Install and validate Chaos on the physical host #252

New issue

Open

opened 2026-09-23 22:06:29 +01:00 by nimmo · 0 comments

nimmo commented

2026-09-23 22:06:29 +01:00

Owner

Scope

Replace Proxmox on the approved Crucial P1 NVMe with a fresh Chaos NixOS installation and validate the physical host. The user confirmed the Proxmox drive never hosted VMs or data requiring restore. Depends on #251.

Cutover checklist

Prepare the 500 GB Crucial NVMe: 511 MB EFI, 16 GB swap, 449 GB Btrfs with all expected Chaos subvolumes. The Ventoy USB remains untouched.
Build the physical Chaos system closure on electra/Nova and copy it to the installer. Verified /nix/store/bfg76vd29b3i19cxdda9c3ixg5qch413-nixos-system-chaos-26.05.20260922.1bc55b9 is valid there. The runtime closure omits the default nixpkgs flake-registry source after a prior copy stalled on it.
Remount the existing partitions after the installer reboot and hold a temporary sleep inhibitor.
From the live installer, run nixos-install --system /nix/store/bfg76vd29b3i19cxdda9c3ixg5qch413-nixos-system-chaos-26.05.20260922.1bc55b9 --no-channel-copy without --no-root-password; set root password at its prompt. Before reboot, run nixos-enter --root /mnt -c 'passwd nimmo' so nimmo can use sudo.
Boot the new machine.
Generate/use the permanent installed SSH host key, register its SOPS recipient, re-key Chaos secrets, and reissue its Nebula certificate.
Check LAN/SSH, sudo, SOPS decryption, Nebula, Docker, auto-update, backups, and each declared container.
Check public routes and service health, document the deployed revision, then perform a no-op follow-up deployment before closing.

Completion

The physical host runs Chaos workloads with a new identity. Record recovery evidence and update the host/service wiki.

## Scope Replace Proxmox on the approved Crucial P1 NVMe with a fresh Chaos NixOS installation and validate the physical host. The user confirmed the Proxmox drive never hosted VMs or data requiring restore. Depends on #251. ## Cutover checklist - [x] Prepare the 500 GB Crucial NVMe: 511 MB EFI, 16 GB swap, 449 GB Btrfs with all expected Chaos subvolumes. The Ventoy USB remains untouched. - [x] Build the physical Chaos system closure on electra/Nova and copy it to the installer. Verified `/nix/store/bfg76vd29b3i19cxdda9c3ixg5qch413-nixos-system-chaos-26.05.20260922.1bc55b9` is valid there. The runtime closure omits the default nixpkgs flake-registry source after a prior copy stalled on it. - [x] Remount the existing partitions after the installer reboot and hold a temporary sleep inhibitor. - [ ] From the live installer, run `nixos-install --system /nix/store/bfg76vd29b3i19cxdda9c3ixg5qch413-nixos-system-chaos-26.05.20260922.1bc55b9 --no-channel-copy` **without** `--no-root-password`; set root password at its prompt. Before reboot, run `nixos-enter --root /mnt -c 'passwd nimmo'` so `nimmo` can use sudo. - [ ] Boot the new machine. - [ ] Generate/use the permanent installed SSH host key, register its SOPS recipient, re-key Chaos secrets, and reissue its Nebula certificate. - [ ] Check LAN/SSH, sudo, SOPS decryption, Nebula, Docker, auto-update, backups, and each declared container. - [ ] Check public routes and service health, document the deployed revision, then perform a no-op follow-up deployment before closing. ## Completion The physical host runs Chaos workloads with a new identity. Record recovery evidence and update the host/service wiki.

nimmo added this to the Chaos Physical Host Migration milestone

2026-09-23 22:06:29 +01:00

nimmo added the

phase:cutover

phase:validation

host:chaos

labels

2026-09-23 22:06:29 +01:00