steveej's infra

This repository helps me to manage all computer infrastructure. This is mostly achieved with the help of Nix.

In the unlikely case that you actually read this and have any questions please don't hesitate to reach out.

Initial Roadmap

• All graphical systems (incl. install media) must have
  • Full-disk encryption by default
  • Yubikey support with SSH auth
• Migrate all devices to new structure
  • Encrypted Install media
  • steveej-laptop
  • steveej-laptop-work
• Migrate home environment to new structure
  • home-manager
  • pkgs-configuration
  • development environments
• (Semi-) automatic synchronization of important repositories
  • Modification strategy The approach is to use vcsh for the dotfiles
  • dotfiles
• Toplevel Justfile for simple actions
  • mount/umount disks
  • install to mounted disk
  • rebuild running system
  • update running system
  • annotate recipes with some documentation
  • declare shell.nix with runtime deps
  • partition/encrypt/format disks
• Document bootstrap process
  • apt install sudo cryptsetup as a requirements on a deb admin machine
  • a new machine
  • an install media
• Design disaster recovery
• Automatic synchronization of other state files - see https://gitlab.com/steveeJ/nix-expressions/issues/2
• Recycle _archived
• Maybe make this a nix-overlay
• container migrations
  • ensure DDNS is updated before the containers are started

Bugs

• home-manager leaves ~/.gnupg at 0755

Usage

(These are reminders for my future self)

just --list

Bootstrap

A new machine

• ensure the dotfiles repo has a branch with the new machine's hostname

• boot with an install media and go through setup

Post-Install Setup

• chmod --recursive g-rwx,o-rwx ~/.gnupg
• gpg2 --edit-card; fetch
• clone password-manager and infra repositories
• gpg2: ultimately trust my own key

Swapping out a disk

1. offline-bitwise copy of drive
2. disconnect remove the previous drive
3. replace the driveId in the device's hw.nix
4. run the just disk-relabel nix/os/devices/<deviceName> <prevDiskId> command to rename the filesystem and volume group

Backup

Copy existing subvolumes to new backup target

`systemctl cat bkp-run | grep ExecStart | awk -F '=' '{print $2}'` --verbose --progress archive /var/lib/container-volumes ssh://[IP]:[PORT]/mnt/backup/container-volumes/