# nixos

NixOS configuration for my three main machines (nixbook, nixpad, tuxcomp).


<!-- TODO: rewrite rest of this file  -->
## Layout

| Path | Contents |
| --- | --- |
| `flake.nix` | Inputs + one nixosConfigurations entry per hostname. |
| `hosts/<hostname>/` | Configuration unique to each machine: hardware, wireguard tunnels. `hardware-configuration.nix` should not be edited as these are generated by `nixos-generate-config`. |
| `modules/` | Everything shared; one file/folder per feature. |
| `secrets/` | sops-encrypted files + the only place `sops.secrets` are declared. |
| `patches/` | Custom patches, currently only a gamescope patch. |

Each modules feature sets the required system options and packages.
When i get around to it i'll add the home-manager options here as well.


## Building

```sh
make          # nixos-rebuild switch for this host
make build    # build ./result without switching
make check    # evaluate all configs
make update   # update flake.lock
nix fmt       # format the Nix files (nixfmt)
```

Do not run the above commands as root.
nixos-rebuild asks for the sudo password when it activates. 
Generations older than 30 days are garbage-collected weekly.

## Secrets

Every secret is stored as its own file, encrypted with sops to each machine's age key.
Public keys are in `.sops.yaml`. 
Private keys are in `~/.config/sops/age/keys.txt`; sops-nix decrypts with it on every switch, and `sops` also finds it:

```sh
sops edit secrets/<name>.bin
```

To add a machine, give it a key before its first boot with
`mkdir -p -m 700 ~/.config/sops/age && age-keygen -o ~/.config/sops/age/keys.txt`,
put the public key this prints in `.sops.yaml`, and run `sops updatekeys` on
every `.bin` from a machine that can already decrypt them.

`thunderbird-creds.bin` isn't text: it's a tarball of Thunderbird's
`logins.json` and `key4.db`, and it only seeds profiles that have no
`logins.json` yet. To update it, change the password in Thunderbird, close
Thunderbird, and update the tarball:

```sh
tar -C ~/.thunderbird/main -cf - logins.json key4.db | sops encrypt --filename-override secrets/thunderbird-creds.bin --output secrets/thunderbird-creds.bin /dev/stdin
```