nix/readme.md

135 lines
4.3 KiB
Markdown
Raw Normal View History

2023-09-06 00:14:34 -05:00
# Nix
2023-09-04 11:40:30 -05:00
2023-09-15 11:16:38 -05:00
My grand, declarative, and unified application, service, environment, and
machine configuration, secret, and package management in a single flake. ❤️ ❄️
2023-09-06 00:14:34 -05:00
2023-09-15 11:16:38 -05:00
**NOTE**: Everything in here is highly specific to my personal preference. I
can't recommend you actually use this in any way, but hopefully some stuff in
here is useful inspiration.
2023-09-06 00:14:34 -05:00
2023-09-15 11:16:38 -05:00
# Quick Start
2023-09-04 11:49:33 -05:00
2023-09-15 11:16:38 -05:00
You don't have even have to clone this crap yourself. How cool is that!
2023-09-06 00:14:34 -05:00
2023-09-19 20:57:24 -05:00
But if you're gonna change stuff you had better setup the pre-commit hook:
```shell_session
2023-10-03 16:26:45 -05:00
$ ln -s $PWD/pre-commit.bash .git/hooks/pre-commit
```
If you're deploying anything secrets-related, you will need the proper keys:
```shell_session
$ mkdir -p ${XDG_CONFIG_HOME:-~/.config}/sops/age
$ pass age-key >> ${XDG_CONFIG_HOME:-~/.config}/sops/age/keys.txt
2023-09-19 20:57:24 -05:00
```
2023-09-15 11:16:38 -05:00
## NixOS
2023-09-04 11:40:30 -05:00
2023-09-15 11:16:38 -05:00
```shell_session
2023-10-03 16:26:45 -05:00
$ nixos-rebuild switch --flake git+https://git.lyte.dev/lytedev/nix
2023-09-06 00:14:34 -05:00
```
2023-09-04 11:40:30 -05:00
2023-09-15 11:16:38 -05:00
## Not NixOS
2023-09-04 11:40:30 -05:00
2023-09-15 11:16:38 -05:00
```shell_session
$ curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | sh -s -- install
$ nix profile install github:nix-community/home-manager
$ home-manager switch --flake git+https://git.lyte.dev/lytedev/nix
2023-09-04 11:40:30 -05:00
```
2023-09-15 11:16:38 -05:00
# Advanced Usage
2023-09-15 11:16:38 -05:00
## Push NixOS Config
```bash
2023-10-03 14:50:00 -05:00
host=your_host
nix run nixpkgs#nixos-rebuild -- --flake "git+https://git.lyte.dev/lytedev/nix#$host" \
--target-host "root@$host" --build-host "root@$host" \
2023-09-15 11:16:38 -05:00
switch --show-trace
2023-09-06 00:14:34 -05:00
```
### Safer Method
```bash
# initialize a delayed reboot by a process you can kill later if things look good
# note that the amount of time you give it probably needs to be enough time to both complete the upgrade
# _and_ perform whatever testing you need
2023-10-03 14:50:00 -05:00
host=your_host
ssh -t "root@$host" "bash -c '
2023-09-28 12:29:21 -05:00
set -m
(sleep 300; reboot;) &
jobs -p
2023-09-28 12:29:21 -05:00
bg
disown
'"
# build the system and start running it, but do NOT set the machine up to boot to that system yet
# we will test things and make sure it works first
# if it fails, the reboot we started previously will automatically kick in once the timeout is reached
# and the machine will boot to the now-previous iteration
2023-10-03 14:50:00 -05:00
nix run nixpkgs#nixos-rebuild -- --flake "git+https://git.lyte.dev/lytedev/nix#$host" \
--target-host "root@$host" --build-host "root@$host" \
test --show-trace
# however you like, verify the system is running as expected
# if it is, run the same command with "switch" instead of "test"
# otherwise, we will wait until the machine reboots back into the
# this is crude, but should be pretty foolproof
# the main gotcha is that the system is already unbootable or non-workable, but
# if you always use this method, that should be an impossible state to get into
# if we still have ssh access and the machine fails testing, just rollback
# instead of waiting for the reboot
2023-10-03 14:50:00 -05:00
ssh "root@$host" nixos-rebuild --rollback switch
```
2023-09-04 11:49:33 -05:00
2023-09-15 11:16:38 -05:00
## Provisioning New NixOS Hosts
2023-09-04 11:49:33 -05:00
```bash
2023-09-15 11:16:38 -05:00
# establish network access
# plug in ethernet or do the wpa_cli song and dance for wifi
wpa_cli scan
2023-09-04 11:49:33 -05:00
wpa_cli scan_results
wpa_cli add_network 0
wpa_cli set_network 0 ssid "MY_SSID"
wpa_cli set_network 0 psk "MY_WIFI_PASSWORD"
wpa_cli enable_network 0
wpa_cli save_config
# disk encryption key (if needed)
echo -n "password" > /tmp/secret.key
2023-09-15 11:16:38 -05:00
# partition disks
nix-shell --packages git --run "sudo nix run \
2023-09-06 00:14:34 -05:00
--extra-experimental-features nix-command \
--extra-experimental-features flakes \
github:nix-community/disko -- \
2023-09-15 11:16:38 -05:00
--flake 'git+https://git.lyte.dev/lytedev/nix#${PARTITION_SCHEME}' \
2023-09-06 00:14:34 -05:00
--mode disko \
2023-09-15 11:16:38 -05:00
--arg disks '[ \"/dev/${DISK}\" ]'"
2023-09-04 11:49:33 -05:00
2023-09-15 11:16:38 -05:00
# install
2023-09-04 11:49:33 -05:00
nix-shell --packages git \
2023-09-06 00:14:34 -05:00
--run "sudo nixos-install \
--flake 'git+https://git.lyte.dev/lytedev/nix#${FLAKE_ATTR}' \
--option substituters 'https://cache.nixos.org https://nix.h.lyte.dev' \
--option trusted-public-keys 'cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= h.lyte.dev:HeVWtne31ZG8iMf+c15VY3/Mky/4ufXlfTpT8+4Xbs0='"
2023-09-04 11:49:33 -05:00
```
2023-09-15 11:16:38 -05:00
# To Do
2023-09-04 11:40:30 -05:00
2023-10-05 10:41:31 -05:00
## Short Term
- Fix Helix UI (picker borders gone)
- Remove all work-specific config and stick that in its own flake that uses my main flake as input
- Fonts installed by home manager instead of nixos module
- Zellij config
- Broot theme
## Long Term
2023-09-15 11:16:38 -05:00
- I don't understand Nix well enough to know why stuff is being compiled even when I have a binary cache
- Maybe it detects different CPUs and will recompile certain packages for per-CPU optimizations?
- How does this factor in with "pureness"?