No description
Find a file
ediblerope 509c4cc47d Add CrowdSec IPS with firewall bouncer on FredOS-Mediaserver
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-05 22:59:37 +01:00
.github/workflows Delete .github/workflows/blank.yml 2026-03-28 19:31:42 +00:00
apps 2026-03-28 15:07:05 +00:00
home-manager Update gnome-hm.nix 2026-03-28 23:42:15 +00:00
hosts Remove easyeffects from FredOS-Gaming packages 2026-04-05 22:15:14 +01:00
services Add CrowdSec IPS with firewall bouncer on FredOS-Mediaserver 2026-04-05 22:59:37 +01:00
settings Reorganise hardware vs host config, tidy settings and services 2026-04-01 21:16:59 +01:00
walls Delete walls/owventures.png 2025-12-21 12:05:03 +00:00
common.nix Add CrowdSec IPS with firewall bouncer on FredOS-Mediaserver 2026-04-05 22:59:37 +01:00
flake.lock Update flake.lock 2026-04-05 11:25:55 +01:00
flake.nix Update flake.nix 2026-04-05 11:20:36 +01:00
readme.md Reorganise hardware vs host config, tidy settings and services 2026-04-01 21:16:59 +01:00

FredOS NixOS Configuration

Flake-based NixOS configuration for three machines, built and deployed directly from GitHub. No local config management required after initial setup.

Machines

Hostname Description
FredOS-Gaming AMD desktop, UEFI/systemd-boot
FredOS-Macbook Intel laptop, UEFI/systemd-boot
FredOS-Mediaserver Intel server, BIOS/GRUB

Structure

├── .github
│   └── workflows
│       └── update.yml               # Auto-updates flake.lock daily
├── apps
│   ├── fastfetch.nix                # Fastfetch config
│   ├── flatpaks.nix                 # Flatpak apps
│   └── zen.nix                      # Zen browser config
├── home-manager
│   ├── fred.nix                     # User-level Home Manager config
│   └── gnome-hm.nix                 # GNOME Home Manager settings
├── hosts
│   ├── FredOS-Gaming.nix            # Gaming: packages, Steam, boot options
│   ├── FredOS-Macbook.nix           # Macbook: packages, power management, boot options
│   ├── FredOS-Mediaserver.nix       # Mediaserver: packages, networking, SSH
│   └── hardware
│       ├── FredOS-Gaming.nix        # AMD GPU, kernel modules, filesystems, bootloader, hostname
│       ├── FredOS-Macbook.nix       # Broadcom WiFi, Intel GPU, Bluetooth, filesystems, bootloader, hostname
│       └── FredOS-Mediaserver.nix   # Intel CPU, data disks, mergerfs pool, GRUB, hostname
├── services
│   ├── bazarr.nix                   # Subtitle management
│   ├── cloudflare-ddns.nix          # Cloudflare dynamic DNS
│   ├── game-servers.nix             # Game server definitions
│   ├── go2rtc.nix                   # Camera/RTSP streaming
│   ├── jellyfin.nix                 # Media server
│   ├── nginx.nix                    # Reverse proxy
│   ├── omnisearch.nix               # OmniSearch service
│   ├── prowlarr.nix                 # Indexer manager
│   ├── qbittorrent-nox.nix          # Torrent client
│   ├── radarr.nix                   # Movie management
│   ├── server-permissions.nix       # File/dir permission setup
│   └── sonarr.nix                   # TV management
├── settings
│   ├── audio.nix                    # PipeWire / audio config
│   ├── gnome.nix                    # GNOME desktop settings
│   ├── locale.nix                   # Locale, timezone, keyboard
│   └── users.nix                    # User accounts
├── walls                            # Wallpapers
├── common.nix                       # Shared config imported by all hosts
├── flake.lock                       # Auto-generated, updated daily by GitHub Actions
└── flake.nix                        # Flake inputs and host definitions

Day-to-day usage

Edit files directly on GitHub, then on the machine run:

update

That's it. The alias is defined in common.nix and expands to:

sudo nixos-rebuild switch --flake github:ediblerope/nixos-config --refresh --no-write-lock-file

Nix automatically matches the running machine's hostname to the correct nixosConfigurations entry.

Other useful aliases:

clean    # sudo nix-collect-garbage -d

Adding a new machine

1. Fresh NixOS install

Boot the NixOS installer and complete the standard installation.

2. Enable flakes temporarily

Add this to /etc/nixos/configuration.nix and rebuild:

nix.settings.experimental-features = [ "nix-command" "flakes" ];
sudo nixos-rebuild switch

3. Create the hardware config on GitHub

Copy the contents of /etc/nixos/hardware-configuration.nix and create hosts/hardware/FredOS-NEWHOST.nix on GitHub. Append the hostname and bootloader config to it:

networking.hostName = "FredOS-NEWHOST";

# For UEFI/systemd-boot machines:
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;

# For BIOS/GRUB machines instead:
# boot.loader.grub.enable = true;
# boot.loader.grub.devices = [ "/dev/sda" ]; # verify with: sudo grub-probe --target=disk /

4. Register the host in flake.nix

In flake.nix on GitHub, add to nixosConfigurations:

FredOS-NEWHOST = mkHost "FredOS-NEWHOST";

5. Add host-specific config

Create hosts/FredOS-NEWHOST.nix on GitHub for any machine-specific packages or services:

{ config, pkgs, lib, ... }:
{
  config = lib.mkIf (config.networking.hostName == "FredOS-NEWHOST") {
    # host-specific packages and services here
  };
}

Then add it to the imports list in common.nix:

./hosts/FredOS-NEWHOST.nix

6. Switch to the flake

Run this once on the new machine with the explicit hostname:

sudo nixos-rebuild switch --flake github:ediblerope/nixos-config#FredOS-NEWHOST --refresh --no-write-lock-file

After this succeeds, the plain update alias works from then on.


Flake inputs

Input Source
nixpkgs github:NixOS/nixpkgs/nixos-unstable
home-manager github:nix-community/home-manager
omnisearch git+https://git.bwaaa.monster/omnisearch
zen-browser github:0xc000022070/zen-browser-flake
nix-flatpak github:gmodena/nix-flatpak

Notes

  • hosts/hardware/ files are committed to the repo — they contain UUIDs and disk layout but no sensitive credentials
  • Host-specific behaviour is gated with lib.mkIf (config.networking.hostName == "...") or lib.elem config.networking.hostName [...]
  • GitHub API rate limit (60 req/hour unauthenticated) can occasionally be hit if running update many times in quick succession during active config changes — wait ~15 minutes and retry