This repository provides a KISS NixOS flake configuration. No over 9000 nested modules, no complex overlays, and no dozens of host configurations.

Powered by Lix!

Usage

Remote

$ nixos-rebuild switch --flake git+https://gitlab.com/Darkness9724/nix-config --sudo

Local clone

$ git clone https://gitlab.com/Darkness9724/nix-config
$ cd nix-config
$ nixos-rebuild switch --flake . --sudo

Secret management

This section is more of a reminder to myself — since I’ve already managed to forget once how to properly setup each of these methods.

At the moment, we use two approaches to organizing secret storage:

1. The classic one, using sops-nix. It works well when we can access a secret through nix options that take a file input, use LoadCredentials, or even EnvironmentFile. However, it’s completely unsuitable when we need to hide the fact that certain nix expressions are being used (for example, hiding a static public IP).

2. The hacky one, using a hidden git repository accessible only over SSH. It’s much more flexible since it allows us to hide literally anything — a nix module, an expression, or even a plain file containing a list of porn sites. But I wouldn’t actually call it hacky (and would probably use only this approach — I mean, why bother with sops-nix then?) if it weren’t for one serious drawback: flake inputs are not lazy at all — nix always tries to copy them into /nix/store, even if they’re unused or unavailable (for instance, when an SSH key is missing). This prevents fully automating deployment of the configuration on machines that don’t have access to the hidden repository. Therefore, if someone else wants to use this flake, they’ll need to remove or comment out inputs.private.

Now, about how each method is set up:

1. Since I already had my own long-standing GPG key — generated long before NixOS even was given a try — I decided to use it, since sops-nix allows that. To do this, the public and private keys specified in .sops.yaml need to be transferred to the new machine and imported with /var/lib/sops specified as GNUPGHOME.

2. On a fresh machine, it’s enough to simply set

   programs.git.enable = true;
   

   then run

   $ ssh-keygen -t ed25519
   

Packages

This repo also includes custom packages you can run, like nix run .#zink-run.