Added hetzner server configs

2026-07-11 20:28:51 +02:00
parent 0457d618e1
commit c5f771bd53
51 changed files with 1800 additions and 309 deletions
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Deploy NixOS to a Hetzner VPS using nixos-anywhere
+# Usage: ./deploy.sh [user@host]
+#
+# IMPORTANT: Run this from a SEPARATE machine with Nix installed
+# (laptop, another VPS, etc.), NOT from the target VPS itself.
+# nixos-anywhere uses kexec to reboot the target; you can't reboot
+# the machine you're running on.
+#
+# Steps:
+#   1. git clone <this-repo> && cd nixos-config
+#   2. Add your SSH pubkey to ./hosts/hetzner/users.nix
+#   3. ./deploy.sh root@<vps-ip>
+#
+# This wipes the target disk and installs NixOS fresh.
+
+HOST=${1:-root@localhost}
+
+echo "=== Deploying NixOS to $HOST ==="
+echo "WARNING: This will WIPE the target disk!"
+read -rp "Continue? [y/N] " confirm
+[[ "$confirm" =~ ^[Yy]$ ]] || exit 1
+
+nix run github:nix-community/nixos-anywhere -- \
+  --generate-hardware-config nixos-generate-config ./hosts/hetzner/hardware-configuration.nix \
+  --flake ".#hetzner" "$HOST"
+
+# After deploy, the generated hw config MUST be imported to flake.nix
+echo ""
+echo "=== CRITICAL: Post-deploy steps! ==="
+echo "1. Import the generated hw config into flake.nix:"
+echo "   git add hosts/hetzner/hardware-configuration.nix"
+echo "   # In flake.nix, add to modules array:"
+echo "       ./hosts/hetzner/hardware-configuration.nix"
+echo ""
+echo "2. Copy the age key to the new system for sops-nix:"
+echo "   # From the deploy machine:"
+echo "   ssh root@<new-ip> 'mkdir -p /etc/age'"
+echo "   scp /home/admin/age/keys.txt root@<new-ip>:/etc/age/keys.txt"
+echo ""
+echo "3. IMPORTANT: The old gitea_db Docker Postgres needs migration."
+echo "   The pg_dump is at /tmp/gitea-db-dump-YYYY-MM-DD.sql.gz"
+echo "   Restore with:"
+echo "   sudo -u postgres psql -c \"CREATE DATABASE gitea;\""
+echo "   sudo -u postgres psql -c \"CREATE USER gitea WITH PASSWORD 'gitea';\""
+echo "   sudo -u postgres psql -c \"GRANT ALL PRIVILEGES ON DATABASE gitea TO gitea;\""
+echo "   zcat /tmp/gitea-db-dump-YYYY-MM-DD.sql.gz | sudo -u postgres psql gitea"
+echo ""
+echo "4. Restore Caddy certs for the mailserver:"
+echo "   # The old Debian Caddy certs were backed up at /home/admin/backups/caddy-certs-mail.tar.gz"
+echo "   # On NixOS Caddy stores at /var/lib/caddy/certificates/..."
+echo ""