tberg/nixos-config
Watch
1
0
Fork
You've already forked nixos-config
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
No description
964 commits 2 branches 0 tags 3.6 MiB
  • Nix 94.6%
  • Shell 3.9%
  • Python 1%
  • Perl 0.3%
  • Lua 0.2%
Find a file
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Tom Berg cdbb4208f2 sunshine: don't restart sunshine-xorg on switch 
A nixpkgs bump that changes the nvidia driver leaves the old kernel
module loaded until reboot; a restarted Xorg then fails on the NVRM API
mismatch, which fails activation and triggers deploy-rs's rollback.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-31 08:23:23 +13:00
hosts drop boot.initrd.systemd.enable; drop Kodi pcre-cpp swap 2026-10-30 21:02:28 +13:00
lib flat: Moonlight from the TV box straight to akrasia 2026-09-25 20:37:13 +12:00
modules sunshine: don't restart sunshine-xorg on switch 2026-10-31 08:23:23 +13:00
openwrt Orbis: the ring shows internet status 2026-09-24 12:00:39 +12:00
secrets ataraxia: SteamGridDB key in sops; steam-art runs at each Steam start 2026-09-26 17:12:49 +12:00
.gitattributes fix sops and stop logos from accessing akrasias lan 2026-08-18 23:23:43 +12:00
.gitignore gitignore: result* rather than result 2026-09-01 15:54:00 +12:00
.sops.yaml ataraxia: install stick with the repo and a pre-made age key 2026-09-25 20:03:03 +12:00
ATARAXIA.md ataraxia: drop gamescope's FSR default 2026-09-29 01:11:26 +13:00
BACKUP.md akrasia: Tang retry 4 minutes, so the prompt comes ~5 min after power-on 2026-10-02 13:25:38 +13:00
BLOCKERS.md radarr: drop the 6.3 chown tripwire; BLOCKERS keeps the folder EPERM 2026-09-24 16:41:37 +12:00
CLAUDE.md akrasia: Tang retry 4 minutes, so the prompt comes ~5 min after power-on 2026-10-02 13:25:38 +13:00
flake.lock updates 2026-10-30 19:55:05 +13:00
flake.nix hyprland: nixpkgs' 0.56.2 instead of the pinned git parent of #16140 2026-10-17 10:42:01 +13:00
LICENSE merge 2023-11-28 17:04:31 +13:00
NETWORK.md ssh: OpenSSH 10.6 ML-DSA rename; pin new host keys, add enkrateia and ataraxia 2026-10-24 14:40:57 +13:00
README.md docs: phase 4 done — the media pool is LUKS2, all five headers backed up 2026-09-27 01:32:39 +12:00
RECONFIGURE.md coturn: listen and relay on v6 too 2026-09-20 02:47:09 +12:00
REFLASH.md docs: Tang key copy is optional and logos-only; document the rebind 2026-09-25 15:05:49 +12:00
RESTORE.md docs: LUKS header backups live in /persist/backups/luks-headers 2026-09-25 17:04:45 +12:00

README.md

nixos-config

Personal NixOS flake for the homelab. Host names follow a Greek/Latin philosophy theme.

Hosts

Host Role Platform
akrasia Gaming + LLM + NAS + headless service hub Tower, 2× GTX 1080
logos Programming laptop Dell Latitude 5400
enkrateia Tang server, and nothing else Raspberry Pi 3
ataraxia TV box: Kodi, Steam, Moonlight ThinkPad T14 Gen 3 AMD

ataraxia is arche's hardware (the former headless server). Arche's services moved to akrasia; install runbook in ATARAXIA.md.

Build a host

nix build .#nixosConfigurations.<Host>.config.system.build.toplevel

Deploy

nix run github:serokell/deploy-rs -- .#akrasia

Secrets

All secrets live under secrets/<host>/ and are encrypted with sops-nix + age. Host age keys live at /persist/secrets/sops_key.txt on each machine — its own btrfs subvolume, which is why no @persist snapshot contains it.

Backup and disk encryption

See BACKUP.md. One plan, because they are one sequence: the disk conversion needs a rehearsed restore, which needs a backup that works.

The backup half is applied: the offsite copy is borg on a Hetzner Storage Box (phase 0), and the content libraries are snapshotted for it (phase 2). Every akrasia disk is LUKS2: the system disk mirrored onto the router's old SSD and unlocked by Tang (phase 3), the media pool encrypted in place (phase 4).

Restore

RESTORE.md is the recovery runbook — read the order first, the steps unlock each other.

RECONFIGURE.md is what comes after the data is back: the hand-entered application state no dump contains.