NixOS System Configuration

This repository is a Nix Flake that manages the complete, declarative configuration of all my personal machines — development workstations and a homelab server — from a single, version-controlled source of truth. Each host is defined as a NixOS configuration module that composes shared profiles (desktop environment, development tools, security hardening) with host-specific settings, making it straightforward to keep multiple machines consistent or diverge them intentionally.

The homelab server runs a set of self-hosted services deployed as NixOS containers, isolated from each other and from the host. Networking between containers and to the outside is managed through a VPN (WireGuard), with firewall rules derived directly from the NixOS configuration. Secrets such as API keys, database passwords, and VPN private keys are encrypted at rest using SOPS (Secrets OPerationS) and decrypted at activation time, so no plaintext secrets ever land in the Nix store.

Automated backups are configured declaratively via restic jobs that snapshot container volumes and push them to an off-site location on a defined schedule. The entire setup — from partitioning to running services — can be reproduced on new hardware by running nixos-anywhere with the flake reference, making disaster recovery a matter of minutes rather than hours.