My NixOS configs

AGS

You might find it weird that most of my config is written in TypeScript. That's because all my desktops run AGS for UI. Click on this to see my configuration.

I'm also a victim of Stockholm syndrome at this point and make my scripts in TypeScript because it's the scripting language I am most comfortable with.

About

General

This repo is the complete configuration of machines I own, running NixOS or Nix. Its structure is based on a flake's outputs.

Flake Location

This git repo will always be located at $FLAKE (config.environment.variables.FLAKE) and symlinked to /etc/nixos to have everything where NixOS tools expect things to be.

ie.

sudo rm -r /etc/nixos

echo "$FLAKE" # /home/matt/.nix

sudo ln -sf /home/matt/.nix /etc/nixos

Flake Outputs

Output	Description
`nixosConfigurations`	devices' + ISO's configurations
`nixOnDroidConfigurations.default`	Nix-On-Droid's configuration
`packages`	Some custom packages not available in nixpkgs or modified from it
`legacyPackages`	Some custom package scopes not available in nixpkgs or modified from it
`apps`	Scripts ran from the flake defined here
`homeManagerModules`	Modules made for home-manager
`homeManagerModules`	Modules made for NixOS systems
`formatter`	I format nix code with alejandra
`devShells.default`	A dev shell to build an ISO from the live-image nixosConfiguration
`devShells.ags`	A dev shell to have a NodeJS env when I enter my AGS's config directory

Flake Inputs

To allow use of the full nix language for my inputs, I use genflake. Therefore, the flake I edit is located at ./outputs.nix.

I also prefer using a more descriptive format for my inputs like so:

nixpkgs = {
  type = "github";
  owner = "NixOS";
  repo = "nixpkgs";

  # Branch name
  ref = "nixos-unstable";

  # Pin this input to a specific commit
  rev = "842d9d80cfd4560648c785f8a4e6f3b096790e19";
};

to make it more clear what is what in the flake URI

Secrets

All my secrets are in a private git repo that makes use of sops-nix. I generate .sops.yaml from .sops.nix:

let
  wim = "somekey";
  binto = "somekey2";
in {
  creation_rules = [
    {
      path_regex = "secrets/[^/]+\\.(yaml|json|env|ini)$";
      key_groups = [
        {
          age = [wim binto];
        }
      ];
    }
  ];
}

which is then converted to .sops.yaml using remarshal and this shell command:

nix eval --json --file ./.sops.nix | remarshal --if json --of yaml > .sops.yaml

TLDR: I hate YAML

3.7 KiB Raw Permalink Blame History