:00
2024-04-13 13:43:01 +00:00
We bootstrap our servers using [nixos-anywhere ](https://github.com/nix-community/nixos-anywhere ).
2023-11-15 12:24:06 +00:00
This reformats the hard disk of the server and installs a fresh NixOS.
Additionally, it deploys an age identity, which is later used for decrypting secrets.
2023-11-05 18:03:44 +00:00
2023-11-15 12:24:06 +00:00
⚠️ This will wipe your server completely ⚠️
2023-11-05 18:03:44 +00:00
2023-11-15 12:24:06 +00:00
1. Make sure your have a [Secret service ](https://www.gnu.org/software/emacs/manual/html_node/auth/Secret-Service-API.html ) running (such as Keepassxc) that provides the age identity.
2. Ensure you have root SSH access to the server.
2024-02-29 22:07:51 +00:00
3. Run nixos-anywhere: `nix run .#bootstrap <servername> <hostname>`
2023-11-05 18:07:32 +00:00
2024-02-10 22:14:10 +00:00
### Deployment
2023-11-05 18:07:32 +00:00
2024-03-02 13:10:36 +00:00
To deploy all servers at once: `nix run nixpkgs#deploy-rs -- .# -k`
2024-03-02 09:50:16 +00:00
To deploy only one server: `nix run nixpkgs#deploy-rs -- -k --targets .#<host>`
2024-02-05 21:50:57 +00:00
2024-04-13 11:35:18 +00:00
## Deploying to Kubernetes
To deploy to the Kubernetes cluster, first make sure you have an admin account on the cluster.
You can generate this using `nix run .#gen-k3s-cert <username> <servername> ~/.kube` , assuming you have SSH access to the master node.
This puts a private key, signed certificate and a kubeconfig in the kubeconfig directory
2024-02-05 21:50:57 +00:00
2024-04-13 11:35:18 +00:00
If the cluster has not been initialized yet, next run `nix run .#kubenix-bootstrap.x86_64-linux` .
2024-04-13 15:28:31 +00:00
2024-04-13 11:35:18 +00:00
Lastly, deploy everything to the cluster using `nix run .#kubenix.x86_64-linux` .
## Known bugs
2024-03-27 19:10:14 +00:00
### Rsync not available during bootstrap
The `rsync` command was removed from recent NixOS ISO which causes nixos-anywhere to fail when copying extra files.
See [this ](https://github.com/nix-community/nixos-anywhere/issues/260 ) issue.
Solution is to execute `nix-env -iA nixos.rsync` on the host.
