NixOS, nix-darwin & Home Manager Configurations

Personal Nix configurations for Linux and macOS hosts, built as a single flake.

Overview

This repository contains:

• NixOS system definitions for a desktop machine and a WSL machine
• a nix-darwin system definition for one macOS host
• shared modules for core settings, desktop features, services, and user programs
• secrets management with sops-nix

Supported platforms are x86_64-linux and aarch64-darwin.

Standalone homeConfigurations outputs are currently kept only for compatibility; active Home Manager setups are integrated into the NixOS and nix-darwin hosts defined in this flake.

Input Strategy

• Linux system and Home Manager targets use nixpkgs with home-manager
• macOS system and Home Manager targets use nixpkgs-darwin with home-manager-darwin
• nix-darwin tracks master together with nixpkgs-darwin on nixpkgs-unstable

Hosts

nixosConfigurations

• sunflower: WSL-based NixOS host, also acts as a remote build target
• dahlia: personal NixOS laptop with Hyprland; disko-managed LUKS + btrfs root with TPM2 auto-unlock

darwinConfigurations

• hydrangea: personal macOS machine

At a glance

Host	Platform	Role
sunflower	NixOS / WSL	personal Linux-on-WSL environment, remote build target
dahlia	NixOS	personal laptop with Hyprland, LUKS+btrfs via disko
hydrangea	nix-darwin	personal macOS machine

Work-related hosts (work_mac, work_vm) live in the private tnmt-work-flake repository, which consumes this flake via mynix.lib.

Repository Layout

.
├── flake.nix              # Flake inputs, outputs, devShell, formatter, helper app
├── lib/                   # Reusable host/HM builders, exposed as `mynix.lib`
├── hosts/                 # Concrete host entrypoints
├── home-manager/          # Reusable Home Manager modules
├── modules/               # Reusable NixOS and cross-host modules
├── profiles/              # Role-based profiles (common, nixos, home-manager, darwin)
├── secrets/               # sops-encrypted secret files
├── themes/                # Shared theme definitions
└── treefmt.toml           # Formatter configuration

The important split is:

• hosts/ selects a machine and wires modules together
• modules/ holds lower-level reusable system pieces
• home-manager/ holds reusable user-level pieces
• profiles/ bundles opinionated groups of modules per layer (common, nixos, home-manager, darwin)
• lib/ exposes the host builders (mkNixosSystem, mkDarwinSystem, mkHomeManagerConfiguration, …) reused by downstream flakes such as tnmt-work-flake

Notable Features

• Hyprland desktop setup with Waybar, Walker, Mako, Hyprlock, Hypridle, Wlogout, and hyprdynamicmonitors (config generated as Lua for Hyprland 0.55+)
• greetd + tuigreet login flow for the Linux desktop profile
• disko + LUKS + btrfs + TPM2 auto-unlock for the dahlia laptop; wayvnc for remote access to its running Hyprland session
• NetBird mesh VPN enrolment via mynix.profiles.netbird on NixOS hosts (replaced Tailscale)
• mynix.services.shizuku local memory server, sourced from a private shizuku flake input and enabled on dahlia and hydrangea
• sops-nix secrets unified at the system layer; host SSH key decryption is the default for every host
• Input remapping with kanata (Linux) and Karabiner-Elements (macOS)
• Shared Tokyo Night Storm theme wiring
• Custom packages pulled directly from the nur-tnmt input via overlay (no NUR aggregator)
• Declarative Homebrew casks and Mac App Store apps (masApps) on the darwin host

Usage

Prerequisites

Before switching a host, make sure the target machine has:

• Nix with flakes enabled
• nh available if you want to use the recommended commands below
• an SSH host key registered in .sops.yaml so sops-nix can decrypt secrets at activation time
• SSH access to the private shizuku repository, since it is a git+ssh flake input (CI swaps it for a stub via --override-input)

Switch (auto-detect)

nix run .#switch reads the current hostname and dispatches to the matching nh os / nh darwin command, so you don't need to remember the platform or host flag.

# Rebuild & activate the current host
nix run .#switch

# Pass extra args through to nh (after `--`)
nix run .#switch -- --dry
nix run .#switch -- -H sunflower

NixOS

# Recommended
nh os switch . -H dahlia

# Directly
sudo nixos-rebuild switch --flake .#dahlia

nix-darwin

# Recommended; also activates the matching Home Manager user.
nh darwin switch . -H hydrangea

# Directly
darwin-rebuild switch --flake .#hydrangea

Development helpers

# Enter the dev shell
nix develop

# Format Nix and TOML files
nix fmt

# Update a flake input (from the dev shell)
update-input nixpkgs github:NixOS/nixpkgs/nixos-unstable

# Run the desktop VM for dahlia
nix run .#dahlia-vm

For local development, enable the repo's git hooks once:

git config core.hooksPath .githooks

The pre-commit hook formats staged files with nix fmt, lints with deadnix / statix, and scans staged changes with gitleaks protect.

Secrets

This repo expects sops-nix with the host's SSH host key available for decryption (derived to age via ssh-to-age); each host's public key is registered in .sops.yaml.

• host/system-specific secrets live in secrets/hosts/<hostname>.yaml
• Home Manager identity secrets use secrets/roles/personal.yaml by default
• shared Home Manager values, such as service endpoints or API keys, live in secrets/common.yaml
• application-specific secrets live under secrets/apps/<app>/
• both system and Home Manager secrets are wired through the system-layer sops-nix module

Builds may evaluate without secrets in some cases, but activation on real machines assumes the corresponding host SSH key exists.

CI

GitHub Actions currently checks:

• formatting via nix fmt
• lint via deadnix and statix
• secret scan via gitleaks over the full history
• NixOS builds for sunflower and dahlia
• darwin evaluation for hydrangea (evaluates the full system on a Linux runner to catch option/module errors; actual builds require a macOS runner)

CI runners have no SSH key for the private shizuku input, so builds and evals override it with a stub flake under .github/ci-stubs/.

License

Personal configuration files. Reuse with care.