Add documentation for NixOS and Home Manager conventions
This commit is contained in:
@@ -0,0 +1,47 @@
|
||||
# chiasson-nix
|
||||
|
||||
My personal NixOS + Home Manager flake. [flake.nix](../flake.nix) feeds `./modules` through flake-parts and [import-tree](https://github.com/vic/import-tree) so config stays in small files instead of one monster module.
|
||||
|
||||
How to work on it: [conventions.md](./conventions.md).
|
||||
|
||||
## Hosts
|
||||
|
||||
| Host | What it is |
|
||||
|------|------------|
|
||||
| `t2mbp` | Intel MacBook with T2 chip — Niri/DMS, `t2linux` + fan daemon |
|
||||
| `14900k` | Main x86 desktop — same GUI stack, also cross-builds aarch64 and exports NFS for Jellyfin |
|
||||
| `ideapad` | Lenovo IdeaPad Duet 3 (Chromebook, `lenovo-wormdingler`) — Mobile NixOS on Snapdragon, Niri/DMS, touch/tablet bits in `_private/` |
|
||||
| `uConsole` | Clockwork Pi uConsole (Pi 5 CM) — Niri/DMS, built with `nixos-raspberrypi` + oom-hardware |
|
||||
| `nix-server` | Headless x86 VM — Attic, Gitea, Immich, SwiftShare, Personal-Website, DDRM, Portainer, … |
|
||||
| `r5500` | Headless media box — Jellyfin, *arr, qBittorrent, Dispatcharr; library on NFS from `nix-server` |
|
||||
|
||||
Each machine: `modules/hosts/<name>/default.nix` → `nixosConfigurations.<name>`, real config in `*Configuration` + optional `_private/` and `_services/`.
|
||||
|
||||
## Deploy / rebuild
|
||||
|
||||
Remote builds use the `builder` user (`systemDeployBuilder`, wired through `client-services` on desktops).
|
||||
|
||||
Fleet deploy is [Navi](https://github.com/cafkafk/navi) — config in `modules/deploy/navi.nix`, outputs `flake.navi` / `flake.naviHive`.
|
||||
|
||||
```bash
|
||||
nix develop # devShell has navi + hints
|
||||
navi apply --on <host>
|
||||
navi apply-local --node 14900k --sudo # this machine, if hostname matches
|
||||
```
|
||||
|
||||
Plain rebuild still works: `sudo nixos-rebuild switch --flake .#<host>`.
|
||||
|
||||
## Repo layout
|
||||
|
||||
```
|
||||
modules/
|
||||
hosts/<host>/ # per-machine composition
|
||||
system/ # nixosModules.system aggregate
|
||||
desktop/ # GUI stack
|
||||
wisdom/ # HM modules (exports still named wisdom*)
|
||||
ssh/ # inbound NixOS + outbound HM
|
||||
deploy/ # navi hive
|
||||
lib/ # pure helpers → flake.lib
|
||||
```
|
||||
|
||||
Machine-only stuff lives in `hosts/<host>/_private/` — import-tree skips `_private/` globally, so those files only get pulled in where you import them.
|
||||
@@ -0,0 +1,105 @@
|
||||
# Conventions
|
||||
|
||||
## How the flake is wired
|
||||
|
||||
`flake.nix` runs import-tree on `./modules` with a few extra filters: skip `/package/`, `/packages/`, and `dms/home-manager/` (callPackage noise + DMS HM colocation). Don't add a global `/home-manager/` filter — `modules/ssh/home-manager/` needs to load.
|
||||
|
||||
Every scanned `.nix` should be a flake fragment:
|
||||
|
||||
```nix
|
||||
{ self, inputs, ... }: {
|
||||
flake.nixosModules.systemFoo = { config, lib, pkgs, ... }: { /* … */ };
|
||||
}
|
||||
```
|
||||
|
||||
Don't define the same `flake.nixosModules.foo` in two files — merge order isn't something to bet on.
|
||||
|
||||
**Outputs I actually use:** `nixosConfigurations.*`, `nixosModules.*`, `homeManagerModules.*`, `lib.*`, `packages.*`, `navi` / `naviHive`. `modules/parts.nix` declares supported systems and the `flake.lib` / `flake.homeManagerModules` option slots.
|
||||
|
||||
## Option namespaces
|
||||
|
||||
Project options live under `chiasson.*` only:
|
||||
|
||||
| Prefix | For |
|
||||
|--------|-----|
|
||||
| `chiasson.system.*` | Machine policy — docker, flatpak, audio, gaming, deploy builder, … |
|
||||
| `chiasson.desktop.*` | GUI — compositors, DMS, wallpapers, display manager |
|
||||
| `chiasson.home.*` | Home Manager toggles (module exports are still `wisdom*`) |
|
||||
| `chiasson.users.*` | Catalog, `enabled`, `hostOverrides`, `extraModules` |
|
||||
| `chiasson.ssh.*` | SSH inventory |
|
||||
|
||||
Leave upstream `services.*`, `networking.*`, `home.*`, etc. alone.
|
||||
|
||||
## Module shape
|
||||
|
||||
**NixOS leaf** — camelCase export, usually prefixed (`systemDocker`, `desktopNiri`):
|
||||
|
||||
```nix
|
||||
{ ... }: {
|
||||
flake.nixosModules.systemSomething = { config, lib, pkgs, ... }:
|
||||
let cfg = config.chiasson.system.something;
|
||||
in {
|
||||
options.chiasson.system.something.enable = lib.mkEnableOption "…";
|
||||
config = lib.mkIf cfg.enable { /* … */ };
|
||||
};
|
||||
}
|
||||
```
|
||||
|
||||
Aggregates: `nixosModules.system` and `nixosModules.desktop` import their leaves. Host configs import those stacks and set options — they shouldn't reimplement whole subsystems.
|
||||
|
||||
**Home** — files under `modules/wisdom/`. Baseline is `homeManagerModules.wisdom` (`chiasson.home.enable`). Everything else is separate exports (`wisdomBrowsersZen`, …); enable on a host via `chiasson.users.extraModules.<user>` and the matching `chiasson.home.*.enable`.
|
||||
|
||||
User apps / dotfiles → wisdom. Daemons, firewall, kernel → NixOS. Sometimes both (LocalSend: HM installs, `systemLocalsend` opens the firewall).
|
||||
|
||||
**Odd exports**
|
||||
|
||||
- `"client-services"` — shared setup for laptops/tablets/desktops (not the VMs). Turns on Bluetooth, lets Navi log in as `builder` to update the machine, enables printing and mounting USB drives, and sets SSH to password. Used on `t2mbp`, `14900k`, `ideapad`, `uConsole`. Skipped on `nix-server` and `r5500`.
|
||||
- `systemUconsoleKernelBuilder` — cross-build the uConsole kernel on x86_64, not for running on the Pi.
|
||||
- `systemFlatpak` — allowlist sync; skips heavy `flatpak update` when lists unchanged (`runHeavyMaintenanceEverySwitch`).
|
||||
|
||||
**Desktop notes**
|
||||
|
||||
- `chiasson.desktop.displayManager.variant`: `sddm` vs `dankgreeter` (DMS + Hyprland/Niri tends toward DankGreeter).
|
||||
- `desktopWallpapers` copies `inputs.wallpapers` into the store; override `chiasson.desktop.wallpapers.source` if needed.
|
||||
|
||||
|
||||
## Users
|
||||
|
||||
User definitions live in `usersCatalogDefaults` (`modules/system/users/catalog-default.nix`) — olivier, server, builder, etc. Pick who exists on a host with `chiasson.users.enabled`.
|
||||
|
||||
Passwords aren't in the repo. They're in `secrets/secrets.yaml` (encrypted with sops). Each host that has `olivier` must declare that secret and set `neededForUsers = true`; sops-nix decrypts it at boot, and the catalog points `hashedPasswordFile` at that file. That's why the catalog is a proper module instead of a static list — it needs `config.sops.secrets.…` at eval time.
|
||||
|
||||
On a host:
|
||||
|
||||
```nix
|
||||
chiasson.users.enabled = [ "olivier" ];
|
||||
chiasson.users.hostOverrides.<name> = { /* optional */ };
|
||||
chiasson.users.extraModules.olivier = [
|
||||
self.homeManagerModules.wisdomTerminalsKitty
|
||||
# …
|
||||
];
|
||||
```
|
||||
|
||||
`usersHomeIntegration` turns that into `users.users` + HM. Don't hand-roll catalog users unless you're changing the users module itself.
|
||||
|
||||
SSH: `sshInbound` on NixOS, outbound/rbw under `modules/ssh/home-manager/`.
|
||||
|
||||
## Adding things
|
||||
|
||||
**New NixOS leaf:** export `flake.nixosModules.whatever`, wire from `system/default.nix` or `desktop/default.nix` if it's global, or only from a host `configuration.nix` if it's not. `nix flake check`. Git-add new paths if eval uses the git tree.
|
||||
|
||||
**New HM slice:** export `flake.homeManagerModules.wisdomFoo`, add the file to `imports` in `modules/wisdom/default.nix`, then wire `extraModules` + options on hosts that need it.
|
||||
|
||||
**Derivations:** `let` inside a fragment, or `flake.packages` / `flake.lib` — not a bare `mkDerivation` file import-tree will try to load.
|
||||
|
||||
**New host:** `hosts/<name>/default.nix` with `nixosSystem`, `configuration.nix` exporting `*Configuration`, hardware + `_private/` as needed, register in `modules/deploy/navi.nix` if it should be in the fleet.
|
||||
|
||||
## When editing
|
||||
|
||||
- `nix flake check` after touching `modules/`.
|
||||
- Stage/commit new files if the flake is read from git.
|
||||
- Small diffs; `mkEnableOption` + `mkIf` for toggles.
|
||||
- Cross-module deps: assertions or `mkDefault`, mention it in the option description.
|
||||
- New flake inputs in `flake.nix` with `follows` where versions should track nixpkgs.
|
||||
- `client-services` SSH defaults are for my LAN — don't copy to anything internet-facing without tightening.
|
||||
- If I'll forget the behavior in six months, update these docs in the same change.
|
||||
Reference in New Issue
Block a user