47fc658523
Stage 4.5: declare a Hetzner-hosted reverse-proxy VPS as a clan machine. - nixos/hosts/vps-relay.nix: Debian→NixOS cx23 in hel1. Caddy at public 80/443 reverse-proxies navidrome.dannydannydanny.me and bbbot.dannydannydanny.me over ZT to sunken-ship. - nixos/disko-cloud.nix: simple GPT + ext4 root, no LUKS — cloud provider has physical disk anyway and there's no operator at boot. - flake-modules/clan.nix: register vps-relay as an inventory machine, zerotier peer, internet networking target at its clan-generated ZT IPv6, and add vps-relay.clan to clanHostsModule /etc/hosts. - sunken-ship fitness-bot: drop pkgs.cloudflared from PATH + set WEBAPP_URL=https://bbbot.dannydannydanny.me. Paired with the bbbot upstream patch (start.py honors env WEBAPP_URL and skips cloudflared when set) — once the 15-min fitness-bot-pull timer pulls that change, bbbot will stop churning trycloudflare.com URLs. Vars (zerotier identity/ip + sops machine key) generated on sunken-ship because clan's hermetic sandbox on macOS fails to run the zerotier identity generator (same workaround as for data-mesher earlier). VPS install flow: Hetzner-created Debian box, then `clan machines install vps-relay --target-host root@<public-ipv4>` reinstalls to NixOS; subsequent updates go over ZT. |
||
|---|---|---|
| .. | ||
| home/danny | ||
| hosts | ||
| disko-cloud.nix | ||
| disko-server.nix | ||
| fish.nix | ||
| installer-iso.nix | ||
| neovim.nix | ||
| ollama.nix | ||
| readme.md | ||
| server-configuration-with-flakes.nix | ||
| server-install-configuration.nix | ||
| wsl.conf | ||
NixOS modules
Host-specific NixOS and home-manager modules live under this dir:
hosts/<machine>.nix+hosts/<machine>-hardware.nixhome/danny/home.nix(home-manager)fish.nix,neovim.nix,ollama.nix,installer-iso.nix,disko-server.nix
The flake itself (flake.nix, flake.lock, flake-modules/, lib/, modules/, sops/, vars/) lives at the repo root, not here. See CLAUDE.md at the repo root for rebuild commands, clan.lol operations, and the dotfiles-rebuild timer.
Quick rebuild reference
# macOS
cd ~/dotfiles && darwin-rebuild switch --flake .
# WSL
sudo nixos-rebuild switch --flake ~/dotfiles#wsl
# Servers (via clan from mac)
nix run git+https://git.clan.lol/clan/clan-core#clan-cli -- \
machines update sunken-ship --flake ~/dotfiles
Server bootstrap (one-time)
nix run --extra-experimental-features "nix-command flakes" nixpkgs#git -- \
clone https://github.com/DannyDannyDanny/dotfiles.git /tmp/dotfiles
sudo mv /tmp/dotfiles /etc/dotfiles
sudo nixos-rebuild switch --flake /etc/dotfiles#sunken-ship \
--option accept-flake-config true
If the daemon doesn't have flakes: copy server-configuration-with-flakes.nix to /etc/nixos/configuration.nix, sudo nixos-rebuild switch, then build the flake.
SSH keys (not in repo): scp ~/.ssh/*.pub danny@server:/tmp/, then on server mkdir -p ~/.ssh; cat /tmp/*.pub >> ~/.ssh/authorized_keys. See docs/ssh-and-secrets.md.
No git in PATH: sudo nix run nixpkgs#git -- -C /etc/dotfiles pull origin main.