My NixOS configuration and other infrastructure related things
Go to file
Simon Bruder bf7403204f
vueko/mail: Add alias
2024-04-28 23:28:53 +02:00
.git-crypt Add 1 git-crypt collaborator 2024-01-23 23:02:13 +01:00
.reuse Simplify git-crypt key paths in dep5 2024-01-23 23:01:53 +01:00
LICENSES waybar: Add security key interaction notification 2024-01-22 17:32:04 +01:00
keys okarin: Migrate to different VPS 2024-04-17 12:40:46 +02:00
machines vueko/mail: Add alias 2024-04-28 23:28:53 +02:00
modules Do not use gpg-agent for ssh on headless systems 2024-04-26 11:41:42 +02:00
pkgs renge/mastodon: Init 2024-04-28 11:38:51 +02:00
users/simon Do not use gpg-agent for ssh on headless systems 2024-04-26 11:41:42 +02:00
.envrc Relicense 2024-01-13 14:39:22 +01:00
.gitattributes Relicense 2024-01-13 14:39:22 +01:00
.gitignore Relicense 2024-01-13 14:39:22 +01:00
.sops.yaml okarin: Migrate to different VPS 2024-04-17 12:40:46 +02:00 Add license exceptions to readme 2024-02-14 14:54:46 +01:00
flake.lock flake.lock: Update 2024-04-13 10:39:56 +02:00
flake.lock.license Relicense 2024-01-13 14:39:22 +01:00
flake.nix Relicense 2024-01-13 14:39:22 +01:00
secrets.yaml sops: Switch to new PGP key 2024-01-22 17:32:02 +01:00

NixOS configuration


  • machines: Machine-specific configuration
    • Short overview of the hardware and usage of the machine
    • configuration.nix: Main configuration
    • hardware-configuration.nix: Hardware-specific configuration. It should not depend on any modules or files from this repository, since it is used for initial setup.
    • services: Non-trivial machine-specific configuration related to a specific service the machine provides.
    • secrets: Nix expressions that include information that is not meant to be visible to everyone (e.g. accounts, password hashes, private information etc.) or secrets for services that dont provide any other (easy) way of specifying them and whose secrets leaking does not pose a huge threat
  • modules: Custom modules. Many are activated by default, since I want them on all systems.
  • pkgs: My nixpkgs overlay
  • users/simon: home-manager configuration

Secrets are managed with sops-nix.

Machines can be deployed with nix run .#deploy/hostname, LUKS encrypted systems can be unlocked over network with nix run .#unlock/hostname.

How to install

This guide describes how to install this configuration with GPT and BIOS boot. It is not a one-fits-all guide, but the base for what I use for interactive systems. Servers and specialised systems may need a different setup (e.g. swap with random luks passphrase and no LVM).

Set up wifi if no wired connection is available:

systemctl start wpa_supplicant
  set_network 0 ssid "SSID"
  set_network 0 psk "PSK"
  set_network 0 key_mgmt WPA-PSK
  enable_network 0

Create the partition table (enter the indented lines in the repl):

parted /dev/nvmeXnY
  mktable GPT
  mkpart ESP 1MiB 512MiB
  mkpart root 512MiB 100%
  set 1 esp on


parted /dev/sdX
  mktable GPT
  mkpart primary 1MiB 2MiB
  mkpart primary 2MiB 512MiB
  mkpart primary 512MiB 100%
  set 1 bios_grub on
  disk_toggle pmbr_boot

Format encrypted partition and open it:

cryptsetup luksFormat --type luks2 /dev/nvmeXnYp2
cryptsetup open /dev/nvmeXnYp2 HOSTNAME-pv

Create LVM (replace 8G with desired swap size):

pvcreate /dev/mapper/HOSTNAME-pv
vgcreate HOSTNAME-vg /dev/mapper/HOSTNAME-pv
lvcreate -L 8G -n swap HOSTNAME-vg
lvcreate -l '100%FREE' -n root HOSTNAME-vg

Hint: If you have to reboot to the installation system later because something went wrong and you need access to the LVM (but dont know LVM), do the following after opening the luks partition: vgchange -ay.

Create filesystems:

mkfs.fat -F 32 -n boot /dev/nvmeXnYpZ
mkfs.btrfs -L root /dev/HOSTNAME-vg/root
mkswap -L swap /dev/HOSTNAME-vg/swap


mkfs.ext2 /dev/sdX2
mkfs.btrfs -L root /dev/HOSTNAME-vg/root
mkswap -L swap /dev/HOSTNAME-vg/swap

Mount the file systems and activate swap:

mount -o compress=zstd /dev/HOSTNAME-vg/root /mnt
mkdir /mnt/boot
mount /dev/nvmeXnYp1 /mnt/boot
swapon /dev/HOSTNAME-vg/swap

Generate hardware configuration and copy hardware configuration to machine configuration (skip this step if you already have a hardware-configuration for this machine):

nixos-generate-config --root /mnt/

Modify the hardware configuration as needed and add it to the machine configuration in this repository. If necessary, create the machine configuration first by basing it on an already existing configuration and adding an entry to machines/default.nix. Then copy this repository to the target machine and run (--impure is needed since /mnt/nix/store is not in /nix/store):

nixos-install --no-channel-copy --impure --flake /path/to/repository#hostname

Add the krops sentinel file:

mkdir -p /mnt/var/src
touch /mnt/var/src/.populate



This repository is REUSE compliant. To get the most correct licensing information, please consult the REUSE specification or use a tool that parses it.

As a rule of thumb, most code files are released under the AGPL-3.0-or-later, most generated files are specified as CC0-1.0 (as they are not copyrightable) and small independent scripts are licensed under Apache-2.0. However, there are deviations from this, so always consult the file header and other resources as specified in the REUSE specification.

Please note that those licensing terms only apply to the source files in this repository, not any build outputs, like system or package closures. They might be licensed differently, depending on their source.

If you think you have a compelling reason why you should be able to use part of this repository under a more permissive license, please contact me, so we can figure something out. Please note, that I can only offer this for files that are solely authored by me, as I do not own the rights to other peoples code.