# raspberry pi

The setup is a little annoying atm. No headless. :(

We want to build a sd image that joins automatically the tailnet, so that we can nixos-rebuild switch —-target-host.

## Build and deploy

The primary administration checkout is `/home/drone/nixos-config` on `blunix`.
Pinix also keeps a checkout at the same path for recovery and optional local
builds. Fast-forward it from Forgejo's `dev` branch before use.

`nrsp` remains available on `tnix` for ordinary local updates. It builds the
`pinix` configuration, copies the closure to the Raspberry Pi, and activates
it.

From `blunix`, use the nixbuild.net remote store for AArch64 builds:

```bash
nix build \
  --json \
  --eval-store auto \
  --store ssh-ng://eu.nixbuild.net \
  path:.#nixosConfigurations.pinix.config.system.build.toplevel
```

Copy the output path from the JSON result into the local store, then to
`pinix`, and activate that exact path:

```bash
nix copy \
  --from ssh-ng://eu.nixbuild.net \
  /nix/store/<output-path>

nix copy \
  --no-check-sigs \
  --to 'ssh-ng://pinix?remote-program=sudo%20nix-daemon' \
  /nix/store/<output-path>

nixos-rebuild switch \
  --no-reexec \
  --store-path /nix/store/<output-path> \
  --target-host pinix \
  --sudo
```

`--no-check-sigs` is required because pinix does not trust the nixbuild.net
signing key; without it the copy fails with "lacks a signature by a trusted
key". `--no-reexec` is required because `nixos-rebuild` otherwise tries to
rebuild itself from `<nixpkgs/nixos>` via `NIX_PATH`, which this flake-only
system does not have configured.

Do not put plaintext credentials in flake sources or derivation inputs.
Secrets remain encrypted with agenix and are decrypted only on the target
host.

Infrastructure addresses and domains can be overridden in the git-ignored
`variables-local.nix`. The required encrypted files and their formats are
listed in [`../../secrets/README.md`](../../secrets/README.md).