# nixos

NixOS configuration for my three main machines (nixbook, nixpad, tuxcomp).


## Layout

| Path | Contents |
| --- | --- |
| `flake.nix` | Inputs + one nixosConfigurations entry per hostname. |
| `hosts/<hostname>/` | Configuration unique to each machine: hardware, wireguard tunnels. `hardware-configuration.nix` should not be edited as these are generated by `nixos-generate-config`. |
| `modules/` | Everything shared; one file/folder per feature. |
| `secrets/` | Sops-encrypted files + the only place `sops.secrets` are declared. |
| `patches/` | Custom patches, currently only a gamescope patch. |

Each modules feature sets the required system options and packages.
When i get around to it i'll add the home-manager options here as well.


## Building

```sh
make          # nixos-rebuild switch for this host
make build    # build ./result without switching
make check    # evaluate all configs
make update   # update flake.lock
nix fmt       # format the Nix files (nixfmt)
```

Run the above commmands as normal user.
Generations older than 30 days are garbage-collected weekly.

## Secrets

Every secret is stored as its own file, encrypted with sops to each machine's age key.
Public keys are in `.sops.yaml`. 
Private keys are in `~/.config/sops/age/keys.txt`; sops-nix decrypts with it on every switch, and `sops` also finds it:

```sh
sops edit secrets/<name>.bin
```

To add a machine, give it a key before its first boot with
`mkdir -p -m 700 ~/.config/sops/age && age-keygen -o ~/.config/sops/age/keys.txt`,
put the public key this prints in `.sops.yaml`, and run `sops updatekeys` on
every `.bin` from a machine that can already decrypt them.