Skip to content

Latest commit

 

History

History
123 lines (90 loc) · 5.06 KB

README.md

File metadata and controls

123 lines (90 loc) · 5.06 KB
Raw

NixOS Configurations

Here are my NixOS configurations.

I'm using this for consistent configuration and portability from machine to machine with a small amount of changes (usually disks, partitions, or hardware changes)

The configurations allow for a base system to be installed, with a core amount of applications to operate, you could add to it, but I feel that this configuration shines when you pair it with something like Home Manager for discrete per-er configuration of their environment. Head on overto my Nix Home Manager | Dotfiles Repository to get an understanding on how I "daily drive" my userspace environments.

Highlights:

BTRFS subvolume implementation with hourly automatic snapshots

  • Impermanence toggled for a clean installation on each reboot

  • Toggled full disk encryption

  • Support for RAID configurations

  • Toggled options for hardware, applications, and features, like VPNs

  • Deployment of secrets using sops-nix

  • Much, much more

  • I blewspent the summer of 2023 moving into this configuration after waving a fond farewell to near 2 decades of running Arch Linux. This, as with life, is still WIP. I documented the process on the Tired of IT! NixOS chapter on my website.

Tree Structure

  • flake.nix: Entrypoint for NixOS configurations.
  • hosts: Host Configurations
    • common: Shared configurations consumed by all hosts.
      • secrets: Secrets that are available to all users
    • <host_a>: "host_a" specific hardware and host configuration
      • secrets: Secrets that are specific to the 'host_a' host
    • ...: And so on as above with other hosts
  • lib: Helpers, functions, libraries and timesavers
  • modules: Modules that are specific to this implementation and allow for toggled configuration
    • application: Applications accessible to all users of system
    • container: Containers using some sort of OCI container engine
    • features: Features such as virtualization, gaming, cross compilation
    • filesystem: Encryption, impermanence, BTRFS options
    • hardware: Bluetooth, Printing, Sound, Wireless
    • network: Firewalls and VPNs
    • service: Miscellanious daemons
  • overlays: Ammendments and updates to packages that exist in the nix ecosphere
  • pkgs: Custom packages, services, scripts that are specific to this installation
  • users: Individual User folders

Usage

Manual approach

Get your installer disc booted up and your disks partitioned. I took notes on how I did an install with BTRFS and encryption on my website. Once you have your partitions created and subvolumes mounted then we can continue..

  • Generate your hardware-configuration.nix file.
nixos-generate-config --root /mnt --file /tmp
  • Go ahead and clone this repository.
nix-shell -p git nixFlakes
git clone https://github.com/tiredofit/nixos-config.git /mnt/etc/nixos

  • Either create a new host entry in flake.nix and add associated bits to the hosts folder or modify one of the existing hosts hardware-configuration.nix with what you generated above. That's kinda janky, but it'll get you started..

  • Install your new NixOS system

nixos-install --root /mnt --flake /mnt/etc/nixos#<host>

Optimized deployment via script

  • Use the included deployment script on an Arch or NixOS system to:
    • Add remove new hosts and templates
    • Update Flake
    • Update running system
    • Generate SSH Key and AGE keys per host
    • Update host / repository secrets
    • Remotely install a new system based on configuration via SSH
    • Build locally and remotely update an in place system via SSH

Configuring a system

Features are toggleable via the host configuration options. Have a look insie the modules/nixos folder for options available.

For example to have a base AMD system using with an integrated GPU using BTRFS as a file system that allowed SSH, Docker, and a hardware webcam it would be configured as such:

  host = {
    hardware = {
      cpu = "amd";
      graphics = {
        acceleration = true;
        displayServer = "x";
        gpu = "integrated-amd";
      };
      webcam.enable = true;
    };
    network = {
      hostname = "samplehostname" ;
      domainname = "tiredofit.ca" ;
    };
    role = server;
  };

This very much relies on the modules/roles folder and sets defaults per role, which can be overridden in each hosts unique configuration.

Keep it up to date

sudo nix flake update /etc/nixos/
sudo nixos-rebuild switch --flake /etc/nixos/#<host>

Managing Secrets

I document the process of getting encrypted secrets created and keeping up to date on my website. Tired of IT! Secrets Management.

License

Do you what you'd like and I hope that this inspires you for your own configurations as many others have myself attribution would be appreciated.