nix-config

My NixOS/nix-darwin config.

Switch system config

In the project root:

sudo nixos-rebuild switch --flake ".#<hostname>"

Install on a remote host

First, generate a set of SSH keys for the new host:

gen-host-ssh-keys.sh <hostname>
# output to gen/<hostname>

Then, rekey secrets so the new host can decrypt them:

cd secrets
# then add a pubkey from the new host to secrets.nix
agenix -r

Finally, use nixos-anywhere to build on current machine then configure the new remote host:

nixos-anywhere --extra-files gen/<hostname> --flake .#<hostname> nixos@<host_ip> --no-substitute-on-destination

Bootstrap on macOS

1. Install nix with the Determinate installer
2. xcode-select --install to install the Command Line Tools and make git available
3. Bootstrap SSH credentials
4. Clone this repo and enter its devShell
5. darwin-rebuild switch --flake .#<hostname>
6. chsh -s /run/current-system/sw/bin/fish
7. (optional) softwareupdate --install-rosetta --agree-to-license

Configure gocryptfs on macOS

The Darwin workstation profile installs macFUSE and mounts ~/Dropbox/data at ~/data. Initial setup requires enabling macFUSE's kernel extension in two places:

1. Shut down the Mac, then hold the power button until startup options appear. Open Options, launch Startup Security Utility, select the startup disk, and open Security Policy. Select Reduced Security, enable Allow user management of kernel extensions from identified developers, and restart.
2. After login, let the mount job trigger macFUSE. Open System Settings → Privacy & Security, allow the macFUSE system software from developer Benjamin Fleischer, and restart again.

The File System Extensions toggles do not replace these steps: gocryptfs uses macFUSE's kernel backend rather than its FSKit backend.

Store the vault password in the login Keychain once:

set-gocryptfs-data-password

The mount job retries every 30 seconds and mounts automatically on future logins, provided ~/Dropbox/data/gocryptfs.conf exists. Verify it with:

mount | grep -F " on $HOME/data "

Tricks

Install nix

On non-NixOS, use the Determinate nix installer:

curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | sh -s -- install

Debug flake

nix repl
# in the resulting nix prompt
> :lf .

zfs auto-snapshot

Enable/disable auto-snapshot with the following command:

sudo zfs set com.sun:auto-snapshot=true <pool>/<fs>

Configure maestral

maestral auth link  # follow instruction

mkdir -p ~/sync/dropbox
maestral config set path ~/sync/dropbox

# common excludes
maestral excluded add /audios
maestral excluded add /backup
maestral excluded add /git
maestral excluded add /researches/lhcb-hardware_related
maestral excluded add /videos

Acknowledgement

• This project was originally based on digga.
• digga is no longer actively maintained. To learn nix and make things simpler, I studied lite-config flake, stole the bits useful to me, and remade the project into its current state.