# Create a new host

### Base config
there is an example config [here](../files/base_host.md) *note: TODO*
## If this is a physical host
Create the keys and secrets using `add-host-keys`
This will ask for a hostname and then
- create and encrypt a ssh-key with sops
- create and encrypt a second ssh-key for the init
- convert the main key to a sops pubkey and display it
- create public/private wireguard keys and display the pubkey
- generate a reproducible mac-address

After this you have to
- write the age public key into machines/.sops.yaml under `keys:`
- write a new creation rule for the `secrets.yaml` under `creation_rules:` like
```
creation_rules:
  - path_regex: {hostname}/secrets.yaml$
    key_groups:
    - pgp:
      - *admin_kalipso
      - *admin_kalipso_dsktp
      age:
      - *admin_atlan
      - *machine_{hostname}
```
- create the secrets.yaml using `sops {hostname}/secrets.yaml`
    - you can already add `wg_private: {wg priv key}` here
- add the host to the `hosts.nix` file (if microvm use the generated mac here)
- add the host to `machines/modules/malobeo/peers.nix` for vpn access (use the wireguard pubkey here)

# deploy the host with nixos-anywhere
We use a nixos-anywhere wrapper script to deploy new hosts.
The wrapper script takes care of copying persistent host keys before calling nixos-anywhere.

To accomplish that boot the host from a nixos image and setup a root password.
``` bash
sudo su
passwd
```

After that get the hosts ip using `ip a` and start deployment from your own machine:

``` bash
# from infrastrucutre repository root dir:
nix develop .#
remote-install hostname 10.0.42.23
```

# Testing Disko
Testing disko partitioning is working quite well. Just run the following and check the datasets in the vm:
```bash
nix run -L .\#nixosConfigurations.fanny.config.system.build.vmWithDisko
```