diff --git a/nixos/hardware/index.html b/nixos/hardware/index.html
index debfc9f..567c2fb 100644
--- a/nixos/hardware/index.html
+++ b/nixos/hardware/index.html
@@ -1244,7 +1244,9 @@
 <p>Enables cloud-init but turns of non-working dhcp.</p>
 <h3 id="nixosmoduleshardware-hetzner-cloud"><code>nixosModules.hardware-hetzner-cloud</code></h3>
 <p>Hardware configuration for <a href="https://www.hetzner.com/cloud">https://www.hetzner.com/cloud</a> instances.</p>
-<p>The main difference here is that cloud-init is enabled.</p>
+<p>The main difference here is that:
+1. cloud-init is enabled.
+2. the qemu agent is running, to allow password reset to function.</p>
 <h3 id="nixosmoduleshardware-hetzner-cloud-arm"><code>nixosModules.hardware-hetzner-cloud-arm</code></h3>
 <p>Hardware configuration for <a href="https://www.hetzner.com/cloud">https://www.hetzner.com/cloud</a> arm instances.</p>
 <p>The main difference from <code>nixosModules.hardware-hetzner-cloud</code> is using systemd-boot by default.</p>
diff --git a/search/search_index.json b/search/search_index.json
index ed3faf2..9924bc3 100644
--- a/search/search_index.json
+++ b/search/search_index.json
@@ -1 +1 @@
-{"config":{"lang":["en"],"separator":"[\\s\\-]+","pipeline":["stopWordFilter"]},"docs":[{"location":"","title":"Home","text":"<p>Welcome!</p> <p>SrvOS is a collection of NixOS modules that are optimized for servers. They includes many lessons that we gained over the years while deploying servers for our customers. As we like to share, we hope that this project will be useful to you.</p> <p>To get started, start by reading the introductory tutorial, then check the User Guide for more information.</p>"},{"location":"faq/","title":"FAQ","text":"<p>Some questions and answers that haven't been integrated in the documentation yet.</p>"},{"location":"faq/#what-version-of-nixos-should-i-use","title":"What version of NixOS should I use?","text":"<p>SrvOS is currently tested against <code>nixos-unstable</code> and the latest NixOS release. SrvOS itself is automatically updated and tested against the latest version of that channel once a week.</p> <p>If you want to make sure to use a tested version, use the \"follows\" mechanisms of Nix flakes to pull the same version as the one of SrvOS:</p> <pre><code>{\n  inputs.srvos.url = \"github:nix-community/srvos\";\n  # Use the version of nixpkgs that has been tested to work with SrvOS\n  inputs.nixpkgs.follows = \"srvos/nixpkgs\";\n}\n</code></pre>"},{"location":"getting_started/","title":"Getting Started with SrvOS","text":"<p>This project is designed to work in combination with the Linux distribution NixOS or nix-darwin on macOS.</p> <p>In this documentation, we expect the reader to be already familiar with the base operating system, and introduce how to compose it with our own extensions.</p> <p>For NixOS continue reading here, for nix-darwin/macOS read this.</p>"},{"location":"github_actions_runner/","title":"GitHub Actions Runner","text":"<p>GitHub Action Runners are processes that execute the automated jobs you specify in your GitHub Actions workflows. These runners can be hosted on GitHub-hosted infrastructure or your infrastructure. Self-hosted runners run for your project only and are available at no additional cost.</p> <p>This article looks at how to install a GitHub runner in your own NixOS infrastructure, making sure the environment is scalable and secure.</p> <p>We have built a NixOS module that installs one or more self-hosted github action runner, along with a cachix watch store service with the most secure defaults.</p> <p>NOTE: if you intend to run NixOS VM tests you must ensure your hosting provider supports nested virtualization  or use bare-metal hosts, otherwise your tests will take a long time to execute. </p>"},{"location":"github_actions_runner/#authentication","title":"Authentication","text":"<p>In order to use a self-hosted GitHub action runner, you will need to register the runner with your GitHub account or organization. There are three different ways a self hosted runner can register itself on GitHub:</p> <ul> <li>Using a Registration token</li> <li>Using a Personal Authentication token</li> <li>Using a Github app</li> </ul> <p>In this document, I will describe the most secure option: how to connect using a new GitHub App in your organization.</p> <p>To ensure that you have complete control over the permissions that the app requires, you should create your own GitHub Application.</p> <p>First, go to the setting page of your organization: <code>https://github.com/organizations/&lt;YOUR ORGANIZATION&gt;/settings/apps</code></p> <ul> <li>Click on <code>New GitHub App</code>.</li> <li>In \"GitHub App name\" type <code>&lt;YOUR ORGANISATION&gt; App for GitHub runners</code>.</li> <li>In \"Homepage\" fill in your project URL. It is required but won't be used hereafter.</li> <li>Unselect <code>Expire user authorization tokens</code>.</li> <li>Unselect <code>Active</code> in the \"Webhook\" section.</li> <li>In the \"Organization permissions\" select <code>Read and write</code> next to the \"Self-hosted runner\" permission</li> <li>Click on <code>Create GitHub App</code></li> </ul> <p>Once the app is created, the app's settings page will be presented. Scroll to the Private keys section and click the button labeled Generate a private key. You should save securely the generated PEM encoded private key. You will need that private key when you configure the CI. You should also save the generated GitHub App Id.</p> <p>Once created, you should also limit the usage of this github app to your CI hosts public IPs (ipv4 and ipv6).</p> <p>The application can be now be installed in your organization:</p> <ul> <li>Go to <code>https://github.com/organizations/&lt;YOUR ORGANIZATION&gt;/settings/apps</code></li> <li>Click on the Edit button for your newly created GitHub app</li> <li>Click on Install App and choose to install it on your organization</li> </ul> <p>You can now use the NixOS role to install and configure the GitHub self hosted runner in your NixOS CI host.</p> <p>If someone else is configuring the runner for you, you will need to provide him the the generated PEM encoded private key and the GitHub App Id.</p> <p>You can find more information in the Official GitHub App creation documentation.</p>"},{"location":"github_actions_runner/#using-the-nixos-module","title":"Using the NixOS module","text":"<p>The module has been created as a role. Roles are used to define the specific purpose of a node, making it easy to manage and scale your infrastructure.</p> <p>The following options must be configured</p> <p><code>url</code> the full URI to your organization or your repository. This URI has to match with the location where you installed the GitHub App.</p> <p><code>count</code> the number of runners you want to start on the host.</p> <p><code>githubApp.id</code> the Id of the GitHub App that was created.</p> <p><code>githubApp.login</code> the name of your organization / user where the GitHub App was registered.</p> <p><code>githubApp.privateKeyFile</code> the path to the file containing the GitHub App generated PEM encoded private key. This file should be present on the host and deployed as a secret (using sops-nix or agenix).</p> <p><code>cachix.cacheName</code> the name of your cachix organization.</p> <p><code>cachix.tokenFile</code> the path to the file containing your cachix token. This file should also be present on the host and deployed as a secret (using sops-nix or agenix).</p> <p>Example of a module to configure 12 Github runners:</p> <pre><code>roles.github-actions-runner = {\n  url = \"https://github.com/&lt;YOUR ORGANIZATION&gt;\";\n  count = 12;\n  name = \"github-runner\";\n  githubApp = {\n    id = \"&lt;YOUR GENERATED APP ID&gt;\";\n    login = \"&lt;YOUR ORGANIZATION&gt;\";\n    privateKeyFile = config.age.secrets.github-app-runner-private-key.path;\n  };\n  cachix.cacheName = \"&lt;YOUR CACHIX ORGANIZATION&gt;\";\n  cachix.tokenFile = config.age.secrets.cachixToken.path;\n};\n</code></pre>"},{"location":"github_actions_runner/#scaling","title":"Scaling","text":"<p>There are multiple ways to scale your GitHub runners, such as increasing the number of hosts or increasing the number of services on a single host. All services are completely isolated from each other, so there is no real distinction between one or the other approach. Your decision should be based on the compute/memory power your project needs.</p> <p>You now have a fully functional self-hosted runner running on your NixOS infrastructure. If you need any further assistance in managing or improving your CI workflows with Nix, don't hesitate to contact us. Our team of experts is here to help you optimize your CI/CD pipelines and streamline your development process.</p>"},{"location":"help/","title":"Getting help","text":""},{"location":"help/#bugs","title":"Bugs","text":"<p>If you found a bug, feel free to create a new GitHub issue.</p>"},{"location":"help/#feature-development","title":"Feature development","text":"<p>For dedicated help or priority support, we are also available. Here is the best place to contact us: https://numtide.com/contact/.</p>"},{"location":"user_guide/","title":"User guide","text":"<p>This part of the documentation provides reference documentation for day-to-day users. Use the navigation menu to jump around.</p>"},{"location":"darwin/getting_started/","title":"Using SrvOS with nix-darwin","text":""},{"location":"darwin/getting_started/#finding-your-way-around","title":"Finding your way around","text":"<p>This project exports four big categories of NixOS modules which are useful to define a server configuration:</p> <ul> <li>Machine type - these are high-level settings that define the machine type (Eg: common, server or desktop). Only one of those would be included.</li> <li>Configuration mixins - these define addons to be added to the machine configuration. One or more can be added.</li> </ul>"},{"location":"darwin/getting_started/#example","title":"Example","text":"<p>Combining all of those together, here is how your <code>flake.nix</code> might look like, to deploy a GitHub Actions runner on Hetzner:</p> <pre><code>{\n  description = \"My machines flakes\";\n  inputs = {\n    srvos.url = \"github:nix-community/srvos/darwin-support\";\n    # Use the version of nixpkgs that has been tested to work with SrvOS\n    # Alternatively we also support the latest nixos release and unstable\n    nixpkgs.follows = \"srvos/nixpkgs\";\n    nix-darwin.url = \"github:LnL7/nix-darwin\";\n    nix-darwin.inputs.nixpkgs.follows = \"srvos/nixpkgs\";\n  };\n  outputs = { srvos, nix-darwin, ... }: {\n    darwinConfigurations.myHost = nix-darwin.lib.darwinSystem {\n      modules = [\n        # This machine is a server (i.e. CI runner)\n        srvos.darwinModules.server\n        # If a machine is a workstation or laptop, use this instead\n        # srvos.darwinModules.desktop\n\n        # Configured with extra terminfos\n        srvos.darwinModules.mixins-terminfo\n        # Finally add your configuration here\n        ./myHost.nix\n      ];\n    };\n  };\n}\n</code></pre>"},{"location":"darwin/getting_started/#continue","title":"Continue","text":"<p>Now that we have gone over the high-level details, you should have an idea of how to use this project.</p> <p>To dig further, take a look at the User guide.</p>"},{"location":"darwin/mixins/","title":"Configuration mixins","text":"<p>Config extensions for a given machine.</p> <p>One or more can be included per Darwin configuration.</p>"},{"location":"darwin/mixins/#darwimodulesmixins-telegraf","title":"<code>darwiModules.mixins-telegraf</code>","text":"<p>Enables a generic telegraf configuration. <code>nixosModules.mixins-prometheus</code> for monitoring rules targeting this telegraf configuration.</p>"},{"location":"darwin/mixins/#darwinmodulesmixins-terminfo","title":"<code>darwinModules.mixins-terminfo</code>","text":"<p>Extends the terminfo database with often used terminal emulators. Terminfo is used by terminal applications to interfere supported features in the terminal. This is useful when connecting to a server via SSH.</p>"},{"location":"darwin/mixins/#darwinmodulesmixins-nix-experimental","title":"<code>darwinModules.mixins-nix-experimental</code>","text":"<p>Enables all experimental features in nix, that are known safe to use (i.e. are only used when explicitly requested in a build).</p>"},{"location":"darwin/mixins/#darwinmodulesmixins-trusted-nix-caches","title":"<code>darwinModules.mixins-trusted-nix-caches</code>","text":"<p>Add the common list of public nix binary caches that we trust.</p>"},{"location":"darwin/type/","title":"Machine type","text":"<p>Those high-level modules are used to define the type of machine.</p> <p>We expect only one of those to be imported per Darwin configuration.</p>"},{"location":"darwin/type/#common-darwinmodulescommon","title":"Common (<code>darwinModules.common</code>)","text":"<p>Use this module if you are unsure if your darwin module will be used on server or desktop.</p> <ul> <li>Better nix-daemon defaults</li> <li>Better serial console support</li> <li>Colored package diffs on nixos-rebuild</li> <li>Use systemd in initrd by default and networkd as a backend for the   Networking module</li> <li>Do not block on networkd/networkmanager's online target</li> <li>Better zfs defaults</li> <li>Add ssh host keys to well-known Git servers (eg: github)</li> <li>Enable sudo for @wheel users.</li> <li>...</li> </ul>"},{"location":"darwin/type/#server-darwinmodulesserver","title":"Server (<code>darwinModules.server</code>)","text":"<p>Use this for headless systems that are remotely managed via ssh.</p> <ul> <li>Includes everything from common</li> <li>So far nothing else, but this might change over time</li> </ul>"},{"location":"darwin/type/#desktop-darwinmodulesdesktop","title":"Desktop (<code>darwinModules.desktop</code>)","text":"<p>Despite this project being about servers, we wanted to dogfood the common module.</p> <ul> <li>Includes everything from common</li> <li>So far nothing else, but this might change over time</li> </ul>"},{"location":"installation/hetzner_cloud/","title":"Hetzner Cloud installation","text":"<p>\u26a0\ufe0f Only works with VMs that have more than 2GB of RAM.</p> <p>\u26a0\ufe0f This document reflects more of an ideal than reality right now.</p> <ol> <li>Create the VM in Hetzner Cloud, get the IP, IPv6, set the SSH public key.</li> <li>Create a new NixOS configuration in your flake:</li> </ol> <pre><code>{\n  inputs.nixos-anywhere.url = \"github:nix-community/nixos-anywhere\";\n  inputs.srvos.url = \"github:nix-community/srvos\"; \n  inputs.disko.url = \"github:nix-community/disko\";\n\n  outputs = { self, nixos-remote, srvos, disko, nixpkgs }: {\n    nixosConfigurations.my-host = nixpkgs.lib.nixosSystem {\n      system = \"x86_64-linux\";\n      modules = [{ \n        imports = [ \n          srvos.nixosModules.hardware-hetzner-cloud\n          srvos.nixosModules.server\n\n          # Are those together?\n          disko.nixosModules.disko\n          srvos.diskoModules.disk-layout-single-v1\n        ];\n        networking.hostName = \"my-host\";\n        # FIXME: Hetzner Cloud doesn't provide us with that configuration\n        systemd.network.networks.\"10-uplink\".networkConfig.Address = \"2a01:4f9:c010:52fd::1/128\";\n      }];\n    };\n    # TODO other $systems\n    devShells.x86_64-linux.default = with nixpkgs.legacyPackages.x86_64-linux; mkShellNoCC {\n      packages = [\n        # TODO: add nixos-rebuild as a package\n        nixos-anywhere.packages.x86_64-linux.default\n      ];\n    };\n  };\n}\n</code></pre> <ol> <li> <p>Update the hostname and IPv6 address in the config.</p> </li> <li> <p>Bootstrap the NixOS deployment:    <pre><code>$ nix develop\n$ nixos-anywhere --flake .#my-host --target &lt;ip&gt;\n</code></pre></p> </li> </ol> <p>\ud83c\udf89</p> <ol> <li>Pick a nixos deployment tool of your choice! Eg:</li> </ol> <pre><code>$ nixos-rebuild --flake .#my-host --target &lt;ip&gt; switch\n</code></pre>"},{"location":"nixos/getting_started/","title":"Using SrvOS on NixOS","text":""},{"location":"nixos/getting_started/#finding-your-way-around","title":"Finding your way around","text":"<p>This project exports four big categories of NixOS modules which are useful to define a server configuration:</p> <ul> <li>Machine type - these are high-level settings that define the machine type (Eg: common, server or desktop). Only one of those would be included.</li> <li>Machine hardware - these define hardware-related settings for well known hardware. Only one of those would be included. (eg: AWS EC2 instances).</li> <li>Machine role - theses take over a machine for a specific role. Only one of those would be included. (eg: GitHub Actions runner)</li> <li>Configuration mixins - these define addons to be added to the machine configuration. One or more can be added.</li> </ul>"},{"location":"nixos/getting_started/#example","title":"Example","text":"<p>Combining all of those together, here is how your <code>flake.nix</code> might look like, to deploy a GitHub Actions runner on Hetzner:</p> <pre><code>{\n  description = \"My machines flakes\";\n  inputs = {\n    srvos.url = \"github:nix-community/srvos\";\n    # Use the version of nixpkgs that has been tested to work with SrvOS\n    # Alternatively we also support the latest nixos release and unstable\n    nixpkgs.follows = \"srvos/nixpkgs\";\n  };\n  outputs = { self, nixpkgs, srvos }: {\n    nixosConfigurations.myHost = nixpkgs.lib.nixosSystem {\n      system = \"x86_64-linux\";\n      modules = [\n        # This machine is a server\n        srvos.nixosModules.server\n        # Deployed on the AMD Hetzner hardware\n        srvos.nixosModules.hardware-hetzner-amd\n        # Configured with extra terminfos\n        srvos.nixosModules.mixins-terminfo\n        # And designed to run the GitHub Actions runners\n        srvos.nixosModules.roles-github-actions-runner\n        # Finally add your configuration here\n        ./myHost.nix\n      ];\n    };\n  };\n}\n</code></pre>"},{"location":"nixos/getting_started/#continue","title":"Continue","text":"<p>Now that we have gone over the high-level details, you should have an idea of how to use this project.</p> <p>To dig further, take a look at the User guide.</p>"},{"location":"nixos/hardware/","title":"Machine hardware","text":"<p>Hardware modules are used to configure NixOS for well known hardware.</p> <p>We expect only one hardware module to be imported per NixOS configuration.</p> <p>Here are some of the hardwares that are supported:</p>"},{"location":"nixos/hardware/#nixosmoduleshardware-amazon","title":"<code>nixosModules.hardware-amazon</code>","text":"<p>Hardware configuration for https://aws.amazon.com/ec2 instances.</p> <p>The main difference here is that the default userdata service is replaced by cloud-init.</p>"},{"location":"nixos/hardware/#nixosmoduleshardware-digitalocean-droplet","title":"<code>nixosModules.hardware-digitalocean-droplet</code>","text":"<p>Hardware configuration for https://www.digitalocean.com/ instances.</p> <p>Enables cloud-init but turns of non-working dhcp.</p>"},{"location":"nixos/hardware/#nixosmoduleshardware-hetzner-cloud","title":"<code>nixosModules.hardware-hetzner-cloud</code>","text":"<p>Hardware configuration for https://www.hetzner.com/cloud instances.</p> <p>The main difference here is that cloud-init is enabled.</p>"},{"location":"nixos/hardware/#nixosmoduleshardware-hetzner-cloud-arm","title":"<code>nixosModules.hardware-hetzner-cloud-arm</code>","text":"<p>Hardware configuration for https://www.hetzner.com/cloud arm instances.</p> <p>The main difference from <code>nixosModules.hardware-hetzner-cloud</code> is using systemd-boot by default.</p>"},{"location":"nixos/hardware/#nixosmoduleshardware-hetzner-online-amd","title":"<code>nixosModules.hardware-hetzner-online-amd</code>","text":"<p>Hardware configuration for https://www.hetzner.com/dedicated-rootserver bare-metal AMD servers.</p> <p>Introduces some workaround for the particular IPv6 configuration that Hetzner has.</p>"},{"location":"nixos/hardware/#nixosmoduleshardware-hetzner-online-intel","title":"<code>nixosModules.hardware-hetzner-online-intel</code>","text":"<p>Hardware configuration for https://www.hetzner.com/dedicated-rootserver bare-metal Intel servers.</p> <p>Introduces some workaround for the particular IPv6 configuration that Hetzner has.</p>"},{"location":"nixos/hardware/#nixosmoduleshardware-hetzner-online-ex101","title":"<code>nixosModules.hardware-hetzner-online-ex101</code>","text":"<p>Hardware configuration for https://www.hetzner.com/de/dedicated-rootserver/ex101 bare-metal Intel Core i9-13900 servers.</p> <p>Introduces some workaround for crashes under load.</p>"},{"location":"nixos/mixins/","title":"Configuration mixins","text":"<p>Config extensions for a given machine.</p> <p>One or more can be included per NixOS configuration.</p>"},{"location":"nixos/mixins/#nixosmodulesmixins-cloud-init","title":"<code>nixosModules.mixins-cloud-init</code>","text":"<p>Enables cloud-init</p>"},{"location":"nixos/mixins/#nixosmodulesmixins-systemd-boot","title":"<code>nixosModules.mixins-systemd-boot</code>","text":"<p>Configure systemd-boot as bootloader.</p>"},{"location":"nixos/mixins/#nixosmodulesmixins-telegraf","title":"<code>nixosModules.mixins-telegraf</code>","text":"<p>Enables a generic telegraf configuration. <code>nixosModules.mixins-prometheus</code> for monitoring rules targeting this telegraf configuration.</p>"},{"location":"nixos/mixins/#nixosmodulesmixins-terminfo","title":"<code>nixosModules.mixins-terminfo</code>","text":"<p>Extends the terminfo database with often used terminal emulators. Terminfo is used by terminal applications to interfere supported features in the terminal. This is useful when connecting to a server via SSH.</p>"},{"location":"nixos/mixins/#nixosmodulesmixins-prometheus","title":"<code>nixosModules.mixins-prometheus</code>","text":"<p>Enables a Prometheus and configures it with a set of alert rules targeting our <code>nixosModules.mixins-prometheus</code> module.</p>"},{"location":"nixos/mixins/#nixosmodulesmixins-nginx","title":"<code>nixosModules.mixins-nginx</code>","text":"<p>Configure Nginx with recommended settings. Is quite useful when using nginx as a reverse-proxy on the machine to other services.</p>"},{"location":"nixos/mixins/#nixosmodulesmixins-nix-experimental","title":"<code>nixosModules.mixins-nix-experimental</code>","text":"<p>Enables all experimental features in nix, that are known safe to use (i.e. are only used when explicitly requested in a build). This for example unlocks use of containers in the nix sandbox.</p>"},{"location":"nixos/mixins/#nixosmodulesmixins-trusted-nix-caches","title":"<code>nixosModules.mixins-trusted-nix-caches</code>","text":"<p>Add the common list of public nix binary caches that we trust.</p>"},{"location":"nixos/mixins/#nixosmodulesmixins-mdns","title":"<code>nixosModules.mixins-mdns</code>","text":"<p>Enables mDNS support in systemd-networkd. Becomes a no-op if avahi is enabled on the same machine</p>"},{"location":"nixos/role/","title":"Machine role","text":"<p>Roles are special types of NixOS modules that are designed to take over a machine configuration.</p> <p>We assume that only one role is assigned per machine.</p> <p>By making this assumption, we are able to make deeper change to the machine configuration, without having to worry about potential conflicts with other roles.</p>"},{"location":"nixos/role/#github-actions-runner-nixosconfigurationroles-github-actions-runner","title":"GitHub Actions runner (<code>nixosConfiguration.roles-github-actions-runner</code>)","text":"<p>Dedicates the machine to becoming a cluster of GitHub Actions runners. </p>"},{"location":"nixos/role/#nix-remote-builder-nixosconfigurationroles-nix-remote-builder","title":"Nix Remote builder (<code>nixosConfiguration.roles-nix-remote-builder</code>)","text":"<p>Dedicates the machine to acting as a remote builder for Nix. The main use-case we have is to add more build capacity to the GitHub Actions runners, in a star fashion.</p>"},{"location":"nixos/type/","title":"Machine type","text":"<p>Those high-level modules are used to define the type of machine.</p> <p>We expect only one of those to be imported per NixOS configuration.</p>"},{"location":"nixos/type/#common-nixosmodulescommon","title":"Common (<code>nixosModules.common</code>)","text":"<p>Use this module if you are unsure if your nixos module will be used on server or desktop.</p> <ul> <li>Better nix-daemon defaults</li> <li>Better serial console support</li> <li>Colored package diffs on nixos-rebuild</li> <li>Use systemd in initrd by default and networkd as a backend for the   Networking module</li> <li>Do not block on networkd/networkmanager's online target</li> <li>Better zfs defaults</li> <li>Add ssh host keys to well-known Git servers (eg: github)</li> <li>Enable sudo for @wheel users.</li> <li>...</li> </ul>"},{"location":"nixos/type/#server-nixosmodulesserver","title":"Server (<code>nixosModules.server</code>)","text":"<p>Use this for headless systems that are remotely managed via ssh.</p> <ul> <li>Includes everything from common</li> <li>Enables OpenSSH server</li> <li>Disables desktop features like sound</li> <li>Defaults to UTC</li> <li>Configures watchdog for reboot</li> <li>Sets up sudo without password</li> <li>...</li> </ul>"},{"location":"nixos/type/#desktop-nixosmodulesdesktop","title":"Desktop (<code>nixosModules.desktop</code>)","text":"<p>Despite this project being about servers, we wanted to dogfood the common module.</p> <ul> <li>Includes everything from common</li> <li>Use pipewire instead of PulseAudio.</li> </ul>"}]}
\ No newline at end of file
+{"config":{"lang":["en"],"separator":"[\\s\\-]+","pipeline":["stopWordFilter"]},"docs":[{"location":"","title":"Home","text":"<p>Welcome!</p> <p>SrvOS is a collection of NixOS modules that are optimized for servers. They includes many lessons that we gained over the years while deploying servers for our customers. As we like to share, we hope that this project will be useful to you.</p> <p>To get started, start by reading the introductory tutorial, then check the User Guide for more information.</p>"},{"location":"faq/","title":"FAQ","text":"<p>Some questions and answers that haven't been integrated in the documentation yet.</p>"},{"location":"faq/#what-version-of-nixos-should-i-use","title":"What version of NixOS should I use?","text":"<p>SrvOS is currently tested against <code>nixos-unstable</code> and the latest NixOS release. SrvOS itself is automatically updated and tested against the latest version of that channel once a week.</p> <p>If you want to make sure to use a tested version, use the \"follows\" mechanisms of Nix flakes to pull the same version as the one of SrvOS:</p> <pre><code>{\n  inputs.srvos.url = \"github:nix-community/srvos\";\n  # Use the version of nixpkgs that has been tested to work with SrvOS\n  inputs.nixpkgs.follows = \"srvos/nixpkgs\";\n}\n</code></pre>"},{"location":"getting_started/","title":"Getting Started with SrvOS","text":"<p>This project is designed to work in combination with the Linux distribution NixOS or nix-darwin on macOS.</p> <p>In this documentation, we expect the reader to be already familiar with the base operating system, and introduce how to compose it with our own extensions.</p> <p>For NixOS continue reading here, for nix-darwin/macOS read this.</p>"},{"location":"github_actions_runner/","title":"GitHub Actions Runner","text":"<p>GitHub Action Runners are processes that execute the automated jobs you specify in your GitHub Actions workflows. These runners can be hosted on GitHub-hosted infrastructure or your infrastructure. Self-hosted runners run for your project only and are available at no additional cost.</p> <p>This article looks at how to install a GitHub runner in your own NixOS infrastructure, making sure the environment is scalable and secure.</p> <p>We have built a NixOS module that installs one or more self-hosted github action runner, along with a cachix watch store service with the most secure defaults.</p> <p>NOTE: if you intend to run NixOS VM tests you must ensure your hosting provider supports nested virtualization  or use bare-metal hosts, otherwise your tests will take a long time to execute. </p>"},{"location":"github_actions_runner/#authentication","title":"Authentication","text":"<p>In order to use a self-hosted GitHub action runner, you will need to register the runner with your GitHub account or organization. There are three different ways a self hosted runner can register itself on GitHub:</p> <ul> <li>Using a Registration token</li> <li>Using a Personal Authentication token</li> <li>Using a Github app</li> </ul> <p>In this document, I will describe the most secure option: how to connect using a new GitHub App in your organization.</p> <p>To ensure that you have complete control over the permissions that the app requires, you should create your own GitHub Application.</p> <p>First, go to the setting page of your organization: <code>https://github.com/organizations/&lt;YOUR ORGANIZATION&gt;/settings/apps</code></p> <ul> <li>Click on <code>New GitHub App</code>.</li> <li>In \"GitHub App name\" type <code>&lt;YOUR ORGANISATION&gt; App for GitHub runners</code>.</li> <li>In \"Homepage\" fill in your project URL. It is required but won't be used hereafter.</li> <li>Unselect <code>Expire user authorization tokens</code>.</li> <li>Unselect <code>Active</code> in the \"Webhook\" section.</li> <li>In the \"Organization permissions\" select <code>Read and write</code> next to the \"Self-hosted runner\" permission</li> <li>Click on <code>Create GitHub App</code></li> </ul> <p>Once the app is created, the app's settings page will be presented. Scroll to the Private keys section and click the button labeled Generate a private key. You should save securely the generated PEM encoded private key. You will need that private key when you configure the CI. You should also save the generated GitHub App Id.</p> <p>Once created, you should also limit the usage of this github app to your CI hosts public IPs (ipv4 and ipv6).</p> <p>The application can be now be installed in your organization:</p> <ul> <li>Go to <code>https://github.com/organizations/&lt;YOUR ORGANIZATION&gt;/settings/apps</code></li> <li>Click on the Edit button for your newly created GitHub app</li> <li>Click on Install App and choose to install it on your organization</li> </ul> <p>You can now use the NixOS role to install and configure the GitHub self hosted runner in your NixOS CI host.</p> <p>If someone else is configuring the runner for you, you will need to provide him the the generated PEM encoded private key and the GitHub App Id.</p> <p>You can find more information in the Official GitHub App creation documentation.</p>"},{"location":"github_actions_runner/#using-the-nixos-module","title":"Using the NixOS module","text":"<p>The module has been created as a role. Roles are used to define the specific purpose of a node, making it easy to manage and scale your infrastructure.</p> <p>The following options must be configured</p> <p><code>url</code> the full URI to your organization or your repository. This URI has to match with the location where you installed the GitHub App.</p> <p><code>count</code> the number of runners you want to start on the host.</p> <p><code>githubApp.id</code> the Id of the GitHub App that was created.</p> <p><code>githubApp.login</code> the name of your organization / user where the GitHub App was registered.</p> <p><code>githubApp.privateKeyFile</code> the path to the file containing the GitHub App generated PEM encoded private key. This file should be present on the host and deployed as a secret (using sops-nix or agenix).</p> <p><code>cachix.cacheName</code> the name of your cachix organization.</p> <p><code>cachix.tokenFile</code> the path to the file containing your cachix token. This file should also be present on the host and deployed as a secret (using sops-nix or agenix).</p> <p>Example of a module to configure 12 Github runners:</p> <pre><code>roles.github-actions-runner = {\n  url = \"https://github.com/&lt;YOUR ORGANIZATION&gt;\";\n  count = 12;\n  name = \"github-runner\";\n  githubApp = {\n    id = \"&lt;YOUR GENERATED APP ID&gt;\";\n    login = \"&lt;YOUR ORGANIZATION&gt;\";\n    privateKeyFile = config.age.secrets.github-app-runner-private-key.path;\n  };\n  cachix.cacheName = \"&lt;YOUR CACHIX ORGANIZATION&gt;\";\n  cachix.tokenFile = config.age.secrets.cachixToken.path;\n};\n</code></pre>"},{"location":"github_actions_runner/#scaling","title":"Scaling","text":"<p>There are multiple ways to scale your GitHub runners, such as increasing the number of hosts or increasing the number of services on a single host. All services are completely isolated from each other, so there is no real distinction between one or the other approach. Your decision should be based on the compute/memory power your project needs.</p> <p>You now have a fully functional self-hosted runner running on your NixOS infrastructure. If you need any further assistance in managing or improving your CI workflows with Nix, don't hesitate to contact us. Our team of experts is here to help you optimize your CI/CD pipelines and streamline your development process.</p>"},{"location":"help/","title":"Getting help","text":""},{"location":"help/#bugs","title":"Bugs","text":"<p>If you found a bug, feel free to create a new GitHub issue.</p>"},{"location":"help/#feature-development","title":"Feature development","text":"<p>For dedicated help or priority support, we are also available. Here is the best place to contact us: https://numtide.com/contact/.</p>"},{"location":"user_guide/","title":"User guide","text":"<p>This part of the documentation provides reference documentation for day-to-day users. Use the navigation menu to jump around.</p>"},{"location":"darwin/getting_started/","title":"Using SrvOS with nix-darwin","text":""},{"location":"darwin/getting_started/#finding-your-way-around","title":"Finding your way around","text":"<p>This project exports four big categories of NixOS modules which are useful to define a server configuration:</p> <ul> <li>Machine type - these are high-level settings that define the machine type (Eg: common, server or desktop). Only one of those would be included.</li> <li>Configuration mixins - these define addons to be added to the machine configuration. One or more can be added.</li> </ul>"},{"location":"darwin/getting_started/#example","title":"Example","text":"<p>Combining all of those together, here is how your <code>flake.nix</code> might look like, to deploy a GitHub Actions runner on Hetzner:</p> <pre><code>{\n  description = \"My machines flakes\";\n  inputs = {\n    srvos.url = \"github:nix-community/srvos/darwin-support\";\n    # Use the version of nixpkgs that has been tested to work with SrvOS\n    # Alternatively we also support the latest nixos release and unstable\n    nixpkgs.follows = \"srvos/nixpkgs\";\n    nix-darwin.url = \"github:LnL7/nix-darwin\";\n    nix-darwin.inputs.nixpkgs.follows = \"srvos/nixpkgs\";\n  };\n  outputs = { srvos, nix-darwin, ... }: {\n    darwinConfigurations.myHost = nix-darwin.lib.darwinSystem {\n      modules = [\n        # This machine is a server (i.e. CI runner)\n        srvos.darwinModules.server\n        # If a machine is a workstation or laptop, use this instead\n        # srvos.darwinModules.desktop\n\n        # Configured with extra terminfos\n        srvos.darwinModules.mixins-terminfo\n        # Finally add your configuration here\n        ./myHost.nix\n      ];\n    };\n  };\n}\n</code></pre>"},{"location":"darwin/getting_started/#continue","title":"Continue","text":"<p>Now that we have gone over the high-level details, you should have an idea of how to use this project.</p> <p>To dig further, take a look at the User guide.</p>"},{"location":"darwin/mixins/","title":"Configuration mixins","text":"<p>Config extensions for a given machine.</p> <p>One or more can be included per Darwin configuration.</p>"},{"location":"darwin/mixins/#darwimodulesmixins-telegraf","title":"<code>darwiModules.mixins-telegraf</code>","text":"<p>Enables a generic telegraf configuration. <code>nixosModules.mixins-prometheus</code> for monitoring rules targeting this telegraf configuration.</p>"},{"location":"darwin/mixins/#darwinmodulesmixins-terminfo","title":"<code>darwinModules.mixins-terminfo</code>","text":"<p>Extends the terminfo database with often used terminal emulators. Terminfo is used by terminal applications to interfere supported features in the terminal. This is useful when connecting to a server via SSH.</p>"},{"location":"darwin/mixins/#darwinmodulesmixins-nix-experimental","title":"<code>darwinModules.mixins-nix-experimental</code>","text":"<p>Enables all experimental features in nix, that are known safe to use (i.e. are only used when explicitly requested in a build).</p>"},{"location":"darwin/mixins/#darwinmodulesmixins-trusted-nix-caches","title":"<code>darwinModules.mixins-trusted-nix-caches</code>","text":"<p>Add the common list of public nix binary caches that we trust.</p>"},{"location":"darwin/type/","title":"Machine type","text":"<p>Those high-level modules are used to define the type of machine.</p> <p>We expect only one of those to be imported per Darwin configuration.</p>"},{"location":"darwin/type/#common-darwinmodulescommon","title":"Common (<code>darwinModules.common</code>)","text":"<p>Use this module if you are unsure if your darwin module will be used on server or desktop.</p> <ul> <li>Better nix-daemon defaults</li> <li>Better serial console support</li> <li>Colored package diffs on nixos-rebuild</li> <li>Use systemd in initrd by default and networkd as a backend for the   Networking module</li> <li>Do not block on networkd/networkmanager's online target</li> <li>Better zfs defaults</li> <li>Add ssh host keys to well-known Git servers (eg: github)</li> <li>Enable sudo for @wheel users.</li> <li>...</li> </ul>"},{"location":"darwin/type/#server-darwinmodulesserver","title":"Server (<code>darwinModules.server</code>)","text":"<p>Use this for headless systems that are remotely managed via ssh.</p> <ul> <li>Includes everything from common</li> <li>So far nothing else, but this might change over time</li> </ul>"},{"location":"darwin/type/#desktop-darwinmodulesdesktop","title":"Desktop (<code>darwinModules.desktop</code>)","text":"<p>Despite this project being about servers, we wanted to dogfood the common module.</p> <ul> <li>Includes everything from common</li> <li>So far nothing else, but this might change over time</li> </ul>"},{"location":"installation/hetzner_cloud/","title":"Hetzner Cloud installation","text":"<p>\u26a0\ufe0f Only works with VMs that have more than 2GB of RAM.</p> <p>\u26a0\ufe0f This document reflects more of an ideal than reality right now.</p> <ol> <li>Create the VM in Hetzner Cloud, get the IP, IPv6, set the SSH public key.</li> <li>Create a new NixOS configuration in your flake:</li> </ol> <pre><code>{\n  inputs.nixos-anywhere.url = \"github:nix-community/nixos-anywhere\";\n  inputs.srvos.url = \"github:nix-community/srvos\"; \n  inputs.disko.url = \"github:nix-community/disko\";\n\n  outputs = { self, nixos-remote, srvos, disko, nixpkgs }: {\n    nixosConfigurations.my-host = nixpkgs.lib.nixosSystem {\n      system = \"x86_64-linux\";\n      modules = [{ \n        imports = [ \n          srvos.nixosModules.hardware-hetzner-cloud\n          srvos.nixosModules.server\n\n          # Are those together?\n          disko.nixosModules.disko\n          srvos.diskoModules.disk-layout-single-v1\n        ];\n        networking.hostName = \"my-host\";\n        # FIXME: Hetzner Cloud doesn't provide us with that configuration\n        systemd.network.networks.\"10-uplink\".networkConfig.Address = \"2a01:4f9:c010:52fd::1/128\";\n      }];\n    };\n    # TODO other $systems\n    devShells.x86_64-linux.default = with nixpkgs.legacyPackages.x86_64-linux; mkShellNoCC {\n      packages = [\n        # TODO: add nixos-rebuild as a package\n        nixos-anywhere.packages.x86_64-linux.default\n      ];\n    };\n  };\n}\n</code></pre> <ol> <li> <p>Update the hostname and IPv6 address in the config.</p> </li> <li> <p>Bootstrap the NixOS deployment:    <pre><code>$ nix develop\n$ nixos-anywhere --flake .#my-host --target &lt;ip&gt;\n</code></pre></p> </li> </ol> <p>\ud83c\udf89</p> <ol> <li>Pick a nixos deployment tool of your choice! Eg:</li> </ol> <pre><code>$ nixos-rebuild --flake .#my-host --target &lt;ip&gt; switch\n</code></pre>"},{"location":"nixos/getting_started/","title":"Using SrvOS on NixOS","text":""},{"location":"nixos/getting_started/#finding-your-way-around","title":"Finding your way around","text":"<p>This project exports four big categories of NixOS modules which are useful to define a server configuration:</p> <ul> <li>Machine type - these are high-level settings that define the machine type (Eg: common, server or desktop). Only one of those would be included.</li> <li>Machine hardware - these define hardware-related settings for well known hardware. Only one of those would be included. (eg: AWS EC2 instances).</li> <li>Machine role - theses take over a machine for a specific role. Only one of those would be included. (eg: GitHub Actions runner)</li> <li>Configuration mixins - these define addons to be added to the machine configuration. One or more can be added.</li> </ul>"},{"location":"nixos/getting_started/#example","title":"Example","text":"<p>Combining all of those together, here is how your <code>flake.nix</code> might look like, to deploy a GitHub Actions runner on Hetzner:</p> <pre><code>{\n  description = \"My machines flakes\";\n  inputs = {\n    srvos.url = \"github:nix-community/srvos\";\n    # Use the version of nixpkgs that has been tested to work with SrvOS\n    # Alternatively we also support the latest nixos release and unstable\n    nixpkgs.follows = \"srvos/nixpkgs\";\n  };\n  outputs = { self, nixpkgs, srvos }: {\n    nixosConfigurations.myHost = nixpkgs.lib.nixosSystem {\n      system = \"x86_64-linux\";\n      modules = [\n        # This machine is a server\n        srvos.nixosModules.server\n        # Deployed on the AMD Hetzner hardware\n        srvos.nixosModules.hardware-hetzner-amd\n        # Configured with extra terminfos\n        srvos.nixosModules.mixins-terminfo\n        # And designed to run the GitHub Actions runners\n        srvos.nixosModules.roles-github-actions-runner\n        # Finally add your configuration here\n        ./myHost.nix\n      ];\n    };\n  };\n}\n</code></pre>"},{"location":"nixos/getting_started/#continue","title":"Continue","text":"<p>Now that we have gone over the high-level details, you should have an idea of how to use this project.</p> <p>To dig further, take a look at the User guide.</p>"},{"location":"nixos/hardware/","title":"Machine hardware","text":"<p>Hardware modules are used to configure NixOS for well known hardware.</p> <p>We expect only one hardware module to be imported per NixOS configuration.</p> <p>Here are some of the hardwares that are supported:</p>"},{"location":"nixos/hardware/#nixosmoduleshardware-amazon","title":"<code>nixosModules.hardware-amazon</code>","text":"<p>Hardware configuration for https://aws.amazon.com/ec2 instances.</p> <p>The main difference here is that the default userdata service is replaced by cloud-init.</p>"},{"location":"nixos/hardware/#nixosmoduleshardware-digitalocean-droplet","title":"<code>nixosModules.hardware-digitalocean-droplet</code>","text":"<p>Hardware configuration for https://www.digitalocean.com/ instances.</p> <p>Enables cloud-init but turns of non-working dhcp.</p>"},{"location":"nixos/hardware/#nixosmoduleshardware-hetzner-cloud","title":"<code>nixosModules.hardware-hetzner-cloud</code>","text":"<p>Hardware configuration for https://www.hetzner.com/cloud instances.</p> <p>The main difference here is that: 1. cloud-init is enabled. 2. the qemu agent is running, to allow password reset to function.</p>"},{"location":"nixos/hardware/#nixosmoduleshardware-hetzner-cloud-arm","title":"<code>nixosModules.hardware-hetzner-cloud-arm</code>","text":"<p>Hardware configuration for https://www.hetzner.com/cloud arm instances.</p> <p>The main difference from <code>nixosModules.hardware-hetzner-cloud</code> is using systemd-boot by default.</p>"},{"location":"nixos/hardware/#nixosmoduleshardware-hetzner-online-amd","title":"<code>nixosModules.hardware-hetzner-online-amd</code>","text":"<p>Hardware configuration for https://www.hetzner.com/dedicated-rootserver bare-metal AMD servers.</p> <p>Introduces some workaround for the particular IPv6 configuration that Hetzner has.</p>"},{"location":"nixos/hardware/#nixosmoduleshardware-hetzner-online-intel","title":"<code>nixosModules.hardware-hetzner-online-intel</code>","text":"<p>Hardware configuration for https://www.hetzner.com/dedicated-rootserver bare-metal Intel servers.</p> <p>Introduces some workaround for the particular IPv6 configuration that Hetzner has.</p>"},{"location":"nixos/hardware/#nixosmoduleshardware-hetzner-online-ex101","title":"<code>nixosModules.hardware-hetzner-online-ex101</code>","text":"<p>Hardware configuration for https://www.hetzner.com/de/dedicated-rootserver/ex101 bare-metal Intel Core i9-13900 servers.</p> <p>Introduces some workaround for crashes under load.</p>"},{"location":"nixos/mixins/","title":"Configuration mixins","text":"<p>Config extensions for a given machine.</p> <p>One or more can be included per NixOS configuration.</p>"},{"location":"nixos/mixins/#nixosmodulesmixins-cloud-init","title":"<code>nixosModules.mixins-cloud-init</code>","text":"<p>Enables cloud-init</p>"},{"location":"nixos/mixins/#nixosmodulesmixins-systemd-boot","title":"<code>nixosModules.mixins-systemd-boot</code>","text":"<p>Configure systemd-boot as bootloader.</p>"},{"location":"nixos/mixins/#nixosmodulesmixins-telegraf","title":"<code>nixosModules.mixins-telegraf</code>","text":"<p>Enables a generic telegraf configuration. <code>nixosModules.mixins-prometheus</code> for monitoring rules targeting this telegraf configuration.</p>"},{"location":"nixos/mixins/#nixosmodulesmixins-terminfo","title":"<code>nixosModules.mixins-terminfo</code>","text":"<p>Extends the terminfo database with often used terminal emulators. Terminfo is used by terminal applications to interfere supported features in the terminal. This is useful when connecting to a server via SSH.</p>"},{"location":"nixos/mixins/#nixosmodulesmixins-prometheus","title":"<code>nixosModules.mixins-prometheus</code>","text":"<p>Enables a Prometheus and configures it with a set of alert rules targeting our <code>nixosModules.mixins-prometheus</code> module.</p>"},{"location":"nixos/mixins/#nixosmodulesmixins-nginx","title":"<code>nixosModules.mixins-nginx</code>","text":"<p>Configure Nginx with recommended settings. Is quite useful when using nginx as a reverse-proxy on the machine to other services.</p>"},{"location":"nixos/mixins/#nixosmodulesmixins-nix-experimental","title":"<code>nixosModules.mixins-nix-experimental</code>","text":"<p>Enables all experimental features in nix, that are known safe to use (i.e. are only used when explicitly requested in a build). This for example unlocks use of containers in the nix sandbox.</p>"},{"location":"nixos/mixins/#nixosmodulesmixins-trusted-nix-caches","title":"<code>nixosModules.mixins-trusted-nix-caches</code>","text":"<p>Add the common list of public nix binary caches that we trust.</p>"},{"location":"nixos/mixins/#nixosmodulesmixins-mdns","title":"<code>nixosModules.mixins-mdns</code>","text":"<p>Enables mDNS support in systemd-networkd. Becomes a no-op if avahi is enabled on the same machine</p>"},{"location":"nixos/role/","title":"Machine role","text":"<p>Roles are special types of NixOS modules that are designed to take over a machine configuration.</p> <p>We assume that only one role is assigned per machine.</p> <p>By making this assumption, we are able to make deeper change to the machine configuration, without having to worry about potential conflicts with other roles.</p>"},{"location":"nixos/role/#github-actions-runner-nixosconfigurationroles-github-actions-runner","title":"GitHub Actions runner (<code>nixosConfiguration.roles-github-actions-runner</code>)","text":"<p>Dedicates the machine to becoming a cluster of GitHub Actions runners. </p>"},{"location":"nixos/role/#nix-remote-builder-nixosconfigurationroles-nix-remote-builder","title":"Nix Remote builder (<code>nixosConfiguration.roles-nix-remote-builder</code>)","text":"<p>Dedicates the machine to acting as a remote builder for Nix. The main use-case we have is to add more build capacity to the GitHub Actions runners, in a star fashion.</p>"},{"location":"nixos/type/","title":"Machine type","text":"<p>Those high-level modules are used to define the type of machine.</p> <p>We expect only one of those to be imported per NixOS configuration.</p>"},{"location":"nixos/type/#common-nixosmodulescommon","title":"Common (<code>nixosModules.common</code>)","text":"<p>Use this module if you are unsure if your nixos module will be used on server or desktop.</p> <ul> <li>Better nix-daemon defaults</li> <li>Better serial console support</li> <li>Colored package diffs on nixos-rebuild</li> <li>Use systemd in initrd by default and networkd as a backend for the   Networking module</li> <li>Do not block on networkd/networkmanager's online target</li> <li>Better zfs defaults</li> <li>Add ssh host keys to well-known Git servers (eg: github)</li> <li>Enable sudo for @wheel users.</li> <li>...</li> </ul>"},{"location":"nixos/type/#server-nixosmodulesserver","title":"Server (<code>nixosModules.server</code>)","text":"<p>Use this for headless systems that are remotely managed via ssh.</p> <ul> <li>Includes everything from common</li> <li>Enables OpenSSH server</li> <li>Disables desktop features like sound</li> <li>Defaults to UTC</li> <li>Configures watchdog for reboot</li> <li>Sets up sudo without password</li> <li>...</li> </ul>"},{"location":"nixos/type/#desktop-nixosmodulesdesktop","title":"Desktop (<code>nixosModules.desktop</code>)","text":"<p>Despite this project being about servers, we wanted to dogfood the common module.</p> <ul> <li>Includes everything from common</li> <li>Use pipewire instead of PulseAudio.</li> </ul>"}]}
\ No newline at end of file