NixOS config

Secrets

There are two types of secrets in this repository. Secret secrets, and secret configuration.

Secret secrets should never be world-readable, even to users who are logged in to one of the hosts managed by this configuration. These are generally managed by agenix, allowing them to still be put in the nix store.

Secret configuration is generally more security through obscurity (e.g. some services that I run that I don't want the whole world to know what ports they run on). These are managed with git-crypt and are files that end in secret.nix.

Setting up a new dev environment

• Create a new *.nix file in the shells directory that describes the environment (this is the hard part).

• Execute use_nix > .envrc to initialize the .envrc file.

• Execute ln -s /path/to/correct/file.nix shell.nix.

• Execute direnv allow to load the .envrc file which in turn loads your environment.