nixos-server: flake, hardware, readme bootstrap, server-quickstart, TODO

Made-with: Cursor

TODO.md

@@ -1,16 +1,15 @@
 # TODO
 
-1. ~~**AGENTS.md**~~ Done.
+1. **Secrets** (started)
+   - SSH public keys removed from `nixos/hosts/nixos-server.nix` and `nixos/server-install-configuration.nix`. Keys are not managed by NixOS there; use scp (see comments in those files and server-quickstart.md).
+   - Optional: audit repo for other IDs (emails, UUIDs) if desired.
 
-2. **Secrets**
-   - Make sure we're not exposing any information in the repo. Prefer pushing keys via `scp` rather than committing them.
+2. ~~**Server hardware before testing**~~ Done. Fetched via `ssh danny@server 'sudo cat /etc/nixos/hardware-configuration.nix'`, replaced stub; added boot.loader and system.stateVersion; flake check passes.
 
-3. **Server hardware before testing**
-   - Before checking if the server flake setup works: do we need to fetch anything from the server? (e.g. a hardware file?)
-   - The current `nixos/hosts/nixos-server-hardware.nix` is a stub, not based on the server's actual hardware. The repo's existing `hardware-configuration.nix` is for the MacBook. Fetch the server's config (e.g. `nixos-generate-config --show-hardware-config` on the server) and replace the stub.
+3. **Server**
+   - Continue configuring the server (add more services to `hosts/nixos-server.nix` as needed).
 
-4. **Server**
-   - Continue configuring the server.
-
-5. **Verify**
+4. **Verify**
    - After 2–4: confirm server hardware in repo, flake builds, auto-rebuild works.
+
+5. Rename nixos-server to <something-cooler>

nixos/flake.nix

@@ -56,6 +56,11 @@
           # home-manager.nixosModules.default
         ];
       };
+
+      nixos-server = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        modules = [ ./hosts/nixos-server.nix ];
+      };
     };
 
     # macOS (nix-darwin) configuration

nixos/hosts/nixos-server-hardware.nix

@@ -0,0 +1,42 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" "sr_mod" "rtsx_pci_sdmmc" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/3a6285bf-341b-4f7f-a3e6-23286916d5b1";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/68A6-613B";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp4s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp5s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

nixos/hosts/nixos-server.nix

@@ -0,0 +1,54 @@
+# NixOS server: hostname, user, SSH, auto-rebuild from dotfiles repo.
+#
+# One-time on server: clone repo to /etc/dotfiles (root needs git access).
+# If private repo: use SSH (ssh:// or git@) and add root's key to GitHub, or use HTTPS + token.
+# Then: sudo nixos-rebuild switch --flake /etc/dotfiles/nixos#nixos-server
+# Timer runs every 15 min: git fetch, pull if origin/main changed, rebuild.
+{ config, lib, pkgs, ... }:
+
+let
+  dotfilesDir = "/etc/dotfiles";
+  flakeRef = "${dotfilesDir}/nixos#nixos-server";
+in
+{
+  imports = [ ./nixos-server-hardware.nix ];
+
+  networking.hostName = "nixos-server";
+  time.timeZone = "Europe/Copenhagen";
+
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  system.stateVersion = "24.11";
+
+  users.users.danny = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ];
+    # SSH keys: push via scp, don't commit. NixOS does not manage authorized_keys so scp’d keys persist.
+    # Example: scp ~/.ssh/id_*_github.pub danny@server:/tmp/ then on server: mkdir -p ~/.ssh; cat /tmp/*.pub >> ~/.ssh/authorized_keys
+  };
+
+  services.openssh.enable = true;
+  environment.systemPackages = [ pkgs.git ];  # for clone/bootstrap and timer
+
+  # Pull dotfiles and rebuild if the repo has new commits.
+  systemd.services.dotfiles-rebuild = {
+    description = "Pull dotfiles and run nixos-rebuild if repo changed";
+    path = with pkgs; [ git nix ];
+    script = ''
+      set -euo pipefail
+      cd ${dotfilesDir}
+      git fetch origin
+      if [ "$(git rev-parse HEAD)" = "$(git rev-parse origin/main)" ]; then
+        exit 0
+      fi
+      git pull origin main
+      exec nixos-rebuild switch --flake ${flakeRef}
+    '';
+    serviceConfig.Type = "oneshot";
+  };
+
+  systemd.timers.dotfiles-rebuild = {
+    wantedBy = [ "timers.target" ];
+    timerConfig.OnCalendar = "*-*-* *:00/15:00";  # every 15 minutes
+    timerConfig.RandomizedDelaySec = "2min";
+  };
+}

nixos/readme.md

@@ -4,7 +4,27 @@ Rebuild nixos and points to dotfiles dir:
 sudo nixos-rebuild switch --flake ~/dotfiles/nixos#macbookair
 # or
 sudo nixos-rebuild switch --flake ~/dotfiles/nixos#wsl
-# or
+# or (macOS)
 sudo -H nix run github:lnl7/nix-darwin -- switch --flake ~/dotfiles/nixos#Daniel-Macbook-Air
 ```
 
+## Server (nixos-server)
+
+One-time on the server (git is not installed until after the first rebuild, so use nix run to get git):
+
+```bash
+nix run --extra-experimental-features "nix-command flakes" nixpkgs#git -- clone https://github.com/DannyDannyDanny/dotfiles.git /tmp/dotfiles
+sudo mv /tmp/dotfiles /etc/dotfiles
+# Enable flakes for this run (needed if the current system config does not)
+sudo nixos-rebuild switch --flake /etc/dotfiles/nixos#nixos-server --option accept-flake-config true
+```
+If that fails with "does not provide attribute ... nixos-rebuild", build and switch manually (NIX_CONFIG makes the daemon accept flakes for this run):
+```bash
+NIX_CONFIG="extra-experimental-features = nix-command flakes" sudo nix build /etc/dotfiles/nixos#nixosConfigurations.nixos-server.config.system.build.toplevel -o /tmp/nixos-result
+sudo /tmp/nixos-result/bin/switch-to-configuration switch
+```
+Use `git@github.com:DannyDannyDanny/dotfiles.git` if the repo is private (clone as danny then `sudo mv` and `sudo chown -R root:root /etc/dotfiles`).
+
+SSH keys for danny (not in repo): from your machine `scp ~/.ssh/*.pub danny@server:/tmp/`, then on server `mkdir -p ~/.ssh; cat /tmp/*.pub >> ~/.ssh/authorized_keys`.
+
+After that, a timer pulls and rebuilds every 15 min when `main` changes. Config lives in `hosts/nixos-server.nix` and `hosts/nixos-server-hardware.nix`.

nixos/server-install-configuration.nix

@@ -0,0 +1,20 @@
+# Minimal server config for NixOS install (copy to /mnt/etc/nixos/configuration.nix on live system)
+{ config, lib, pkgs, ... }:
+
+{
+  imports = [ ./hardware-configuration.nix ];
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "nixos-server";
+  time.timeZone = "Europe/Copenhagen";
+
+  users.users.danny = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ];
+    # After install, add keys via scp (see server-quickstart or nixos-server.nix comment).
+  };
+
+  services.openssh.enable = true;
+}

server-quickstart.md

@@ -36,6 +36,8 @@ users.users.danny.openssh.authorizedKeys.keys = [
 ];
 ```
 
+To avoid committing keys (e.g. public repo): omit `openssh.authorizedKeys` and push keys via `scp ~/.ssh/*.pub danny@server:/tmp/` then on server: `cat /tmp/*.pub >> ~/.ssh/authorized_keys`.
+
 Optional: `services.openssh.settings = { PasswordAuthentication = false; PermitRootLogin = "no"; };`
 
 ## 5. Apply and test