My NixOS configuration and other infrastructure related things
You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Go to file
Simon Bruder 43067ad796
neovim: Rework configuration in lua
Many plugins are not yet configured, but the basic functionality is
2 years ago
.git-crypt Add 1 git-crypt collaborator 2 years ago
keys yuzuru: Init 2 years ago
machines vueko/mail: Add alias 2 years ago
modules yuzuru: Init 2 years ago
pkgs pkgs/rtw89: Add src override at unstable-2021-10-21 2 years ago
users/simon neovim: Rework configuration in lua 2 years ago
.envrc direnv: Use nix-direnv’s use_flake 2 years ago
.gitattributes Use sops for secrets 2 years ago
.gitignore Ignore all results 3 years ago
.sops.yaml yuzuru: Init 2 years ago
LICENSE Initial commit 3 years ago readme: Clarify the license statement 2 years ago
flake.lock neovim: Rework configuration in lua 2 years ago
flake.nix neovim: Rework configuration in lua 2 years ago
secrets.yaml mayushii: Init 2 years ago

NixOS configuration


  • machines: Machine-specific configuration
    • Short overview of the hardware and usage of the machine
    • configuration.nix: Main configuration
    • hardware-configuration.nix: Hardware-specific configuration. It should not depend on any modules or files from this repository, since it is used for initial setup.
    • services: Non-trivial machine-specific configuration related to a specific service the machine provides.
    • secrets: Nix expressions that include information that is not meant to be visible to everyone (e.g. accounts, password hashes, private information etc.) or secrets for services that dont provide any other (easy) way of specifying them and whose secrets leaking does not pose a huge threat
  • modules: Custom modules. Many are activated by default, since I want them on all systems.
  • pkgs: My nixpkgs overlay
  • users/simon: home-manager configuration

Secrets are managed with sops-nix.

Machines can be deployed with nix run .#deploy/hostname, LUKS encrypted systems can be unlocked over network with nix run .#unlock/hostname.

How to install

This guide describes how to install this configuration with GPT and BIOS boot. It is not a one-fits-all guide, but the base for what I use for interactive systems. Servers and specialised systems may need a different setup (e.g. swap with random luks passphrase and no LVM).

Set up wifi if no wired connection is available:

wpa_passphrase "SSID" "PSK" | wpa_supplicant -B -i wlp4s0 -c/dev/stdin

Create the partition table (enter the indented lines in the repl):

parted /dev/sdX
  mktable GPT
  mkpart primary 1MiB 2MiB
  mkpart primary 2MiB 500MiB
  mkpart primary 500MiB 100%
  set 1 bios_grub on
  disk_toggle pmbr_boot


parted /dev/nvmeXnY
  mktable GPT
  mkpart ESP 1MiB 512MiB
  mkpart root 512MiB 100%
  set 1 esp on

Format encrypted partition and open it:

cryptsetup luksFormat --type luks2 /dev/sdX3
cryptsetup open --type luks2 /dev/sdX3 HOSTNAME-pv

Create LVM (replace 8G with desired swap size):

pvcreate /dev/mapper/HOSTNAME-pv
vgcreate HOSTNAME-vg /dev/mapper/HOSTNAME-pv
lvcreate -L 8G -n swap HOSTNAME-vg
lvcreate -l '100%FREE' -n root HOSTNAME-vg

Hint: If you have to reboot to the installation system later because something went wrong and you need access to the LVM (but dont know LVM), do the following after opening the luks partition: vgchange -ay.

Create filesystems:

mkfs.ext2 /dev/sdX2
mkfs.btrfs -L root /dev/HOSTNAME-vg/root
mkswap -L swap /dev/HOSTNAME-vg/swap


mkfs.fat -F 32 -n boot /dev/nvmeXnYpZ
mkfs.btrfs -L root /dev/HOSTNAME-vg/root
mkswap -L swap /dev/HOSTNAME-vg/swap

Mount the file systems and activate swap:

mount /dev/HOSTNAME-vg/root /mnt
mkdir /mnt/boot
mount /dev/sdX2 /mnt/boot
swapon /dev/HOSTNAME-vg/swap

Generate hardware configuration and copy hardware configuration to machine configuration (skip this step if you already have a hardware-configuration for this machine):

nixos-generate-config --root /mnt/

Modify the hardware configuration as needed and add it to the machine configuration in this repository. If necessary, create the machine configuration first by basing it on an already existing configuration and adding an entry to machines/default.nix. Then copy this repository to the target machine and run (--impure is needed since /mnt/nix/store is not in /nix/store):

nixos-install --impure --flake /path/to/repository#hostname

Add the krops sentinel file:

mkdir -p /mnt/var/src
touch /mnt/var/src/.populate



Unless otherwise noted in the specific files or directories, the files in this repository are licensed under the MIT License. This only applies to the nix expressions, not the built system or package closures. Patches may also be licensed differently, since they may be derivative works of the packages to which they apply.