✨ Maroka's Config ✨

This config is intended for my own use and won't work for you out of the box. Feel free to use as inspiration ✨

Install on a new machine

1. Add a nixosConfiguration for the new machine and set up secrets.
2. Boot into the Nix minimal installer on the target machine and run pass so we can ssh to it.
3. Add a Disko config for the new machine.
4. Generate a hardware-configuration for the target machine.

# On target machine
nixos-generate-config --no-filesystems --show-hardware-config

5. Setup disk encryption. (Optional)
6. Format and install the system with nixos-anywhere.

# On source machine
nix run github:nix-community/nixos-anywhere -- \
    --disk-encryption-keys /dev/disk/by-partlabel/CRYPTKEY "$KEYPATH" \
    --flake .#<nixosConfiguration> nixos@<ip>

Disk Encryption

This section generates a disk encryption key and writes it to a regular flash drive for decryption.

Q. Why a regular flash drive?
A. I don't have a YubiKey :(

1. Generate and backup keyfile.

# On source machine
KEYPATH=$(mktemp)
dd bs=1024 count=4 if=/dev/random of="$KEYPATH" iflag=fullblock
chmod 0400 "$KEYPATH"

2. Write the keyfile to a flash drive. Simply plug it in and run:

# On source machine
./utils/create_keypart.sh "$KEYPATH"

⚠️ Backup the LUKS header(s) after installation!

# On target machine
sudo cryptsetup luksHeaderBackup --header-backup-file ./"$(hostname)".luksheader <crypt-partition>

Deploy

1. Run the devshell

nix develop

2. Apply the configuration

deploy .#<deployNode>

Secrets

Agenix

1. Generate SSH keypair or use system keys if OpenSSH is enabled.

ssh-keygen -t ed25519

2. Add secrets

nix run github:ryantm/agenix -- -e secret.age

⚠️ To add a user password, use the sha hash given by executing:

mkpasswd -m sha-512

Run in VM

We can use vmWithDisko to build a VM that uses the Disko config to format and create the filesystems.

nix run -L '.#nixosConfigurations.kanan.config.system.build.vmWithDisko'