NixOS (Lix) dotfiles

My declarative, reproducible NixOS system built using Lix. My configuration is designed to support the following:

• Multiple hosts, including a MacBook (mine has a M2 Max chip) and a Mac Mini ;
• Multiple users, some of whom are reused across different hosts ;
• Variants of users ;
• A beautiful KDE Plasma desktop with theme Nord applied everywhere ;
• LibreWolf which I spent some time hardening ;
• My Emacs config including OpenCode.el ;
• Shell synchronisation via atuin ;
• LUKS encryption via disko ;
• Secrets management with sops ;
• YubiKey support.

I've aimed for a balance between readability and completeness.

Installation

Please follow my installation instructions in INSTALL.md.

If you set up a new machine you should probably generate a new SSH key pair. Put your keys in /home/thomas/.ssh/ once you're logged in in your new machine. Don't forget to set up a new password for your user using passwd.

Put your age keys here:

vim /home/thomas/.config/sops/age/keys.txt

Now you are ready to clone this configuration. Update my user thomas with yours. Once you are ready, rebuild the system:

nixos-rebuild switch --flake .#host --sudo

# Or, better
nh os switch . -H host

To rebuild a remote system locally, and deploy it:

nixos-rebuild switch --flake .#golmotte --target-host ssh-ng://thomas@golmotte --sudo

# Or, better
nh os switch . -H golmotte --target-host ssh-ng://thomas@golmotte

If you run out of memory, add parameters --cores x and --max-jobs x to the build command.

Available hosts

This configuration supports multiple hosts as documented in hosts/README.md.

Manual configuration

Some packages require manual configuration.

Atuin

If you imported age keys, just login to retrieve your shell history:

atuin login
atuin sync

Obsidian

Just open Obsidian, login and sync everything including community plugins and settings (Active community plugin list and Installed community plugins options). Wait for the end of the synchronization, and restart the app.

OpenCode

If running OpenCode from outside Emacs, use the following command to connect to the local server:

opencode attach http://localhost:4096

Tailscale

Connect your machine to your Tailscale network and authenticate in your browser:

sudo tailscale up

In Dolphin (or somewhere else), use smb://user@ip to connect to a remote SMB share.

Printers

You can add a printer from the KDE settings > Define a connection to a printer > PDD file (you should see something like canonts3500.ppd).

Useful commands

Optimize the Nix store by hard linking duplicate binaries. This shouldn't be needed with my current dotfiles though, as optimizations are performed automatically at build time.

nix-store --optimise

The Nix store accumulates entries which are no longer useful. They can be deleted:

nix-store --gc

Delete all generations older than a specific period (e.g. 30 days):

nix-collect-garbage --delete-older-than 30d

These commands are run altogether when using:

nh clean all --keep-since 30d

Future work

Limitations:

• (localsend) Fonts are not rendering under Asahi Linux localsend/localsend#2873. A temporary overlay fixes this issue.
• (dns4eu) I should find a way to enable DNSOverTLS with DNS4EU.
• (librewolf) privacy.resistFingerprinting = true prevents media upload and Leboncoin login from working.
• (vscodium) VSCodium 1.126 ignores ELECTRON_RUN_AS_NODE, so the marimo extension's bundled WASM language server (spawned via Electron-as-Node) never starts and crashes in a -32097 loop. Workaround in users/thomas/vscode.nix: run the extension's wasmServer.js with Nixpkgs' Node (marimo.lsp.server = "custom"). Once VSCodium honors the variable again — check with ELECTRON_RUN_AS_NODE=1 codium --version, which should print a Node version — remove the workaround.

These are not fully integrated yet:

• SDDM doesn't offer a keyboard layout selection, which is very annoying for non-US keyboard users. SDDM should be incubated into Plasma at some point.

Some resources I found useful

• Introduction to Nix and NixOS by Wil T
• I got some inspiration from geraldwuhoo
• NixOS Secrets Management by EmergentMind
• Flakes + Home Manager Multiuser/Multihost Configuration by Chris McDonough
• NixOS on Apple Silicon by sef
• Moving the store