Warning

Still learning and trying out nix

NixOS Configuration

Flake configuration for my system.

System

Highlights are mainly:

• btrfs with lzo compression
• zram
• impermanence
• root on tmpfs, /home and /nix on btrfs subvolumes
• LUKS encryption
• hjem

Other minor changes are

• dbus-broker instead of regular dbus
• systemd in initrd stage 1
• iwd and resolved for networking
• nftables instead iptables for firewall

Setup

These notes are for me, yes me. Note that the sector-size=4096 is not always available. There is also a risk with TRIM regarding encrypted SSD drives.

1. luks encryption with --sector-size=4096 --perf-no_read_workqueue --allow-discards see this
2. create two partitions, /boot and /
3. format boot with fat32
4. format / with btrfs and lzo compression and noatime
5. create subvolumes for /nix and /home
6. no swap since zram is used
7. continue as usual with nix flake installation

The root directory is then mounted on tmpfs while /nix and /home are on persistent subvolumes (this means enough memory should be available).

Warning

Passwords are done using a password file stored under /nix/persist/passwords/<username> and have to be manually created and edited! Enter mkpasswd -m help to see a list of encryption methods.

Important

Symlinks are used for neovim config and scripts, set the environmental variable FLAKE to point to the root flake directory.

Wrappers

Wrappers are used for almost everything in config. This is mainly for large applications where it benefits them immensely to write in their own config language rather than nix. For example, hyper-extensive applications like neovim or emacs. In most cases, these require FLAKE to be set.

Modules

Hjem is used alongside NixOS modules, so there is no distinction between them. This is kind of different from other configs where Home-manager and NixOS modules are separated. The modules are not as organized as I would like them to be

• config: "user" configuration, like colors or user services
• display: configuration for desktop environments
• packages: kind of obvious, just applications and packages
• system: system configuration, like non-user services or hardware config

Then you have default.nix tree importing all modules and setting defaults values. The other modules (dbus.nix, home.nix, sops.nix) provide additional, library like-utilities. Home exposes hjem and Sops exposes, well, sops-nix.

Terranix

Terranix is used in packages to create a terraform file instructing incus to create instances and volumes. Packages can also have modules, for whatever reasons.

Sops

Secrets are stored elsewhere, just for fun. A quick rundown of how to use sops (for myself) is

• edit secrets: nix-shell -p sops --run "sops secrets/example.yaml"
• rekey secrets: nix-shell -p sops --run "sops updatekeys secrets/example.yaml"
• get public key: nix-shell -p ssh-to-age --run 'cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age'

After adding a new key to .sop.yaml, you must rekey the secrets. This is absolutely necessary.

References

• https://github.com/hlissner/dotfiles
• https://github.com/sioodmy/dotfiles