NixOS Configuration

Personal NixOS configuration using the den framework (dendritic pattern).

Hosts

Hostname	Profile	GPU
desktop	Gaming + development	Nvidia
notebook	Portable development	Intel

Prerequisites

• just: nix shell nixpkgs#just
• nvd for just diff: nix shell nixpkgs#nvd

Usage

# Rebuild and switch (uses current hostname automatically)
just switch

# Target a specific host
just switch desktop
just switch notebook

# Build only, without switching
just build

# Test (applies temporarily, reverts on next boot)
just test

# Update all inputs
just update

# Update a single input
just update-input nixpkgs

# Run garbage collection
just gc

# See what changed before switching
just diff

Secrets (SOPS + age)

Secrets are stored encrypted in secrets/secrets.yaml and decrypted at boot by sops-nix.

First-time setup on a new machine

1. Generate an age key:

   mkdir -p /etc/sops/age
   age-keygen -o /etc/sops/age/keys.txt
   

2. Add the new public key to .sops.yaml under keys:.

3. Re-encrypt secrets for all keys:

   sops updatekeys secrets/secrets.yaml
   

Adding a new secret

1. Edit the secrets file: just secrets
2. Declare it in modules/secrets.nix under sops.secrets.

Rotating the age key

1. Generate a new key (step 1 above).
2. Update .sops.yaml with the new public key.
3. Run sops updatekeys secrets/secrets.yaml to re-encrypt.

Identity

All user identity (name, email, SSH key) lives in modules/identity.nix. Override the defaults there or in a profile-specific module when creating a new user profile.

Adding a new host

1. Run nixos-generate-config on the target machine and copy the output to modules/_hardware/<hostname>-hardware.nix.
2. Add the host in modules/den.nix under den.hosts.
3. Define or reuse an aspect for the host profile.