nix-config

My personal NixOS configuration, managed as a Nix flake using the Blueprint framework.

The Hosts, NixOS Modules, Home Manager Modules, and Packages sections below are generated by packages/readme.nix and verified in CI (checks/readme.nix). Don't edit the content between the GENERATED markers by hand — edit the source (hostMeta, a module's # meta.description comment, or a package's meta.description) and run install -m 644 "$(nix build --no-link --print-out-paths .#readme)" README.md.

Hosts

morpheus (x86_64-linux)

Main workstation and home server — programming, gaming, multimedia, and self-hosted services.

• CPU: AMD Ryzen 5950X — RAM: 128 GB — GPU: AMD RX 6700 XT
• Storage: 1× 512 GB NVMe (root), 2× 2 TB NVMe (system), 2× 4 TB HDD (BTRFS mirror), 6× 4 TB IronWolf via LSI HBA (ZFS RAIDZ2)
• LUKS-encrypted root, Secure Boot via lanzaboote
• Services: Immich, Plex, Paperless-ngx, Firefly III, Vikunja, Home Assistant, Attic, Hydra, Nixarr, LubeLogger, llama.cpp

neo (x86_64-linux)

Development laptop; occasional gaming.

• Dell XPS 15 9560 — CPU: Intel i7-7700HQ — RAM: 64 GB
• Storage: 1 TB NVMe
• LUKS-encrypted root, Secure Boot via lanzaboote
• BorgBackup to trinity (AC power only)

oracle (x86_64-linux)

VPS.

• Tailscale exit node
• acme-dns for auth.lyndeno.ca
• Auto-upgrades nightly from GitHub

trinity (aarch64-linux)

BorgBackup repository host for morpheus and neo.

• Raspberry Pi 4B (4 GB) + 2 TB USB HDD
• Image-based, A/B-updatable NixOS (systemd-repart + systemd-sysupdate)

---

Structure

Blueprint auto-discovers modules, packages, and hosts — adding a file in the right place exposes it as a flake output.

hosts/<name>/configuration.nix    # per-host config
modules/nixos/<name>/default.nix  # → flake.nixosModules.<name>
modules/home/<name>/default.nix   # → flake.homeModules.<name>
packages/<name>.nix               # → flake.packages.<system>.<name>
patches/<pkg>.{patch,nix}         # auto-applied to nixpkgs.<pkg> (see Patches)
overlays/<name>.nix               # auto-applied overlay (see Overlays)
secrets/                          # age-encrypted secrets
pubKeys.nix                       # SSH/Age public keys for hosts and users

NixOS Modules

Module	Purpose
acme	ACME wildcard certificates via acme-dns DNS-01 challenges
asus-desktop	ASUS desktop hardware configuration
attic-watch	Pushes the local Nix store to the Attic cache
atticd	Attic binary cache server (atticd)
borgmatic	Shared borgmatic backup configuration
calibre-web	Calibre-Web ebook library server
common	Base system shared by all hosts: Nix, security, systemd-networkd, Tailscale, hostMeta
desktop	Desktop base: Wayland session, PipeWire audio, printing, firmware updates, mDNS
failure-notify	E-mails a report when a systemd unit enters the failed state
firefly	Firefly III personal finance manager
gaming	Steam, Gamescope and gaming applications
gpu-coredump	Saves DRM/amdgpu device coredumps before the kernel expires them
home-assistant	Home Assistant home automation
host-meta	Declares the hostMeta options consumed by the README generator
hydra	Hydra continuous-integration server
hydraCache	Substitutes builds from the lyndeno Attic cache
immich	Immich photo library with a daily RAW/JPG stacking job
laptop	Laptop power management: suspend-then-hibernate, iwd, geolocated timezone
llama-swap	llama-swap: on-demand model swapping in front of llama.cpp (Vulkan)
localProxy	nginx reverse proxy exposing local services on subdomains
lubelogger	LubeLogger vehicle maintenance tracker
modprobed-db	Records every kernel module ever loaded, for make localmodconfig
msmtp	System mail relay via msmtp (Fastmail)
niri	Niri scrolling Wayland compositor
nixarr	Media automation stack (Sonarr/Radarr/Prowlarr/Transmission) behind a VPN
paperless	Paperless-ngx document management with a Samba consumption share
plex	Plex Media Server
postgresql	PostgreSQL database server
secureboot	Secure Boot via lanzaboote
server	Server hardening: watchdog, no suspend, headless smartd mail alerts
stylix	System-wide Stylix theming (Gruvbox Dark Hard, Sedona wallpaper)
syncthing	Syncthing file synchronisation
vikunja	Vikunja task and to-do manager
virtualisation	libvirt/QEMU virtual machines with virt-manager
xps-9560	Dell XPS 15 9560 hardware support
zed	ZFS Event Daemon notifications via Pushover
zfs	ZFS support with periodic scrub and TRIM

Home Manager Modules

Module	Purpose
alacritty	Alacritty terminal emulator
desktop	Desktop user apps (Firefox, Spotify, qutebrowser)
development	Developer tooling and language servers
email	aerc email client with Fastmail JMAP
lsanche	Base user config: Git and SSH keys
niri	Niri compositor user config (keybinds, layout)
nixvim	Neovim configured via nixvim (LSP, completion, plugins)
qutebrowser	qutebrowser keyboard-driven web browser
shell	Fish shell with Starship, Atuin, Bat, Eza and FZF
spotify	Spotify desktop client
spotifyd	spotifyd headless Spotify daemon
vscode	Visual Studio Code
wlroots	Shared Wayland user services: waybar, mako, swayidle, kanshi, wob

Packages

Package	Description
battery-status	Reports AC adapter state as on/off/n/a
cmp-notmuch	nvim-cmp completion source backed by notmuch
fastmail-unread	Prints the Fastmail unread message count via JMAP
hmts	Tree-sitter highlighting for embedded code in Home Manager files (hmts.nvim)
hydra-latest	Resolves the latest successful Hydra build for a host to its store path
img-blur	Writes a Gaussian-blurred copy of an image (wallpaper helper)
img-darken	Writes a darkened copy of an image (wallpaper helper)
lock-screen	Locks the screen (swaylock) with a blurred wallpaper, falling back to a plain lock
lock-screen-timeout	Powers off monitors on idle, but only while the screen is locked
qutebrowser-aerc	Throwaway qutebrowser instance for opening links from aerc
screen-timeout	Powers off all monitors via niri
screenshot-annotate	Region screenshot with annotation (grim/slurp + satty)
screenshot-ocr	OCRs a screenshot region to the clipboard (tesseract)
sleep-on-battery	Suspend-then-hibernate when running on battery
terminal-weather	Shows the weather in a terminal and waits for a keypress
update-available	Waybar module reporting whether a newer Hydra build is available
update-system	Activates the latest Hydra-built system closure fetched from the cache
update-system-hold	Runs update-system, then holds the terminal open
wallpaper	The desktop wallpaper (Sedona), with blurred and darkened variants
wb-cast	Waybar module showing the current niri screencast target
wb-cell	Waybar module showing phone cellular signal/type via BatteryInfoServer
wb-email	Waybar module showing the unread email count
wb-fan	Waybar module showing fan speed
wb-phone-battery	Waybar module showing phone battery status via BatteryInfoServer
wb-ts	Waybar module showing the active Tailscale exit node
webcam-picker	Picks a webcam via fuzzel and launches a viewer
wob-brightness	Adjusts screen brightness with a wob overlay bar
wob-volume	Adjusts volume/mute with a wob overlay bar

Packages include NixOS VM tests, run via nix flake check.

Patches

Nixpkgs patches are auto-discovered from patches/ and applied to the matching package by name — no per-package overlay needed:

patches/<pkg>.patch    # vendored patch file, used as-is
patches/<pkg>.nix      # { url, hash, ... } passed to fetchpatch; name defaults to the filename
patches/<pkg>/*.patch  # multiple patches/specs for one package
patches/<pkg>/*.nix

Overlays

Every overlays/*.nix file is auto-discovered and applied as an overlay — no need to list it in flake.nix. A file is imported and, if it takes an {inputs, ...}-style argument, called with {inherit inputs;} first; otherwise it's used directly as the final: prev: ... overlay.

Theming

Stylix provides system-wide theming on desktop machines — Gruvbox Dark Hard color scheme, Sedona wallpaper.

Secrets

Age-encrypted .age files in secrets/. secrets/secrets.nix maps each secret to host public keys. Managed with agenix.