NixOS Configurations

Host-based NixOS configuration for homelab and personal devices using flakes, home-manager, and sops-nix.

Hosts

• fisher - Homelab server (x86_64-linux, user: guppy). Runs Nextcloud, Vaultwarden, Forgejo (with runner), Matrix, Minecraft, FreshRSS, nginx, PostgreSQL, Docker, Prometheus + Grafana.
• book - Personal laptop (x86_64-linux, user: geekiot). Desktop environment with Niri compositor, Helix/Zed/VSCodium, Librewolf, Kitty, and gaming tools.

Structure

.
├── flake.nix                  # Flake entry point, host definitions
├── .sops.yaml                 # sops-nix age key configuration
├── nix-secrets/               # sops-secrets for hosts (used by custom zsh-command)
├── lib/
│   ├── make_system.nix        # System builder (NixOS + home-manager + sops)
│   └── utils/                 # Utility functions (scan_paths, etc.)
├── overlays/                  # Shared package overlays
└── hosts/
    ├── common/                # Shared configs across all hosts
    │   ├── nixos/             #   Common system modules
    │   ├── home/              #   Common home-manager modules (git, ssh, zsh, etc.)
    │   ├── data/              #   Common data (paths, defaults)
    │   └── secrets/           #   Shared encrypted secrets
    ├── book/                  # Laptop configuration
    │   ├── nixos/             #   System: core, hardware, networking, wm
    │   ├── home/              #   User: editors, browser, terminal, games
    │   ├── data/              #   Host-specific data
    │   ├─── pkgs/             #   Custom packages
    │   └── secrets/           #   Encrypted secrets
    └── fisher/                # Homelab configuration
        ├── nixos/             #   System: core, hardware, networking, services, homelab apps
        ├── home/              #   User config
        ├── data/              #   Host-specific data
        ├── pkgs/              #   Custom packages
        └── secrets/           #   Encrypted secrets

Quick Start

Prerequisites

• NixOS with flakes enabled (nix.settings.experimental-features = [ "flakes" "nix-command" ])
• Age key for sops-nix decryption
• Your own sops-secrets dir nix-secrets/

Deployment

# Build and switch to a host configuration
sudo nixos-rebuild switch --flake .#fisher
sudo nixos-rebuild switch --flake .#book

# Or use my own zsh-command (if you've already installed the system & configure nix-secrets dir)
update

update remote fisher

Secrets

Secrets are encrypted with sops-nix using age keys.

# Edit secrets for a specific host
sops hosts/fisher/secrets/sops.yaml
sops hosts/book/secrets/sops.yaml

# Re-key after adding new keys
sops updatekeys hosts/fisher/secrets/sops.yaml

Each host has its own age key defined in .sops.yaml. Place the corresponding private key at the path specified in the host's data config.

Or place them in the nix-secrets directory to hide them in a Git submodule, as I have done. Then use the update zsh-command to update them.

Key Technologies

• NixOS
• Flakes
• Home Manager
• sops-nix
• Catppuccin