diff options
Diffstat (limited to 'nix/README.md')
| -rw-r--r-- | nix/README.md | 106 |
1 files changed, 80 insertions, 26 deletions
diff --git a/nix/README.md b/nix/README.md index 020bc36..ab3a339 100644 --- a/nix/README.md +++ b/nix/README.md @@ -1,42 +1,86 @@ # Deploy -## Setup (one time) +## Base Image + +The base image is used as a "base" for all images. +It is the config on first boot once Terraform/OpenTofu has finished provisioning. Build base image: ```sh +nix flake update nixos-rebuild build-image --image-variant proxmox --flake .#base ``` -Copy base image to a Proxmox node: +Copy base image to Proxmox: ```sh -scp result/vzdump-qemu-nixos-26.05.20260401.6201e20.vma.zst root@192.168.0.85:/var/lib/vz/dump/ +scp result/*.vma.zst lan.hesh:/var/lib/vz/dump/ ``` -Restore on Proxmox. +Restore on Proxmox: +```sh +# Destroy the old template 104 is the clone source in TF. +ssh lan.hesh 'qm destroy 104 --purge' +ssh lan.hesh 'qmrestore "$(ls -t /var/lib/vz/dump/vzdump-qemu-nixos-*.vma.zst | head -n1)" 104 --storage local-lvm' +``` -Convert to Proxmox Template. +Convert to Proxmox Template: +```sh +ssh lan.hesh 'qm template 104' +``` Run TF as usual using clone against the Template. +```sh +cd ../terraform +source con.env +tofu plan -out=tfplan +tofu apply tfplan +``` -Generate host-keys, and age key for the host. +## Add Host + +Copy `per-host/<EXISTING_HOST>` to `per-host/<HOST_NAME>`. + +Modify the `per-host/<HOST_NAME>/configuration.nix` accordingly. + +Generate host-keys, and `age` key for the host. ```sh -# first time only -./generate-keys.sh torrents--2 +./generate-keys.sh <HOST_NAME> ``` ## Secrets w/ `sops` -Edit the `.sops.yaml` to include the host's age key +Edit the `.sops.yaml` to include the host's age key. -Create host's secrets: +Create new secrets for a host: ```sh -sops secrets/torrents-2.yaml +sops secrets/<HOST_NAME>.yaml ``` -## Push +## Push/Update ```sh -./deploy.sh torrents-2 root +./deploy.sh <HOST_NAME> jefe + +# This is not normally required, but if the base image is far enough from the +# current build then NixOS will not allow auto-switch on next boot. +# You can set the boot arg here to force it. +# This is also a good sign that the base image should be re-built and deployed. +./deploy.sh torrents-2 jefe boot +``` + +## Update all + +Update all the hosts. +```sh +nix flake update + +for host in $(ls per-host | grep -v '^base$'); do + if ! ssh -o ConnectTimeout=5 "$host" true 2>/dev/null; then + echo "→ [$host] offline, skipping" + continue + fi + ./deploy.sh "$host" jefe boot && ssh "$host" sudo reboot +done ``` ## References: @@ -44,21 +88,28 @@ sops secrets/torrents-2.yaml https://github.com/nix-community/nixos-generators https://gist.github.com/joshleecreates/e6892ca21b0e6b7c24d96ca2a24bf23e -# Hosts +## Hosts + +This section documents any notes for specific hosts I want to be aware of. + +### caldav + +For calendar, contacts, and tasks sync. + +### torrents-2 -## torrents-2 +For Linux ISOs. -For all my Linux ISOs ofcourse. +### rproxy-2 -## rproxy-2 +TLS termination for upstream services. -Entrypoint into my home-lab services. +### git -## git +For git repos. -Set your `sshconfig`: +Set `~/.ssh/config` to include: ```sshconfig -# ~/.ssh/config Host git.kumardamani.net Port 2222 ``` @@ -102,18 +153,21 @@ git remote set-url --add --push origin git@gitlab.com:kdam0/<name>.git git remote -v ``` -## s3 +### photos -Bootstrap: +For photos. + +### s3 + +For s3 buckets. + +Bootstrap one-time with: ```sh sudo garage status sudo garage layout assign -z dc1 -c 10G <NODE_ID> sudo garage layout apply --version 1 - sudo garage bucket create <BUCKET_NAME> - # to enable static sites sudo garage bucket website --allow <BUCKET_NAME> - sudo garage key create site-uploader ``` |