darch

Personal Nix configuration — one flake covering both a NixOS system and standalone home-manager for the machines that aren't NixOS.

Flake outputs

# NixOS system (the darch desktop, ex-Garuda):
sudo nixos-rebuild switch --flake .#darch

# NixOS system (the trumbeak home server — builds on the node, not here):
make server-switch                       # rsync repo → /etc/nixos + rebuild #trumbeak

# Standalone home-manager (non-NixOS machines):
home-manager switch --flake .#$USER   # or: make switch

# Custom packages:
nix build .#avito .#dbaasctl .#claude-usage   # avito/dbaasctl need corp VPN

• nixosConfigurations.darch — x86_64-linux, built via garuda.lib.garudaSystem. aken's home is managed by the system through home/aken.nix.
• nixosConfigurations.trumbeak — x86_64-linux home server (single-node Kubernetes), built against the nixpkgs-server input (nixos-26.05). See the Server section below.
• homeConfigurations.nvzhiga — aarch64-darwin (this Mac; corp VPN → avito/dbaasctl included).
• homeConfigurations.aken — x86_64-linux, for a non-NixOS Linux box (corp CLIs excluded). Do not home-manager switch .#aken on the NixOS darch host — there the system already manages aken's home.
• packages.* — avito, dbaasctl, dbaasctl-cli, dbaasctl-py, claude-usage.

Layout

• flake.nix — inputs: nixpkgs, nixpkgs-server (nixos-26.05, for trumbeak), garuda, nixos-hardware, home-manager, sops-nix, plus private avito-cli / dbaasctl-cli sources.
• hosts/darch/ — NixOS system config + hardware for the darch desktop.
• hosts/trumbeak/ — NixOS system config + hardware + package overlay for the trumbeak home server.
• server/ — Kubernetes workloads that run on trumbeak (raw manifests under apps/, helm values under helm/, monitoring/, and helmfile.yaml). See server/README.md.
• home/aken.nix — aken's home for the NixOS host (imported by the system; gaming/GUI apps, emacs-pgtk).
• home/common.nix — shared standalone-home identity + module imports (per-user home dir injected by mkHome).
• modules/*.nix — shell, terminal, git, editors, packages, nushell, firefox, scripts. packages.nix gates the corp CLIs behind a corp flag.
• files/ — raw configs not expressed as module options, referenced via home.file / readFile (zsh, tmux, wezterm, doom, vscode, nushell, firefox, XCompose, ~/.bin scripts, …).
• pkgs/ — custom-built packages (avito, dbaasctl, claude-usage, …).

Secrets

sops-nix: encrypted secrets/secrets.yaml (age), decrypted only at activation into runtime paths (config.sops.secrets.*.path / sops.templates). The age private key (~/.config/sops/age/keys.txt) is never committed — see secrets/README.md for bootstrap. Never put plaintext secrets in the flake; the Nix store is world-readable.

Make targets

Target	Action
make switch	Apply the home-manager config for $USER (bootstraps via nix run on first switch).
make test	Alias of make check — nix build of the activation package.
make check	Build the activation package without applying (dry verification).
make server-switch	rsync the repo to /etc/nixos on trumbeak and nixos-rebuild switch --flake …#trumbeak.
make server-test	Same, but nixos-rebuild test (activate without setting the boot default).
make server-update	Bump flake.lock on the server and copy it back here to commit.

A full nix build needs the corp VPN for the private avito-cli / dbaasctl-cli sources.

Server (trumbeak)

trumbeak (192.168.2.3) is a bare-metal NixOS home server running a single-node Kubernetes cluster (both master and node roles, Cilium CNI). Two concerns live in the repo:

1. Host config — hosts/trumbeak/ (configuration.nix, hardware-configuration.nix, overlay.nix), wired into the root flake as nixosConfigurations.trumbeak. It builds against the nixpkgs-server input (nixos-26.05), independent of the desktop's unstable channel.
2. Workloads — server/ holds the raw Kubernetes manifests (apps/, monitoring/) and Helm value files (helm/, pinned in helmfile.yaml).

The Mac can't build the Linux closure, so the node builds itself: make server-switch rsyncs the whole repo to /etc/nixos (the flake root is the repo root — trumbeak references ../../pkgs and the root flake.nix) and runs nixos-rebuild switch --flake /etc/nixos#trumbeak there. Override the target with make server-switch SERVER_HOST=aken@192.168.2.3. Applying the k8s workloads is separate (kubectl apply / helmfile apply) — see server/README.md.

Linting

Trunk is the meta-linter (.trunk/trunk.yaml) — run trunk check / trunk fmt. Enabled linters include yamllint, markdownlint, prettier, taplo, and security/secret scanners (checkov, trivy, trufflehog). Keep credentials in Bitwarden/Vault, not files.

Why not the alternatives

• Puppet — overkill for daily home usage; certs and secure setup make sense for large fleets, not a small home environment.
• chezmoi — home-manager gives reproducible packages + config in one declarative tree.

For non-NixOS machines (this Mac, other Linux boxes) Nix stays at the user scope via home-manager; the darch desktop goes all-in with NixOS.