services.jellyfin = {
enable = true;
};
# Disable service on startup
systemd.services.jellyfin.wantedBy = lib.mkForce [ ];You can change jellyfin to the service name of whichever service you wish to disable on startup.
Please note:
{ config, pkgs, lib, ... }:
{
users.users = {
exampleuser = {
uid = 1005;
};
};
virtualisation.oci-containers.containers = {
exampleservice = {
environment = {
PUID = builtins.toString config.users.users.exampleuser.uid;
};
};
};
}nixos-rebuild switch -I nixos-config=$(pwd)/configuration.nix{
# ...
fileSystems = builtins.mapAttrs (name: value: {
device = "//${value.storageUser}.your-storagebox.de/${value.storageUser}";
fsType = "cifs";
mountPoint = name;
options = [
# https://wiki.nixos.org/wiki/Samba#CIFS_mount_configuration
"x-systemd.automount"
"noauto"
"x-systemd.idle-timeout=60"
"x-systemd.device-timeout=5s"
"x-systemd.mount-timeout=5s"
"credentials=${value.credentials}"
# https://docs.hetzner.com/robot/storage-box/access/access-samba-cifs#encrypt-samba-connection
"iocharset=utf8"
"rw"
"nofail"
"seal"
# Custom
"mfsymlinks"
"uid=${value.uid}"
"gid=${value.gid}"
"file_mode=0740"
"dir_mode=0740"
];
}) {
"/mnt/storage-1" = {
storageUser = "uxxxxxx-sub1";
credentials = "/home/user/sb-1.conf";
uid = builtins.toString config.users.users.foo.uid;
gid = builtins.toString config.users.groups.users.gid;
};
"/mnt/storage-2" = {
storageUser = "uxxxxxx-sub2";
credentials = "/home/user/sb-2.conf";
uid = builtins.toString config.users.users.bar.uid;
gid = builtins.toString config.users.groups.users.gid;
};
"/mnt/storage-2" = {
storageUser = "uxxxxxx-sub4";
credentials = "/home/user/sb-3.conf";
uid = builtins.toString config.users.users.example.uid;
gid = builtins.toString config.users.groups.users.gid;
};
};
# ...
}Remote/target server configuration.nix:
{
nix.settings.trusted-users = [ "yourname" ];
}Make sure to use nixos-rebuild switch at least once after adding this line, otherwise it won't take effect and your remote build will be blocked.
Device to build on:
nixos-rebuild switch --use-remote-sudo --target-host yourname@example.com -I nixos-config=$(pwd)/configuration.nixNix will - sadly - expose any direct text passed in your nix files. To circumvent this for sensitive data, secret managing schemes can be used.
services.caddy = {
enable = true;
package = pkgs.caddy.withPlugins {
plugins = [ "github.com/caddy-dns/porkbun@v0.3.1" ];
hash = "sha256-YZ4Bq0hfOJpa0C2lKipEY4fqwzJbEFM7ci5ys9S3uAo=";
};
globalConfig = ''
acme_dns porkbun {
api_key {$CADDY_API_KEY}
api_secret_key {$CADDY_API_SECRET_KEY}
}
'';
virtualHosts = {
"example.com".extraConfig = ''
reverse_proxy 127.0.0.1:5000
'';
};
};
systemd.services.caddy.serviceConfig.EnvironmentFile = ["/path/to/.env.caddy"];# /path/to/.env.caddy
CADDY_API_KEY=YOUR_KEY
CADDY_API_SECRET_KEY=YOUR_OTHER_KEY# configuration.nix
# _module.args import
{ config, lib, pkgs, ssh_keys, ... }:
{
# File import itself
imports = [
./base-config.nix
];
users.users.yourname = {
uid = 1001;
isNormalUser = true;
extraGroups = [ "wheel" ];
openssh.authorizedKeys.keys = ssh_keys;
packages = with pkgs; [
htop
] ++ extraPackages;
};
}# base-config.nix
{ config, pkgs, ... }:
{
_module.args = {
# If this file is imported, the following imports become available
ssh_keys = [ "ssh-ed25519 +5MWqxhi... user@device" "ssh-ed25519 AAAA... user2@device2"];
extraPackages = (with pkgs; [
ffmpeg-full
]);
};
# If this file is imported, the settings below will be applied to your configuration automatically
services.xserver.xkb = {
layout = "be";
variant = "nodeadkeys";
};
time.timeZone = "Europe/Brussels";
i18n.defaultLocale = "en_GB.UTF-8";
console.keyMap = "be-latin1"; # Configure console keymap
}# Apply /etc/configuration.nix immediately
sudo nixos-rebuild switch
# Apply /etc/configuration.nix on next boot
sudo nixos-rebuild boot
# Create a temporary shell environment with the specified packages
nix-shell -p wget nodejs_22 yarn
# Switch to a system user/consistent path to executables
sudo su lauti -s /run/current-system/sw/bin/bashNote: sudo is usually needed for NixOS installations in the commands below. Check if the first command returns a valid url without using sudo. If yes, you probably don't have to/shouldn't use sudo from the following commands!
# View current NixOS channel
sudo nix-channel --list | grep nixos
# Set new NixOS channel/upgrade NixOS
sudo nix-channel --add https://channels.nixos.org/nixos-25.11 nixos
# Rebuild with --upgrade, set on boot to be thorough
sudo nixos-rebuild boot --upgrade
# Reboot the system
sudo reboot nowYou can view the latest stable channel from the manual link below or checking the channel options in search.nixos.org!
{ config, pkgs, ... }:
let
unstable = import (builtins.fetchTarball
"https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz"
) {
config.allowUnfree = true;
};
in
{
# Method 1: singular package from another channel
environment.systemPackages = with pkgs; [
alacritty # Default channel
unstable.hyprlock # From unstable
] ++ (with unstable; [
# Method 2: Multiple packages from another channel
stremio-linux-shell
discord
]);
}