From 5e1b3697c863b6241270fa132d75affb8b5eb135 Mon Sep 17 00:00:00 2001
From: mikl <mikl@iscg.dev>
Date: Fri, 26 Jun 2026 02:44:08 +0300
Subject: [PATCH] muscari: switch bootloader to systemd-boot (UEFI)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Changes:
- boot.loader: generic-extlinux-compatible (BIOS) → systemd-boot (UEFI)
- YC standard-v3 VM is UEFI by default; systemd-boot is the modern
  choice for single-disk cloud VMs (no GRUB complexity)
- Comments updated: nixos-anywhere → nixos-install (in tmux), aligning
  with the documented install procedure in projects/servers/muscari/SETUP.md
- .gitignore: add hosts/*/hardware-configuration.nix as defense-in-depth
  (muscari uses disko and has no hw-config file; this guards future hosts
  from leaking UUIDs/MACs to the public forgejo repo)

Context:
- muscari VM specs: 2 vCPU / 8 GB / 100 GB SSD (was incorrectly documented
  as 4/16 in muscari/README.md; fixed there too)
- Flake builds cleanly:
    nix flake show           → nixosConfigurations.muscari
    hostname                 → "muscari"
    systemd-boot.enable      → true
    fileSystems."/"         → ext4 (disko-derived)
    fileSystems."/boot"     → vfat (disko-derived)

Verified: nix --extra-experimental-features 'nix-command flakes' flake show
and eval .#nixosConfigurations.muscari.config.{networking.hostName,
boot.loader.systemd-boot.enable, fileSystems} all pass.

Session: verify plan
---
 .gitignore                |  6 +++++-
 hosts/muscari/default.nix | 10 +++++-----
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/.gitignore b/.gitignore
index 9fdb9f2..673b16c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -21,4 +21,8 @@ devenv.yaml
 # age key (НИКОГДА не коммитить!)
 *.age-key
 *age-keys.txt
-*age-keys.json
\ No newline at end of file
+*age-keys.json
+
+# hardware-configuration per-host (защита от случайного коммита в публичный repo)
+# muscari использует disko и не имеет этого файла — это defense-in-depth для будущих хостов
+hosts/*/hardware-configuration.nix
\ No newline at end of file
diff --git a/hosts/muscari/default.nix b/hosts/muscari/default.nix
index a3d31b6..b201bcd 100644
--- a/hosts/muscari/default.nix
+++ b/hosts/muscari/default.nix
@@ -1,4 +1,4 @@
-# muscari — k3s single-node cluster на YC (Debian 12 → Nix через nixos-anywhere)
+# muscari — k3s single-node cluster на YC (Debian 12 → NixOS 25.11 через nixos-install в tmux)
 # https://git.iscg.dev/mikl/nix-config
 
 { config, pkgs, lib, ... }:
@@ -20,14 +20,14 @@
     ];
   };
 
-  # Bootloader — extlinux (совместимо с YC BIOS boot)
-  boot.loader.grub.enable = false;
-  boot.loader.generic-extlinux-compatible.enable = true;
+  # Bootloader — systemd-boot (UEFI, требуется для YC standard-v3)
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
 
   # fileSystems — определяется через disko (см. disk-config.nix)
   # Не задаём явно fileSystems."/" чтобы не конфликтовать с disko
 
-  # После nixos-anywhere первая установка может быть 26.05,
+  # После nixos-install первая установка 25.11,
   # потом не трогаем (NixOS convention)
   system.stateVersion = "25.11";
 }
\ No newline at end of file