❄️ Curious's Nix Config

Personal NixOS, Home Manager and nix-on-droid configurations, managed with Flakes.

Tech Stack

• Lix - A delicious Nix fork
• flake-parts - Flake module system
• vaultix - Secret management
• preservation - Opt-in state preservation
• disko - Declarative disk partitioning
• lanzaboote - Secure boot
• treefmt-nix - All-in-one formatter
• devenv - Developer environments
• Cachix - Binary cache for CI and local machines
• RS-Key - Security key. FIDO/OpenPGP firmware for RP2350

Project Structure

• nixos/: NixOS system configurations
• home-manager/: Standalone Home Manager configurations
• nix-on-droid/: nix-on-droid configurations for Android
• modules/: Reusable Nix modules (NixOS, Home Manager, flake-parts)
• pkgs/: Custom packages (currently an empty scaffold)
• overlays/: Nixpkgs overlays
• secrets/: Encrypted secrets, managed by vaultix

Hosts

Hostnames follow <category>-<brand>-<model>[-<suffix>]. The last segment only appears when there are multiple machines of the same model.

NixOS

• Laptop-Legion-R7000: Main laptop
• Server-IdeaPad-G480: Home server
• Router-RaspberryPi-4B-1: Raspberry Pi 4B router

nix-on-droid

• Phone-Redmi-K50Pro: Personal phone
• Pad-Vivo-3Pro: Tablet

CI/CD

The build matrix is generated from the ci.jobs flake output. Its machine list comes directly from nixosConfigurations, homeConfigurations and nixOnDroidConfigurations, so adding a machine requires no CI changes.

• CI: gitleaks secret scan, flake.lock health check, actionlint, nix flake check (including aarch64-linux evaluation)
• Build: covers every NixOS toplevel, Home Manager activation and nix-on-droid activation; runs only when a commit touches build-related paths (workflow_dispatch forces a full run); aarch64 machines build on arm64 runners
• Build outputs are pushed to curious.cachix.org, so local nixos-rebuild / home-manager switch / nix-on-droid runs pull them directly
• Update flake.lock: weekly flake.lock update PR
• Dependabot: weekly updates for GitHub Actions

---