Aner Zakobar
161 lines
4.2 KiB
Markdown
161 lines
4.2 KiB
Markdown
# Attic — Post-Deployment Setup
|
|
|
|
Steps to run once after the first `nixos-rebuild switch` with `homey.attic.enable = true`.
|
|
|
|
**Status as of 2026-05-30:** all steps complete. Cache `main` is live at
|
|
`https://attic.zakobar.com/main`. Lauretta is logged in and can push/pull.
|
|
|
|
---
|
|
|
|
## Known values
|
|
|
|
| Item | Value |
|
|
|------|-------|
|
|
| Server URL | `https://attic.zakobar.com` |
|
|
| Cache name | `main` |
|
|
| Binary cache endpoint | `https://attic.zakobar.com/main` |
|
|
| Public signing key | `main:9SZt/6plBU7jjQzz90J7O011I13hmJvOMYouxNqExNQ=` |
|
|
| Cache visibility | Private (token required to pull) |
|
|
| GC retention | 90 days |
|
|
| Attic login (lauretta) | `~/.config/attic/config.toml` → server `homey` |
|
|
|
|
---
|
|
|
|
## Token reference
|
|
|
|
Tokens are stateless signed JWTs — the server does not store them. If you lose
|
|
one, regenerate it with the same command; it will work identically to the original.
|
|
|
|
### Admin token (full access)
|
|
|
|
```bash
|
|
ssh admin@192.168.1.100 \
|
|
"sudo podman exec attic atticadm -f /etc/attic/server.toml make-token \
|
|
--sub admin \
|
|
--validity '10y' \
|
|
--pull '*' \
|
|
--push '*' \
|
|
--delete '*' \
|
|
--create-cache '*' \
|
|
--configure-cache '*' \
|
|
--configure-cache-retention '*' \
|
|
--destroy-cache '*'"
|
|
```
|
|
|
|
### Pull-only token (for non-admin clients)
|
|
|
|
```bash
|
|
ssh admin@192.168.1.100 \
|
|
"sudo podman exec attic atticadm -f /etc/attic/server.toml make-token \
|
|
--sub nixos-client \
|
|
--validity '10y' \
|
|
--pull '*'"
|
|
```
|
|
|
|
### Push-only token (e.g. for CI)
|
|
|
|
```bash
|
|
ssh admin@192.168.1.100 \
|
|
"sudo podman exec attic atticadm -f /etc/attic/server.toml make-token \
|
|
--sub ci \
|
|
--validity '10y' \
|
|
--push 'main'"
|
|
```
|
|
|
|
---
|
|
|
|
## Configuring a new client machine
|
|
|
|
### 1. Add to `~/.config/nix/nix.conf`
|
|
|
|
```
|
|
extra-substituters = https://attic.zakobar.com/main
|
|
extra-trusted-public-keys = main:9SZt/6plBU7jjQzz90J7O011I13hmJvOMYouxNqExNQ=
|
|
```
|
|
|
|
### 2. Add pull token to `~/.netrc`
|
|
|
|
Generate a pull-only token (see above), then append to `~/.netrc`:
|
|
|
|
```
|
|
machine attic.zakobar.com
|
|
login token
|
|
password <pull-token>
|
|
```
|
|
|
|
### 3. Log in for pushing (optional)
|
|
|
|
```bash
|
|
nix run github:zhaofengli/attic -- login homey https://attic.zakobar.com <admin-or-push-token>
|
|
```
|
|
|
|
### 4. Verify
|
|
|
|
```bash
|
|
nix store ping --store https://attic.zakobar.com/main
|
|
```
|
|
|
|
---
|
|
|
|
## Pushing builds
|
|
|
|
```bash
|
|
# Push a specific path and its closure
|
|
nix run github:zhaofengli/attic -- push homey:main <path>
|
|
|
|
# Push the current system closure
|
|
nix run github:zhaofengli/attic -- push homey:main /run/current-system
|
|
|
|
# Push after a nix build
|
|
nix build .#nixosConfigurations.pi-main.config.system.build.toplevel
|
|
nix run github:zhaofengli/attic -- push homey:main ./result
|
|
|
|
# Watch the store and push all new paths as they are built
|
|
nix run github:zhaofengli/attic -- watch-store homey:main
|
|
```
|
|
|
|
Paths already signed by `cache.nixos.org` are skipped automatically.
|
|
|
|
---
|
|
|
|
## Monitoring
|
|
|
|
- **Uptime Kuma**: monitor configured automatically via the NixOS module (5 min interval)
|
|
- **Disk usage**: `ssh admin@192.168.1.100 "du -sh /mnt/data/attic/"`
|
|
- **Grafana**: node exporter tracks `/mnt/data` filesystem usage
|
|
- **Logs**: `ssh admin@192.168.1.100 "journalctl -u podman-attic -n 50"`
|
|
|
|
### Manual GC
|
|
|
|
```bash
|
|
ssh admin@192.168.1.100 \
|
|
"sudo podman exec attic atticadm -f /etc/attic/server.toml run-gc"
|
|
```
|
|
|
|
---
|
|
|
|
## Signing key rotation
|
|
|
|
If the signing key is ever compromised or needs rotating:
|
|
|
|
```bash
|
|
nix run github:zhaofengli/attic -- cache configure homey:main --regenerate-keypair
|
|
nix run github:zhaofengli/attic -- cache info homey:main # get new public key
|
|
```
|
|
|
|
Then update `trusted-public-keys` in `hosts/pi-main/default.nix` and on all client machines.
|
|
|
|
---
|
|
|
|
## Initial setup steps (completed 2026-05-30)
|
|
|
|
For reference — these were run once during first deployment.
|
|
|
|
1. Deployed NixOS config with `homey.attic.enable = true`
|
|
2. Added `attic.zakobar.com` to Cloudflare Tunnel dashboard
|
|
3. Generated admin token via `atticadm` inside container
|
|
4. Logged in: `attic login homey https://attic.zakobar.com <token>`
|
|
5. Created cache: `attic cache create homey:main` (Attic generates signing key server-side)
|
|
6. Added public key and substituter to `hosts/pi-main/default.nix`
|
|
7. Configured lauretta: `~/.config/nix/nix.conf` + `~/.netrc`
|