ark #

NixOS and home-manager configurations, packages and modules.

Source of truth #

Ark is the canonical flake. Keep host changes here rather than rebuilding from an old nixcfg checkout or a migration worktree.

Valefar's configuration is hosts/valefar/; on the host this repo is checked out (branch terra) at ~/.config/nixos, and /etc/nixos only holds a pointer note. Its RustFS credentials stay encrypted in secrets/rustfs-credentials.env.age; its service refuses to start unless /rustfs is mounted. Keep the existing system generation for rollback.

Focalor (hosts/focalor/) is set up the same way: ark at ~/.config/nixos, a pointer note in /etc/nixos, deployed with nix run .#deploy -- focalor --target-build.

Build on an x86_64 Linux machine: some inputs use Linux import-from-derivation, so evaluating these hosts on macOS can fail with a platform mismatch.

nix build --no-write-lock-file --no-link --print-out-paths \
  .#nixosConfigurations.valefar.config.system.build.toplevel
nix eval --no-write-lock-file --raw \
  .#nixosConfigurations.focalor.config.system.build.toplevel.drvPath

After reviewing the build and service changes, deploy Valefar from this checkout:

nix run .#deploy -- valefar --target-build

The default is a live switch, not a reboot. That is only safe when the kernel and the nvidia driver are unchanged: a live switch swaps the userspace driver under the already-loaded kernel module and breaks the GPU (and skews zfs). Compare first, and use --boot plus a planned reboot (VMs and services go down) when either moves:

nix store diff-closures /run/current-system "$new" | rg 'linux-6|nvidia|zfs'

After a reboot into a new generation, if you pinned the old one as a fallback with bootctl set-default, run sudo bootctl set-default '' once it is healthy. A left-over EFI default overrides the loader.conf nixos writes, so later deploys would still boot the pinned generation.

A failed agenix secret does not fail the switch. After deploying, check that every secret in hosts/valefar/secrets.nix exists under /run/agenix; a missing pia-wireguard-auth.env leaves the two PIA containers failing to start.

Valefar services outside this repo #

• Bonsai 2 27B (hosts/valefar/bonsai.nix, package terra.llama-cpp-bonsai): bonsai2.service serves it on 127.0.0.1:8899 and a socket exposes it on the LAN and tailnet addresses without an API key, since the host firewall is off. The weights are not in the store: ~/models/bonsai2-27b/Ternary-Bonsai-2-27B-PTQ1_0-mtp-lean.gguf (sudoingX's MTP graft; the other quants are in /storage/models/bonsai2-27b/).
• Spindle (hosts/valefar/spindle.nix, ci.klbr.net) and its ncps binary cache keep their state in the hand-made datasets rustfs/spindle (quota 400G) and rustfs/nix-cache (quota 200G). ci.klbr.net reaches it through trimounts: spindle-tunnel holds the private half of the key hosts/trimounts/modules/spindle.nix authorizes, so rotating that key needs a trimounts deploy too.
• VM disks (niri, dawn) are Proxmox state in /etc/pve, not nix. Both live on the HBAdrive storage (/storage).
• storage zpool is two partitions of one 8 TB SAS disk striped together, so there is no redundancy; only the rustfs pool is on a different disk. Its USB/SAS adapter (152d:0562) uses bulk-only transport via usb-storage.quirks=152d:0562:u. Keep that quirk: capacity and file reads were verified at 5 Gbps with usb-storage, while the initial UAS connection failed. ZFS already imports the pool and uses its existing /storage mountpoint; no new filesystem or pool is needed.

The Yoga laptop runs Fedora, not NixOS. Its current desktop dotfiles are unmanaged; do not apply Valefar's NixOS configuration there. Moving them to home-manager is a separate change.