nix-config

ryan4yinMIT活跃维护

一套用 Nix Flake 统一管理 NixOS 桌面、macOS 和家庭实验室服务器的配置,涵盖 Hyprland、i3 等桌面环境,可直接参考或复用来搭建自己的声明式系统。

❄️ My nix config for both desktops(NixOS+macOS) and homelab servers(NixOS).

v0.20.0发布于 2026-11-02 09:55 UTC2,116star +2 / 7 天102fork同步于 2026-11-10 17:47 UTC

怎么上手

由 README 提炼,执行前请确认
nix shell nixpkgs#just nixpkgs#nushell
just local
硬件要求按 README 说明

README 未说明具体硬件要求;仓库含作者自己的 hardware-configuration.nix 与 Nvidia 支持配置,仅适配其本人机器

下载:源码 zip·GitHub Releases(安装包)本站不镜像安装包

项目说明

由 README 自动翻译提炼

作者自用的 Nix Flakes 配置仓库,统一管理 NixOS 桌面、macOS 与家庭服务器

一套用 Nix Flake 统一管理 NixOS 桌面、macOS 和家庭实验室服务器的配置,涵盖 Hyprland、i3 等桌面环境,可直接参考或复用来搭建自己的声明式系统。

核心能力

  • 用 Nix Flakes 声明式构建 NixOS 桌面、macOS 与服务器
  • NixOS 桌面采用 Niri Wayland 与 Noctalia 桌面 shell
  • macOS 通过 nix-darwin 与 Home Manager 共享 home/ 配置
  • 服务器用 libvirt、microVM 与 K3s 运行自托管服务
  • 用 agenix 管理密钥,lanzaboote 启用 Secure Boot

容易踩的坑

不能直接部署本 flake,它绑定作者硬件配置且依赖私有 secrets 仓库 ryan4yin/nix-secrets;macOS 首次部署需先手动安装 nix 与 homebrew,并注释 lib/macosSystem.nix 中 home-manager 代码加速首次构建;更新 flake inputs 需按 .agents/skills/nix-config-update/SKILL.md 流程执行,不是单条命令

内容由模型根据 README 生成,可能不完整或不准确,以官方文档为准。看原文 README

最近发版

5 个版本v0.20.0
  1. v0.20.0最新正式版2026-11-02 · 2026-11-02 09:55 UTC

    Sandboxed desktop apps, hardened homelab, and udev in place of oneshots. 117 commits across 25 PRs, 297 files, +8.8k/−2.5k lines in 14 days — mostly authored by agents: Claude Code (claude-opus-5-5) and DeepSeek Harness (deepseek-flash), with some work from GPT-6 Astra and GPT-6.1 Sol. These notes were drafted by Claude Code (claude-opus-5-5).

    Highlights

    • nixpak sandboxes for desktop apps: a unified sandbox with a cleared environment, no system bus, and isolated network now wraps Foliate, Krita, Bambu Studio, OrcaSlicer and more, with per-app policy checks (#490, #491, #493–#497).
    • Homelab hardening: SSH, services and the audit trail on the homelab are hardened, k3s pods can no longer reach etcd's client port, and roots with compromised eMudhra intermediates are distrusted (#479, #489).
    • Power monitoring and wake on demand: homelab power draw is monitored, aquamarine suspends when idle and wakes over LAN, and the mini PCs get Wake-on-LAN too (#501, #503, #509).
    • Builders and caching: aquamarine serves as a remote builder for every physical host, and youko runs a pull-through cache for two Nix upstreams (#499, #500).
    • Less imperative glue: hardware tweaks move from custom oneshots to udev rules and tmpfiles, LAN exporters and whisper-asr are socket-activated with FreeBind, and many stale pins, overlays and workarounds are retired.

    Features

    • Sandbox desktop apps with nixpak: unify the sandboxes, clear the environment, drop the system bus and isolate the network; add Foliate, Krita, Bambu Studio and OrcaSlicer (#490, #491, #494, #495, #497).
    • Package WeChat natively from nixpkgs with app-scoped data (#492).
    • Monitor homelab power and reduce aquamarine's idle draw; suspend it after idle and wake it over LAN (#501, #503).
    • Enable Wake-on-LAN on the mini PCs (#509).
    • Use aquamarine as a remote builder on the remaining physical hosts (#500), and add a pull-through cache for two Nix upstreams on youko (#499).
    • Track linuxPackages_latest on aquamarine (#478).
    • Alert when the last successful backup goes stale.
    • Enable on-demand VRR for games in niri.
    • Add ipython data helpers without persisted history (#510).
    • Fetch npm through npmmirror, persist ~/models on ai, re-add gitleaks, and install python313 on every NixOS host.
    • Add Japanese and Korean locale font fallbacks and prefer Noto CJK family names.

    Fixes

    • Harden homelab SSH, services and the audit trail; mount /etc/ssh in initrd so key changes apply on boot (#489).
    • Deny pod sources the etcd client port 2379 in k3s, and distrust roots with compromised eMudhra intermediates (#479).
    • Catch up restic backups missed while a host was off, date youko's store snapshots by name, and drop stale btrfs snapshots before taking a new one.
    • Apply the declarative OpenRGB off profile at boot and reapply it after resume; persist OpenRGB settings (#502, #508).
    • Keep the mihomo proxy up when the resolved hook times out.
    • Route Zoom screen sharing through xdg-desktop-portal-wlr 0.8.2, and let untitled Proton windows go fullscreen.
    • Keep displays awake during gamepad use (#480), and pin ai's 4K monitor at 144 Hz.
    • Fix Colmena to deploy the systems nixosConfigurations evaluates, and run k3s MicroVM guests from their own entries (#483, #484).
    • Socket-activate LAN exporters and whisper-asr with FreeBind instead of waiting for the network.

    Refactors & cleanup

    • Replace custom oneshots with udev rules: R9700 power limit, shoukei charge cap, RAPL access, HDD spindown, and the Insta360 Link reset on resume.
    • Move youko setup into tmpfiles and native NixOS modules (homepage, caddy wallpapers, /data-ro mountpoints).
    • Get NUR packages from the nur-ryan4yin overlay, link mihomo geodata from nixpkgs, and route VR headset audio with a WirePlumber hook.
    • Drop retired pins and workarounds (smartctl-exporter, tuios flake, NVMe and nvidia-drm params, pcie_aspm=off, the Comodo root blacklist), replace redun
  2. v0.19.02026-10-19 · 2026-10-19 07:59 UTC
    查看更新说明

    A two-GPU inference box, speech recognition on the NPU, and a proxy config that lives in this repository. 114 commits across 51 PRs, 249 files, +10.4k/−1.6k lines in 12 days — mostly authored by agents: DeepSeek Harness (deepseek-flash), with a few host fixes from GPT-6 Sol and GPT-6 Astra. These notes were drafted by the same agent run.

    Highlights

    • Two-GPU inference host returns: aquamarine is back as the inference box on the Colorful CVN Z890 ARK FROZEN V20 board it inherited from ai, with two R9700s capped at 250 W each, while ai returns to its MSI MAG B760M MORTAR with the RTX 4090 (#439, #453, #467).
    • Speech recognition on the NPU: an OpenAI-compatible /v1/audio/transcriptions service runs whisper-large-v3-turbo int8 on OpenVINO's VPU, after Qwen3-ASR and SenseVoice failed to compile (#472).
    • Generated mihomo config: the proxy config is generated from this repository instead of a copy in the live directory (#420, #438), and the IPv6 fake-IP design is reworked across gateway, desktops, and VM guests (#419, #420, #442, #443).
    • Native CPU scaling: TuneD is dropped; hosts scale their CPUs natively, with the power profile pinned per host (#458, #460, #461).
    • Desktop hardware control: OpenRGB for ai's board ARGB and DDC/CI monitor control (#452), SuperIO fan and temperature sensors on both boards (#456), a 90% charge cap on shoukei (#457), and EasyEffects state that survives the tmpfs root.
    • Agent tooling: dsh-nu moves to its own flake (#475, #476), and dsh becomes Nushell-only with steerable turns and programmatic tool calling (#473).

    Features

    Hosts, inference & hardware

    • Revive aquamarine on the Colorful CVN Z890 ARK FROZEN V20 board with both R9700s, and return ai to its MSI MAG B760M MORTAR with the RTX 4090 (#439).
    • Build ai and shoukei on aquamarine through remote builders, authenticating with passphrase-free host keys (#467).
    • Serve Whisper transcription from aquamarine's NPU as an OpenAI-compatible endpoint for voice input (#472).
    • Make aquamarine's iGPU usable for VA-API/QSV transcoding and openvino-gpu, keeping both R9700s for inference (#474).
    • Cap each R9700 at 250 W (#453), expose the boards' fans and temperatures through SuperIO (nct6683 on ai, nct6775 on aquamarine) (#456), add OpenRGB control for ai's board ARGB and control its external monitors over DDC/CI (#452).
    • Cap shoukei battery charging at 90% (#457).

    Network & proxy

    • Generate the mihomo config from this repository, drop the redacted gateway template, and sniff on the gateway instead of the desktop (#420, #438).
    • Rework IPv6 fake-IP handling: answer AAAA on a public fake-ip pool, keep the fake pool out of fc00::/7, force the TUN v6 up so a cold boot keeps IPv6, and keep the tailnet and unproxiable ranges off the TUN (#419, #420, #442, #443).
    • Keep Steam downloads off the proxy so Steam keeps a CN CDN, and restore the Steam community and store PROXY rules (#408, #412).
    • Sync the mihomo policy to Clash Verge on macOS (#424).
    • Pin the MicroVM guests to a cluster ULA IPv6 identity (#420).

    Power

    • Replace TuneD with native CPU scaling, after pinning the profile per host and capping the VM hosts (#458), and mask the packaged tuned-ppd unit when ppdSupport is off (#460, #461).

    Desktop & terminal

    • Keep EasyEffects state across reboots and declare its excluded apps in the output preset, leaving local media and meeting apps unprocessed.
    • Enlarge yazi image previews and add four plugins (#469).
    • Keep tuios sessions across reboots, create them with a cwd before attaching, and handle a stopped daemon at shell startup (#416, #418); upgrade tuios to v0.10.1.
    • Add nh for NixOS and nix-darwin operations, and start terminals fullscreen on macOS.
    • Keep the catppuccin starship port build across nix-collect-garbage (#468), and stop Noctalia from double-counting mihomo's network speed (#414).
    • Keep named podman images when pruning (#435).
  3. v0.18.02026-10-07 · 2026-10-07 13:51 UTC
    查看更新说明

    Zero hand-written lines this time. All 40 commits across 22 PRs were driven by DeepSeek Harness — DeepSeek V4.1 Flash plus local models (Qwen3.8-Flash-Next GSQ-RCO IQ3_S on Strata), opencode retired — running up to 5–6 agent tasks in parallel through multiple rounds of AI audits, with most prompts dictated by voice via fcitx5-vinput (local Sherpa-ONNX). The release notes themselves came from Qwen3.8-Flash-Next.

    Highlights

    • Apple Silicon gaming: shoukei now runs x86/x86_64 apps and games through muvm + FEX (Steam, Wine), replacing the qemu-user/box64 path, and the gaming module gained declarative Proton and dGPU rendering (#394, #393).
    • Nix 2.35 via nixVersions.latest: lazy flake source copying, mimalloc-accelerated evaluation (5–12% faster), lower nix-daemon memory, HTTP/3, and jittered transfer retries (#405).
    • K3s on Cilium eBPF: kube-proxy is disabled so Cilium can own service routing (#404).
    • Resilient backups: restic verifies its repository after every backup, and youko snapshots the restic store hourly (#402).
    • Security hardening: k3s pods can no longer reach credential-bearing host ports, the NFS golden export and libvirt VNC are locked down, and the PostgreSQL loopback superuser path is closed (#399, #400, #401).
    • dsh web: the agent web profile is now versioned with a proxied launcher, and its shared policy ships as a home-layer patch (#387, #388).

    Features

    • shoukei: run x86/x86_64 apps and games via muvm+FEX (Steam, Wine); pin the home Wi-Fi to a static IPv4 and rework networking.nix (#394, #407).
    • gaming: declarative Proton and dGPU game rendering (#393).
    • nix: move to Nix 2.35 via nixVersions.latest (#405).
    • k3s: disable kube-proxy in favour of Cilium's eBPF replacement (#404).
    • backup: verify the restic repository after each backup and snapshot the restic store hourly on youko (#402); back up the ~/.dsh state on idols-ai with restic.
    • agents: version the dsh web profile and add a proxied launcher (#387).
    • desktop: share the Rime config and user dictionary across Linux and macOS (#385); switch CN/EN with Ctrl+Space and right Shift (fcitx5); open the vinput command palette with right Ctrl; add a 10s confirm countdown to Noctalia session actions.

    Fixes

    • security: deny credential-bearing host ports to k3s pod sources; restrict the NFS golden export and bind libvirt VNC to loopback; require a password for the PostgreSQL superuser over TCP; keep root-only agenix secrets root-only on Darwin (#399, #400, #401).
    • apparmor: attach disconnected paths in the sudo profile and correct its comment.
    • shoukei: mitigate brcmfmac Wi-Fi auth failures and document the duplicate-profile bug (#406).
    • monitoring: stop recurring false alerts (#395) and ignore OpenAPI discovery in the apiserver latency alert.
    • k8s: pass inputs to the MicroVM guests (#396).
    • ssh: make sandboxed SSH work on Linux (#390).
    • agents: preserve dsh data.
    • desktop: restore dynamic light/dark for Qt apps, align Qt fonts with GTK (#386), and drop the duplicate Noctalia "Now Playing" OSD.

    Other Changes

    • refactor: drop the repo-wide pkgs-x64 package set (#394); link the dsh shared policy as a home-layer patch (#388).
    • ci: harden workflows, run the runtime firewall VM test (#398), and bound and retry the Gitee mirror push.
    • docs: refresh the idols-ai host notes and screenshots (#391), and fix stale claims and AI-flavored prose (#397).

    Full Changelog: https://github.com/ryan4yin/nix-config/compare/v0.17.0...v0.18.0

  4. v0.17.02026-10-05 · 2026-10-05 08:09 UTC
    查看更新说明

    The first release built almost entirely with AI coding agents — nearly all of its 425 commits across 116 PRs were completed with opencode powered by DeepSeek V4.1 Flash, while the agent skills and global rules (.agents/skills/, agents/) were mostly authored with GPT-6 / GPT-6.1. 92% of the PRs merged in a 17-day sprint over the Mid-Autumn & National Day holiday (Sep 19 – Oct 5), at roughly 60× the merge rate of the previous release. Even these release notes were written by a local model — Qwen3.8-Flash-Next GSQ-RCO IQ3_S, driven by Strata.

    Highlights

    Four months of work across the desktops, the homelab VMs, and the self-hosted services:

    • Desktop: Noctalia v5 shell, Zed replaces VS Code, native mihomo replaces Clash Verge, and voice input via fcitx5-vinput (CPU/Sherpa-ONNX) on ai and shoukei.
    • Editors & terminal: standardize on Helix, replace nixvim with programs.neovim, swap Zellij for the tuios multiplexer, and default to Ghostty + Kitty.
    • Virtualization: home services moved from KubeVirt to libvirt/microVMs, the three VM hosts renamed to 12kingdoms-*, and the k3s-test-1 control planes now run as microVMs.
    • Services: RustFS replaces MinIO for S3, plus Immich and Jellyfin on youko.
    • Security & backup: default-deny inbound firewall (LAN + tailnet trusted), expanded AppArmor hardening, CanoKey support, and btrbk/restic backups with failure notifications.
    • Agents & docs: substantial global rule and repository documentation updates, a project-scoped Grafana MCP, and dsh packaged from NUR.

    Features

    Desktop, editors & terminal

    • Upgrade to the native Noctalia v5 shell with a declarative theme, restored bar system monitors and a dated clock, and an idle media widget (#273).
    • Replace VS Code with Zed (#263).
    • Standardize on Helix with Neovim as a backup editor (#345), and migrate from nixvim to programs.neovim (#336).
    • Replace Zellij with the tuios multiplexer and default to Ghostty + Kitty (#349).
    • Manage scattered trash directories with a trash-cli retention timer (#265).
    • Add plocate filesystem search and cap the podman log size (#333), and a genpass command for random passwords (#293).

    Voice, input & hardware

    • Add NPU voice input via fcitx5-vinput on ai (#377); drop the NPU/OpenVINO backend after confirming it never actually ran on the NPU (#384).
    • Add CanoKey hardware security key support (#334).

    Networking

    • Replace Clash Verge with native mihomo on all NixOS hosts (#379), show the hostname in the metacubexd title (#383), and tie ai's link-DNS takeover to mihomo's lifecycle (#380).

    Security posture

    • Default-deny host inbound traffic, trusting the LAN and tailnet (#325), and firewall/retune transmission on youko (#326).
    • Add a balanced kernel and exporter baseline (#365), plus hardening pass 1 (AppArmor, default-deny firewall, loopback-only metrics, tighter k3s permissions, disabled SSH X11) (#266).
    • Add a work gitconfig secret with a no-sudo replace flow (#346).

    Virtualization & VM platform

    • Migrate the idol desktops from KubeVirt to libvirt (#287), rename the hardware config to qemu-guest (#290), and write uploaded images into the VM's own disk (#285).
    • Rename the three VM hosts to 12kingdoms-* (#292), run aquamarine's services natively on youko (#288), and retire the KubeVirt-era cluster bits (#291, #294).
    • Run the k3s-test-1 masters as microVMs with a reusable guest module and configurable volume sizes (#289), and serve VM golden images from a shared NFS store (#282).
    • Move KubeVirt networking to a Linux bridge with Cilium instead of OVS/flannel (#278).
    • Add a headless X11/i3 + cua-driver computer-use environment on ruby and kana, with X clipboard sync (#277, #308).

    K3s & Kubernetes

    • Add three k3s-test-1 worker nodes and taint the control plane (#283, #307).
    • Reserve a KubeVip block and narrow the Tailscale routes (#3
  5. v0.16.12026-06-03 · 2026-06-03 06:17 UTC
    查看更新说明

    What's Changed

    Full Changelog: https://github.com/ryan4yin/nix-config/compare/v0.16.0...v0.16.1

用户点评

登录用户的真实使用记录,可按版本和硬件筛选
共 0 条

    还没有人点评。第一个说出真实体验的人最有价值。

    README 原文

    未翻译

    My configuration is becoming more and more complex, and it will be difficult for beginners to read. If you are new to NixOS and want to know how I use NixOS, I would recommend you to take a look at the ryan4yin/nix-config/releases first, check out to some simpler older versions, such as i3-kickstarter, which will be much easier to understand.

    This repository is home to the Nix code that builds all of my systems:

    1. NixOS desktops — Home Manager, Niri (Wayland), the Noctalia shell, agenix.
    2. macOS desktops — nix-darwin + Home Manager, sharing the same home/ configuration with the NixOS desktops.
    3. NixOS servers — three physical mini PCs running the VMs (libvirt and microVMs), the K3s test cluster and the self-hosted services.

    See ./docs for the documentation index, ./hosts for the host inventory, ./outputs for how the flake outputs are composed, BACKUP.md for the backup design, and ./AGENTS.md for the repository conventions.

    Why NixOS & Flakes?

    Nix allows for easy-to-manage, collaborative, reproducible deployments. This means that once something is setup and configured once, it works (almost) forever. If someone else shares their configuration, anyone else can just use it (if you really understand what you're copying/referring now).

    As for Flakes, refer to Introduction to Flakes - NixOS & Nix Flakes Book

    Want to know NixOS & Flakes in detail? Looking for a beginner-friendly tutorial or best practices? You don't have to go through the pain I've experienced again! Check out my NixOS & Nix Flakes Book - 🛠️ ❤️ An unofficial & opinionated :book: for beginners!

    If you're using macOS, check out ryan4yin/nix-darwin-kickstarter for a quick start.

    Components

    NixOS (Wayland)
    Display Managergreetd + tuigreet
    Window ManagerNiri
    Desktop ShellNoctalia — bar/notifications/launcher/lock screen/control center/power menu/screenshots, one native shell
    Terminal EmulatorsKitty, Ghostty
    Terminal Multiplexertuios
    ShellNushell + Starship
    Editors / IDEZed (GUI, primary), VS Code (GUI); Helix (TUI, primary), Neovim (TUI, backup)
    Color Schemecatppuccin-nix
    Networkingsystemd-networkd / NetworkManager
    Input MethodFcitx5 + rime + 小鹤音形 flypy
    System MonitorBtop (+ Noctalia's built-in sysmon widgets)
    File ManagerYazi (TUI) + thunar (GUI)
    Media Playermpv
    Image Viewerimv
    ScreenshotsNative Noctalia capture: region / fullscreen / display picker, with a built-in annotation editor
    Screen RecordingOBS, gpu-screen-recorder, wf-recorder
    FontsNerd fonts
    Filesystem & Encryptiontmpfs as /, Btrfs subvolumes on a LUKS encrypted partition for persistent data; unlock via passphrase
    Secure Bootlanzaboote

    Wallpapers: https://github.com/ryan4yin/wallpapers

    Screenshots

    desktop

    btop, fastfetch, and llama.cpp serving logs

    Editors / IDE

    Secrets Management

    See ./secrets for details.

    Security & Hardening

    See SECURITY.md for the threat model, security architecture, controls and audit status, ./hardening/README.md for application sandboxing and Linux hardening, and WORKAROUNDS.md for temporary exceptions and known gaps.

    How to Deploy this Flake?

    :red_circle: IMPORTANT: You should NOT deploy this flake directly on your machine :exclamation: It will not succeed. This flake contains my hardware configuration (such as hardware-configuration.nix, Nvidia support, etc.) which is not suitable for your hardware, and requires my private secrets repository ryan4yin/nix-secrets to deploy. You may use this repo as a reference to build your own configuration.

    Updating flake inputs and rolling the result out safely is a procedure, not a single command. Follow .agents/skills/nix-config-update/SKILL.md.

    For NixOS:

    To deploy this flake from NixOS's official ISO image (purest installation method), please refer to ./nixos-installer/

    # Desktops: deploy the <hostname>-niri nixosConfiguration (e.g. ai-niri, shoukei-niri)
    just niri           # equals `sudo nixos-rebuild switch --flake .#<hostname>-niri`
    just niri boot      # set as the next boot configuration without switching
    just niri switch debug  # detailed output
    
    # Other hosts (servers, VMs): deploy the nixosConfiguration matching the bare hostname
    just local
    just local boot
    just local switch debug
    

    For macOS (nix-darwin):

    # If you are deploying for the first time,
    # 1. install nix & homebrew manually.
    # 2. prepare the deployment environment with essential packages available
    nix shell nixpkgs#just nixpkgs#nushell
    # 3. comment home-manager's code in lib/macosSystem.nix to speed up the first deployment.
    
    # Deploy the darwinConfiguration by hostname match (fern, frieren)
    just local
    just local debug  # detailed output (macOS has no switch/boot mode)
    

    Remote / cluster hosts are deployed with Colmena on top of the same flake, e.g. just col <tag>, just k3s-test, just lab.

    What y'all will need when Nix drives you to drink. (copy from hlissner's dotfiles, it really matches my feelings when I first started using NixOS...)

    Validation & Development

    nix develop provides the formatters and linters used by the repository. The most useful commands:

    just test    # eval tests across Linux & Darwin (fails unless the result is `true`)
    just fmt     # format all Nix files with nixfmt
    just --list  # all recipes
    
    nix flake check   # broader flake checks
    

    For Nix changes, run just test and inspect just fmt's diff before committing. Non-Nix files are formatted with prettier; spelling is checked with typos.

    References

    Other dotfiles that inspired me: