不能直接部署本 flake,它绑定作者硬件配置且依赖私有 secrets 仓库 ryan4yin/nix-secrets;macOS 首次部署需先手动安装 nix 与 homebrew,并注释 lib/macosSystem.nix 中 home-manager 代码加速首次构建;更新 flake inputs 需按 .agents/skills/nix-config-update/SKILL.md 流程执行,不是单条命令
nix-config
ryan4yinMIT活跃维护一套用 Nix Flake 统一管理 NixOS 桌面、macOS 和家庭实验室服务器的配置,涵盖 Hyprland、i3 等桌面环境,可直接参考或复用来搭建自己的声明式系统。
❄️ My nix config for both desktops(NixOS+macOS) and homelab servers(NixOS).
nix shell nixpkgs#just nixpkgs#nushell
just localREADME 未说明具体硬件要求;仓库含作者自己的 hardware-configuration.nix 与 Nvidia 支持配置,仅适配其本人机器
作者自用的 Nix Flakes 配置仓库,统一管理 NixOS 桌面、macOS 与家庭服务器
一套用 Nix Flake 统一管理 NixOS 桌面、macOS 和家庭实验室服务器的配置,涵盖 Hyprland、i3 等桌面环境,可直接参考或复用来搭建自己的声明式系统。
核心能力
- 用 Nix Flakes 声明式构建 NixOS 桌面、macOS 与服务器
- NixOS 桌面采用 Niri Wayland 与 Noctalia 桌面 shell
- macOS 通过 nix-darwin 与 Home Manager 共享 home/ 配置
- 服务器用 libvirt、microVM 与 K3s 运行自托管服务
- 用 agenix 管理密钥,lanzaboote 启用 Secure Boot
容易踩的坑
- v0.20.0最新正式版2026-11-02 · 2026-11-02 09:55 UTC
Sandboxed desktop apps, hardened homelab, and udev in place of oneshots. 117 commits across 25 PRs, 297 files, +8.8k/−2.5k lines in 14 days — mostly authored by agents: Claude Code (claude-opus-5-5) and DeepSeek Harness (deepseek-flash), with some work from GPT-6 Astra and GPT-6.1 Sol. These notes were drafted by Claude Code (claude-opus-5-5).
Highlights
- nixpak sandboxes for desktop apps: a unified sandbox with a cleared environment, no system bus, and isolated network now wraps Foliate, Krita, Bambu Studio, OrcaSlicer and more, with per-app policy checks (#490, #491, #493–#497).
- Homelab hardening: SSH, services and the audit trail on the homelab are hardened, k3s pods can no longer reach etcd's client port, and roots with compromised eMudhra intermediates are distrusted (#479, #489).
- Power monitoring and wake on demand: homelab power draw is monitored,
aquamarinesuspends when idle and wakes over LAN, and the mini PCs get Wake-on-LAN too (#501, #503, #509). - Builders and caching:
aquamarineserves as a remote builder for every physical host, andyoukoruns a pull-through cache for two Nix upstreams (#499, #500). - Less imperative glue: hardware tweaks move from custom oneshots to udev rules and tmpfiles, LAN exporters and whisper-asr are socket-activated with FreeBind, and many stale pins, overlays and workarounds are retired.
Features
- Sandbox desktop apps with nixpak: unify the sandboxes, clear the environment, drop the system bus and isolate the network; add Foliate, Krita, Bambu Studio and OrcaSlicer (#490, #491, #494, #495, #497).
- Package WeChat natively from nixpkgs with app-scoped data (#492).
- Monitor homelab power and reduce
aquamarine's idle draw; suspend it after idle and wake it over LAN (#501, #503). - Enable Wake-on-LAN on the mini PCs (#509).
- Use
aquamarineas a remote builder on the remaining physical hosts (#500), and add a pull-through cache for two Nix upstreams onyouko(#499). - Track
linuxPackages_latestonaquamarine(#478). - Alert when the last successful backup goes stale.
- Enable on-demand VRR for games in niri.
- Add ipython data helpers without persisted history (#510).
- Fetch npm through npmmirror, persist
~/modelsonai, re-add gitleaks, and install python313 on every NixOS host. - Add Japanese and Korean locale font fallbacks and prefer Noto CJK family names.
Fixes
- Harden homelab SSH, services and the audit trail; mount
/etc/sshin initrd so key changes apply on boot (#489). - Deny pod sources the etcd client port 2379 in k3s, and distrust roots with compromised eMudhra intermediates (#479).
- Catch up restic backups missed while a host was off, date
youko's store snapshots by name, and drop stale btrfs snapshots before taking a new one. - Apply the declarative OpenRGB off profile at boot and reapply it after resume; persist OpenRGB settings (#502, #508).
- Keep the mihomo proxy up when the resolved hook times out.
- Route Zoom screen sharing through xdg-desktop-portal-wlr 0.8.2, and let untitled Proton windows go fullscreen.
- Keep displays awake during gamepad use (#480), and pin
ai's 4K monitor at 144 Hz. - Fix Colmena to deploy the systems
nixosConfigurationsevaluates, and run k3s MicroVM guests from their own entries (#483, #484). - Socket-activate LAN exporters and whisper-asr with FreeBind instead of waiting for the network.
Refactors & cleanup
- Replace custom oneshots with udev rules: R9700 power limit,
shoukeicharge cap, RAPL access, HDD spindown, and the Insta360 Link reset on resume. - Move
youkosetup into tmpfiles and native NixOS modules (homepage, caddy wallpapers,/data-romountpoints). - Get NUR packages from the nur-ryan4yin overlay, link mihomo geodata from nixpkgs, and route VR headset audio with a WirePlumber hook.
- Drop retired pins and workarounds (smartctl-exporter, tuios flake, NVMe and nvidia-drm params,
pcie_aspm=off, the Comodo root blacklist), replace redun
- v0.19.02026-10-19 · 2026-10-19 07:59 UTC
查看更新说明
A two-GPU inference box, speech recognition on the NPU, and a proxy config that lives in this repository. 114 commits across 51 PRs, 249 files, +10.4k/−1.6k lines in 12 days — mostly authored by agents: DeepSeek Harness (deepseek-flash), with a few host fixes from GPT-6 Sol and GPT-6 Astra. These notes were drafted by the same agent run.
Highlights
- Two-GPU inference host returns:
aquamarineis back as the inference box on the Colorful CVN Z890 ARK FROZEN V20 board it inherited fromai, with two R9700s capped at 250 W each, whileaireturns to its MSI MAG B760M MORTAR with the RTX 4090 (#439, #453, #467). - Speech recognition on the NPU: an OpenAI-compatible
/v1/audio/transcriptionsservice runs whisper-large-v3-turbo int8 on OpenVINO's VPU, after Qwen3-ASR and SenseVoice failed to compile (#472). - Generated mihomo config: the proxy config is generated from this repository instead of a copy in the live directory (#420, #438), and the IPv6 fake-IP design is reworked across gateway, desktops, and VM guests (#419, #420, #442, #443).
- Native CPU scaling: TuneD is dropped; hosts scale their CPUs natively, with the power profile pinned per host (#458, #460, #461).
- Desktop hardware control: OpenRGB for
ai's board ARGB and DDC/CI monitor control (#452), SuperIO fan and temperature sensors on both boards (#456), a 90% charge cap onshoukei(#457), and EasyEffects state that survives the tmpfs root. - Agent tooling:
dsh-numoves to its own flake (#475, #476), and dsh becomes Nushell-only with steerable turns and programmatic tool calling (#473).
Features
Hosts, inference & hardware
- Revive
aquamarineon the Colorful CVN Z890 ARK FROZEN V20 board with both R9700s, and returnaito its MSI MAG B760M MORTAR with the RTX 4090 (#439). - Build
aiandshoukeionaquamarinethrough remote builders, authenticating with passphrase-free host keys (#467). - Serve Whisper transcription from
aquamarine's NPU as an OpenAI-compatible endpoint for voice input (#472). - Make
aquamarine's iGPU usable for VA-API/QSV transcoding andopenvino-gpu, keeping both R9700s for inference (#474). - Cap each R9700 at 250 W (#453), expose the boards' fans and temperatures through SuperIO (nct6683 on
ai, nct6775 onaquamarine) (#456), add OpenRGB control forai's board ARGB and control its external monitors over DDC/CI (#452). - Cap
shoukeibattery charging at 90% (#457).
Network & proxy
- Generate the mihomo config from this repository, drop the redacted gateway template, and sniff on the gateway instead of the desktop (#420, #438).
- Rework IPv6 fake-IP handling: answer AAAA on a public fake-ip pool, keep the fake pool out of
fc00::/7, force the TUN v6 up so a cold boot keeps IPv6, and keep the tailnet and unproxiable ranges off the TUN (#419, #420, #442, #443). - Keep Steam downloads off the proxy so Steam keeps a CN CDN, and restore the Steam community and store PROXY rules (#408, #412).
- Sync the mihomo policy to Clash Verge on macOS (#424).
- Pin the MicroVM guests to a cluster ULA IPv6 identity (#420).
Power
- Replace TuneD with native CPU scaling, after pinning the profile per host and capping the VM hosts (#458), and mask the packaged
tuned-ppdunit whenppdSupportis off (#460, #461).
Desktop & terminal
- Keep EasyEffects state across reboots and declare its excluded apps in the output preset, leaving local media and meeting apps unprocessed.
- Enlarge yazi image previews and add four plugins (#469).
- Keep tuios sessions across reboots, create them with a cwd before attaching, and handle a stopped daemon at shell startup (#416, #418); upgrade tuios to v0.10.1.
- Add
nhfor NixOS and nix-darwin operations, and start terminals fullscreen on macOS. - Keep the catppuccin starship port build across
nix-collect-garbage(#468), and stop Noctalia from double-counting mihomo's network speed (#414). - Keep named podman images when pruning (#435).
- Two-GPU inference host returns:
- v0.18.02026-10-07 · 2026-10-07 13:51 UTC
查看更新说明
Zero hand-written lines this time. All 40 commits across 22 PRs were driven by DeepSeek Harness — DeepSeek V4.1 Flash plus local models (Qwen3.8-Flash-Next GSQ-RCO IQ3_S on Strata), opencode retired — running up to 5–6 agent tasks in parallel through multiple rounds of AI audits, with most prompts dictated by voice via
fcitx5-vinput(local Sherpa-ONNX). The release notes themselves came from Qwen3.8-Flash-Next.Highlights
- Apple Silicon gaming:
shoukeinow runs x86/x86_64 apps and games through muvm + FEX (Steam, Wine), replacing the qemu-user/box64 path, and the gaming module gained declarative Proton and dGPU rendering (#394, #393). - Nix 2.35 via
nixVersions.latest: lazy flake source copying, mimalloc-accelerated evaluation (5–12% faster), lower nix-daemon memory, HTTP/3, and jittered transfer retries (#405). - K3s on Cilium eBPF: kube-proxy is disabled so Cilium can own service routing (#404).
- Resilient backups: restic verifies its repository after every backup, and
youkosnapshots the restic store hourly (#402). - Security hardening: k3s pods can no longer reach credential-bearing host ports, the NFS golden export and libvirt VNC are locked down, and the PostgreSQL loopback superuser path is closed (#399, #400, #401).
- dsh web: the agent web profile is now versioned with a proxied launcher, and its shared policy ships as a home-layer patch (#387, #388).
Features
- shoukei: run x86/x86_64 apps and games via muvm+FEX (Steam, Wine); pin the home Wi-Fi to a static IPv4 and rework
networking.nix(#394, #407). - gaming: declarative Proton and dGPU game rendering (#393).
- nix: move to Nix 2.35 via
nixVersions.latest(#405). - k3s: disable kube-proxy in favour of Cilium's eBPF replacement (#404).
- backup: verify the restic repository after each backup and snapshot the restic store hourly on
youko(#402); back up the~/.dshstate on idols-ai with restic. - agents: version the dsh web profile and add a proxied launcher (#387).
- desktop: share the Rime config and user dictionary across Linux and macOS (#385); switch CN/EN with Ctrl+Space and right Shift (fcitx5); open the vinput command palette with right Ctrl; add a 10s confirm countdown to Noctalia session actions.
Fixes
- security: deny credential-bearing host ports to k3s pod sources; restrict the NFS golden export and bind libvirt VNC to loopback; require a password for the PostgreSQL superuser over TCP; keep root-only agenix secrets root-only on Darwin (#399, #400, #401).
- apparmor: attach disconnected paths in the sudo profile and correct its comment.
- shoukei: mitigate brcmfmac Wi-Fi auth failures and document the duplicate-profile bug (#406).
- monitoring: stop recurring false alerts (#395) and ignore OpenAPI discovery in the apiserver latency alert.
- k8s: pass inputs to the MicroVM guests (#396).
- ssh: make sandboxed SSH work on Linux (#390).
- agents: preserve dsh data.
- desktop: restore dynamic light/dark for Qt apps, align Qt fonts with GTK (#386), and drop the duplicate Noctalia "Now Playing" OSD.
Other Changes
- refactor: drop the repo-wide
pkgs-x64package set (#394); link the dsh shared policy as a home-layer patch (#388). - ci: harden workflows, run the runtime firewall VM test (#398), and bound and retry the Gitee mirror push.
- docs: refresh the idols-ai host notes and screenshots (#391), and fix stale claims and AI-flavored prose (#397).
Full Changelog: https://github.com/ryan4yin/nix-config/compare/v0.17.0...v0.18.0
- Apple Silicon gaming:
- v0.17.02026-10-05 · 2026-10-05 08:09 UTC
查看更新说明
The first release built almost entirely with AI coding agents — nearly all of its 425 commits across 116 PRs were completed with opencode powered by DeepSeek V4.1 Flash, while the agent skills and global rules (
.agents/skills/,agents/) were mostly authored with GPT-6 / GPT-6.1. 92% of the PRs merged in a 17-day sprint over the Mid-Autumn & National Day holiday (Sep 19 – Oct 5), at roughly 60× the merge rate of the previous release. Even these release notes were written by a local model — Qwen3.8-Flash-Next GSQ-RCO IQ3_S, driven by Strata.Highlights
Four months of work across the desktops, the homelab VMs, and the self-hosted services:
- Desktop: Noctalia v5 shell, Zed replaces VS Code, native mihomo replaces Clash Verge, and voice input via
fcitx5-vinput(CPU/Sherpa-ONNX) onaiandshoukei. - Editors & terminal: standardize on Helix, replace nixvim with
programs.neovim, swap Zellij for the tuios multiplexer, and default to Ghostty + Kitty. - Virtualization: home services moved from KubeVirt to libvirt/microVMs, the three VM hosts renamed to
12kingdoms-*, and thek3s-test-1control planes now run as microVMs. - Services: RustFS replaces MinIO for S3, plus Immich and Jellyfin on
youko. - Security & backup: default-deny inbound firewall (LAN + tailnet trusted), expanded AppArmor hardening, CanoKey support, and btrbk/restic backups with failure notifications.
- Agents & docs: substantial global rule and repository documentation updates, a project-scoped Grafana MCP, and
dshpackaged from NUR.
Features
Desktop, editors & terminal
- Upgrade to the native Noctalia v5 shell with a declarative theme, restored bar system monitors and a dated clock, and an idle media widget (#273).
- Replace VS Code with Zed (#263).
- Standardize on Helix with Neovim as a backup editor (#345), and migrate from nixvim to
programs.neovim(#336). - Replace Zellij with the tuios multiplexer and default to Ghostty + Kitty (#349).
- Manage scattered trash directories with a trash-cli retention timer (#265).
- Add plocate filesystem search and cap the podman log size (#333), and a
genpasscommand for random passwords (#293).
Voice, input & hardware
- Add NPU voice input via
fcitx5-vinputonai(#377); drop the NPU/OpenVINO backend after confirming it never actually ran on the NPU (#384). - Add CanoKey hardware security key support (#334).
Networking
- Replace Clash Verge with native mihomo on all NixOS hosts (#379), show the hostname in the metacubexd title (#383), and tie
ai's link-DNS takeover to mihomo's lifecycle (#380).
Security posture
- Default-deny host inbound traffic, trusting the LAN and tailnet (#325), and firewall/retune transmission on
youko(#326). - Add a balanced kernel and exporter baseline (#365), plus hardening pass 1 (AppArmor, default-deny firewall, loopback-only metrics, tighter k3s permissions, disabled SSH X11) (#266).
- Add a work gitconfig secret with a no-sudo replace flow (#346).
Virtualization & VM platform
- Migrate the idol desktops from KubeVirt to libvirt (#287), rename the hardware config to qemu-guest (#290), and write uploaded images into the VM's own disk (#285).
- Rename the three VM hosts to
12kingdoms-*(#292), run aquamarine's services natively onyouko(#288), and retire the KubeVirt-era cluster bits (#291, #294). - Run the
k3s-test-1masters as microVMs with a reusable guest module and configurable volume sizes (#289), and serve VM golden images from a shared NFS store (#282). - Move KubeVirt networking to a Linux bridge with Cilium instead of OVS/flannel (#278).
- Add a headless X11/i3 + cua-driver computer-use environment on ruby and kana, with X clipboard sync (#277, #308).
K3s & Kubernetes
- Add three
k3s-test-1worker nodes and taint the control plane (#283, #307). - Reserve a KubeVip block and narrow the Tailscale routes (#3
- Desktop: Noctalia v5 shell, Zed replaces VS Code, native mihomo replaces Clash Verge, and voice input via
- v0.16.12026-06-03 · 2026-06-03 06:17 UTC
查看更新说明
What's Changed
- Various Fixes
- fix: suppress nixvim nixpkgs.source and ssh matchBlocks deprecation w… by @ryan4yin in https://github.com/ryan4yin/nix-config/pull/262
Full Changelog: https://github.com/ryan4yin/nix-config/compare/v0.16.0...v0.16.1
用户点评
登录用户的真实使用记录,可按版本和硬件筛选还没有人点评。第一个说出真实体验的人最有价值。
My configuration is becoming more and more complex, and it will be difficult for beginners to read. If you are new to NixOS and want to know how I use NixOS, I would recommend you to take a look at the ryan4yin/nix-config/releases first, check out to some simpler older versions, such as i3-kickstarter, which will be much easier to understand.
This repository is home to the Nix code that builds all of my systems:
- NixOS desktops — Home Manager, Niri (Wayland), the Noctalia shell, agenix.
- macOS desktops — nix-darwin + Home Manager, sharing the same
home/configuration with the NixOS desktops. - NixOS servers — three physical mini PCs running the VMs (libvirt and microVMs), the K3s test cluster and the self-hosted services.
See ./docs for the documentation index, ./hosts for the host inventory, ./outputs for how the flake outputs are composed, BACKUP.md for the backup design, and ./AGENTS.md for the repository conventions.
Why NixOS & Flakes?
Nix allows for easy-to-manage, collaborative, reproducible deployments. This means that once something is setup and configured once, it works (almost) forever. If someone else shares their configuration, anyone else can just use it (if you really understand what you're copying/referring now).
As for Flakes, refer to Introduction to Flakes - NixOS & Nix Flakes Book
Want to know NixOS & Flakes in detail? Looking for a beginner-friendly tutorial or best practices? You don't have to go through the pain I've experienced again! Check out my NixOS & Nix Flakes Book - 🛠️ ❤️ An unofficial & opinionated :book: for beginners!
If you're using macOS, check out ryan4yin/nix-darwin-kickstarter for a quick start.
Components
| NixOS (Wayland) | |
|---|---|
| Display Manager | greetd + tuigreet |
| Window Manager | Niri |
| Desktop Shell | Noctalia — bar/notifications/launcher/lock screen/control center/power menu/screenshots, one native shell |
| Terminal Emulators | Kitty, Ghostty |
| Terminal Multiplexer | tuios |
| Shell | Nushell + Starship |
| Editors / IDE | Zed (GUI, primary), VS Code (GUI); Helix (TUI, primary), Neovim (TUI, backup) |
| Color Scheme | catppuccin-nix |
| Networking | systemd-networkd / NetworkManager |
| Input Method | Fcitx5 + rime + 小鹤音形 flypy |
| System Monitor | Btop (+ Noctalia's built-in sysmon widgets) |
| File Manager | Yazi (TUI) + thunar (GUI) |
| Media Player | mpv |
| Image Viewer | imv |
| Screenshots | Native Noctalia capture: region / fullscreen / display picker, with a built-in annotation editor |
| Screen Recording | OBS, gpu-screen-recorder, wf-recorder |
| Fonts | Nerd fonts |
| Filesystem & Encryption | tmpfs as /, Btrfs subvolumes on a LUKS encrypted partition for persistent data; unlock via passphrase |
| Secure Boot | lanzaboote |
Wallpapers: https://github.com/ryan4yin/wallpapers
Screenshots


Editors / IDE
- Terminal editors: ./home/base/core/editors/ — Helix / Neovim,
$EDITOR, docs. - GUI editor: Zed.
- LLM coding agents: ./agents — rules, installers, CLI snippets; see ./agents/README.md.
Secrets Management
See ./secrets for details.
Security & Hardening
See SECURITY.md for the threat model, security architecture, controls and audit status, ./hardening/README.md for application sandboxing and Linux hardening, and WORKAROUNDS.md for temporary exceptions and known gaps.
How to Deploy this Flake?
:red_circle: IMPORTANT: You should NOT deploy this flake directly on your machine :exclamation: It will not succeed. This flake contains my hardware configuration (such as hardware-configuration.nix, Nvidia support, etc.) which is not suitable for your hardware, and requires my private secrets repository ryan4yin/nix-secrets to deploy. You may use this repo as a reference to build your own configuration.
Updating flake inputs and rolling the result out safely is a procedure, not a single command. Follow
.agents/skills/nix-config-update/SKILL.md.
For NixOS:
To deploy this flake from NixOS's official ISO image (purest installation method), please refer to ./nixos-installer/
# Desktops: deploy the <hostname>-niri nixosConfiguration (e.g. ai-niri, shoukei-niri)
just niri # equals `sudo nixos-rebuild switch --flake .#<hostname>-niri`
just niri boot # set as the next boot configuration without switching
just niri switch debug # detailed output
# Other hosts (servers, VMs): deploy the nixosConfiguration matching the bare hostname
just local
just local boot
just local switch debug
For macOS (nix-darwin):
# If you are deploying for the first time,
# 1. install nix & homebrew manually.
# 2. prepare the deployment environment with essential packages available
nix shell nixpkgs#just nixpkgs#nushell
# 3. comment home-manager's code in lib/macosSystem.nix to speed up the first deployment.
# Deploy the darwinConfiguration by hostname match (fern, frieren)
just local
just local debug # detailed output (macOS has no switch/boot mode)
Remote / cluster hosts are deployed with Colmena on top
of the same flake, e.g. just col <tag>, just k3s-test, just lab.
What y'all will need when Nix drives you to drink. (copy from hlissner's dotfiles, it really matches my feelings when I first started using NixOS...)
Validation & Development
nix develop provides the formatters and linters used by the repository. The most useful commands:
just test # eval tests across Linux & Darwin (fails unless the result is `true`)
just fmt # format all Nix files with nixfmt
just --list # all recipes
nix flake check # broader flake checks
For Nix changes, run just test and inspect just fmt's diff before committing. Non-Nix files are
formatted with prettier; spelling is checked with typos.
References
Other dotfiles that inspired me:
- Nix Flakes
- NixOS-CN/NixOS-CN-telegram
- notusknot/dotfiles-nix
- xddxdd/nixos-config
- bobbbay/dotfiles
- gytis-ivaskevicius/nixfiles
- davidtwco/veritas
- gvolpe/nix-config
- Ruixi-rebirth/flakes
- fufexan/dotfiles: gtk theme, xdg, git, media, etc.
- nix-community/srvos: a collection of opinionated and sharable NixOS configurations for servers
- Modularized NixOS Configuration
- Neovim / AstroNvim
- maxbrunet/dotfiles: astronvim with nix flakes.
- Misc