From 7a1d66bd7492e948b9182e8f4f564c4cb149eacb Mon Sep 17 00:00:00 2001
From: Karan Jayachandra <karan.jayachandra@nxp.com>
Date: Fri, 17 Jul 2026 14:49:31 +0200
Subject: Added the changes README

---
 README.md | 59 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 57 insertions(+), 2 deletions(-)

(limited to 'README.md')

diff --git a/README.md b/README.md
index 420356c..cd50582 100644
--- a/README.md
+++ b/README.md
@@ -38,6 +38,61 @@ modules/
 
 ---
 
+## Prerequisites (Local Machine)
+
+Before running any deploy commands you need the following installed on your laptop.
+
+### 1. Nix (with flakes enabled)
+
+Nix must be installed locally. It is used to evaluate the flake, run `nixos-anywhere`,
+and build the system closure. It is **not** needed on the Hetzner VM in advance -
+`nixos-anywhere` takes care of installing NixOS there.
+
+The easiest installer (enables flakes automatically):
+```bash
+curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | sh -s -- install
+```
+
+Or use the official installer and then add this to `/etc/nix/nix.conf`:
+```
+experimental-features = nix-command flakes
+```
+
+Verify:
+```bash
+nix --version
+nix run nixpkgs#hello
+```
+
+### 2. sops + ssh-to-age + age
+
+These are needed to set up encrypted secrets before the first deploy.
+With Nix installed, you can run them directly without a permanent install:
+```bash
+nix shell nixpkgs#sops nixpkgs#ssh-to-age nixpkgs#age
+```
+
+Or install them permanently:
+```bash
+nix profile install nixpkgs#sops nixpkgs#ssh-to-age nixpkgs#age
+```
+
+### 3. apache2-utils (for AdGuard bcrypt hash)
+
+Needed to generate the AdGuard admin password hash:
+```bash
+# macOS
+brew install httpd
+
+# Linux (Debian/Ubuntu)
+sudo apt install apache2-utils
+
+# Or via Nix
+nix shell nixpkgs#apacheHttpd
+```
+
+---
+
 ## Bootstrap: First Deploy
 
 ### 1. Create the Hetzner Cloud VM
@@ -292,8 +347,8 @@ Commit both `.sops.yaml` and the encrypted `secrets/secrets.yaml`.
 1. Go to https://console.hetzner.cloud and create a new project (or use an existing one)
 2. Add both your SSH public keys to the project under **Security -> SSH Keys**
 3. Create a server with the following spec:
-   - **Minimum:** CAX11 (2 ARM vCPU / 4 GB RAM / 40 GB disk, ~3.79 EUR/month) - all services work fine on ARM64
-   - **Alternative:** CX22 (2 x86 vCPU / 4 GB RAM / 40 GB disk, ~4.35 EUR/month) - use if you need x86 compatibility later
+   - **Recommended:** CX23 (2 x86 vCPU / 4 GB RAM / 80 GB disk, Cost Optimized line) - good value, x86-64, all services supported
+   - **Cheaper ARM option:** CAX11 (2 ARM vCPU / 4 GB RAM / 40 GB disk) - all services work fine on ARM64
    - Location: **Nuremberg** or **Falkenstein**
    - Image: **Debian 12** (nixos-anywhere replaces it)
 4. Note the **public IPv4 address**
-- 
cgit v1.3.1