Brye's NixOS

Install notes for this NixOS flake. Built on flake-parts with den and flake-file, using disko, impermanence, sops-nix and home-manager.

Layout

Everything lives under modules/, loaded by import-tree — every file is a flake-parts module. flake.nix itself is generated (see Flake inputs).

• modules/defaults/ — universal baseline; each file is one aspect registered into den.default, which den applies to every host automatically (boot, networking, nix, security, disko, home-manager, rescue)
• modules/hosts/<hostname>/ — self-contained host: registration (den.hosts), aspect composition, disko export; _config/ holds the machine's hardware reality (disko, hardware, gpu, filesystem, secrets)
• modules/users/ — user entities (account, home-manager basics, user secrets)
• modules/features/ — everything else, as den aspects; most register into the workstation bundle hosts include, per-host choices (plymouth, cachyos-kernel) stay outside it
• modules/packages/ — custom packages, overlaid onto nixpkgs and exported as flake packages (nix build .#dracula-cursors)

Fresh install (NixOS ISO)

Replace <hostname> with a host folder under modules/hosts.

Reformatting an existing host

Format the drive and install in one step with disko-install:

sudo nix --extra-experimental-features "nix-command flakes" \
  run "github:nix-community/disko/latest#disko-install" \
  -- --flake github:bryewalks/nixos#<hostname> \
  --disk main /dev/<disk>

sudo reboot

Alternatively, format and install as separate steps (avoids disko-install building in the ISO's tmpfs):

sudo nix --extra-experimental-features "nix-command flakes" \
  run github:nix-community/disko \
  -- --mode destroy,format,mount \
  --flake github:bryewalks/nixos#<hostname>

sudo nixos-install --flake github:bryewalks/nixos#<hostname>

sudo reboot

Continue with Post install.

New host setup

Prerequisites

Create modules/hosts/<hostname>/ with:

• default.nix — registers the host (den.hosts) with its capabilities (persistRoot — must match the disko mountpoint, themeName, optionally swapSizeGiB and storageRoot; leave out passwordConfigured until Post install), exports its disko config (flake.diskoConfigurations), and composes its aspects (workstation, per-host extras; the den.default baseline applies automatically; hostname comes from the entity name) (example)
• _config/default.nix — sops.defaultSopsFile, system.stateVersion (the release being installed), host options (example)
• _config/disko.nix — disk layout (example)
• _config/secrets.yaml — optional; ssh key (sshKey) and user password (hashedPassword), see Secrets management

Install

Format and mount the drive with disko:

sudo nix --extra-experimental-features "nix-command flakes" \
  run github:nix-community/disko \
  -- --mode destroy,format,mount \
  --flake github:bryewalks/nixos#<hostname>

Clone the repo into the mounted disk:

sudo git clone https://github.com/bryewalks/nixos /mnt/tmp/nixos

Generate the hardware config:

sudo nixos-generate-config --no-filesystems \
  --show-hardware-config \
  | sudo tee /mnt/tmp/nixos/modules/hosts/<hostname>/_config/hardware.nix \
  > /dev/null

Install:

sudo nixos-install --flake /mnt/tmp/nixos#<hostname>

Commit the hardware config now, or regenerate it after first login.

sudo reboot

Continue with Post install.

Post install

Copy the sops age key to persistent storage:

sudo cp /path/to/sops/keys.txt /persist/system/var/lib/sops/keys.txt

Rebuild (activates sops secrets, including the hashed password):

sudo nixos-rebuild switch --flake github:bryewalks/nixos#<hostname>

Add passwordConfigured = true; to the host entity in modules/hosts/<hostname>/default.nix and rebuild again. This switches the user from initialPassword = "password" to the sops-managed hashedPassword (and enables openssh) — until then the default plaintext password remains active.

sudo nixos-rebuild switch --flake github:bryewalks/nixos#<hostname>

Clone the repo for day-to-day use:

git clone git@github.com:bryewalks/nixos

Enable the pre-commit hook (treefmt + flake.nix sync checks, see .githooks/):

git config core.hooksPath .githooks

Flake inputs (flake-file)

flake.nix is generated by flake-file — never edit it by hand. Each module declares the inputs it consumes via flake-file.inputs (e.g. gaming declares steam-config-nix); core inputs no single feature owns (nixpkgs, den, home-manager) live in modules/den.nix, which also wires the flake-file dendritic flakeModule. Deleting a feature removes its input on the next regeneration.

After adding, removing, or changing an input declaration:

nix run .#write-flake

Then lock the new input and rebuild as usual (nh os switch --update is unaffected by flake-file otherwise). Commit the regenerated flake.nix together with the module change — nix flake check fails if they drift.

If flake.nix is ever lost, restore it from git, or regenerate without an evaluable flake:

nix-shell https://github.com/vic/flake-file/archive/main.tar.gz \
  -A flake-file.sh --run write-flake

Secrets management

sops-nix with age. Secrets live in per-host secrets.yaml files, decrypted at build/activation time.

Paths:

• Age key file: /persist/system/var/lib/sops/keys.txt (set in modules/features/sops/default.nix)
• Per-host secrets: modules/hosts/<hostname>/_config/secrets.yaml (via sops.defaultSopsFile in each host's _config/default.nix)

Expected secrets:

• sshKey — private key contents for /home/brye/.ssh/id_ed25519
• hashedPassword — hashed password used by users.users.brye.hashedPasswordFile

Age key setup

Generate a key where sops-nix expects it:

mkdir -p /persist/system/var/lib/sops
age-keygen -o /persist/system/var/lib/sops/keys.txt

Print the public key (for secrets.yaml recipients):

age-keygen -y /persist/system/var/lib/sops/keys.txt

Create or edit a secrets file with an explicit recipient:

sops --age <publicKey> modules/hosts/<hostname>/_config/secrets.yaml

Generating a hashed password

openssl passwd -6

Extra commands

Check the flake for errors (no build):

nix flake check --no-build

Format the tree (treefmt + nixfmt, configured in modules/formatter.nix; nix flake check fails on unformatted files):

nix fmt

Evaluate a specific host:

nix eval .#nixosConfigurations.<hostname>.config.system.build.toplevel.drvPath

Generate a hardware config on a non-NixOS machine (requires nix):

sudo nix --extra-experimental-features "nix-command flakes" shell nixpkgs#nixos-install-tools -c nixos-generate-config --show-hardware-config > hardware.nix