imterah/nix-infra
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

fix: Make configuration installable

Browse source
This commit is contained in:
Tera << 8 2025-05-05 21:58:28 -04:00
parent dd929d89d3
commit 8a2f7309ec
Signed by: imterah
GPG key ID: 8FA7DD57BA6CEA37
4 changed files with 44 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

5
README.md
View file

@ -51,8 +51,9 @@ TODO.
### Installing the Configuration
1. Copy/clone the configuration over to the host to install.
1. Copy/clone the configuration over to the host to install and `cd` into it.
2. Copy the sops key data to the host you are installing on (sops `key.txt` and `ssh_host_ed25519_key` to `/var/lib/sops-nix/`)
3. Run `sudo nix --experimental-features "nix-command flakes" run github:nix-community/disko/latest -- --mode destroy,format,mount -f "$PWD#hostname"` to prepare the disk, replacing `hostname` with the host you want to install (ex. `andromeda`).
4. Before installing, prepare sops inside the mounted filesystem: `sudo mkdir -p /mnt/persist/var/lib/sops-nix/; sudo cp -r /var/lib/sops-nix/ /mnt/persist/var/lib/sops-nix/`
4. Before installing, prepare sops inside the mounted filesystem: `sudo mkdir -p /mnt/persist/var/lib/sops-nix/; sudo cp -r /var/lib/sops-nix/ /mnt/persist/var/lib/; sudo chmod -R 755 /mnt/persist/var/lib/sops-nix/`
5. Run `sudo nixos-install --flake "$PWD#hostname"` to install the OS, replacing `hostname` with the host you want to install (ex. `andromeda`).
6. Copy the current configuration into `/etc/nixos`: `sudo cp -r $PWD/. /mnt/persist/etc/nixos`

10
hosts/andromeda/hardware-configuration.nix
View file

@ -9,12 +9,13 @@
...
}: {
imports = [
(modulesPath + "/installer/scan/not-detected.nix")
(modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = ["xhci_pci" "usbhid" "uas" "sd_mod"];
boot.initrd.kernelModules = ["dm-snapshot"];
boot.kernelModules = [];
boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
boot.initrd.kernelModules = [ "dm-snapshot" ];
boot.kernelModules = [ "kvm-amd" ];
boot.extraModulePackages = [ ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
@ -23,5 +24,4 @@
networking.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}

30
system/disko.nix
View file

@ -20,29 +20,39 @@
rootfs = {
size = "100%";
name = "NixOS";
content = {
type = "lvm_pv";
vg = "root_vg";
};
};
};
};
};
};
lvm_vg = {
root_vg = {
type = "lvm_vg";
lvs = {
root = {
size = "100%FREE";
content = {
type = "btrfs";
extraArgs = ["-f"];
subvolumes = {
root = {
name = "root";
"/root" = {
mountpoint = "/";
};
persist = {
name = "persist";
"/persist" = {
mountpoint = "/persist";
mountOptions = ["subvol=persist" "noatime"];
};
home = {
name = "home";
"/home" = {
mountpoint = "/home";
mountOptions = ["subvol=home" "noatime"];
};
nix = {
name = "nix";
"/nix" = {
mountpoint = "/nix";
mountOptions = ["compress=zstd" "subvol=nix" "noatime"];
};
mountOptions = ["subvol=nix" "noatime"];
};
};
};

8
system/sops.nix
View file

@ -9,10 +9,10 @@ in
sops = {
defaultSopsFile = "${secretspath}/secrets.yaml";
age = {
# I'd prefer different OpenSSH keys for different hosts so I'm not 100% screwed if one of my devices get compromised.
# Therefore, we set a custom path for the sops key.
sshKeyPaths = ["/var/lib/sops-nix/ssh_host_ed25519_key"];
keyFile = "/var/lib/sops-nix/key.txt";
# I'd prefer different OpenSSH keys for different hosts so I'm not 100% screwed if one of my devices get compromised (SSH traffic potentially being decrypted and analyzed).
# Therefore, we set a custom path for the sops key & let the SSH key be generated automagically.
sshKeyPaths = ["/persist/var/lib/sops-nix/ssh_host_ed25519_key"];
keyFile = "/persist/var/lib/sops-nix/key.txt";
generateKey = false;
};
secrets = {