Aomi — Fedora CSB + Nix

ThinkPad P1 Gen 3 running Red Hat CSB (Fedora), managed with Nix system-manager and home-manager.

Architecture

Fedora CSB (base OS, IT-managed)
  └── Nix (Determinate installer)
       ├── system-manager  → WireGuard, Syncthing, system services
       └── home-manager    → shell, editors, dev tools

Bootstrap

From another machine with SSH access to aomi:

ssh vdemeest@192.168.1.23 'bash -s' < imperative/aomi/bootstrap.sh

Or on aomi directly:

curl -sL https://git.sbr.pm/home/raw/branch/main/imperative/aomi/bootstrap.sh | bash

Rebuilding

cd ~/src/home

# System-manager (WireGuard, Syncthing)
nix build .#systemConfigs.aomi && sudo ./result/bin/activate

# Home-manager (dev tools, shell)
home-manager switch --flake .#vdemeest@aomi

WireGuard

The system-manager config writes /etc/wireguard/wg0.conf but uses a placeholder for the private key. After first activation:

# Option 1: Restore backed-up key
sudo cp /path/to/backup/private.key /etc/wireguard/
sudo chmod 600 /etc/wireguard/private.key

# Option 2: Generate a new keypair, then update globals.nix
wg genkey | sudo tee /etc/wireguard/private.key
sudo cat /etc/wireguard/private.key | wg pubkey
# → update globals.nix machines.aomi.net.vpn.pubkey
#   (current: Pmu/0CjRaClmz+v25OV3SLd/V6Il8YLLavbtu8cYSGY=, VPN IP 10.100.0.17)

sudo systemctl restart wireguard-wg0

Local OpenShift (CRC)

The bootstrap installs CRC (OpenShift Local) — a single-node OpenShift cluster running in a libvirt VM. The crc binary is downloaded to ~/bin. Requires a Red Hat pull secret (download from https://console.redhat.com/openshift/create/local and save to ~/.crc/pull-secret.json), then:

crc setup
crc start --pull-secret-file ~/.crc/pull-secret.json

CRC needs libvirt/NetworkManager (installed by the bootstrap) and the user in the libvirt group (added by the bootstrap; log out/in to apply).

For a lighter MicroShift-style cluster, use the CRC preset instead of a separate install (the @redhat-et/microshift Fedora COPR is abandoned; MicroShift is now RHEL-only):

crc config set preset microshift
crc setup && crc start --pull-secret-file ~/.crc/pull-secret.json

Syncthing

After activation, Syncthing runs as a system service under the vdemeest user. The device ID is already registered in globals.nix (S6UM56N-...). If the ID changes, update globals.nix and re-accept the device on other nodes.

# Get the current device ID
curl -s http://localhost:8384/rest/system/status | jq -r .myID