Bare metal

A bare-metal node is a physical machine you install over the network rather than one a cloud creates for you. Navi installs NixOS onto it with nixos-anywhere and then manages it like any other node.

Installing onto a fresh machine

A fresh machine has no facts to read an address from, so you give Navi the address and the installer's initial password directly. Booting the target into a NixOS installer or any SSH-reachable Linux is enough to begin:

navi provision --on rack-01 --ip 10.0.0.20 --initial-password <installer-password>

--ip skips the interactive address prompt, and --initial-password is passed through to nixos-anywhere for the first SSH connection, before the machine has your keys. Once installation finishes, the host is keyed and subsequent commands connect normally.

Reaching hosts on a LAN

Bare-metal hosts often sit on a local network behind an overlay such as Tailscale. To force SSH through a physical interface rather than the overlay, set deployment.forceHwLink on the node. Navi detects an appropriate physical interface and routes the connection through it:

rack-01 = { ... }: {
  deployment.tags = [ "on-prem" ];
  deployment.forceHwLink = true;
};

The initrd unlock connection has its own equivalent, deployment.unlock.forceHwLink, covered in Remote unlock.

Reinstalling

To wipe and reinstall a node from scratch, pass --reinstall. This destroys and recreates the machine's installation before installing onto it again:

navi install --on rack-01 --reinstall

Inspect the selection first with --list when you want to be sure which hosts a reinstall would touch.