Server specification
| Hardware | Configuration |
|---|---|
| Processor | Intel Core i7-4790, 4x3600 MHz |
| Memory | 32 GB DDR3 1600 MHz |
| Disks | 120 GB SSD x 2, 4 TB HDD x 1 |
Boot from installation ISO image
Boot from installation ISO image (Minimal, 64-bit Intel/AMD):
-
set a password for the
nixosuserpasswd
-
connect from a remote host
ssh nixos@[SERVER_IP_ADDRESS]
Partitioning of disk
Ignore info messages from parted:
Information: You may need to update /etc/fstab.
-
delete data from SSD drives
sudo shred --verbose /dev/sdX
-
find disk which connected to SATA-port 1
$ for i in /dev/disk/by-path/*;do [[ ! "$i" =~ '-part[0-9]+$' ]] && echo "Port $(basename "$i"|grep -Po '(?<=ata-)[0-9]+'): $(readlink -f "$i")";done Port 1: /dev/sdb
-
create a GPT partition table
sudo parted /dev/sdb -- mklabel gpt
-
create a
rootpartition, left 16GiB forswappartition at the end of disk and 512MiB forbootpartition at the beggining of disksudo parted /dev/sdb -- mkpart primary 512MiB -16GiB
-
create a
swappartitionsudo parted -a none /dev/sdb -- mkpart primary linux-swap -16GiB 100%
-
create a
bootpartitionsudo parted /dev/sdb -- mkpart ESP fat32 1MiB 512MiB sudo parted /dev/sdb -- set 3 esp on
Formatting of disk
-
format a
rootpartition to ext4, add a labelnixossudo mkfs.ext4 -L nixos /dev/sdb1
-
create a
swappartition, add a labelswapsudo mkswap -L swap /dev/sdb2
-
create a
bootpartition, add a lablebootsudo mkfs.fat -F 32 -n boot /dev/sdb3
Installing OS
-
mount the target file system on which NixOS should be installed on
/mntsudo mount /dev/disk/by-label/nixos /mnt
-
mount the boot file system on
/mnt/bootsudo mkdir -p /mnt/boot sudo mount /dev/disk/by-label/boot /mnt/boot
-
generate an initial configuration file
sudo nixos-generate-config --root /mnt
-
edit a configuration file
sudo nano /mnt/etc/nixos/configuration.nix
- enable OpenSSH service
- allow login as root user
services.openssh = { enable = true; settings.PermitRootLogin = "yes"; }; -
run the installation
sudo nixos-install
-
at the end of the installation set the password for the root user. If something went wrong, set it manually
[nixos@nixos:~]$ sudo nixos-enter --root '/mnt' [root@nixos:/]# passwd [root@nixos:/]# exit
-
reboot system
sudo reboot
-
after reboot check connection under the
rootuserssh root@[SERVER_IP_ADDRESS]
-
delete data from HDD drive
- run the process in the background, because it can take a long time
sudo shred --verbose /dev/sdX >> shred.log 2>&1 &
- display logs
tail -f shred.log
- run the process in the background, because it can take a long time
Prepare
-
create bot and group in Telegram
-
create a personal access token (classic) in GitHub
- Note: grafana
- Expiration: No expiration
- Scopes:
- repo:status
- repo_deployment
- public_repo
- read:packages
- read:org
- read:user
- user:email
- read:project
-
build an image
docker build --rm --file Dockerfile --tag ansible:2.16.0 . -
create a Vault password file named
.vault_passwordand add a password in it -
create an encrypted file
docker run --rm -ti \ --volume=$(pwd):/etc/ansible \ ansible:2.16.0 \ ansible-vault create host_vars/localhost/vault.yml -
write credentials to encrypted file
--- vault_server_ip_address: 192.168.0.1 vault_server_root_account_password: 'S0me P@ssword' vault_server_technical_account_username: [VALUE] vault_1password_device_id: [VALUE] (can be found in `~/.config/op/config` on Alpine linux) vault_1password_master_password: 'S0me P@ssword' vault_1password_subdomain: my vault_1password_email_address: email@example.com vault_1password_secret_key: [VALUE] vault_telegram_bot_token: [VALUE] vault_telegram_chat_id: [VALUE] vault_domain_name_internal: example.com vault_mattermost_postgres_username: [VALUE] vault_mattermost_postgres_database: [VALUE] vault_redis_exporter_redis_username: [VALUE] vault_gitlab_postgres_username: [VALUE] vault_gitlab_postgres_database: [VALUE] vault_postgres_exporter_postgres_username: [VALUE] vault_pgadmin_postgres_username: [VALUE] vault_grafana_github_token: [VALUE] vault_grafana_postgres_username: [VALUE] vault_grafana_redis_username: [VALUE]
-
run a playbook to do an initial configuration on a server and configure a local environment
docker run --rm -t \ --volume=$(pwd):/etc/ansible \ ansible:2.16.0 \ ansible-playbook site.yml --tags prepare -
grafana dashboard sources
-
run a playbook to upload grafana dashboards
docker run --rm -t \ --volume=$(pwd):/etc/ansible \ ansible:2.16.0 \ ansible-playbook site.yml --tags dashboards -
run a playbook to upgrade NixOS and services to the latest version
docker run --rm -ti \ --volume=$(pwd):/etc/ansible \ ansible:2.16.0 \ ansible-playbook site.yml --tags upgrade -
upload Windows ISO image to
/mnt/hdd/libvirt/isodirectory on server
Deploy
-
run a playbook to configure a server
docker run --rm -t \ --volume=$(pwd):/etc/ansible \ ansible:2.16.0 \ ansible-playbook site.yml -
import certificates in Firefox: Preferences -> Privacy & Security -> Security -> Certificates -> View Certificates...
- import certificate authority: Authorities -> Import... -> ca.pem (choose
Trust this CA to identify websites.) - import user certificate for authentication: Your Certificates -> Import... -> user.pfx (leave the password field blank and click Log in)
- import certificate authority: Authorities -> Import... -> ca.pem (choose
-
install guest agent and tools on Windows
- virtio-win -> guest-agent\qemu-ga-x86_64.msi
- virtio-win -> virtio-win-guest-tools.exe
- https://github.com/billziss-gh/winfsp/releases (install Core)
- configure and start service
sc config VirtioFsSvc binPath="C:\Program Files\Virtio-Win\VioFS\virtiofs.exe" start=auto depend=VirtioFsDrv sc start VirtioFsSvc
- configure and start service
- host-share -> spice-guest-tools-latest.exe
- host-share -> grafana-agent-installer.exe
- configure and start service
sc config "Grafana Agent" binpath="\"C:\Program Files\Grafana Agent\grafana-agent-windows-amd64.exe\" -config.file=\"Z:\agent-config.yaml\" -config.expand-env -server.http.address=\"127.0.0.1:12345\" -server.grpc.address=\"127.0.0.1:12346\"" sc stop "Grafana Agent" sc start "Grafana Agent"
- configure and start service