Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

quickstart fixes #236

Merged
merged 5 commits into from
Oct 20, 2023
Merged

quickstart fixes #236

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
a8071ab
quickstart: fix indentation, explicitly mention
phaer Oct 19, 2023
e9fe1a6
nix fmt
phaer Oct 19, 2023
560b6ba
quickstart: fix link to ssh key example
phaer Oct 19, 2023
9406168
quickstart: mention the need to copy generated...
phaer Oct 19, 2023
b61ca55
don't recommend starting from an empty flake...
phaer Oct 20, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions docs/howtos/use-without-flakes.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,10 @@

While `nixos-anywhere` is designed to work optimally with Nix Flakes, it also
supports the traditional approach without flakes. This document outlines how to
use `nixos-anywhere` without relying on flakes.
You will need to [import the disko nixos module](https://github.com/nix-community/disko/blob/master/docs/HowTo.md#installing-nixos-module) in your NixOS configuration
and define disko devices as described in the [examples](https://github.com/nix-community/disko/tree/master/example).
use `nixos-anywhere` without relying on flakes. You will need to
[import the disko nixos module](https://github.com/nix-community/disko/blob/master/docs/HowTo.md#installing-nixos-module)
in your NixOS configuration and define disko devices as described in the
[examples](https://github.com/nix-community/disko/tree/master/example).

## Generate Required Store Paths

Expand Down
237 changes: 117 additions & 120 deletions docs/quickstart.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,8 @@ You will need:
performed
- A disk configuration containing details of the file system that will be
created on the new server.
- A target machine, reachable via SSH, with your SSH public key deployed and and
the privilege to either login directly as root or to use password-less sudo.

**nixos-anywhere** doesn’t need to be installed. You can run it directly from
[Numtide's repository on Github.](https://github.com/numtide/nixos-anywhere)
Expand All @@ -30,33 +32,24 @@ below.

## Steps required to run nixos-anywhere

1. **Enable Flakes and Create a Directory**:
1. **Enable Flakes**:

- Ensure that flakes are enabled on your system. To enable flakes, refer to
the [NixOS Wiki](https://nixos.wiki/wiki/Flakes#enable-flakes).
- Create a directory to store the flake and configuration files.
Ensure that flakes are enabled on your system. To enable flakes, refer to the
[NixOS Wiki](https://nixos.wiki/wiki/Flakes#enable-flakes).

2. **Initialize a Flake**: Within the newly-created directory, execute the
command:
2. **Initialize a Flake**:

```bash
nix flake init
```

This command will generate a `flake.nix` file. Modify this file according to
your requirements.

- **For a Minimal Setup**:\
You can copy and paste the example flake contents available
[here](https://github.com/numtide/nixos-anywhere-examples/blob/main/flake.nix).
This example is tailored for a virtual machine setup similar to one on
[Hetzner Cloud](https://www.hetzner.com/cloud).
The easiest way to start is to copy our
[example flake.nix](https://github.com/numtide/nixos-anywhere-examples/blob/main/flake.nix)
into a new directory. This example is tailored for a virtual machine setup
similar to one on [Hetzner Cloud](https://www.hetzner.com/cloud), so you
might need to adapt it for your setup.

**Hardware-Specific Configuration**: If you're not using a virtual machine,
you'll need to generate a custom hardware configuration with
`nixos-generate-config`.
**Hardware-Specific Configuration**: If you're not using a virtual machine,
you'll need to generate a custom hardware configuration with
`nixos-generate-config`.

- **Getting `nixos-generate-config` on Target Machine**:
- **Get `nixos-generate-config` onto the Target Machine**:

1. **Option 1**: If NixOS is not installed, boot into an installer without
first installing NixOS.
Expand All @@ -70,11 +63,12 @@ below.
```

This creates the necessary configuration files under `/mnt/etc/nixos/`, which
you can then customize as needed.
you can then customize as needed and copy them to your local machine in order
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, you kind of mentioning this here. I missed that sentence on my phone.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, just saw that I somehow posted a butchered response from my phone, hope that wasn't confusing

to include them in your flake.

3. **Find SSH Key Line**:\
if you cloned
[our nixos-anywhere-example](https://github.com/numtide/nixos-anywhere-examples/blob/main/flake.nix)
[our nixos-anywhere-example](https://github.com/numtide/nixos-anywhere-examples/blob/main/configuration.nix)
you will also replace the SSH key like this: In your configuration, locate
the line that reads:

Expand All @@ -101,32 +95,33 @@ below.

5. Run the following command to create the `flake.lock` file:

```
nix flake lock
```
```
nix flake lock
```

Optionally, you can commit these files to a repo such as Github, or you can
simply reference your local directory when you run **nixos-anywhere**. This
example uses a local directory on the source machine.
Optionally, you can commit these files to a repo such as Github, or you can
simply reference your local directory when you run **nixos-anywhere**. This
example uses a local directory on the source machine.

6. On the target machine, make sure you have access as root via ssh by adding
your SSH key to the file `authorized_keys` in the directory `/root/.ssh`

7. (Optional) Test your nixos and disko configuration:

The following command will automatically test your nixos configuration and run
disko inside a virtual machine, where
The following command will automatically test your nixos configuration and
run disko inside a virtual machine, where

- `<path to configuration>` is the path to the directory or repository
containing `flake.nix` and `disk-config.nix`
- `<path to configuration>` is the path to the directory or repository
containing `flake.nix` and `disk-config.nix`

- `<configuration name>` must match the name that immediately follows the text
`nixosConfigurations.` in the flake, as indicated by the comment in the
[example](https://github.com/numtide/nixos-anywhere-examples/blob/main/flake.nix)).
- `<configuration name>` must match the name that immediately follows the
text `nixosConfigurations.` in the flake, as indicated by the comment in
the
[example](https://github.com/numtide/nixos-anywhere-examples/blob/main/flake.nix)).

```
nix run github:numtide/nixos-anywhere -- --flake <path to configuration>#<configuration name> --vm-test
```
```
nix run github:numtide/nixos-anywhere -- --flake <path to configuration>#<configuration name> --vm-test
```

8. You can now run **nixos-anywhere** from the command line as shown below,
where:
Expand All @@ -141,83 +136,85 @@ nix run github:numtide/nixos-anywhere -- --flake <path to configuration>#<config

- `<ip address>` is the IP address of the target machine.

```
nix run github:numtide/nixos-anywhere -- --flake <path to configuration>#<configuration name> root@<ip address>
```

The command would look  like this if you had created your files in a directory
named `/home/mydir/test` and the IP address of your target machine is
`37.27.18.135`:

```
nix run github:numtide/nixos-anywhere -- --flake /home/mydir/test#hetzner-cloud [email protected]
```

**nixos-anywhere** will then run, showing various output messages at each stage.
It may take some time to complete, depending on Internet speeds. It should
finish by showing the messages below before returning to the command prompt.

```
Installation finished. No error reported.
Warning: Permanently added '<ip-address>' (ED25519) to the list of known hosts
```

When this happens, the target server will have been overwritten with a new
installation of NixOS. Note that the server's public SSH key will have changed.

If you have previously accessed this server using SSH, you may see the following
message the next time you try to log in to the target.

```
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ED25519 key sent by the remote host is
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.
Please contact your system administrator.
Add correct host key in ~/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in ~/.ssh/known_hosts:6
remove with:
ssh-keygen -f ~/.ssh/known_hosts" -R "<ip addrress>"
Host key for <ip_address> has changed and you have requested strict checking.
Host key verification failed.
```

This is because the `known_hosts` file in the `.ssh` directory now contains a
mismatch, since the server has been overwritten. To solve this, use a text
editor to remove the old entry from the `known_hosts` file. The next connection
attempt will then treat this as a new server.

The error message line `Offending ECDSA key in ~/.ssh/known_hosts:` gives the
line number that needs to be removed from the `known_hosts` file.

The new server's configurations are defined in the flake. `nixos-anywhere` does
not create `etc/nixos/configuration.nix`, since it expects the server to be
administered remotely. Any future changes to the configuration should be made to
the flake, and you would reference this flake when doing the nixos-rebuild
command or a deployment tool of your choice i.e.
[colmena](https://github.com/zhaofengli/colmena),
[nixinate](https://github.com/MatthewCroughan/nixinate).

This example can be run from the machine itself for updating (replace
`<URL to your flake>` with your flake i.e. `.#` if your flake is in the current
directory):

```
nixos-rebuild switch --flake <URL to your flake>
```

You can also run `nixos-rebuild` to update a machine remotly, if you have set up
an openssh server and your ssh key for the root user:

```
nixos-rebuild switch --flake <URL to your flake> --target-host "root@<ip address>"
```

For more information on different use cases of **nixos-anywhere** please refer
to the [How to Guide](./howtos/INDEX.md), and for more technical information and
explanation of known error messages, refer to the
[Reference Manual](./reference.md).
```
nix run github:numtide/nixos-anywhere -- --flake <path to configuration>#<configuration name> root@<ip address>
```

The command would look  like this if you had created your files in a
directory named `/home/mydir/test` and the IP address of your target
machine is `37.27.18.135`:

```
nix run github:numtide/nixos-anywhere -- --flake /home/mydir/test#hetzner-cloud [email protected]
```

**nixos-anywhere** will then run, showing various output messages at each
stage. It may take some time to complete, depending on Internet speeds. It
should finish by showing the messages below before returning to the command
prompt.

```
Installation finished. No error reported.
Warning: Permanently added '<ip-address>' (ED25519) to the list of known hosts
```

When this happens, the target server will have been overwritten with a new
installation of NixOS. Note that the server's public SSH key will have
changed.

If you have previously accessed this server using SSH, you may see the
following message the next time you try to log in to the target.

```
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ED25519 key sent by the remote host is
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.
Please contact your system administrator.
Add correct host key in ~/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in ~/.ssh/known_hosts:6
remove with:
ssh-keygen -f ~/.ssh/known_hosts" -R "<ip addrress>"
Host key for <ip_address> has changed and you have requested strict checking.
Host key verification failed.
```

This is because the `known_hosts` file in the `.ssh` directory now contains
a mismatch, since the server has been overwritten. To solve this, use a
text editor to remove the old entry from the `known_hosts` file. The next
connection attempt will then treat this as a new server.

The error message line `Offending ECDSA key in ~/.ssh/known_hosts:` gives
the line number that needs to be removed from the `known_hosts` file.

The new server's configurations are defined in the flake. `nixos-anywhere`
does not create `etc/nixos/configuration.nix`, since it expects the server
to be administered remotely. Any future changes to the configuration should
be made to the flake, and you would reference this flake when doing the
nixos-rebuild command or a deployment tool of your choice i.e.
[colmena](https://github.com/zhaofengli/colmena),
[nixinate](https://github.com/MatthewCroughan/nixinate).

This example can be run from the machine itself for updating (replace
`<URL to your flake>` with your flake i.e. `.#` if your flake is in the
current directory):

```
nixos-rebuild switch --flake <URL to your flake>
```

You can also run `nixos-rebuild` to update a machine remotly, if you have
set up an openssh server and your ssh key for the root user:

```
nixos-rebuild switch --flake <URL to your flake> --target-host "root@<ip address>"
```

For more information on different use cases of **nixos-anywhere** please
refer to the [How to Guide](./howtos/INDEX.md), and for more technical
information and explanation of known error messages, refer to the
[Reference Manual](./reference.md).