GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — GitHub - Swarsel/.dotfiles: Flake-based, literate nix config for personal infrastructure

BranchesTags
Open more actions menu

Latest commit

 

History

1,190 Commits
1,190 Commits

Folders and files

NameName
Last commit message
Last commit date
.github
.github
 
 
files
files
 
 
hosts
hosts
 
 
modules
modules
 
 
pkgs
pkgs
 
 
secrets
secrets
 
 
tofu/sops
tofu/sops
 
 
.envrc
.envrc
 
 
.gitattributes
.gitattributes
 
 
.gitignore
.gitignore
 
 
.sops.yaml
.sops.yaml
 
 
LICENSE
LICENSE
 
 
SwarselSystems.org
SwarselSystems.org
 
 
flake.lock
flake.lock
 
 
flake.nix
flake.nix
 
 
justfile
justfile
 
 

Repository files navigation

nixos logo using earthbound giant step icon
   ~SwarselSystems~ (née .dotfiles)

"With NixOS, your entire system is just one file: /etc/nixos/configuration.nix!"
... I took that literally.

screenshot showing emacs and glide screenshot showing fastfetch and music player screenshot showing noctalia bar screenshot showing wallpaper

Overview ness

  • Literate configuration defining my entire infrastructure, including Emacs
  • Dendritic configuration based on flakes (using flake-file) for personal hosts as well as servers on:
    • NixOS
    • home-manager only (no full NixOS) with support from nixGL
    • nix-darwin
    • nix-on-droid
  • Streamlined configuration and deployment pipeline:
    • Framework for packages, overlays, dendritic modules (features), and library functions
    • Dynamically generated config:
      • host configurations
      • dns records
      • network setup (+ WireGuard mesh on systemd-networkd)
    • Remote Builders for [x86_64,aarch64]-linux running on Buildbot, feeding a private nix binary cache and updating the flake on a weekly basis
    • Fully autonomous remote deployment using nixos-anywhere and disko (with secrets handling)
    • Improved nix tooling
  • Support for advanced features:
    • Secrets handling using sops-nix (pls no pwn ❤️)
    • Management of personally identifiable information at evaluation time through piix
    • Full Yubikey support (with SSH support for SK keys, certs and PGP keys)
    • LUKS-encryption with support for remote disk unlock over SSH
    • Secure boot using Lanzaboote
    • BTRFS-based Impermanence
    • Configuration shared between configurations (configuration for one nixosConfiguration can be defined in another nixosConfiguration)
    • Global attributes shared between all configurations to reduce attribute re-declaration
    • Config library for defining config-based functions for generating service information
    • Reduced friction between full NixOS- and home-manager-only deployments
      • efficient secrets handling depending on system context
      • automatic config sharing between contexts
      • dendritic structure for keeping features in a centralized manner

Infrastructure paula

Click here for a summary of my infrastructure full topology diagram

Programs

Topic Program
⛩️ Bar Noctalia Shell
✒️ Editor Emacs
🌐 Browser Glide
🎨 Theme City-Lights (managed by stylix)
🐚 Shell zsh
🖥️ Terminal Kitty
🚀 Launcher Noctalia Shell
🚨 Alerts Noctalia Shell
🚪 DM greetd
🪟 WM Niri

Services

Topic Program
☁️ S3 Garage
⚓ Anki Sync Anki Sync Server
⛏️ Minecraft Minecraft
✂️ Paste Tool Microbin
✉️ Mail simple-nixos-mailserver
🃏 Collections Koillection
🌳 Git Forgejo
🍴 RSS FreshRss
🍽️ Recipes Mealie
🎞️ Photos Immich
🎧 Audiobooks Audiobookshelf
🎵 Music Navidrome + Spotifyd + MPD
🎼 Music Downloader Yubal
🐙 Nix Build farm Buildbot
🐝 Home Automation Home Assistant + Zigbee2MQTT + Mosquitto
🐽 Threat Detection CrowdSec
👀 DNS Records Knot
👁️ Monitoring Grafana + Mimir + Loki + Tempo + Alloy + Pyroscope + Gotify
💸 Finance Firefly-III + Spliit
💾 Backups Restic
📁 Filesharing Nextcloud + CopyParty + Croc. Also slskd, transmission + friends
📄 Documents Paperless
📅 CalDav/CardDav Radicale
📖 Books Kavita
📚 Bookmarks Readeck
📝 Office Suite Collabora Online + Filestash
📋 Forms OpnForm
📸 Image Sharing Slink
📹 Video Downloader MeTube
📺 Video Streaming Invidious + Invidious Companion
📼 Videos Jellyfin
🔄 File Sync Syncthing
🚀 Speedtest LibreSpeed
🔎 Search Engine SearXNG
🔑 Cert-based SSH OPKSSH
🔗 Link Shortener Shlink
🔨 Home Asset Management Homebox
🕸️ Nix Binary Cache Attic
🗃️ Shell History Atuin
🗨️ Messaging Matrix
🗺️ Location History Dawarich
🚇 VPN Access Firezone
🛎️ DHCP Kea
🛡️ Local DNS Resolver AdGuard Home
🦊 Firefox Sync Firefox-Syncserver
🪎 Second Hand Site Info Shopservatory + Socks Proxy
🪪 SSO Kanidm + oauth2-proxy

Hosts

Name Hardware Use
💻 bakery Lenovo Ideapad 720S-13IKB Personal laptop
💻 pyramid Framework 16, AMD 7940HS, RX 7700S, 64GB RAM Work laptop
💻 machpizza MacBook Pro 2016 Alternative work laptop, MacOS
🏠 treehouse NVIDIA DGX Spark AI sandbox, HM-only
🖥️ hintbooth HUNSN RM02, 8GB RAM Router, home proxy/DNS
🖥️ summers ASUS Z10PA-D8, 2 Intel Xeon E5-2650 v4, 128G RAM Main Homeserver, NAS
🖥️ winters ASRock J4105-ITX, 32GB RAM IoT Homeserver, Wi-Fi(6) AP
☁️ belchsfactory 4 vCPUs, 24GB RAM Remote Builder, nix cache
☁️ eagleland 2 vCPUs, 8GB RAM Mailserver
☁️ liliputsteps 1 vCPUs, 8GB RAM SSH bastion
☁️ moonside 4 vCPUs, 24GB RAM Non-critical services
☁️ stoicclub 1 vCPUs, 8GB RAM Authoritative DNS server
☁️ twothreetunnel 2 vCPUs, 8GB RAM Web proxy
🪟 chaostheater Asus Z97-A, i7-4790k, GTX970, 32GB RAM Game streaming (on AtlasOS)
📱 magicant Samsung Galaxy Z Flip 6 Phone (nix-on-droid)
💿 brickroad - Kexec tarball for low-mem hosts
💿 drugstore - Installer ISO for new hosts
💿 policestation - Live ISO for generating keys
❔ vacanthouse - Staging environment

Documentation jeff

The full documentation can be found here:

SwarselSystems literate configuration

I went to great lengths in order to document the full design process of my infrastructure properly; the above document strives to serve as an introductory lecture to nix / NixOS while at the same time explaining the config in general.

Emacs

If you came here for my raw Emacs configuration, the relevant files live here in elisp form (these files are generated from the nix emacs-init module):

  • early-init.el
  • init.el

Deployment

Click here for deployment instructions
  1. Fork this repo, and write your own host config at hosts/nixos/<YOUR_ARCHITECTURE>/<YOUR_CONFIG_NAME>/default.nix. At the very least, you should replace the secrets/ directory with your own secrets and replace the SSH public keys with your own ones (otherwise I will come visit you!🔓❤️). I personally recommend to use the literate configuration and org-babel-tangle-file in Emacs, but you can also simply edit the separate .nix files.
  2. Boot into a NixOS installer
  3. Make sure that your Yubikey is plugged in or that you have your SSH key available (and configured)
  4. Run swarsel-bootstrap <CONFIGURATION_NAME> <TARGET_IP> and follow the prompts

Attributions poo

I would like to express my gratitude (not solely) to:

The people who help maintain NixOS, nix-community, and other nix-related projects.
The people who have inspired me with their configurations
  • theSuess with their home-manager
  • hlissner with their dotfiles
  • AntonHakansson with their nixos-config
  • EmergentMind with their nix-config
  • oddlama with their nix-config

If you feel that I forgot to pay you tribute for code that I used in this repository, please shoot me a message and I will fix it :)

FAQ king

Q: How do I get started with nix?

A: Click here for a small list of tips that should be helpful if you are new to the nix ecosystem
  • Temporarily install any package using nix shell nixpkgs#<PACKAGE_NAME> - this can be e.g. useful if you accidentally removed home-manager from your packages on a non-NixOS machine.

    • if you need multiple packages, you can do nix shell nixpkgs#{<pkg1>,<pkg2>,<pkg3>}.
    • you can set nix.registry to add more flakes to your registry. I use this to add a n shorthand to nixpkgs, which allows me to do nix shell n#{<pkg1>,<pkg2>,<pkg3>}.
  • Alternatively, use comma

    • More info on nix [...] commands: https://nixos.org/manual/nix/stable/command-ref/new-cli/nix
    • some examples:
      • nix flake update <input-name> lets you update a specific input only.
      • nix repl <your flake path> gives quick insight into your written configuration.
      • nix eval <your flake path>#<config attribute> quickly returns an attribute in your written configuration
      • nix fmt formats your flake using the formatter specified under formatter in your flake.nix
  • When you are trying to setup a new configuration part, GitHub code search can really help you to find a working configuration. Just filter for .nix files and the options you are trying to set up.

  • getting packages at a different version than your target (or not packaged at all) can be done in most cases easily with fetchFromGithub (https://ryantm.github.io/nixpkgs/builders/fetchers/)

  • you can easily install old revisions of packages using https://lazamar.co.uk/nix-versions/. You can conveniently spawn a shell with a chosen package available using vershell <NIXPKGS_REVISION> <PACKAGE>. Just make sure to pick a revision that has flakes enabled, otherwise you will need the legacy way of spawning the shell (see the link for more info)

  • when developing modules in a dev branch of another flake, you can use --override-input to temporarily use the local directory as the flake source.

  • including nixosConfig ? config in your module arguments is a smart way of enabling a module to pull in config from NixOS or home-manager config, no matter if it is a NixOS system or not.

  • you can have a quick CLI evaluation for nix commands with e.g. nixpgks.lib available using nix-instantiate --strict --eval --expr "let lib = import <nixpkgs/lib>; in <expression>".

  • if you are looking for a specific library, nix-locate makes it easy to look for them.

  • to look at the dependencies pulled in by a tool, use nix-tree

    • to find out which derivation uses another derivation, use nix store --query --referrers <derivation>
  • to get a neat overview of your config changes in recent generations, use nix profile diff-closures --profile /nix/var/nix/profiles/system

    • to get instead the changes since the last boot, use nix profile diff-closures /run/*-system
    • if you just need the generation numbers, use sudo nix-env --list-generations --profile /nix/var/nix/profiles/system
    • to then switch to another generation, you can use sudo nix-env --switch-generation <generation number> -p /nix/var/nix/profiles/system followed by sudo /nix/var/nix/profiles/system/bin/switch-to-configuration switch
  • These links are your best friends:

    • The nix documentation: https://nix.dev/
    • The nixpkgs reference manual: https://nixos.org/manual/nixpkgs/unstable/#buildpythonapplication-function
      • the nixpkgs repository - especially useful to look at the various READMEs that are in various places in the repository (find using GitHub code search) as well as the issues and PRs pages
      • and the nixpkgs Pull Request Tracker
    • The NixOS manual: https://nixos.org/manual/nixos/stable/
    • The NixOS package search: https://search.nixos.org/packages
      • and the nix package version search: https://lazamar.co.uk/nix-versions/
    • The NixOS option search https://search.nixos.org/options
    • mipmip's home-manager option search: https://mipmip.github.io/home-manager-option-search/
    • Alan Pearce's nix-darwin search: https://searchix.alanpearce.eu/options/darwin/search (which supports all of the other versions as well :o)
    • For the above, you can use the CLI tool manix
    • Nix function search: https://noogle.dev/
    • Search for nix-community options: https://search.nüschtos.de/
  • But that is not all:

    • Some nix resources
      • A tour of Nix: https://nixcloud.io/tour/
      • The Nix One Pager: https://github.com/tazjin/nix-1p
      • another one page introduction: https://learnxinyminutes.com/nix/
      • a very short introduction to Nix features: https://zaynetro.com/explainix
      • introductory nix article: https://medium.com/@MrJamesFisher/nix-by-example-a0063a1a4c55
      • and another one: https://web.archive.org/web/20210121042658/https://ebzzry.io/en/nix/#nix
      • How to learn nix: https://ianthehenry.com/posts/how-to-learn-nix/
      • the Nix Cookbook: https://github.com/functionalops/nix-cookbook?tab=readme-ov-file
      • and the Nix Pills: https://nixos.org/guides/nix-pills/
    • Some resources on flakes
      • Why to use flakes and introduction to flakes: https://www.tweag.io/blog/2020-05-25-flakes/
      • The NixOS & Flakes Book
      • and Wombat's book
      • as well as Ekala's book
      • or the Zero to Nix series
      • last but not least, NixOS in Production
      • Practical nix flakes article: https://serokell.io/blog/practical-nix-flakes
    • A bit on Overlays:
      • Overview on overlays: Mastering Nixpkgs overlays article
      • Some examples on best practices: Do's and Don'ts of overlays
      • Blog article about overrides: https://bobvanderlinden.me/customizing-packages-in-nix/#using-modified-packages
    • Also useful is the official NixOS Wiki
      • there is also the unofficial NixOS Wiki that tends to be a bit outdated, use with care
  • Some resources for specific nix tools:

    • Flake output reference: https://nixos-and-flakes.thiscute.world/other-usage-of-flakes/outputs
    • You can find public repositories with modules at https://nur.nix-community.org/ (you should check what you are installing however):
      • I like to use this for rycee's Firefox extensions: https://nur.nix-community.org/repos/rycee/
    • List of nerd-fonts: https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/data/fonts/nerd-fonts/manifests/fonts.json
    • Stylix configuration options: https://danth.github.io/stylix/
    • nix-on-droid options: https://nix-community.github.io/nix-on-droid/nix-on-droid-options.html#sec-options
  • Very useful tools that are mostly not directly used in configuration but instead called on need:

    • Convert non-NixOS machines to NixOS using nixos-infect
    • Create various installation media with nixos-generators
    • Remotely deploy NixOS using nixos-anywhere
  • And a few links that are not directly nix-related, but may still serve you well:

    • List of pre-commit-hooks: https://devenv.sh/reference/options/#pre-commithooks

Q: Why Is this just called .dotfiles?

A: Would you rename your children once they turn 18?

About

Flake-based, literate nix config for personal infrastructure

swarsel.github.io/.dotfiles/

Topics

diskodotfilesemacsemacs-overlayhome-managerimpermanencelanzabooteluks-encryptionnirinixnix-confignix-flakenix-on-droidnixosnixos-anywherenoctalia-shellsops-nixstylixsway

Resources

Readme
MIT license
Activity

Stars

91 stars

Watchers

0 watching

Forks

3 forks
Report repository

Releases

Used by

Contributors

Languages

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.