forked from lukas/nixos-config
4f5f852931
Document the --no-check-sigs/--no-reexec flags needed for the pinix nixbuild.net deploy path, and add CLAUDE.md plus an operator profile (docs/nixos-fleet-agent-prompt.md) covering the verification cascade, rollout order, and the project's simplicity/forkability constraints.
59 lines
1.9 KiB
Markdown
59 lines
1.9 KiB
Markdown
# raspberry pi
|
|
|
|
The setup is a little annoying atm. No headless. :(
|
|
|
|
We want to build a sd image that joins automatically the tailnet, so that we can nixos-rebuild switch —-target-host.
|
|
|
|
## Build and deploy
|
|
|
|
The primary administration checkout is `/home/drone/nixos-config` on `blunix`.
|
|
Pinix also keeps a checkout at the same path for recovery and optional local
|
|
builds. Fast-forward it from Forgejo's `dev` branch before use.
|
|
|
|
`nrsp` remains available on `tnix` for ordinary local updates. It builds the
|
|
`pinix` configuration, copies the closure to the Raspberry Pi, and activates
|
|
it.
|
|
|
|
From `blunix`, use the nixbuild.net remote store for AArch64 builds:
|
|
|
|
```bash
|
|
nix build \
|
|
--json \
|
|
--eval-store auto \
|
|
--store ssh-ng://eu.nixbuild.net \
|
|
path:.#nixosConfigurations.pinix.config.system.build.toplevel
|
|
```
|
|
|
|
Copy the output path from the JSON result into the local store, then to
|
|
`pinix`, and activate that exact path:
|
|
|
|
```bash
|
|
nix copy \
|
|
--from ssh-ng://eu.nixbuild.net \
|
|
/nix/store/<output-path>
|
|
|
|
nix copy \
|
|
--no-check-sigs \
|
|
--to 'ssh-ng://pinix?remote-program=sudo%20nix-daemon' \
|
|
/nix/store/<output-path>
|
|
|
|
nixos-rebuild switch \
|
|
--no-reexec \
|
|
--store-path /nix/store/<output-path> \
|
|
--target-host pinix \
|
|
--sudo
|
|
```
|
|
|
|
`--no-check-sigs` is required because pinix does not trust the nixbuild.net
|
|
signing key; without it the copy fails with "lacks a signature by a trusted
|
|
key". `--no-reexec` is required because `nixos-rebuild` otherwise tries to
|
|
rebuild itself from `<nixpkgs/nixos>` via `NIX_PATH`, which this flake-only
|
|
system does not have configured.
|
|
|
|
Do not put plaintext credentials in flake sources or derivation inputs.
|
|
Secrets remain encrypted with agenix and are decrypted only on the target
|
|
host.
|
|
|
|
Infrastructure addresses and domains can be overridden in the git-ignored
|
|
`variables-local.nix`. The required encrypted files and their formats are
|
|
listed in [`../../secrets/README.md`](../../secrets/README.md).
|