lukas/nixos-config
Archived
1
0
Fork 1
Code Issues Pull requests Releases Wiki Activity
This repository has been archived on 2026-09-17. You can view files and clone it, but you cannot make any changes to its state, such as pushing and creating new issues, pull requests or comments.
nixos-config/hosts/pinix/README.md
pijukka 4f5f852931 docs: add operator guidance and fix remote-deploy command gaps 
Document the --no-check-sigs/--no-reexec flags needed for the pinix
nixbuild.net deploy path, and add CLAUDE.md plus an operator profile
(docs/nixos-fleet-agent-prompt.md) covering the verification cascade,
rollout order, and the project's simplicity/forkability constraints.
2026-07-28 22:01:28 +02:00

1.9 KiB
Raw Permalink Blame History

raspberry pi

The setup is a little annoying atm. No headless. :(

We want to build a sd image that joins automatically the tailnet, so that we can nixos-rebuild switch —-target-host.

Build and deploy

The primary administration checkout is /home/drone/nixos-config on blunix. Pinix also keeps a checkout at the same path for recovery and optional local builds. Fast-forward it from Forgejo's dev branch before use.

nrsp remains available on tnix for ordinary local updates. It builds the pinix configuration, copies the closure to the Raspberry Pi, and activates it.

From blunix, use the nixbuild.net remote store for AArch64 builds:

nix build \
  --json \
  --eval-store auto \
  --store ssh-ng://eu.nixbuild.net \
  path:.#nixosConfigurations.pinix.config.system.build.toplevel

Copy the output path from the JSON result into the local store, then to pinix, and activate that exact path:

nix copy \
  --from ssh-ng://eu.nixbuild.net \
  /nix/store/<output-path>

nix copy \
  --no-check-sigs \
  --to 'ssh-ng://pinix?remote-program=sudo%20nix-daemon' \
  /nix/store/<output-path>

nixos-rebuild switch \
  --no-reexec \
  --store-path /nix/store/<output-path> \
  --target-host pinix \
  --sudo

--no-check-sigs is required because pinix does not trust the nixbuild.net signing key; without it the copy fails with "lacks a signature by a trusted key". --no-reexec is required because nixos-rebuild otherwise tries to rebuild itself from <nixpkgs/nixos> via NIX_PATH, which this flake-only system does not have configured.

Do not put plaintext credentials in flake sources or derivation inputs. Secrets remain encrypted with agenix and are decrypted only on the target host.

Infrastructure addresses and domains can be overridden in the git-ignored variables-local.nix. The required encrypted files and their formats are listed in ../../secrets/README.md.