LunatixOS

Personal NixOS configuration for the igloo host, built on a dendritic flake layout using the den framework, flake-parts, and import-tree.

Every file under modules/ is imported automatically, so the configuration is organized as small, self-contained aspects rather than a single monolithic module tree.

Overview

• Host: igloo (hostname nixos), x86_64-linux
• Hardware: Dell Latitude 3250
• Primary user: lunixose
• Channel: nixpkgs-unstable
• State version: 26.05
• Filesystem: Btrfs on LUKS with home, nix, and boot partitions; encrypted swap
• Boot: systemd-boot with EFI, latest kernel

Reinstall on a fresh machine

Boot the NixOS installer ISO, connect to the network, then:

nix-shell -p just git 
git clone https://github.com/lunixose/lunatix
cd lunatix
just bootstrap

lsblk -o NAME,SIZE,TYPE,MODEL,SERIAL

Stash the LUKS passphrase where disko expects it while formatting. This is used only during formatting — boot still prompts interactively:

echo -n 'your-passphrase' > /tmp/secret.key

Partition, format and mount the disk at /mnt. This is DESTRUCTIVE — it wipes the target disk:

just disko-format

Install the system onto the freshly mounted /mnt:

just install
just switch

Desktop

Both a Wayland and an X11 desktop are configured:

• KDE Plasma 6 with the SDDM display manager
• Hyprland, configured in Lua, with the Noctalia shell (Catppuccin Pink)

Oracle VPS

oracle (aarch64-linux) is a headless server deployed onto an Oracle Cloud free-tier instance. It ships SSH + firewall only; services (PiHole, Forgejo, Syncthing, Caddy) are added as aspects later.

Bootstrapping from the stock Ubuntu image (one time):

# 1. Capture the instance host key — this becomes the agenix rekey recipient.
ssh-keyscan <oracle-ip> | grep ed25519 > modules/community/lix/hardware/oracle.pub

# 2. Deploy NixOS over SSH. Oracle logs in as `ubuntu` (passwordless sudo).
#    nixos-anywhere downloads the aarch64 kexec image, builds the closure on
#    the instance (--build-on remote), and --copy-host-keys keeps the host key
#    so secrets decrypt on first boot.
just deploy-oracle ubuntu@<oracle-ip>

Secrets use agenix-rekey: edit with the master identity, rekey to each host's key at build time. See justfile (secret, rekey).

Diagrams

The den framework exposes an aspect-resolution graph for every host. This repo builds Mermaid diagrams for it via den-diagram:

nix build .#diag-igloo    # host-level aspect resolution
nix build .#diag-fleet    # fleet-wide Sankey

Each result is a plain .mmd text file under result/. Paste it into any Mermaid renderer (GitHub markdown, mermaid.live) or pipe through mmdc for SVG:

nix run nixpkgs#mermaid-cli -- -i result/diag-igloo.mmd -o diag-igloo.svg

Usage

Build and switch the host configuration:

just build           # build only
just switch          # build and activate

Test changes in a VM before applying them to hardware:

nix run .#vm

The flake file is generated by flake-file. After changing flake inputs declared inside modules, regenerate it:

nix run .#write-flake