homelab

Flake-based NixOS config. Host: jupiter (ZimaBlade, NAS + services).

Structure

flake.nix                           # inputs (nixpkgs, disko) + nixosConfigurations
jupiter/configuration.nix           # real host: imports + bootloader + data mount
jupiter/disk-config.nix             # disko: OS-disk partitions + filesystems
jupiter/hardware-configuration.nix  # PLACEHOLDER — kernel modules, regenerate on target
jupiter/services.nix                # shared: users, ssh, samba, containers, caddy
jupiter/vm.nix                      # VirtualBox test image (jupiter-vbox)

Two configs from one service definition: jupiter (real host, disko-partitioned) and jupiter-vbox (test OVA). Both import services.nix.

Test in VirtualBox (no hardware needed)

nix build .#nixosConfigurations.jupiter-vbox.config.system.build.virtualBoxOVA
VBoxManage import result/*.ova --vsys 0 --vmname jupiter-vbox
VBoxManage startvm jupiter-vbox --type headless

Login darman / test. Forward ports with VBoxManage modifyvm ... --natpf1.

First install on the ZimaBlade — nixos-anywhere + disko

Wipes the OS disk and installs the flake over SSH. No USB needed if the box already runs Linux (ZimaOS) reachable by root SSH — nixos-anywhere kexecs into an installer, partitions via disko, installs.

⚠️ The OS disk in disk-config.nix is WIPED. Set device to the OS disk ONLY (by-id). Back up / physically identify the NAS data disk first — it must NOT appear in disko. lsblk -o NAME,SERIAL,SIZE,MODEL to identify.

1. Set the real OS disk id in jupiter/disk-config.nix (ls -l /dev/disk/by-id), and the data-disk mount in configuration.nix.
2. Add your SSH pubkey to users.users.darman.openssh.authorizedKeys.keys.
3. Wire the samba secret (see Notes) — real password, not the VM's plaintext.
4. Run from your laptop:

   nix run github:nix-community/nixos-anywhere -- \
     --flake .#jupiter \
     --generate-hardware-config nixos-generate-config ./jupiter/hardware-configuration.nix \
     --target-host root@<zimablade-ip>
   

   --generate-hardware-config pulls the target's real kernel modules into the placeholder for you. Commit the result. Reboot into NixOS.

Manual alternative (USB ISO): boot installer, disko the disk, then nixos-install --flake .#jupiter.

Rebuild after changes (the daily loop)

# from laptop, build + activate on jupiter over SSH:
nixos-rebuild switch --flake .#jupiter \
  --target-host darman@jupiter --use-remote-sudo

Rollback: nixos-rebuild switch --rollback, or pick a prior generation at boot.

Adding a service

Copy the whoami block in oci-containers.containers, swap image/ports/volumes. Native NixOS module exists for many apps (Nextcloud, Jellyfin, Grafana...) — prefer services.<app> over a container when available. Add a caddy virtualHosts block to expose it.

Notes

• Backend is Podman with dockerCompat — docker CLI works, no daemon.
• Samba keeps its own password DB. services.samba never sets it; a systemd oneshot (samba-smbpasswd) provisions it from /etc/samba/smb-password. Real host: supply that file via sops-nix / agenix, never commit plaintext.
• Data disk: plain fileSystems."/mnt/data" in configuration.nix — kept out of disko so it is never formatted. Reference by by-id / by-uuid.
• system.stateVersion = 26.05, install-time schema. Do NOT bump on upgrades.
• Terraform is not used: a single bare-metal box has no provider API. disko + nixos-anywhere cover provisioning natively.