djaidjai/nixos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fmt

Browse Source
This commit is contained in:
Djai Hougee
2026-09-26 02:14:34 +02:00
parent 7a07c37bc3
commit a8365a1a73
17 changed files with 313 additions and 134 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
Makefile
View File

@@ -7,7 +7,7 @@ HOSTS = nixbook nixpad tuxcomp
switch:
nixos-rebuild switch --flake . --sudo --ask-sudo-password
# build this host's system (./result) without activating it.
# build this host's system without activating it.
build:
nixos-rebuild build --flake .

56
README.md
View File

@@ -1,3 +1,57 @@
# nixos
configuration files for nixos
NixOS configuration for my three main machines (nixbook, nixpad, tuxcomp).
<!-- TODO: rewrite rest of this file -->
## Layout
| Path | Contents |
| --- | --- |
| `flake.nix` | Inputs + one nixosConfigurations entry per hostname. |
| `hosts/<hostname>/` | Configuration unique to each machine: hardware, wireguard tunnels. `hardware-configuration.nix` should not be edited as these are generated by `nixos-generate-config`. |
| `modules/` | Everything shared; one file/folder per feature. |
| `secrets/` | sops-encrypted files + the only place `sops.secrets` are declared. |
| `patches/` | Custom patches, currently only a gamescope patch. |
Each modules feature sets the required system options and packages.
When i get around to it i'll add the home-manager options here as well.
## Building
```sh
make # nixos-rebuild switch for this host
make build # build ./result without switching
make check # evaluate all configs
make update # update flake.lock
nix fmt # format the Nix files (nixfmt)
```
Do not run the above commands as root.
nixos-rebuild asks for the sudo password when it activates.
Generations older than 30 days are garbage-collected weekly.
## Secrets
Every secret is stored as its own file, encrypted with sops to each machine's age key.
Public keys are in `.sops.yaml`.
Private keys are in `~/.config/sops/age/keys.txt`; sops-nix decrypts with it on every switch, and `sops` also finds it:
```sh
sops edit secrets/<name>.bin
```
To add a machine, give it a key before its first boot with
`mkdir -p -m 700 ~/.config/sops/age && age-keygen -o ~/.config/sops/age/keys.txt`,
put the public key this prints in `.sops.yaml`, and run `sops updatekeys` on
every `.bin` from a machine that can already decrypt them.
`thunderbird-creds.bin` isn't text: it's a tarball of Thunderbird's
`logins.json` and `key4.db`, and it only seeds profiles that have no
`logins.json` yet. To update it, change the password in Thunderbird, close
Thunderbird, and update the tarball:
```sh
tar -C ~/.thunderbird/main -cf - logins.json key4.db | sops encrypt --filename-override secrets/thunderbird-creds.bin --output secrets/thunderbird-creds.bin /dev/stdin
```

125
flake.lock generated Normal file
View File

@@ -0,0 +1,125 @@
{
"nodes": {
"home-manager": {
"inputs": {
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1790365885,
"narHash": "sha256-iQ0ebhiVo64NktTnwft9hNxlFu4j5cvljVxyJaEVIP4=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "7b4c5ec4bedaf1e062bbc1bcaeddbc6bd242aa1b",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "home-manager",
"type": "github"
}
},
"nix-flatpak": {
"locked": {
"lastModified": 1767983141,
"narHash": "sha256-7ZCulYUD9RmJIDULTRkGLSW1faMpDlPKcbWJLYHoXcs=",
"owner": "gmodena",
"repo": "nix-flatpak",
"rev": "440818969ac2cbd77bfe025e884d0aa528991374",
"type": "github"
},
"original": {
"owner": "gmodena",
"ref": "latest",
"repo": "nix-flatpak",
"type": "github"
}
},
"nix4nvchad": {
"inputs": {
"nixpkgs": [
"nixpkgs"
],
"nvchad-starter": "nvchad-starter"
},
"locked": {
"lastModified": 1790046371,
"narHash": "sha256-j1q/Bx89d5PM7CRBqdV1RDvmTwwfAqIBEthXg39pUWE=",
"owner": "nix-community",
"repo": "nix4nvchad",
"rev": "706a5c7d9fb40395c9c4805a0316ab32622beb36",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "nix4nvchad",
"type": "github"
}
},
"nixpkgs": {
"locked": {
"lastModified": 1790185690,
"narHash": "sha256-xJ+X4hBtOcAFGBOe5nAMyMUeF9foJBmIOu3NjBqBycU=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "4975466d324710c576dc11ad614684e6bd8cad8e",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nvchad-starter": {
"flake": false,
"locked": {
"lastModified": 1753939018,
"narHash": "sha256-xdLr6tlU9uA+wu0pqha2br0fdVm+1MjgjbB5awz9ICU=",
"owner": "NvChad",
"repo": "starter",
"rev": "e3572e1f5e1c297212c3deeb17b7863139ce663e",
"type": "github"
},
"original": {
"owner": "NvChad",
"ref": "main",
"repo": "starter",
"type": "github"
}
},
"root": {
"inputs": {
"home-manager": "home-manager",
"nix-flatpak": "nix-flatpak",
"nix4nvchad": "nix4nvchad",
"nixpkgs": "nixpkgs",
"sops-nix": "sops-nix"
}
},
"sops-nix": {
"inputs": {
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1790247521,
"narHash": "sha256-TNfgoHsqsYYvaJImlWctfRkh4PseTagzegU1Dgdbehw=",
"owner": "Mic92",
"repo": "sops-nix",
"rev": "2bd00bd9bb35fe6d114888c8f1c2e946c541dd8f",
"type": "github"
},
"original": {
"owner": "Mic92",
"repo": "sops-nix",
"type": "github"
}
}
},
"root": "root",
"version": 7
}

34
hosts/nixbook/default.nix
View File

@@ -1,8 +1,7 @@
{ config, pkgs, ... }:
{
imports =
[
imports = [
./hardware-configuration.nix
../../modules
];
@@ -10,7 +9,8 @@
networking.hostName = "nixbook";
system.stateVersion = "26.05";
boot.initrd.luks.devices."luks-082cc474-c00a-46c5-b140-4b7ccc2e6958".device = "/dev/disk/by-uuid/082cc474-c00a-46c5-b140-4b7ccc2e6958";
boot.initrd.luks.devices."luks-082cc474-c00a-46c5-b140-4b7ccc2e6958".device =
"/dev/disk/by-uuid/082cc474-c00a-46c5-b140-4b7ccc2e6958";
services.power-profiles-daemon.enable = true;
@@ -20,28 +20,36 @@
steam
];
# explicitly override videoDrivers (nvidia doesnt like us on nixbook )
services.xserver.videoDrivers = lib.mkForce [ "intel" ];
# BELOW IS OLD!! remove as we make more modular
# custom certificates
# TODO: move certs to secrets, make this a module not a host based thing
security.pki.certificateFiles = [
./certs/npm-caddy-private.crt
./certs/npm-caddy-public.crt
./certs/npm-caddy-shared.crt
];
# custom certificates
# security.pki.certificateFiles = [
# ./certs/npm-caddy-private.crt
# ./certs/npm-caddy-public.crt
# ./certs/npm-caddy-shared.crt
# ];
# TODO: move to secrets
# tunnel
networking.wg-quick.interfaces = {
npm = {
address = ["10.8.0.3/32"];
address = [ "10.8.0.3/32" ];
privateKeyFile = "/root/wireguard-keys/npm";
peers = [{
peers = [
{
publicKey = "YlQfDLqOET0RCTfbeRTDUicF/RA6dic/ThHLy25w4nQ=";
presharedKeyFile = "/root/wireguard-keys/npm_preshared";
allowedIPs = ["10.9.11.0/24" "10.8.0.0/24"];
allowedIPs = [
"10.9.11.0/24"
"10.8.0.0/24"
];
endpoint = "wg-easy.u.djairo.dev:51820";
persistentKeepalive = 25;
}];
}
];
};
};
}

3
hosts/tuxcomp/default.nix
View File

@@ -1,8 +1,7 @@
{ config, pkgs, ... }:
{
imports =
[
imports = [
./hardware-configuration.nix
../../modules
./gaming.nix

3
hosts/tuxcomp/gaming.nix
View File

@@ -30,7 +30,6 @@
# than esync/fsync under thread contention.
boot.kernelModules = [ "ntsync" ];
users.users.djai.packages = with pkgs; [
desmume
eden
@@ -38,7 +37,7 @@
prismlauncher
steam
winetricks
]:
];
services.flatpak.packages = [
"org.vinegarhq.Sober"

2
modules/audio.nix
View File

@@ -1,7 +1,7 @@
{ pkgs, ... }:
{
software.pulseaudio.enable = false;
services.pulseaudio.enable = false;
security.rtkit.enable = true;
services.pipewire = {

1
modules/base.nix
View File

@@ -50,7 +50,6 @@
vim
];
# TODO: use home-manager
# home-manager = {
# useGlobalPkgs = true;

2
modules/default.nix
View File

@@ -1,6 +1,6 @@
{
imports = [
../secrets
# ../secrets # TODO: uncomment
./apps.nix
./audio.nix
./base.nix

8
modules/desktop/default.nix
View File

@@ -4,15 +4,15 @@
services.displayManager.sddm.enable = true;
services.displayManager.autoLogin = {
enable = true;
user = djai;
user = "djai";
};
services.xserver = {
enable = true;
videoDrivers = [
nvidia
amdgpu
intel
"nvidia"
"amdgpu"
"intel"
];
xkb = {
layout = "us";

134
modules/dev.nix
View File

@@ -2,73 +2,6 @@
let
system = pkgs.stdenv.hostPlatform.system;
in
{
programs.java.enable = true;
programs.nix-ld.libraries = with pkgs; [
stdenv.cc.cc.lib
zlib
ncurses5
libGL
libGLU
vulkan-loader
libdrm
mesa
libx11
libxcursor
libxrandr
libxi
libxext
libxfixes
libxcb
wayland
libpulseaudio
alsa-lib
nss
nspr
expat
glib
dbus
systemd
freetype
fontconfig
];
users.users.djai.packages = with pkgs; [
# dev environment
godot
inputs.nix4nvchad.packages.${system}.nvchad
jq
lazygit
ripgrep
# toolchains
cargo
gcc
gnumake
openssl
python3
rustc
uv
# containers / secrets
age
fluxcd
k9s
kubectl
kubectx
sops
# hosts / networks
wireguard-tools
lm_sensors
];
# TODO: switch to home manager
# FIXME: use builtins.readfile to store these config options i think
# home-manager.users.djai.home.packages = with pkgs; [];
nvchad = inputs.nix4nvchad.packages.${system}.default.override {
extraConfig = ''
local map = vim.keymap.set
@@ -133,4 +66,71 @@ in
}
'';
};
in
{
programs.java.enable = true;
programs.nix-ld.libraries = with pkgs; [
stdenv.cc.cc.lib
zlib
ncurses5
libGL
libGLU
vulkan-loader
libdrm
mesa
libx11
libxcursor
libxrandr
libxi
libxext
libxfixes
libxcb
wayland
libpulseaudio
alsa-lib
nss
nspr
expat
glib
dbus
systemd
freetype
fontconfig
];
users.users.djai.packages = with pkgs; [
# dev environment
godot
nvchad
jq
lazygit
ripgrep
# toolchains
cargo
gcc
gnumake
openssl
python3
rustc
uv
# containers / secrets
age
fluxcd
k9s
kubectl
kubectx
sops
# hosts / networks
wireguard-tools
lm_sensors
];
# TODO: switch to home manager
# FIXME: use builtins.readfile to store these config options i think
# home-manager.users.djai.home.packages = with pkgs; [];
}

14
modules/dunst.nix
View File

@@ -18,7 +18,7 @@
corners = "bottom-left, top-right";
ellipsize = "middle";
enable_posix_regex = true;
follow = mouse;
follow = "mouse";
font = "Iosevka Mono Nerd Font Medium 10";
force_xinerama = false;
force_xwayland = false;
@@ -32,7 +32,7 @@
idle_threshold = 120;
ignore_dbusclose = false;
ignore_newline = false;
indicate_hidden = yes;
indicate_hidden = true;
line_height = 0;
markup = "full";
max_icon_size = 32;
@@ -47,19 +47,19 @@
progress_bar_max_width = 400;
progress_bar_min_width = 150;
progress_bar = true;
separator_color = frame;
separator_color = "frame";
separator_height = 2;
show_age_threshold = 60;
show_indicators = true;
shrink = no;
sort = yes;
shrink = false;
sort = true;
stack_duplicates = true;
sticky_history = true;
text_icon_padding = 15;
title = "Dunst";
vertical_alignment = "center";
width = 250;
word_wrap =false;
word_wrap = false;
};
experimental.per_monitor_dpi = false;
@@ -82,7 +82,7 @@
foreground = "#F38BA8";
format = "<b>%s</b>\n%b";
frame_color = "#F38BA8";
timeout = 60 ;
timeout = 60;
};
fcitx5-filter = {

1
modules/email.nix
View File

@@ -1,6 +1,5 @@
{ config, pkgs, ... }:
{
programs.thunderbird.enable = true;
}

1
modules/web/default.nix
View File

@@ -15,4 +15,3 @@
firefox
];
}

15
modules/web/firefox.nix
View File

@@ -3,7 +3,8 @@
{
programs.firefox = {
enable = true;
preferences = { #TODO: port over all changes in about:config from tuxcomp
preferences = {
# TODO: port over all changes in about:config from tuxcomp
"browser.resistFingerPrinting" = true;
};
@@ -12,26 +13,22 @@
ExtensionSettings = {
"uBlock0@raymondhill.net" = {
installation_mode = "force_installed";
install_url =
"https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi";
install_url = "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi";
};
"vimium@vimium.org" = {
installation_mode = "force_installed";
install_url =
"https://addons.mozilla.org/firefox/downloads/latest/vimium/latest.xpi";
install_url = "https://addons.mozilla.org/firefox/downloads/latest/vimium/latest.xpi";
};
"addon@darkreader.org" = {
installation_mode = "force_installed";
install_url =
"https://addons.mozilla.org/firefox/downloads/latest/darkreader/latest.xpi";
install_url = "https://addons.mozilla.org/firefox/downloads/latest/darkreader/latest.xpi";
};
"{446900e4-71c2-419f-a6a7-df9c091e268b}" = {
installation_mode = "force_installed";
install_url =
"https://addons.mozilla.org/firefox/downloads/latest/bitwarden-password-manager/latest.xpi";
install_url = "https://addons.mozilla.org/firefox/downloads/latest/bitwarden-password-manager/latest.xpi";
};
};
};