Hosts | Overview | Structure

❄️ My NixOS Configuration

This is my personal nix config which I use to maintain my whole infrastructure, including my homelab, external servers and my development machines.

Hosts

Overview

An overview over what you will find in this repository. I usually put a lot of effort into all my configurations and try to go over every option in detail. I've included the major components in the lists below.

Dotfiles

Services

General & Miscellaneous

(WIP)

• reverse proxy with wireguard tunnel
• restic
• static wireguard mesh
• unified guests interface for microvms and containers with ZFS integration
• zoned nftables
• Secret rekeying, generation and bootstrapping using agenix-rekey
• Remote-unlockable full disk encryption using ZFS on LUKS
• Automatic disk partitioning via disko
• Support for repository-wide secrets at evaluation time (hides PII like MACs)

Structure

If you are interested in parts of my configuration, you probably want to examine the contents of users/, config/, modules/ and hosts/. Also, a lot of interesting modules have been moved to nixos-extra-modules, a separate repository specifically for reusable stuff. The full structure of this flake is described in STRUCTURE.md, but here's a quick breakdown of the what you will find where.

How-To

Add new machine

... incomplete.

• Add to hosts in flake.nix
• Create hosts/
• Fill net.nix
• Fill fs.nix (you need to know the device /dev/by-id paths in advance for partitioning to work!)
• Run agenix generate and agenix rekey (create's dummy secrets for initial deploy)

Initial deploy

• Create a bootable iso disk image with nix build --print-out-paths --no-link .#images.<target-system>.live-iso, dd it to a stick and boot
• (Alternative) Use an official NixOS live-iso and setup ssh manually
• Copy the installer from a local machine to the live system with nix copy --to <target> .#nixosConfigurationsMinimal.config.system.build.installFromLive

Afterwards:

• Run install-system in the live environment, export your zfs pools and reboot
• Retrieve the new host identity by using ssh-keyscan <host/ip> | grep -o 'ssh-ed25519.*' > hosts/<host>/secrets/host.pub
• (If the host has guests, also retrieve their identities!)
• Rekey the secrets for the new identity nix run .#rekey
• Deploy again

New secret

...

Stuff

• Generate, edit and rekey secrets with agenix <generate|edit|rekey>

To be able to decrypt the repository-wide secrets (files that contain my PII and are thus hidden from public view), you will need to _{(be me and)} add nix-plugins and point it to ./nix/extra-builtins.nix. The devshell will do this for you automatically. If this doesn't work for any reason, this can also be done manually:

1. Get nix-plugins: NIX_PLUGINS=$(nix build --print-out-paths --no-link nixpkgs#nix-plugins)
2. Run all commands with --option plugin-files "$NIX_PLUGINS"/lib/nix/plugins --option extra-builtins-file ./nix/extra-builtins.nix

Misc

Generate self-signed cert, e.g. for kanidm internal communication to proxy:

openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes \
  -keyout selfcert.key -out selfcert.crt -subj \
  "/CN=example.com" -addext "subjectAltName=DNS:example.com,DNS:sub1.example.com,DNS:sub2.example.com,IP:10.0.0.1"

Access backups

restic -o rclone.program="ssh -p 23 u000000@u000000.your-storagebox.de rclone" -o rclone.args="serve restic --stdio /home/restic/<subuser>/repo" -r rclone: stats