system

NixOS configuration for multiple hosts, managed with flakes and home-manager.

Structure

host/
 default.nix # shared base config (locale, shells, gc, ...)
 <hostname>/
 default.nix # host-specific config
 hardware.nix # generated hardware config
home/
 default.nix # shared user config (packages, dotfiles, services, ...)
 <username>/
 default.nix # user-specific config

Bootstrapping a new host

1. Clone the repo

git clone https://github.com/wintermute-cell/system /etc/nixos-config

2. Generate hardware config

nixos-generate-config --show-hardware-config > /etc/nixos-config/host/<hostname>/hardware.nix

3. Create host/<hostname>/default.nix

Copy an existing host as a starting point. At minimum set networking.hostName and system.stateVersion (use the current NixOS version).

4. Register the host in flake.nix

Add a new entry under nixosConfigurations, declaring which users exist and their home-manager config (see existing hosts as reference).

5. Switch

sudo nixos-rebuild switch --flake /etc/nixos-config#<hostname>

Or use rebuild.sh, which picks the hostname automatically.

Post-install steps

These are one-time imperative steps that can't be done declaratively and must be repeated on each new machine.

Thunderbolt dock authorization

Bolt manages Thunderbolt security but device trust is intentionally imperative (you're trusting a specific physical device). After plugging in a dock:

boltctl list # find the uuid
sudo boltctl enroll <uuid> # permanently authorize it

Only needs to be done once per device — enrollment persists across rebuilds.

Updating

./rebuild.sh # updates flake inputs and rebuilds
./rebuild.sh --no-update # rebuild without updating inputs

xremap

xremap handles keyboard remapping. It uses a two-process design to support multiple simultaneously logged-in users without one user blocking input for another.

• System service (xremap-socket): runs as root, holds exclusive grab on physical keyboards, applies global remaps (CapsLock→Ctrl, hj→Esc). Uses the socket feature so it can receive window focus info without needing niri IPC directly.
• Per-user bridge (xremap-niri): runs in each user's session, connects to niri IPC to watch the focused window, and forwards that info to the system service over a socket. This enables app-specific keymaps (e.g. emacs keys in Firefox).

The two binaries are compiled from the same source with different feature flags, which is why they are built as separate derivations in flake.nix.