From 84a065a3dfcffcd4d7293355cd982d5842174207 Mon Sep 17 00:00:00 2001 From: DannyDannyDanny Date: Fri, 27 Feb 2026 23:18:57 +0100 Subject: [PATCH] nixos-server: flake, hardware, readme bootstrap, server-quickstart, TODO Made-with: Cursor --- TODO.md | 19 +++++---- nixos/flake.nix | 5 +++ nixos/hosts/nixos-server-hardware.nix | 42 ++++++++++++++++++++ nixos/hosts/nixos-server.nix | 54 ++++++++++++++++++++++++++ nixos/readme.md | 22 ++++++++++- nixos/server-install-configuration.nix | 20 ++++++++++ server-quickstart.md | 2 + 7 files changed, 153 insertions(+), 11 deletions(-) create mode 100644 nixos/hosts/nixos-server-hardware.nix create mode 100644 nixos/hosts/nixos-server.nix create mode 100644 nixos/server-install-configuration.nix diff --git a/TODO.md b/TODO.md index 3b69b5e..e6bca4d 100644 --- a/TODO.md +++ b/TODO.md @@ -1,16 +1,15 @@ # TODO -1. ~~**AGENTS.md**~~ Done. +1. **Secrets** (started) + - SSH public keys removed from `nixos/hosts/nixos-server.nix` and `nixos/server-install-configuration.nix`. Keys are not managed by NixOS there; use scp (see comments in those files and server-quickstart.md). + - Optional: audit repo for other IDs (emails, UUIDs) if desired. -2. **Secrets** - - Make sure we're not exposing any information in the repo. Prefer pushing keys via `scp` rather than committing them. +2. ~~**Server hardware before testing**~~ Done. Fetched via `ssh danny@server 'sudo cat /etc/nixos/hardware-configuration.nix'`, replaced stub; added boot.loader and system.stateVersion; flake check passes. -3. **Server hardware before testing** - - Before checking if the server flake setup works: do we need to fetch anything from the server? (e.g. a hardware file?) - - The current `nixos/hosts/nixos-server-hardware.nix` is a stub, not based on the server's actual hardware. The repo's existing `hardware-configuration.nix` is for the MacBook. Fetch the server's config (e.g. `nixos-generate-config --show-hardware-config` on the server) and replace the stub. +3. **Server** + - Continue configuring the server (add more services to `hosts/nixos-server.nix` as needed). -4. **Server** - - Continue configuring the server. - -5. **Verify** +4. **Verify** - After 2–4: confirm server hardware in repo, flake builds, auto-rebuild works. + +5. Rename nixos-server to \ No newline at end of file diff --git a/nixos/flake.nix b/nixos/flake.nix index 471c305..de35519 100644 --- a/nixos/flake.nix +++ b/nixos/flake.nix @@ -56,6 +56,11 @@ # home-manager.nixosModules.default ]; }; + + nixos-server = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + modules = [ ./hosts/nixos-server.nix ]; + }; }; # macOS (nix-darwin) configuration diff --git a/nixos/hosts/nixos-server-hardware.nix b/nixos/hosts/nixos-server-hardware.nix new file mode 100644 index 0000000..19d208f --- /dev/null +++ b/nixos/hosts/nixos-server-hardware.nix @@ -0,0 +1,42 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" "sr_mod" "rtsx_pci_sdmmc" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/3a6285bf-341b-4f7f-a3e6-23286916d5b1"; + fsType = "ext4"; + }; + + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/68A6-613B"; + fsType = "vfat"; + options = [ "fmask=0022" "dmask=0022" ]; + }; + + swapDevices = [ ]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.enp4s0.useDHCP = lib.mkDefault true; + # networking.interfaces.wlp5s0.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +} diff --git a/nixos/hosts/nixos-server.nix b/nixos/hosts/nixos-server.nix new file mode 100644 index 0000000..1716c1d --- /dev/null +++ b/nixos/hosts/nixos-server.nix @@ -0,0 +1,54 @@ +# NixOS server: hostname, user, SSH, auto-rebuild from dotfiles repo. +# +# One-time on server: clone repo to /etc/dotfiles (root needs git access). +# If private repo: use SSH (ssh:// or git@) and add root's key to GitHub, or use HTTPS + token. +# Then: sudo nixos-rebuild switch --flake /etc/dotfiles/nixos#nixos-server +# Timer runs every 15 min: git fetch, pull if origin/main changed, rebuild. +{ config, lib, pkgs, ... }: + +let + dotfilesDir = "/etc/dotfiles"; + flakeRef = "${dotfilesDir}/nixos#nixos-server"; +in +{ + imports = [ ./nixos-server-hardware.nix ]; + + networking.hostName = "nixos-server"; + time.timeZone = "Europe/Copenhagen"; + + nix.settings.experimental-features = [ "nix-command" "flakes" ]; + system.stateVersion = "24.11"; + + users.users.danny = { + isNormalUser = true; + extraGroups = [ "wheel" ]; + # SSH keys: push via scp, don't commit. NixOS does not manage authorized_keys so scp’d keys persist. + # Example: scp ~/.ssh/id_*_github.pub danny@server:/tmp/ then on server: mkdir -p ~/.ssh; cat /tmp/*.pub >> ~/.ssh/authorized_keys + }; + + services.openssh.enable = true; + environment.systemPackages = [ pkgs.git ]; # for clone/bootstrap and timer + + # Pull dotfiles and rebuild if the repo has new commits. + systemd.services.dotfiles-rebuild = { + description = "Pull dotfiles and run nixos-rebuild if repo changed"; + path = with pkgs; [ git nix ]; + script = '' + set -euo pipefail + cd ${dotfilesDir} + git fetch origin + if [ "$(git rev-parse HEAD)" = "$(git rev-parse origin/main)" ]; then + exit 0 + fi + git pull origin main + exec nixos-rebuild switch --flake ${flakeRef} + ''; + serviceConfig.Type = "oneshot"; + }; + + systemd.timers.dotfiles-rebuild = { + wantedBy = [ "timers.target" ]; + timerConfig.OnCalendar = "*-*-* *:00/15:00"; # every 15 minutes + timerConfig.RandomizedDelaySec = "2min"; + }; +} diff --git a/nixos/readme.md b/nixos/readme.md index 32acf54..cb63860 100644 --- a/nixos/readme.md +++ b/nixos/readme.md @@ -4,7 +4,27 @@ Rebuild nixos and points to dotfiles dir: sudo nixos-rebuild switch --flake ~/dotfiles/nixos#macbookair # or sudo nixos-rebuild switch --flake ~/dotfiles/nixos#wsl -# or +# or (macOS) sudo -H nix run github:lnl7/nix-darwin -- switch --flake ~/dotfiles/nixos#Daniel-Macbook-Air ``` +## Server (nixos-server) + +One-time on the server (git is not installed until after the first rebuild, so use nix run to get git): + +```bash +nix run --extra-experimental-features "nix-command flakes" nixpkgs#git -- clone https://github.com/DannyDannyDanny/dotfiles.git /tmp/dotfiles +sudo mv /tmp/dotfiles /etc/dotfiles +# Enable flakes for this run (needed if the current system config does not) +sudo nixos-rebuild switch --flake /etc/dotfiles/nixos#nixos-server --option accept-flake-config true +``` +If that fails with "does not provide attribute ... nixos-rebuild", build and switch manually (NIX_CONFIG makes the daemon accept flakes for this run): +```bash +NIX_CONFIG="extra-experimental-features = nix-command flakes" sudo nix build /etc/dotfiles/nixos#nixosConfigurations.nixos-server.config.system.build.toplevel -o /tmp/nixos-result +sudo /tmp/nixos-result/bin/switch-to-configuration switch +``` +Use `git@github.com:DannyDannyDanny/dotfiles.git` if the repo is private (clone as danny then `sudo mv` and `sudo chown -R root:root /etc/dotfiles`). + +SSH keys for danny (not in repo): from your machine `scp ~/.ssh/*.pub danny@server:/tmp/`, then on server `mkdir -p ~/.ssh; cat /tmp/*.pub >> ~/.ssh/authorized_keys`. + +After that, a timer pulls and rebuilds every 15 min when `main` changes. Config lives in `hosts/nixos-server.nix` and `hosts/nixos-server-hardware.nix`. diff --git a/nixos/server-install-configuration.nix b/nixos/server-install-configuration.nix new file mode 100644 index 0000000..9357716 --- /dev/null +++ b/nixos/server-install-configuration.nix @@ -0,0 +1,20 @@ +# Minimal server config for NixOS install (copy to /mnt/etc/nixos/configuration.nix on live system) +{ config, lib, pkgs, ... }: + +{ + imports = [ ./hardware-configuration.nix ]; + + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + networking.hostName = "nixos-server"; + time.timeZone = "Europe/Copenhagen"; + + users.users.danny = { + isNormalUser = true; + extraGroups = [ "wheel" ]; + # After install, add keys via scp (see server-quickstart or nixos-server.nix comment). + }; + + services.openssh.enable = true; +} diff --git a/server-quickstart.md b/server-quickstart.md index 7d8e785..1cad215 100644 --- a/server-quickstart.md +++ b/server-quickstart.md @@ -36,6 +36,8 @@ users.users.danny.openssh.authorizedKeys.keys = [ ]; ``` +To avoid committing keys (e.g. public repo): omit `openssh.authorizedKeys` and push keys via `scp ~/.ssh/*.pub danny@server:/tmp/` then on server: `cat /tmp/*.pub >> ~/.ssh/authorized_keys`. + Optional: `services.openssh.settings = { PasswordAuthentication = false; PermitRootLogin = "no"; };` ## 5. Apply and test