NixOS Configuration

A buncha convoluted NixOS configuration files.

If you're a new Nix user, or you're looking for a good starter configuration or template, check out https://github.com/Misterio77/nix-starter-configs.

Warning

DO NOT DOWNLOAD AND RUN nixos-rebuild ON THIS REPOSITORY! These are my personal configuration files. I invite you to look through them, modify them, and take inspiration from them, but if you run nixos-rebuild boot/switch/test --flake . on this folder, it will completely overwrite your current system!

About this repo

Here's what's in each folder:

• bin: Scripts and other little programs that get installed on each host.
• hosts: Host-specific configuration files.
• modules: Reusable modules built using the NixOS modules syntax. These are mostly based on nixpkgs modules, but with some extra personal tweaks. All modules are imported automatically, and only need to be enabled to take effect.
• overlays: Simply put, overlays.
• packages: Custom packages not in nixpkgs.
• templates: Templates for hosts and modules.

All Nix files from this repo use a common namespace called Sapana. So for example, if you want to use the ACME module in your own Nix files, you'd need to import modules/services/acme.nix and enable it using config.Sapana.services.acme.enable = true;.

Using this repo

Note on secrets management

Secrets are managed in the secrets submodule using sops-nix. To read them, you need an SSH (or age) key corresponding to one of the keys in secrets/.sops.yaml.

First-time installation

This config expects to be installed on a single drive with two partitions. (You can use a different layout, but there are no guarantees it'll work). The partitions should look like this:

1. An ext2 /boot partition flagged as an EFI partition
2. An empty partition encrypted with LUKS

Before you run the format-drives script, read this:

This will wipe the second partition and reformat it as a BTRFS volume. It'll create subvolumes for /, /home, /var/log, /nix, and /swap. You can tweak this by changing the format-drives script, and modules/system/filesystem.nix.

Run bin/format-drives.sh --boot [path to your boot partition] --luks [path to your encrypted partition] (don't use sudo - the script will request privileges):

./bin/format-drives.sh --boot /dev/nvme0n1p1 --luks /dev/nvme0n1p2

Next, configure your host in the hosts folder by copying templates/hosts/configuration.nix and templates/hosts/hardware-configuration.nix. into a new folder. You should also have a hardware-configuration.nix file that the script generated.

Add the host to flake.nix under nixosConfigurations. Add any other module imports in addition to defaultModules.

Finally, run the NixOS installer, replacing host with your system's hostname:

sudo nixos-install --verbose --root /mnt --flake .#host --no-root-password

Running updates

This config installs a nixos-rebuild wrapper called nos (NixOS Operations Script) that handles pulling and pushing changes to a git repository, specifically one shared between hosts.

To update the system, run nos (or nixos-operations-script if you really want to). If you want to update flake.lock, commit the new lock file, push it up to the repo, and run a build, use nos --update.

Note

Don't not run this script as root - it'll automatically demand request sudo privileges when needed.

Automatic updates

To enable automatic updates for a host, set config.Sapana.services.autoUpgrade = true;. Like most modules, autoUpgrade has more options:

services.autoUpgrade = {
  enable = true;
  configDir = "/home/8bitbuddhist/nixConfig";
  onCalendar = "daily";
  user = config.users.users.aires.name;
};

Automatic updates work by scheduling nos --update as a systemd service.

![Note] You technically could have multiple hosts updating the same repo, but schedule them at different times to avoid conflicts.

Manual updates

Run nos to update the system. For the first build, you'll need to specify the path to your flake.nix file and your hostname using nos --hostname my_hostname --flake /path/to/flake.nix.

After the first build, you can omit the hostname and path and just run:

nos

Behind the scenes, this is just running:

cd $FLAKE_DIR
git pull
sudo nixos-rebuild switch --flake .

Updating

Add --update to update flake.lock and push the changes back to your Git repo.

Operations

nos can run these options using the --operation or -o flag:

• switch replaces the running system immediately.
• boot switches to the new generation during the next reboot.
  • Add --restart to restart your PC as soon as the update is finished.
• build creates and stores the new generation, but doesn't apply it.
• test creates the generation and switches to it, but doesn't add it to the bootloader. Rebooting will revert to your last gen.

Using Remote builds

Nix can create builds for or on remote systems, and transfer them via SSH.

Generating a build on a remote system

You can run a build on a remote server by using --build-host:

nos --operation build --build-host [remote hostname]

Pushing a build to a remote system

Conversely, you can run a build on the local host, then push it to a remote system.

nos -o build --target-host [remote hostname]

Testing without modifying the system

If you want to test without doing a whole build or changing your system, there are a couple additional tools to try.

Flake checks

Run nix flake check to run through your config completely, from head to toe, for all hosts. It'll catch synatx errors, logic errors, all sorts of useful stuff.

Dry builds

A dry-build simulates a build process, but doesn't actually do it. This basically ensures your system will actually build, though it's still not as accurate as just doing a regular build.

nixos-rebuild dry-build --flake .

Or

nos -o dry-build --flake .

Virtual machines

If you don't mind doing a build but don't want to change the system, create a VM.The first command builds the VM, and the second runs it:

nixos-rebuild build-vm --flake .
./result/bin/run-nixos-vm

Note

Running the VM also creates a .qcow2 file for data persistence. Remove this file after a while, otherwise unwanted data might hang out between builds and muck things up.

About this repository

This config feature uses:

• Flakes
• Home Manager
• Extended hardware support using nixos-hardware and nixos-facter
• Automatic daily updates
• AMD, Intel, and Raspberry Pi (ARM64) hardware configurations
• Gnome desktop environment
• Plymouth boot splash screens
• Secure Boot support
• Disk encryption via LUKS with TPM auto-unlocking
• A bunch of custom packages and systemd services
• Flatpaks
• Default ZSH shell using Oh My ZSH
• Secrets using Sops-nix