Where am I?
You're in a rabbit hole.
How did I get here?
The door opened; you got in.
Somewhere between then and now you discovered this cairne in the fog. I hope it is useful in some way. Inspiration, reference, or whatever you're looking for.
This is written perhaps as more of a reminder for myself than it is for you, but then again you could be future me or maybe past me stuck in a strange loop...
$ whoami
error: entity unknown or undefinedSteady...
The way out, is through.
- Feature Highlights
- Roadmap of TODOs
- Requirements
- Structure
- Adding a New Host
- Secrets Management
- Initial Install Notes
- Troubleshooting
- Acknowledgements
- Guidance and Resources
Watch NixOS related videos on my YouTube channel.
-
Flake-based multi-host, multi-user NixOS and Home-Manager configurations
- Core configs for hosts and users
- Modular, optional configs for user and host-specific needs
-
Secrets management via sops-nix and a private nix-secrets repo which is included as a flake input
-
Declarative LUKS encrypted btrfs partitions via disko
-
Automated remote-bootstrapping of NixOS, nix-config, and private nix-secrets
-
Multiple YubiKey device handling and agent forwarding for touch-based/passwordless authentication during:
- login
- sudo
- ssh
- git commit signing
- LUKS2 decryption
-
Automated borg backups
-
NixOS and Home-Manager automation recipes
The roadmap of additional features is laid across functionally thematic stages that can be viewed, along with short term objectives, in the Roadmap of TODOs.
Completed features will be added here as each stage is complete.
- NixOS 23.11 or later to properly receive passphrase prompts when building in the private nix-secrets repo
- Patience
- Attention to detail
- Persistance
- More disk space
This is a personalized configuration that has several technical requirements to build successfully. This nix-config will serve you best as a reference, learning resource, and template for crafting your own configuration. I am continuing to provide resources throughout the repository and my website to help but you must also experiment and learn as you go to be successful to create a NixOS environment that will meet your needs.
For details about design concepts, constraints, and how structural elements interact, see the article and/or Youtube video Anatomy of a NixOS Config available on my website.
For a large screenshot of the concept diagram, as well as previous iterations, see Anatomy.
flake.nix- Entrypoint for hosts and user home configurations. Also exposes a devshell for manual bootstrapping tasks (nix developornix-shell).hosts- NixOS configurations accessible viasudo nixos-rebuild switch --flake .#<host>.common- Shared configurations consumed by the machine specific ones.core- Configurations present across all hosts. This is a hard rule! If something isn't core, it is optional.disks- Declarative disk partition and format specifications via disko.optional- Optional configurations present across more than one host.users- Host level user configurations present across at least one host.<user>/keys- Public keys for the user that are symlinked to ~/.ssh
genoa- stage 6ghost- Primary box - 4.0GHz Ryzen 5 3600XT (12 core), 64MB RAM, Radeon RX5600XTgrief- Lab - Qemu VMgooey- stage xguppy- Remote Install Lab - Qemu VMgusto- Theatre - Asus VivoPC - 1.5GHz Celeron 1007U, 4GB RAM, onboard Intel graphics
home/<user>- Home-manager configurations, built automatically during host rebuilds.common- shared home-manager configurations consumed the user's machine specific ones.core- Home-manager configurations present for user across all machines. This is a hard rule! If something isn't core, it is optional.optional- Optional home-manager configurations that can be added for specific machines. These can be added by category (e.g. options/media) or individually (e.g. options/media/vlc.nix) as needed. The home-manager core and options are defined in host-specific .nix files housed inhome/<user>.
lib- Custom library used throughout the nix-config to make import paths more readable.modules- Custom modules to enable special functionality for nixos or home-manager oriented configurations.nixos-installer- A stripped down version of the main nix-config flake used exclusively for generating ISOs and during installation of NixOS and nix-config on hosts.overlays- Custom modifications to upstream packages.pkgs- Custom packages meant to be shared or upstreamed.vars- Custom variables used throughout the nix-config. Most of the variables are focused on the primary user across all hosts.scripts- Custom scripts for automation, including remote installation and bootstrapping of NixOS and nix-config.
Secrets for this config are stored in a private repository called nix-secrets that is pulled in as a flake input and managed using the sops-nix tool.
For details on how this is accomplished, how to approach different scenarios, and troubleshooting for some common hurdles, please see my article and accompanying YouTube video NixOS Secrets Management available on my website.
Thank you to my generous supporters!
If you find what I do helpful, please consider supporting my work using one of the links under "Sponsor this project" on the right-hand column of this page.
I intentionally keep all of my content ad-free but some platforms, such as YouTube, put ads on my videos outside of my control.
- Official Nix Documentation
- Noogle - Nix API reference documentation.
- Official NixOS Wiki
- NixOS & Flakes Book - an excellent introductory book by Ryan Yin
- Impermanence
- Yubikey
Those who have heavily influenced this strange journey into the unknown.
- FidgetingBits - You told me there was a strange door that could be opened. I'm truly grateful.
- Misterio77 - Structure and reference.
- Ryan Yin - A treasure trove of useful documentation and ideas.
- Mic92 and Lassulus - My nix-config leverages many of the fantastic tools that these two people maintain, such as sops-nix, disko, and nixos-anywhere.
- VimJoyer - Excellent videos on the high-level concepts required to navigate NixOS.
