nixos-netcup-vps

NixOS deployment tooling for Netcup VPS instances using the SCP API and a generation-specific UEFI boot ISO.

Status

Early implementation scaffold.

Implemented:

• NixOS module and Netcup VMID metadata
• Architecture-indexed deploy app and package outputs
• Target NixOS configuration evaluation
• Target system build and closure transfer
• Restricted activation helper

Not yet implemented:

• Generation-specific boot ISO creation
• Initrd support for mounting the existing root filesystem
• Netcup API authentication adapter
• ISO upload and assignment orchestration
• Boot verification and automatic rollback

Do not use this version for unattended production deployment.

Build the deploy client

nix build .#deploy

Run it:

nix run .#deploy -- --help

Prepare a deployment

nix run .#deploy -- \
  remote-deploy@vps.example.net \
  github:example/my-infrastructure#my-vps \
  --prepare-only

The client builds the target NixOS system and copies its closure to the remote Nix store.

Netcup metadata

Import nixosModules.vps and configure:

netcup.enable = true;
netcup.vmid = "123456";

Security

• Do not enable SSH root login.
• Use a dedicated deployment identity.
• Protect the Netcup API credentials.
• Review the privileges granted to remote deployment users.
• Verify the ISO boot and rollback path before production use.

API authentication

The referenced netcup-scp-cli currently uses OAuth2 device-code authentication. A direct API-token integration requires a separately verified authentication flow.