NixOS Configuration

Personal NixOS configuration using the den framework (dendritic pattern).

Hosts

Hostname	Profile	GPU
desktop	Gaming + development	Nvidia
notebook	Portable development	Intel
work	Portable development	AMD + Nvidia (PRIME)

Prerequisites

• just: nix shell nixpkgs#just
• nvd for just diff: nix shell nixpkgs#nvd

Usage

# Rebuild and switch (uses current hostname automatically)
just switch

# Target a specific host
just switch desktop
just switch notebook

# Build only, without switching
just build

# Test (applies temporarily, reverts on next boot)
just test

# Update all inputs
just update

# Update a single input
just update-input nixpkgs

# Run garbage collection
just gc

# See what changed before switching
just diff

Installing on a new machine (notebook)

Only the notebook host supports automated installation via the installer ISO. No hardware-specific preparation is needed beforehand — the installer detects the hardware automatically using nixos-generate-config.

1. Build and flash the ISO

The ISO embeds the flake at build time, so all changes must be committed first.

# Commit any pending changes — the ISO only includes git-tracked files
git add -A && git commit -m "pre-install snapshot"

just iso
sudo dd if=result/iso/*.iso of=/dev/sdX bs=4M status=progress && sync

2. Boot and install

Boot the ISO on the target machine. The installer logs in as root automatically.

If you need Wi-Fi, the script will prompt you to connect via nmtui before proceeding.

Run the installer:

nixos-install-host

The script will:

1. Prompt to set up network (Wi-Fi via nmtui if needed)
2. Ask which host to install (notebook)
3. Auto-detect hardware with nixos-generate-config and inject the result into the flake
4. Show available disks and confirm the target
5. Ask for the age key (keys.txt) — copy it to a USB or provide the path manually
6. Partition the disk with LUKS + btrfs via disko (prompts for LUKS passphrase)
7. Run nixos-install
8. Copy the flake (with detected hardware config) to ~/repos/nixos on the new system

3. Age key

The age key used to encrypt secrets/secrets.yaml must be available during installation. Bring it on a USB drive — the installer will find it automatically at /run/media/*/keys.txt.

4. After the first boot

Commit the auto-detected hardware config so future ISO builds include it:

cd ~/repos/nixos
git add modules/_hardware/notebook-hardware.nix
git commit -m "add notebook hardware config"
git push

Note: GRUB will ask for the LUKS passphrase once during boot, and the initrd will ask again to mount the root filesystem. This is expected behavior with enableCryptodisk.

Secrets (SOPS + age)

Secrets are stored encrypted in secrets/secrets.yaml and decrypted at boot by sops-nix.

First-time setup on a new machine

1. Generate an age key:

   mkdir -p /etc/sops/age
   age-keygen -o /etc/sops/age/keys.txt
   

2. Add the new public key to .sops.yaml under keys:.

3. Re-encrypt secrets for all keys:

   sops updatekeys secrets/secrets.yaml
   

Adding a new secret

1. Edit the secrets file: just secrets
2. Declare it in modules/secrets.nix under sops.secrets.

Rotating the age key

1. Generate a new key (step 1 above).
2. Update .sops.yaml with the new public key.
3. Run sops updatekeys secrets/secrets.yaml to re-encrypt.

Identity

All user identity (name, email, SSH key) lives in modules/identity.nix. Override the defaults there or in a profile-specific module when creating a new user profile.

Adding a new host

1. Run nixos-generate-config on the target machine and copy the output to modules/_hardware/<hostname>-hardware.nix.
2. Add the host in modules/den.nix under den.hosts.
3. Define or reuse an aspect for the host profile.