StuRa NixOS Infrastructure

Our servers are managed using the NixOS deployment tool Colmena. Secrets are encrypted using SOPS and age keys derived from SSH keys.

Repo structure

.
├── flake.lock
├── flake.nix
├── hive.nix     # contains the definition of all our machines
├── common       # contains our common configurations and users
├── hosts        # contains our host-specific configuration (hostname, network, etc.)
├── profiles     # contains our profiles that we apply on hosts

Preparations

Currently you need to enable the experimental features "nix-command" and "flakes" in your nix daemon.

Then you can start a developer-shell using nix develop or use direnv to automatically drop into a developer shell when entering the repository by running echo "use flake" > .envrc && direnv allow

Build/Deployment

Some Examples:

• Build all hosts: colmena build
• Build & deploy a specific host: colmena apply --on hostname