From 222cd4e7ebc4f725d346a08203069aaaf22cfd7c Mon Sep 17 00:00:00 2001 From: Aly Raffauf Date: Sat, 9 May 2026 11:29:29 -0400 Subject: [PATCH] cleanup --- README.md | 1 - nix/hosts/README.md | 31 ++++--------------- nix/hosts/eterna/grafana.nix | 4 --- nix/modules/nixos/base/known-hosts.nix | 4 --- .../nixos/profiles/backups/default.nix | 5 ++- 5 files changed, 8 insertions(+), 37 deletions(-) diff --git a/README.md b/README.md index 26d43ba7..30d4d970 100644 --- a/README.md +++ b/README.md @@ -16,7 +16,6 @@ This repository contains NixOS and home-manager configurations, along with whate - [flake](https://github.com/alyraffauf/flake): Fully featured flake template for NixOS, nix-darwin, home-manager configurations, and software projects. - [fontix](https://github.com/alyraffauf/fontix): Home-manager modules for setting consistent fonts and sizing across applications. - [safari](https://github.com/alyraffauf/safari): Shell configuration used in this repository. -- [secrets](https://github.com/alyraffauf/secrets): Encrypted secrets storage using agenix. - [snippets](https://github.com/alyraffauf/snippets): Reusable Nix snippets used across multiple repositories. --- diff --git a/nix/hosts/README.md b/nix/hosts/README.md index fdbc381a..d52bf501 100644 --- a/nix/hosts/README.md +++ b/nix/hosts/README.md @@ -13,8 +13,6 @@ hosts/ ├── celestic/ # Hetzner VPS ├── eterna/ # Beelink Mini S12 Pro ├── jubilife/ # Custom Mini-ITX NAS -├── oreburgh/ # Framework Laptop 13 (11th Gen Intel) -├── slateport/ # Lenovo ThinkCentre M700 Tiny ├── snowpoint/ # Netcup VPS ├── solaceon/ # Hetzner VPS └── twinleaf/ # Minimal installation ISO @@ -24,33 +22,16 @@ hosts/ ## 🛠️ Provisioning New Devices -To add a new device to this configuration, follow these steps: +1. **Create host configuration**: duplicate an existing host directory under `hosts/` and rename it. Update `default.nix`, `disko.nix`, `hardware.nix`, etc. to match the device. -1. **Create Host Configuration**: - - Duplicate an existing host directory within `hosts/` and rename it to the new device's hostname. - - Modify the `default.nix` and other relevant Nix modules (e.g., `disko.nix`, `hardware.nix`, `home.nix`) to match the new device's specifications. +1. **Register the host**: add it to `nixosConfigurations` in `nix/modules/flake/nixos.nix`. -1. **Update `flake.nix`**: - - Add the new host to the `nixosConfigurations` section in `modules/flake/nixos.nix`. +1. **Install NixOS** on the device using this flake. Secrets will not decrypt on first boot until the host's age key is a recipient. -1. **Install NixOS**: - - Install NixOS on the new device using this flake. Note that secrets will not be available on the first boot without a valid SSH private key. +1. **Add SSH host key as a sops recipient**: copy `/etc/ssh/ssh_host_ed25519_key.pub` from the new device into `publicKeys/root_$HOSTNAME.pub`, then run `just sops-rekey` to regenerate `.sops.yaml` and re-encrypt every secret. -1. **Authorize SSH Key**: - - On a separate machine, copy the new system's public SSH key (`/etc/ssh/ssh_host_ed25519_key.pub`) to the secrets repository at `github.com/alyraffauf/secrets` (`secrets/publicKeys/root_$HOSTNAME.pub`). +1. **Rebuild** on the new device. Secrets land at `/run/secrets/` (sops-nix). -1. **Rekey Secrets**: - - Add the new public key to `secrets.nix` in the secrets repository. - - Rekey all secrets: - ```bash - agenix --rekey - ``` - - Push the changes to the repository. - -1. **Rebuild System**: - - On the new device, rebuild the system from the repository. Secrets will be automatically decrypted and available in `/run/agenix/` for NixOS and `$XDG_RUNTIME_DIR/agenix/` for users. - -1. **(Optional) Configure User SSH Key**: - - Generate a new user SSH key and copy it to the secrets repository at `secrets/publicKeys/$USER_$HOSTNAME.pub` to enable passwordless logins to other hosts. +1. **(Optional) Add a user key**: drop `~/.ssh/id_ed25519.pub` from the new device into `publicKeys/$USER_$HOSTNAME.pub` and re-run `just sops-rekey` so the user can decrypt secrets too. --- diff --git a/nix/hosts/eterna/grafana.nix b/nix/hosts/eterna/grafana.nix index ea068ce5..c4ff6688 100644 --- a/nix/hosts/eterna/grafana.nix +++ b/nix/hosts/eterna/grafana.nix @@ -181,10 +181,6 @@ _: { targets = ["celestic:3021"]; labels.instance = "celestic"; } - { - targets = ["oreburgh:3021"]; - labels.instance = "oreburgh"; - } { targets = ["jubilife:3021"]; labels.instance = "jubilife"; diff --git a/nix/modules/nixos/base/known-hosts.nix b/nix/modules/nixos/base/known-hosts.nix index 814c463b..b34c671f 100644 --- a/nix/modules/nixos/base/known-hosts.nix +++ b/nix/modules/nixos/base/known-hosts.nix @@ -26,10 +26,6 @@ in { hostNames = ["fortree" "fortree.local" "fortree.${tnet}"]; publicKeyFile = pub "fortree"; }; - oreburgh = { - hostNames = ["oreburgh" "oreburgh.local" "oreburgh.${tnet}" "lavaridge" "lavaridge.local" "lavaridge.${tnet}"]; - publicKeyFile = pub "oreburgh"; - }; jubilife = { hostNames = ["jubilife" "jubilife.local" "jubilife.${tnet}" "lilycove" "lilycove.local" "lilycove.${tnet}"]; publicKeyFile = pub "jubilife"; diff --git a/nix/modules/nixos/profiles/backups/default.nix b/nix/modules/nixos/profiles/backups/default.nix index 3915e1ae..d17841b2 100644 --- a/nix/modules/nixos/profiles/backups/default.nix +++ b/nix/modules/nixos/profiles/backups/default.nix @@ -8,9 +8,8 @@ mkRepo = service: "${backupDestination}/${service}"; stop = service: "${pkgs.systemd}/bin/systemctl stop ${service}"; start = service: "${pkgs.systemd}/bin/systemctl start ${service}"; - # mySnippets.restic still wires `passwordFile`/`rcloneConfigFile` to - # `config.age.secrets.*.path`. Override to point at the sops-managed - # paths so we can drop ragenix. + # mySnippets.restic defaults `passwordFile`/`rcloneConfigFile` to + # `config.age.secrets.*.path`; override to the sops-managed paths. restic = config.mySnippets.restic // { -- 2.51.2