nixos-infra

Declarative NixOS infrastructure: host configurations, system modules, services, and user environments. Built on Nix flakes, NixOS modules, and Home Manager.

Design principles:

• Single source of truth for all systems
• Fully reproducible builds
• Minimal duplication; shared logic in modules and lib
• Modular services with a unified machine.<service>.* interface

Contents:

• nixos-infra
  • Machines
  • Architecture
  • Repository structure
    • Hosts
    • Lib
    • Services
    • Users
    • Secrets
  • Packages
  • Security
    • Sudo
    • OpenSSH
  • TODO
  • Deployment
  • License

---

Machines

Host	Role
elaris	Personal desktop
velarion	RuJect infrastructure (Forgejo, mail, etc.)

---

Architecture

• hosts/ -- per-machine configuration (hardware, disk, common baseline)
• modules/ -- reusable NixOS modules (SSH, security, fonts, etc.)
• services/ -- service definitions with options.nix and service.nix; enabled via machine.<name>.enable, machine.<name>.domain, etc.
• users/ -- user accounts and Home Manager configs (system.nix, default.nix, hosts/<host>.nix)
• pkgs/ -- standalone flake (ruject-nix) providing packages, NixOS modules, and home-manager modules (see pkgs/README.md)
• lib/ -- mkNixos, mkUsers, mkHome for assembling systems and home configs

---

Repository structure

.
├── flake.nix
├── hosts/
│   ├── common/          # shared baseline (modules, packages, locale)
│   ├── elaris/
│   └── velarion/
├── modules/             # NixOS modules (ssh, security, ...)
├── services/            # machine.<name>.* service definitions
├── users/
├── pkgs/            # ruject-nix subflake (packages, modules, overlays)
├── lib/
└── secrets/

Hosts

Per-host config lives under hosts/<hostname>/ (e.g. disk.nix, machine.nix, default.nix). The common/ import provides a shared baseline for all hosts (see hosts/common/default.nix).

Lib

• mkNixos -- builds a nixosSystem: flake inputs, host config, Home Manager, users. Entrypoint: mkNixos { hostname = "velarion"; users = [ "rus07tam" ]; }.
• mkUsers -- turns users/<name>/system.nix and users/<name>/default.nix into system modules and Home Manager config.
• mkHome -- builds Home Manager config for a user on a given host; supports users/<name>/hosts/<hostname>.nix overrides.

Services

Each service is a module with a unified NixOS option namespace machine.<service>.*.

Typical layout (see services/forgejo/):

File	Purpose
default.nix	Entry point; imports options.nix, service.nix, and optional submodules
options.nix	Declares machine.<service>.* options (enable, domain, port, database, etc.)
service.nix	Core service config: enables the service, configures settings, system packages, SSH AllowUsers if needed

Optional components:

File	Purpose
network.nix / nginx.nix	Firewall (allowedTCPPorts), nginx virtualHost with reverse proxy, SSL/ACME
mail.nix	SMTP/mailer config for the service; mailserver login accounts (when machine.mail.enable)
tmpfiles.nix	systemd.tmpfiles.rules for directories and static assets (e.g. custom themes)
secrets.nix	Sops secrets referenced by the service
database.nix	Database setup (PostgreSQL ensureDatabases, ensureUsers) when the service needs a DB

Users

Per-user directory: users/<username>/.

• system.nix -- system-level: users.users.<name> (groups, hashedPasswordFile, openssh.authorizedKeys), services.openssh.settings.AllowUsers, shared programs (e.g. programs.fish.enable). Passwords and sensitive data come from sops secrets.
• default.nix -- Home Manager base: imports (variables, modules), home.packages, targets.genericLinux.enable.
• hosts/<hostname>.nix -- host-specific Home Manager overrides.
• modules/, variables/, assets/ -- user-local modules and shared variables.

Example layout: users/rus07tam/{system.nix, default.nix, secrets.nix, variables/, modules/, hosts/}.

Secrets

Managed with sops-nix. Secrets are decrypted at evaluation time and referenced in config.

Layout:

Path	Description
.sops.yaml	Encryption rules (recipients, path regexes)
secrets/common.yaml	Shared secrets used across multiple services
secrets/<host>.yaml	Per-host secrets (elaris.yaml, velarion.yaml)
secrets/<user>/secrets.yaml	Per-user secrets (rus07tam/secrets.yaml)
secrets/<user>/<module>/	Encrypted workspace/files for a specific module (rus07tam/openclaw/)

Encryption rules in .sops.yaml use path_regex to match different files:

• ^secrets/.*\.ya?ml$ — standard YAML secret files
• ^secrets/openclaw/.*$ — encrypted workspace files (binary format)

Module argument aliases:

Instead of writing config.sops.secrets."...".path, these shorthand aliases are injected via _module.args:

Alias	Defined in	Scope	Value
sec	modules/sops.nix	NixOS modules	config.sops.secrets (system-level)
sec	lib/baseHome.nix	Home Manager modules	config.sops.secrets (home-level)
osSec	lib/baseHome.nix	Home Manager modules	osConfig.sops.secrets (system-level secrets from home context)

Example usage:

{ sec, ... }: {
  users.users.rus07tam.hashedPasswordFile = sec."rus07tam/hashedPassword".path;
}

---

Packages

The pkgs/ directory is a standalone flake (ruject-nix) that provides packages, NixOS modules, and home-manager modules consumed by the root flake. It is added as a flake input:

ruject-nix.url = "path:./pkgs";

Available outputs:

Output	Description
packages.${system}.*	Package derivations
overlays.default	Overlay adding all packages to pkgs
nixosModules.nixos-update	NixOS module for nixos-update script
homeModules.clipboard	Home Manager module for clipboard tools
homeModules.noctalia-keybinds	Home Manager module for keybinds plugin

See pkgs/README.md for a full description of each package.

---

Security

Sudo

Configures sudo for group wheel: NOPASSWD for a fixed set of commands only:

• nixos-rebuild
• nix
• systemctl
• reboot
• poweroff

All other operations require a password.

OpenSSH

• services.openssh: enabled, openFirewall = true.
• Global settings: Access is key-only; root login is disabled.
• Per-user access: each user and each service account that needs SSH (e.g. forgejo for git) is added explicitly via services.openssh.settings.AllowUsers in the corresponding module (e.g. in users/rus07tam/system.nix or services/forgejo/service.nix).

---

TODO

• Add firejail
• Add SSH/PGP daemons
• Fix noctalia plugins (pkgs/noctalia-*) — currently broken
• Improve guest-isolation and integrate with services
• Add yt-dlp to rus07tam
• Migrate from throne to native xray-core
• Add auto bump flake.lock (Forgejo Actions)
• Add auto nix fmt (pre-commit hook or CI)

---

Deployment

On a host, apply the configuration for that host:

sudo nixos-rebuild switch --flake .#<hostname>

Alternatively, use the nixos-update script (see pkgs/nixos-update/module.nix) to pull the latest flake from the remote and run the rebuild.

---

License

See LICENSE.