nixos

Marc Partensky's NixOS + Home Manager + nix-darwin configuration, one flake for every machine: tower, laptop, deck, the anywhere VPS, the Mac, and the phone (nix-on-droid).

Machines

Flake output	Type	Description
nixosConfigurations.tower	NixOS	Main machine (AMD, ZFS). profiles/common + profiles/tower + services/ (all self-hosted services).
nixosConfigurations.laptop	NixOS	Laptop. profiles/common + profiles/laptop + services/.
nixosConfigurations.deck	NixOS	Steam Deck (via Jovian-NixOS). profiles/deck only, no services/.
nixosConfigurations.anywhere	NixOS	VPS (RackNerd): Pangolin, Traefik/Caddy, Stalwart mail, headscale. profiles/anywhere.
nixosConfigurations.laptop-iso / deck-iso	NixOS	Installer images (disko + hardware-configuration bundled).
nixosConfigurations.dev	NixOS (microvm)	Disposable dev VM, see vms/. Launched with just vm.
homeConfigurations.marc	Home Manager standalone	Marc's Linux profile (tower/laptop), not wired into any nixosConfigurations — managed independently.
homeConfigurations."marc@macos"	Home Manager	HM profile on the Mac (on top of nix-darwin).
homeConfigurations."marc@deck"	Home Manager	HM profile on the Deck.
darwinConfigurations.macos	nix-darwin	The Mac's system config.
nixOnDroidConfigurations.default	nix-on-droid	Android phone.

nixpkgs = nixos-26.05 (+ unstable for packages missing from 26.05, nixpkgs-darwin/nix-darwin-26.05 for the Mac).

Repo layout

flake.nix              every nixosConfigurations / homeConfigurations / darwinConfigurations
Justfile + .env        common commands (default HOST, HM, RUN)
profiles/<host>/       per-machine composition (imports, firewall, hostName, sops file)
  common/               base shared by tower+laptop (users, nixos modules, home-manager.users.root)
hosts/<name>/          disko.nix + hardware-configuration.nix per machine
modules/
  nixos/<name>/         unit NixOS modules (enabled = imported in profiles/common or profiles/<host>)
  home/<name>/           Home Manager modules (Linux), imported by users/marc/home.nix
  home-mac/<name>/       Mac-specific Home Manager modules
users/
  marc/                  home.nix + packages.nix (standalone profile, `just home`)
  root/                  home.nix wired via profiles/common (only HM profile inside nixosConfigurations)
  mac/, deck/            HM profiles for the other machines
services/<name>/       self-hosted services (one folder per service), registry = services/default.nix
  hermes/plugins/        Nix-managed plugins for the Hermes gateway
secrets/*.yml           sops-age encrypted secrets (see below)
vms/                    microvm.nix definitions for dev VMs

services/ is only imported by laptop and tower (see flake.nix): deck and anywhere don't have this registry.

Commands (Justfile)

.env sets the defaults: HOST=tower, HM=marc, RUN=nixos.

Command	Effect
just	just nixos (via RUN)
just nixos	sudo nixos-rebuild switch --impure --flake .#$HOST
just home	home-manager switch --flake .#$HM (run as marc, not hermes)
just mac	nix-darwin switch --flake .#macos
just droid	nix-on-droid switch --flake ~/.config/nixos#default
just vm [name=dev]	build + launch a dev microvm (state in ~/.local/state/microvms/<name>/)
just vm-build [name=dev]	build only, don't launch
just iso	ISO image for $HOST-iso
just install	disko + nixos-install (new machine)
just ventoy <disk> [size]	Ventoy USB stick + Nix installer

Updating inputs: nix flake update before a rebuild (--upgrade has no effect on a flake, don't use it).

Eval check without building: nix eval .#nixosConfigurations.$HOST.config.system.build.toplevel.drvPath --impure.

Secrets (sops-nix)

• secrets/*.yml, one file per domain (tower.yml, common.yml, anywhere.yml, zitadel.yml, gitea.yml, ...), encrypted with sops + age keys.
• 4 keys in .sops.yaml: anywhere, tower, mac, deck. common.yml is decryptable by every machine; each profile sets sops.defaultSopsFile to its dedicated file.
• Creating a new secret only needs the public keys already in .sops.yaml: nix run nixpkgs#sops -- -e --filename-override secrets/<name>.yml --output secrets/<name>.yml <plaintext>. Editing an existing file in place requires the private key (root only).

Self-hosted services (tower/laptop)

Registry in services/default.nix. Active on tower:

• Infra / networking: newt (Pangolin tunnel), autossh, eternal-terminal, adguard, tor, wayvnc, cage-firefox.
• Accounts / auth: zitadel (OIDC), vaultwarden.
• Cloud / files: nextcloud (+ postgres), gitea.
• Media: jellyfin, navidrome, audiobookshelf, radarr/sonarr/readarr/prowlarr/flaresolverr, qbittorrent/rqbit, media (shared /srv/media dataset).
• Matrix bridges: matrix (Synapse), matrix-whatsapp, matrix-signal, matrix-discord, matrix-meta, matrix-linkedin.
• Hermes agent: hermes (gateway + plugins), hermes-webui, hermes-dashboard, hermes-pocket (mobile app backend), discord-bot.
• MCP servers (tools for Hermes): nextcloud-mcp, amazon-mcp, firefox-mcp, zitadel-mcp, roku, codeberg-mcp, ibkr-mcp, meetup-mcp, gitea-mcp, arr-mcp, mcp-nixos.
• Other apps: jupyterhub.
• Disabled in the registry (commented out, pending a fix or waiting on something): dnscrypt, minio, stalwart-mcp (cargoHash mismatch), gotify, kanidm, syncserver, matrix-telegram (waiting on api_id/api_hash), vaultwarden-mcp (missing input).

Conventions

• Comments and commit messages in French, conventional commits format (feat(scope): ..., fix(scope): ..., chore(scope): ...), grouped by logical theme (not one commit per touched file).
• A module is "enabled" by being added to its registry's import list (services/default.nix, profiles/common/default.nix, users/marc/home.nix, ...); commented out = disabled but kept as reference.
• home-manager.users.marc must never be wired into any nixosConfigurations: Marc's profile stays standalone Home Manager (just home), only root goes through the NixOS module (profiles/common).
• The repo is edited concurrently (multiple sessions/agents): check git status and that no nixos-rebuild is already running before triggering a switch.