EICAS server config

Initial deploy

On Hetzner:

Create a machine and add cloud-config:

#cloud-config
runcmd:
 - curl https://raw.githubusercontent.com/elitak/nixos-infect/master/nixos-infect | PROVIDER=hetznercloud NIX_CHANNEL=nixos-unstable bash 2>&1 | tee /tmp/infect.log

Edit DNS so relevant hostnames point to this IP, like hetzner.eicas.nl and updating the SPF record to allow email through this IP

• get public host key with ssh-keyscan <IP>
• add to secrets.nix
• nix develop
• agenix --rekey
• NIX_SSHOPTS=... nixos-rebuild ....

Then manually:

• if nextcloud-setup.service fails to create the Nextcloud instance, you may need to delete the (likely-empty) /var/lib/nextcloud/config/config.php and retry

Test if configuration builds

Copy the networking.nix and hardware-configuration.nix from the deployed machine:

scp it@hetzner.eicas.nl:/etc/nixos/networking.nix .
scp it@hetzner.eicas.nl:/etc/nixos/hardware-configuration.nix .

Then build:

nixos-rebuild --flake .#hetzner build

Update

Copy the networking.nix and hardware-configuration.nix from the deployed machine:

scp it@hetzner.eicas.nl:/etc/nixos/networking.nix .
scp it@hetzner.eicas.nl:/etc/nixos/hardware-configuration.nix .

Then deploy:

nixos-rebuild --flake .#hetzner --use-remote-sudo --target-host it@hetzner.eicas.nl switch
nixos-rebuild --flake .#hetzner2 --use-remote-sudo --target-host it@hetzner2.eicas.nl switch

Secrets

Edit a secret:

agenix -e ./mailinglists.yaml.age

Add a new secret:

• add to secrets.nix
• add age.secrets.foo to configuration.nix
• use as config.age.secrets.foo.path

Secrets and git diff/git show

To see secrets in git diff and git show and the like, add the following to your .git/config:

[core]
	pager = cat
[diff "age"]
	textconv = age -d -i ~/.ssh/id_ed25519

The 'pager = cat' is only needed if you have password-protected your private key, to avoid the pager from messing with the password input.

Administration

Roundcube

Manual database connection: nix-shell -p postgresql --run "sudo -u postgres psql roundcube"

Updating mailinglists

To update credentials: agenix -e mailbox-credentials.toml.age

To update signatures: agenix -e mailinglists.toml.age and run sudo systemctl start update-signatures.service. (this cannot happen automatically periodically because it breaks draft emails until we finish eicas/admin-sync#7)