Normal Operations

All commands are prefixed by the hostname, allowing to handle multiple hosts. Here we assume the hostname is myskarabox.

Decrypt root pool after boot

$ nix run .#myskarabox-unlock

The connection will then disconnect automatically with no message. This is normal behavior.

SSH in

$ nix run .#myskarabox-ssh

Reboot

$ nix run .#myskarabox-ssh sudo reboot

You will then be required to decrypt the hard drives upon reboot as explained above.

Deploy an Update

Modify the ./configuration.nix file then run one of the following snippets:

To deploy with deploy-rs, first import the flake module skarabox.flakeModules.deploy-rs as shown in the template flake.nix then:

$ nix run .#deploy-rs

To deploy with colmena, first import the flake module skarabox.flakeModules.colmena as shown in the template flake.nix then:

$ nix run .#colmena apply

Specific options for deploy-rs or colmena can be added by appending a double dash followed by the arguments, like so:

$ nix run .#colmena apply -- --on myskarabox

Update dependencies

$ nix flake update
$ nix run .#deploy-rs

To pin Skarabox to the latest release, edit the flake.nix and replace ?ref=<oldversion> with ?ref=1.7.0, then run:

$ nix flake update skarabox

Edit secrets

$ nix run .#sops ./myskarabox/secrets.yaml

Add other hosts

$ nix run .#gen-new-host otherhost.

and copy needed config in flake.nix.

Rotate host key

$ ssh-keygen -f ./myskarabox/host_key
$ nix run .#add-sops-cfg -- -o .sops.yaml alias myskarabox $(ssh-to-age -i ./myskarabox/host_key.pub)
$ nix run .#deploy-rs
$ nix run .#baryum-gen-knownhosts-file