KropCloud Machines Configuration

This repository contains the NixOS infrastructure-as-code (IaC) for KropCloud, a custom private cloud cluster. It leverages Nix Flakes, disko, agenix, and nixos-anywhere for a fully declarative and reproducible setup.

🏗️ Architecture

• flake.nix: The main entry point. Automatically discovers hosts in the hosts/ directory.
• hosts/: Machine-specific configurations (e.g., node0.nix, node1.nix).
• nixosModules/: Reusable modules for services, networking, and user management.
  • services/: K3s, Hydra, NFS, SSH, Tailscale.
  • networking/: WireGuard, Firewall, Avahi.
  • users/: Standard admin user configuration with SSH keys and agenix passwords.
• provider/: Infrastructure-specific configurations (Hetzner, Proxmox).
• secrets/: Encrypted secrets managed by agenix and a custom keys.json rekeying system.
• scripts/: Python automation: install.py (bootstrap + secret rekey + fresh install) and update.py (redeploy an existing machine).

🚀 Getting Started

Prerequisites

• A machine with Nix installed and Flakes enabled.
• agenix CLI for secret management.
• SSH access to your target nodes.

Adding a New Machine

1. Create the configuration: Add a new .nix file in the hosts/ directory.

   { ... }: {
     imports = [ ../provider/proxmox ]; # or hetzner
     kropcloud.services.k3s.enable = true;
     # ... other host-specific config
   }
   

2. Perform Fresh Install: Use install.py to deploy the configuration. It fetches the new host's SSH key, rekeys secrets, and runs the install. Pass --bootstrap for a fresh server without NixOS to provision it with nixos-anywhere first (use -B hetzner to select a non-default provider profile):

   ./scripts/install.py <machine-name> <target-ip> --bootstrap
   

Updating an Existing Machine

Redeploy the current configuration to a machine that is already running with update.py. The SSH user is derived from the host config automatically:

./scripts/update.py <machine-name> <target-ip>
# options: --port/-p <ssh-port>, --type/-t switch|boot|test|dry-activate|dry-build (default: switch)

🛠️ Key Components

Secret Management (agenix)

Secrets are stored in .age files. Host public keys are tracked in secrets/keys.json. When a new machine is added, the install.py script:

1. Scans the host's ed25519 SSH key.
2. Adds it to keys.json.
3. Runs agenix -r to re-encrypt all secrets for the updated set of host keys.

K3s Cluster

The cluster is managed via the kropcloud.services.k3s module. It supports master/worker roles and custom flags for a streamlined Kubernetes experience on NixOS.

📜 TODO

• Handle multidisk bootstrapping
• Implement more granular secret distribution (only send keys to required hosts).
• Automate HA master discovery for K3s.

⚖️ License

MIT (or your preferred license)