daniel-w-innes/nixos

Purpose and entry points

This is a Nix flake repository for declarative management of multiple NixOS machines, user environments, self-hosted services, secrets, and custom monitoring exporters. Primary evaluation/deployment entry points are flake.nix, host definitions under hosts/, and reusable system modules under generic/ and modules/.

Host composition

Each machine has a dedicated NixOS configuration plus hardware/facter inputs:

• hosts/cucamelon/configuration.nix

• hosts/melon/configuration.nix

• hosts/onion/configuration.nix

Host configurations are the composition boundary: they select common profiles, machine-specific hardware, service roles, and secrets. hardware-configuration.nix and facter.json represent host hardware discovery rather than shared policy.

Reusable system profiles

generic/ contains composable NixOS role and capability modules. These divide hosts into desktop, laptop, minimal, server, networking, remote access, upgrades, and observability concerns:

• generic/desktop.nix

• generic/server.nix

• generic/autoUpgrade.nix

Service-host aggregation is centered on generic/server/all.nix, with individual service modules separated so hosts can enable a selected service set.

Self-hosted service platform

The server layer configures a homelab-style application stack, including Forgejo, media/library services, search, file sharing, and download automation:

• generic/server/forgejo.nix

• generic/server/arr.nix

• generic/server/immich.nix

Ingress is separated from applications through Traefik configuration and target/dynamic-routing modules:

• generic/server/traefik.nix

• generic/server/traefik-dynamic.nix

• generic/server/traefik-targets.nix

This establishes a boundary between externally exposed routing and backend service definitions. Other material external services include Meilisearch, Searx, SMB, Calibre, Dawarich, BookOrbit, and weather integrations.

User environment and graphical sessions

Home Manager-style user configuration is organized independently from system modules. Base, terminal, GUI, desktop, laptop, and server profiles are composed with multiple Wayland compositor configurations:

• home/base.nix

• home/desktop.nix

• home/hypr.nix

Compositor-specific runtime configuration is maintained as native config assets, e.g. home/hyprland/hyprland.conf, home/niri/config.kdl, and home/sway/config. Waybar configuration is scoped per compositor.

Monitoring and custom Go exporters

Monitoring configuration is split between generic Prometheus enablement and custom Nix-packaged exporters:

• generic/prometheus.nix

• modules/airzone-exporter.nix

• modules/konnected-exporter.nix

The exporters are Go programs with independent module definitions, such as modules/airzone-exporter/main.go and modules/openweathermap-exporter/main.go. The Konnected exporter includes a checked-in Gotify API client, creating an integration boundary with Gotify; secrets also indicate InfluxDB and Grafana integrations.

Secret handling and automation

Encrypted age secrets are stored in secrets/ and are consumed by service/system modules without plaintext credentials in the repository:

• secrets/secrets.nix

• secrets/traefik-env.age

• secrets/forgejo-db-password.age

Secret coverage includes service database/admin credentials, API keys, network credentials, VPN configuration, and exporter tokens. Forgejo CI workflows in .forgejo/workflows/test.yml and .forgejo/workflows/update.yml provide repository automation; the flake lockfile pins the Nix dependency graph in flake.lock.