❄️NixOS

• Layer 1. Every physical host runs NixOS, configured under nix/ and declared in flake.nix via a mkHost helper (nix/lib/mkHost.nix). See Fleet for the concrete machines.

• Layout

  • nix/hosts/<hostname>.nix — per-host entry points (the Pis, spore, oldboy); k8s nodes are defined directly in flake.nix with role/tags and pull in the k8s service modules

  • nix/hardware/ — hardware profiles (pi4, pi5, x86)

  • nix/services/ — optional service modules (k8s/, common.nix, kiosk.nix, iperf3.nix, …)

  • nix/system/ — core modules: SSH hardening, Tailscale, auto-upgrades, users, disko, chezmoi

  • nix/overlays/ — package patches and overrides

  • nix/images/ — buildable images: WSL tarball, ISO, GCE, container, netboot, and the pi5 RAM image

• Host groups

  • folly k8s nodes: optiplex (control-plane), riptide, shale

  • offsite k8s nodes: retrofit (control-plane), oldschool

  • Raspberry Pis: cloudpi4, homepi4, weatherpi4, dns, rackpi5 (diskless — see ADR/0008 Diskless netboot for rackpi5), spore (NFS/PXE server)

  • Cloud: oldboy (GCE)

• Deploying

  • Build without deploying:

  • nix build .#nixosConfigurations.<hostname>.config.system.build.toplevel

  • Deploy immediately:

  • nixos-rebuild switch --flake .#<hostname> --target-host <hostname> --sudo

  • Deploy safely (activates on next reboot):

  • nixos-rebuild boot --sudo --target-host <hostname> --flake .#<hostname>

  • Roll back on the host:

  • sudo nixos-rebuild switch --rollback

• Auto-upgrades keep git honest

  • Hosts auto-rebuild from GitHub main. A config deployed from a branch silently reverts on the next upgrade cycle unless the branch merges promptly. Treat nixos-rebuild from a branch as a test, not a deploy.

• Disk layout

  • Partitioning is declarative via disko with GPT partlabels (disk-main-*). Hosts installed before the migration need their partitions relabeled or they fail to boot — see ADR/0004 Disko with GPT partlabels and the scripts in nix/scripts/.

• Dotfiles

  • chezmoi-managed from the in-repo dotfiles/ tree; an activation script applies them from the store path on every rebuild/boot, no network clone. See ADR/0006 Dotfiles vendored in-repo with chezmoi.

Edit this page on GitHub