My NixOS Configuration

Useful Commands

Hosts

Name	Description
server	Runs my homelab and hosts the bulk of my data.
zephyr	Runs alethea, chanel-vm and windows-vm.
io	Runs on a VPS. For logging and uptime monitoring.
desktop	Portal device.
laptop	Portal device.

Setting up a new host

All hosts with access to my server should have encrypted storage.

• Create its config (and optionally disko's config) under hosts/
• Generate the host's user's SSH key and place it in server's ~/keys. This key is used to encrypt/decrypt sops secrets in secrets.yaml.
• Add the host's age key to .sops.yaml: AGE_KEY=$(ssh-to-age -i /path/to/public/key) yq 'with(.creation_rules[0].key_groups[0].age; . += env(AGE_KEY) | .[-1] line_comment="host-name")' -i .sops.yaml
• From another host with its key added prior, add the new host's key to secrets.yaml with SOPS_AGE_KEY=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519) sops updatekeys secrets.yaml
• (optional) If this host should be allowed to SSH into my servers, add that SSH key to common-opt/allowSsh.nix.
• Deploy via nixos-anywhere
• SSH into the host as root and copy over the host's user's SSH key.
• Add the machine's SSH host key to the common known keys (obtain with ssh-keyscan -t ed25519 hostname)

Note: For systems using TPM2 with Secure Boot, ensure that Secure Boot is disabled during the installation. Follow the instructions here to enroll the Secure Boot keys post-installation. After that, enroll the LUKS key into the TPM following the instructions on the NixOS Wiki.

Post Install

Setup logins (these can't be declaratively set)

• Tailscale
• Telegram
• Whatsapp
• GSConnect pairing

Resources

• Dotfiles: dmadisetti, Electrostasy, reckenrode
• Hyprland configs: yurihikari, Waayway
• Comparison of git-crypt, agenix and sops-nix