nixos-servers/README.md

# nixos-servers

Nix definitions to configure our servers at home.

## Acknowledgements

- [deploy-rs](https://github.com/serokell/deploy-rs): NixOS deploy tool with rollback functionality
- [disko](https://github.com/nix-community/disko): declarative disk partitioning
- [dns.nix](https://github.com/kirelagin/dns.nix): A Nix DSL for defining DNS zones
- [flake-utils](https://github.com/numtide/flake-utils): Handy utilities to develop Nix flakes
- [nixos-hardware](https://github.com/NixOS/nixos-hardware): Hardware-specific NixOS modules. Doing the heavy lifting for our Raspberry Pi
- [kubenix](https://kubenix.org/): declare and deploy Kubernetes resources using Nix
- [nixhelm](https://github.com/farcaller/nixhelm): Nix-digestible Helm charts
- [sops-nix](https://github.com/Mic92/sops-nix): Sops secret management for Nix

## Installation

### Prerequisites

1. Install the Nix package manager or NixOS ([link](https://nixos.org/download))
2. Enable flake and nix commands ([link](https://nixos.wiki/wiki/Flakes#Enable_flakes_permanently_in_NixOS))

### Bootstrapping

We bootstrap our servers using [nixos-anywhere](https://github.com/nix-community/nixos-anywhere).
This reformats the hard disk of the server and installs a fresh NixOS.
Additionally, it deploys an age identity, which is later used for decrypting secrets.

⚠️  This will wipe your server completely ⚠️

1. Make sure your have a [Secret service](https://www.gnu.org/software/emacs/manual/html_node/auth/Secret-Service-API.html) running (such as Keepassxc) that provides the age identity.
2. Ensure you have root SSH access to the server.
3. Run nixos-anywhere: `nix run '.#bootstrap' <servername> <hostname>`

### Deployment

To deploy all servers at once: `nix run 'nixpkgs#deploy-rs' -- '.#' -k`
To deploy only one server: `nix run 'nixpkgs#deploy-rs' -- -k --targets '.#<host>'`

## Deploying to Kubernetes

To deploy to the Kubernetes cluster, first make sure you have an admin account on the cluster.
You can generate this using `nix run '.#gen-k3s-cert' <username> <servername> ~/.kube`, assuming you have SSH access to the master node.
This puts a private key, signed certificate and a kubeconfig in the kubeconfig directory

If the cluster has not been initialized yet, next run `nix run '.#kubenix.x86_64-linux.bootstrap.deploy'`.

Applications are currently deployed in two method:
 - A single big deployment of many applications (which I am trying to move away from)
 - A separate deployment for each application using [ApplySets](https://kubernetes.io/docs/tasks/manage-kubernetes-objects/declarative-config/#how-to-delete-objects)

The first method: `nix run '.#kubenix.x86_64-linux.all.deploy'`
The second method: `nix run '.#kubenix.x86_64-linux.<application>.deploy'`
Currently, the applications being deployed like this are:
- `cyberchef`
- `freshrss`
- `radicale`
- `kms`
- `atuin`
- `blog`
- `nextcloud`
- `hedgedoc`
- `kitchenowl`
- `forgejo`
- `paperless-ngx`
- `syncthing`
- `pihole`
- `immich`
- `attic`
- `inbucket`
- `dnsmasq`
- `bind9`
- `media`

## Known bugs

### Rsync not available during bootstrap

The `rsync` command was removed from recent NixOS ISO which causes nixos-anywhere to fail when copying extra files.
See [this](https://github.com/nix-community/nixos-anywhere/issues/260) issue.
Solution is to execute `nix-env -iA nixos.rsync` on the host.
init 2023-11-05 17:43:32 +00:00			`# nixos-servers`

update readme 2024-03-09 10:44:29 +00:00			`Nix definitions to configure our servers at home.`
init 2023-11-05 17:43:32 +00:00
Update README.md 2024-02-10 22:14:10 +00:00			`## Acknowledgements`

			`- [deploy-rs](https://github.com/serokell/deploy-rs): NixOS deploy tool with rollback functionality`
			`- [disko](https://github.com/nix-community/disko): declarative disk partitioning`
			`- [dns.nix](https://github.com/kirelagin/dns.nix): A Nix DSL for defining DNS zones`
update documentation 2024-03-02 13:10:36 +00:00			`- [flake-utils](https://github.com/numtide/flake-utils): Handy utilities to develop Nix flakes`
Improve createScript function 2024-05-19 12:05:20 +00:00			`- [nixos-hardware](https://github.com/NixOS/nixos-hardware): Hardware-specific NixOS modules. Doing the heavy lifting for our Raspberry Pi`
			`- [kubenix](https://kubenix.org/): declare and deploy Kubernetes resources using Nix`
			`- [nixhelm](https://github.com/farcaller/nixhelm): Nix-digestible Helm charts`
Replace agenix with sops-nix 2024-06-15 20:27:07 +00:00			`- [sops-nix](https://github.com/Mic92/sops-nix): Sops secret management for Nix`
restructure documentation 2023-12-29 11:51:42 +00:00
Update README.md 2024-02-10 22:14:10 +00:00			`## Installation`
restructure documentation 2023-12-29 11:51:42 +00:00
Update README.md 2024-02-10 22:14:10 +00:00			`### Prerequisites`
update README change directory naming 2023-11-05 18:03:44 +00:00
update readme update boostrap script 2023-11-15 12:24:06 +00:00			`1. Install the Nix package manager or NixOS ([link](https://nixos.org/download))`
			`2. Enable flake and nix commands ([link](https://nixos.wiki/wiki/Flakes#Enable_flakes_permanently_in_NixOS))`
initial nixos-anywhere 2023-11-13 21:44:43 +00:00
Update README.md 2024-02-10 22:14:10 +00:00			`### Bootstrapping`
initial nixos-anywhere 2023-11-13 21:44:43 +00:00
cleanup 2024-04-13 13:43:01 +00:00			`We bootstrap our servers using [nixos-anywhere](https://github.com/nix-community/nixos-anywhere).`
update readme update boostrap script 2023-11-15 12:24:06 +00:00			`This reformats the hard disk of the server and installs a fresh NixOS.`
			`Additionally, it deploys an age identity, which is later used for decrypting secrets.`
update README change directory naming 2023-11-05 18:03:44 +00:00
update readme update boostrap script 2023-11-15 12:24:06 +00:00			`⚠️ This will wipe your server completely ⚠️`
update README change directory naming 2023-11-05 18:03:44 +00:00
update readme update boostrap script 2023-11-15 12:24:06 +00:00			`1. Make sure your have a [Secret service](https://www.gnu.org/software/emacs/manual/html_node/auth/Secret-Service-API.html) running (such as Keepassxc) that provides the age identity.`
			`2. Ensure you have root SSH access to the server.`
docs(readme): Update deployment instructions docs(readme): Fix commands for ZSH 2024-07-14 11:31:18 +00:00			3. Run nixos-anywhere: `nix run '.#bootstrap' <servername> <hostname>`
Update README.md 2023-11-05 18:07:32 +00:00
Update README.md 2024-02-10 22:14:10 +00:00			`### Deployment`
Update README.md 2023-11-05 18:07:32 +00:00
docs(readme): Update deployment instructions docs(readme): Fix commands for ZSH 2024-07-14 11:31:18 +00:00			To deploy all servers at once: `nix run 'nixpkgs#deploy-rs' -- '.#' -k`
			To deploy only one server: `nix run 'nixpkgs#deploy-rs' -- -k --targets '.#<host>'`
update readme about microvm bug 2024-02-05 21:50:57 +00:00
update documentation on k8s 2024-04-13 11:35:18 +00:00			`## Deploying to Kubernetes`

			`To deploy to the Kubernetes cluster, first make sure you have an admin account on the cluster.`
docs(readme): Update deployment instructions docs(readme): Fix commands for ZSH 2024-07-14 11:31:18 +00:00			You can generate this using `nix run '.#gen-k3s-cert' <username> <servername> ~/.kube`, assuming you have SSH access to the master node.
update documentation on k8s 2024-04-13 11:35:18 +00:00			`This puts a private key, signed certificate and a kubeconfig in the kubeconfig directory`
update readme about microvm bug 2024-02-05 21:50:57 +00:00
docs(readme): Update deployment instructions docs(readme): Fix commands for ZSH 2024-07-14 11:31:18 +00:00			If the cluster has not been initialized yet, next run `nix run '.#kubenix.x86_64-linux.bootstrap.deploy'`.
create own library for globals and net.nix 2024-04-13 15:28:31 +00:00
docs(readme): Update deployment instructions docs(readme): Fix commands for ZSH 2024-07-14 11:31:18 +00:00			`Applications are currently deployed in two method:`
			`- A single big deployment of many applications (which I am trying to move away from)`
			`- A separate deployment for each application using [ApplySets](https://kubernetes.io/docs/tasks/manage-kubernetes-objects/declarative-config/#how-to-delete-objects)`

			The first method: `nix run '.#kubenix.x86_64-linux.all.deploy'`
			The second method: `nix run '.#kubenix.x86_64-linux.<application>.deploy'`
			`Currently, the applications being deployed like this are:`
			- `cyberchef`
			- `freshrss`
feat(kms): Move to separate namespace 2024-07-14 11:58:08 +00:00			- `radicale`
			- `kms`
feat(atuin): Move to separate k8s namespace 2024-07-14 12:14:08 +00:00			- `atuin`
feat(blog): Move to static-websites k8s namespace refactor(cyberchef): Move to static-websites k8s namespace 2024-07-14 13:31:58 +00:00			- `blog`
feat(nextcloud): Move to separate k8s namespace 2024-07-14 13:56:38 +00:00			- `nextcloud`
feat(hedgedoc): Move to separate k8s namespace 2024-07-14 14:20:24 +00:00			- `hedgedoc`
feat(kitchenowl): Move to separate k8s namespace 2024-07-14 17:59:49 +00:00			- `kitchenowl`
feat(forgejo): Move to separate k8s namespace 2024-07-14 18:14:48 +00:00			- `forgejo`
feat(paperless-ngx): Move to separate k8s namespace 2024-07-14 20:58:06 +00:00			- `paperless-ngx`
feat(syncthing): Move to separate k8s namespace 2024-07-16 13:31:47 +00:00			- `syncthing`
feat(pihole): Move to separate k8s namespace 2024-07-16 13:46:13 +00:00			- `pihole`
feat(immich): Move to separate k8s namespace 2024-07-16 14:13:29 +00:00			- `immich`
feat(attic): Move to separate k8s namespace 2024-07-16 16:38:47 +00:00			- `attic`
feat(inbucket): Move to separate k8s namespace 2024-07-16 17:56:18 +00:00			- `inbucket`
feat(dnsmasq): Move to dns k8s namespace refactor(pihole): Move to dns k8s namespace 2024-07-17 08:25:23 +00:00			- `dnsmasq`
feat(bind9): Move to dns k8s namespace 2024-07-17 08:30:50 +00:00			- `bind9`
feat(media): Move to separate k8s namespace 2024-07-17 09:59:48 +00:00			- `media`
docs(readme): Update deployment instructions docs(readme): Fix commands for ZSH 2024-07-14 11:31:18 +00:00
update documentation on k8s 2024-04-13 11:35:18 +00:00			`## Known bugs`
add script to generate k3s certificate 2024-03-27 19:10:14 +00:00
			`### Rsync not available during bootstrap`

			The `rsync` command was removed from recent NixOS ISO which causes nixos-anywhere to fail when copying extra files.
			`See [this](https://github.com/nix-community/nixos-anywhere/issues/260) issue.`
			Solution is to execute `nix-env -iA nixos.rsync` on the host.