asxpi/iac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

nixos: runbook for the move, tested restore

Browse source 
Write down the cutover for asxpio-services step by step, with the
times measured in the rehearsal: backup 6 minutes, restore of 29 GB
3 minutes.

The backup script now tolerates files changing under tar in live mode,
which a running Minecraft world always does; in final mode, with the
servers stopped, that remains an error. The restore script can leave
the containers stopped for a restore test.

Also checked on the test server before it was deleted: the production
network layout (interfaces matched by MAC, static IPv6, the private
network on enp7s0) comes up after a reboot with the same routes the
Debian host has.

Assisted-by: Claude:fable-5-2
This commit is contained in:
Sergei Poljanski 2026-11-12 17:13:02 +04:00
commit 131124e0de
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
4 changed files with 111 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
nixos/README.md
View file

@ -83,3 +83,13 @@ and the steps above install onto it.
`.#rehearsal` is the same system for a throwaway server: plain DHCP, SSH
from anywhere, no WireGuard, dummy secrets. Use it to try an install or
a risky change before production.
Its secrets are encrypted for a host key that was thrown away with the
last test server. For a new one, generate a key, put its age recipient
in `.sops.yaml` and re-encrypt:
```sh
ssh-keygen -t ed25519 -N '' -f extra/etc/ssh/ssh_host_ed25519_key
nix run nixpkgs#ssh-to-age < extra/etc/ssh/ssh_host_ed25519_key.pub # -> &rehearsal
sops updatekeys secrets/rehearsal.yaml
```