nixos-config

This repo contains configuration files for my NixOS based systems.

Secrets

The configuration uses sops-nix to store encrypted secrets in a yaml file. The secrets are decrypted on the target machine at "activate" time (i.e. during a nixos-rebuild) and become readable for the root user at /run/secrets/... (or, in Nix, at sops.secrets."secret-name".path").

To change the owner of the secret: sops.secrets."secret-name".owner = "alex" (changes file perms)

Add a secret

sops secrets/atauno.yaml

Then commit and push.

Add a new host

# generate a key for the user / host machine
mkdir -p ~/.config/sops/age
age-keygen -o ~/.config/sops/age/keys.txt

# or generate from ssh
nix-shell -p ssh-to-age --run "ssh-to-age < ~/.ssh/id_ed25519.pub"

Add the public key to .sops.yaml and then:

sops updatekeys secrets/atauno.yaml

(note: updatekeys must be called from a machine in the existing group)

Images

The file config/images/base-img.nix contains a config for remote image deployments. This is primarily intended for DigitalOcean droplets, exposing a workflow as so:

1. Generate the image: nixos-rebuild build-image --image-variant digital-ocean --flake .#base-img
2. Upload this as a custom image to DO
3. Instantiate a new droplet with this base image
4. During initial startup, a systemd service resets the VM's hostname to match the droplet name from DO's API metadata server
5. At this point, comin enables this droplet to pull updates automatically from this config repo, forking off from the base image config