molly's nixos config #

One flake managing three x86_64-linux hosts:

host	role	Mycelium IPv6
chi	Framework 12 laptop — Niri + Noctalia, Stylix theming, Home Manager desktop	5ec:6edc:7495:220e:6f58:1bae:13be:cbf5
halo	Strix Halo server — public edge (Caddy/Cloudflare), identity (ratlogin), pubnix, Tangled git, LLM gateway	517:1053:3359:7f4a:8994:c16:4241:e900
misty	Media/storage — Jellyfin + *arr, Navidrome, Seerr, Nextcloud, Invidious, Harmonia binary cache, Nix builder	45a:adb:d00f:1128:b131:a28:551b:c1da

Clan Core manages the controller-free Mycelium mesh. Iroh provides a separate NAT-traversing SSH/deployment path to halo and misty; see NETWORK.md.

The canonical repository lives on Tangled: https://tangled.org/molly.computer/nixos.

layout #

flake.nix            — inputs and the chi/halo/misty configurations
inventory.nix        — Clan fleet registry and service roles
keys.nix             — central SSH public keys
hosts/chi/           — Framework 12 config, desktop modules, hardware
hosts/halo/          — pubnix server config
hosts/misty/         — media server config
users/<person>/      — account definitions (declared once; rosters opt in)
modules/             — shared + per-service modules (caddy, auth, media, …)
home/                — chi Home Manager modules
pkgs/                — locally packaged software
patches/             — patches for upstream packages
static/              — served assets (logos, fonts)
images/              — misty installer image
scripts/             — one-shot operational scripts
secrets/             — SOPS-encrypted credentials only; never store plaintext

hosts/*/hardware-configuration.nix is generated by nixos-generate-config and is intentionally excluded from the formatter. Keep it byte-identical unless the hardware itself changes.

services #

halo is the only public edge; everything below is fronted by its Caddy (modules/caddy.nix). "ratlogin (proxy)" means an oauth2-proxy guard sits in front of an app with no SSO of its own; "ratlogin (OIDC)" means the app authenticates against ratlogin itself. Services marked misty are reached from halo over Mycelium.

Endpoint	Service	Auth
daze.lol, tilde.daze.lol	pubnix landing page	public
tilde.daze.lol/~user	per-user websites (/home/<user>/public_html)	public
tilde.daze.lol/users	generated member directory	public
*.daze.lol	per-user vanity domains + ATProto handle records	public
planet.daze.lol	aggregated member blogs (+ atom.xml)	public
search.daze.lol	SearXNG	public
paste.daze.lol	Microbin pastebin and file host	public
rsshub.daze.lol	RSSHub feed generator	public
scryphil.daze.lol	static site	public
auth.daze.lol	ratlogin, the OIDC provider	ATProto OAuth
pds.daze.lol	Tranquil PDS	ATProto
hold.daze.lol	ATCR container registry	ATProto
cdn.daze.lol	Garage S3 (Hold blob downloads)	internal
knot.daze.lol	Tangled knot (git)	Tangled DID
spindle.daze.lol	Tangled spindle (CI)	Tangled DID
code.daze.lol	Forgejo	ratlogin (OIDC)
tasks.daze.lol	Vikunja	ratlogin (OIDC)
game.daze.lol	RomM ROM library and web emulator	ratlogin (OIDC)
yt.daze.lol	Invidious (misty)	ratlogin (OIDC)
video.daze.lol	Jellyfin (misty)	ratlogin (OIDC, in-app plugin)
requests.daze.lol	account request portal	ratlogin (proxy)
dash.daze.lol	homepage dashboard	ratlogin (proxy)
music.daze.lol	Navidrome (misty)	ratlogin (proxy)
files.daze.lol	FileBrowser (misty)	ratlogin (proxy)
niri.daze.lol	niri agent harness UI	ratlogin (proxy)
pds-admin.daze.lol	PDS Operator	ratlogin (proxy)
route.daze.lol/ui	CLIProxyAPI management UI	ratlogin (proxy)
route.daze.lol	CLIProxyAPI LLM gateway (/zeta/*, /zeta-lsp/*)	API key
chat.daze.lol	Open WebUI (route + OpenRouter ZDR models)	WebUI account
cloud.daze.lol	Nextcloud (misty)	Nextcloud account
seerr.daze.lol	Seerr requests (login shim)	Jellyfin Quick Connect

Non-HTTP listeners on halo, opened in modules/hardening.nix:

Listener	Service	Auth
gemini://gemini.daze.lol/~user/ (:1965)	Agate capsules	public
gopher://gopher.daze.lol/1/~user/ (:70)	geomyidae holes	public
irc.daze.lol:6697 (+ gamja over /socket)	soju bouncer	soju accounts
:4567 (TCP/UDP)	i2pd router and tilde eepsite	loopback proxies
:4242, :2965, :29665	Reticulum TCP and AutoInterface	Reticulum

deploying #

Deployments originate from chi. Clan selects Iroh first and Mycelium as the fallback for halo and misty:

nix develop -c clan machines update halo
nix develop -c clan machines update misty

# chi is the local workstation
sudo nixos-rebuild switch --flake .#chi

checks #

nix fmt
nix flake check
for h in chi halo misty; do
  nix eval --raw .#nixosConfigurations.$h.config.system.build.toplevel.drvPath
done

The formatter is treefmt with Alejandra, Statix, and deadnix. nix flake check runs the formatting check and the package self-tests; evaluate each host separately after touching flake.nix, flake.lock, modules/common.nix, or shared inputs.

secrets #

SOPS with age. Only recipients, Clan's encrypted vars/, and ciphertext under secrets/ belong in Git; keep private keys outside the repository. halo and misty use their persistent SSH host keys as SOPS identities.

backups #

Clan borgbackup stores encrypted, deduplicated backups on misty under /var/lib/borgbackup/<host>. The clan.core.state folders declared on chi and halo are backed up daily at 01:00; halo stops its database-backed services for the duration of the run (see hosts/halo/configuration.nix) so the archives are consistent.

# on a client, back up now / list archives
sudo systemctl start borgbackup-job-misty.service
borg-job-misty list

agent browser vm #

misty runs one declarative NixOS MicroVM (hosts/misty/agent-browser.nix) with Chromium and Playwright for browser agents. Reach it through misty:

ssh -J molly@misty -p 10022 agent@127.0.0.1

Work persists in /workspace. The guest reaches the public internet but not the LAN, Mycelium, or misty's loopback, and its SSH port is bound to misty's loopback only. Chromium works headlessly and require("playwright-core") resolves; Google routinely serves its anti-bot CAPTCHA to automated/datacenter traffic, so use a signed-in profile or another engine when real Google results are needed.

model hosting (halo) #

halo serves local GGUF models (Qwen3.8-Flash, Qwen3-0.6B, Zeta) via llama.cpp for the route.daze.lol gateway. hosts/halo/models-paused.nix is a temporary override that removes those services and model closures; remove its import to resume.