2023-09-19 17:05:08 +00:00
* Yubikeys are great, if you use them correctly
https://www.procustodibus.com/blog/2023/04/how-to-set-up-a-yubikey/
* generate age public key from host's existing SSH keypair
nix-shell -p ssh-to-age --run 'cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age'
* trigger first encryption of a secrets file
EDITOR=vi sops --config .sops.yaml --encrypt --in-place hosts/common/secrets.yaml
* edit secrets in that file later
2023-09-19 19:40:04 +00:00
* When SOPS complains about your ~/.gnupg/secring.pgp file not being there try:
export GPG_TTY=$(tty)
gpgconf --reload gpg-agent
2023-09-20 12:29:42 +00:00
* SOPS
https://dev.to/stack-labs/manage-your-secrets-in-git-with-sops-common-operations-118g
2023-09-22 14:42:28 +00:00
export SOPS_PGP_FP="D4BB42BE729AEFBD2EFEBF8822931AF7895E82DF"
sops -e /etc/ssh/ssh_host_id > hosts/floki/
2023-09-22 17:06:18 +00:00
* labels
* btrfs
* sudo btrfs filesystem label <mountpoint|device> <newlabel>
* luks
* FAT
* sudo fatlabel <device> <newlabel>
* swap (see: https://discourse.nixos.org/t/how-do-i-set-up-a-swap-file/8323/7)
* udevadm trigger
2023-09-20 12:29:42 +00:00
2023-09-20 15:47:08 +00:00
INSTALL:
2023-09-21 18:19:52 +00:00
export device=/dev/nvme0n1
2023-09-22 17:06:18 +00:00
export hostname=floki
wipefs/shread/scrub ${device}
2023-09-21 18:19:52 +00:00
printf "label: gpt\n,550M,U\n,,L\n" | sfdisk ${device}
2023-09-22 17:25:33 +00:00
mkfs.fat -L ESP -F 32 ${device}
2023-09-22 17:06:18 +00:00
cryptsetup --verify-passphrase -v luksFormat --label "${hostname}_crypt" "${device}p2"
cryptsetup open "${device}p2" "${hostname}_crypt"
mkfs.btrfs -L ${hostname} /dev/mapper/"${hostname}_crypt"
mount -t btrfs -o subvol=/ /dev/disk/by-label/${hostname} /mnt
2023-09-21 18:19:52 +00:00
btrfs subvolume create /mnt/root
btrfs subvolume create /mnt/nix
btrfs subvolume create /mnt/persist
btrfs subvolume create /mnt/swap
btrfs subvolume create /mnt/logs
2023-09-22 17:06:18 +00:00
mount -o compress=zstd,subvol=root /dev/mapper/"${hostname}_crypt" /mnt
2023-09-22 14:10:04 +00:00
mkdir /mnt/{nix,persist,swap,var/logs}
2023-09-22 17:06:18 +00:00
mount -o compress=zstd,noatime,subvol=nix /dev/mapper/"${hostname}_crypt" /mnt/nix
mount -o compress=zstd,subvol=persist /dev/mapper/"${hostname}_crypt" /mnt/persist
mount -o compress=zstd,noatime,subvol=logs /dev/mapper/"${hostname}_crypt" /mnt/var/logs
mount -o noatime,subvol=swap /dev/mapper/"${hostname}_crypt" /mnt/swap
2023-09-21 18:19:52 +00:00
mkdir /mnt/boot
mount /dev/sda1 /mnt/boot
nixos-generate-config --root /mnt
2023-09-22 17:06:18 +00:00
nano /mnt/etc/nixos/configuration.nix # manually add mount options or cp from USB
2023-09-21 18:19:52 +00:00
nixos-install
nixos-generate-config --show-hardware-config
fileSystems = {
"/".options = [ "compress=zstd" ];
"/nix".options = [ "compress=zstd" "noatime" ];
"/persist".options = [ "compress=zstd" "noatime" ];
"/logs".options = [ "compress=zstd" "noatime" ];
"/swap".options = [ "noatime" ];
};
2023-09-22 14:10:04 +00:00
user hashedPassword: mkpasswd -m sha-512
2023-09-22 17:06:18 +00:00
SWAP file btrfs: https://discourse.nixos.org/t/how-do-i-set-up-a-swap-file/8323/7
2023-09-21 18:19:52 +00:00
btrfs filesystem mkswapfile --size 8g --uuid clear /swap/swapfile
2023-09-22 17:06:18 +00:00
swapon?
swapDevices = [ { device = "/dev/disk/by-label/swap/swapfile"; } ];
2023-09-21 18:19:52 +00:00
nixos-rebulid switch
2023-09-20 15:47:08 +00:00
export NIX_CONFIG="experimental-features = nix-command flakes"
2023-09-20 20:14:48 +00:00
nix-env -iA nixos.pinentry nixos.git
2023-09-20 17:32:13 +00:00
echo pinentry-program $(which pinentry) >> ~/.gnupg/gpg-agent.conf
2023-09-20 15:47:08 +00:00
git clone https://github.com/gburd/nix-config.git
cd nix-config
nix develop
2023-09-21 18:36:14 +00:00
export GPG_TTY=$(tty)
gpg-connect-agent reloadagent /bye
2023-09-20 20:14:48 +00:00
echo test | gpg --clearsign
gpg --list-keys
EDITOR=vi sops --config .sops.yaml hosts/common/secrets.yaml
2023-09-20 17:32:13 +00:00
sudo nixos-install --flake .#hostname
2023-09-20 15:47:08 +00:00
reboot
home-manager switch --flake .#username@hostname
2023-09-19 17:05:08 +00:00
2023-09-20 15:47:08 +00:00
2023-09-19 17:05:08 +00:00
sudo nixos-rebuild switch --flake .#my-hostname
2023-09-22 17:06:18 +00:00
clear; sudo nixos-rebuild dry-activate --flake .#${hostname}
2023-09-19 18:38:19 +00:00
2023-09-19 17:05:08 +00:00
-------
services.pcscd.enable = true;
2023-09-21 18:19:52 +00:00
2023-09-22 14:10:04 +00:00
https://mt-caret.github.io/blog/posts/2020-06-29-optin-state.html
2023-09-22 17:25:33 +00:00
------------------------------------------
building the system configuration...
warning: Git tree '/home/gburd/ws/nix-config' is dirty
trace: warning: optionsDocBook is deprecated since 23.11 and will be removed in 24.05
trace: warning: optionsDocBook is deprecated since 23.11 and will be removed in 24.05
trace: warning: optionsDocBook is deprecated since 23.11 and will be removed in 24.05
would stop the following units: ModemManager.service, NetworkManager-wait-online.service, NetworkManager.service, accounts-daemon.service, alsa-store.service, audit.service, avahi-daemon.service, avahi-daemon.socket, bluetooth.service, bolt.service, colord.service, cpufreq.service, kmod-static-nodes.service, logrotate-checkconf.service, mount-pstore.service, network-local-commands.service, network-setup.service, nscd.service, power-profiles-daemon.service, resolvconf.service, rtkit-daemon.service, systemd-machined.service, systemd-modules-load.service, systemd-oomd.service, systemd-oomd.socket, systemd-sysctl.service, systemd-timesyncd.service, systemd-udevd-control.socket, systemd-udevd-kernel.socket, systemd-udevd.service, systemd-update-done.service, udisks2.service, upower.service, wpa_supplicant.service
would NOT stop the following changed units: display-manager.service, getty@tty1.service, systemd-backlight@backlight:intel_backlight.service, systemd-backlight@leds:tpacpi::kbd_backlight.service, systemd-fsck@dev-disk-by\x2duuid-3D04\x2d3716.service, systemd-journal-flush.service, systemd-logind.service, systemd-random-seed.service, systemd-remount-fs.service, systemd-update-utmp.service, systemd-user-sessions.service, user-runtime-dir@1000.service, user@1000.service
would activate the configuration...
sops-install-secrets: Imported /persist/etc/ssh/ssh_host_ed25519_key as age key with fingerprint age1z2x0g05q2erpux006vwhul70d8akj9avrj67s9p27fm4ce32ly8qt8nllz
warning: password file ‘ ’
would restart systemd
would reload the following units: dbus.service, firewall.service, persist.mount, reload-systemd-vconsole-setup.service
would restart the following units: nix-daemon.service, polkit.service, sshd.service, systemd-journald.service
would start the following units: ModemManager.service, NetworkManager-wait-online.service, NetworkManager.service, accounts-daemon.service, audit.service, avahi-daemon.socket, bluetooth.service, bolt.service, colord.service, cpufreq.service, kmod-static-nodes.service, logrotate-checkconf.service, mount-pstore.service, network-local-commands.service, network-setup.service, nscd.service, power-profiles-daemon.service, resolvconf.service, rtkit-daemon.service, systemd-machined.service, systemd-modules-load.service, systemd-oomd.socket, systemd-sysctl.service, systemd-timesyncd.service, systemd-udevd-control.socket, systemd-udevd-kernel.socket, systemd-update-done.service, udisks2.service, upower.service, wpa_supplicant.service
[nix-shell:~/ws/nix-config]$ clear; sudo nixos-rebuild dry-activate --flake .#floki
