Nix Config

This repository contains NixOS and nix-darwin system configurations, using Home Manager as a module.

• Directory Structure
• Install
• Rebuild
• Testing
• SOPS Secrets
• Secure Boot
• GPG
• Misc

• flake.nix: Entry point for all configurations.
• modules/hosts/: Host entrypoints and private per-host leaves (_<hostname>/).
• secrets/: Encrypted SOPS secrets, organized by domain (hosts/, users/).
• home-manager/: Shared user-level modules (shell, editors, GUI apps).
  • modules/: Atomic configuration units.
• packages/: Custom package definitions (e.g., openagents-opencode).
• docs/: detailed documentation.

See ARCHITECTURE.md for details on the module system and __cfg pattern.

To install a new system, use disko-install from the flake. Note: Disable features like sops and secureboot (__cfg.secureboot.enable = false;) initially, as they require keys generated after installation.

1. Generate hardware config:

   nixos-generate-config --show-hardware-config --no-filesystems

2. Install from flake: Replace <config> with the target host config (e.g., qemu, psy-fw13) and <disk> with the target device.

   sudo nix --experimental-features 'nix-command flakes' run 'github:nix-community/disko/latest#disko-install' -- --write-efi-boot-entries --flake 'github:suicide/nixcfg#<config>' --disk main <disk>

To apply changes to your current system:

NixOS:

sudo nixos-rebuild switch --flake .#<hostname>

macOS:

sudo darwin-rebuild switch --flake .#<hostname>

To test config changes without persisting boot entries:

sudo nixos-rebuild test --flake .#<hostname>

Secrets are managed via sops-nix. Place your age key in ${HOME}/.config/sops/age/keys.txt.

Ensure __cfg.sops.enable = true; is set in your configuration.

Editing secrets:

nix run nixpkgs#sops -- secrets/users/psy.yaml

See the Secure Boot Guide for detailed setup instructions using Lanzaboote.

Quick summary:

1. Boot with Secure Boot disabled in firmware.
2. Generate keys: sudo sbctl create-keys
3. Enable in config: __cfg.secureboot.enable = true;
4. Rebuild.
5. Enroll keys and enable in firmware.

Export Subkeys from separate store:

gpg --homedir <pathToGpgStore> --pinentry-mode loopback --output <somePath> --export-secret-subkeys <keyID>

Clean cache / nix-store:

nix-store --gc