NixOS machines

Declarative config for my NixOS machines. Multi-host flake: shared config in modules/, per-machine specifics in hosts/, user environment in home/. The repo is synced across machines by Syncthing, so every host builds from ~/Code/nixos directly.

Each host's default.nix imports ../../modules plus its own hardware-configuration.nix, then sets only what's machine-specific. The flake's mkHost adds nix-flatpak, home-manager, and agenix to every host. No conditionals — a machine either imports a module or it doesn't.

Day-to-day

The flake attribute is the hostname, so bare nixos-rebuild targets the right host:

sudo nixos-rebuild switch --flake /home/jonathan/Code/nixos#laptop
sudo nixos-rebuild build  --flake /home/jonathan/Code/nixos#laptop   # check without activating
nix flake update          --flake /home/jonathan/Code/nixos          # bump inputs
sudo nixos-rebuild switch --rollback                                 # previous gen

New .nix files are picked up automatically (not a git flake, so no git add needed).

Secrets (agenix)

The GitHub packages token lives encrypted in secrets/github-token.age, decrypted at boot to /run/agenix/github-token, and read into GITHUB_PACKAGES_TOKEN by zsh. Every host that consumes a secret must be a recipient in secrets/secrets.nix — get a host's pubkey with cat /etc/ssh/ssh_host_ed25519_key.pub.

cd secrets && nix run github:ryantm/agenix -- -e github-token.age   # edit
cd secrets && nix run github:ryantm/agenix -- -r                    # re-encrypt

modules/secrets.nix guards on pathExists, so the config still evaluates before the .age exists.

Home / dotfiles

home/jonathan.nix (home-manager): zsh + oh-my-zsh + starship, git, ssh, editorconfig, Syncthing, GNOME dconf. The system only enables zsh as a login shell; all shell config is here. Conflicting pre-existing files are moved to *.hm-bak on first switch. Syncthing's device list is filtered per host so a machine never lists itself; server is the introducer.

Adding a host

1. Install NixOS (UEFI → systemd-boot).
2. sudo nixos-generate-config --show-hardware-config > hosts/<name>/hardware-configuration.nix
3. Write hosts/<name>/default.nix: bootloader, networking.hostName, system.stateVersion, and imports = [ ./hardware-configuration.nix ../../modules ].
4. Add <name> = mkHost ./hosts/<name>; to flake.nix.
5. Add the host's SSH host key to secrets/secrets.nix, then agenix -r.
6. sudo nixos-rebuild switch --flake /home/jonathan/Code/nixos#<name>.

Each host needs its own hardware-configuration.nix — never copy one machine's to another. Re-encrypt secrets after a fresh install: the new host gets a new SSH host key, so update secrets/secrets.nix and run agenix -r, or boot-time decryption will fail.