From 7f122aab0536060606f6643dfe92b4a7fc1ec33c Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Tue, 10 Feb 2026 17:06:59 +0100 Subject: [PATCH 1/7] Update the config, start writing documentation. --- documentation_titlepage.md | 108 ++++++++++++++++++ .../system/blank_system_USE_THIS_AS_COPY.nix | 49 ++++++++ .../modules/system/teamspeak.nix | 4 + 3 files changed, 161 insertions(+) create mode 100644 documentation_titlepage.md create mode 100644 nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix diff --git a/documentation_titlepage.md b/documentation_titlepage.md new file mode 100644 index 0000000..4025e9b --- /dev/null +++ b/documentation_titlepage.md @@ -0,0 +1,108 @@ +# Welcome to the Polyteknisk Radiogruppe's Server Documentation + +The following the documentation showcases how the server is built up and how one should manage this in both long and short terms. +Also, thusly, this document should be actively maintained in the functional changes no matter how small or large, as in +if a flag is changed in the compiliation of the system build, password key changes, new added standard package, then it must +be documented here. + +## Documentation File Structure + +As this document is in alpha release, the following package has been made with the standard Rust project template in the case +of having to create custom binaries for the system of the sysadmin or any related responsibilites/positions. Thusly, +the following document focus should be in the `nix-system-configs` folder, which +is the main folder for the system configuration files and scripts. + +>[note!] For the documentation maintainer, be sure to update this tree with the `lsd` package with running the `lsd --tree` of the project directory. Please do take care to not have some secrets exposed here in your own home system if so be it. +```bash + . +├──  Cargo.lock +├──  Cargo.toml +├──  LICENSE +├──  maintence_cheatsheet.md +├──  nix-system-configs +│ ├──  build +│ │ └──  configuration.nix +│ ├──  database-deprecated +│ │ └──  configuration.nix +│ ├──  dns +│ │ ├──  configuration-knot.nix +│ │ ├──  configuration-pihole-green.nix +│ │ ├──  configuration-pihole-inside-system.nix +│ │ └──  configuration-pihole-orange.nix +│ ├──  example-composed.nix +│ ├──  forgejo-deprecated +│ │ ├──  forgejo-localconfig.nix +│ │ ├──  pull.zsh +│ │ └──  push.zsh +│ ├──  gateway +│ │ └──  gateway.nix +│ ├──  modules +│ │ ├──  bootloader +│ │ │ ├──  seabios-assigned-iso-at-birth.nix +│ │ │ └──  seabios-assigned-proxmox-at-birth.nix +│ │ ├──  desktop-manager +│ │ │ ├──  gnome.nix +│ │ │ └──  sway_greetd_homemanager.nix +│ │ ├──  lix-default.nix +│ │ ├──  local +│ │ │ ├──  hostname_username.nix +│ │ │ └──  networking_local.nix +│ │ ├──  scripts +│ │ │ ├──  compose_two_nix.zsh +│ │ │ ├──  pull.zsh +│ │ │ └──  push.zsh +│ │ ├──  secrets-config +│ │ │ ├──  sops-composesongsheet.nix +│ │ │ └──  sops-database.nix +│ │ ├──  songsheet +│ │ │ └──  wavelog +│ │ │ ├──  docker-compose.nix +│ │ │ ├──  docker-compose.yml +│ │ │ └──  notes.md +│ │ ├──  system +│ │ │ ├──  compose-songsheet.nix +│ │ │ ├──  database.nix +│ │ │ ├──  forgejo.nix +│ │ │ ├──  teamspeak.nix +│ │ │ └──  traefik.nix +│ │ ├──  system_scripts +│ │ │ ├──  backup_strategem +│ │ │ │ └──  manual_database_restore.zsh +│ │ │ └──  gcloud_backup.nix +│ │ └──  toolsets +│ │ └──  remote_building.nix +│ ├──  old-server-notes.md +│ ├──  prg-blank-setup +│ │ ├──  blank-proxmox-partition.nix +│ │ └──  example.nix +│ ├──  secrets +│ │ ├──  database +│ │ │ ├──  gcloud_bucket.json +│ │ │ └──  secrets.yaml +│ │ ├──  songsheet +│ │ │ ├──  example.yaml +│ │ │ └──  secrets.yaml +│ │ └──  traefik +│ │ └──  test.yaml +│ └──  traefik-deprecated +│ ├──  pull.zsh +│ ├──  push.zsh +│ └──  traefik-config.nix +├──  README.md +└── 󱧼 src + └──  main.rs +``` + +As you can see it, the main system is separated up the the following `modules`, where all Nix configurations are thusly reused and +updated across different systems. As mentioned before, `system` is the start of the core configuration of the following linux systems running in Proxmox. +Looking at the `blank_system_USE_THIS_AS_COPY.nix`, you can see that the system is variables are declared dynamically in Nix-like variable declaration where +we create the local new options class and make this callable in the other functions in the imports. Speaking of imports, `imports = [ ... ] ` block shows +which modules which are then attached the core system, usually the bootloader is a must feature to the attached as the following system will not boot properly without it but different systems, depending how they were installed, need different configurations. +Then usually the networking module is also attached to have capabilities to use networking i.e. internet access, hostname, which DNS to use etc. `lix-default.nix` module imported is the +the assumed standard which tools each NixOS machine in the PRG network has, which is important for ensuring consistent existence of the tools used and maintanence within the machine outside of this documentation and machine buildings, as in enabling file transfers, package manager, SSH, password management, locales, timezones, upgrade system schedules. +Next piece that should be added is the desktop/window management which could help simplifing the interaction of the VMs in the Proxmox or other external systems that are depednent of this repository. + +As you can see that each aformentioned module in specific tasks are in their folders `local` for networking and users, `desktop-manager` for interaction, `bootloader` for... well.. bootloaders etc. Feel free to add more different modules for each system need or change. + + + diff --git a/nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix b/nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix new file mode 100644 index 0000000..6fa22ea --- /dev/null +++ b/nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix @@ -0,0 +1,49 @@ +{ + config, + pkgs, + lib, + ... +}: { + options.local = { + hostname = lib.mkOption { + type = lib.types.str; + default = "nixos-default"; + description = "System hostname"; + }; + username = lib.mkOption { + type = lib.types.str; + default = "user"; + description = "Primary user username"; + }; + userDescription = lib.mkOption { + type = lib.types.str; + default = "NixOS User"; + description = "Primary user description"; + }; + address = lib.mkOption { + type = lib.types.str; + default = "10.1.1.100"; + description = "Static IP address"; + }; + }; + + imports = [ + ./modules/desktop-manager/sway_greetd_homemanager.nix + ./modules/local/hostname_username.nix + ./modules/local/networking_local.nix + ./modules/bootloader/seabios-assigned-iso-at-birth.nix + ./modules/lix-default.nix + # Optionally to enable remote building: ./modules/toolsets/remote_building.nix + #./modules/songsheet/wavelog/docker-compose.nix + #./modules/secrets-config/sops-the-blank-system.nix + ]; + + config = { + local.hostname = "nixos-songsheet"; + local.username = "songsheetprg"; + local.userDescription = "NixOS PRG Portainer-Like Songsheet Service"; + local.address = "10.1.1.249"; + + system.stateVersion = "25.11"; + }; +} diff --git a/nix-system-configs/modules/system/teamspeak.nix b/nix-system-configs/modules/system/teamspeak.nix index 5b5ab6a..feb027f 100644 --- a/nix-system-configs/modules/system/teamspeak.nix +++ b/nix-system-configs/modules/system/teamspeak.nix @@ -68,6 +68,8 @@ address = "0.0.0.0"; database_backend = "rocksdb"; server_name = "lgbtq.prg-radio.org"; + allow_federation = true; + allow_check_for_updates = true; # See https://docs.conduit.rs/turn.html, and https://github.com/element-hq/synapse/blob/develop/docs/turn-howto.md for more details # turn_uris = [ @@ -82,11 +84,13 @@ 80 443 12244 + 8448 ]; networking.firewall.allowedUDPPorts = [ 80 443 12244 + 8448 ]; system.stateVersion = "25.11"; From 8da43a68e1c9080038d43c63838cf26bebcb80ba Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Tue, 10 Feb 2026 17:31:10 +0100 Subject: [PATCH 2/7] Add trusted servers to matrix configuration --- nix-system-configs/modules/system/teamspeak.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nix-system-configs/modules/system/teamspeak.nix b/nix-system-configs/modules/system/teamspeak.nix index feb027f..c687232 100644 --- a/nix-system-configs/modules/system/teamspeak.nix +++ b/nix-system-configs/modules/system/teamspeak.nix @@ -71,6 +71,8 @@ allow_federation = true; allow_check_for_updates = true; + trusted_servers = ["matrix.org" "lilyu.xyz"]; + # See https://docs.conduit.rs/turn.html, and https://github.com/element-hq/synapse/blob/develop/docs/turn-howto.md for more details # turn_uris = [ # "turn:your.turn.url?transport=udp" From 8c543be367807f3bfe6c5cd31bb1adbeeca7b343 Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Tue, 10 Feb 2026 17:41:29 +0100 Subject: [PATCH 3/7] Bind Traefik entry points to IPv6 addresses --- nix-system-configs/modules/system/traefik.nix | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/nix-system-configs/modules/system/traefik.nix b/nix-system-configs/modules/system/traefik.nix index ffe915e..f8718ef 100644 --- a/nix-system-configs/modules/system/traefik.nix +++ b/nix-system-configs/modules/system/traefik.nix @@ -48,7 +48,8 @@ staticConfigOptions = { entryPoints = { web = { - address = ":80"; + # Bind on IPv6 as well as IPv4 by using [::]:80 + address = "[::]:80"; asDefault = true; http.redirections.entrypoint = { to = "websecure"; @@ -56,7 +57,8 @@ }; }; websecure = { - address = ":443"; + # Bind on IPv6 as well as IPv4 by using [::]:443 + address = "[::]:443"; asDefault = true; http.tls = { domains = [ @@ -69,17 +71,19 @@ }; # Federation entrypoint: external TLS on 8448 federation = { - address = ":8448"; + # Bind on IPv6 as well as IPv4 by using [::]:8448 + address = "[::]:8448"; }; # TeamSpeak entry points teamspeak-voice = { - address = ":9987/udp"; + # UDP entrypoint bind to IPv6 as well + address = "[::]:9987/udp"; }; teamspeak-squery = { - address = ":10022/tcp"; + address = "[::]:10022/tcp"; }; teamspeak-data = { - address = ":30033/tcp"; + address = "[::]:30033/tcp"; }; }; log = { From 5feeff9d3edda00ccc65c57f1e5b5f7724b3416c Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Tue, 10 Feb 2026 18:20:39 +0100 Subject: [PATCH 4/7] Enable TLS passthrough for Matrix federation on ports 12244 and 443 --- nix-system-configs/modules/system/traefik.nix | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/nix-system-configs/modules/system/traefik.nix b/nix-system-configs/modules/system/traefik.nix index f8718ef..e58c7f7 100644 --- a/nix-system-configs/modules/system/traefik.nix +++ b/nix-system-configs/modules/system/traefik.nix @@ -170,6 +170,22 @@ rule = "HostSNI(`*`)"; service = "matrix-federation"; entryPoints = ["federation"]; + # Pass TLS through to the backend (Conduit handles TLS on port 12244) + tls = { + passthrough = true; + }; + }; + # Also accept TLS passthrough on port 443 for the Matrix host so + # other servers that contact :443/_matrix/* + # will be forwarded to Conduit as well. + matrix-tls443 = { + # match by SNI to avoid interfering with other HTTPS sites + rule = "HostSNI(`lgbtq.prg-radio.org`)"; + service = "matrix-federation"; + entryPoints = ["websecure"]; + tls = { + passthrough = true; + }; }; }; From a986fe18c48fb839f2ac44f844b161385f2c041d Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Tue, 10 Feb 2026 18:48:43 +0100 Subject: [PATCH 5/7] Remove redundant trusted server from Matrix configuration that might cause issues. --- nix-system-configs/modules/system/teamspeak.nix | 2 +- nix-system-configs/modules/system/traefik.nix | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/nix-system-configs/modules/system/teamspeak.nix b/nix-system-configs/modules/system/teamspeak.nix index c687232..7427647 100644 --- a/nix-system-configs/modules/system/teamspeak.nix +++ b/nix-system-configs/modules/system/teamspeak.nix @@ -71,7 +71,7 @@ allow_federation = true; allow_check_for_updates = true; - trusted_servers = ["matrix.org" "lilyu.xyz"]; + trusted_servers = ["matrix.org"]; # See https://docs.conduit.rs/turn.html, and https://github.com/element-hq/synapse/blob/develop/docs/turn-howto.md for more details # turn_uris = [ diff --git a/nix-system-configs/modules/system/traefik.nix b/nix-system-configs/modules/system/traefik.nix index e58c7f7..3613882 100644 --- a/nix-system-configs/modules/system/traefik.nix +++ b/nix-system-configs/modules/system/traefik.nix @@ -178,6 +178,7 @@ # Also accept TLS passthrough on port 443 for the Matrix host so # other servers that contact :443/_matrix/* # will be forwarded to Conduit as well. + # I guess I had to declare the rule explicitly here again? matrix-tls443 = { # match by SNI to avoid interfering with other HTTPS sites rule = "HostSNI(`lgbtq.prg-radio.org`)"; From aec8fc397bab488628507d23c507ddac30fe7048 Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Tue, 10 Feb 2026 21:46:58 +0100 Subject: [PATCH 6/7] Enhance documentation for server management and module architecture. --- README.md | 2 + documentation_titlepage.md | 183 +++++++++++++----- maintence_cheatsheet.md | 4 - .../modules/scripts/compose_two_nix.zsh | 0 nix-system-configs/modules/scripts/pull.zsh | 0 nix-system-configs/modules/scripts/push.zsh | 0 6 files changed, 139 insertions(+), 50 deletions(-) delete mode 100644 maintence_cheatsheet.md mode change 100644 => 100755 nix-system-configs/modules/scripts/compose_two_nix.zsh mode change 100644 => 100755 nix-system-configs/modules/scripts/pull.zsh mode change 100644 => 100755 nix-system-configs/modules/scripts/push.zsh diff --git a/README.md b/README.md index 40cdbf9..3b82d1a 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,7 @@ ### Title +If you want to see proper documentation, please visit the [documentation](documentation_titlepage.md) page. + Hewo :3 - you have found the Polyteknisk Radiogruppe's NixOS configurations of our server, feel free to poke holes at it, as security through obscurity isn't really security. Like don't be a douche poking holes, but be nice, do not ruin it if you were on the other side, silliness is okay, but consent is best. diff --git a/documentation_titlepage.md b/documentation_titlepage.md index 4025e9b..6b98eb1 100644 --- a/documentation_titlepage.md +++ b/documentation_titlepage.md @@ -1,9 +1,11 @@ # Welcome to the Polyteknisk Radiogruppe's Server Documentation -The following the documentation showcases how the server is built up and how one should manage this in both long and short terms. -Also, thusly, this document should be actively maintained in the functional changes no matter how small or large, as in -if a flag is changed in the compiliation of the system build, password key changes, new added standard package, then it must -be documented here. +This documentation outlines how the server is built and maintained, covering both short- and long-term management practices. + +> [!NOTE] +> **Important:** This document should be actively maintained whenever functional changes occur—no matter how small or large. +> This includes compilation flag changes, password key updates, new standard packages, and any other modifications. + ## Documentation File Structure @@ -12,16 +14,24 @@ of having to create custom binaries for the system of the sysadmin or any relate the following document focus should be in the `nix-system-configs` folder, which is the main folder for the system configuration files and scripts. ->[note!] For the documentation maintainer, be sure to update this tree with the `lsd` package with running the `lsd --tree` of the project directory. Please do take care to not have some secrets exposed here in your own home system if so be it. +> [!TIP] For documentation maintainers: Update the directory tree using `lsd --tree` from the project root. Be careful not to expose secrets and other things when documenting from your local system. + ```bash  . +├──  backup-key.private ├──  Cargo.lock ├──  Cargo.toml +├──  compose2nix-readme.md +├──  docker-compose.wellknown.override.yml +├──  documentation_titlepage.md +├──  dummy.txt ├──  LICENSE -├──  maintence_cheatsheet.md +├──  nginx +│ └──  matrix.conf ├──  nix-system-configs │ ├──  build │ │ └──  configuration.nix +│ ├──  christine-server_do_not_use.nix │ ├──  database-deprecated │ │ └──  configuration.nix │ ├──  dns @@ -38,71 +48,152 @@ is the main folder for the system configuration files and scripts. │ │ └──  gateway.nix │ ├──  modules │ │ ├──  bootloader -│ │ │ ├──  seabios-assigned-iso-at-birth.nix -│ │ │ └──  seabios-assigned-proxmox-at-birth.nix │ │ ├──  desktop-manager -│ │ │ ├──  gnome.nix -│ │ │ └──  sway_greetd_homemanager.nix │ │ ├──  lix-default.nix │ │ ├──  local -│ │ │ ├──  hostname_username.nix -│ │ │ └──  networking_local.nix │ │ ├──  scripts -│ │ │ ├──  compose_two_nix.zsh -│ │ │ ├──  pull.zsh -│ │ │ └──  push.zsh │ │ ├──  secrets-config -│ │ │ ├──  sops-composesongsheet.nix -│ │ │ └──  sops-database.nix │ │ ├──  songsheet -│ │ │ └──  wavelog -│ │ │ ├──  docker-compose.nix -│ │ │ ├──  docker-compose.yml -│ │ │ └──  notes.md │ │ ├──  system -│ │ │ ├──  compose-songsheet.nix -│ │ │ ├──  database.nix -│ │ │ ├──  forgejo.nix -│ │ │ ├──  teamspeak.nix -│ │ │ └──  traefik.nix │ │ ├──  system_scripts -│ │ │ ├──  backup_strategem -│ │ │ │ └──  manual_database_restore.zsh -│ │ │ └──  gcloud_backup.nix │ │ └──  toolsets -│ │ └──  remote_building.nix │ ├──  old-server-notes.md │ ├──  prg-blank-setup │ │ ├──  blank-proxmox-partition.nix │ │ └──  example.nix │ ├──  secrets │ │ ├──  database -│ │ │ ├──  gcloud_bucket.json -│ │ │ └──  secrets.yaml │ │ ├──  songsheet -│ │ │ ├──  example.yaml -│ │ │ └──  secrets.yaml │ │ └──  traefik -│ │ └──  test.yaml │ └──  traefik-deprecated │ ├──  pull.zsh │ ├──  push.zsh │ └──  traefik-config.nix ├──  README.md -└── 󱧼 src - └──  main.rs +├──  sops-nix-readme.md +├── 󱧼 src +│ └──  main.rs +└──  target + ├──  CACHEDIR.TAG + └──  debug + ├──  build + ├──  deps + ├──  examples + └──  incremental ``` -As you can see it, the main system is separated up the the following `modules`, where all Nix configurations are thusly reused and -updated across different systems. As mentioned before, `system` is the start of the core configuration of the following linux systems running in Proxmox. -Looking at the `blank_system_USE_THIS_AS_COPY.nix`, you can see that the system is variables are declared dynamically in Nix-like variable declaration where -we create the local new options class and make this callable in the other functions in the imports. Speaking of imports, `imports = [ ... ] ` block shows -which modules which are then attached the core system, usually the bootloader is a must feature to the attached as the following system will not boot properly without it but different systems, depending how they were installed, need different configurations. -Then usually the networking module is also attached to have capabilities to use networking i.e. internet access, hostname, which DNS to use etc. `lix-default.nix` module imported is the -the assumed standard which tools each NixOS machine in the PRG network has, which is important for ensuring consistent existence of the tools used and maintanence within the machine outside of this documentation and machine buildings, as in enabling file transfers, package manager, SSH, password management, locales, timezones, upgrade system schedules. -Next piece that should be added is the desktop/window management which could help simplifing the interaction of the VMs in the Proxmox or other external systems that are depednent of this repository. +## Module Architecture -As you can see that each aformentioned module in specific tasks are in their folders `local` for networking and users, `desktop-manager` for interaction, `bootloader` for... well.. bootloaders etc. Feel free to add more different modules for each system need or change. +The system is organized into reusable modules across all NixOS machines in the PRG network. +The `system` module serves as the core configuration for Linux systems running on Proxmox, while supporting diverse +deployments through modular composition. +### Configuration Pattern +Use `blank_system_USE_THIS_AS_COPY.nix` as a template for new system configurations. +This file demonstrates the standard pattern of declaring system variables using Nix syntax to create custom local options that are callable across imported modules. +### Core Modules + +The `imports = [ ... ]` block specifies which modules are attached to your system configuration. These core modules ensure consistency and functionality: + - Bootloader [`bootloader`] (**required**): Handles system boot initialization. Configuration varies by installation type (ISO-assigned or Proxmox-assigned). + - Local [`local`] (**required**): Provides internet connectivity, hostname resolution, DNS configuration, and user settings. + - Standard Toolset [`lix-default.nix`] (**strongly recommended**): Ensures consistent tools across the PRG network—file transfers (rsync), SSH with key-based authentication, security features (U2F and SSH agent passwordless sudo), package management, and automated daily system upgrades. + - Desktop/Window Manager [`desktop-manager`] (**optional**): Simplifies VM interaction within Proxmox and supports systems requiring graphical interfaces. + - Toolsets [`toolsets`] (**optional**): Contains reusable configurations for specific tools or services that may be needed across multiple systems, such as remote building configurations. + - Secrets Config [`secrets-config`] (**required when needing password management**): Manages sensitive information like database credentials and Traefik secrets using SOPS-encrypted Nix files (see [this](https://github.com/Mic92/sops-nix) and [that](https://github.com/getsops/sops#2usage)). This module is essential for systems that require secure handling of secrets. + - Docker Containers [`songsheet`] (**optional**): This special module handles Docker Compose files that are converted to Nix. Currently it is used for a single VM but can be expanded to contain all [compose2nix](https://github.com/aksiksi/compose2nix) generated configurations. + - System Scripts [`system_scripts`] (**variable**): `system_scripts` contains scripts (for example, database backup scripts) that are often easier to write and maintain in shell than in Nix. + +### Module Organization + +```bash + . +├──  bootloader +│ ├──  seabios-assigned-iso-at-birth.nix +│ └──  seabios-assigned-proxmox-at-birth.nix +├──  desktop-manager +│ ├──  gnome.nix +│ └──  sway_greetd_homemanager.nix +├──  lix-default.nix +├──  local +│ ├──  hostname_username.nix +│ └──  networking_local.nix +├──  scripts +│ ├──  compose_two_nix.zsh +│ ├──  pull.zsh +│ └──  push.zsh +├──  secrets-config +│ ├──  sops-composesongsheet.nix +│ └──  sops-database.nix +├──  songsheet +│ └──  wavelog +├──  system +│ ├──  blank_system_USE_THIS_AS_COPY.nix +│ ├──  compose-songsheet.nix +│ ├──  database.nix +│ ├──  forgejo.nix +│ ├──  teamspeak.nix +│ └──  traefik.nix +├──  system_scripts +│ ├──  backup_strategem +│ └──  gcloud_backup.nix +└──  toolsets +└──  remote_building.nix +``` + +### Module Scripts + +> [!INFO] As you saw the odd one in the file structure, the `scripts` folder contains helper scripts to +> simplify maintenance and to make updating system configuration files on remote machines easier. +> These helper scripts live under `nix-system-configs/modules/scripts`. + +#### `pull.zsh` + +Deploys configuration changes from the repository to the local system. This script: + +1. Prompts you to select a system configuration (or accepts one as a command-line argument) +2. Pulls the latest changes from the git repository +3. Syncs the `modules` directory to `/etc/nixos/modules` +4. Syncs the `secrets` directory to `/etc/nixos/secrets` (if present) +5. Syncs the `system_scripts` directory to `/etc/nixos/system_scripts` (if present) +6. Copies the selected system configuration to `/etc/nixos/configuration.nix` +7. Executes `nixos-rebuild switch --upgrade-all` to apply changes + +#### `push.zsh` + +Synchronizes local system changes back to the repository. This script: + +1. Prompts you to select a system configuration (or accepts one as a command-line argument) +2. Rebuilds the local NixOS system with `nixos-rebuild switch --upgrade-all` +3. Pulls the latest changes from the git repository +4. Copies the active configuration from `/etc/nixos/configuration.nix` back to the repository +5. Syncs changes from `/etc/nixos/modules` back to the repository +6. Stages, commits, and pushes changes to the remote git repository with a timestamped commit message + +## How to maintain the local machines + +> [!NOTE] The following maintenance scripts should be made less unwieldy to use, so they will be changed in the next +> possible project restructuring. + +From the home machine: + +The remote access IP address should be reachable via the VPN service you use (Tailscale, OpenVPN, etc.). +To connect to the remote machine (or other machines on the same network) with established keys, use: +```zsh +ssh -A REMOTE_MACHINE_USERNAME@ACCESS_IP_ADDRESS +``` +To connect to other machines: +```zsh +ssh -A OTHER_REMOTE_MACHINE_USERNAME@LOCAL_IP_ADDRESS +``` + +After having had connected to the remote machine, run the following commands, although this assumes you have git cloned +this repository into the home directory of the remote machine. Now, running through the selection of the different +systems as per script and upon selection of the script, it will then try to upgrade the system. + +```zsh +cd the-prg-server-structure +git pull +zsh nix-system-configs/modules/scripts/pull.zsh +``` diff --git a/maintence_cheatsheet.md b/maintence_cheatsheet.md deleted file mode 100644 index f595040..0000000 --- a/maintence_cheatsheet.md +++ /dev/null @@ -1,4 +0,0 @@ -# Upload the config to the server -```zsh -rsync -avz --progress2 FILE root@HOSTNAME:/etc/nixos/configuration-knot.nix -``` \ No newline at end of file diff --git a/nix-system-configs/modules/scripts/compose_two_nix.zsh b/nix-system-configs/modules/scripts/compose_two_nix.zsh old mode 100644 new mode 100755 diff --git a/nix-system-configs/modules/scripts/pull.zsh b/nix-system-configs/modules/scripts/pull.zsh old mode 100644 new mode 100755 diff --git a/nix-system-configs/modules/scripts/push.zsh b/nix-system-configs/modules/scripts/push.zsh old mode 100644 new mode 100755 From 3dd427aca44c35f512ef1b40cae3d1fd58e09ac8 Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Tue, 10 Feb 2026 21:49:27 +0100 Subject: [PATCH 7/7] "Use a dash to separate phrases" - HOW ABOUT I DO.... ANYWAY https://youtu.be/yWULCfJ2PGA --- documentation_titlepage.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/documentation_titlepage.md b/documentation_titlepage.md index 6b98eb1..ee020cf 100644 --- a/documentation_titlepage.md +++ b/documentation_titlepage.md @@ -3,7 +3,7 @@ This documentation outlines how the server is built and maintained, covering both short- and long-term management practices. > [!NOTE] -> **Important:** This document should be actively maintained whenever functional changes occur—no matter how small or large. +> **Important:** This document should be actively maintained whenever functional changes occur - no matter how small or large. > This includes compilation flag changes, password key updates, new standard packages, and any other modifications.