# extremist software

nixos config for the hetzner vps.

services:
- forgejo (git.extremist.software)
- stalwart (mail.extremist.software)
- searxng (search.extremist.software)
- conduit (matrix.extremist.software)
- caddy (reverse proxy)
- grafana/prometheus (status.extremist.software)

## Deployment

This repository uses **untracked secrets**, so you must build the system locally before deploying.

### 1. Setup Secrets
1.  `cp secrets/secrets.nix.example secrets/secrets.nix`
2.  Fill in the values (generate random keys, etc).
    - `tailscaleKey` must be a **Reusable** key from the Tailscale admin console.

### 2. Initial Install (Wite & Install)
Run this command to build and deploy. **Warning: Wipes the server disk.**

```bash
# Replace <TARGET_IP> with your server's IP
nix run github:nix-community/nixos-anywhere -- --store-paths \
  $(nix build path:.#nixosConfigurations.extremist-software.config.system.build.diskoScript --impure --print-out-paths --no-link) \
  $(nix build path:.#nixosConfigurations.extremist-software.config.system.build.toplevel --impure --print-out-paths --no-link) \
  root@<TARGET_IP> | tee install.log
```

### 3. Update Existing Server (No Wipe)
Once the server is running NixOS, use `nixos-rebuild` to push updates. This is faster and doesn't wipe data.

```bash
# Update via IP
nixos-rebuild switch --flake path:.#extremist-software --target-host root@<TARGET_IP> --impure

# Update via Tailscale (Once tailored up)
nixos-rebuild switch --flake path:.#extremist-software --target-host root@extremist-software --impure
```

repo uses `impure` build to load `secrets/secrets.nix` directly. no encrypted secrets in git.