Artur's NixOS & Nix Home Manager configurations

This repository contains NixOS configuration for my desktop, personal, and work laptops, Hetzner VM, and a small VM running on Proxmox (for my homelab). The configurations are based on a Nix flake for easy management and configuration. Changes are made in devel branch and then merged into main branch.

Note

System Information:

• Desktop environment: KDE Plasma 6
• File systems: BTRFS/ZFS
• Shell: zsh
• Terminal: Kitty
• Editor: Nixvim

Updates

Updates are managed via flake.lock on my Forgejo instance. The workflows are public.

Secrets

I keep secrets in a private repository and pull them into my configuration with flake. EmergentMind wrote a great post on how to implement this.

Stuff to Do Manually

Not everything is feasible (still?) to declare. Not an exhaustive list of stuff to do after the installation:

• Login into Librewolf for syncing
• Login into gh
• Login into fj (forgejo-cli)
• Login into bw
• Set up Thunderbird if it asks for password
• Set up tailscale
• Install Better Bibtex for Zotero

nixos-anywhere deployment

The script scripts/nixos-anywhere-deployment.sh allows the remote deployment of NixOS machines. I use it to deploy, for example, my NixOS box. It handles everything: from disk configuration to the actual configuration.

The only required environment variable is NIXOS_ANYWHERE_HOST.

export NIXOS_ANYWHERE_HOST=<host>

For secrets, I use pass utility. The secrets are decrypted by the host SSH key, which is an entry nixos_anywhere_ed25519_hostkey.

If you are deploying a new machine, first generate a unique SSH key for this machine and add it to pass.

cd /tmp
ssh-keygen ./id_ed25519
# This will overwrite the entry
pass insert --multiline --force nixos_anywhere_ed25519_hostkey < /tmp/id_ed25519
nix-shell -p ssh-to-age --run 'cat /tmp/id_ed25519.pub | ssh-to-age'

# Add the generate age key to sops.yaml

Then update the key
sops --config ../nix-secrets/.sops.yaml updatekeys ../nix-secrets/secrets.yaml

# Update the flake in nixos main repo
nix flake update nix-secrets

# Remove the generated key
rm /tmp/id_ed25519*

Configuration mirrors

This configuration is available on my own Forgejo instance, Codeberg and GitHub.