TODO working on changes to this now

Old Config prior to per system flake approach

https://git.joshuabell.xyz/dotfiles/~files/6527f67145fe047df57b4778c154dde580ec04c4

Old modules from multi branch flake approach

• common
• de_gnome
• de_cosmic
• de_hyperland
• secrets
• nebula
• stormd
• home_manager
• boot_grub
• boot_systemd

First Install on new Machine

NixOS install

1. Install nix minimal: (new with btrfs backing)

• Partitions
  • parted /dev/DEVICE -- mklabel gpt - make GPT partition table
  • parted /dev/DEVICE -- mkpart NIXROOT 2GB 100% - make root partition (2GB offset for boot)
  • parted /dev/DEVICE -- mkpart ESP fat32 1MB 2GB - make boot partition (2GB)
  • parted /dev/DEVICE -- set 2 esp on - make boot bootable
• LUKS Encryption
  • cryptsetup luksFormat /dev/DEVICE_1
    • Create passphrase and save to bitwarden
  • cryptsetup luksOpen /dev/DEVUCE_1 cryptroot
  • Create keyfile for auto-unlock (optional)
    • dd if=/dev/random of=/tmp/keyfile_DEVICE_1 bs=1024 count=4
    • chmod 400 /tmp/keyfile
    • cryptsetup luksAddKey /dev/DEVICE_1 /tmp/keyfile_DEVICE_1
• Formatting
  • mkfs.btrfs -L NIXROOT /dev/mapper/cryptroot
  • mkfs.fat -F 32 -n NIXBOOT /dev/DEVICE_2
• Create btrfs subvolumes (optional: for better snapshot perf)
  • mount /dev/mapper/cryptroot /mnt
  • btrfs subvolume create /mnt/root
  • btrfs subvolume create /mnt/nix
  • btrfs subvolume create /mnt/snapshots
  • umount /mnt
• Mount (with sub vols above)
  • mount -o subvol=root,compress=zstd,noatime /dev/mapper/cryptroot /mnt
  • mkdir -p /mnt/{nix,boot,.snapshots}
  • mount -o subvol=nix,compress=zstd,noatime /dev/mapper/cryptroot /mnt/nix
  • mount -o subvol=snapshots,compress=zstd,noatime /dev/mapper/cryptroot /mnt/.snapshots
  • mount -o umask=077 /dev/disk/by-label/NIXBOOT /mnt/boot
• Mount (with no sub vols)
  • mount -o compress=zstd,noatime /dev/mapper/cryptroot /mnt
  • mkdir -p /mnt/boot
  • mount -o umask=077 /dev/disk/by-label/NIXBOOT /mnt/boot
• Add SWAP device (optional)
  • in hardware config

swapDevices = [
  {
    device = "/.swapfile";
    size = 32 * 1024; # 32GB
  }
];

• Copy keyfile for auto-unlock (optional)
  • cp /tmp/keyfile_DEVICE_1 /mnt/boot/keyfile_DEVICE_1
  • chmod 400 /mnt/boot/keyfile_DEVICE_1
• If Encrypted keyfile exists
  • Add to hardware config

boot.initrd.secrets = {
  "/keyfile_DEVICE_1" = "/boot/keyfile_DEVICE_1";
};

boot.initrd.luks.devices

2. Install and setup nixos

• nixos config and hardware config
  • export HOSTNAME=desired_hostname_for_this_machine
  • export USERNAME=desired_username_for_admin_on_this_machine (josh)
  • nixos-generate-config --root /mnt
  • cd /mnt/etc/nixos
  • curl -O --proto '=https' --tlsv1.2 -sSf https://git.joshuabell.xyz/ringofstorms/dotfiles/raw/branch/master/onboard.sh
  • chmod +x onboard.sh && ./onboard.sh
  • verify hardware config, run nixos-install
  • reboot
• log into USERNAME with password1, use passwd to change the password

Easiest to ssh into the machine for these steps so you can copy paste...

• cat /etc/ssh/ssh_host_ed25519_key.pub ~/.ssh/id_ed25519.pub
  • On an already onboarded computer copy these and add them to secrets/secrets.nix file
    • nix run github:yaxitech/ragenix -- --rules ~/.config/nixos-config/common/secrets/secrets/secrets.nix -r
  • Maybe copy hardware/configs over and setup, otherwise do it on the client machine
• git clone nixos-config git clone https://git.joshuabell.xyz/ringofstorms/dotfiles ~/.config/nixos-config
• Setup config as needed
  • add hosts dir and files needed
• sudo nixos-rebuild switch --flake ~/.config/nixos-config/hosts/$HOSTNAME
• Update remote, ssh should work now: cd ~/.config/nixos-config && git remote remove origin && git remote add origin "ssh://git.joshuabell.xyz:3032/ringofstorms/dotfiles" && git pull origin master

Local tooling

• bitwarden setup/sign into self hosted vault

• atuin setup

  • if atuin is on enable that mod in configuration.nix, make sure to atuin login get key from existing device
  • TODO move key into secrets and mount it to atuin local share

• ssh key access, ssh iden in config in nix config

Notes

Dual booting windows?

• If there is a new boot partition being used than the old windows one, copy over the /boot/EFI/Microsoft folder into the new boot partition, same place
• If the above auto probing for windows does not work, you can also manually add in a windows.conf in the loader entries: /boot/loader/entries/windows.conf:

title Windows 11
efi   /EFI/Microsoft/Boot/bootmgfw.efi

Settings references

• Flake docs: https://nixos.wiki/wiki/Flakes
• nixos: https://search.nixos.org/options
• home manager: https://nix-community.github.io/home-manager/options.xhtml TODO make an offline version of this, does someone else have this already?

TODO

Nix Infrastructure & Automation Improvements

• Replace deployment scripts with deploy-rs for declarative, hands-off host updates.
  Remove manual deploy_linode/deploy_oracle scripts. Use deploy-rs to apply updates across one or all hosts, including remote builds.

• Add isoImage outputs for every host for instant USB/boot media creation.
  Use:

  packages.x86_64-linux.install-iso = nixosConfigurations.<host>.config.system.build.isoImage;
  

  Then:

  nix build .#packages.x86_64-linux.install-iso
  

• Document or automate new host bootstrap:

  • Script or steps: boot custom ISO, git clone config, secrets onboarding (agenix), nixos-install with flake config.
  • Provide an example shell script or README note for a single-command initial setup.

• (Optional) Add an ephemeral “vm-experiment” target for NixOS VM/dev testing.

  • Use new host config with minimal stateful services, then
    nixos-rebuild build-vm --flake .#vm-experiment

• Remote build reliability:

  • Parametrize/automate remote builder enable/disable.
  • Add quickstart SSH builder key setup instructions per-host in README.
  • (Optional) Use deploy-rs's agent forwarding and improve errors if builder can't be reached at deploy time.

• Add disko to declaratively manage disk/partition creation for new installs and reinstalls.

• work on secrets pre ragenix, stormd pre install for all the above bootstrapping steps would be ideal

• reduce home manager, make per user modules support instead

• Ensure my neovim undohistory/auto saves don't save .age files as they can be sensitive.

Server hosts

simply run deploy in the host root and it will push changes to the server (or deploy_[oracle|linode] <name> from root)