djairoh
bf31806ab7
no longer toggles grey shader, just makes the border grey + fixed mute_active dunst notif + keybinds
nixos
NixOS configuration for my three main machines (nixbook, nixpad, tuxcomp).
Layout
| Path | Contents |
|---|---|
flake.nix |
Inputs + one nixosConfigurations entry per hostname. |
hosts/<hostname>/ |
Configuration unique to each machine: hardware, wireguard tunnels. hardware-configuration.nix should not be edited as these are generated by nixos-generate-config. |
modules/ |
Everything shared; one file/folder per feature. |
secrets/ |
Sops-encrypted files + the only place sops.secrets are declared. |
patches/ |
Custom patches, currently only a gamescope patch. |
Each modules feature sets the required system options and packages. When i get around to it i'll add the home-manager options here as well.
Building
make # nixos-rebuild switch for this host
make build # build ./result without switching
make check # evaluate all configs
make update # update flake.lock
nix fmt # format the Nix files (nixfmt)
Run the above commmands as normal user. Generations older than 30 days are garbage-collected weekly.
Secrets
Every secret is stored as its own file, encrypted with sops to each machine's age key.
Public keys are in .sops.yaml.
Private keys are in ~/.config/sops/age/keys.txt; sops-nix decrypts with it on every switch, and sops also finds it:
sops edit secrets/<name>.bin
To add a machine, give it a key before its first boot with
mkdir -p -m 700 ~/.config/sops/age && age-keygen -o ~/.config/sops/age/keys.txt,
put the public key this prints in .sops.yaml, and run sops updatekeys on
every .bin from a machine that can already decrypt them.