diff options
| -rw-r--r-- | README.md | 30 |
1 files changed, 27 insertions, 3 deletions
@@ -170,13 +170,21 @@ The file is now safe to commit. To edit it later: `sops secrets/secrets.yaml` ### 4. Install NixOS with nixos-anywhere +If deploying from a non-x86_64-linux machine (e.g. an Apple Silicon Mac), add +`--build-on remote` so the server builds its own closure rather than your local +machine attempting a cross-architecture build: + ```bash # From your local machine (requires nix with flakes enabled) nix run github:nix-community/nixos-anywhere -- \ --flake .#eurovm \ + --build-on remote \ root@<server-ipv4> ``` +> **Note:** if you chose a CAX11 (ARM64) server instead of a CX23 (x86_64), change +> `system = "x86_64-linux"` to `system = "aarch64-linux"` in `flake.nix` first. + nixos-anywhere will: 1. Copy the flake to the server 2. Run disko to partition the disk @@ -205,7 +213,10 @@ sops updatekeys secrets/secrets.yaml Commit and push, then redeploy: ```bash -nixos-rebuild switch --flake .#eurovm --target-host admin@<server-ipv4> --use-remote-sudo +nixos-rebuild switch --flake .#eurovm \ + --target-host admin@<server-ipv4> \ + --build-host admin@<server-ipv4> \ + --use-remote-sudo ``` --- @@ -213,10 +224,19 @@ nixos-rebuild switch --flake .#eurovm --target-host admin@<server-ipv4> --use-re ## Day-to-Day Operations ### Deploy updates + +If deploying from a non-x86_64-linux machine (e.g. an Apple Silicon Mac), pass +`--build-host` so the server compiles its own closure instead of the local machine: + ```bash -nixos-rebuild switch --flake .#eurovm --target-host admin@<server-ipv4> --use-remote-sudo +nixos-rebuild switch --flake .#eurovm \ + --target-host admin@<server-ipv4> \ + --build-host admin@<server-ipv4> \ + --use-remote-sudo ``` +If your local machine is also x86_64-linux you can omit `--build-host`. + ### Edit secrets ```bash sops secrets/secrets.yaml @@ -372,6 +392,7 @@ Make sure you have Nix with flakes enabled locally, then: ```bash nix run github:nix-community/nixos-anywhere -- \ --flake .#eurovm \ + --build-on remote \ root@<server-ipv4> ``` @@ -395,7 +416,10 @@ sops updatekeys secrets/secrets.yaml Push the updated `.sops.yaml` and re-encrypted `secrets/secrets.yaml`, then run: ```bash -nixos-rebuild switch --flake .#eurovm --target-host admin@<server-ipv4> --use-remote-sudo +nixos-rebuild switch --flake .#eurovm \ + --target-host admin@<server-ipv4> \ + --build-host admin@<server-ipv4> \ + --use-remote-sudo ``` ### Step 8 - First login to each service |