Skip to content
nix-config

Post-Installation & Onboarding

Following an automated installation via install.sh, complete the onboarding steps to configure cryptographic hardware bindings, SSH keys, repository remotes, and agenix secrets.

Initial Boot

  1. If using LUKS + Secure Boot:
    • Reboot into your BIOS setup.
    • Re-enable Secure Boot.
    • Save and exit BIOS.
  2. At the boot prompt, unlock the system using your manual LUKS password (if prompted).
  3. Log in with your user credentials.

Running post-install.sh

Navigate to the cloned repository in your home directory (~/nix-config):

Terminal window
cd ~/nix-config
./post-install.sh

What post-install.sh Does Automatically (Hands-off):

  • Converts Git Remote: Converts origin from HTTPS to SSH (git@gitlab.com:kylekwong/nix-config.git).
  • Enrolls TPM2: Automatically runs systemd-cryptenroll against PCR 7 (--tpm2-device=auto --tpm2-pcrs=7) if a LUKS container and TPM2 device are detected (automatically skipped on unencrypted storage).
  • Generates SSH Keys: Creates ed25519 keys for both the host (/etc/ssh/ssh_host_ed25519_key) and the user (~/.ssh/id_ed25519) if they do not exist.
  • Registers Public Keys: Injects the newly generated public keys directly into secrets/keys.nix under the current hostname.

Interactive Service Authentication (--auth)

To authenticate command-line services and automatically register your new user SSH key with remote providers, run:

Terminal window
./post-install.sh --auth-only

(Or run ./post-install.sh --auth during initial setup).

This interactive flow guides you through:

  1. GitLab CLI (glab): Authenticates via web session and uploads your public SSH key to your GitLab account (enabling git SSH push/pull access immediately).
  2. GitHub CLI (gh): Authenticates via web session and uploads your public SSH key to your GitHub account.
  3. NordVPN: Triggers interactive login to enable VPN connectivity.
  4. Wallpapers: Automatically clones the private wallpaper repository (private-wallpaper) via SSH, or falls back gracefully to the public wallpaper collection.

Fleet Rekeying & Secret Propagation

Because secrets are encrypted with public keys in secrets/keys.nix, the new machine’s keys must be pushed to git, rekeyed from an existing authorized machine, and pulled back down:

1. On the New Machine:

Commit and push the generated hardware-configuration.nix and updated secrets/keys.nix:

Terminal window
git lazy "feat(<host_name>): add host keys and hardware configuration"

2. On an Authorized Machine (e.g. framework16):

Pull the changes, re-encrypt the agenix secrets with the new host’s public key, and push:

Terminal window
git pull
cd secrets
agenix --rekey
git lazy "chore(secrets): rekey secrets for <host_name>"

3. Back on the New Machine:

Pull the re-encrypted secret files and trigger a system rebuild:

Terminal window
git pull
nrs

Your new machine is now fully provisioned and synchronized with the fleet.