47 lines
2.3 KiB
Markdown
47 lines
2.3 KiB
Markdown
# NixOS Flake Configuration
|
|
|
|
Personal NixOS configuration, managed as a flake. Deploys to NixOS, macOS (nix-darwin), and home-manager.
|
|
|
|
## Machines
|
|
|
|
| Hostname | Nix Target | Purpose |
|
|
|------|----|-------------|
|
|
| **nero** | NixOS | Personal desktop - KDE, gaming (Steam), VR (WiVRn), Flatpak apps |
|
|
| **vergil** | NixOS | Server - Jellyfin, Pi-hole, nginx, remote build node |
|
|
| **pdw-frankiel** | NixOS | Work desktop - KDE, flatpak apps |
|
|
| **franks-macbook-pro** | macOS (nix-darwin) | General-purpose laptop |
|
|
|
|
## Directory Structure
|
|
|
|
```
|
|
flake.nix
|
|
hosts/ <- Host specific confirugration, each host gets its own subdirectory matching it's hostname.
|
|
shared/ <- Shared components specific to hosts (Trusted SSH keys, shared pkgs, disk layouts).
|
|
features/ <- Portable software feature modules (KDE, Podman, Wine, vim, etc.).
|
|
home/ <- Home-manager configuration and drop-in config files.
|
|
packages/ <- Custom pkgs outside of nixpkgs or external flakes.
|
|
secrets/ <- SOPS secret store
|
|
assets/ <- Static assets like graphics.
|
|
keys/ <- SSH and GPG public keys.
|
|
```
|
|
|
|
### Building and useful commands
|
|
|
|
```bash
|
|
# Build and switch.
|
|
sudo nixos-rebuild switch --flake .#<HOSTNAME>
|
|
|
|
# Build and switch if using nix-darwin.
|
|
sudo darwin-rebuild switch --flake .#<HOSTNAME>
|
|
|
|
# Build but do not switch.
|
|
nix build .#nixosConfigurations.nero.config.system.build.toplevel
|
|
|
|
# Format all .nix files.
|
|
nixfmt
|
|
```
|
|
|
|
## Secrets
|
|
|
|
Secrets are managed with SOPS. The `secrets/` directory contains encrypted files that get decrypted at build time (or when using `sops edit secrets/<NAME>.yaml`. **Never** commit the decrypted versions. In order to successfully build a configuration with secrets, place the correct private age key file in `/persist/sops/age/keys.txt` with the file mask of `0400` prior to building. You can also drop in the `keys.txt` file using nixos-anywhere or other deployment tools. In order to edit sops encrypted files without being root, place the same key file in the user's home directory at `$HOME/.config/sops/age/keys.txt` with the file mask of `0400`. Ensure that you **always** edit secret files with `sops edit secrets/<NAME>.yaml` and that you don't accidentally commit unencrypted secrets.
|