mirror of
https://github.com/gburd/nix-config.git
synced 2024-07-04 00:47:20 +00:00
127 lines
4.5 KiB
Plaintext
127 lines
4.5 KiB
Plaintext
* Yubikeys are great, if you use them correctly
|
|
https://www.procustodibus.com/blog/2023/04/how-to-set-up-a-yubikey/
|
|
* generate age public key from host's existing SSH keypair
|
|
nix-shell -p ssh-to-age --run 'cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age'
|
|
* trigger first encryption of a secrets file
|
|
EDITOR=vi sops --config .sops.yaml --encrypt --in-place hosts/common/secrets.yaml
|
|
* edit secrets in that file later
|
|
* When SOPS complains about your ~/.gnupg/secring.pgp file not being there try:
|
|
export GPG_TTY=$(tty)
|
|
gpgconf --reload gpg-agent
|
|
* SOPS
|
|
https://dev.to/stack-labs/manage-your-secrets-in-git-with-sops-common-operations-118g
|
|
export SOPS_PGP_FP="D4BB42BE729AEFBD2EFEBF8822931AF7895E82DF"
|
|
sops -e /etc/ssh/ssh_host_id > hosts/floki/
|
|
* labels
|
|
* btrfs
|
|
* sudo btrfs filesystem label <mountpoint|device> <newlabel>
|
|
* luks
|
|
* FAT
|
|
* sudo fatlabel <device> <newlabel>
|
|
* swap (see: https://discourse.nixos.org/t/how-do-i-set-up-a-swap-file/8323/7)
|
|
* udevadm trigger
|
|
|
|
INSTALL:
|
|
export device=/dev/nvme0n1
|
|
export hostname=floki
|
|
wipefs/shread/scrub ${device}
|
|
sgdisk --zap-all ${device}
|
|
printf "label: gpt\n,550M,U\n,,L\n" | sfdisk ${device}
|
|
mkfs.fat -L ESP -F 32 ${device}
|
|
cryptsetup --verify-passphrase -v luksFormat --label "${hostname}_crypt" "${device}p2"
|
|
cryptsetup open "${device}p2" "${hostname}_crypt"
|
|
mkfs.btrfs -L ${hostname} /dev/mapper/"${hostname}_crypt"
|
|
mount -t btrfs -o subvol=root /dev/disk/by-label/${hostname} /mnt
|
|
btrfs subvolume create /mnt/root
|
|
btrfs subvolume create /mnt/nix
|
|
btrfs subvolume create /mnt/persist
|
|
btrfs subvolume create /mnt/swap
|
|
btrfs subvolume create /mnt/logs
|
|
|
|
mount -t btrfs -o compress=zstd,subvol=root /dev/disk/by-label/"${hostname}" /mnt
|
|
mkdir /mnt/{nix,persist,swap,var/logs}
|
|
mount -t btrfs -o compress=zstd,noatime,subvol=nix /dev/disk/by-label/"${hostname}" /mnt/nix
|
|
mount -t btrfs -o compress=zstd,subvol=persist /dev/disk/by-label/"${hostname}" /mnt/persist
|
|
mount -t btrfs -o compress=zstd,noatime,subvol=logs /dev/disk/by-label/"${hostname}" /mnt/var/logs
|
|
mount -t btrfs -o noatime,subvol=swap /dev/disk/by-label/"${hostname}" /mnt/swap
|
|
|
|
mkdir /mnt/boot
|
|
mount /dev/nvme0n1p1 /mnt/boot
|
|
|
|
mount -t proc /proc /mnt/proc
|
|
mount -t sysfs /sys /mnt/sys
|
|
mount --bind /dev /mnt/dev
|
|
mount --bind /dev/pts /mnt/dev/pts
|
|
|
|
or
|
|
for i in proc sys dev; do mount -o bind $i /mnt/$i; done
|
|
|
|
nixos-generate-config --root /mnt
|
|
nano /mnt/etc/nixos/configuration.nix # manually add mount options or cp from USB
|
|
nixos-install
|
|
|
|
nixos-generate-config --show-hardware-config
|
|
|
|
fileSystems = {
|
|
"/".options = [ "compress=zstd" ];
|
|
"/nix".options = [ "compress=zstd" "noatime" ];
|
|
"/persist".options = [ "compress=zstd" "noatime" ];
|
|
"/logs".options = [ "compress=zstd" "noatime" ];
|
|
"/swap".options = [ "noatime" ];
|
|
};
|
|
|
|
user hashedPassword: mkpasswd -m sha-512
|
|
|
|
SWAP file btrfs: https://discourse.nixos.org/t/how-do-i-set-up-a-swap-file/8323/7
|
|
btrfs filesystem mkswapfile --size 8g --uuid clear /swap/swapfile
|
|
swapon?
|
|
swapDevices = [ { device = "/dev/disk/by-label/swap/swapfile"; } ];
|
|
nixos-rebulid switch
|
|
|
|
export NIX_CONFIG="experimental-features = nix-command flakes"
|
|
nix-env -iA nixos.pinentry nixos.git
|
|
echo pinentry-program $(which pinentry) >> ~/.gnupg/gpg-agent.conf
|
|
git clone https://github.com/gburd/nix-config.git
|
|
cd nix-config
|
|
nix develop
|
|
export GPG_TTY=$(tty)
|
|
gpg-connect-agent reloadagent /bye
|
|
echo test | gpg --clearsign
|
|
gpg --list-keys
|
|
EDITOR=vi sops --config .sops.yaml nixos/common/secrets.yaml
|
|
sudo nixos-install --flake .#hostname
|
|
reboot
|
|
home-manager switch --flake .#username@hostname
|
|
|
|
|
|
sudo nixos-rebuild switch --flake .#my-hostname
|
|
clear; sudo nixos-rebuild dry-activate --flake .#${hostname}
|
|
sudo nix run github:nix-community/disko -- --mode disko /tmp/disko-config.nix --arg disks '[ "/dev/nvme0n1" ]'
|
|
|
|
-------
|
|
services.pcscd.enable = true;
|
|
|
|
https://mt-caret.github.io/blog/posts/2020-06-29-optin-state.html
|
|
https://hoverbear.org/blog/declarative-gnome-configuration-in-nixos/
|
|
https://github.com/wimpysworld/nix-config
|
|
https://github.com/Misterio77/nix-config
|
|
https://github.com/Misterio77/nix-starter-configs
|
|
|
|
------------------------------------------
|
|
TODO:
|
|
|
|
* agenix: alternative to sops/age for secrets
|
|
agenix.url = "github:ryantm/agenix";
|
|
agenix.inputs.nixpkgs.follows = "nixpkgs";
|
|
* "yet-another-nix-helper" https://github.com/viperML/nh
|
|
* declarative disk partitioning/formatting
|
|
https://github.com/nix-community/disko
|
|
* https://aria2.github.io/
|
|
* https://github.com/schollz/croc
|
|
|
|
------------------------------------------
|
|
EXAMPLE COMMANDS:
|
|
|
|
* nh os switch --ask
|
|
* clear; sudo nixos-rebuild dry-activate --flake .#floki
|