main
..
README.md
rw-r--r--
2.6 KB
bootstrap.sh
rwxr-xr-x
16.0 KB
clone-repos.sh
rwxr-xr-x
3.9 KB

Kyushu — Fedora CSB + Nix

ThinkPad X1 Carbon Gen 12 running Red Hat CSB (Fedora), managed with Nix home-manager and manual system config files.

Architecture

Fedora CSB (base OS, IT-managed)
  └── Nix (Determinate installer)
       ├── home-manager    → shell, editors, dev tools, syncthing
       └── Manual configs  → /etc/hosts, WireGuard, nix.custom.conf, NM dispatcher

Note: system-manager is intentionally NOT used — its activation clobbers /etc/profile.d, /etc/systemd/system, and /etc/tmpfiles.d with nix-store symlinks, breaking Fedora’s shell and NSS/LDAP setup.

Bootstrap

From another machine with SSH access to kyushu:

ssh vdemeest@kyushu.home 'bash -s' < imperative/kyushu/bootstrap.sh

Or on kyushu directly:

curl -sL https://git.sbr.pm/home/raw/branch/main/imperative/kyushu/bootstrap.sh | bash

Individual phases can be run by sourcing the script:

source imperative/kyushu/bootstrap.sh
setup_tpm

Rebuilding

cd ~/src/home

# Home-manager (dev tools, shell, emacs, syncthing)
home-manager switch --flake .#vdemeest@kyushu

System config files (/etc/hosts, WireGuard, etc.) are written once by the bootstrap. To update them, re-run the relevant phase:

source imperative/kyushu/bootstrap.sh
setup_system_configs

WireGuard

The bootstrap writes /etc/wireguard/wg0.conf. You need to place the private key manually:

# Restore backed-up key (same pubkey, no globals.nix update needed)
sudo cp ~/tmp/kyushu-wg-private.key /etc/wireguard/private.key
sudo chmod 600 /etc/wireguard/private.key
sudo systemctl restart wg-quick@wg0

Or generate a new keypair:

wg genkey | sudo tee /etc/wireguard/private.key
sudo cat /etc/wireguard/private.key | wg pubkey
# → update globals.nix machines.kyushu.net.vpn.pubkey
#   (current VPN IP: 10.100.0.19)
sudo chmod 600 /etc/wireguard/private.key
sudo systemctl restart wg-quick@wg0

Syncthing

After home-manager activation, Syncthing runs as a user service. The device ID needs to be updated in globals.nix after first run:

curl -s http://localhost:8384/rest/system/status | jq -r .myID

Passage

After WireGuard is up and the passage store is cloned:

  1. Generate a new TPM identity: age-plugin-tpm --generate
  2. Add the public key to .age-recipients in the passage store
  3. Remove the old kyushu TPM pubkey
  4. Run passage reencrypt from a machine with YubiKey #1

Differences from aomi

  • No CRC — no local OpenShift cluster needed
  • No lid-close override — default suspend behavior is fine
  • No system-manager — config files written directly by bootstrap