My NixOS configuration

Quick Start

Apply configuration changes:

just switch

Update

Update the flake inputs and rebuild:

just update

Or just update flake.lock without rebuilding:

just flake

Bootstrap a New NixOS System

Clone the repo:

git clone [email protected]:stfl/dotfiles.git ~/.config/dotfiles

Setup Emacs

https://github.com/stfl/doom.d#installation

System Configuration

Access user journal

Grant user access to system journal:

usermod -a -G systemd-journal $USER

Set default boot target to multi-user

For headless systems:

systemctl set-default multi-user.target

Hardware: ZSA Keyboards

ZSA keyboard support (ErgoDox EZ, Moonlander, Voyager) is configured in modules/hardware/zsa.nix.

The udev rules and plugdev group setup are handled automatically by NixOS.

Docker

Docker is configured via modules/docker.nix. The module handles:

• Installing docker and docker-compose
• Adding the user to the docker group
• Enabling the docker service

Bashrc for root

Symlink root’s .bashrc to the versioned config:

ln /home/slendl/.config/dotfiles/config/bash/.bashrc.root /root/.bashrc -sf

Development Tools

password-store

Trust your password-store GPG key:

gpg --edit-key <password-store-key>
> trust
> 5 # trust ultimately

org-protocol in Brave Browser

Reddit about policy Brave Doku

Install the org-protocol policy system-wide:

{
  "AutoLaunchProtocolsFromOrigins": [
    {
      "allowed_origins": [ "*" ],
      "protocol": "org-protocol2"
    }
  ]
}

Brave nix source

NixOS Operations

Building and switching

Local rebuild:

sudo nixos-rebuild switch --flake ".#"

Remote deployment

Deploy to a remote host:

nixos-rebuild \
    --target-host [email protected] \
    --use-remote-sudo \
    switch \
    --flake ".#hostname"

NixOS Installation

The easiest solution is to do a remote setup - have the nixos config on an existing machine and connect to the new system via ssh.

On the installation target, change the password so that ssh will work:

passwd

Partitioning

Partitioning with an ESP and a single large partition with ext4:

Setup

Mount partitions:

mount /dev/sda3 /mnt
mkdir -p /mnt/boot
mount /dev/sda1 /mnt/boot
swapon /dev/sda2

Generate the hardware-configuration.nix:

nixos-generate-config --root /mnt --dir .

Copy the hardware-configuration to the git repo:

HOST=kondor
mkdir -p hosts/$HOST
scp [email protected]:hardware-configuration.nix hosts/$HOST
cp hosts/nixos-vm/{default,home}.nix hosts/$HOST

Then customize hardware-configuration.nix, default.nix and home.nix

Installation

Get the config to the target (rsync won’t work if not available on target):

rsync -ravh ./ [email protected]:dotfiles/

On the target, run nixos-install:

HOST=kondor
nixos-install --root /mnt --flake .#$HOST

Repair NixOS Installation via Live ISO

To repair a NixOS installation when booted to a live ISO:

Mount the partitions to /mnt and enter the special nixos chroot:

nixos-enter

cd /path/to/dotfiles
nixos-rebuild switch --flake .#hostname

Secrets Management with agenix

Add a new secret

Modify secrets/secrets.nix and add the new secret file.

Edit a secret

cd secrets
agenix -e <name-of-secret>.age

Emacs will open. Close with SPC b k to terminate the buffer and return to the shell.

Add a new host

• You need to first setup NixOS without agenix
• Put the auto-generated ssh host public key /etc/ssh/ssh_host_ed25519_key.pub into secrets.nix
• Rekey with another private key that allows decrypting all relevant keys:

agenix --rekey -i ~/.ssh/id_ed25519_stfl

Create a Custom ISO

Edit modules/iso.nix, then build:

nix build .#iso

Write to USB:

sudo dd if=results/iso/*.iso of=/dev/sda bs=4M status=progress && sync

Application Setup

Citrix Workspace

Download the corresponding version from https://www.citrix.com/downloads/workspace-app/

Add the file to the nix store:

nix-prefetch-url file://${PWD}/packages/citrix/linuxx64-24.8.0.98.tar.gz

Afterwards citrix_workspace can be installed.

Stremio + Torrentio

https://torrentio.strem.fun/providers=yts,eztv,rarbg,1337x,thepiratebay,kickasstorrents,torrentgalaxy,magnetdl,horriblesubs,nyaasi,tokyotosho,anidex%7Clanguage=german%7Cqualityfilter=threed,480p,scr,cam,unknown%7Climit=10/configure

Steam

https://wiki.nixos.org/wiki/Steam

Steam is configured via modules/steam.nix.

Starting steam within gamescope:

export AMD_VULKAN_ICD="RADV"
gamescope --adaptive-sync --hdr-enabled --rt --steam -- \
    steam -pipewire-dmabuf -tenfoot

Display Configuration

Kanshi

Get current output information:

swaymsg -t get_outputs

Display profiles are configured per-host in the home-manager configuration.

FlakeHub

Login to FlakeHub for faster downloads and cache:

determinate-nixd login