nixos-server: flake, hardware, readme bootstrap, server-quickstart, TODO

Made-with: Cursor

nixos/hosts/nixos-server-hardware.nix

@@ -0,0 +1,42 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" "sr_mod" "rtsx_pci_sdmmc" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/3a6285bf-341b-4f7f-a3e6-23286916d5b1";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/68A6-613B";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp4s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp5s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

nixos/hosts/nixos-server.nix

@@ -0,0 +1,54 @@
+# NixOS server: hostname, user, SSH, auto-rebuild from dotfiles repo.
+#
+# One-time on server: clone repo to /etc/dotfiles (root needs git access).
+# If private repo: use SSH (ssh:// or git@) and add root's key to GitHub, or use HTTPS + token.
+# Then: sudo nixos-rebuild switch --flake /etc/dotfiles/nixos#nixos-server
+# Timer runs every 15 min: git fetch, pull if origin/main changed, rebuild.
+{ config, lib, pkgs, ... }:
+
+let
+  dotfilesDir = "/etc/dotfiles";
+  flakeRef = "${dotfilesDir}/nixos#nixos-server";
+in
+{
+  imports = [ ./nixos-server-hardware.nix ];
+
+  networking.hostName = "nixos-server";
+  time.timeZone = "Europe/Copenhagen";
+
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  system.stateVersion = "24.11";
+
+  users.users.danny = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ];
+    # SSH keys: push via scp, don't commit. NixOS does not manage authorized_keys so scp’d keys persist.
+    # Example: scp ~/.ssh/id_*_github.pub danny@server:/tmp/ then on server: mkdir -p ~/.ssh; cat /tmp/*.pub >> ~/.ssh/authorized_keys
+  };
+
+  services.openssh.enable = true;
+  environment.systemPackages = [ pkgs.git ];  # for clone/bootstrap and timer
+
+  # Pull dotfiles and rebuild if the repo has new commits.
+  systemd.services.dotfiles-rebuild = {
+    description = "Pull dotfiles and run nixos-rebuild if repo changed";
+    path = with pkgs; [ git nix ];
+    script = ''
+      set -euo pipefail
+      cd ${dotfilesDir}
+      git fetch origin
+      if [ "$(git rev-parse HEAD)" = "$(git rev-parse origin/main)" ]; then
+        exit 0
+      fi
+      git pull origin main
+      exec nixos-rebuild switch --flake ${flakeRef}
+    '';
+    serviceConfig.Type = "oneshot";
+  };
+
+  systemd.timers.dotfiles-rebuild = {
+    wantedBy = [ "timers.target" ];
+    timerConfig.OnCalendar = "*-*-* *:00/15:00";  # every 15 minutes
+    timerConfig.RandomizedDelaySec = "2min";
+  };
+}