nixos

NixOS configuration for my three main machines (nixbook, nixpad, tuxcomp).

Layout

Path	Contents
flake.nix	Inputs + one nixosConfigurations entry per hostname.
hosts/<hostname>/	Configuration unique to each machine: hardware, wireguard tunnels. hardware-configuration.nix should not be edited as these are generated by nixos-generate-config.
modules/	Everything shared; one file/folder per feature.
secrets/	Sops-encrypted files + the only place sops.secrets are declared.
patches/	Custom patches, currently only a gamescope patch.

Each modules feature sets the required system options and packages. When i get around to it i'll add the home-manager options here as well.

Building

make          # nixos-rebuild switch for this host
make build    # build ./result without switching
make check    # evaluate all configs
make update   # update flake.lock
nix fmt       # format the Nix files (nixfmt)

Run the above commmands as normal user. Generations older than 30 days are garbage-collected weekly.

Secrets

Every secret is stored as its own file, encrypted with sops to each machine's age key. Public keys are in .sops.yaml. Private keys are in ~/.config/sops/age/keys.txt; sops-nix decrypts with it on every switch, and sops also finds it:

sops edit secrets/<name>.bin

To add a machine, give it a key before its first boot with mkdir -p -m 700 ~/.config/sops/age && age-keygen -o ~/.config/sops/age/keys.txt, put the public key this prints in .sops.yaml, and run sops updatekeys on every .bin from a machine that can already decrypt them.