Quick start

These are the commands from the scaffold README. They have not been run yet, so expect to fix things on the first pass. The first run is the test.

You need a machine with Nix and flakes enabled. The repository is not public yet, so for now this means a working copy of the scaffold.

1. Evaluate every host

nix flake lock
./check-hosts.sh

check-hosts.sh evaluates each host and prints its derivation path. Run it before and after a refactor. The paths must match unless you meant to change something.

2. Build the example host

nix build .#nixosConfigurations.example.config.system.build.toplevel

3. Two-minute demo

example and example-strict are the same machine. The only difference is nixmsp.security.baseline. These commands show what that one option changes:

nix eval .#nixosConfigurations.example.config.services.fail2ban.enable
nix eval .#nixosConfigurations.example-strict.config.services.fail2ban.enable
nix eval .#nixosConfigurations.example-strict.config.services.openssh.settings.PasswordAuthentication

Expected output, from reading the code: false, true, false. This has not been confirmed by running it.

4. Break it on purpose

Delete the authorizedKeys line in hosts/example-strict/default.nix and run the third command again. By design, the build fails with a clear message instead of producing a machine you cannot log in to.

Screenshot placeholder

Before real use

The example host uses placeholder hardware settings and a placeholder SSH key. Replace both. Do not deploy the example to a real machine.