Prepare Chaos physical-host configuration and identity #251

New issue

Open

opened 2026-09-23 22:06:18 +01:00 by nimmo · 0 comments

nimmo commented

2026-09-23 22:06:18 +01:00

Owner

Context

Chaos is moving from a Proxmox VM to the physical Intel i7-8700 host booted from the NixOS installer at 192.168.8.244. The only internal drive is a 500 GB Crucial P1 NVMe (/dev/disk/by-id/nvme-CT500P1SSD8_1924E20B3CB9); /dev/sda is the Ventoy installer USB. The user approved wiping the NVMe, confirmed no VMs or data need preserving there, and requested a fresh Chaos installation with a new host identity.

Preparation

Replace QEMU hardware settings with physical Intel/NVMe modules and microcode.
Target only the verified NVMe by stable ID in Disko; retain Btrfs subvolumes and add swap.
Update host inventory and README on feat/chaos-physical-host.
Generate a permanent SSH host key on the mounted target filesystem, then register its public key as Chaos's SOPS age recipient and re-key every encrypted file whose creation rule contains *chaos.
Reissue Chaos's Nebula cert and key for its existing overlay address; avoid any duplicate Chaos identity on the mesh.
Run nix flake check and review the config diff.

Completion

A validated, reviewable branch with usable encrypted secrets is ready for cutover. Do not merge or auto-deploy the physical Disko config onto the VM.

## Context Chaos is moving from a Proxmox VM to the physical Intel i7-8700 host booted from the NixOS installer at 192.168.8.244. The only internal drive is a 500 GB Crucial P1 NVMe (`/dev/disk/by-id/nvme-CT500P1SSD8_1924E20B3CB9`); `/dev/sda` is the Ventoy installer USB. The user approved wiping the NVMe, confirmed no VMs or data need preserving there, and requested a fresh Chaos installation with a new host identity. ## Preparation - [x] Replace QEMU hardware settings with physical Intel/NVMe modules and microcode. - [x] Target only the verified NVMe by stable ID in Disko; retain Btrfs subvolumes and add swap. - [x] Update host inventory and README on `feat/chaos-physical-host`. - [ ] Generate a permanent SSH host key on the mounted target filesystem, then register its public key as Chaos's SOPS age recipient and re-key every encrypted file whose creation rule contains `*chaos`. - [ ] Reissue Chaos's Nebula cert and key for its existing overlay address; avoid any duplicate Chaos identity on the mesh. - [x] Run `nix flake check` and review the config diff. ## Completion A validated, reviewable branch with usable encrypted secrets is ready for cutover. Do not merge or auto-deploy the physical Disko config onto the VM.

nimmo added this to the Chaos Physical Host Migration milestone

2026-09-23 22:06:18 +01:00

nimmo added the

host:chaos

phase:prep

labels

2026-09-23 22:06:18 +01:00

nimmo referenced this issue

2026-09-23 22:06:29 +01:00

Install and validate Chaos on the physical host #252