home/nixos-servers
home/nixos-servers
2
0
Fork 0
Code Issues 8 Pull requests Projects Releases Packages Wiki Activity Actions
Infrastructure as Code for our home servers
474 commits 3 branches 0 tags 2.4 MiB
Nix 98.2%
Shell 1.8%
Find a file
Pim Kunis e91f37d700 Remove deploy checks 
Move image globals to kubernetes repo
2024-09-22 21:11:09 +02:00
ansible Rename pikvm ansible playbook 2024-09-07 14:01:00 +02:00
machines Restructure and clean up code 2024-09-07 13:59:04 +02:00
modules Remove code to prefetch Docker images 2024-09-22 20:40:54 +02:00
scripts Remove code to prefetch Docker images 2024-09-22 20:40:54 +02:00
secrets Cleanup after kubernetes deployment migration 2024-09-07 13:06:37 +02:00
utils Remove deploy checks 2024-09-22 21:11:09 +02:00
.gitignore add persistent storage to minecraft 2024-04-13 22:21:26 +02:00
.sops.yaml Cleanup after kubernetes deployment migration 2024-09-07 13:06:37 +02:00
deploy.nix Restructure and clean up code 2024-09-07 13:59:04 +02:00
flake.lock Deploy NixNG-built dnsmasq container image 2024-09-17 13:22:34 +02:00
flake.nix Remove deploy checks 2024-09-22 21:11:09 +02:00
nixos.nix Restructure and clean up code 2024-09-07 13:59:04 +02:00
README.md Move more stuff to kubernetes-deployments 2024-09-07 21:59:17 +02:00
shell.nix Restructure and clean up code 2024-09-07 13:59:04 +02:00

README.md

nixos-servers

Nix definitions to configure our servers at home.

Acknowledgements

  • deploy-rs: NixOS deploy tool with rollback functionality
  • disko: declarative disk partitioning
  • dns.nix: A Nix DSL for defining DNS zones
  • flake-utils: Handy utilities to develop Nix flakes
  • nixos-hardware: Hardware-specific NixOS modules. Doing the heavy lifting for our Raspberry Pi
  • sops-nix: Sops secret management for Nix

Prerequisites

  1. Install the Nix package manager or NixOS (link)
  2. Enable flake and nix commands (link)

Bootstrapping

We bootstrap our servers using nixos-anywhere. This reformats the hard disk of the server and installs a fresh NixOS. Additionally, it deploys an age identity, which is later used for decrypting secrets.

⚠️ This will wipe your server completely ⚠️

  1. Make sure you can decrypt the Sops-encrypted secrets in secrets/. You can test this by running sops -d secrets/serverKeys.yaml.
  2. Ensure you have root SSH access to the server.
  3. Run nixos-anywhere: nix run '.#bootstrap' <servername> <hostname>

Deployment

To deploy all servers at once: nix run 'nixpkgs#deploy-rs' -- '.#' -k To deploy only one server: nix run 'nixpkgs#deploy-rs' -- -k --targets '.#<host>'

Known bugs

Rsync not available during bootstrap

The rsync command was removed from recent NixOS ISO which causes nixos-anywhere to fail when copying extra files. See this issue. Solution is to execute nix-env -iA nixos.rsync on the host.