143 lines
4.1 KiB
Markdown
143 lines
4.1 KiB
Markdown
# NixOS Configuration
|
|
|
|
Personal NixOS configuration using the [den](https://github.com/vic/den) framework (dendritic pattern).
|
|
|
|
## Hosts
|
|
|
|
| Hostname | Profile | GPU |
|
|
|------------|----------------------|--------|
|
|
| `desktop` | Gaming + development | Nvidia |
|
|
| `notebook` | Portable development | Intel |
|
|
| `work` | Portable development | AMD + Nvidia (PRIME) |
|
|
|
|
## Prerequisites
|
|
|
|
- [just](https://github.com/casey/just): `nix shell nixpkgs#just`
|
|
- [nvd](https://github.com/khumba/nvd) for `just diff`: `nix shell nixpkgs#nvd`
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
# Rebuild and switch (uses current hostname automatically)
|
|
just switch
|
|
|
|
# Target a specific host
|
|
just switch desktop
|
|
just switch notebook
|
|
|
|
# Build only, without switching
|
|
just build
|
|
|
|
# Test (applies temporarily, reverts on next boot)
|
|
just test
|
|
|
|
# Update all inputs
|
|
just update
|
|
|
|
# Update a single input
|
|
just update-input nixpkgs
|
|
|
|
# Run garbage collection
|
|
just gc
|
|
|
|
# See what changed before switching
|
|
just diff
|
|
```
|
|
|
|
## Installing on a new machine (notebook)
|
|
|
|
Only the `notebook` host supports automated installation via the installer ISO.
|
|
No hardware-specific preparation is needed beforehand — the installer detects the
|
|
hardware automatically using `nixos-generate-config`.
|
|
|
|
### 1. Build and flash the ISO
|
|
|
|
The ISO embeds the flake at build time, so **all changes must be committed first**.
|
|
|
|
```bash
|
|
# Commit any pending changes — the ISO only includes git-tracked files
|
|
git add -A && git commit -m "pre-install snapshot"
|
|
|
|
just iso
|
|
sudo dd if=result/iso/*.iso of=/dev/sdX bs=4M status=progress && sync
|
|
```
|
|
|
|
### 2. Boot and install
|
|
|
|
Boot the ISO on the target machine. The installer logs in as root automatically.
|
|
|
|
**If you need Wi-Fi**, the script will prompt you to connect via `nmtui` before proceeding.
|
|
|
|
Run the installer:
|
|
```bash
|
|
nixos-install-host
|
|
```
|
|
|
|
The script will:
|
|
1. Prompt to set up network (Wi-Fi via `nmtui` if needed)
|
|
2. Ask which host to install (`notebook`)
|
|
3. **Auto-detect hardware** with `nixos-generate-config` and inject the result into the flake
|
|
4. Show available disks and confirm the target
|
|
5. Ask for the age key (`keys.txt`) — copy it to a USB or provide the path manually
|
|
6. Partition the disk with LUKS + btrfs via disko (prompts for LUKS passphrase)
|
|
7. Run `nixos-install`
|
|
8. Copy the flake (with detected hardware config) to `~/repos/nixos` on the new system
|
|
|
|
### 3. Age key
|
|
|
|
The age key used to encrypt `secrets/secrets.yaml` must be available during installation.
|
|
Bring it on a USB drive — the installer will find it automatically at `/run/media/*/keys.txt`.
|
|
|
|
### 4. After the first boot
|
|
|
|
Commit the auto-detected hardware config so future ISO builds include it:
|
|
|
|
```bash
|
|
cd ~/repos/nixos
|
|
git add modules/_hardware/notebook-hardware.nix
|
|
git commit -m "add notebook hardware config"
|
|
git push
|
|
```
|
|
|
|
> **Note:** GRUB will ask for the LUKS passphrase once during boot, and the initrd will ask
|
|
> again to mount the root filesystem. This is expected behavior with `enableCryptodisk`.
|
|
|
|
## Secrets (SOPS + age)
|
|
|
|
Secrets are stored encrypted in `secrets/secrets.yaml` and decrypted at boot by [sops-nix](https://github.com/Mic92/sops-nix).
|
|
|
|
### First-time setup on a new machine
|
|
|
|
1. Generate an age key:
|
|
```bash
|
|
mkdir -p /etc/sops/age
|
|
age-keygen -o /etc/sops/age/keys.txt
|
|
```
|
|
|
|
2. Add the new public key to `.sops.yaml` under `keys:`.
|
|
|
|
3. Re-encrypt secrets for all keys:
|
|
```bash
|
|
sops updatekeys secrets/secrets.yaml
|
|
```
|
|
|
|
### Adding a new secret
|
|
|
|
1. Edit the secrets file: `just secrets`
|
|
2. Declare it in `modules/secrets.nix` under `sops.secrets`.
|
|
|
|
### Rotating the age key
|
|
|
|
1. Generate a new key (step 1 above).
|
|
2. Update `.sops.yaml` with the new public key.
|
|
3. Run `sops updatekeys secrets/secrets.yaml` to re-encrypt.
|
|
|
|
## Identity
|
|
|
|
All user identity (name, email, SSH key) lives in `modules/identity.nix`. Override the defaults there or in a profile-specific module when creating a new user profile.
|
|
|
|
## Adding a new host
|
|
|
|
1. Run `nixos-generate-config` on the target machine and copy the output to `modules/_hardware/<hostname>-hardware.nix`.
|
|
2. Add the host in `modules/den.nix` under `den.hosts`.
|
|
3. Define or reuse an aspect for the host profile.
|