dotfiles

My NixOS-managed dotfiles repository.

Installation

NixOS configurations

Reinstalling an existing configuration

These can be installed using nixos-anywhere, however the installation steps are subtly different from the upstream ones:

Warning yui has not yet been set up for this process

1. Get the gpg secret directory from a backup. If no backup is
   available, set up a new gpg directory as in the new machine
   instructions.
2. Boot the NixOS install disk on the machine in question, set up
   networking and a user password.
3. ssh into the machine, copy the ssh public key into
   /root/.ssh/authorized_keys
4. Place the desired disk encryption password in a file
   (secret.key), ensuring it does not end in a newline (echo -e).
5. Run nix run --inputs-from . nixos-anywhere -- -f .#<hostname> root@<ip> --no-reboot --disk-encryption-keys /tmp/secret.key secret.key
   • If some permission error around secret.key pops up, rerun the
     command without the --disk-encryption-keys. They will already
     have been copied over, some kind of upstream bug.
6. Before rebooting:
   1. Copy the gpg dir acquired in step 1 to /mnt/var/lib/sops
   2. Place a copy of /etc/sops/secrets.yaml in /mnt/etc/sops/secrets.yaml.
   3. Set a password for tlater with nixos-enter and passwd

Setting up a new machine

Before the configuration can be installed, we need to set up a few basic things.

It's easiest to do this when the system in question is already running, and we're ssh'd into it, so we can read out some device data. So boot into the NixOS installer first (will be useful later anyway).

Create a new subdirectory of nixos-config named after the new host, and create a new nixosConfigurations entry for it.

Then set up:

1. Basic networking. Typically a bond config, see ren/yui for
   examples.
2. Make sure to include one of the network modules so that wireless
   networking is set up on first boot.
3. Generate and include a new hardware-configuration.nix:

   nixos-generate-config --no-filesystems --show-hardware-config
   

4. Set up a new sops target.
   1. Firstly, create a new gpg dir according to these
      instructions.
   2. Then, add the generated fingerprint to .sops.yaml, and
      re-encrypt /etc/sops/secrets.yaml.

GPG/sops setup

Non-NixOS

For non-NixOS hosts, this requires nix >=2.4 with flakes enabled. To install this on an arbitrary Linux distro, follow the upstream nix installation instructions and then run:

nix-env -iA nixpkgs.nixFlakes
mkdir -p ~/.config/nix
echo 'experimental-features = nix-command flakes' > ~/.config/nix/nix.conf

After that, enter a devshell for this flake and install it with home-manager:

nix develop github:tlater/dotfiles
home-manager switch --flake github:tlater/dotfiles#gnome-vm