Adding a New Host¶

Checklist for onboarding a new machine into the ndots fleet. Service-specific setup (syncthing, beszel) is documented in each service's own page.

1. Age Key¶

Every host needs an age key for sops decryption.

# On the new host:
mkdir -p ~/.config/sops/age
nix run nixpkgs#age-keygen -o ~/.config/sops/age/keys.txt

# Print the public key (needed for .sops.yaml):
nix run nixpkgs#age-keygen -y ~/.config/sops/age/keys.txt

Add the public key to .sops.yaml:

keys:
  - &newhost age1xxxxxx...

Then add newhost to the appropriate creation_rules key group (office for server.yaml/office.yaml, personal for keys.yaml).

Re-encrypt existing sops files so the new host can decrypt them:

SOPS_AGE_KEY_FILE=~/.config/sops/age/keys.txt \
  nix run nixpkgs#sops -- --output-type yaml -d secrets/server.yaml | \
  SOPS_AGE_KEY_FILE=~/.config/sops/age/keys.txt \
  nix run nixpkgs#sops -- -e --input-type yaml /dev/stdin > secrets/server.yaml

2. Host Config¶

Create hosts/nixos/<hostname>/:

hosts/nixos/<hostname>/
  default.nix       # imports common/cloud.nix (VPS) or common/workstation.nix (desktop)
  hardware.nix      # generated by nixos-generate-config
  disk.nix          # disko partitioning (if fresh install)
  users/<user>.nix  # home-manager imports

Add the user to config.nix:

users.<hostname> = {
  username = "<username>";
  inherit (me) fullname email sshPublicKeys;
};

3. Tailscale¶

Tailscale auth key goes in sops. For a new host using server.yaml:

# Generate a reusable auth key at https://login.tailscale.com/admin/settings/keys
SOPS_AGE_KEY_FILE=~/.config/sops/age/keys.txt \
  nix run nixpkgs#sops -- -i secrets/server.yaml
# Add: tailscale_auth_key: tskey-auth-xxxxx

The shared module (nixosModules.tailscale) reads it automatically - no per-host config needed beyond what cloud.nix or workstation.nix already wires.

4. Services¶

Each service has its own onboarding steps in its docs page:

5. Deploy¶

just deploy <hostname>

Verify services are running:

systemctl status tailscaled
systemctl status beszel-agent
systemctl --user status syncthing