Kaare Hoff Skovgaard
608d758f30
However, the nixos-install script fails on khs openstack as the system won't boot up after installation due it being unable to locate the root disk. I am not sure what disk it ends up finding.
51 lines
1.9 KiB
Markdown
51 lines
1.9 KiB
Markdown
# Nix Machines
|
|
|
|
This is my repository for all my various machines running NixOS (or Using Nix Darwin).
|
|
|
|
It has been created as an attempt at unifying all the various provisioning of software/cloud resources that must happen, such that for every instance there's a unified set of commands to run.
|
|
|
|
When running on a desktop machine, simply running `nixos-install` as per usual should suffice.
|
|
|
|
## Servers
|
|
|
|
To provision the cloud resources needed, the following can be run:
|
|
|
|
```bash
|
|
nix run '.#create-instance' -- <hostname>
|
|
```
|
|
|
|
This will run the `provision.pre` terraform code to ensure the cloud resources are created as needed, on either hetzner or openstack. It should also select the appropriate secrets backend to fetch secrets from. In general every server should use `vault` (OpenBAO) as the backend, except for the server hosting OpenBAO.
|
|
|
|
Once the instance has been created it will _not_ run NixOS, but rather something like Debian, which can then be provisioned into a NixOS installation. Run the following command to enroll NixOS on the instance:
|
|
|
|
```bash
|
|
nix run '.#inxos-install' -- <hostname>
|
|
```
|
|
|
|
<details>
|
|
<summary>NOTE</summary>
|
|
If you're creating and destroying instances on the same host name and have DNS caching trouble, you can run the following to connect using an IP address:
|
|
|
|
```bash
|
|
nix run '.#nixos-install' -- <hostname> <ip>
|
|
```
|
|
|
|
</details>
|
|
|
|
TODO: Here should be some guidance on how to transfer RoleID/SecretID to the server, as well as running the post provisioning scripts for the servers that need it.
|
|
|
|
To delete the resources again run:
|
|
|
|
```bash
|
|
nix run '.#destroy-instance' -- <hostname>
|
|
```
|
|
|
|
NOTE: It is normal for the secret id associated with vault/openbao roles to not be deletable. Simply run the destroy-instance command a 2nd time and everything should work just fine.
|
|
|
|
## Secrets
|
|
|
|
To transfer the secrets needed for OpenTofu from Bitwarden to OpenBAO run:
|
|
|
|
```bash
|
|
nix run '.#bitwarden-to-vault'
|
|
```
|