anomalOS - my gaming centric NixOS configuration

Hyprland with noctalia-shell for the bar, launcher, lock screen, and control center. config module at modules/hjem/hyprland.nix, which generates a Lua config at ~/.config/hypr/hyprland.lua at runtime.

workspaces:

1. comms -- Discord (Zen web app), gajim+biboumi (XMPP+IRC)
2. dev -- ghostty, zed
3. web -- Zen Browser
4. games -- steam, heroic
5. media -- Jellyfin (Zen kiosk), mpv, gimp, inkscape, rmpc

• stash (special) -- pavucontrol, nmtui, blueman, LACT, btop, piper, pulsemixer, cliphist

keybinds:

wlr-which-key is the primary navigation layer. Super tap opens it for app launches, system tools, screenshots, power menu. full menu in modules/hjem/wlr-which-key.nix.

• YubiKey -- U2F for login, sudo, polkit. touch required on every auth.
• firewall -- nftables. drops everything by default. SSH on port 2222. gaming ports 23243-23262 (Divinity Original Sin 2). Jellyfin on 8096. Decky Loader web UI on 8080. Tailscale interface trusted. ping blocked.
• Suricata -- inline IPS running in NFQ mode, logs to /var/log/suricata/. can drop packets, not just detect.
• DNSCrypt -- encrypted DNS via dnscrypt-proxy, Cloudflare + Quad9, DNSSEC required, no-logging servers required, IPv6 queries blocked. systemd-resolved and unbound are disabled.
• kernel hardening -- ASLR, kernel pointer hiding, dmesg restricted to root, ptrace limited to parent processes, core dumps disabled, SYN flood protection, TCP TIME_WAIT protection, ICMP redirect rejection, reverse path filtering.

• zed -- primary editor with LSP for nix, css, html, ts, nu, md and prettier/nixfmt/nufmt formatting. config in modules/hjem/desktop/zed/.
• devshell -- nix develop drops into nushell with: nixd, nil, nixfmt, basedpyright, ruff, hyprls, nufmt, marksman, biome, clippy, rust-analyzer, rustfmt, dprint, typescript, typescript-language-server, nushell. see Contributing.
• Claude Code -- AI-assisted dev, cc alias launches claude-launcher with project selection.
• nix-search-tv -- ns for fzf-powered package search.
• nix-index + nix-index-database -- command-not-found handler with pre-built community DB, comma integration.

• steam -- Proton, Gamescope, controller support, 32-bit compat.
• heroic -- Epic/GOG launcher, globally wired with Gamescope (2560x1440, 144fps, wayland backend).
• Decky Loader -- steam plugin system, web UI at localhost:8080.
• MangoHud -- performance overlay, 5 presets (0=off to 4=full), Shift+F12 to toggle.
• gamemode -- globally enabled.
• emulators -- RetroArch (33 cores), PPSSPP (RetroArch core), melonDS (DS, RetroArch core), ProtonUp-Qt, OpenRA.
• DCSS -- Dungeon Crawl Stone Soup, wired in modules/hjem/dcss.nix.

• audio -- Pipewire + WirePlumber, hardware mixing, Bluetooth (A2DP, aptX, LDAC, AAC, SBC-XQ). HFP/HSP disabled.
• music -- MPD + rmpc TUI client. Navidrome streaming server accessible over Tailscale. snag for playlist to MP3, yoink for video downloads, sync-music for ADB sync to Android.
• media server -- Jellyfin with VAAPI hardware decode. arr suite: Radarr, Sonarr, Prowlarr, Bazarr, FlareSolverr, Recyclarr. Transmission as system service, tremc TUI.
• media creation -- GIMP 3, Inkscape, gpu-screen-recorder (replay buffer).
• video playback -- mpv, Jellyfin via Zen kiosk mode.

Automated snapshots via sanoid. Snapshots are copy-on-write -- they start at nearly zero space and only grow as data changes.

Templates are defined in modules/nixos-modules/sanoid.nix. Dataset assignments are in modules/hosts/hx99g-zfs.nix.

list snapshots:

zfs list -t snapshot # all snapshots
zfs list -t snapshot -r zroot/persist # specific dataset
zfs list -t snapshot -o name,used,refer # with space usage

restore a file:

every dataset has a .zfs/snapshot directory:

ls /persist/.zfs/snapshot/
cp /persist/.zfs/snapshot/autosnap_2025年12月11日_16:00:00_hourly/path/to/file ~/restored-file

restore a directory:

cp -a /persist/.zfs/snapshot/autosnap_2025年12月11日_12:00:00_hourly/path/to/dir /tmp/restored-dir
# verify it looks right, then move it where you want

rollback entire dataset:

this destroys everything after the snapshot. be sure.

sudo zfs rollback zroot/persist@autosnap_2025年12月11日_12:00:00_hourly

manual snapshot:

sudo zfs snapshot zroot/persist@manual-$(date +%Y%m%d-%H%M%S)
# or kick sanoid:
sudo systemctl start sanoid.service

check snapshot space:

zfs list -o name,used,avail,refer,usedsnap,usedds
# usedsnap = how much your snapshots are actually using

sanoid health:

systemctl status sanoid.service
systemctl status sanoid.timer
sudo journalctl -u sanoid.service -f

snapshots are local to the drive. they protect against accidental deletion and corruption, not hardware failure. your config is in git (GitHub/Codeberg) -- thats your system backup. critical personal data needs an external backup too.

troubleshooting:

# snapshots not being created
systemctl status sanoid.timer
sudo journalctl -u sanoid.service -n 50
sudo systemctl start sanoid.service
# out of space
zfs list -o space
# reduce retention in modules/nixos-modules/sanoid.nix and rebuild
# cant delete a snapshot (probably has dependent clones)
zfs list -t all | grep <snapshot-name>
# destroy the clones first

sudo zpool import -f zroot
sudo mount -t zfs zroot/root /mnt
sudo mount /dev/disk/by-label/NIXBOOT /mnt/boot
sudo mount -t zfs zroot/nix /mnt/nix
sudo mount -t zfs zroot/persist /mnt/persist
sudo mount -t zfs zroot/cache /mnt/cache
sudo nixos-enter --root /mnt
nh os switch --file /home/YOUR_USERNAME/dotfiles/assemble.nix YOUR_HOSTNAME
exit
sudo reboot

Secret management via agenix. Secrets are encrypted with your SSH keys, committed to git encrypted, and decrypted to /run/agenix/ (tmpfs) at boot -- gone on reboot.

how it works:

• encrypted .age files live in secrets/ and are safe to commit
• secrets/secrets.nix maps each .age filename to its recipient public keys (what agenix reads)
• modules/nixos-modules/secrets.nix wires secrets into the system config via age.secrets.*
• identity path is /persist/etc/ssh/ssh_host_ed25519_key -- if that key is missing, agenix silently fails at boot
• decrypts to /run/agenix/ at boot

currently configured secrets: tailscale-authkey, discord-token, radarr-api-key, sonarr-api-key, jellyfin-api-key.

create a secret:

cd ~/repo/public/anomalos
# create/edit the secret (opens $EDITOR)
nix run github:ryantm/agenix -- -e secrets/my-secret.age
# snapshot so nix can see it
jj s

declare it in the relevant module:

age.secrets.my-secret = {
 file = ./secrets/my-secret.age;
 owner = "weegs";
 mode = "400";
};
# reference the decrypted path:
programs.something.passwordFile = config.age.secrets.my-secret.path;
# resolves to: /run/agenix/my-secret

add to secrets/secrets.nix (the agenix recipient file):

let
 weegs = "ssh-ed25519 AAAA... weegs@HX99G";
 HX99G = "ssh-ed25519 AAAA... root@nixos";
 allKeys = [weegs HX99G];
in {
 "secrets/my-secret.age".publicKeys = allKeys;
}

edit existing secret:

nix run github:ryantm/agenix -- -e secrets/my-secret.age

rekey (after changing SSH keys):

nix run github:ryantm/agenix -- -r

adding a new machine:

# 1. get the new machine's host key
sudo cat /etc/ssh/ssh_host_ed25519_key.pub
# 2. add it to secrets/secrets.nix
# 3. rekey all secrets
nix run github:ryantm/agenix -- -r
jj s

troubleshooting:

ssh-add -L # check loaded keys
nix run github:ryantm/agenix -- -d secrets/my-secret.age # try manual decrypt
ls -la /run/agenix/ # check permissions
grep -r "age.secrets" ~/repo/public/anomalos/modules/ # check declaration exists

YubiKey-backed SSH keys work fine at boot, but creating or editing secrets interactively can be flaky. if agenix hangs, use a regular SSH key instead.

mental model:

• your working copy (@) IS a commit, not "dirty" state
• changes are automatically tracked and amend @ commit
• no staging area -- jj n finalizes current work and creates a new empty commit
• bookmarks dont auto-move -- you move them explicitly

daily workflow:

# make changes
zeditor modules/hjem/something.nix
# check what changed
jj s
jj d
# describe and finalize
jj dm "add wireguard configuration"
jj n # creates new empty commit (finalizes current)
# test
nrt
# if broken, fix and squash
jj sq
# push to both remotes (GitHub + Codeberg)
jj-push # nushell def: fetch + push + fetch

note: under pure tack, nix reads the working copy directly -- no jj s needed before nix eval or repl (that was a flakes-only requirement). snapshot when you want a version-control checkpoint, not to make nix see your edits.

core commands:

# viewing
jj s # status
jj l # recent commits
jj ll # detailed log
jj d # diff working copy
jj dp # diff against parent (@-)
jj ds # diff stats
# change management
jj dm "msg" # describe current commit
jj n # create new empty commit (finalizes current)
# manipulation
jj sq # squash into parent
jj sp # split commit interactively
jj spi # split with interface
# bookmarks
jj bs <name> -r <rev> # set bookmark to revision
jj tug # move closest bookmark to @-
# remotes
jj f # fetch from default remote
jj p # push
jj-fetch # nushell alias: jj git fetch --all-remotes
jj-push # nushell def: fetch + push + fetch (safe push workflow)
jj-pull # nushell def: fetch + move main bookmark to main@origin
jj-commit # nushell def: interactive split + bookmark move
# recovery
jj u # undo last operation

everything is recoverable via operation log. jj u works for rebases, squashes, deletions, etc.

key aliases (configured in modules/hjem/jujutsu.nix):

nushell defs (defined in modules/hjem/nushell.nix):

git vs jj:

git remotes: colocate mode exposes .git/ so the GitHub/Codeberg remotes work. files are automatically exported to git on every jj command.

build failures:

sudo nix-collect-garbage -d && nrt
tu nixpkgs # refresh a pin / hash mismatch
rm -rf ~/.cache/nix # clear eval cache
nh os test -- --show-trace # verbose output (nrt doesnt pass args through)

Hyprland wont start:

cat /tmp/hypr/$(ls -t /tmp/hypr/ | head -1)/hyprland.log
echo $XDG_SESSION_TYPE # should be "wayland"

noctalia missing:

noct-r
journalctl --user -u noctalia-shell

audio:

systemctl --user restart pipewire pipewire-pulse wireplumber

general:

journalctl -xe
systemctl --failed
systemctl --user --failed

help: NixOS Discourse -- NixOS Wiki -- Issues