Skip to content

Swarsel/.dotfiles

Folders and files

NameName
Last commit message
Last commit date

Latest commit

ย 

History

892 Commits
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 

Repository files navigation

Build Status

Disclaimer

You probably do not want to use this setup verbatim. This is made to fit my specific use cases, and I do not guarantee best practises everywhere. Changes are made on a daily basis.

That being said, there is a lot of general configuration that you probably can use without changes; if you only want to use this repository as a starting point for your own configuration, you should be fine. See below for more information. Also, if you see something that can be done more efficiently or better in general, please let me know! :)

~SwarselSystems~

swarselsystems_preview1 swarselsystems_preview2

Overview

  • Literate configuration defining my entire infrastructure, including Emacs
  • Dendritic configuration based on flakes (using flake-file) for personal hosts as well as servers on:
  • Streamlined configuration and deployment pipeline:
    • Framework for packages, overlays, dendritic modules (features), and library functions
    • Dynamically generated config:
      • host configurations
      • dns records
      • network setup (+ wireguard mesh on systemd-networkd)
    • Remote Builders for [x86_64,aarch64]-linux running on buildbot, feeding a private nix binary cache and updating the flake on a weekly basis
    • Bootstrapping:
      • Limited local installer (no secrets handling) with a (kinda un-)supported demo build
      • Fully autonomous remote deployment using nixos-anywhere and disko (with secrets handling)
    • Improved nix tooling
  • Support for advanced features:
    • Secrets handling using sops-nix (pls no pwn โค๏ธ)
    • Management of personally identifiable information using nix-plugins
    • Full Yubikey support (with SSH support for SK keys, certs and PGP keys)
    • LUKS-encryption with support for remote disk unlock over SSH
    • Secure boot using Lanzaboote
    • BTRFS-based Impermanence
    • Configuration shared between configurations (configuration for one nixosConfiguration can be defined in another nixosConfiguration)
    • Global attributes shared between all configurations to reduce attribute redeclaration
    • Config library for defining config-based functions for generating service information
    • Reduced friction between full NixOS- and home-manager-only deployments
      • efficient secrets handling depending on system context
      • automatic config sharing between contexts
      • denritic structure for keeping features in a centralised manner

Documentation

The full documentation can be found here:

SwarselSystems literate configuration

I went to great lengths in order to document the full design process of my infrastructure properly; the above document strives to serve as an introductory lecture to nix / NixOS while at the same time explaining the config in general.

Emacs

If you came here for my raw Emacs configuration, the relevant files live here in elisp form (these files are generated from the nix emacs-init module):

Getting started

Demo configuration

Click here for instructions on how to install the demo system

If you just want to see if this configuration is for you, run this command on any system that has nix installed:

nix run --experimental-features 'nix-command flakes' github:Swarsel/.dotfiles#swarsel-rebuild -- -u <YOUR_USERNAME>

This will activate the hotel configuration on your system, which is a de-facto mirror of my main configuration with secret-based settings removed. Please keep in mind that this limited installer will make local changes to the cloned repository in order to be able to install it (otherwise the builder would fail at fetching my private secrets repository). As such, this should only be used to evaluate the system - if you want to use it longterm, you will need to create a fork and make some changes.

Deployment

Click here for deployment instructions

The deployment process for this configuration is mostly automated, there are only a few steps that are needed to be done manually. You can choose between a remote deployment strategy that is also able to deploy new age keys for sops for you and a local installer that will only install the system without any secret handling.

Remote deployment (recommended if you have at least one running system)

  1. Fork this repo, and write your own host config at hosts/nixos/<YOUR_ARCHITECTURE>/<YOUR_CONFIG_NAME>/default.nix (you can use one of the other configurations as a template. Also see https://github.com/Swarsel/.dotfiles/tree/main/modules for a list of all additional options). At the very least, you should replace the secrets/ directory with your own secrets and replace the SSH public keys with your own ones (otherwise I will come visit you!๐Ÿ”“โค๏ธ). I personally recommend to use the literate configuration and org-babel-tangle-file in Emacs, but you can also simply edit the separate .nix files.
  2. Have a system with nix available booted (this does not need to be installed, i.e. you can use a NixOS installer image; a custom minimal installer ISO can be built by running just iso in the root of this repo)
  3. Make sure that your Yubikey is plugged in or that you have your SSH key available (and configured)
  4. Run swarsel-bootstrap -n <CONFIGURATION_NAME> -d <TARGET_IP> on your existing system. - Alternatively (if you run this on a system that is not yet running this configuration), you can also run nix run --experimental-features 'nix-command flakes' github:Swarsel/.dotfiles -- -n <CONFIGURATION_NAME> -d <TARGET_IP> (this runs the same program as the command above).
  5. Follow the installers instructions: - you will have to choose a disk encryption password (if you want that feature) - you will have to confirm once that the target system has rebooted - you will have to enter the root password once during the final system install
  6. That should be it! The installer will take care of setting up disks, secrets, and the rest of the hardware configuration! You will still have to sign in manually to some webservices etc.

Local deployment (recommended for setting up the first system)

  1. Boot the latest install ISO from this repository on an UEFI system.
  2. Run swarsel-install -n <CONFIGURATION_NAME>
  3. Reboot

Alternatively, to install this from any NixOS live ISO, run nix run --experimental-features 'nix-command flakes' github:Swarsel/.dotfiles#install -- -n <CONFIGURATION_NAME> at step 2.

Infrastructure

Click here for a summary of my infrastructure topology

Programs

Topic Program
๐Ÿš Shell zsh
๐Ÿšช DM greetd
๐ŸชŸ WM SwayFX or Niri
โ›ฉ๏ธ Bar Waybar or Noctalia Shell
โœ’๏ธ Editor Emacs
๐Ÿ–ฅ๏ธ Terminal Kitty
๐Ÿš€ Launcher Fuzzel or Noctalia Shell
๐Ÿšจ Alerts Mako or Noctalia Shell
๐ŸŒ Browser Firefox
๐ŸŽจ Theme City-Lights (managed by stylix)

Services

Topic Program
๐Ÿ“– Books Kavita
๐Ÿ“ผ Videos Jellyfin
๐ŸŽต Music Navidrome + Spotifyd + MPD
๐Ÿ—จ๏ธ Messaging Matrix
๐Ÿ“ Filesharing Nextcloud + CopyParty + Croc
๐ŸŽž๏ธ Photos Immich
๐Ÿ“„ Documents Paperless
๐Ÿ”„ File Sync Syncthing
๐Ÿ’พ Backups Restic
๐Ÿ‘๏ธ Monitoring Grafana + Mimir + Loki + Tempo + Alloy + Pyroscope + Gotify
๐Ÿด RSS FreshRss
๐ŸŒณ Git Forgejo
โš“ Anki Sync Anki Sync Server
๐Ÿชช SSO Kanidm + oauth2-proxy
๐Ÿ’ธ Finance Firefly-III
๐Ÿƒ Collections Koillection
๐Ÿ—ƒ๏ธ Shell History Atuin
๐Ÿ“… CalDav/CardDav Radicale
โœ‚๏ธ Paste Tool Microbin
๐Ÿ“ธ Image Sharing Slink
๐Ÿ”— Link Shortener Shlink
โ›๏ธ Minecraft Minecraft
โ˜๏ธ S3 Garage
๐Ÿ•ธ๏ธ Nix Binary Cache Attic
๐Ÿ™ Nix Build farm Buildbot
๐Ÿ”‘ Cert-based SSH OPKSSH
๐Ÿ”จ Home Asset Management Homebox
๐Ÿ‘€ DNS Records NSD
โœ‰๏ธ Mail simple-nixos-mailserver
๐Ÿš‡ VPN Access Firezone
๐Ÿ›ก๏ธ Local DNS Resolver AdGuard Home
๐Ÿ›Ž๏ธ DHCP Kea
๐Ÿ”Ž Search Engine SearXNG
๐Ÿ“บ Video Streaming Invidious + Invidious Companion
๐Ÿฝ Threat Detection CrowdSec
๐Ÿฝ๏ธ Recipes Mealie

Hosts

Name Hardware Use
๐Ÿ’ป pyramid Framework Laptop 16, AMD 7940HS, RX 7700S, 64GB RAM Work laptop
๐Ÿ’ป bakery Lenovo Ideapad 720S-13IKB Personal laptop
๐Ÿ’ป machpizza MacBook Pro 2016 MacOS reference and build sandbox
๐Ÿ  treehouse NVIDIA DGX Spark AI Workstation, remote builder, hm-only-reference
๐Ÿ–ฅ๏ธ summers ASUS Z10PA-D8, 2* Intel Xeon E5-2650 v4, 128GB RAM Homeserver (microvms), remote builder, data storage
๐Ÿ–ฅ๏ธ winters ASRock J4105-ITX, 32GB RAM Homeserver (IoT server in spe)
๐Ÿ–ฅ๏ธ hintbooth HUNSN RM02, 8GB RAM Router, DNS Resolver, home NGINX endpoint
โ˜๏ธ stoicclub Cloud Server: 1 vCPUs, 8GB RAM Authoritative DNS server
โ˜๏ธ liliputsteps Cloud Server: 1 vCPUs, 8GB RAM SSH bastion
โ˜๏ธ twothreetunnel Cloud Server: 2 vCPUs, 8GB RAM Service proxy
โ˜๏ธ eagleland Cloud Server: 2 vCPUs, 8GB RAM Mailserver
โ˜๏ธ moonside Cloud Server: 4 vCPUs, 24GB RAM Game servers, syncthing + other lightweight services
โ˜๏ธ belchsfactory Cloud Server: 4 vCPUs, 24GB RAM Hydra builder and nix binary cache
๐ŸชŸ chaostheater Asus Z97-A, i7-4790k, GTX970, 32GB RAM Home Game Streaming Server (Windows/AtlasOS, not nix-managed)
๐Ÿ“ฑ magicant Samsung Galaxy Z Flip 6 Phone
๐Ÿ’ฟ drugstore - NixOS-installer ISO for bootstrapping new hosts
๐Ÿ’ฟ policestation - NixOS live ISO for generating cryptographic keys
๐Ÿ’ฟ brickroad - Kexec tarball for bootstrapping low-memory machines
โ” hotel - Demo config for checking out this configuration
โ” toto - Helper configuration for testing purposes

General Nix tips & useful links

Click here for a summary of nix tips & links

Attributions, Acknowledgements, Inspirations, etc.

These are in random order (also known as 'the order in which I discovered them'). I would like to express my gratitude to:

The great people who have contributed code for the nix-community, with special mentions for (this list is unfairly incomplete)
The people who have inspired me with their configurations (sadly also highly incomplete)

If you feel that I forgot to pay you tribute for code that I used in this repository, please shoot me a message and I will fix it :)