Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Garuda Linux server configurations

built with nix deploy docs

General information

  • Our current infrastructure is hosted in two of these.
  • The servers are being backed up to Hetzner storage boxes via Borg, driven by borgmatic.
  • After multiple different setups, we settled on NixOS as our main OS as it provides reproducible and atomically updated system states
  • Cloudflare protects most (sub)domains while also making use of its caching feature. Exemptions are services such as our mail server and parts violating Cloudflares rules such as proxying Mastodon video content.
  • Cloudflare Access in combination with Cloudflared is used to secure access to high-risk services such as admin panels.
  • Monitoring and alerting are self-hosted, based on Prometheus, Grafana, Loki and Alertmanager (see Monitoring).

Dev shell and how to enter it

This NixOS flake provides a plain pkgs.mkShell dev shell which contains all deployment tools as well as handy commands for common tasks. The only requirement for using it is having the Nix package manager available. It can be installed on various distributions via the package manager or the following script (click me for more information):

curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix -o nix-install.sh # Check its content afterwards
sh ./nix-install.sh install --diagnostic-endpoint=""

This installs the Nix packages with flakes already pre-enabled. After that, the shell can be invoked as follows:

nix develop # The intended way to use the devshell
nix-shell # Legacy, non-flakes way if flakes are not available for some reason

This also sets up pre-commit-hooks and lists the available commands, which can be executed by running them. The tools colmena, dnscontrol, git, prek and sops are on the PATH as well.

Welcome to Garuda's infra-nix shell ❄️
  deploy          Builds and switches the servers to the local configuration (args go to colmena apply, e.g. --on aerialis)
  clean           Runs the garbage collection on the servers
  update          Bumps flake.lock and deploys it to the servers for the next boot
  restart         Restarts all physical servers
  topology        Renders the infrastructure diagrams (nix-topology) to docs/src/topology
  buildiso-remote Spawns a buildiso shell on the iso-runner builder
  buildiso-local  Spawns a local buildiso shell to build to ./buildiso (needs Docker)