NixOS Config Breakdown

Architecture Philosophy

My infrastructure follows a “think zen garden, not herd” philosophy. Rather than managing dozens of independent servers with disparate configs, I use NixOS Flakes and Modules to maintain a single source of truth for every system.

Core Principles

1. Declarative — Every system’s state is defined in code. No manual changes on running servers.
2. Reproducible — Copy a system’s config, rebuild, and get an identical system.
3. Modular — Common settings live in shared modules; system-specific settings override as needed.
4. Version-controlled — The entire OS lives in Git. Changes are reviewed, committed, and deployed.
5. Atomic — New configurations are evaluated before activation. Rollback is instant.

Host Breakdown

command — Bare-Metal Host

The physical machine (Gigabyte NUC) running the hypervisor. It hosts:

• VM Workstation — Primary development environment with GPU/USB passthrough
• Client VMs — Isolated environments for each project/client
• Bare-metal services — MySQL, Postgres, Gitea, Nextcloud, Grafana

1
2
3
4
5
6
7
# command/hosts/command/default.nix
{
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  networking.hostName = "command";
  # ... VM configuration, GPU passthrough, etc.
}

giga — Workstation VM

My daily driver VM with GPU and USB passthrough. The GPU outputs directly to the monitor, so the VM feels native. SSH from here to any other host in the fleet.

1
2
3
4
5
6
7
8
9
# hosts/giga/default.nix
{
  networking.hostName = "giga";
  programs.fish.enable = true;
  environment.systemPackages = with pkgs; [
    neovim tmux fish bat fd ripgrep eza
  ];
  # ... desktop environment, GPU config
}

vpn — VPN Gateway (Oracle Free Tier)

The backbone of my network. Routes all traffic through WireGuard to a West Montreal datacenter.

• AmneziaWG — Encrypted WireGuard with jitter for anti-detection
• Unbound — Encrypted DNS resolver (ISPs can’t see what sites you visit)
• AdGuard Home — DNS-level ad blocking
• 2 WireGuard interfaces — One for personal network, one for family

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
# hosts/vpn/default.nix
{
  networking.hostName = "vpn";
  networking.nat.enable = true;
  networking.nat.externalInterface = "eth0";
  
  wg-quick.interfaces.wg0 = {
    type = "amneziaWG";
    listenPort = 41020;
    peers = [
      { # captain (workstation)
        publicKey = "...";
        allowedIPs = [ "11.0.0.2/32" ];
      }
      { # command (bare-metal)
        publicKey = "...";
        allowedIPs = [ "11.0.0.3/32" ];
      }
      # ... more peers
    ];
  };
  
  services.unbound = {
    enable = true;
    settings = {
      # Forward all DNS through Quad9 and Cloudflare over TLS
      forward-zone = [{
        name = ".";
        forward-tls-upstream = "yes";
        forward-addr = [
          "149.112.112.112@853#dns.quad9.net"
          "1.0.0.1@853#one.one.one.one"
        ];
      }];
    };
  };
}

mail — Mail/Proxy Server (Oracle Free Tier)

Self-hosted mail server with full email stack.

• NixOS Mailserver — Postfix, Dovecot, OpenDKIM, OpenDMARC
• Nginx — Reverse proxy for internal services
• Btrfs — Automated scrubbing with zstd compression
• DMARC reporting — Full email authentication and reporting

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
# hosts/mail/default.nix
{
  networking.hostName = "mail";
  
  mailserver = {
    enable = true;
    fqdn = "mail.ymrtech.com";
    domains = [ "ymrtech.com" ];
    loginAccounts = {
      "yannick@ymrtech.com" = {
        hashedPasswordFile = "/etc/nixos/ymrtechemail";
      };
    };
    fullTextSearch.enable = true;
    dmarcReporting.enable = true;
  };
  
  services.nginx.virtualHosts."mail.ymrtech.com" = {
    enableACME = true;
    forceSSL = true;
  };
}

public — Public Services (Oracle Free Tier)

The public-facing server hosting all external services.

• Uptime Kuma — Monitoring dashboard
• Nextcloud — File sync/backup
• Ghost — Blog/content management
• Syncthing — Device-to-device sync
• All behind WireGuard — No ports open to the internet

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
# hosts/public/default.nix
{
  networking.hostName = "public";
  
  services = {
    uptime-kuma.enable = true;
    syncthing.enable = true;
    
    nginx.virtualHosts = {
      "nextcloud.ymrtech.com" = { proxyPass = "http://11.0.0.2/"; };
      "ghost.ymrtech.com" = { proxyPass = "http://11.0.0.2:2368"; };
      "uptime.ymrtech.com" = { proxyPass = "http://localhost:3001/"; };
    };
  };
}

Shared Infrastructure

Common Modules (hosts/common/)

All hosts inherit these shared configurations:

• Fish shell with autocompletion
• Btrfs auto-scrub with zstd compression
• OpenSSH with password authentication disabled
• Automatic upgrades with rollback support
• Monitoring agents (VictoriaMetrics, VMAgent)

Monitoring Stack

Security Features

• WireGuard encryption across all internal traffic
• AmneziaWG with jitter for anti-detection on public endpoints
• Encrypted DNS via Unbound + Quad9/Cloudflare over TLS
• DMARC/DKIM/SPF for email authentication
• Btrfs encryption on sensitive filesystems
• Zstd compression on all filesystems (security through obscurity + performance)