configurations of hq services
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Astro 41c9658b9a glotzbert: remove obsolete wakeonlan configure 10 hours ago
ansible set beats version 7 months ago
doc README: update list-upgradable documentation 3 months ago
hosts glotzbert: remove obsolete wakeonlan configure 10 hours ago
kubernetes update deployer 2 years ago
lib lib/stats: moar collectd workarounds 4 weeks ago
overlay radiobert: switch from wiedehopf/readsb back to Mictronics/readsb-protobuf 3 weeks ago
proxmox proxmox/ prepare the nixos 3 months ago
.gitignore Add "result" to .gitignore 2 years ago glotzbert: mount new cephfs with keyfile from sops-nix 4 weeks ago
flake.lock flake.lock: update heliwatch 10 hours ago
flake.nix flake.nix: update nixpkgs from release-21.05 to release-21.11 4 days ago
host-registry.nix storage-ng: begin flakification 4 weeks ago
hq.nixops dhcp: remove 6 months ago pulsebert: add home-manager home.nix 3 years ago add 3 years ago


Install Nix Flakes

A Nix environment with Nix Flakes support is required.

(temporary) Shell with Nix Flakes

Set up an environment (with the common command nix-shell) in which the package nixFlakes (for Nix Flakes) is available and jump into it

nix-shell --packages nixFlakes

Nix Flakes ist gegenwärtig bei Nix (Version 20.09) noch keine standardmäßige Funktionalität für Nix. Die Bereitstellung der Kommandos für Nix Flakes müssen als experimentelle Funktionalität für das Kommando ''nix'' festgelegt werden, um sie verfügbar zu machen.

Set some configuration (do this only once)

echo 'experimental-features = nix-command flakes' >> ~/.config/nix/nix.conf

Add this repository to your local flake registry:

nix registry add c3d2 git+

(permanent) System with Nix Flakes

set this to your NixOS configuration:

{ pkgs, ... }: {
  nix = {
    package = pkgs.nixFlakes;
    extraOptions = "experimental-features = nix-command flakes";

And add this repository to your local flake registry:

nix registry add c3d2 git+


Beide failen bei Activation des neuen Profils. (TODO)

Mit Flakes

Local deployment

Running nixos-rebuild --flake c3d2 switch on a machine should be sufficient to update that machine to the current configuration and Nixpkgs revision.

Remote deployment

Use nix run with one of the deploy scripts exported by the flake, for example: nix run c3d2#glotzbert-nixos-rebuild switch. Use nix flake show c3d2 to show what is available. Note that the deploy scripts only work if the target machines already has flakes enabled.

Now that there is a -local variant that builds the system profile on your machine (possibly reusing dependencies that were built for other hosts), flakification of an existing NixOS host can be done using nix run c3d2#glotzbert-nixos-rebuild-local switch

The must be an existing nixosConfiguration.${host} in flake.nix.

Remote deployment from non-NixOS

A shell script that copies the current working tree, and runs nixos-rebuild switch on the target:


It cannot not lookup hostnames in host-registry.nix. It will not take extra care of the secrets.

Mit NixOps

The official way for deployment is through

Deploy changes

Use deployer system:

ssh k-ot@
cd nix-config/
nixops deploy -d hq --check --include=[hostname]

Creating new Container

This does not work yet, as the nixos-system-x86_64-linux.tar.xz image is broken.

  1. log into any proxmox server
  2. pct create [num] cephfs-iso:vztmpl/nixos-system-x86_64-linux.tar.xz -ostype unmanaged -net0 name=eth0,bridge=vmbr0,tag=[vlantag] -storage vms -hostname [hostname]
  3. adjustments through ui if necessary
  4. Adjust hq.nixops, add [hostname]
  5. Run
    ssh k-ot@
    cd nix-config/
    nixops deploy -d hq --check --include=[hostname]

Tarballs can be built for containers using

nix build

Mit nixos-rebuild switch

nixos-rebuild switch -I nixos-config=./hosts/containers/$HOST/configuration.nix --target-host "root@$"

Checking for updates

nix run .#list-upgradable

list-upgradable output

Checks all hosts with a nixosConfiguration in flake.nix.


Add your gpg-id to the .gpg-id file in secrets and let somebody reencrypt it for you. Maybe this works for you, maybe not. I did it somehow:

PASSWORD_STORE_DIR=`pwd` tr '\n' ' ' < .gpg-id | xargs -I{} pass init {}

Your gpg key has to have the Authenticate flag set. If not update it and push it to a keyserver and wait. This is necessary, so you can login to any machine with your gpg key.

Laptops / Desktops

This repository contains a NixOS module that can be used with personal machines as well. This module appends /etc/ssh/ssh_known_hosts with the host keys of registered HQ hosts, and optionally appends /etc/hosts with static IPv6 addresses local to HQ. Simply import the lib directory to use the module. As an example:

# /etc/nixos/configuration.nix
{ config, pkgs, lib, ... }:
  c3d2Config =
    builtins.fetchGit { url = ""; };
in {
  imports = [
    # ...

  c3d2 = {
    isInHq = false; # not in HQ, this is the default.
    mapHqHosts = true; # Make entries in /etc/hosts for *.hq internal addresses.
    enableMotd = true; # Set the login shell message to the <<</>> logo.

  # ...

Secret Management Using sops-nix

Edit secrets/.sops.yaml to add files for a new host and its SSH pubkey.

cd secrets
nix develop
sops hosts/.../secrets.yaml
git commit -a -m YOLO
git push origin HEAD:master
cd ..
nix flake lock . --update-input secrets