dotnix

Installation

Prerequisites

You need to prepare a couple things before installation due to the way secrets are managed.

Prepare secrets repo

1. Ensure all required dependencies are present.

nix-shell -p sops age git

2. Initialize your secrets repo. You can do this anywhere on your system except this repository.

mkdir secrets
cd secrets
git init

3. Create your gitignore. You want this to make sure that you do not accidentally push your private key.

echo "keys.txt" > .gitignore

4. Generate your private key.

age-keygen -o ./keys.txt

5. Create your sops configuration file.

cat <<EOF > .sops.yaml
keys:
  - &master $(age-keygen -y ./keys.txt)
creation_rules:
  - path_regex: .*\.(yaml|json|env|ini)$
    key_groups:
    - age:
      - *master
EOF

6. Create a password file for your user.

mkpasswd | wl-copy # if you're on x11, replace `wl-copy` with `xclip -sel clipboard`
sops user_password.yaml

Then edit the file to look like this.

user_password: <The pasted password from mkpasswd>

7. Commit and push your changes.

git remote add origin git@example.com:example/secrets
git add .
git commit -m "batman"
git push --set-upstream origin master

8. Back up your keys.txt.

This step is very important as you'll need to copy this file to your new installation. Make sure you'll be able to securely copy it to another machine, you should handle this file with much care as anyone who has it will be able to decrypt your secrets if the have the files.

Selecting a livecd for the installation

The installation should work on all the NixOS livecd images, other livecds are not supported. Just make sure you have a way to get both your ssh key for cloning your secrets repository and keys.txt for decrypting your sops files.

Installation

1. Clone this repository

git clone https://github.com/c4em/dotnix.git
cd dotnix

2. Enter a nix-shell with all required dependencies for the installation

nix-shell # This will automatically install all dependencies from `shell.nix`

3. Update the submodule to use your secrets repository.

git submodule set-url -- secrets <ssh uri to your repository>

4. Fetch your keys.txt.

This step is very important, without it your system wont be able to boot. Make sure to place it in the root of the secrets/ directory.

5. Adjust the configuration to your needs.

Information about how the configuation is structured is available in the WIP section.

6. Run the installation script

./install.sh --host <your host> --device <the device to install NixOS on>