Nix-Vibe public snapshot (squashed history)

2026-09-19 13:56:12 +01:00
commit aee8fb1e9b
119 changed files with 18895 additions and 0 deletions
@@ -0,0 +1,69 @@
+# Initial Installation
+
+This repository uses [nixos-anywhere](https://github.com/nix-community/nixos-anywhere) for seamless deployment to new hardware.
+
+## Prerequisites
+
+1. **SSH Access**: The target machine must be booted into a Linux environment (e.g., NixOS Installer ISO) with SSH enabled and your public key authorized.
+2. **Secrets Management**: If the target host requires secrets, ensure its Age key is generated and added to `.sops.yaml` as described in the [SOPS Guide](sops-secrets.md).
+3. **Disko**: Ensure the `disko-config.nix` for the host matches the target hardware's drive names (e.g., `/dev/nvme0n1` vs `/dev/sda`).
+
+## Deployment Command
+
+Run this command from the root of the repository:
+
+```bash
+nix run github:nix-community/nixos-anywhere -- --flake .#<hostname> <target-ip>
+```
+
+*Example:* `nix run github:nix-community/nixos-anywhere -- --flake .#x1carbon 192.168.1.50`
+
+The process will automatically partition the drive via `disko`, install the system, and reboot into the new NixOS environment.
+
+## Post-Installation
+
+After the first boot, apply the configuration locally:
+
+```bash
+sudo nixos-rebuild switch --flake /etc/nixos/#<hostname>
+```
+
+For ongoing management, clone this repository and use the commands in the main [README.md](../README.md).
+
+---
+
+## Secrets: Using Age Keys with `--extra-files`
+
+Some hosts require SOPS secrets at build time (e.g., user passwords with `neededForUsers = true`). The private age key must be available during `nixos-rebuild`, but it should **never** be committed to Git. Use the `extra-files/` directory (in `.gitignore`) and the `--extra-files` flag to supply the key securely.
+
+### 1. Create the Age Key
+
+Generate a new age key and store it in the untracked `extra-files/` tree:
+
+```bash
+mkdir -p extra-files/root/.config/sops/age
+age-keygen -o extra-files/root/.config/sops/age/keys.txt
+```
+
+Extract the **public key** and add it to `.sops.yaml`, then re-encrypt the secrets file so this key can decrypt them:
+
+```bash
+cat extra-files/root/.config/sops/age/keys.txt | age-keygen -y
+# Copy the output public key into .sops.yaml under the `age` key list
+sops updatekeys secrets.yaml
+```
+
+### 2. Deploy with `--extra-files`
+
+The `--extra-files` flag copies the local `extra-files/` directory into the Nix store so the age key is available at build time:
+
+```bash
+sudo nixos-rebuild switch --flake .#<hostname> --extra-files extra-files
+```
+
+This makes `extra-files/root/.config/sops/age/keys.txt` available at `/root/.config/sops/age/keys.txt` during evaluation, allowing SOPS to decrypt `secrets.yaml` without the key ever touching the target machine's filesystem.
+
+> **Note**: For `nixos-anywhere` initial deployments, supply the age key via `--extra-files` as well:
+> ```bash
+> nix run github:nix-community/nixos-anywhere -- --extra-files extra-files --flake .#<hostname> <target-ip>
+> ```