2.3 KiB
NixOS Flake Configuration
Personal NixOS configuration, managed as a flake. Deploys to NixOS, macOS (nix-darwin), and home-manager.
Machines
| Hostname | Nix Target | Purpose |
|---|---|---|
| nero | NixOS | Personal desktop - KDE, gaming (Steam), VR (WiVRn), Flatpak apps |
| vergil | NixOS | Server - Jellyfin, Pi-hole, nginx, remote build node |
| pdw-frankiel | NixOS | Work desktop - KDE, flatpak apps |
| franks-macbook-pro | macOS (nix-darwin) | General-purpose laptop |
Directory Structure
flake.nix
hosts/ <- Host specific confirugration, each host gets its own subdirectory matching it's hostname.
shared/ <- Shared components specific to hosts (Trusted SSH keys, shared pkgs, disk layouts).
features/ <- Portable software feature modules (KDE, Podman, Wine, vim, etc.).
home/ <- Home-manager configuration and drop-in config files.
packages/ <- Custom pkgs outside of nixpkgs or external flakes.
secrets/ <- SOPS secret store
assets/ <- Static assets like graphics.
keys/ <- SSH and GPG public keys.
Building and useful commands
# Build and switch.
sudo nixos-rebuild switch --flake .#<HOSTNAME>
# Build and switch if using nix-darwin.
sudo darwin-rebuild switch --flake .#<HOSTNAME>
# Build but do not switch.
nix build .#nixosConfigurations.nero.config.system.build.toplevel
# Format all .nix files.
nixfmt
Secrets
Secrets are managed with SOPS. The secrets/ directory contains encrypted files that get decrypted at build time (or when using sops edit secrets/<NAME>.yaml. Never commit the decrypted versions. In order to successfully build a configuration with secrets, place the correct private age key file in /persist/sops/age/keys.txt with the file mask of 0400 prior to building. You can also drop in the keys.txt file using nixos-anywhere or other deployment tools. In order to edit sops encrypted files without being root, place the same key file in the user's home directory at $HOME/.config/sops/age/keys.txt with the file mask of 0400. Ensure that you always edit secret files with sops edit secrets/<NAME>.yaml and that you don't accidentally commit unencrypted secrets.