Entries

• Disabling a NixOS service on startup

  Solution

    services.jellyfin = {
      enable = true;
    };
    # Disable service on startup
    systemd.services.jellyfin.wantedBy = lib.mkForce [ ];

  You can change jellyfin to the service name of whichever service you wish to disable on startup.

• Referring to a user's UID in NixOS

  Solution

  Please note:

  • If referring to a user's UID this way, the UID needs to be explicitly defined (see example below)
  • This example also shows how to convert the UID to a string for services that need it

  { config, pkgs, lib, ... }:
  
  {
    users.users = {
      exampleuser = {
        uid = 1005;
      };
    };
  
    virtualisation.oci-containers.containers = {
      exampleservice = {
        environment = { 
          PUID = builtins.toString config.users.users.exampleuser.uid;
        };
      };
    };
  }

• nixos-rebuild: specify config

  Solution

  nixos-rebuild switch -I nixos-config=$(pwd)/configuration.nix

  Related:

  • NixOS: basic commands

• NixOS: mounting multiple Hetzner storageboxes

  Solution

  {
    # ...
    fileSystems = builtins.mapAttrs (name: value: {
      device = "//${value.storageUser}.your-storagebox.de/${value.storageUser}";
      fsType = "cifs";
        mountPoint = name;
        options = [
          # https://wiki.nixos.org/wiki/Samba#CIFS_mount_configuration
          "x-systemd.automount"
          "noauto"
          "x-systemd.idle-timeout=60"
          "x-systemd.device-timeout=5s"
          "x-systemd.mount-timeout=5s"
          "credentials=${value.credentials}"
          # https://docs.hetzner.com/robot/storage-box/access/access-samba-cifs#encrypt-samba-connection
          "iocharset=utf8"
          "rw"
          "nofail"
          "seal"
          # Custom
          "mfsymlinks"
          "uid=${value.uid}"
          "gid=${value.gid}"
          "file_mode=0740"
          "dir_mode=0740"
        ];
    }) {
      "/mnt/storage-1" = {
        storageUser = "uxxxxxx-sub1";
        credentials = "/home/user/sb-1.conf";
        uid = builtins.toString config.users.users.foo.uid;
        gid = builtins.toString config.users.groups.users.gid;
      };
      "/mnt/storage-2" = {
        storageUser = "uxxxxxx-sub2";
        credentials = "/home/user/sb-2.conf";
        uid = builtins.toString config.users.users.bar.uid;
        gid = builtins.toString config.users.groups.users.gid;
      };
      "/mnt/storage-2" = {
        storageUser = "uxxxxxx-sub4";
        credentials = "/home/user/sb-3.conf";
        uid = builtins.toString config.users.users.example.uid;
        gid = builtins.toString config.users.groups.users.gid;
      };
    };
    # ...
  }

• NixOS: Remote rebuild

  Solution

  Remote/target server configuration.nix:

  {
      nix.settings.trusted-users = [ "yourname" ];
  }

  Make sure to use nixos-rebuild switch at least once after adding this line, otherwise it won't take effect and your remote build will be blocked.

  Device to build on:

  nixos-rebuild switch --use-remote-sudo --target-host yourname@example.com -I nixos-config=$(pwd)/configuration.nix
  ``
  

  Related:

  • NixOS: basic commands

• NixOS: securely passing environment variables w/ Caddy quickstart

  Solution

  Nix will - sadly - expose any direct text passed in your nix files. To circumvent this for sensitive data, secret managing schemes can be used.

  services.caddy = {
      enable = true;
      package = pkgs.caddy.withPlugins {
        plugins = [ "github.com/caddy-dns/porkbun@v0.3.1" ];
        hash = "sha256-YZ4Bq0hfOJpa0C2lKipEY4fqwzJbEFM7ci5ys9S3uAo=";
      };
      globalConfig = ''
          acme_dns porkbun {
              api_key {$CADDY_API_KEY}
              api_secret_key {$CADDY_API_SECRET_KEY}
          }
      '';
      virtualHosts = {
          "example.com".extraConfig = ''
            reverse_proxy 127.0.0.1:5000
          '';
      };
  };
  systemd.services.caddy.serviceConfig.EnvironmentFile = ["/path/to/.env.caddy"];

  # /path/to/.env.caddy
  CADDY_API_KEY=YOUR_KEY
  CADDY_API_SECRET_KEY=YOUR_OTHER_KEY

• NixOS: Import nix files

  Solution

  # configuration.nix
  # _module.args import
  { config, lib, pkgs, ssh_keys, ... }:
  
  {
    # File import itself
    imports = [
      ./base-config.nix
    ];
    
    users.users.yourname = {
      uid = 1001;
      isNormalUser = true;
      extraGroups = [ "wheel" ];
      openssh.authorizedKeys.keys = ssh_keys;
      packages = with pkgs; [
        htop
      ] ++ extraPackages;
    };
  }

  # base-config.nix
  { config, pkgs, ... }:
  
  {
    _module.args = {
      # If this file is imported, the following imports become available
      ssh_keys = [ "ssh-ed25519 +5MWqxhi... user@device"  "ssh-ed25519 AAAA... user2@device2"];
      
      extraPackages = (with pkgs; [
        ffmpeg-full
      ]);
    };
  
    # If this file is imported, the settings below will be applied to your configuration automatically
    services.xserver.xkb = {
      layout = "be";
      variant = "nodeadkeys";
    };
  
    time.timeZone = "Europe/Brussels";
    i18n.defaultLocale = "en_GB.UTF-8";
    console.keyMap = "be-latin1";  # Configure console keymap
  }

• NixOS: basic commands

  Solution

  # Apply /etc/configuration.nix immediately
  sudo nixos-rebuild switch
  # Apply /etc/configuration.nix on next boot
  sudo nixos-rebuild boot
  
  # Create a temporary shell environment with the specified packages 
  nix-shell -p wget nodejs_22 yarn

  Related:

  • nixos-rebuild: specify config
  • NixOS: Remote rebuild