My Systems Flake

This flake contains the system topology of my main desktops and RaspberryPIs.

Installation (Desktop)

Disk Partitioning

nix develop .#first-install --extra-experimental-features "nix-command flakes"
sudo disko --mode destroy,format,mount --flake .#<system>

While formatting you will be asked for a password which is used for disk encryption with LUKS. Make sure you have the correct keyboard layout set.

[Optional] Generate Hardware Configuration (for new Systems)

sudo nixos-generate-config --no-filesystems --root /mnt

Integrate into existing config.

Install from Flake

sudo nixos-install --no-root-password --root /mnt --flake .#<system>

Imperative configuration steps

Tailscale

Create a new headscale user (Server)

sudo headscale users create <USER>

Add a machine with a preauthkey (Server and Client)

• Generate the preauthkey on the server: sudo headscale preauthkeys create -e 1h -u <USER>
• Use the key to connect a client sudo tailscale up --login-server <SERVER_URL> --authkey <KEY> --accept-routes

Add an Android Phone

• Download the Tailscale app from F-Droid.
• Click on the upper-right 3-dots menu several time until the option Change server appears.
• Click on Change server and enter the full url.
• Click Save.
• Click Sign in. This will open a browser and give a command like this: sudo headscale nodes register --user USERNAME --key nodekey:<KEY>
• Replace USERNAME with the right username and enter it on the server.

Configure a subnet route

On NixOS add

{
  services.tailscale.useRoutingFeatures = "server";
}

to the node that offers the subnet route and add

{
  services.tailscale.useRoutingFeatures = "client";
}

to the nodes that want to use the subnet routes.

On the node offering the subnet routes do

• sudo tailscale set --advertise-routes 10.0.0.0/24
• Check that the route exists with sudo headscale routes list
• Then do sudo headscale routes enable -r <ID>
• On the other nodes enable the routes with sudo tailscale set --accept-routes

On the Tailscale Android app the routing should work automatically.

Now all traffic should flow normally except for calls to the specified subnet, which get tunneled through the node offering itself as the server.

Keys

On the hombase pi add the gandi API key to /home/kristian/.keys/gandi.

Desktop PC

Available configurations are:

• pc
• laptop

Build with

sudo nixos-rebuild switch --flake .#[configuration]

After first deployment it suffices to do nrs for sudo nixos-rebuild switch ... or nrb for sudo nixos-rebuild boot .... This relies on the flake being saved to /etc/nixos.

GPU Fan Control

Enable

By default, Nvidia GPUs manage the fan speed with the firmware. To change this setting to allow this script to control your fan speed, use the below command. Do not forget to revert this command if disabling this fan control script.

sudo nvidia-settings -a gpufancontrolstate=1

Disable

Pausing or disabling the script will leave the GPU fans spinning at the last set speed. Automatic fan control will be disabled. To re-enable fan control after pausing or disabling the service, set:

sudo nvidia-settings -a gpufancontrolstate=0

Laptop

My laptop is a Thinkpad X1 Carbon Gen7 and thus needs an extra module from nixos-hardware. The rest is similar to my desktop:

Build with sudo nixos-rebuild switch --flake .#laptop

After first deployment it suffices to do nrs for sudo nixos-rebuild switch ... or nrb for sudo nixos-rebuild boot ....

Fingerprint

Use fprintd-enroll to register your fingerprint.

VPS

These are my configuration for my VPSs hosted on GandiCloud, as they a are very NixOS friendly.

Webmail

Use this guide

DNS

set the following DNS record:

mail 10800 IN A 1.2.3.4
mail 10800 IN AAAA ::1

@ 10800 IN MX 10 mail.example.com.

@ 10800 IN TXT "v=spf1 a:mail.example.com -all"
_dmarc 10800 IN TXT "v=DMARC1; p=none"

mail._domainkey 10800 IN TXT "v=DKIM1; p=<public-key>

where you replace example.com with your domain and 1.2.3.4 with your IPv4 and ::1 is your IPv6. <public-key> can be found by doing cat /var/dkim/example.com.mail.txt. This will result in an output looking like this:

mail._domainkey IN TXT "v=DKIM1; k=rsa; s=email; p=<public-key>" ; ----- DKIM mail for domain.tld

Additionally you can also set these DNS records to enable Autodiscovery:

_submission._tcp 3600 IN SRV 5 0 587 mail.example.com.
_submissions._tcp 3600 IN SRV 5 0 465 mail.example.com.
_imap._tcp 3600 IN SRV 5 0 143 mail.example.com.
_imaps._tcp 3600 IN SRV 5 0 993 mail.example.com.

rDNS

and also add mail.exampl.com to rDNS by going to Left Side Panel > GANDICLOUD VPS > IP Addresses > 3-dot menu > Edit rDNS.

Hash user login passwords

Create the password for the corresponding mail accounts.

nix shell nixpkgs#mkpasswd -c mkpasswd -m bcrypt

Set the result as mailserver.loginAccounts.<user>.hashedPassword in the mailserver config.

mkpasswd is also available in the shell by running nix develop or using direnv.

Deployment

When using direnv change into this directory and do

deploy

If not using direnv do:

nix develop
deploy

Raspberry PI

Due to the limited hardware of the RaspberryPIs it is recommended to build the configurations on your current system by emulating. On NixOS systems other than aarch-64-linux add this to your configuration:

{
  boot.binfmt.emulatedSystems = ["aarch64-linux"];
}

On other systems you will have to figure this out yourself.

To build an image run:

Homebase

Available images are:

• homebase-minimal A minimal working system that has only a ssh connection configured.
• homebase-full A fully configured reverse proxy, add blocker, vpn, uptime checker and dyn-dns for my home system.

An image can be built by doing:

nix build .#images.[image-name]

This homebase-full configurations can also be deployed remotely with:

nix shell nixpkgs#deploy-rs
deploy .#homebase

Flashing

After building the image uncompress it with:

nix shell nixpkgs#zstd -c unzstd -o nixos-raspberrypi.img ./result/sd-image/*.img.zst

Then flash the resulting image onto a device with:

sudo dd if=nixos-raspberrypi.img of=/path/to/device status=progress

After flashing resize the NIXOS_SD partition to use the whole size of the disk with a tool like gnome disks.

Cleanup

Delete nixos-raspberrypi.img with:

rm nixos-raspberrypi.img

The resulting image will be saved in the nix store and symlinked to the result directory. Therefore to cleanup the file unlink the directory with:

unlink result

After that run:

nix store gc

to remove the image and its dependencies from the nix store.

GPG

Transfer a Key

On the old machine

gpg --export-secret-keys <KEY> > key.gpg

On new machine

gpg --import key.gpg

Set the trust level of the new key

gpg --edit-key <KEY> trust
  # enter 5<RETURN> (I trust ultimately)
  # enter y<RETURN> (Really set this key to ultimate trust - Yes)

References

This repo has be inspired by and used code from:

• Matthew Croughan's Example
• NixOS: On Raspberry Pi 3B