nixos

Bilingual

Migrating my NAS from CoreOS/Flatcar Linux to NixOS
2 months ago
- The author migrated his NAS from CoreOS/Flatcar to NixOS due to issues like deprecated cloud-init, container bitrot, dependency on Docker Hub, and inability to run Immich.
- He prototyped the migration in a VM before applying changes to the live system to ensure safety.
- Migration milestones included installing NixOS, setting up remote disk unlock, Samba access, and SSH/rsync backups.
- He gradually transitioned from Docker containers to native NixOS modules for services like Samba, Jellyfin, health checks, and backup scripts.
- NixOS provided benefits such as no central registry, finer-grained rollbacks, and a larger selection of easily configurable packages.
- Additional configurations included Prometheus monitoring, reliable mounting with systemd, and shared user settings across machines.
- He successfully installed Immich on NixOS, which was not possible on CoreOS/Flatcar, and recommends NixOS for managing multiple systems but considers it overkill for a single system.
Secret Management on NixOS with sops-nix
2 months ago
- The article explains the need for secret management in Linux systems when sharing configurations via Git, emphasizing encryption at rest to prevent unauthorized access.
- It introduces sops-nix as a tool for integrating sops (a secret encryption tool) with NixOS, using age for key management with existing SSH keys for convenience.
- The setup process includes obtaining age identities from SSH keys, configuring sops for the Git repository, managing encrypted secrets, and integrating with NixOS configuration.
- Examples demonstrate using decrypted secrets in systemd services via command-line flags, environment variable files, systemd credentials, and Samba passwords.
NixCon 2025 Trip Report 🐝
2 months ago
- The author attended NixCon 2025 in Rapperswil, Switzerland, at OST University of Applied Sciences.
- Friday included talks on Nix-based CI (cloud.devenv.sh), Hydra queue runner rewrite in Rust, Nix dev shells, and adoption stories from Shopify and ASML.
- Lightning talks on Friday covered Determinate Nix features, NixOS for friends/family, and systemd-sysupdate for A/B updates.
- Saturday featured workshops and talks on the official Nix formatter, NixOS integration tests, and when to use Nix vs. other config methods.
- Sunday was a hack day with collaborative project work and networking.
- The conference was well-organized with high-quality talks, custom break music, and Swiss chocolate gifts.
- Key takeaways include incremental Nix adoption strategies and the value of community-driven open-source events.
Coding Agent VMs on NixOS with microvm.nix
2 months ago
- The author describes creating ephemeral VMs with microvm.nix on NixOS to run coding agents like Claude Code safely, isolating them from personal files so the VM can be discarded if compromised.
- Step-by-step setup includes: configuring a network bridge (microbr) with NAT, adding microvm as a Nix flake input, declaring VMs in microvm.nix, using a base configuration for shared directories, SSH keys, an 8GB disk overlay, and cloud-hypervisor with 8 vCPUs and 4GB RAM.
- The author shows how Claude Code can automate VM creation using a skill, and notes that this setup's maintenance is minimal as it updates with the host NixOS config.
Using the Brother DS-640 Scanner on NixOS
2 months ago
- The Brother DS-640 is a compact USB scanner that requires proprietary drivers to work on NixOS.
- Enable SANE scanners and add your user to the scanner and lp groups in the NixOS configuration.
- Use the brscan5 driver (not brscan4) to avoid partial page scans.
- For a graphical interface, install simple-scan via Home Manager.
- Verify the scanner with `scanimage --list-devices`; if it shows 'Unknown USB scanner', try a different USB port.
- Test scanning with `scanimage --device="brother5:bus4;dev2" --format=jpeg --output-file=scan.jpg`.
- Improve scan quality using options like --AutoDeskew=yes, --AutoDocumentSize=yes, and --resolution 300.
TIL: Symlinking NixOS Dotfiles
2 months ago
- The author avoids home-manager for dotfile management due to aesthetic and practical objections: dependency management complexity, single-user package preference, and need to rebuild system for config changes.
- The author prefers storing dotfiles in the same repository as flake.nix and symlinking them in place.
- NixOS does not natively support declaring symlinks for home directories (e.g., ~/.config), but systemd-tmpfiles can be used declaratively via NixOS configuration.
- The author contrasts this approach with manual symlinking or using tools like GNU Stow, noting the roundabout method using systemd-tmpfiles.
Almost Went Back: One Month on NixOS
2 months ago
- The author considered switching back to Arch after four weeks on NixOS due to missing the direct, imperative system interaction and feeling distanced from Linux knowledge.
- After posting on the NixOS Discord, community responses highlighted that NixOS offers reproducibility, rollbacks, and finite control, which matched the author's frustrations with Arch breaking.
- Existing Linux knowledge transfers to NixOS in substance (understanding how systems work) but not in familiarity with file locations, making an Arch background helpful rather than irrelevant.
- Trying to configure everything 'the Nix way' led to overcomplexity; the author learned it's fine to use native config formats via symlinks and only control system-level aspects with Nix.
- The declarative model simplifies maintenance, prevents losing configurations, and reduces anxiety about updates, though it initially felt unfamiliar.
- The author ultimately finds NixOS worth committing to, recommending community support and noting the learning curve is real but surmountable.
- Recommended resources include Vimjoyer, NixOS Discord, Nix Pills, and LLMs for troubleshooting.
NixOS is more complicated than you think but OpenCode fixed it
2 months ago
- NixOS setup using LabWC (Wayland compositor) and Noctalia Shell V5 from Cachix, achieving a lean desktop with 743 MB RAM and 48 active tasks at boot.
- AI configuration assistance provided by opencode and DeepSeek V4 Flash model.
- LabWC requires manual configuration of services like DBus, Polkit, and Clipman; greetd does not fully manage environment variables.
- User configs stored in ~/.config/ for portability, with symlinks managed via rebuild hook (no Home-Manager).
- Hybrid package management combines Nix packages with npm-installed apps like opencode2.
- Custom patches needed for Snapshot (webcam app) despite being in nixpkgs.
- Notable services include greetd, vox-type, podman, cockpit, kshi, clipman, satty, scrcpy, smartmontools, LocalSend, KDE Connect, and Traefik.
- Lessons learned: LabWC is not a full desktop environment; 4 GB+ RAM recommended for NixOS rebuilds; swap file helpful on low-RAM machines.
Secrets Don't Belong in Config
2 months ago
- Secrets (passwords, API keys, tokens) should not be stored in application configuration files because configuration and secrets have different lifecycles and access requirements.
- A quarter of NixOS modules (110 out of 445) safely retrieve secrets but then merge them into configuration at runtime, creating security-sensitive workarounds like envsubst or custom scripts.
- Mixing secrets with configuration in a single file complicates rotation, access control, and code sharing, as seen in Cachix where cache configuration and credentials were combined.
- Applications should accept secrets through dedicated runtime channels such as password_file settings, systemd credentials, scoped environment variables, or external secret providers.
- SecretSpec is a proposed solution that separates secret declarations (secretspec.toml) from their actual values, allowing providers like system keyring or cloud services to resolve them per environment.
- The goal is to have consistent secret handling across development, CI, and production without requiring organizations to build their own secrets platform.

nixos

Migrating my NAS from CoreOS/Flatcar Linux to NixOS

Secret Management on NixOS with sops-nix

NixCon 2025 Trip Report 🐝

Coding Agent VMs on NixOS with microvm.nix

Using the Brother DS-640 Scanner on NixOS

TIL: Symlinking NixOS Dotfiles

Almost Went Back: One Month on NixOS

NixOS is more complicated than you think but OpenCode fixed it

Secrets Don't Belong in Config