Archived

This repository has been archived on 2026-09-17. You can view files and clone it, but you cannot make any changes to its state, such as pushing and creating new issues, pull requests or comments.

History

pijukka c8cfdcd88e host(pinix): add live intent and ereader viewer services Both run on pinix, published only through the pinix Tailnet namespace and Traefik's web-internal entrypoint (unbound local-data + Headscale split DNS for intent./ereader.domain2). Live Intent reads its OpenAI key from the new pinix-only agenix secret. ereaderViewer is a path: flake input for now; the repo split plan moves it into its own repository on cgit. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>		2026-09-17 12:18:55 +02:00
..
localServices	host(pinix): add live intent and ereader viewer services	2026-09-17 12:18:55 +02:00
configuration.nix	host(pinix): clean up leftover Mango references after the router migration	2026-09-13 16:07:15 +02:00
disko.nix	auto	2025-06-29 21:21:33 +02:00
hardware-configuration.nix	auto	2025-06-29 20:48:33 +02:00
hardware-configuration_bak.nix	auto	2025-06-29 20:48:33 +02:00
README.md	docs: add operator guidance and fix remote-deploy command gaps	2026-07-28 22:01:28 +02:00
router-lan.nix	host(pinix): restore link-local addresses on end0/wlan0 for radvd	2026-09-13 15:53:55 +02:00
router-uplink.nix	host(pinix): clean up leftover Mango references after the router migration	2026-09-13 16:07:15 +02:00

README.md

raspberry pi

The setup is a little annoying atm. No headless. :(

We want to build a sd image that joins automatically the tailnet, so that we can nixos-rebuild switch —-target-host.

Build and deploy

The primary administration checkout is /home/drone/nixos-config on blunix. Pinix also keeps a checkout at the same path for recovery and optional local builds. Fast-forward it from Forgejo's dev branch before use.

nrsp remains available on tnix for ordinary local updates. It builds the pinix configuration, copies the closure to the Raspberry Pi, and activates it.

From blunix, use the nixbuild.net remote store for AArch64 builds:

nix build \
  --json \
  --eval-store auto \
  --store ssh-ng://eu.nixbuild.net \
  path:.#nixosConfigurations.pinix.config.system.build.toplevel

Copy the output path from the JSON result into the local store, then to pinix, and activate that exact path:

nix copy \
  --from ssh-ng://eu.nixbuild.net \
  /nix/store/<output-path>

nix copy \
  --no-check-sigs \
  --to 'ssh-ng://pinix?remote-program=sudo%20nix-daemon' \
  /nix/store/<output-path>

nixos-rebuild switch \
  --no-reexec \
  --store-path /nix/store/<output-path> \
  --target-host pinix \
  --sudo

--no-check-sigs is required because pinix does not trust the nixbuild.net signing key; without it the copy fails with "lacks a signature by a trusted key". --no-reexec is required because nixos-rebuild otherwise tries to rebuild itself from <nixpkgs/nixos> via NIX_PATH, which this flake-only system does not have configured.

Do not put plaintext credentials in flake sources or derivation inputs. Secrets remain encrypted with agenix and are decrypted only on the target host.

Infrastructure addresses and domains can be overridden in the git-ignored variables-local.nix. The required encrypted files and their formats are listed in ../../secrets/README.md.