TODO working on changes to this now

Old Config prior to per system flake approach

https://git.joshuabell.xyz/dotfiles/~files/6527f67145fe047df57b4778c154dde580ec04c4

Old modules from multi branch flake approach

First Install on new Machine

NixOS install

Install nix minimal: (new with btrfs backing)

Partitions
- parted /dev/DEVICE -- mklabel gpt - make GPT partition table
- parted /dev/DEVICE -- mkpart NIXROOT 2GB 100% - make root partition (2GB offset for boot)
- parted /dev/DEVICE -- mkpart ESP fat32 1MB 2GB - make boot partition (2GB)
- parted /dev/DEVICE -- set 2 esp on - make boot bootable
LUKS Encryption
- cryptsetup luksFormat /dev/DEVICE_1
  - Create passphrase and save to bitwarden
- cryptsetup luksOpen /dev/DEVUCE_1 cryptroot
- Create keyfile for auto-unlock (optional)
  - dd if=/dev/random of=/tmp/keyfile_DEVICE_1 bs=1024 count=4
  - chmod 400 /tmp/keyfile
  - cryptsetup luksAddKey /dev/DEVICE_1 /tmp/keyfile_DEVICE_1
Formatting
- mkfs.btrfs -L NIXROOT /dev/mapper/cryptroot
- mkfs.fat -F 32 -n NIXBOOT /dev/DEVICE_2
Create btrfs subvolumes (optional: for better snapshot perf)
- mount /dev/mapper/cryptroot /mnt
- btrfs subvolume create /mnt/root
- btrfs subvolume create /mnt/nix
- btrfs subvolume create /mnt/snapshots
- umount /mnt
Mount (with sub vols above)
- mount -o subvol=root,compress=zstd,noatime /dev/mapper/cryptroot /mnt
- mkdir -p /mnt/{nix,boot,.snapshots}
- mount -o subvol=nix,compress=zstd,noatime /dev/mapper/cryptroot /mnt/nix
- mount -o subvol=snapshots,compress=zstd,noatime /dev/mapper/cryptroot /mnt/.snapshots
- mount -o umask=077 /dev/disk/by-label/NIXBOOT /mnt/boot
Mount (with no sub vols)
- mount -o compress=zstd,noatime /dev/mapper/cryptroot /mnt
- mkdir -p /mnt/boot
- mount -o umask=077 /dev/disk/by-label/NIXBOOT /mnt/boot
Add SWAP device (optional)
- in hardware config

swapDevices = [
  {
    device = "/.swapfile";
    size = 32 * 1024; # 32GB
  }
];

Copy keyfile for auto-unlock (optional)
- cp /tmp/keyfile_DEVICE_1 /mnt/boot/keyfile_DEVICE_1
- chmod 400 /mnt/boot/keyfile_DEVICE_1
If Encrypted keyfile exists
- Add to hardware config

boot.initrd.secrets = {
  "/keyfile_DEVICE_1" = "/boot/keyfile_DEVICE_1";
};

boot.initrd.luks.devices

Install and setup nixos

nixos config and hardware config
- export HOSTNAME=desired_hostname_for_this_machine
- export USERNAME=desired_username_for_admin_on_this_machine (josh)
- nixos-generate-config --root /mnt
- cd /mnt/etc/nixos
- curl -O --proto '=https' --tlsv1.2 -sSf https://git.joshuabell.xyz/ringofstorms/dotfiles/raw/branch/master/onboard.sh
- chmod +x onboard.sh && ./onboard.sh
- verify hardware config, run nixos-install
- reboot
log into USERNAME with password1, use passwd to change the password

Easiest to ssh into the machine for these steps so you can copy paste...

cat /etc/ssh/ssh_host_ed25519_key.pub ~/.ssh/id_ed25519.pub
- On an already onboarded computer copy these and add them to secrets/secrets.nix file
  - nix run github:yaxitech/ragenix -- --rules ~/.config/nixos-config/common/secrets/secrets/secrets.nix -r
- Maybe copy hardware/configs over and setup, otherwise do it on the client machine
git clone nixos-config git clone https://git.joshuabell.xyz/ringofstorms/dotfiles ~/.config/nixos-config
Setup config as needed
- add hosts dir and files needed
sudo nixos-rebuild switch --flake ~/.config/nixos-config/hosts/$HOSTNAME
Update remote, ssh should work now: cd ~/.config/nixos-config && git remote remove origin && git remote add origin "ssh://git.joshuabell.xyz:3032/ringofstorms/dotfiles" && git pull origin master

Local tooling

bitwarden setup/sign into self hosted vault
atuin setup
- if atuin is on enable that mod in configuration.nix, make sure to atuin login get key from existing device
- TODO move key into secrets and mount it to atuin local share
ssh key access, ssh iden in config in nix config

Notes

Dual booting windows?

If there is a new boot partition being used than the old windows one, copy over the /boot/EFI/Microsoft folder into the new boot partition, same place
If the above auto probing for windows does not work, you can also manually add in a windows.conf in the loader entries: /boot/loader/entries/windows.conf:

title Windows 11
efi   /EFI/Microsoft/Boot/bootmgfw.efi

Settings references

Flake docs: https://nixos.wiki/wiki/Flakes
nixos: https://search.nixos.org/options
home manager: https://nix-community.github.io/home-manager/options.xhtml TODO make an offline version of this, does someone else have this already?

TODO

Nix Infrastructure & Automation Improvements

Replace deployment scripts with deploy-rs for declarative, hands-off host updates.
Remove manual deploy_linode/deploy_oracle scripts. Use deploy-rs to apply updates across one or all hosts, including remote builds.

Add isoImage outputs for every host for instant USB/boot media creation.
Use:

packages.x86_64-linux.install-iso = nixosConfigurations.<host>.config.system.build.isoImage;

Then:

nix build .#packages.x86_64-linux.install-iso

Document or automate new host bootstrap:
- Script or steps: boot custom ISO, git clone config, secrets onboarding (agenix), nixos-install with flake config.
- Provide an example shell script or README note for a single-command initial setup.
(Optional) Add an ephemeral “vm-experiment” target for NixOS VM/dev testing.
- Use new host config with minimal stateful services, then
  nixos-rebuild build-vm --flake .#vm-experiment
Remote build reliability:
- Parametrize/automate remote builder enable/disable.
- Add quickstart SSH builder key setup instructions per-host in README.
- (Optional) Use deploy-rs's agent forwarding and improve errors if builder can't be reached at deploy time.
Add disko to declaratively manage disk/partition creation for new installs and reinstalls.
work on secrets pre ragenix, stormd pre install for all the above bootstrapping steps would be ideal
reduce home manager, make per user modules support instead
Ensure my neovim undohistory/auto saves don't save .age files as they can be sensitive.

Server hosts

simply run deploy in the host root and it will push changes to the server (or deploy_[oracle|linode] <name> from root)

7.5 KiB Raw Permalink Blame History