fmt

README.md

@@ -1,3 +1,57 @@
 # nixos
 
-configuration files for nixos
+NixOS configuration for my three main machines (nixbook, nixpad, tuxcomp).
+
+
+<!-- TODO: rewrite rest of this file  -->
+## Layout
+
+| Path | Contents |
+| --- | --- |
+| `flake.nix` | Inputs + one nixosConfigurations entry per hostname. |
+| `hosts/<hostname>/` | Configuration unique to each machine: hardware, wireguard tunnels. `hardware-configuration.nix` should not be edited as these are generated by `nixos-generate-config`. |
+| `modules/` | Everything shared; one file/folder per feature. |
+| `secrets/` | sops-encrypted files + the only place `sops.secrets` are declared. |
+| `patches/` | Custom patches, currently only a gamescope patch. |
+
+Each modules feature sets the required system options and packages.
+When i get around to it i'll add the home-manager options here as well.
+
+
+## Building
+
+```sh
+make          # nixos-rebuild switch for this host
+make build    # build ./result without switching
+make check    # evaluate all configs
+make update   # update flake.lock
+nix fmt       # format the Nix files (nixfmt)
+```
+
+Do not run the above commands as root.
+nixos-rebuild asks for the sudo password when it activates. 
+Generations older than 30 days are garbage-collected weekly.
+
+## Secrets
+
+Every secret is stored as its own file, encrypted with sops to each machine's age key.
+Public keys are in `.sops.yaml`. 
+Private keys are in `~/.config/sops/age/keys.txt`; sops-nix decrypts with it on every switch, and `sops` also finds it:
+
+```sh
+sops edit secrets/<name>.bin
+```
+
+To add a machine, give it a key before its first boot with
+`mkdir -p -m 700 ~/.config/sops/age && age-keygen -o ~/.config/sops/age/keys.txt`,
+put the public key this prints in `.sops.yaml`, and run `sops updatekeys` on
+every `.bin` from a machine that can already decrypt them.
+
+`thunderbird-creds.bin` isn't text: it's a tarball of Thunderbird's
+`logins.json` and `key4.db`, and it only seeds profiles that have no
+`logins.json` yet. To update it, change the password in Thunderbird, close
+Thunderbird, and update the tarball:
+
+```sh
+tar -C ~/.thunderbird/main -cf - logins.json key4.db | sops encrypt --filename-override secrets/thunderbird-creds.bin --output secrets/thunderbird-creds.bin /dev/stdin
+```