Everything changed - major rewrite

2026-06-07 00:59:22 +03:00
parent 08e8b5edbe
commit 261cf892dd
20 changed files with 673 additions and 139 deletions
@@ -0,0 +1,160 @@
+# Attic — Post-Deployment Setup
+
+Steps to run once after the first `nixos-rebuild switch` with `homey.attic.enable = true`.
+
+**Status as of 2026-05-30:** all steps complete. Cache `main` is live at
+`https://attic.zakobar.com/main`. Lauretta is logged in and can push/pull.
+
+---
+
+## Known values
+
+| Item | Value |
+|------|-------|
+| Server URL | `https://attic.zakobar.com` |
+| Cache name | `main` |
+| Binary cache endpoint | `https://attic.zakobar.com/main` |
+| Public signing key | `main:9SZt/6plBU7jjQzz90J7O011I13hmJvOMYouxNqExNQ=` |
+| Cache visibility | Private (token required to pull) |
+| GC retention | 90 days |
+| Attic login (lauretta) | `~/.config/attic/config.toml` → server `homey` |
+
+---
+
+## Token reference
+
+Tokens are stateless signed JWTs — the server does not store them. If you lose
+one, regenerate it with the same command; it will work identically to the original.
+
+### Admin token (full access)
+
+```bash
+ssh admin@192.168.1.100 \
+  "sudo podman exec attic atticadm -f /etc/attic/server.toml make-token \
+    --sub admin \
+    --validity '10y' \
+    --pull '*' \
+    --push '*' \
+    --delete '*' \
+    --create-cache '*' \
+    --configure-cache '*' \
+    --configure-cache-retention '*' \
+    --destroy-cache '*'"
+```
+
+### Pull-only token (for non-admin clients)
+
+```bash
+ssh admin@192.168.1.100 \
+  "sudo podman exec attic atticadm -f /etc/attic/server.toml make-token \
+    --sub nixos-client \
+    --validity '10y' \
+    --pull '*'"
+```
+
+### Push-only token (e.g. for CI)
+
+```bash
+ssh admin@192.168.1.100 \
+  "sudo podman exec attic atticadm -f /etc/attic/server.toml make-token \
+    --sub ci \
+    --validity '10y' \
+    --push 'main'"
+```
+
+---
+
+## Configuring a new client machine
+
+### 1. Add to `~/.config/nix/nix.conf`
+
+```
+extra-substituters = https://attic.zakobar.com/main
+extra-trusted-public-keys = main:9SZt/6plBU7jjQzz90J7O011I13hmJvOMYouxNqExNQ=
+```
+
+### 2. Add pull token to `~/.netrc`
+
+Generate a pull-only token (see above), then append to `~/.netrc`:
+
+```
+machine attic.zakobar.com
+  login token
+  password <pull-token>
+```
+
+### 3. Log in for pushing (optional)
+
+```bash
+nix run github:zhaofengli/attic -- login homey https://attic.zakobar.com <admin-or-push-token>
+```
+
+### 4. Verify
+
+```bash
+nix store ping --store https://attic.zakobar.com/main
+```
+
+---
+
+## Pushing builds
+
+```bash
+# Push a specific path and its closure
+nix run github:zhaofengli/attic -- push homey:main <path>
+
+# Push the current system closure
+nix run github:zhaofengli/attic -- push homey:main /run/current-system
+
+# Push after a nix build
+nix build .#nixosConfigurations.pi-main.config.system.build.toplevel
+nix run github:zhaofengli/attic -- push homey:main ./result
+
+# Watch the store and push all new paths as they are built
+nix run github:zhaofengli/attic -- watch-store homey:main
+```
+
+Paths already signed by `cache.nixos.org` are skipped automatically.
+
+---
+
+## Monitoring
+
+- **Uptime Kuma**: monitor configured automatically via the NixOS module (5 min interval)
+- **Disk usage**: `ssh admin@192.168.1.100 "du -sh /mnt/data/attic/"`
+- **Grafana**: node exporter tracks `/mnt/data` filesystem usage
+- **Logs**: `ssh admin@192.168.1.100 "journalctl -u podman-attic -n 50"`
+
+### Manual GC
+
+```bash
+ssh admin@192.168.1.100 \
+  "sudo podman exec attic atticadm -f /etc/attic/server.toml run-gc"
+```
+
+---
+
+## Signing key rotation
+
+If the signing key is ever compromised or needs rotating:
+
+```bash
+nix run github:zhaofengli/attic -- cache configure homey:main --regenerate-keypair
+nix run github:zhaofengli/attic -- cache info homey:main  # get new public key
+```
+
+Then update `trusted-public-keys` in `hosts/pi-main/default.nix` and on all client machines.
+
+---
+
+## Initial setup steps (completed 2026-05-30)
+
+For reference — these were run once during first deployment.
+
+1. Deployed NixOS config with `homey.attic.enable = true`
+2. Added `attic.zakobar.com` to Cloudflare Tunnel dashboard
+3. Generated admin token via `atticadm` inside container
+4. Logged in: `attic login homey https://attic.zakobar.com <token>`
+5. Created cache: `attic cache create homey:main` (Attic generates signing key server-side)
+6. Added public key and substituter to `hosts/pi-main/default.nix`
+7. Configured lauretta: `~/.config/nix/nix.conf` + `~/.netrc`