NixOS Config Breakdown

Architecture Philosophy

My infrastructure follows a “think zen garden, not herd” philosophy. Rather than managing dozens of independent servers with disparate configs, I use NixOS Flakes and Modules to maintain a single source of truth for every system.

Core Principles

1. Declarative — Every system’s state is defined in code. No manual changes on running servers.
2. Reproducible — Copy a system’s config, rebuild, and get an identical system.
3. Modular — Common settings live in shared modules; system-specific settings override as needed.
4. Version-controlled — The entire OS lives in Git. Changes are reviewed, committed, and deployed.
5. Atomic — New configurations are evaluated before activation. Rollback is instant.

Host Breakdown

command — Bare-Metal Host

The physical machine running the hypervisor. It hosts:

• VM Workstation — Primary development environment with GPU/USB passthrough
• Client VMs — Isolated environments for each project/client

giga — Workstation VM

My daily driver

• Local LLM — Qwen3.6-35B-A3B-Uncensored-HauhauCS-Aggressive-Q4_K_M 131k context running on 3090 24gb egpu
• Gaming — Proton helps with gaming and other than my thermally throttling CPU, i game fine with my 3090
• Hermes Agent — Hermes agent running as a service accessible both locally via TUI, web, or desktop, and on my phone

vpn — VPN Gateway (Oracle Free Tier)

The backbone of my network. Routes all traffic through WireGuard to a West Montreal datacenter.

• AmneziaWG — Encrypted WireGuard with jitter for anti-detection
• Unbound — Encrypted DNS resolver (ISPs, govs, or corporations can’t see what sites you visit)
• AdGuard Home — DNS-level ad blocking

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
# hosts/vpn/default.nix
{
  networking.hostName = "vpn";
  networking.nat.enable = true;
  networking.nat.externalInterface = "eth0";
  
  wg-quick.interfaces.wg0 = {
    type = "amneziaWG";
    listenPort = 41020;
    peers = [
      { # captain (workstation)
        publicKey = "...";
        allowedIPs = [ "11.0.0.2/32" ];
      }
      { # command (bare-metal)
        publicKey = "...";
        allowedIPs = [ "11.0.0.3/32" ];
      }
      # ... more peers
    ];
  };
  
  services.unbound = {
    enable = true;
    settings = {
      # Forward all DNS through Quad9 and Cloudflare over TLS
      forward-zone = [{
        name = ".";
        forward-tls-upstream = "yes";
        forward-addr = [
          "149.112.112.112@853#dns.quad9.net"
          "1.0.0.1@853#one.one.one.one"
        ];
      }];
    };
  };
}

mail — Mail/Proxy Server (Oracle Free Tier)

Self-hosted mail server with full email stack.

• NixOS Mailserver — Postfix, Dovecot, OpenDKIM, OpenDMARC
• Nginx — Reverse proxy for internal services
• DMARC reporting — Full email authentication and reporting

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
# hosts/mail/default.nix
{
  networking.hostName = "mail";
  
  mailserver = {
    enable = true;
    fqdn = "mail.ymrtech.com";
    domains = [ "ymrtech.com" ];
    loginAccounts = {
      "yannick@ymrtech.com" = {
        hashedPasswordFile = "/etc/nixos/ymrtechemail";
      };
    };
    fullTextSearch.enable = true;
    dmarcReporting.enable = true;
  };
  
  services.nginx.virtualHosts."mail.ymrtech.com" = {
    enableACME = true;
    forceSSL = true;
  };
}

public — Public Services (Oracle Free Tier)

The public-facing server hosting all external services.

• Uptime Kuma — Monitoring dashboard
• Jekyll — This website
• Syncthing — Device-to-device sync
• All behind WireGuard — No ports open to the internet

Shared Infrastructure

Common Modules (hosts/common/)

All hosts inherit these shared configurations:

• Fish shell with autocompletion
• Btrfs auto-scrub with zstd compression
• OpenSSH with password authentication disabled
• Automatic upgrades with rollback support
• Monitoring agents (VictoriaMetrics, VMAgent)

Monitoring Stack

Security Features

• WireGuard encryption across all internal traffic
• AmneziaWG with jitter for anti-detection on public endpoints
• Encrypted DNS via Unbound + Quad9/Cloudflare over TLS
• DMARC/DKIM/SPF for email authentication
• Btrfs encryption on sensitive filesystems
• Zstd compression on all filesystems (security through obscurity + performance)