2023-11-05 17:43:32 +00:00
|
|
|
# nixos-servers
|
|
|
|
|
|
2024-03-09 10:44:29 +00:00
|
|
|
Nix definitions to configure our servers at home.
|
2023-11-05 17:43:32 +00:00
|
|
|
|
2024-02-10 22:14:10 +00:00
|
|
|
## Acknowledgements
|
|
|
|
|
|
|
|
|
|
- [deploy-rs](https://github.com/serokell/deploy-rs): NixOS deploy tool with rollback functionality
|
|
|
|
|
- [disko](https://github.com/nix-community/disko): declarative disk partitioning
|
|
|
|
|
- [dns.nix](https://github.com/kirelagin/dns.nix): A Nix DSL for defining DNS zones
|
2024-03-02 13:10:36 +00:00
|
|
|
- [flake-utils](https://github.com/numtide/flake-utils): Handy utilities to develop Nix flakes
|
2024-05-19 12:05:20 +00:00
|
|
|
- [nixos-hardware](https://github.com/NixOS/nixos-hardware): Hardware-specific NixOS modules. Doing the heavy lifting for our Raspberry Pi
|
2024-06-15 20:27:07 +00:00
|
|
|
- [sops-nix](https://github.com/Mic92/sops-nix): Sops secret management for Nix
|
2023-12-29 11:51:42 +00:00
|
|
|
|
2024-09-07 19:58:27 +00:00
|
|
|
## Prerequisites
|
2023-11-05 18:03:44 +00:00
|
|
|
|
2023-11-15 12:24:06 +00:00
|
|
|
1. Install the Nix package manager or NixOS ([link](https://nixos.org/download))
|
|
|
|
|
2. Enable flake and nix commands ([link](https://nixos.wiki/wiki/Flakes#Enable_flakes_permanently_in_NixOS))
|
2023-11-13 21:44:43 +00:00
|
|
|
|
2024-09-07 19:58:27 +00:00
|
|
|
## Bootstrapping
|
2023-11-13 21:44:43 +00:00
|
|
|
|
2024-04-13 13:43:01 +00:00
|
|
|
We bootstrap our servers using [nixos-anywhere](https://github.com/nix-community/nixos-anywhere).
|
2023-11-15 12:24:06 +00:00
|
|
|
This reformats the hard disk of the server and installs a fresh NixOS.
|
|
|
|
|
Additionally, it deploys an age identity, which is later used for decrypting secrets.
|
2023-11-05 18:03:44 +00:00
|
|
|
|
2023-11-15 12:24:06 +00:00
|
|
|
⚠️ This will wipe your server completely ⚠️
|
2023-11-05 18:03:44 +00:00
|
|
|
|
2024-07-28 12:48:09 +00:00
|
|
|
1. Make sure you can decrypt the Sops-encrypted secrets in `secrets/`. You can test this by running `sops -d secrets/serverKeys.yaml`.
|
2023-11-15 12:24:06 +00:00
|
|
|
2. Ensure you have root SSH access to the server.
|
2024-07-14 11:31:18 +00:00
|
|
|
3. Run nixos-anywhere: `nix run '.#bootstrap' <servername> <hostname>`
|
2023-11-05 18:07:32 +00:00
|
|
|
|
2024-09-07 19:58:27 +00:00
|
|
|
## Deployment
|
2023-11-05 18:07:32 +00:00
|
|
|
|
2024-07-14 11:31:18 +00:00
|
|
|
To deploy all servers at once: `nix run 'nixpkgs#deploy-rs' -- '.#' -k`
|
|
|
|
|
To deploy only one server: `nix run 'nixpkgs#deploy-rs' -- -k --targets '.#<host>'`
|
2024-02-05 21:50:57 +00:00
|
|
|
|
2024-04-13 11:35:18 +00:00
|
|
|
## Known bugs
|
2024-03-27 19:10:14 +00:00
|
|
|
|
|
|
|
|
### Rsync not available during bootstrap
|
|
|
|
|
|
|
|
|
|
The `rsync` command was removed from recent NixOS ISO which causes nixos-anywhere to fail when copying extra files.
|
|
|
|
|
See [this](https://github.com/nix-community/nixos-anywhere/issues/260) issue.
|
|
|
|
|
Solution is to execute `nix-env -iA nixos.rsync` on the host.
|
