feat(installer): interactive one-command fleet installer

lytedev commented

2026-07-19 00:27:55 -05:00

Owner

Overhauls packages/installer.nix into the boot-a-stock-ISO, run-one-command flow: fzf host picker; disks come from the host's baked-in disko config (no more scheme-matching or hand-typed --args); confirm/remap each disk against the machine's real block devices; passphrase prompt only for encrypted layouts; typed-hostname confirmation; disko; optional pre-generated host-key provisioning from secrets/-provision.yaml (so sops-nix decrypts on first boot); nixos-install.

Validation so far: package builds (shellcheck), and the JSON-roundtrip remap path was proven with disko --dry-run against fennec's config. Not yet run end-to-end on real hardware — first real customer is the fennec install (#790).

🤖 Generated with Claude Code

https://claude.ai/code/session_015yzzxRtnuvnRhA1Jt7Xsie

Overhauls packages/installer.nix into the boot-a-stock-ISO, run-one-command flow: fzf host picker; disks come from the host's baked-in disko config (no more scheme-matching or hand-typed --args); confirm/remap each disk against the machine's real block devices; passphrase prompt only for encrypted layouts; typed-hostname confirmation; disko; optional pre-generated host-key provisioning from secrets/<host>-provision.yaml (so sops-nix decrypts on first boot); nixos-install. Validation so far: package builds (shellcheck), and the JSON-roundtrip remap path was proven with disko --dry-run against fennec's config. Not yet run end-to-end on real hardware — first real customer is the fennec install (#790). 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_015yzzxRtnuvnRhA1Jt7Xsie

lytedev added 1 commit

2026-07-19 00:27:55 -05:00

feat(installer): interactive one-command fleet installer

/ check-format (push) Successful in 32s

Details

/ build (push) Successful in 6m13s

Details

da044fc280

Overhaul packages/installer.nix into the boot-ISO one-command flow:

  sudo nix run --extra-experimental-features 'nix-command flakes' \
    git+https://git.lyte.dev/lytedev/nix#installer

- Pick the host with fzf; its disk layout comes from the disko config
  baked into the nixosConfiguration (diskConfig), killing the old
  'select a partition scheme that must match + hand-type --arg soup'.
- Shows the machine's real block devices and confirms each configured
  disk against them; a mismatched device name (sda vs nvme0n1) can be
  remapped for the run — the devices are evaled to JSON (internal
  _-prefixed/function options stripped; roundtrip verified with disko
  --dry-run) and rewritten with jq, repo config untouched.
- Encryption passphrase prompted only when the layout references
  /tmp/secret.key.
- Typed-hostname confirmation before disko destroys anything.
- If secrets/<host>-provision.yaml exists (pre-generated host identity,
  e.g. fennec's), offers to decrypt the ssh host key into /mnt/etc/ssh
  before nixos-install so sops-nix works on first boot.

Not yet exercised end-to-end on real hardware; the disko dry-run and
package build (shellcheck) are the current validation. First real
customer is the fennec install (PR #790).

lytedev added 1 commit

2026-07-19 00:51:53 -05:00

feat(installer): read the provisioning age key from a file

/ check-format (push) Successful in 11s

Details

/ build (push) Successful in 5m30s

Details

a8a4386bbf

Interactive paste of an AGE-SECRET-KEY is a pain from a live ISO (wifi ->
vaultwarden -> browser). Check for a key file first — /tmp/age.key by
default, INSTALLER_AGE_KEY_FILE to override — so the key can be scp'd in
from an existing host (passwd + systemctl start sshd on the ISO, then
scp ~/.config/sops/age/keys.txt nixos@<ip>:/tmp/age.key). Paste remains
the fallback.

lytedev merged commit 6be12138eb into main

2026-07-19 01:09:13 -05:00

lytedev deleted branch installer-overhaul

2026-07-19 01:09:13 -05:00

Rows
Columns

feat(installer): interactive one-command fleet installer #793