From 39f172101a6642df1793f31774491efa6c53cdf7 Mon Sep 17 00:00:00 2001 From: Aly Raffauf Date: Mon, 5 Aug 2024 16:51:19 -0400 Subject: [PATCH] hosts: update README.md --- hosts/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hosts/README.md b/hosts/README.md index 49197156..9378ab10 100644 --- a/hosts/README.md +++ b/hosts/README.md @@ -39,7 +39,7 @@ In short, 1. Add host to `nixosConfigurations` in `flake.nix`. 1. (OPTIONAL) Generate a `cert.pem`, `key.pem`, and device ID for Syncthing with `syncthing -generate=$HOSTNAME`. Find the device ID in the generated `config.xml` and add it to `nixosModules/services/syncthing/default.nix`, encrypt the cert and key with agenix, and set them as appropriate in the host configuration. 1. Install NixOS from this flake. Secrets will _not_ be available on first boot without a valid SSH private key. -1. Copy the new system's public SSH key (`/etc/ssh/ssh_host_ed25519_key.pub`) to the host configuration (`secrets/publicKeys/root_$HOSTNAME.pub`). -1. Add the new public key to `secrets/secrets.nix` and rekey all secrets with `agenix --rekey`. +1. On a separate PC, copy the new system's public SSH key (`/etc/ssh/ssh_host_ed25519_key.pub`) to the host configuration (`secrets/publicKeys/root_$HOSTNAME.pub`). +1. Add the new public key to `secrets/secrets.nix`, rekey all secrets with `agenix --rekey`, and push your changes to master. 1. Rebuild the new system from git. Secrets will be automatically decrypted and immediately available in `/run/agenix/` for NixOS and `$XDG_RUNTIME_DIR/agenix/` for users. 1. (OPTIONAL) Generate a new user SSH key and add it to `nixosModules/users/default.nix` in order to enable passwordless logins to other hosts.