mazex/nixos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(readme): traduire le README en anglais

Browse Source
This commit is contained in:
Hermes Agent
2026-09-27 23:59:36 -04:00
parent bfd1a3c865
commit 79032ac0ab
1 changed files with 60 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+60 -60
View File
@@ -1,93 +1,93 @@
# nixos
Configuration NixOS + Home Manager + nix-darwin de Marc Partensky, en flake unique pour toutes les machines : `tower`, `laptop`, `deck`, le VPS `anywhere`, le Mac, et le téléphone (nix-on-droid).
Marc Partensky's NixOS + Home Manager + nix-darwin configuration, one flake for every machine: `tower`, `laptop`, `deck`, the `anywhere` VPS, the Mac, and the phone (nix-on-droid).
## Machines
| Output flake | Type | Description |
| Flake output | Type | Description |
|---|---|---|
| `nixosConfigurations.tower` | NixOS | Machine principale (AMD, ZFS). `profiles/common` + `profiles/tower` + `services/` (tous les services auto-hébergés) + `protonmail-mcp`. |
| `nixosConfigurations.laptop` | NixOS | Portable. `profiles/common` + `profiles/laptop` + `services/`. |
| `nixosConfigurations.deck` | NixOS | Steam Deck (via Jovian-NixOS). `profiles/deck` seul, pas de `services/`. |
| `nixosConfigurations.anywhere` | NixOS | VPS (RackNerd) : Pangolin, Traefik/Caddy, Stalwart mail, headscale. `profiles/anywhere`. |
| `nixosConfigurations.laptop-iso` / `deck-iso` | NixOS | Images d'installation (disko + hardware-configuration inclus). |
| `nixosConfigurations.dev` | NixOS (microvm) | VM de dev jetable, voir `vms/`. Se lance avec `just vm`. |
| `homeConfigurations.marc` | Home Manager standalone | Profil Linux de marc (tower/laptop), **pas câblé** dans les `nixosConfigurations` — géré indépendamment. |
| `homeConfigurations."marc@macos"` | Home Manager | Profil HM sur le Mac (en plus de nix-darwin). |
| `homeConfigurations."marc@deck"` | Home Manager | Profil HM sur le Deck. |
| `darwinConfigurations.macos` | nix-darwin | Système du Mac. |
| `nixOnDroidConfigurations.default` | nix-on-droid | Téléphone Android. |
| `nixosConfigurations.tower` | NixOS | Main machine (AMD, ZFS). `profiles/common` + `profiles/tower` + `services/` (all self-hosted services) + `protonmail-mcp`. |
| `nixosConfigurations.laptop` | NixOS | Laptop. `profiles/common` + `profiles/laptop` + `services/`. |
| `nixosConfigurations.deck` | NixOS | Steam Deck (via Jovian-NixOS). `profiles/deck` only, no `services/`. |
| `nixosConfigurations.anywhere` | NixOS | VPS (RackNerd): Pangolin, Traefik/Caddy, Stalwart mail, headscale. `profiles/anywhere`. |
| `nixosConfigurations.laptop-iso` / `deck-iso` | NixOS | Installer images (disko + hardware-configuration bundled). |
| `nixosConfigurations.dev` | NixOS (microvm) | Disposable dev VM, see `vms/`. Launched with `just vm`. |
| `homeConfigurations.marc` | Home Manager standalone | Marc's Linux profile (tower/laptop), **not wired** into any `nixosConfigurations` — managed independently. |
| `homeConfigurations."marc@macos"` | Home Manager | HM profile on the Mac (on top of nix-darwin). |
| `homeConfigurations."marc@deck"` | Home Manager | HM profile on the Deck. |
| `darwinConfigurations.macos` | nix-darwin | The Mac's system config. |
| `nixOnDroidConfigurations.default` | nix-on-droid | Android phone. |
`nixpkgs` = `nixos-26.05` (+ `unstable` pour les paquets absents de la 26.05, `nixpkgs-darwin`/`nix-darwin-26.05` pour le Mac).
`nixpkgs` = `nixos-26.05` (+ `unstable` for packages missing from 26.05, `nixpkgs-darwin`/`nix-darwin-26.05` for the Mac).
## Structure du repo
## Repo layout
```
flake.nix toutes les nixosConfigurations / homeConfigurations / darwinConfigurations
Justfile + .env commandes courantes (HOST, HM, RUN par défaut)
profiles/<host>/ composition par machine (imports, firewall, hostName, sops file)
common/ base partagée par tower+laptop (users, modules nixos, home-manager.users.root)
hosts/<name>/ disko.nix + hardware-configuration.nix par machine
flake.nix every nixosConfigurations / homeConfigurations / darwinConfigurations
Justfile + .env common commands (default HOST, HM, RUN)
profiles/<host>/ per-machine composition (imports, firewall, hostName, sops file)
common/ base shared by tower+laptop (users, nixos modules, home-manager.users.root)
hosts/<name>/ disko.nix + hardware-configuration.nix per machine
modules/
nixos/<name>/ modules système unitaires (activés = importés dans profiles/common ou profiles/<host>)
home/<name>/ modules Home Manager (Linux), importés par users/marc/home.nix
home-mac/<name>/ modules Home Manager spécifiques Mac
nixos/<name>/ unit NixOS modules (enabled = imported in profiles/common or profiles/<host>)
home/<name>/ Home Manager modules (Linux), imported by users/marc/home.nix
home-mac/<name>/ Mac-specific Home Manager modules
users/
marc/ home.nix + packages.nix (profil standalone `just home`)
root/ home.nix câblé via profiles/common (seul profil HM dans les nixosConfigurations)
mac/, deck/ profils HM des autres machines
services/<name>/ services auto-hébergés (un dossier par service), registre = services/default.nix
hermes/plugins/ plugins Nix-managed du gateway Hermes
secrets/*.yml secrets chiffrés sops-age (voir plus bas)
vms/ définitions de microvm.nix pour les VM de dev
marc/ home.nix + packages.nix (standalone profile, `just home`)
root/ home.nix wired via profiles/common (only HM profile inside nixosConfigurations)
mac/, deck/ HM profiles for the other machines
services/<name>/ self-hosted services (one folder per service), registry = services/default.nix
hermes/plugins/ Nix-managed plugins for the Hermes gateway
secrets/*.yml sops-age encrypted secrets (see below)
vms/ microvm.nix definitions for dev VMs
```
`services/` n'est importé QUE par `laptop` et `tower` (cf. `flake.nix`) : `deck` et `anywhere` n'ont pas ce registre.
`services/` is only imported by `laptop` and `tower` (see `flake.nix`): `deck` and `anywhere` don't have this registry.
## Commandes (Justfile)
## Commands (Justfile)
`.env` fixe les valeurs par défaut : `HOST=tower`, `HM=marc`, `RUN=nixos`.
`.env` sets the defaults: `HOST=tower`, `HM=marc`, `RUN=nixos`.
| Commande | Effet |
| Command | Effect |
|---|---|
| `just` | `just nixos` (via `RUN`) |
| `just nixos` | `sudo nixos-rebuild switch --impure --flake .#$HOST` |
| `just home` | `home-manager switch --flake .#$HM` (à lancer en tant que `marc`, pas `hermes`) |
| `just home` | `home-manager switch --flake .#$HM` (run as `marc`, not `hermes`) |
| `just mac` | `nix-darwin switch --flake .#macos` |
| `just droid` | `nix-on-droid switch --flake ~/.config/nixos#default` |
| `just vm [nom=dev]` | build + lance une microvm de dev (état dans `~/.local/state/microvms/<nom>/`) |
| `just vm-build [nom=dev]` | build seul, sans lancer |
| `just iso` | image ISO de `$HOST-iso` |
| `just install` | disko + `nixos-install` (nouvelle machine) |
| `just ventoy <disk> [size]` | clé USB Ventoy + installeur Nix |
| `just vm [name=dev]` | build + launch a dev microvm (state in `~/.local/state/microvms/<name>/`) |
| `just vm-build [name=dev]` | build only, don't launch |
| `just iso` | ISO image for `$HOST-iso` |
| `just install` | disko + `nixos-install` (new machine) |
| `just ventoy <disk> [size]` | Ventoy USB stick + Nix installer |
Mise à jour des inputs : `nix flake update` avant un rebuild (`--upgrade` n'a aucun effet sur un flake, ne pas l'utiliser).
Updating inputs: `nix flake update` before a rebuild (`--upgrade` has no effect on a flake, don't use it).
Vérifier l'éval sans build : `nix eval .#nixosConfigurations.$HOST.config.system.build.toplevel.drvPath --impure`.
Eval check without building: `nix eval .#nixosConfigurations.$HOST.config.system.build.toplevel.drvPath --impure`.
## Secrets (sops-nix)
- `secrets/*.yml`, un fichier par domaine (`tower.yml`, `common.yml`, `anywhere.yml`, `zitadel.yml`, `gitea.yml`, ...), chiffrés avec `sops` + clés `age`.
- 4 clés dans `.sops.yaml` : anywhere, tower, mac, deck. `common.yml` est déchiffrable par toutes les machines ; chaque profil fixe `sops.defaultSopsFile` sur son fichier dédié.
- Créer un secret **neuf** ne nécessite que les clés publiques déjà dans `.sops.yaml` : `nix run nixpkgs#sops -- -e --filename-override secrets/<nom>.yml --output secrets/<nom>.yml <plaintext>`. Éditer un fichier **existant** en place exige la clé privée (root uniquement).
- `secrets/*.yml`, one file per domain (`tower.yml`, `common.yml`, `anywhere.yml`, `zitadel.yml`, `gitea.yml`, ...), encrypted with `sops` + `age` keys.
- 4 keys in `.sops.yaml`: anywhere, tower, mac, deck. `common.yml` is decryptable by every machine; each profile sets `sops.defaultSopsFile` to its dedicated file.
- Creating a **new** secret only needs the public keys already in `.sops.yaml`: `nix run nixpkgs#sops -- -e --filename-override secrets/<name>.yml --output secrets/<name>.yml <plaintext>`. Editing an **existing** file in place requires the private key (root only).
## Services auto-hébergés (tower/laptop)
## Self-hosted services (tower/laptop)
Registre dans `services/default.nix`. Actifs sur tower :
Registry in `services/default.nix`. Active on tower:
- **Infra / réseau** : `newt` (tunnel Pangolin), `autossh`, `eternal-terminal`, `adguard`, `tor`, `wayvnc`, `cage-firefox`.
- **Comptes / auth** : `zitadel` (OIDC), `vaultwarden`.
- **Cloud / fichiers** : `nextcloud` (+ postgres), `gitea`.
- **Médias** : `jellyfin`, `navidrome`, `audiobookshelf`, `radarr`/`sonarr`/`readarr`/`prowlarr`/`flaresolverr`, `qbittorrent`/`rqbit`, `media` (dataset partagé `/srv/media`).
- **Passerelles Matrix** : `matrix` (Synapse), `matrix-whatsapp`, `matrix-signal`, `matrix-discord`, `matrix-meta`, `matrix-linkedin`.
- **Agent Hermes** : `hermes` (gateway + plugins), `hermes-webui`, `hermes-dashboard`, `hermes-pocket` (backend app mobile), `discord-bot`.
- **Serveurs MCP** (outils pour Hermes) : `nextcloud-mcp`, `amazon-mcp`, `firefox-mcp`, `zitadel-mcp`, `roku`, `codeberg-mcp`, `ibkr-mcp`, `meetup-mcp`, `gitea-mcp`, `arr-mcp`, `mcp-nixos`. `protonmail-mcp` est tower-only (importé directement depuis `flake.nix`, pas dans le registre).
- **Autres apps** : `jupyterhub`.
- **Désactivés dans le registre** (commentés, à réparer ou en attente) : `dnscrypt`, `minio`, `stalwart-mcp` (cargoHash), `gotify`, `kanidm`, `syncserver`, `matrix-telegram` (attend api_id/api_hash), `vaultwarden-mcp` (input manquant).
- **Infra / networking**: `newt` (Pangolin tunnel), `autossh`, `eternal-terminal`, `adguard`, `tor`, `wayvnc`, `cage-firefox`.
- **Accounts / auth**: `zitadel` (OIDC), `vaultwarden`.
- **Cloud / files**: `nextcloud` (+ postgres), `gitea`.
- **Media**: `jellyfin`, `navidrome`, `audiobookshelf`, `radarr`/`sonarr`/`readarr`/`prowlarr`/`flaresolverr`, `qbittorrent`/`rqbit`, `media` (shared `/srv/media` dataset).
- **Matrix bridges**: `matrix` (Synapse), `matrix-whatsapp`, `matrix-signal`, `matrix-discord`, `matrix-meta`, `matrix-linkedin`.
- **Hermes agent**: `hermes` (gateway + plugins), `hermes-webui`, `hermes-dashboard`, `hermes-pocket` (mobile app backend), `discord-bot`.
- **MCP servers** (tools for Hermes): `nextcloud-mcp`, `amazon-mcp`, `firefox-mcp`, `zitadel-mcp`, `roku`, `codeberg-mcp`, `ibkr-mcp`, `meetup-mcp`, `gitea-mcp`, `arr-mcp`, `mcp-nixos`. `protonmail-mcp` is tower-only (imported directly from `flake.nix`, not in the registry).
- **Other apps**: `jupyterhub`.
- **Disabled in the registry** (commented out, pending a fix or waiting on something): `dnscrypt`, `minio`, `stalwart-mcp` (cargoHash mismatch), `gotify`, `kanidm`, `syncserver`, `matrix-telegram` (waiting on api_id/api_hash), `vaultwarden-mcp` (missing input).
## Conventions
- Commentaires et messages de commit en français, format conventional commits (`feat(scope): ...`, `fix(scope): ...`, `chore(scope): ...`), groupés par thème logique (pas un commit par fichier touché).
- Un module est "activé" en étant ajouté à la liste d'imports de son registre (`services/default.nix`, `profiles/common/default.nix`, `users/marc/home.nix`, ...) ; commenté = désactivé mais gardé comme référence.
- `home-manager.users.marc` ne doit **jamais** être câblé dans un `nixosConfigurations` : le profil de marc reste en Home Manager standalone (`just home`), seul `root` passe par le module NixOS (`profiles/common`).
- Repo utilisé en écriture concurrente (plusieurs sessions/agents) : vérifier `git status` et l'absence d'un `nixos-rebuild` déjà en cours avant de lancer un switch.
- Comments and commit messages in French, conventional commits format (`feat(scope): ...`, `fix(scope): ...`, `chore(scope): ...`), grouped by logical theme (not one commit per touched file).
- A module is "enabled" by being added to its registry's import list (`services/default.nix`, `profiles/common/default.nix`, `users/marc/home.nix`, ...); commented out = disabled but kept as reference.
- `home-manager.users.marc` must **never** be wired into any `nixosConfigurations`: Marc's profile stays standalone Home Manager (`just home`), only `root` goes through the NixOS module (`profiles/common`).
- The repo is edited concurrently (multiple sessions/agents): check `git status` and that no `nixos-rebuild` is already running before triggering a switch.