Install NixOS on Hetzner Cloud

Note: This article is about installing NixOS on Hetzner Cloud, which provides VPS cloud servers. It is not to be confused with Hetzner Online, which provides dedicated bare-metal servers.

Installation

There are several ways to install NixOS, such as the 'traditional' ISO installation and nixos-infect.

traditional ISO

Create a machine with any OS, such as Ubuntu
Power it off
Mount the available nixos 22.11-minimal ISO
Power the machine back on
Open the console (">_")
Install NixOS as documented at https://nixos.org/manual/nixos/stable/index.html#sec-installation-manual (going for the "Legacy Boot (MBR)" variation)
Power off the machine
Unmount the iso
Power on the machine

disko

TODO: it would be neat to document how to boot from the NixOS ISO and create the machine based on an online description including https://github.com/nix-community/disko specs - should be a quick way to set up bespoke 'throwaway' machines.

nixos-infect

Beside the manual installation, one way to setup NixOS is to replace an existing installation, for example the latest Ubuntu image, with nixos-infect. The installation process follows these steps:

Boot into the existing operating system, preferably Ubuntu or Debian
Login as root or with root permissions
Deploy your SSH public key for the current root user. This key will be used later for authentication into the NixOS system.
Run following script. Replace NIX_CHANNEL variable with the version string you wish to install.

curl https://raw.githubusercontent.com/elitak/nixos-infect/master/nixos-infect | NIX_CHANNEL=nixos-22.11 bash -x

Reboot into NixOS

Declarative

TODO are any of the 'declarative' configuration management systems like NixOps or Terraform able to spin up Hetzner machines according to a particular configuration? If so then it would be nice to document this here :)

Network configuration

Hetzner Cloud offers both IPv4 (/32 subnet) and IPv6 (/64 subnet) connectivity to each machine. The assigned addresses can be looked up on the Hetzner Cloud Console from the "Networking" tab on the instance details. The public IPv4 address of the server can automatically obtained be via DHCP. For IPv6 you have to statically configure both address and gateway.

/etc/nixos/configuration.nix

  systemd.network.enable = true;
  systemd.network.networks."10-wan" = {
    matchConfig.Name = "ens3"; # either ens3 (amd64) or enp1s0 (arm64)
    networkConfig.DHCP = "ipv4";
    address = [
      # replace this address with the one assigned to your instance
      "2a01:4f8:aaaa:bbbb::1/64"
    ];
    routes = [
      { routeConfig.Gateway = "fe80::1"; }
    ];
  };

Static IPv4 configuration

The IPv4 address can also be configured statically. The trick here is, that the gateway needs to be configured with the onlink flag, because it is not in the same subnet as your public IP address, but still very much on that same link.

  systemd.network.networks."10-wan" = {
    networkConfig.DHCP = "no";
    address = [
      # replace this address with the one assigned to your instance
      "A.B.C.D/32"
    ];
    routes = [
      { routeConfig = { Destination = "172.31.1.1"; }; }
      { routeConfig = { Gateway = "172.31.1.1"; GatewayOnLink = true; }; }
    ];
  }