Homelab infrastructure

Welcome to my homelab infrastructure repository. The code within is in constant flux and some of it is only partially deployed. You're welcome to use it, but while this works for me, it may not work for you. Here be dragons! LLAP 🖖

Hardware

Hostname	Description	CPU	GPU	RAM	OS
rocinante	Topton N5105	Intel N100	None	16	NixOS
defiant	Framework 13	AMD Ryzen 7 7840U	Radeon 7080M	32	NixOS
enterprise	B760M DS3H	Intel i5-13500	Intel ARC A380	64	Proxmox
serenity	Virtual Machine	Virtual	Intel ARC A380 (passthrough)	16	NixOS
nostromo	ThinkPad T495	Ryzen 7 Pro 3700U	Radeon Vega	16	NisOS
orville	Virtual Machine	Virtual	None	8	NixOS
galactica	HP Microserver Gen8	Intel Xeon E3-1265L	None	16	NixOS
citadel	Hetzner VPS	AMD something	None	8	NixOS

NixOS Quickstart

# Clone the repo
git clone git@gitlab.com:craigw/nix-infra.git
cd nix-infra

# Format the disk with Disko
sudo nix --experimental-features "nix-command flakes" run github:nix-community/disko/latest /
 -- --mode destroy,format,mount --flake .#<host>

# Generate a hardware configuration
sudo nixos-generate-config --no-filesystems --root /mnt
cp /mnt/etc/nixos/hardware-configuration.nix hosts/<host>/hardware.nix
git add .

# Install NixOS from the flake
sudo nixos-install --flake .#<host>

# Set the users password
cd /mnt
sudo nixos-enter
passwd <user>
exit

# Copy the flake to the users home directory
mv /home/nixos/nix-infra /mnt/home/<user>

NixOS router configuration

Some of the devices in this flake are configured with NixOS Utils which will rollback changes that have not been marked as good. In practice this means if you apply a configuration and don't mark it as good, the device will reboot back to the last known good configuration within 5 minutes. This is very handy when you've applied some random crap from an LLM, and messed up your system yet again (stop doing that!).

list-generations # List generations include "good", "current", and "booted"
sudo nixos-confirm  # Set this generation as "good" and prevent auto-rollback

Keep it secret, keep it safe

Secrets are kept in this repo using sops-nix. Here is how to generate keys and where to put them:

1. Generate a user key for reading, writing and updating the encrypted secrets file.

# Private key
mkdir -p ~/.config/sops/age
age-keygen -o ~/.config/sops/age/keys.txt

# Show public key
age-keygen -y ~/.config/sops/age/keys.txt

2. Generate a host key for reading the secrets file.

# Private key
sudo mkdir -p /var/lib/private/sops/age
sudo age-keygen -o /var/lib/private/sops/age/keys.txt

# Show public keyg
sudo age-keygen -y /var/lib/private/sops/age/keys.txt

3. Create or update the encrypted secrets file.

# Create a new file
sops secrets/secrets.yaml

# Update an existing file
sops updatekeys secrets/secrets.yaml

Deploy Age keys

Sometimes I need to re-deploy my age keys because I re-installed a machine. I keep a backup of the keys in an encrypted vault so they can be re-deployed. These commands remind me what I need to do to get sops-nix working again!

# Deploy user key
mkdir -p ~/.config/sops/age
cp keys ~/.config/sops/age
chown craig:users ~/.config/sops/age/keys.txt
chmod 644 ~/.config/sops/age/keys.txt

# Deploy host key
sudo mkdir -p /var/lib/private/sops/age
sudo cp keys.txt /var/lib/private/sops/age
sudo chown root:root /var/lib/private/sops/age/keys.txt
sudo chmod 600 /var/lib/private/sops/age/keys.txt

Things to do after a new install

• Deploy age host key (/var/lib/private/sops/age/keys.txt)
• Deploy age user key (~/.config/sops/age/keys.txt)

Install NixOS on a VPS with nixos-anywhere

1. Spin up a new VPS and copy the IP address
2. Ensure the NixOS configuration has flakes enabled
3. Make sure your SSH key is defined along with the root user
4. Ensure virtio kernel modules are available if you want it to boot

nix run github:nix-community/nixos-anywhere -- --flake .#hetzner root@YOUR_NEW_SERVER_IP

Commands I keep forgetting

1. Generate a network host ID.

# New Host
head -c 4 /dev/urandom | od -A none -t x4

# Existing host
head -c 8 /etc/machine-id