nix/README.md

NixOS Configuration Repository

NOTE: These configs expect this repo to be cloned to /etc/nixos/git/

• Clone this repo

sudo git clone https://git.sysctl.io/albert/nix /etc/nixos/git
sudo chown -R albert:root /etc/nixos/git
# or, with wallpapers
sudo git clone --recursive https://git.sysctl.io/albert/nix /etc/nixos/git
sudo chown -R albert:root /etc/nixos/git

• Installation:

nixos-install <Hostname> [<Username>]
# or 
./docs/install.sh <Hostname> [<Username>]

• Post install (home-manager, GPG keys, SOPS, etc)

nix develop -c /etc/nixos/git/docs/setup.sh

Machines

Name	Description	Status
backups-rpi4	Japan Raspberry Pi 4 for backups from nuc-server	Done
framework-server	sysctl.io - main server, framework 13th gen mainboard	Done
nixos-desktop	My main desktop	Done
nixos-framework	My AMD Framework 13 laptop	Done
osaka-linode-01	Osaka Linode relay for sysctl.io external connections	Done
milan-linode-01	Milan Linode DERP relay for Tailscale	Done
piaware-rpi4	FlightAware for Raspberry Pi	Done
quitman-rpi4	Raspberry Pi at my parents house. Headscale Exit Node	On Hold
nuc-server	Second NUC server at my brothers house	On Hold

Images

Name	Description	Build Commands
nixos-iso-console	Console ISO image of this flake for installing	nix build .#imageConfigurations.nixos-iso-console
nixos-iso-desktop	Gnome ISO image of this flake for installing	nix build .#imageConfigurations.nixos-iso-desktop
nixos-linode-img	Image of this flake for use on Linode	nix build .#imageConfigurations.nixos-linode-img
nixos-rpi4-img	Image of this flake for use on Raspberry Pi 4's	nix build .#imageConfigurations.nixos-rpi4-img

---

To Do List

• fixes
  • re-enable a few things when 24.05 is stable

Host Specific

framework-server

• Try this https://www.ntop.org/products/traffic-analysis/ntop/
• Podman mgiration - Potentially use nix-defined containers.

General

• Security hardening / scans / etc
• Where possible, convert cronjobs to systemd services / timers

Home-Manager

• Figure out what the home-manager account options are for.
• Find a way to remove all default search engines in Firefox (Google, Amazon, etc)

Desktop / GUI

• rofi - rbw integration
• Set up PyRadio with Nightride.FM
• Update desktop Hyprland config with new monitor setup
• See if I can hide the waybar hyprlan workspace switcher when only 1 desktop is present

Completed ToDo List here

---

Information

Home Manager

• Home Manager Documentation - Link
• Home Manager Options Search - Link

NixOS

• nix.dev - Official Nix Documentation - Link
• NixOS Documentation - Stable - Link
• NixOS Packages / Options Search - Link
• Nix User Repository (NUR) Search - Link
• ARM NixOS Building - Link
• NixOS Manual - Link

Useful Links

• FlakeHub - Link
• Flakestry.dev - Link
• Track a Nixpkgs PR - Link
• Awesome-Hyprland - Link

Examples

• Tons of good examples here - Link
• NixOS Flakes Intro Guide - Link

Theming

• Neofetch Themes - Link
• Stylix - Link
• Hyprland Inspirations
  • Aylur - Link
• Base16 Color Schemes - Link

---

Lanzaboote / SecureBoot

• Instructions here - Link

Generic Instructions:

1. Create your keys: sbctl create-keys
2. Verify your machine is ready for SecureBoot: sbctl verify - Everything except *-bzImage.efi are signed
3. Enter Secureboot Setup mode in your EFI Settings on the motherboard (F10)
   • Security -> SecureBoot -> Set to Enabled and "Reset to Setup Mode" and exit
4. Enroll the keys: sbctl enroll-keys --microsoft
   • If you wish, you can select --tpm-eventlog, but checksums will change later (ie, at a kernel rebuild)
5. Reboot and verify you are activated: bootctl status

Framework Specific:

1. Change boot import from boot.nix to secureboot.nix in ./nixos/hosts/<hostname>/default.nix
2. Run rebuild-host to switch from boot.nix to secureboot.nix
3. Reboot into EUFI and set SecureBoot settings to:
   • Enforce Secure Boot - Enabled
   • Erase all Secure Boot Settings - Enabled
   • Restore Secure Boot to Factory Settings - Disabled
4. Save and reboot
5. Run sudo sbctl create-keys
6. Run sudo sbctl enroll-keys
7. Reboot and verify with bootctl status

Manual: GPG Keys

1. Import the user private key: gpg --import gpg/users/albert/privkey.asc
2. Mark it as trusted: gpg --edit-key albert@sysctl.io, then type trust, then 5
3. On each new machine, run sudo nix-shell -p ssh-to-pgp --run "ssh-to-pgp -i /etc/ssh/ssh_host_rsa_key -o /etc/nixos/git/keys/hosts/$(hostname).asc"
   • This will output the identifier you add to .sops.yaml
   • Move HOSTNAME.asc to keys/hosts/ and upload to git and rename accordingly.

Secrets

1. Run nix-develop in /etc/nixos/git to import new keys
2. To edit a file: sops secrets/file.yml"
3. When you add a new machine, you must update the secrets files encryption.
   • Ensure .sops.yaml has the updated fingerprint and file mappings.
   • Run sops updatekeys secrets/file.yaml and commit the change.

Troubleshooting

1. To troubleshoot disko issues, this command can come in handy:

 nix eval .#nixosConfigurations.`hostname`.config.disko.devices._config

Directory Structure

/etc/nixos/git/
├── docs
├── home-manager
│   ├── common
│   │   ├── desktops
│   │   └── software
│   │       ├── cli
│   │       └── gui
│   ├── hosts
│   └── users
├── keys
│   ├── hosts
│   ├── ssh
│   └── users
├── lib
├── nixos
│   ├── common
│   │   ├── desktops
│   │   ├── modules
│   │   ├── services
│   │   └── software
│   │       ├── cli
│   │       └── gui
│   ├── hosts
│   ├── containers
│   └── users
├── secrets
│   ├── containers
│   └── hosts
├── stylix
│   ├── common
│   └── themes
└── wallpapers