Nix Configuration Monorepo

Declarative, flake-based system configuration for:

• macOS (via nix-darwin)
• NixOS (Linux workstation)

This repository provides a single source of truth for system, user, and development environments across machines.

---

Setup macOS

This section covers bootstrapping and daily use on macOS via nix-darwin.

Prerequisites

• Install Nix (Lix works too) so nix is available on your PATH.
• If you hit build failures later, install Xcode Command Line Tools: xcode-select --install

Lix users: If nix isn't found after installing Lix:

• Use the full path: /nix/var/nix/profiles/default/bin/nix
• Or source the profile script (zsh/bash): . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh

Bootstrap nix-darwin

Install nix-darwin. Use sudo -i instead of plain sudo due to this issue.

This flake defines darwinConfigurations.hammerhead.

First switch (works even before darwin-rebuild is on your PATH):

nix --extra-experimental-features "nix-command flakes" \
  run github:nix-darwin/nix-darwin/master#darwin-rebuild -- \
  switch --flake ".#hammerhead"

Subsequent switches:

darwin-rebuild switch --flake ".#hammerhead"

Update inputs

nix flake update
darwin-rebuild switch --flake ".#hammerhead"

---

Hosts

Fresh install (auto-detect OS)

Use this on a fresh machine. It auto-detects macOS vs NixOS and runs the correct host installer.

bash <(curl -sL https://raw.githubusercontent.com/noahkamara/nix-config/main/install.sh)

Hammerhead (macOS)

macOS workstation managed via nix-darwin and Home Manager.

Fresh install (one command, Lix)

On a freshly set up macOS machine:

bash <(curl -sL https://raw.githubusercontent.com/noahkamara/nix-config/main/install.sh)

The script will:

1. Ensure Xcode Command Line Tools are installed
2. Install Lix (if nix is not already available)
3. Install Homebrew if it is not already available
4. Clone this repository
5. Run the first darwin-rebuild switch --flake .#hammerhead

Colossus (macOS remote development)

The macOS installer uses the machine's local hostname to select its flake configuration. Once the Mac is named colossus, use the same command:

bash <(curl -sL https://raw.githubusercontent.com/noahkamara/nix-config/main/install.sh)

The installer keeps the first switch awake with caffeinate; the resulting configuration disables idle system sleep. FLAKE_HOST=colossus remains available as an override when bootstrapping before renaming the Mac.

Deploy updates from Hammerhead

After bootstrapping Colossus, deploy from this repo on Hammerhead:

./deploy.sh colossus

This builds locally for Apple Silicon, connects through the colossus SSH alias as its configured primary user, and prompts for that user's sudo password to activate the system. SSH key access must already work. To connect over the LAN instead, use ./deploy.sh colossus --hostname colossus-lan.

Rebuild

Run locally on Colossus:

sudo darwin-rebuild switch --flake .#colossus

iOS development

Upgrade macOS before deploying this configuration. Homebrew's xcodes CLI requires macOS 15 or later; check Apple's Xcode requirements for the Xcode version you need. Colossus was running Sonoma 14.8.7 when this setup was added, which supports at most Xcode 16.2. Xcode 27 requires macOS Tahoe 26.6 or later.

The remote-development profile installs xcodes and aria2 through Homebrew. xcodes uses aria2 for parallel downloads. After upgrading macOS and deploying, connect interactively and install Xcode:

ssh -t colossus-lan
xcodes install --latest --select
sudo xcodebuild -runFirstLaunch
xcodebuild -downloadPlatform iOS

Run xcodes as your normal user. It prompts for your Apple ID, two-factor authentication, and administrator password as needed. Installation stays outside Nix activation because it requires those interactive steps. To match a project's toolchain, replace --latest with its Xcode version.

Verify the selected Xcode, iOS SDK, and Simulator runtime:

xcodebuild -version
xcrun --sdk iphoneos --show-sdk-version
xcrun simctl list runtimes

Nebulon (NixOS)

NixOS workstation with full declarative system configuration.

• GPT layout managed by disko
• LUKS-encrypted LVM (TPM2 auto-unlock)
• LVM: 32G swap (hibernation-ready) + btrfs root with subvolumes
• btrfs subvolumes: @, @home, @nix, @snapshots
• Hyprland desktop with tuigreet

Fresh install

Boot from a NixOS installer/live ISO, then:

sudo -i
nix-shell -p curl --run "bash <(curl -sL https://raw.githubusercontent.com/noahkamara/nix-config/main/install.sh)"

The script will:

1. Clone this repo
2. Generate hardware configuration
3. List available disks and prompt you to select one
4. Warn if the disk is already partitioned (requires typing the disk name to confirm)
5. Patch the selected disk into disko.nix, partition, format, and mount
6. Activate swap and run nixos-install
7. Enroll TPM2 for automatic LUKS unlock (if a TPM2 device is detected)
8. Offer to reboot

Manual install (without script)

sudo -i

nix-shell -p git
git clone https://github.com/noahkamara/nix-config.git
cd nix-config

nixos-generate-config --root /tmp/hw-config --no-filesystems
cp /tmp/hw-config/etc/nixos/hardware-configuration.nix ./hosts/nebulon/hardware-configuration.nix

# identify the target disk
ls -l /dev/disk/by-id/ | grep nvme

# set the disk in disko.nix
sed -i 's|diskDevice = ".*"|diskDevice = "/dev/disk/by-id/<your-target-disk>"|' ./hosts/nebulon/disko.nix
git add hosts/nebulon/

# partition, format, and mount
nix --extra-experimental-features "nix-command flakes" \
  build '.#nixosConfigurations.nebulon.config.system.build.diskoScript' \
  --print-out-paths --no-link | xargs -I{} bash {}

# activate swap for the build
swapon /dev/vg0/swap

# install
nixos-install --flake '.#nebulon' --no-root-passwd

# enroll TPM2 (if available)
systemd-cryptenroll /dev/disk/by-partlabel/disk-main-root --tpm2-device=auto

reboot

Notes:

• The generated /tmp/hw-config/etc/nixos/configuration.nix is not used in this flake setup.
• hosts/nebulon/default.nix replaces traditional configuration.nix.
• hosts/nebulon/disko.nix is the source of truth for partitioning/filesystems/swap.

Rebuild

sudo nixos-rebuild switch --flake .#nebulon

Encrypted user vault (~/vault.img)

nebulon includes a vault shell command that manages a Disko-backed encrypted image file in your home directory:

• Image path: ~/vault.img
• Maximum size: 100G (sparse file)
• Mount point: ~/Vault
• Encryption: LUKS

Commands:

vault open
vault status
vault close

Notes:

• vault open creates ~/vault.img on first run, then uses disko --mode format,mount to initialize/mount it.
• vault close unmounts ~/Vault and closes the LUKS mapper.
• The command uses sudo for mount/cryptsetup operations, so it will prompt for your password.

Troubleshooting

If you hit no space left on device in the live installer:

# check which filesystem is full
df -h / /tmp /mnt /mnt/boot

# if live /tmp is full, keep build temp files on target disk
mkdir -p /mnt/tmp
chmod 1777 /mnt/tmp
export TMPDIR=/mnt/tmp

# retry nixos-install
nixos-install --flake '.#nebulon' --no-root-passwd

Chimaera (VPS NixOS)

Minimal VPS-focused NixOS host installed remotely from this repo with nixos-anywhere.

Notes:

• Partitioning/formatting is handled by Disko (hosts/chimaera/disko.nix).

⚠️ WARNING: Ensure your SSH key is present in modules/keys.nix before install — otherwise you will be locked out after first boot.

Fresh install from Debian VPS

From your local machine (in this repo), run:

cd /Users/noahkamara/.nix-config

# optional: verify target disk on the VPS first
# ssh root@debian-4gb-nbg1-1 'lsblk -o NAME,SIZE,TYPE,MOUNTPOINT'

nix run github:nix-community/nixos-anywhere -- \
  --flake .#chimaera \
  --target-host root@chimaera.noahkamara.com \
  --generate-hardware-config nixos-generate-config ./hosts/chimaera/hardware-configuration.nix \
  --build-on local # if you're building on a different architecture use `remote`

This will wipe the selected disk and reinstall the machine as NixOS. The target disk comes from hosts/chimaera/disko.nix (diskDevice).

After reboot:

ssh noah@chimaera.noahkamara.com

Deploy updates (deploy-rs)

Remote NixOS deployments are defined in flake.nix under deploy.nodes.

Deploy a specific host:

nix run github:serokell/deploy-rs -- .#chimaera

Or use the helper script:

./deploy.sh chimaera

---

Secrets

Secrets are managed with sops-nix. Encrypted files live under secrets/; edit them from a development shell so sops, age, and ssh-to-age are available:

nix develop
sops secrets/chimaera.yaml
sops secrets/hammerhead.yaml

chimaera decrypts with its SSH host Ed25519 key. If the VPS is reprovisioned, update the chimaera_host recipient in .sops.yaml with:

ssh root@chimaera.noahkamara.com \
  'nix-shell -p ssh-to-age --run "ssh-to-age < /etc/ssh/ssh_host_ed25519_key.pub"'

hammerhead decrypts with the local age key at ~/Library/Application Support/sops/age/keys.txt. Never put API keys or private keys directly in Nix expressions; wire services to config.sops.secrets.<name>.path instead.

---

Development Shells

You can manually enter the default development shell (with jq, just, etc.) by running:

nix develop

Or you can enter a specific shell (like the Swift environment) by running:

nix develop .#swift

Automatic Environment Activation (direnv)

This repository includes direnv and nix-direnv setup via Home Manager to automatically load these shells when you cd into a project directory.

1. Configure the Project Folder In your specific project folder, create a .envrc file to point to the desired shell in this flake:

• For the Swift shell: echo "use flake ~/Tools/nix-config#swift" > .envrc
• For the Default shell: echo "use flake ~/Tools/nix-config" > .envrc

2. Allow the Environment Navigate to the folder in your terminal and allow the environment:

direnv allow

3. Use in VSCode-based IDEs To make VSCode recognize these tools (for language servers, formatters like swiftformat, etc.), you have two options:

• Option A (Recommended): Install the direnv extension (mkhl.direnv) in Cursor. It will automatically load the Nix environment when you open the folder.
• Option B: Launch VSCoe directly from the activated terminal (code .), which passes the Nix environment variables to the editor.

---

Optional per-project shells can be added under devShells in flake.nix.

---

For AI agents: see AGENTS.md for build commands, coding conventions, repository structure, and editing guidance.

---

Applications

ComfyUI

Image generation UI, packaged via comfyui-nix. CUDA GPU acceleration is enabled automatically on x86_64-linux.

nix run .#comfyui