Br3nnabee's Modular, Multi-Device Nix Config

A flakeless, multi-host NixOS configuration for my desktop (cobalt) and Framework laptop (nickel). Declarative $HOME via hjem & hjem-rum (no home-manager), disko-managed full-disk encryption with impermanence and measured boot (lanzaboote + systemd-pcrlock) on the laptop, a hardened Firefox via Schizofox, nvf-built Neovim, gaming configs, and a bunch of other nifty stuff. Currently Intel and Nvidia hardware; AMD is the eventual direction.

Feel free to use this as a template or example for your own config.

Layout

• .tack/ - dependency pins (tack: flake-like TOML pins, lazily fetched; pins.toml is hand-editable, pins.lock.json is what Nix reads, default.nix is the vendored resolver)
• lib/ - mkHost and shared helpers
• hosts/<name>/ - per-host config (hardware, disks, boot, option values)
• modules/nixos/ - shared NixOS module tree behind host.* options
• home/<user>/ - per-user tree, evaluated inside hjem's user submodule
• pkgs/ - local packages (endcord) pending upstreaming

Building

Flakeless, so no --flake:

nixos-rebuild switch -f . -A <host>

Update pins with tack update (the binary is in the dev shell; bootstrap with nix run github:manic-systems/tack -- update).

First build on a fresh machine

Four things the commands above assume, which a fresh installer does not have:

1. Experimental features. The vendored resolver uses builtins.fetchTree, which the installed system enables via nix.settings.experimental-features. That option only takes effect after a successful build, so pass it by hand for the first one (fetch-tree is the minimal flag on Nix 2.24+; flakes also implies it):

   nixos-rebuild switch --file . --attr nickel \
     --option extra-experimental-features fetch-tree
   

2. Password hashes. host.system.users.declarativePassword reads /persist/passwords/<user>, which this repo does not create. On a wipeRoot host with mutableUsers = false, forgetting it produces a machine you cannot log into. Before the first boot of a fresh install:

   mkdir -p /persist/passwords
   mkpasswd -m yescrypt > /persist/passwords/<user>
   chmod 600 /persist/passwords/<user>
   

3. Privileged nix operations need sudo. trusted-users is ["root"] only, so adding a substituter or cache key is a change to modules/nixos/system/nix-daemon.nix rather than a CLI flag. nixos-rebuild and nh os elevate themselves; plain nix build / nix develop / nix eval against the configured substituters need no elevation.

4. Secure Boot keys. host.boot.secureboot expects an enrolled key hierarchy at /persist/secureboot (sbctl create-keys + sbctl enroll-keys). On cobalt, which dual-boots Windows, enrolment must include Microsoft's CA (sbctl enroll-keys --microsoft), or the Windows boot entry and the ESP sync in modules/nixos/boot/windows-dualboot.nix silently stop working. That sync is a manual command: run sudo sync-windows-boot after a Windows update that touched its bootloader.