This config is tailored to my needs, and is not meant to be a tutorial, but if you do find anything you like, feel free to yank it :)

This repository is home to the nix code that builds my systems:

• NixOS Desktop: NixOS with Flakes, Home-manager, Sops-Nix, etc.
• MacOS Laptop: nix-darwin with home-manager, share the same home-manager configuration with NixOS.
• HomeLab server: (TODO)
• Rpi-HomeAssistant: (TODO)

TODO PICTURE

Most of the packages / programs used are installed and configured using home manager.

├── core.nix # shared packages
├── darwin.nix # MacOS specific config
├── linux.nix # NixOS specific config 
└── programs # complex or optional config
    ├── ...

To evaluate and list installed packages run:

nix eval .#nixosConfigurations.nixos.config.home-manager.users.<USERNAME>.home.packages --json | jq

• home-manager
• nix-darwin
• sops-nix

├── darwin
│   ├── apps.nix # system packages & Homebrew
│   └── system.nix # system settings & MacOS-defaults
└── linux
    ├── configuration.nix # system settings
    └── hardware-configuration.nix # auto generated

To evaluate the packages installed system-wide:

nix eval .#darwinConfigurations.<HOST>.config.environment.systemPackages --json | jq

NeoVim is configured directly in this repo and symlinked to $XDG_CONFIG_HOME/nvim when built.

// TODO PICTURE

Nvim config can be found here => ./dotfiles/nvim/

Ghostty enabled using home-manager

Currently there are some build issues on darwin, so on darwin, Ghostty is install using Homebrew and only configured by home-manager

./home/programs/ghostty.nix

Fish enabled using home-manager

On darwin, the default shell needs to be updated using

chsh -s /etc/profiles/per-user/hest/bin/fish

Plugins:

• autopair
• done
• fzf
• grc
• sponge
• puffer

Nushell - WIP

mkdir -p ~/.config/sops/age
age-keygen -o ~/.config/sops/age/keys.txt # generate key
age-keygen -y ~/.config/sops/age/keys.txt # fetch public key

keys:
  - &host1 <YOUR PUBLIC KEY>
creation_rules:
  - path_regex: secrets.yaml$
    key_groups:
    - age:
      - *host1

# if sops is not installed yet
nix-shell -p sops --run "sops secrets.yaml"

# if sops already in place
sops secrets.yaml

inputs = {
  sops-nix.url = "github:Mic92/sops-nix";

  dot-secrets = {
    url = "git+ssh://[email protected]/HestHub/dot-secrets.git";
    flake = false;
  };
};
...
# include sops module in home manager

home-manager.darwinModules.home-manager
{
  ...
  home-manager.sharedModules = [
    sops-nix.homeManagerModules.sops
  ];
  ...
}

  sops = {
    # select key to use for decryption
    age.keyFile = "${config.home.homeDirectory}/.config/sops/age/keys.txt";

    # select file to decrypt from secrets repo
    defaultSopsFile = "${inputs.dot-secrets}/secrets.yaml";
    
    secrets = {
      # create new file from the secret used
      "ssh/key".path = "${config.home.homeDirectory}/.ssh/id_X";
    };
  };

keys:
  - &host1 <YOUR PUBLIC KEY>
  - &host2 <SECOND PUBLIC KEY>
creation_rules:
  - path_regex: secrets.yaml$
    key_groups:
      - age: [*host1, *host2]

🔴 IMPORTANT: Do not try to deploy this flake as is ❗ It will not succeed. This flake contains my hardware configuration, and requires my private secrets repository using Sops-Nix to deploy. Only use this repo as a reference to build your own setup

If you like to deploy a flake like this, read through the code and pick out the pieces that seems relevant and create your own flake, or just fork it and remove anything not relevant. Most important parts to remove is the hardware-configuration for NixOS, the secrets management in home manager and swap host-names and user-names.

NixOS:

  # clone repo
  git clone https://github.com/HestHub/nixos.git
  
  # fetch tools
  nix-shell -p age just
 
  # create new age key
  mkdir -p ~/.config/sops/age
  age-keygen -o ~/.config/sops/age/keys.txt
  age-keygen -y ~/.config/sops/age/keys.txt

  # (Move key to secret repo & add as recipient)

  # rebuild system
  sudo nixos-rebuild switch --flake .#<HOSTNAME>

  # or deploy via `just`(a command runner with similar syntax to make) & Justfile
  nix-shell -p just
  just build

MacOS:

  #install Xcode
  xcode-select --install
  
  # Install nix (Say NO to install determinate)
  curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | sh -s -- install

  # install Homebrew
  /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

  # clone repo
  git clone https://github.com/HestHub/nixos.git
  
  # fetch tools
  nix-shell -p age just
 
  # create new age key
  mkdir -p ~/.config/sops/age
  age-keygen -o ~/.config/sops/age/keys.txt
  age-keygen -y ~/.config/sops/age/keys.txt

  # (Move key to secret repo & add as recipient)

  # Deploy Dariwn config
  just build

• Nushell
• Disko
• Cleanup
• CI
• Move scripts to repo
• Security hardening
• adding server to combined config
• expanding secrets management

Good reads and dotfiles that inspired me:

• Nix Flakes
  • ryan4yin/nix-config + NixOS and Flakes
  • gvolpe/nix-config
  • Mic92/dotfiles
  • nix-community/srvos
  • 1amSimp1e/dots
  • Frost-Phoenix/nixos-config
  • budimanjojo/nix-config
  • Misterio77/nix-config
  • Awesome-nix
• NeoVim/LazyVim
  • LazyVim distro
  • LazyVim for Ambitious Developers