dantefromhell: Me too, I've been hacking on solutions for a while. My primary provider is hetzner (both cloud and bare-metal) and my general approach was to write a small script which collects info like hostname, available disks, network config, etc from a rescue system, then uses kexec to switch into a "live" nixos system while passing the collected info via kernel commandline and then partitioning and installing nixos from there on as normal.

My first implementation is available at https://github.com/dep-sys/nixos-zfs-installer but ended up with huge kexec images, so after learning more about nix(os) and looking into not-os in between, I restarted with https://github.com/dep-sys/nix-dabei.

That's not finished yet, but works for me and the general approach should be pretty portable between providers. Also because it should be rather trivial to build an iso or efi executable for the same expression used for kexec. same for netboot, but i haven't looked into that yet

In reply to @dantefromhell:matrix.org
Your approach to `nix-dabei` seems fairly similar to what I pondered a minimal `netboot` could look like 🤔

What would it take to get the zfs & raspberry features working (not necessarily both at the same time)? Those are hard requirements for a good solution in my environment

In reply to @kritnich:kritni.ch
I saw there is a way to make services dependent on certain keys. Is there a way to make services restart/reload once a key has been changed?

For each secret file deployed using deployment.keys, a systemd service with the name of ${name}-key.service is created

So you can do something like:

systemd.services.<name>.partOf = ["secret-key.service"];

In reply to @buckley310:matrix.org
$SSH_CONFIG_FILE

In reply to @buckley310:matrix.org
I seem to recall finding it in some documentation somewhere, but I’m not totally sure

In reply to @huyage:matrix.org

For each secret file deployed using deployment.keys, a systemd service with the name of ${name}-key.service is created

So you can do something like:

systemd.services.<name>.partOf = ["secret-key.service"];

In reply to @kritnich:kritni.ch
Thanks for the pointer, I'm not sure if that will work because I don't think the service restarts since it only checks for existence and not modification in ${secret}-key.path but I'll test around a little

In reply to @kritnich:kritni.ch
Thanks for the pointer, I'm not sure if that will work because I don't think the service restarts since it only checks for existence and not modification in ${secret}-key.path but I'll test around a little