mirror of
https://github.com/ellmau/nixos.git
synced 2025-12-19 09:29:36 +01:00
Stefan Ellmauthaler
4bd547123a
Flake lock file updates:
• Updated input 'emacs-overlay':
'github:nix-community/emacs-overlay/cd34501a9bcec341533c7131af77572456c100d8' (2023-02-17)
→ 'github:nix-community/emacs-overlay/2b807c388a5600d9f4e98f743306834de5dd03a5' (2023-02-20)
• Updated input 'nixos-hardware':
'github:NixOS/nixos-hardware/44ae00e02e8036a66c08f4decdece7e3bbbefee2' (2023-02-09)
→ 'github:NixOS/nixos-hardware/26c9dbdc92abc370510be78889942f38a272d705' (2023-02-20)
• Updated input 'nixpkgs':
'github:NixOS/nixpkgs/c43f676c938662072772339be6269226c77b51b8' (2023-02-14)
→ 'github:NixOS/nixpkgs/0cf4274b5d06325bd16dbf879a30981bc283e58a' (2023-02-19)
• Updated input 'nixpkgs-unstable':
'github:NixOS/nixpkgs/28319deb5ab05458d9cd5c7d99e1a24ec2e8fc4b' (2023-02-15)
→ 'github:NixOS/nixpkgs/5f4e07deb7c44f27d498f8df9c5f34750acf52d2' (2023-02-18)
• Updated input 'sops-nix':
'github:Mic92/sops-nix/c5dab21d8706afc7ceb05c23d4244dcb48d6aade' (2023-02-12)
→ 'github:Mic92/sops-nix/1da7257baa1d6801c45d9d3dedae7ce79c0e6498' (2023-02-19)
• Updated input 'sops-nix/nixpkgs-stable':
'github:NixOS/nixpkgs/d863ca850a06d91365c01620dcac342574ecf46f' (2023-02-12)
→ 'github:NixOS/nixpkgs/f27a4e2f6a3a23b843ca1c736e6043fb8b99acc1' (2023-02-19)
Nix-configuration
Deploy on a new machine
- setup the filesystem as you see fit
- check out repository to
/mnt/etc/nixos - run
nixos-generate-config --root /mntin/mnt/etc/nixos - create
machines/<machine-name>/default.nixand configure the machine - move
hardware-configuration.nixtomachines/<machine-name>/hardware-configuration.nix - stage the machine-folder
- run
nix-install --no-root-passwd --flake .#hostname --option experimental-features "nix-command flakes"
nix-sops
- generate on your (sshd-enabled) machine a pgp key:
nix shell nixpkgs#ssh-to-pgpsudo ssh-to-pgp -i /etc/ssh/ssh_host_rsa_key > /etc/nixos/secrets/keys/hosts/<hostname>.asc
- add the fingerprint of the new key to the
/etc/nixos/.sops.yamlfile - Rekey the secrets with either
- a master key
- or after a git push on another machine with enough permissions to rekey
- the flakes dev-shell (
nix develop) allows to usesops <sops-file>as well assops-rekey <sops-file>to manage the keys on the system