ryan4yin | 二花
e37042f61c
* feat(hosts): per-host restic backups to the SMB remote Replace the disabled aggregate job (which rsynced every host's /persistent into /tmp - a tmpfs - and silently produced incomplete backups) with one restic repo per host, backing up its own data directly: - shared module lib/genResticBackup.nix: secrets, rclone/SMB target (rclone:smb-downloads:/Downloads/homelab-backup/<host>), retention, and excludes for the regenerable/bulky paths (podman overlay layers, microvm and libvirt disk images, nfs golden images, logs, caches) - youko additionally backs up the service state under /persistent/var/lib and dumps all postgres databases first (a consistent SQL artifact beside the crash-consistent data dir) - shoryu/shushou back up /etc/agenix, /etc/ssh and the k3s token Needs three agenix secrets before it can run: restic-password, ssh-key-for-restic-backup and rclone-conf-for-restic-backup. * refactor(hosts): only restic does off-host; btrbk stays local btrbk works at the subvolume level, so a would ship the whole @persistent - including podman's overlay storage, the microVM/libvirt images and the nfs golden images - which is exactly the regenerable bulk we want out of the backups. So: btrbk keeps making the cheap local CoW snapshots (quick rollbacks), and restic owns the off-host copies with file-level excludes. Back up the whole /persistent minus those excludes, so nothing is missed. Update the btrbk module's comment to say so. * fix(restic): never back up keys; drop the implicit /etc/agenix restic's own password lives in /etc/agenix, so backing that up would store the repository's password inside the repository. Exclude agenix, the ssh host keys and the usual credential dirs (.ssh, .gnupg, .aws, gcloud). * refactor(restic): make the backup a proper module Replace lib/genResticBackup.nix with modules/nixos/base/restic-backup.nix, which declares modules.restic-backup options (enable, repository, paths, exclude, requiresMountsFor, postgresDump) like the btrbk module does. youko just sets the options now. * refactor(restic): exclude the whole podman storage, trim retention Exclude /persistent/var/lib/containers wholesale: the image layers are re-pullable and podman's storage DB is not consistent when copied from a running podman. uptime-kuma's named volume lives there, but its data is not wanted anyway. Retention: daily 3, weekly 2, monthly 2 - no yearly. * refactor(restic): back up a short-lived btrfs snapshot, drop pg_dump A live copy of a running postgres data dir is only crash-consistent. Instead of a daily pg_dumpall (which duplicates the data in the repository and gets slower as the DB grows), take a short-lived read-only btrfs snapshot in backupPrepareCommand, back that up, and delete it right after - a consistency step, not a second backup. The excludes are relative now so they work for both the snapshot and a direct path. * feat(secrets): restic-password for modules.restic-backup With the rekeyed secret in nix-secrets (storage group, alongside hdd-luks-crypt-key), the module's passwordFile resolves. * fix(restic): agenix's secret is under /run/agenix, not /etc/agenix * fix(restic): take the password path from agenix, not a hardcoded one config.age.secrets."restic-password".path follows agenix's secretsDir, so it stays correct if that changes.
❄️ Ryan4Yin's Nix Config ❄️
My configuration is becoming more and more complex, and it will be difficult for beginners to read. If you are new to NixOS and want to know how I use NixOS, I would recommend you to take a look at the ryan4yin/nix-config/releases first, check out to some simpler older versions, such as i3-kickstarter, which will be much easier to understand.
This repository is home to the Nix code that builds all of my systems:
- NixOS desktops — Home Manager, Niri (Wayland), the Noctalia shell, agenix.
- macOS desktops — nix-darwin + Home Manager, sharing the same
home/configuration with the NixOS desktops. - NixOS servers — three physical mini PCs running the VMs (libvirt and microVMs), the K3s test cluster and the self-hosted services.
See ./hosts for the host inventory, ./outputs for how the flake outputs are composed, and ./AGENTS.md for the repository conventions.
Why NixOS & Flakes?
Nix allows for easy-to-manage, collaborative, reproducible deployments. This means that once something is setup and configured once, it works (almost) forever. If someone else shares their configuration, anyone else can just use it (if you really understand what you're copying/referring now).
As for Flakes, refer to Introduction to Flakes - NixOS & Nix Flakes Book
Want to know NixOS & Flakes in detail? Looking for a beginner-friendly tutorial or best practices? You don't have to go through the pain I've experienced again! Check out my NixOS & Nix Flakes Book - 🛠️ ❤️ An unofficial & opinionated 📖 for beginners!
If you're using macOS, check out ryan4yin/nix-darwin-kickstarter for a quick start.
Components
| NixOS (Wayland) | |
|---|---|
| Display Manager | greetd + tuigreet |
| Window Manager | Niri |
| Desktop Shell | Noctalia — bar/notifications/launcher/lock screen/control center/power menu/screenshots, one native shell |
| Terminal Emulators | foot, Kitty, Alacritty, Ghostty |
| Terminal Multiplexer | Zellij |
| Shell | Nushell + Starship |
| Editors / IDE | Zed (GUI, primary), VS Code (GUI); Helix (TUI, primary), Neovim (TUI, backup) |
| Color Scheme | catppuccin-nix |
| Networking | systemd-networkd / NetworkManager |
| Input Method | Fcitx5 + rime + 小鹤音形 flypy |
| System Monitor | Btop (+ Noctalia's built-in sysmon widgets) |
| File Manager | Yazi (TUI) + thunar (GUI) |
| Media Player | mpv |
| Image Viewer | imv |
| Screenshots | Native Noctalia capture: region / fullscreen / display picker, with a built-in annotation editor |
| Screen Recording | OBS, gpu-screen-recorder, wf-recorder |
| Fonts | Nerd fonts |
| Filesystem & Encryption | tmpfs as /, Btrfs subvolumes on a LUKS encrypted partition for persistent data; unlock via passphrase |
| Secure Boot | lanzaboote |
Wallpapers: https://github.com/ryan4yin/wallpapers
Screenshots
Editors / IDE
- Terminal editors: ./home/base/core/editors/ — Helix / Neovim,
$EDITOR, docs. - GUI editors: Zed (primary) and VS Code.
- LLM coding agents: ./agents — rules, installers, CLI snippets; see ./agents/README.md.
Secrets Management
See ./secrets for details.
How to Deploy this Flake?
🔴 IMPORTANT: You should NOT deploy this flake directly on your machine ❗ It will not succeed. This flake contains my hardware configuration (such as hardware-configuration.nix, Nvidia support, etc.) which is not suitable for your hardware, and requires my private secrets repository ryan4yin/nix-secrets to deploy. You may use this repo as a reference to build your own configuration.
Run just --list to see every recipe.
For NixOS:
To deploy this flake from NixOS's official ISO image (purest installation method), please refer to ./nixos-installer/
# Desktops: deploy the <hostname>-niri nixosConfiguration (e.g. ai-niri, shoukei-niri)
just niri # equals `sudo nixos-rebuild switch --flake .#<hostname>-niri`
just niri boot # set as the next boot configuration without switching
just niri switch debug # detailed output
# Other hosts (servers, VMs): deploy the nixosConfiguration matching the bare hostname
just local
just local boot
just local switch debug
For macOS (nix-darwin):
# If you are deploying for the first time,
# 1. install nix & homebrew manually.
# 2. prepare the deployment environment with essential packages available
nix-shell -p just nushell
# 3. comment home-manager's code in lib/macosSystem.nix to speed up the first deployment.
# 4. comment out the proxy settings in scripts/darwin_set_proxy.py if the proxy is not ready yet.
# Deploy the darwinConfiguration by hostname match (fern, frieren)
just local
just local debug # detailed output (macOS has no switch/boot mode)
Remote / cluster hosts are deployed with Colmena on top of
the same flake, e.g. just col <tag>, just k3s-test, just lab.
What y'all will need when Nix drives you to drink. (copy from hlissner's dotfiles, it really matches my feelings when I first started using NixOS...)
Validation & Development
nix develop provides the formatters and linters used by the repository. The most useful commands:
just test # eval tests across Linux & Darwin; the output must be `true`
just fmt # format all Nix files with nixfmt
just --list # all recipes
nix flake check # broader flake checks
For Nix changes, run just test and inspect just fmt's diff before committing. Non-Nix files are
formatted with prettier; spelling is checked with typos.
References
Other dotfiles that inspired me:
- Nix Flakes
- NixOS-CN/NixOS-CN-telegram
- notusknot/dotfiles-nix
- xddxdd/nixos-config
- bobbbay/dotfiles
- gytis-ivaskevicius/nixfiles
- davidtwco/veritas
- gvolpe/nix-config
- Ruixi-rebirth/flakes
- fufexan/dotfiles: gtk theme, xdg, git, media, etc.
- nix-community/srvos: a collection of opinionated and sharable NixOS configurations for servers
- Modularized NixOS Configuration
- Neovim / AstroNvim
- maxbrunet/dotfiles: astronvim with nix flakes.
- Misc