nix-config/NOTES

144 lines
5.3 KiB
Text
Raw Normal View History

2024-05-24 18:03:22 +00:00
nix flake lock --update-input nixpkgs
sudo nixos-rebuild dry-activate --flake .#floki
sudo nixos-rebuild switch --flake .#floki
home-manager build --debug --flake .#gburd@floki
home-manager switch -b bkup --flake .#gburd@floki
nix-build '<nixpkgs/nixos>' -A config.system.build.sdImage -I nixos-config=./sdcard/rpi2.nix
# Major differences:
* sops/age for secrets
* persistence/impermanence
2023-09-19 17:05:08 +00:00
* Yubikeys are great, if you use them correctly
https://www.procustodibus.com/blog/2023/04/how-to-set-up-a-yubikey/
* generate age public key from host's existing SSH keypair
nix-shell -p ssh-to-age --run 'cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age'
* trigger first encryption of a secrets file
2024-05-24 18:03:22 +00:00
EDITOR=vi sops --config .sops.yaml --encrypt --in-place nixos/_mixins/secrets.yaml
2023-09-19 17:05:08 +00:00
* edit secrets in that file later
2023-09-19 19:40:04 +00:00
* When SOPS complains about your ~/.gnupg/secring.pgp file not being there try:
export GPG_TTY=$(tty)
gpgconf --reload gpg-agent
2023-09-20 12:29:42 +00:00
* SOPS
https://dev.to/stack-labs/manage-your-secrets-in-git-with-sops-common-operations-118g
2023-09-22 14:42:28 +00:00
export SOPS_PGP_FP="D4BB42BE729AEFBD2EFEBF8822931AF7895E82DF"
sops -e /etc/ssh/ssh_host_id > hosts/floki/
2023-09-22 17:06:18 +00:00
* labels
* btrfs
* sudo btrfs filesystem label <mountpoint|device> <newlabel>
* luks
* FAT
* sudo fatlabel <device> <newlabel>
* swap (see: https://discourse.nixos.org/t/how-do-i-set-up-a-swap-file/8323/7)
* udevadm trigger
2023-09-20 12:29:42 +00:00
2023-09-20 15:47:08 +00:00
INSTALL:
2023-09-28 17:15:12 +00:00
nix-env -iA nixos.pkgs.gitAndTools.gitFull
2023-09-21 18:19:52 +00:00
export device=/dev/nvme0n1
2023-09-22 17:06:18 +00:00
export hostname=floki
wipefs/shread/scrub ${device}
2023-09-28 15:28:32 +00:00
sgdisk --zap-all ${device}
2023-09-21 18:19:52 +00:00
printf "label: gpt\n,550M,U\n,,L\n" | sfdisk ${device}
2023-09-22 17:25:33 +00:00
mkfs.fat -L ESP -F 32 ${device}
2023-09-22 17:06:18 +00:00
cryptsetup --verify-passphrase -v luksFormat --label "${hostname}_crypt" "${device}p2"
cryptsetup open "${device}p2" "${hostname}_crypt"
mkfs.btrfs -L ${hostname} /dev/mapper/"${hostname}_crypt"
2023-09-28 15:28:32 +00:00
mount -t btrfs -o subvol=root /dev/disk/by-label/${hostname} /mnt
2023-09-21 18:19:52 +00:00
btrfs subvolume create /mnt/root
btrfs subvolume create /mnt/nix
btrfs subvolume create /mnt/persist
btrfs subvolume create /mnt/swap
btrfs subvolume create /mnt/logs
2023-09-28 15:28:32 +00:00
mount -t btrfs -o compress=zstd,subvol=root /dev/disk/by-label/"${hostname}" /mnt
2023-09-22 14:10:04 +00:00
mkdir /mnt/{nix,persist,swap,var/logs}
2023-09-28 15:28:32 +00:00
mount -t btrfs -o compress=zstd,noatime,subvol=nix /dev/disk/by-label/"${hostname}" /mnt/nix
mount -t btrfs -o compress=zstd,subvol=persist /dev/disk/by-label/"${hostname}" /mnt/persist
mount -t btrfs -o compress=zstd,noatime,subvol=logs /dev/disk/by-label/"${hostname}" /mnt/var/logs
mount -t btrfs -o noatime,subvol=swap /dev/disk/by-label/"${hostname}" /mnt/swap
2023-09-21 18:19:52 +00:00
mkdir /mnt/boot
2023-09-28 15:28:32 +00:00
mount /dev/nvme0n1p1 /mnt/boot
mount -t proc /proc /mnt/proc
mount -t sysfs /sys /mnt/sys
mount --bind /dev /mnt/dev
mount --bind /dev/pts /mnt/dev/pts
or
for i in proc sys dev; do mount -o bind $i /mnt/$i; done
2023-09-21 18:19:52 +00:00
nixos-generate-config --root /mnt
2023-09-22 17:06:18 +00:00
nano /mnt/etc/nixos/configuration.nix # manually add mount options or cp from USB
2023-09-21 18:19:52 +00:00
nixos-install
nixos-generate-config --show-hardware-config
fileSystems = {
"/".options = [ "compress=zstd" ];
"/nix".options = [ "compress=zstd" "noatime" ];
"/persist".options = [ "compress=zstd" "noatime" ];
"/logs".options = [ "compress=zstd" "noatime" ];
"/swap".options = [ "noatime" ];
};
2023-09-22 14:10:04 +00:00
user hashedPassword: mkpasswd -m sha-512
2023-09-22 17:06:18 +00:00
SWAP file btrfs: https://discourse.nixos.org/t/how-do-i-set-up-a-swap-file/8323/7
2023-09-21 18:19:52 +00:00
btrfs filesystem mkswapfile --size 8g --uuid clear /swap/swapfile
2023-09-22 17:06:18 +00:00
swapon?
swapDevices = [ { device = "/dev/disk/by-label/swap/swapfile"; } ];
2023-09-21 18:19:52 +00:00
nixos-rebulid switch
2023-09-20 15:47:08 +00:00
export NIX_CONFIG="experimental-features = nix-command flakes"
2023-09-28 19:29:12 +00:00
nix-env -iA nixos.pinentry nixos.git nixos.direnv
eval "$(direnv hook bash)"
2023-09-20 17:32:13 +00:00
echo pinentry-program $(which pinentry) >> ~/.gnupg/gpg-agent.conf
2023-09-20 15:47:08 +00:00
git clone https://github.com/gburd/nix-config.git
cd nix-config
nix develop
2023-09-21 18:36:14 +00:00
export GPG_TTY=$(tty)
gpg-connect-agent reloadagent /bye
2023-09-20 20:14:48 +00:00
echo test | gpg --clearsign
gpg --list-keys
2024-05-24 18:03:22 +00:00
EDITOR=vi sops --config .sops.yaml nixos/_mixins/secrets.yaml
2023-09-20 17:32:13 +00:00
sudo nixos-install --flake .#hostname
2023-09-20 15:47:08 +00:00
reboot
home-manager switch --flake .#username@hostname
2023-09-29 15:54:02 +00:00
gsettings reset org.gnome.desktop.input-sources xkb-options
gsettings reset org.gnome.desktop.input-sources sources
2023-09-20 15:47:08 +00:00
2023-09-19 17:05:08 +00:00
sudo nixos-rebuild switch --flake .#my-hostname
2023-09-22 17:06:18 +00:00
clear; sudo nixos-rebuild dry-activate --flake .#${hostname}
2023-09-28 17:15:12 +00:00
sudo nix --extra-experimental-features "flakes nix-command" run github:nix-community/disko -- --mode disko nixos/${hostname}/disks.nix --arg disks '[ "/dev/nvme0n1" ]' --arg config.networking.hostName ${hostname}
2023-09-28 19:29:12 +00:00
sudo nix run github:nix-community/disko -- --mode disko nixos/${hostname}/disks.nix
2023-09-19 18:38:19 +00:00
2023-09-19 17:05:08 +00:00
-------
2023-09-28 15:28:32 +00:00
services.pcscd.enable = true;
2023-09-21 18:19:52 +00:00
2023-09-22 14:10:04 +00:00
https://mt-caret.github.io/blog/posts/2020-06-29-optin-state.html
2023-09-22 20:13:58 +00:00
https://hoverbear.org/blog/declarative-gnome-configuration-in-nixos/
https://github.com/wimpysworld/nix-config
https://github.com/Misterio77/nix-config
https://github.com/Misterio77/nix-starter-configs
2023-09-22 17:25:33 +00:00
------------------------------------------
TODO:
* agenix: alternative to sops/age for secrets
agenix.url = "github:ryantm/agenix";
agenix.inputs.nixpkgs.follows = "nixpkgs";
* "yet-another-nix-helper" https://github.com/viperML/nh
* declarative disk partitioning/formatting
https://github.com/nix-community/disko
* https://aria2.github.io/
* https://github.com/schollz/croc
2023-09-22 20:13:58 +00:00
------------------------------------------
EXAMPLE COMMANDS:
2023-09-22 17:25:33 +00:00
* nh os switch --ask
2023-09-29 18:59:38 +00:00
* nix run github:viperML/nh -- os switch --ask --nom .
* clear; sudo nixos-rebuild dry-activate --flake .#floki