albert/nix
albert/nix
1
0
Fork 0
Code Issues Pull requests Activity Actions
nix/README.md
albert e13c058699
Update README
2024-12-11 19:29:14 +01:00

8.1 KiB
Raw Permalink Blame History

NixOS Configuration Repository

NOTE: These configs expect this repo to be cloned to /etc/nixos/git/

  • Clone this repo
sudo git clone https://git.sysctl.io/albert/nix /etc/nixos/git
sudo chown -R albert:root /etc/nixos/git
# or, with wallpapers
sudo git clone --recursive https://git.sysctl.io/albert/nix /etc/nixos/git
sudo chown -R albert:root /etc/nixos/git
  • Installation:
nixos-install <Hostname> [<Username>]
# or 
./docs/install.sh <Hostname> [<Username>]
  • Post install (home-manager, secrets, etc)
nix develop -c /etc/nixos/git/docs/setup.sh

Machines

Name Category Description Status Deployments
osaka-linode-01 Linode Osaka Linode relay for sysctl.io external connections ✔️ ✔️
milan-linode-01 Linode Milan Linode DERP relay for Tailscale ✔️ ✔️
frankfurt-linode-01 Linode Frankfurt, Germany alternate relay for external conns ✔️ ✔️
framework-server Server sysctl.io - main server, framework 13th gen mainboard ✔️ ✔️
warsaw-ovh-01 Server Warsaw OVH server, backup for framework-server ✔️ ✔️
nuc-server Server Server at my brothers house ✔️ ✔️
nixos-desktop Personal My main desktop ✔️ ❌
nixos-framework Personal My AMD Framework 13 laptop ✔️ ❌
steamdeck Personal Valve Steam Deck gaming console ✔️ ✔️
piaware-rpi4 Raspberry Pi Raspberry Pi for FlightAware flight tracking software ✔️ ✔️
backups-rpi4 Raspberry Pi Raspberry Pi for rsync backups ✔️ ✔️
bakersfield-rpi4 Raspberry Pi Raspberry Pi in Bakersfield, Headscale Exit Node ✔️ ✔️
quitman-rpi4 Raspberry Pi Raspberry Pi at my parents house, hs exit node ✔️ ✔️

Images

Name Description Build Commands
nixos-iso-console Console ISO image of this flake for installing nix build .#imageConfigurations.nixos-iso-console
nixos-iso-desktop Gnome ISO image of this flake for installing nix build .#imageConfigurations.nixos-iso-desktop
nixos-linode-img Image of this flake for use on Linode nix build .#imageConfigurations.nixos-linode-img
nixos-rpi4-img Image of this flake for use on Raspberry Pi 4's nix build .#imageConfigurations.nixos-rpi4-img

📋 To Do List

  • Add audio to rdesktop xrdp config
  • Figure out a way to pass through GPG AND SSH authentications via SSH (so I can use my YubiKey on my server remotely)

Homelab General

  • Upgrades:
    • Headscale 0.23 - Need to update the web ui

Completed To Do List here

ℹ️ Information

🏠 Home Manager

  • Home Manager Documentation - Link
  • Home Manager Options Search - Link

❄️ NixOS

  • nix.dev - Official Nix Documentation - Link
  • NixOS Documentation - Stable - Link
  • NixOS Packages / Options Search - Link
  • Nix User Repository (NUR) Search - Link
  • ARM NixOS Building - Link
  • NixOS Manual - Link

🔗 Useful Links

  • FlakeHub - Link
  • Flakestry.dev - Link
  • Track a Nixpkgs PR - Link
  • Awesome-Hyprland - Link

🌐 Examples

  • Tons of good examples here - Link
  • NixOS Flakes Intro Guide - Link

👀 Theming

  • Neofetch Themes - Link
  • Stylix - Link
  • Hyprland Inspirations
  • Base16 Color Schemes - Link

🔒 Lanzaboote / SecureBoot

  • Instructions here - Link

🔒 Generic Instructions:

  1. Create your keys: sbctl create-keys
  2. Verify your machine is ready for SecureBoot: sbctl verify - Everything except *-bzImage.efi are signed
  3. Enter Secureboot Setup mode in your EFI Settings on the motherboard (F10)
    • Security -> SecureBoot -> Set to Enabled and "Reset to Setup Mode" and exit
  4. Enroll the keys: sbctl enroll-keys --microsoft
    • If you wish, you can select --tpm-eventlog, but checksums will change later (ie, at a kernel rebuild)
  5. Reboot and verify you are activated: bootctl status

💻 Framework Specific:

  1. Change boot import from boot.nix to secureboot.nix in ./nixos/hosts/<hostname>/default.nix
  2. Run rebuild-host to switch from boot.nix to secureboot.nix
  3. Reboot into EUFI and set SecureBoot settings to:
    • Enforce Secure Boot - Enabled
    • Erase all Secure Boot Settings - Enabled
    • Restore Secure Boot to Factory Settings - Disabled
  4. Save and reboot
  5. Run sudo sbctl create-keys
  6. Run sudo sbctl enroll-keys
  7. Reboot and verify with bootctl status

🗝️ Manual: GPG Keys

  1. Import the user private key: gpg --import gpg/users/albert/privkey.asc
  2. Mark it as trusted: gpg --edit-key albert@sysctl.io, then type trust, then 5
  3. On each new machine, run sudo nix-shell -p ssh-to-pgp --run "ssh-to-pgp -i /etc/ssh/ssh_host_rsa_key -o /etc/nixos/git/keys/hosts/$(hostname).asc"
    • This will output the identifier you add to .sops.yaml
    • Move HOSTNAME.asc to keys/hosts/ and upload to git and rename accordingly.

🔐 Secrets

  1. Run nix-develop in /etc/nixos/git to import new keys
  2. To edit a file: sops secrets/file.yml"
  3. When you add a new machine, you must update the secrets files encryption.
    • Ensure .sops.yaml has the updated fingerprint and file mappings.
    • Run sops updatekeys secrets/file.yaml and commit the change.

ℹ️ Troubleshooting

  1. To troubleshoot disko issues, this command can come in handy:
 nix eval .#nixosConfigurations.`hostname`.config.disko.devices._config

Directory Structure

/etc/nixos/git/
├── docs
├── home-manager
│   ├── common
│   │   ├── desktops
│   │   └── software
│   │       ├── cli
│   │       └── gui
│   ├── hosts
│   └── users
├── keys
│   ├── hosts
│   ├── ssh
│   └── users
├── lib
├── nixos
│   ├── common
│   │   ├── desktops
│   │   ├── modules
│   │   ├── packages
│   │   ├── services
│   │   └── software
│   │       ├── cli
│   │       └── gui
│   ├── hosts
│   ├── containers
│   └── users
├── secrets
│   ├── containers
│   └── hosts
├── stylix
│   ├── common
│   └── themes
└── wallpapers