44 lines
1.6 KiB
Markdown
44 lines
1.6 KiB
Markdown
# extremist software
|
|
|
|
nixos config for the hetzner vps.
|
|
|
|
services:
|
|
- forgejo (git.extremist.software)
|
|
- stalwart (mail.extremist.software)
|
|
- searxng (search.extremist.software)
|
|
- conduit (matrix.extremist.software)
|
|
- caddy (reverse proxy)
|
|
- grafana/prometheus (status.extremist.software)
|
|
|
|
## Deployment
|
|
|
|
This repository uses **untracked secrets**, so you must build the system locally before deploying.
|
|
|
|
### 1. Setup Secrets
|
|
1. `cp secrets/secrets.nix.example secrets/secrets.nix`
|
|
2. Fill in the values (generate random keys, etc).
|
|
- `tailscaleKey` must be a **Reusable** key from the Tailscale admin console.
|
|
|
|
### 2. Initial Install (Wite & Install)
|
|
Run this command to build and deploy. **Warning: Wipes the server disk.**
|
|
|
|
```bash
|
|
# Replace <TARGET_IP> with your server's IP
|
|
nix run github:nix-community/nixos-anywhere -- --store-paths \
|
|
$(nix build path:.#nixosConfigurations.extremist-software.config.system.build.diskoScript --impure --print-out-paths --no-link) \
|
|
$(nix build path:.#nixosConfigurations.extremist-software.config.system.build.toplevel --impure --print-out-paths --no-link) \
|
|
root@<TARGET_IP> | tee install.log
|
|
```
|
|
|
|
### 3. Update Existing Server (No Wipe)
|
|
Once the server is running NixOS, use `nixos-rebuild` to push updates. This is faster and doesn't wipe data.
|
|
|
|
```bash
|
|
# Update via IP
|
|
nixos-rebuild switch --flake path:.#extremist-software --target-host root@<TARGET_IP> --impure
|
|
|
|
# Update via Tailscale (Once tailored up)
|
|
nixos-rebuild switch --flake path:.#extremist-software --target-host root@extremist-software --impure
|
|
```
|
|
|
|
repo uses `impure` build to load `secrets/secrets.nix` directly. no encrypted secrets in git.
|