My Nix Config

Sensitive data is kept in a private flake input (nix-secrets) that is fetched at build time. Below is the expected structure.

A flake with no inputs of its own, exporting three top-level attributes:

{
  outputs = { ... }: {
    users = {
      primary = {
        username = "john";
        fullName = "John Doe";
        handle = "jdoe";              # e.g. GitHub username
        email = {
          personal = "john@example.com";
          gitHub = "john@gmail.com";
        };
      };
      secondary = {
        enable = true;
        username = "jane";
        fullName = "Jane Doe";
      };
    };

    domain = "example.com";           # optional, defaults to "localdomain"

    nfsClient = {
      server = "192.168.1.100";
      shares = [ "data" "media" ];
    };
  };
}

A SOPS-encrypted file containing user password hashes, SSH private keys, and other sensitive values. Referenced throughout the config by the key path (e.g. passwords/adam, passwords/brenda).

SOPS creation rules that define which age keys can decrypt which files.

nix-secrets/
├── flake.nix           # Outputs: users, domain, nfsClient
├── secrets.yaml        # SOPS-encrypted secrets (passwords, SSH keys, etc.)
└── .sops.yaml          # SOPS creation rules

If you use GitHub Actions / Dependabot, the following secrets need to be set in the repository:

lib.mkAliasOptionModule — https://noogle.dev/f/lib/modules/mkAliasOptionModule#aliases

git push origin HEAD:refs/heads/dev

Inspired by:

• EmergentMind/nix-config
• KonradMalik/dotfiles
• Vimjoyer