getting-started.sh: fresh NixOS install to a hypervisor with one VM, no forge account

vnprc-agent commented

2026-10-05 20:19:02 +01:00

There is no documented way from a fresh NixOS install to a running Allod hypervisor with one VM. The README's Fork section covers the deploy flake, but a first-time operator also has to: clone the right repos to the paths the host scripts expect, replace the hypervisor hardware module, generate a host identity and re-key every VM host key to it, decide what to do about forge credentials they do not have, point the deploy flake at their data, build the installer image, and rebuild the host. Walked by hand this was too much typing by the first clone.

Proposal: one script, getting-started.sh, fetched with curl from this repo and run on the fresh install as the user who will operate the host. It re-execs under nix-shell with git, age and jq; clones the public repos under ~/work/allod/; copies the machine's /etc/nixos/hardware-configuration.nix over the inventory's hypervisor hardware file; generates ~/.ssh/host and fresh VM host keys encrypted to it; takes the dev VM out of forge access and makes every repo host-provided, so no forge account is needed; points this flake's three data inputs at the local clones; builds the installer image into ~/iso/; and runs nixos-rebuild boot. After a reboot the operator logs in with the password they already have (NixOS keeps mutable users, so the account that ran the script survives the switch) and runs provision-vm allod-dev.

Depends on the inventory hardware-file split, the forge-less bootstrap in allod/nexus, the derived credential entries in allod/secrets, and the hypervisor groups in allod/archetypes.

Found during the public install walk.

There is no documented way from a fresh NixOS install to a running Allod hypervisor with one VM. The README's Fork section covers the deploy flake, but a first-time operator also has to: clone the right repos to the paths the host scripts expect, replace the hypervisor hardware module, generate a host identity and re-key every VM host key to it, decide what to do about forge credentials they do not have, point the deploy flake at their data, build the installer image, and rebuild the host. Walked by hand this was too much typing by the first clone. Proposal: one script, `getting-started.sh`, fetched with `curl` from this repo and run on the fresh install as the user who will operate the host. It re-execs under `nix-shell` with git, age and jq; clones the public repos under `~/work/allod/`; copies the machine's `/etc/nixos/hardware-configuration.nix` over the inventory's hypervisor hardware file; generates `~/.ssh/host` and fresh VM host keys encrypted to it; takes the dev VM out of forge access and makes every repo host-provided, so no forge account is needed; points this flake's three data inputs at the local clones; builds the installer image into `~/iso/`; and runs `nixos-rebuild boot`. After a reboot the operator logs in with the password they already have (NixOS keeps mutable users, so the account that ran the script survives the switch) and runs `provision-vm allod-dev`. Depends on the inventory hardware-file split, the forge-less bootstrap in `allod/nexus`, the derived credential entries in `allod/secrets`, and the hypervisor groups in `allod/archetypes`. Found during the public install walk.