Rite of Resurrection — RogueLeader

Complete guide to resurrect the RogueLeader home-shrine.

Reference Information

Parameter	Value
Local network	`192.168.0.10` (alias `rogueleader.home`)
Disk	`/dev/sda` (BIOS/GPT via disko)
Architecture	x86_64, Intel KVM
SSH	Directly accessible (public key only, no Tailscale)
sops	Age key derived from `/etc/ssh/ssh_host_ed25519_key`

Prerequisites

Physical or console access to the server
NixOS ISO USB ready
Local network connectivity (DHCP)
exampleHost age key available (for re-encrypting secrets after install) See Reliquary Backup & Restoration
Recent Borg backup verified: BORG_PASSPHRASE=... borg list ssh://backup@storage2.friloux.me/~/rogueleader.friloux.me

Partitioning Summary (disko)

Single disk /dev/sda, GPT:

Partition	Size	Role
part1	1 MB	GRUB BIOS boot
part2	4 GB	swap
part3	remainder	`/` ext4

Unlike clochette, disko manages the NixOS fileSystems — no manual UUID updates needed after reinstall.

Step 1 — Boot on NixOS ISO

Plug in USB, boot from NixOS ISO.

Verify network connectivity (DHCP LAN):

ip addr show
ping -c3 192.168.0.1

Step 2 — Fetch Repository

git clone https://github.com/gfriloux/nixos /tmp/nixos
cd /tmp/nixos

Step 3 — Disk Partitioning with disko

sudo nix run github:nix-community/disko/latest -- \
  --mode destroy,format,mount \
  --flake /tmp/nixos#RogueLeader

disko partitions /dev/sda, formats as ext4, and mounts everything under /mnt.

Verify:

df -h /mnt
mount | grep /mnt

Step 4 — NixOS Installation

sudo nixos-install --flake /tmp/nixos#RogueLeader --no-root-passwd

Step 5 — First Boot

reboot

Remove the USB. System boots into GRUB → NixOS.

SSH is directly accessible from the local network via the public key declared in users.nix:

# From exampleHost
ssh guillaume@rogueleader.home

Step 6 — Update Age Key in sops

The new install generated a new SSH host key → new age key. Without this update, sops cannot decrypt secrets from RogueLeader.

From RogueLeader (connected via SSH):

nix run nixpkgs#ssh-to-age -- -i /etc/ssh/ssh_host_ed25519_key.pub

From exampleHost, update .sops.yaml with the new public key:

cd ~/Apps/github/gfriloux/nixos
nano .sops.yaml
# Replace &server_rogueleader value with the new age key

Re-encrypt secrets/RogueLeader.yaml:

sops updatekeys secrets/RogueLeader.yaml
# Confirm with 'y'

# Verify
sops -d secrets/RogueLeader.yaml

Commit and push:

git add .sops.yaml secrets/RogueLeader.yaml
git commit -m "chore(secrets): rotate RogueLeader age key after reinstall"
git push

Step 7 — Full Deployment from exampleHost

just install_rogueleader --ask-sudo-password

This deploys the complete configuration with secrets now decryptable by the new SSH host key.

To deploy Home Manager:

just home_rogueleader

Step 8 — Data Restoration from Borg (if needed)

# From RogueLeader as root
sudo -i

# List archives
BORG_PASSPHRASE=$(cat /run/secrets/services/borg/passphrase) \
BORG_RSH="ssh -i /run/secrets/services/borg/key/private" \
borg list ssh://backup@storage2.friloux.me/~/rogueleader.friloux.me

# Stop daemons
systemctl stop docker-papra docker-uptime-kuma docker-mealie docker-borg-ui \
                docker-wow-cp-bookstack docker-wow-cp-mariadb docker-wow-cp-mysqldump

# Restore from /
cd /
BORG_PASSPHRASE=$(cat /run/secrets/services/borg/passphrase) \
BORG_RSH="ssh -i /run/secrets/services/borg/key/private" \
borg extract --progress \
  ssh://backup@storage2.friloux.me/~/rogueleader.friloux.me::ARCHIVE_NAME

# Restart services
systemctl start docker-papra docker-uptime-kuma docker-mealie docker-borg-ui \
                docker-wow-cp-bookstack docker-wow-cp-mariadb docker-wow-cp-mysqldump

Step 9 — Final Verification

# Daemons are running
docker ps --format "table {{.Names}}\t{{.Status}}"

# Secrets decrypted
ls /run/secrets/

# Borg backup
systemctl status borgbackup-job-remote