Switch from deploy-rs to nixos-rebuild for remote deployment The main reasons for this are that deploy-rs is quite complex and annoying and unofficial, and I'd rather use SSH cryptography and root login using a dedicated key rather than using Nix signing keys. Also my signing key isn't encrypted so it feels like more of a security hazard. This reduces the number of lines in my config by quite a bit. The biggest downside is that now the deployment parameters aren't hardcoded in the flake but rather something I have to pass on the CLI, but it's included in the cheatsheet. I also reordered the cheatsheet into implicit sections.

Changes

5 changed files (+15/-121)

• README.md
  • @@ -9,17 +9,16 @@ Prefer the new `nix` CLI when possible instead of the old `nix-*` commands. It's
    | Task | Command | | --- | --- | | Run program | `nix run nixpkgs#hello` (needs `--` if passing args) | - | Run program from another Nixpkgs repo | `nix run github:Toby222/nixpkgs#space-station-14-launcher` | + | Run AppImage | `appimage-run blah.AppImage` | | Clean Nix store | `run0 nix-collect-garbage && nix store optimise` | | Get size of Nix store | `sqlite3 /nix/var/nix/db/db.sqlite 'SELECT SUM(narSize) FROM ValidPaths'` | | Get largest packages | `sqlite3 /nix/var/nix/db/db.sqlite 'SELECT * FROM ValidPaths ORDER BY narSize DESC LIMIT 50'` | | Check if anything depends on path | `nix-store --query --referrers /nix/store/blah` | | List system generations | `nixos-rebuild list-generations` | | Switch to generation | `run0 nix-env --switch-generation 1234 -p /nix/var/nix/profiles/system && run0 /nix/var/nix/profiles/system/bin/switch-to-configuration switch` | - | Run Nix file | `nix eval -f main.nix` | - | Build VM from config | `nixos-rebuild build-vm && result/bin/run-* -m 4G -smp 8 -device virtio-vga-gl -display sdl,gl=on` (may need to change the QEMU version in the run script if the config uses a different nixpkgs) | - | Deploy using signing key | `LOCAL_KEY=key deploy -s .` | - | Run AppImage | `appimage-run blah.AppImage` | | Get changes between system generations | `nix profile diff-closures --profile /nix/var/nix/profiles/system` | + | Deploy to remote machine | `NIX_SSHOPTS="-i ~/.ssh/nixos-rebuild" nixos-rebuild switch --flake .#Unnamed-Server --target-host root@unnamed.website` | + | Build VM from config | `nixos-rebuild build-vm && result/bin/run-* -m 4G -smp 8 -device virtio-vga-gl -display sdl,gl=on` (may need to change the QEMU version in the run script if the config uses a different nixpkgs) | | Install specific version of package | https://lazamar.co.uk/nix-versions/ | + | Run Nix file | `nix eval -f main.nix` | | Inspect system config in REPL | `nix repl .#nixosConfigurations.$hostname` |
• ThinkPad-X1-Yoga-Gen-6/default.nix
  • @@ -89,7 +89,6 @@
    # Utilities and other random junk aspellDicts.en - deploy-rs ffmpeg fusee-nano hugo
• Unnamed-Server/default.nix
  • @@ -6,14 +6,8 @@
    }: { - nix = { - # https://crystalwobsite.gay/posts/2025-02-09-deploying_nixos#deploying-with-a-trusted-key - settings.trusted-public-keys = [ - "cache.ThinkPad-X1-Yoga-Gen-6-1:IpXs6Lbx1k2jXillRc2Pb+/3n/eNqLrQ42eajv0zj7Y=" - ]; - # Use lower IO priority for Nix so my server is still responsive while getting nix-copy-closured - daemonIOSchedClass = "idle"; - }; + # Use lower IO priority for Nix so my server is still responsive while getting nix-copy-closured + nix.daemonIOSchedClass = "idle"; nixpkgs = { hostPlatform = lib.mkDefault "x86_64-linux";
  • @@ -78,9 +72,14 @@
    # The best time zone time.timeZone = "UTC"; - users.users.a.openssh.authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDLPakDnAelqFTUudQB8X0T7yc/8ekV3jGqpeJb062l anthonywang" - ]; + users.users = { + root.openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPWzNs8PdQKsgSADzbub2XfrZeIrF+jK7M4VMjuRmaIt anthonywang" + ]; + a.openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDLPakDnAelqFTUudQB8X0T7yc/8ekV3jGqpeJb062l anthonywang" + ]; + }; programs.tmux.enable = true;
  • @@ -93,7 +92,6 @@
    AcceptEnv = "GIT_PROTOCOL"; # Don't hack me PasswordAuthentication = false; - PermitRootLogin = "no"; }; };
  • @@ -112,7 +110,7 @@
    "github.com/caddy-dns/porkbun@v0.3.1" "dev.mediocregopher.com/mediocre-caddy-plugins.git@v0.0.0-20250308145011-421597d7c920" ]; - hash = "sha256-VoJG4iSQi3jjcmyvg9o81K+0hg/JPzm1gzfSb+vlmoI="; + hash = "sha256-8GjlNnYCv1VzfVh6OagcihU6jeNkFrkHyHW2KnhyJbc="; }; # Porkbun API keys environmentFile = "/etc/caddy/env";
• flake.lock
  • @@ -1,27 +1,5 @@
    { "nodes": { - "deploy-rs": { - "inputs": { - "flake-compat": "flake-compat", - "nixpkgs": [ - "nixpkgs" - ], - "utils": "utils" - }, - "locked": { - "lastModified": 1756719547, - "narHash": "sha256-N9gBKUmjwRKPxAafXEk1EGadfk2qDZPBQp4vXWPHINQ=", - "owner": "serokell", - "repo": "deploy-rs", - "rev": "125ae9e3ecf62fb2c0fd4f2d894eb971f1ecaed2", - "type": "github" - }, - "original": { - "owner": "serokell", - "repo": "deploy-rs", - "type": "github" - } - }, "disko": { "inputs": { "nixpkgs": [
  • @@ -43,22 +21,6 @@
    "type": "github" } }, - "flake-compat": { - "flake": false, - "locked": { - "lastModified": 1733328505, - "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=", - "owner": "edolstra", - "repo": "flake-compat", - "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec", - "type": "github" - }, - "original": { - "owner": "edolstra", - "repo": "flake-compat", - "type": "github" - } - }, "nixpkgs": { "locked": { "lastModified": 1760038930,
  • @@ -77,43 +39,9 @@
    }, "root": { "inputs": { - "deploy-rs": "deploy-rs", "disko": "disko", "nixpkgs": "nixpkgs" } - }, - "systems": { - "locked": { - "lastModified": 1681028828, - "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", - "owner": "nix-systems", - "repo": "default", - "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", - "type": "github" - }, - "original": { - "owner": "nix-systems", - "repo": "default", - "type": "github" - } - }, - "utils": { - "inputs": { - "systems": "systems" - }, - "locked": { - "lastModified": 1731533236, - "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", - "owner": "numtide", - "repo": "flake-utils", - "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", - "type": "github" - }, - "original": { - "owner": "numtide", - "repo": "flake-utils", - "type": "github" - } } }, "root": "root",
• flake.nix
  • @@ -8,31 +8,12 @@
    url = "github:nix-community/disko/latest"; inputs.nixpkgs.follows = "nixpkgs"; }; - # https://crystalwobsite.gay/posts/2025-02-09-deploying_nixos - # https://lantian.pub/en/article/modify-website/nixos-initial-config-flake-deploy.lantian/#batch-deployment-with-deploy-rs - deploy-rs = { - url = "github:serokell/deploy-rs"; - inputs.nixpkgs.follows = "nixpkgs"; - }; }; outputs = inputs@{ self, nixpkgs, ... }: let system = "x86_64-linux"; pkgs = import nixpkgs { inherit system; }; - # Use the deploy-rs binaries from nixpkgs but lib from the flake - deployPkgs = import nixpkgs { - inherit system; - overlays = [ - inputs.deploy-rs.overlays.default - (self: super: { - deploy-rs = { - inherit (pkgs) deploy-rs; - lib = super.deploy-rs.lib; - }; - }) - ]; - }; in { nixosConfigurations = {
  • @@ -52,17 +33,6 @@
    ]; }; }; - deploy.nodes.Unnamed-Server = { - hostname = "unnamed.website"; - profiles.system = { - user = "root"; - interactiveSudo = true; - path = deployPkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.Unnamed-Server; - # Download everything on the local system, then copy it over - # Otherwise my tiny tiny server sometimes runs out of RAM while downloading - fastConnection = true; - }; - }; packages.${system}.image = self.nixosConfigurations.Unnamed-Server.config.system.build.diskoImages; # I love autoformatters formatter.${system} = pkgs.nixfmt-tree;