Universal NixOS configuration

Shared NixOS and Home Manager policy lives in this repository. Machine-specific hardware, users, feature selections, identities, and credentials are generated under local/ and are intentionally not committed.

Bootstrap

Copy examples/bootstrap.json, edit the host, user, and profile values, then run this from the repository root on the target NixOS machine:

nix run "path:$PWD#bootstrap" -- --input ./bootstrap.json
bash tools/rebuild switch <host-name>

For an already-running machine, the JSON value users: "auto" can detect the current non-system user, home directory, and shell. It never reads or copies a password hash. Git identity and feature-specific settings should still be specified in the input file.

If running directly from an existing Btrfs installation causes nixos-generate-config --root / to fail while retrieving subvolume metadata, reuse a known-valid hardware file with --hardware-file. For a new machine, prefer booting the installer and generating hardware from its mounted target root instead.

When running from an installer as root, users: "auto" reads the mounted target's /etc/passwd when --hardware-root /mnt is used. Override the source with --user-root if the target and hardware roots differ. If several regular users are found, list them explicitly.

Use --dry-run to inspect generated changes without writing them. name, hostname, and system may be "auto". Hardware is collected from the mounted installation root with nixos-generate-config --root /mnt --show-hardware-config; use --hardware-root when the target is mounted elsewhere.

The host builder accepts any NixOS Linux system supported by the selected nixpkgs revision; bootstrap auto-detects common x86_64, aarch64, ARMv7, i686, and RISC-V systems and accepts an explicit system for other architectures. Profiles are opt-in: dns requires networking, doh requires dns, amnezia requires doh, and netbird requires dns. The yubikey profile requires an explicit U2F mapping. Bootstrap never enrolls keys or copies private configuration files.

The docker profile enables the Docker daemon. Add docker to a user's extraGroups in the local manifest to allow that user to manage containers.

Rebuild

The helper evaluates the selected local overlay with --impure and exposes it as a host-named flake output:

bash tools/rebuild switch <host-name>
bash tools/rebuild boot <host-name>

Bootstrap can also activate the generated configuration without changing the bootloader. On the running system use --apply test; from an installer, use --apply test --target-root /mnt after placing the repository under /mnt:

nix run "path:$PWD#bootstrap" -- \
  --input ./local/elgrush_laptop-bootstrap.json \
  --apply test