STC — Standard Template Construct

A Nix flake library of reusable NixOS and Home Manager modules.
Themed after the Adeptus Mechanicus. Functional in all universes.

Praise the Omnissiah. May your modules evaluate without heresy.

Documentation: https://gfriloux.github.io/stc

STC is a library only — it contains no system configuration. Your production flake imports the modules it needs and configures them.

The library is organised into four layers:

All options live under stc.*:

stc.relics.*       — individual module options  (stc.relics.boot, stc.relics.zfs, …)
stc.cogitator.*    — profile options            (stc.cogitator.vm, stc.cogitator.hardening, …)

# flake.nix
{
  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
    stc = {
      url = "github:gfriloux/stc";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs = { nixpkgs, stc, ... }: {
    nixosConfigurations.my-machine = nixpkgs.lib.nixosSystem {
      system = "x86_64-linux";
      modules = [
        stc.nixosModules.relics-boot
        stc.nixosModules.relics-zfs
        stc.nixosModules.cogitator-hardening

        ({ ... }: {
          stc.relics.boot.enable = true;
          stc.relics.zfs.enable = true;
          stc.cogitator.hardening.enable = true;
        })
      ];
    };
  };
}

See the schematics/ directory for complete working examples:

• schematics/local-vm/ — QEMU/KVM VM with ZFS + impermanence + hardening
• schematics/aws-ami/ — AWS EC2 AMI with ZFS + impermanence + AWS platform
• schematics/dreadnought/ — Running EC2 instance profile

# Nix tools (alejandra, statix, deadnix)
nix develop

# Documentation (Node.js + Astro)
nix develop .#docs
cd docs && npm install && npm run dev

# Format + lint + check
just ci

STC follows Semantic Versioning and is pre-1.0 (0.x). See CHANGELOG.md for the release history and .claude/plans/README.md for the map of tags to the work that produced them. The changelog is generated from Conventional Commits with just changelog (git-cliff).

If your configuration uses the flat stc.boot, stc.zfs, stc.traefik, etc. (the layout before v0.2.0), the old namespace still works but emits a deprecation warning. Migrate to the canonical stc.relics.* / stc.cogitator.* namespaces — see MIGRATION.md. The legacy aliases will be removed at the next major release (v1.0.0).

Options that accept secrets use a *File suffix and read the file at runtime — STC never stores secret values inline, and is agnostic to the secrets backend (sops-nix, agenix, plain files).