57 lines
2.1 KiB
Markdown
57 lines
2.1 KiB
Markdown
# nixos
|
|
|
|
NixOS configuration for my three main machines (nixbook, nixpad, tuxcomp).
|
|
|
|
|
|
<!-- TODO: rewrite rest of this file -->
|
|
## Layout
|
|
|
|
| Path | Contents |
|
|
| --- | --- |
|
|
| `flake.nix` | Inputs + one nixosConfigurations entry per hostname. |
|
|
| `hosts/<hostname>/` | Configuration unique to each machine: hardware, wireguard tunnels. `hardware-configuration.nix` should not be edited as these are generated by `nixos-generate-config`. |
|
|
| `modules/` | Everything shared; one file/folder per feature. |
|
|
| `secrets/` | Sops-encrypted files + the only place `sops.secrets` are declared. |
|
|
| `patches/` | Custom patches, currently only a gamescope patch. |
|
|
|
|
Each modules feature sets the required system options and packages.
|
|
When i get around to it i'll add the home-manager options here as well.
|
|
|
|
|
|
## Building
|
|
|
|
```sh
|
|
make # nixos-rebuild switch for this host
|
|
make build # build ./result without switching
|
|
make check # evaluate all configs
|
|
make update # update flake.lock
|
|
nix fmt # format the Nix files (nixfmt)
|
|
```
|
|
|
|
Run the above commmands as normal user.
|
|
Generations older than 30 days are garbage-collected weekly.
|
|
|
|
## Secrets
|
|
|
|
Every secret is stored as its own file, encrypted with sops to each machine's age key.
|
|
Public keys are in `.sops.yaml`.
|
|
Private keys are in `~/.config/sops/age/keys.txt`; sops-nix decrypts with it on every switch, and `sops` also finds it:
|
|
|
|
```sh
|
|
sops edit secrets/<name>.bin
|
|
```
|
|
|
|
To add a machine, give it a key before its first boot with
|
|
`mkdir -p -m 700 ~/.config/sops/age && age-keygen -o ~/.config/sops/age/keys.txt`,
|
|
put the public key this prints in `.sops.yaml`, and run `sops updatekeys` on
|
|
every `.bin` from a machine that can already decrypt them.
|
|
|
|
`thunderbird-creds.bin` isn't text: it's a tarball of Thunderbird's
|
|
`logins.json` and `key4.db`, and it only seeds profiles that have no
|
|
`logins.json` yet. To update it, change the password in Thunderbird, close
|
|
Thunderbird, and update the tarball:
|
|
|
|
```sh
|
|
tar -C ~/.thunderbird/main -cf - logins.json key4.db | sops encrypt --filename-override secrets/thunderbird-creds.bin --output secrets/thunderbird-creds.bin /dev/stdin
|
|
```
|