.forgejo/workflows | ||
common | ||
devices | ||
home | ||
modules | ||
.gitignore | ||
flake.lock | ||
flake.nix | ||
LICENSE.md | ||
README.md | ||
updateSha.sh |
My NixOS configs
Ags
You might find it weird that most of my config is written in TypeScript. That's because all my desktops run AGS for UI. Click on this to see my configuration.
About
General
This repo is the complete configuration of machines I own, running NixOS or Nix. I tend to mix Home-Manager and NixOS a lot to make my custom modules by using my global vars system explained here
Flake Location
This git repo will always be located at /home/${mainUser}/.nix
and symlinked to /etc/nixos
to have everything where NixOS tools
expect things to be.
ie.
sudo rm -r /etc/nixos
sudo ln -sf /home/matt/.nix /etc/nixos
Flake Outputs
Output | Description |
---|---|
nixosConfigurations |
devices' + ISO's configurations |
nixOnDroidConfigurations.default |
Nix-On-Droid's configuration |
formatter |
I have yet to know if this has any uses but I format with alejandra |
devShells.default |
A dev shell to build an ISO from the live-image nixosConfiguration |
Flake Inputs
I prefer using a more descriptive format for my inputs like so:
nixpkgs = {
type = "github";
owner = "NixOS";
repo = "nixpkgs";
# Branch name
ref = "nixos-unstable";
# Pin this input to a specific commit
rev = "842d9d80cfd4560648c785f8a4e6f3b096790e19";
};
to make it more clear what is what in the flake URI
I also have a long list of inputs with flake = false;
because
it makes it easier to update non-flake custom packages or overlays
to have the latest git. I make sure to end the names of these inputs
with src
to make it clear what they are.
Secrets
All my secrets are in a private git repo that makes use of
sops-nix.
I only use secrets stored in JSON
and generate .sops.yaml
from .sops.nix
:
let
wim = "somekey";
oksys = "somekey2";
in {
creation_rules = [
{
path_regex = "secrets/[^/]+\\.(yaml|json|env|ini)$";
key_groups = [
{
age = [wim oksys];
}
];
}
];
}
which is then converted to .sops.yaml
using
remarshal
and this shell command:
nix eval --json --file ./.sops.nix | remarshal --if json --of yaml > .sops.yaml
TLDR: I hate YAML