NixiN/nixin-krops
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
POC for deploying nixin configurations with krops
15 commits 1 branch 0 tags 118 KiB
Nix 100%
Find a file
Fabrice Bellamy a7df2c8aa1 update readme
2024-12-19 15:57:17 +01:00
config fix wireguard private key file path 2024-12-19 15:54:49 +01:00
modules modularize configuration of arachnide server 2024-12-19 15:47:58 +01:00
.gitignore first version 2024-12-18 22:54:04 +01:00
krops.nix activate configuration for arachnide server 2024-12-19 13:57:13 +01:00
nixpkgs.json pre-fetch nixpkgs revision hash 2024-12-19 11:07:32 +01:00
README.md update readme 2024-12-19 15:57:17 +01:00

README.md

Nixin krops POC

This is a proof of concept of using krops to deploy nixos configurations generated by nixin

The configurations of the servers are stored in a sub-directories of the config directory :

├── config
│   ├── server-01
│   │   ├── configuration.nix
│   │   └── hardware-configuration.nix
│   └── server-02
│       ├── configuration.nix
│       └── hardware-configuration.nix

These configurations can import shared modules stored in the modules directory

├── modules
│   ├── nixin.nix
│   └── users.nix

The file nixpkgs.json contains the revision of nixpkgs to use. See the tips section for how to update it

The file krops.nix is the main deployment configuration that ties everything up. If new servers are added to the config directory, they must also be added in this file.

The servers mush be accessible with ssh as root or as a user with passwordless sudo capability, as defined in krops.nix

Secrets are stored in a sub directory of a separate git repository, managed with passwordstore
This directory must available at ~/.password-store/nixin-password-store/krops. (This is also defined in krops.nix)
When building the configuration on the server, the secrets files are decrypted and copied to the /var/srv/secret directory

Sample /var/src on a server after configuration deployment :

[root@arachnide:~]# ls -l /var/src
total 20
drwxr-xr-x  2 root root 4096 18 déc.  19:07 config
drwxr-xr-x  2 root root 4096 18 déc.  21:39 modules
lrwxrwxrwx  1 root root   24 19 déc.  10:28 nixos-config -> config/configuration.nix
drwxr-xr-x 10 root root 4096 19 déc.  10:29 nixpkgs
drwx------  2 root root 4096 19 déc.  10:30 secrets

Tips

The file /var/src/.populate needs to be created on target servers to be able to deploy a configuration to them. This is a protection to avoid deploying to a machine that is not meant to be managed with krops

Deploying configuration of only one server :
nix-build ./krops.nix -A arachnide && ./result

Deploying configuration of all servers :
nix-build ./krops.nix -A all && ./result

Updating the nixpkgs revision that is used :

nix-prefetch-git   --url https://github.com/NixOS/nixpkgs   --rev "refs/heads/nixos-24.11"   > nixpkgs.json

Rebuilding the system on the host itself :

nixos-rebuild switch -I /var/src

References