Create a new host

Base config

there is an example config here note: TODO

If this is a physical host

Create the keys and secrets using add-host-keys This will ask for a hostname and then

• create and encrypt a ssh-key with sops
• create and encrypt a second ssh-key for the init
• convert the main key to a sops pubkey and display it
• create public/private wireguard keys and display the pubkey
• generate a reproducible mac-address

After this you have to

• write the age public key into machines/.sops.yaml under keys:
• write a new creation rule for the secrets.yaml under creation_rules: like

creation_rules:
  - path_regex: {hostname}/secrets.yaml$
    key_groups:
    - pgp:
      - *admin_kalipso
      - *admin_kalipso_dsktp
      age:
      - *admin_atlan
      - *machine_{hostname}

• create the secrets.yaml using sops {hostname}/secrets.yaml
  • you can already add wg_private: {wg priv key} here
• add the host to the hosts.nix file (if microvm use the generated mac here)
• add the host to machines/modules/malobeo/peers.nix for vpn access (use the wireguard pubkey here)

deploy the host with nixos-anywhere

We use a nixos-anywhere wrapper script to deploy new hosts. The wrapper script takes care of copying persistent host keys before calling nixos-anywhere.

To accomplish that boot the host from a nixos image and setup a root password.

sudo su
passwd

After that get the hosts ip using ip a and start deployment from your own machine:

# from infrastrucutre repository root dir:
nix develop .#
remote-install hostname 10.0.42.23

Testing Disko

Testing disko partitioning is working quite well. Just run the following and check the datasets in the vm:

nix run -L .\#nixosConfigurations.fanny.config.system.build.vmWithDisko