So I have carota-sativa installed on Luggage, can spice into it from Telchar, XDM works, CTWM also works, but I'm sshing in for the time being.
Let the fun begin!
13
Replies
0
Boosts
First things first: git, rust, curl installed, so I can get basic things done. Since I need an editor slightly more advanced than the system's vi, I'm gonna grab vim-classic from pkgsrc-wip.
I'll probably set my user's shell to fish too.
Then... then I need to figure out how to keep the system sanely manageable.
I'm forever spoiled by using a declarative distribution, where I can have one single place that declares my entire system.
I don't think I can easily do that for NetBSD, but... having a record of packages I installed, the config files I edited, and a record of other stuff I touched would be nice.
If I can't directly deploy from a declarative configuration, I'd like to be able to go from a base install to whatever I had, preferably without it being "just restore the entire thing from backup lol".
First idea: I can have a shell script that does the necessary setup, and I can have restic do the backing up of non-declarative data.
It won't be entirely declarative, but close enough.
The problem with this is secrets, I'd have to figure something out about those. But I have an idea about that.
Where shall I put this script and stuff? Do I put it into my infrastructure.org repo? I think I will, because then I can have some code sharing, and my entire infra (except my desktop, until I merge that in too) remains in one place.
Current plan is to have a shell script that does the "lets make the current system match what's declared" magic. I'll tangle it out from my infrastructure.org literate config, and deployment is copying out/bsd/<hostname> to <hostname>:/usr/src/local, and running /usr/src/local/sync.sh on the target.
Only problem is bootstrap: /usr/src/local needs to exist and have appropriate permissions so that I can copy stuff. But... hm. I'll deal with that later. For the time being, if I need to restore this thing, I should be able to do a NetBSD install manually, manually copy the stuff, run sync, and restore stuff from backup.
I don't know how to approach backups yet, though - I'm spoiled by impermanence. But I guess I'll have a backups.sh script that can save & restore.
(Tangentially, once I'm done setting carota-sativa up, I'll spin up a Redox OS VM too.)
carota-sativa# ./sync.sh
* Logging started, see /var/log/mhp-sync.log.
* Installing pkgin... already installed.
* Importing pkgin packages...
wip/vim-classic is not available in the repository
calculating dependencies...done.
nothing to do.
* Importing pkgin packages... ok.
So far so good.
I'll soon get to a point where I will have to figure out how to transfer file ownership & permissions. They'll be tangled out owned by my local user on Telchar, 0644. They're not all root:wheel 0644.
I suppose tangling out a /path/to/file owner:group mode file could do the trick.
carota-sativa# ./sync.sh
* Logging started, see /var/log/mhp-sync.log.
* Installing pkgin...already installed.
* Importing pkgin packages...
pkgin import /usr/local/etc/packages.txt
wip/vim-classic is not available in the repository
calculating dependencies...done.
nothing to do.
* Importing pkgin packages... ok.
* Installing pkgsrc current... already installed.
* Installing wip/vim-classic...already installed.
* Installing /usr/pkg/etc/doas.conf... ok.
Didn't need permissions yet! Though, I will, for SSH keys and such, but... those will need some work. The idea is that since I already use sops to store secrets in-repo, I'll store these there, too.
Then, I can copy the relevant sops file over, decrypt it on-host, and write directly to the relevant file, once permissions are set up on it.
Eh. sops will introduce a bit of a bootstrapping problem, but that exists on NixOS too. No big deal.
carota-sativa# ./sync.sh
* Logging started, see /var/log/mhp-sync.log.
* Installing pkgin...already installed.
* Importing pkgin packages...
wip/vim-classic is not available in the repository
calculating dependencies...done.
nothing to do.
* Importing pkgin packages... ok.
* Installing pkgsrc current... already installed.
* Installing wip/vim-classic...already installed.
* Installing /usr/pkg/etc/doas.conf... ok.
* Installing /etc/rc.conf... ok.
* Installing secret: /etc/age/key... ok.
* Installing secret: /etc/ssh/ssh_host_ed25519_key... ok.
Awesome. It doesn't restart services yet or anything, and always clobbers files, even if they're otherwise unmodified. But it gets the job done.
Pretty much the only thing I need now is backups, but... I'll postpone that to some other day, because there's nothing on that host that I can't rebuild in a jiffy.
And I'm eager to move on to Redox OS, see what I can do there.
