nixconfig

This is my NixOS system configuration.

Installation

Important

Read the whole text BEFORE modifying your system!

Note

If you are new to Linux, do not start with NixOS. Try Fedora or Mint instead.

When looking for solutions online, search "NixOS" specifically. Use https://wiki.nixos.org, not nixos.wiki.

Note

This README describes the installation process for desktop machines. To use the Proxmox LXC configured by nixosConfigurations.libewa, simply create a NixOS container as usual, then rebuild from that configuration. You might want to read the section on Editing the configuration anyway.

This configuration uses Disko for partition management, so you will need to wipe your hard drive. BACKUP YOUR FILES!

Before installing the OS, reset your UEFI to Secure Boot Setup Mode. This is so that Limine can enroll its own signing keys after the installation.

Create a NixOS USB using the normal methods, and boot into it.
You can alsp use any already installed OS, if you can use the Nix package manager. Live ISOs probably will not have enough space for the full bootstrap.

Enter a Nix Shell with the necessary tools:

$ run0 nix shell --experimental-features "nix-command flakes" \
 nixpkgs#git \
 nixpkgs#nixos-install-tools \
 disko#disko-install \
 nixpkgs#agenix-cli

Tip

If your configuration has Flakes enabled, such as when booting from an ISO with this configuration, you can omit the --experimental-features flag.

Editing the configuration

Clone the repository.

# git clone https://codeberg.org/libewa/nixconfig
# cd nixconfig

Generate a hardware configuration and save it under your chosen hostname:

# mkdir hosts/<hostname>
# nixos-generate-config --no-filesystems --show-hardware-config > hosts/<hostname>/default.nix

Open flake.nix, search for nixosConfigurations and add a new configuration for your hostname. You can use stickerbox or gaming as a template. Update the hostName, hostPlatform, and stateVersion fields accordingly.
stateVersion should be set to the next unreleased stable version of NixOS, unless you also modify the nixpkgs input to use a stable channel.

Modify system/desktop/users.nix as per the NixOS manual and its example, remembering to add one user to the wheel group. Also, open system/default.nix to change programs.nh.flake to the path you will store your config at.

Optionally, modify system/locale.nix to set a different locale, or remove it and the reference in system/default.nix and commit your changes.

Unless you have my SSH keys, you'll need to swap out the encrypted secrets. Remove the unneeded entries in secrets/secrets.nix and add your SSH user and host keys to ssh-keys/. Also change or remove all of the references to age.secrets in system/desktop/network.nix. It's probably fine to just delete the whole file. Otherwise, this is the part where you configure declarative networks.

To add a secret, add it to secrets.nix, then run agenix:

# cd secrets
# agenix -e <secret path>.age

Remove hosts you do not need from hosts/ and flake.nix (or keep them) for reference, then finally commit and push to a remote (or copy the directory to a USB drive) to build upon your changes later.

Then, to activate the configuration, run Disko.

Installing to the disk

Caution

This will wipe your hard drive! All data will be lost! Make sure your backups are up to date!

# disko-install --flake .#<flake attribute> --disk main <device>

Replace <flake attribute> with the flake attribute you want to configure, like stickerbox, and <device> with a raw disk device path (like /dev/nvme0n1).

If your nix-store runs out of space (or the oom-reaper even kills your build process), the NixOS install is too large. You can try removing packages or using Disko manually. (See the manual for details.)

During the installation, Disko will ask for an encryption password. Store it safely, since you need it to access your data from a rescue environment.

Next steps

Your system should now be usable. Secure Boot is already enabled as well.
To unlock the disk without entering the password every time, enroll keys in the TPM and/or a FIDO2 security key.

# systemd-cryptenroll \
 --tpm2-device=auto \
 --tpm2-with-pin=true \ # optional for added security
 --tpm2-pcrlock=/var/lib/systemd/pcrlock.json \
 /dev/nvme0n1p2
# systemd-cryptenroll --fido2-device=auto

Hacking

This configuration includes the NixOS helper nh. For nh to function, the configuration must be at the location specified in programs.nh.flake. This setting is defined in system/default.nix and set to /home/linus/nixconfig, so you will probably need to change it.

All new files must be in some way imported by the appropriate configuration in flake.nix. They can either be directly imported, or listed in another file's imports attribute. Here, the files doing the latter are always named default.nix for recognizability. They also have the special attribute of being able to be included only by their parent directory's name.

Directory Structure

• dotfiles - Additional raw configuration files for some software (git, nvim, waybar)
• home/ - Home Manager configurations for user environments (shell, editor, GUI apps, etc.)
• hosts/ - Hardware configurations for specific machines (one .nix file per hostname)
• nvim/ - Neovim configuration (LSP, keybinds, completion, etc.)
• secrets/ - Encrypted secret keys for WiFi networks and access tokens. You will need to replace or remove these.
• ssh-keys - Your SSH user and host keys. These are used as recipient keys for age, as well as the authorized keys for the server.
• system/ - System-wide NixOS configurations (users, boot, audio, GUI, networking, etc.)
• stylix.nix - Theming and styling configuration (colors, fonts, cursors)

Commands

The most important commands for system maintenance are:

Full system update

On rolling release distros, you should always update the entire system at once. Nix makes it quite hard to do something else.

cd $NH_FLAKE
nix flake update --commit-lock-file
nh os boot
reboot

Also do this after adding a new flake input.

System rebuild

Rebuilds the system configuration, using the same package versions as before.

nh os switch

When changing configurations affecting the boot or login process, or after large modifications, do not apply the new configuration immediately, only after a reboot:

nh os boot
reboot