Nix Derivations and OS configurations

Collection of system configurations and derivations for packages not found in Nixpkgs, accessible via a Nix flake.

Derivations

FlakeTeX

A script to compile a LaTeX project via pdflatex provided by TeX Live.

nix run github:hfxbse/nixos-config#flaketex

Parameters to the script can be pass after a -- as typical for flakes. Here is an example which will display the script help.

# everything after the `--` will be passed to the script
nix run github:hfxbse/nixos-config#flaketex -- -h

Nixvim

Neovim configuration on all host machines implemented using NixVim. Can be run as a standalone program, no dependency on NixOS, though Nerd Fonts is needed to display icons correctly.

Quick template

Wrapper around nix flake init to avoid having to type long URLs manually.

Templates

Baseline flake template

• .editorconfig for .nix files and enforcing a new line at the end of all files.
• GitHub Workflow to check the validity of the flake.
• system helper function only using nixpkgs.lib.genAttrs.
• .gitignore excluding build output from Nix.

To utilize this template run

nix flake init -t github:hfxbse/nixos-config

Host configurations

Bootstrapping desktops and laptops

1. Disable secure boot in the BIOS of your computer and set it into setup mode.
2. Format the disk from the installer via disko:

   sudo nix --experimental-features "nix-command flakes" \
       run github:nix-community/disko/latest -- \
       --mode destroy,format,mount \
       disk-config.nix

3. Install NixOS from the configuration flake:

   sudo nixos-install --flake .

   ⚠️ Secure boot needs to be disabled in the configuration at this point ⚠️
4. Enter the installation via nixos-enter and set the password of the normal users.
5. Boot into the new NixOS installation
6. Generate secure boot platform keys and enroll them:

   nix run nixpkgs#sbctl -- create-keys
   nix run nixpkgs#sbctl -- enroll-keys

   ⚠️ Omitting Microsoft's platform keys might brick your system ⚠️ This has not been an issue on a Lenovo ThinkPad X12 gen 1.
7. Enabled secure boot within the BIOS of your computer.
8. Setup automatic unlocking of the LUKS's encryption via TPM:

   sudo systemd-cryptenroll --tpm2-device auto --tpm2-pcrs=0+2+7+12 --wipe-slot=tpm2 /dev/X

Bootstrapping the server

1. Create a file on your local machine at /tmp/disk.key containing the LUKS password.
2. Populate the host/<server-name>/setup-keys directory with the authorized_keys files. You need this to access the server after the installation as no initial password is set.
3. Disable secure boot in the server configuration. Secure boot can only be configuration after the initial installation. See the guide for desktop machines and laptops for more information.
4. Run nixos-anywhere to install the NixOS configuration

    nix run github:nix-community/nixos-anywhere -- \
        --flake .#<server-name> \
        --no-substitute-on-destination \
        --target-host <user>@<host> \
        --disk-encryption-keys /tmp/disk.key /tmp/disk.key \
        --extra-files hosts/<server-name>/setup-keys/

ISO

Minimal live system to create a bootable ISO from with Nix flakes enabled by default as well as other quality of live improvements for a headless installation.

A parameterized build is possible using the non-flake CLI, for example setting up an authorized key for an SSH connection can be accomplished via

nix-build iso.nix --argstr authorizedKey "$(cat ~/.ssh/id_rsa.pub)"