nix-files/doc/adding-a-host.md

to add a host:

• create the new nix targets
  • hosts/by-name/HOST
  • let the toplevel (impure.nix) know about HOST
  • let the other hosts know about this host (hosts/common/hosts.nix)
  • let sops know about the host's pubkey (.sops.yaml)
    • re-encrypt all sops keys in secrets/common
• build and flash an image
• optionally expand the rootfs
  • cfdisk /dev/sda2 -> resize partition
  • mount /dev/sda2 boot
  • btrfs filesystem resize max root
• setup required persistent directories
  • mkdir -p root/persist/private
  • gocryptfs -init root/persist/private
  • then boot the device, and for every dangling symlink in ~/.local/share, ~/.cache, do mkdir -p on it
• setup host ssh
  • mkdir -p root/persist/plaintext/etc/ssh/host_keys
  • boot the machine and let it create its own ssh keys
  • add the pubkey to hosts/common/hosts.nix
• setup user ssh
  • ssh-keygen. don't enter any password; it's stored in a password-encrypted fs.
  • add the pubkey to hosts/common/hosts.nix
• allow the new host to view secrets
  • instructions in hosts/common/secrets.nix
  • run ssh-to-age on user/host pubkeys
  • add age key to .sops.yaml
  • update encrypted secrets: find secrets -type f -exec sops updatekeys -y '{}' ';'
• setup wireguard keys
  • pk=$(wg genkey)
  • echo "$pk" | sops encrypt --filename-override secrets/$(hostname)/wg-home.priv.bin --output secrets/$(hostname)/wg-home.priv.bin
  • pub=$(echo "$pk" | wg pubkey)
  • add pubkey to hosts/common/hosts.nix