My NixOS configuration and other infrastructure related things
Go to file
2021-03-30 23:24:52 +02:00
.git-crypt Add 1 git-crypt collaborator 2021-02-05 18:01:49 +01:00
machines fuuko/hedgedoc: Start after postgresql 2021-03-30 16:13:20 +02:00
modules Add binfmt emulation for all needed systems 2021-03-30 23:24:52 +02:00
nix Update sources 2021-03-30 10:06:52 +02:00
pkgs pkgs: Inherit callPackage from super 2021-03-20 21:10:09 +01:00
users/simon waybar: Do not print status on mpc invocation 2021-03-29 16:20:24 +02:00
.envrc Initial commit 2020-08-22 17:44:39 +02:00
.gitattributes pkgs: Add imprint 2021-02-14 19:48:50 +01:00
.gitignore Ignore all results 2020-12-17 09:50:25 +01:00
deploy.nix Replace builtins with lib where possible 2021-02-27 19:57:00 +01:00
LICENSE Initial commit 2020-08-22 17:44:39 +02:00 Explain machines/*/secrets in readme 2021-03-01 13:54:41 +01:00
shell.nix Replace builtins with lib where possible 2021-02-27 19:57:00 +01:00

NixOS configuration


  • deploy.nix: Configuration for deployment with krops
  • machines: Machine-specific configuration
    • Short overview of the hardware and usage of the machine
    • configuration.nix: Main configuration
    • hardware-configuration.nix: Hardware-specific configuration. It should not depend on any modules or files from this repository, since it is used for initial setup.
    • services: Non-trivial machine-specific configuration related to a specific service the machine provides.
    • secrets: Nix expressions that include information that is not meant to be visible to everyone (e.g. accounts, password hashes, private information etc.)
  • modules: Custom modules. Many are activated by default, since I want them on all systems.
  • pkgs: My nixpkgs overlay
  • users/simon: home-manager configuration

Secrets are managed with kropss integrated support for pass. Permission management for them is implemented in modules/secrets.nix.

How to install

This guide describes how to install this configuration with GPT and BIOS boot. It is not a one-fits-all guide, but the base for what I use for interactive systems. Servers and specialised systems may need a different setup (e.g. swap with random luks passphrase and no LVM).

Set up wifi if no wired connection is available:

wpa_passphrase "SSID" "PSK" | wpa_supplicant -B -i wlp4s0 -c/dev/stdin

Create the partition table (enter the indented lines in the repl):

parted /dev/sdX
  mktable GPT
  mkpart primary 1MiB 2MiB
  mkpart primary 2MiB 500MiB
  mkpart primary 500MiB 100%
  set 1 bios_grub on
  disk_toggle pmbr_boot

Format encrypted partition and open it:

cryptsetup luksFormat --type luks2 /dev/sdX3
cryptsetup open --type luks2 /dev/sdX3 HOSTNAME-pv

Create LVM (replace 8G with desired swap size):

pvcreate /dev/mapper/HOSTNAME-pv
vgcreate HOSTNAME-vg /dev/mapper/HOSTNAME-pv
lvcreate -L 8G -n swap HOSTNAME-vg
lvcreate -l '100%FREE' -n root HOSTNAME-vg

Hint: If you have to reboot to the installation system later because something went wrong and you need access to the LVM (but dont know LVM), do the following after opening the luks partition: vgchange -ay.

Create filesystems:

mkfs.ext2 /dev/sdX2
mkfs.ext4 -L root /dev/HOSTNAME-vg/root
mkswap -L swap /dev/HOSTNAME-vg/swap

Mount the file systems and activate swap:

mount /dev/HOSTNAME-vg/root /mnt
mkdir /mnt/boot
mount /dev/sdX2 /mnt/boot
swapon /dev/HOSTNAME-vg/swap

Generate hardware configuration and copy hardware configuration to machine configuration (skip this step if you already have a hardware-configuration for this machine):

nixos-generate-config --root /mnt/

Modify the hardware configuration as needed. Fill in the FIXME fields of machines/installation/configuration.nix and copy it to /mnt/etc/nixos/configuration.nix.

Install NixOS:


Add the krops sentinel file:

mkdir -p /mnt/var/src
touch /mnt/var/src/.populate

After the successful instalation, reboot use deploy HOSTNAME on another system to deploy the new system using krops, after adding the configuration.nix and entry in machines/default.nix for the machine.


As nixpkgs, this repository is licensed under the MIT License. This only applies to the nix expressions, not the built system or package closure. Patches may also be licensed differently, since they may be derivative works of the packages to which they apply.