NixOS Infrastructure as Code using the Dendritic Pattern, an organic configuration growth pattern with automatic module discovery. Powered by flake-parts.
All Nix files are flake-parts modules and are automatically imported via import-tree. Files prefixed with _ are omitted. No literal path imports are used, so files can be moved and nested freely.
Shared device policy that serves multiple optional applications belongs in modules/hosts/common/, so its permissions do not disappear when one app module is disabled. Optional app modules own their package and capability-wrapper behavior, including compiled argv filters with audited, grammar-aware allowlists that fail closed on unsupported and non-device forms, validate parser-dependent argument boundaries, and bound the resulting no-sudo operation boundary.
This project uses a custom build script, build.sh, for validation and deployment:
./build.sh # validate and deploy
./build.sh --boot # install for next boot only
./build.sh --update # refresh metadata + update flake inputs
./build.sh --offline # Offline buildThe script runs a validation pipeline (format, pre-commit hooks, flake check) before deployment.
It refuses to run on a dirty worktree by default; use --allow-dirty to override.
--update intentionally allows dirty worktrees and does not auto-commit flake.lock.
Development commands:
| Command | Description |
|---|---|
nix develop path:. |
Enter dev shell |
nix run path:.#treefmt -- . |
Format files |
nix develop path:. -c pre-commit run --all-files --hook-stage manual |
Run all hooks |
These carry the explicit path:. installable because the branch workflow in AGENTS.md puts the work in a linked worktree, where Lix cannot fetch a clean checkout as a git+file flake: .git is a file there, not a directory. Dropping path:. gives the primary-checkout form, where nix fmt also works. Two cases path:. cannot fix: nix fmt, because Lix hardcodes the . installable in lix/nix/fmt.cc; and any command that writes flake.lock back, such as nix flake metadata --refresh and nix flake update, which need an absolute ref like "path:$PWD".
This repo uses a dual-module approach: NixOS modules install packages, HM modules configure them. To avoid duplicate installation, HM modules set package = null when supported.
See the App Modules Style Guide for details.
Nested host app overrides register full option paths and route them through programs first, then services for services-only paths. A path absent from both baseline namespaces fails the host evaluation, so it cannot be dropped by a switch that never runs the FR-5 check.
See the App Modules Style Guide for the routing and validation contract.
Storage-dependent services must be enabled only on hosts that provide their required mount. The system76 host has no dedicated /data, so it disables both common local mirror writers and the R2 runtime; the relocated /data volume belongs to songbird.
See the local mirror reference, system76 configuration, and R2 runtime policy for the operational contracts.
Cache-root membership is derived from evaluated host configuration. Every NVIDIA-enabled host explicitly sets cacheRoots.nvidiaKernelModules; missing, malformed, or unknown policy values fail evaluation. songbird sets it to false to keep its source-built CachyOS module out while retaining nvidia-x11 and nvidia-settings coverage.
See binary cache coverage for the inventory and operator policy.
Secrets are managed with sops-nix. Encrypted payloads live in secrets/, a private git submodule, and are declared via sops.secrets.
See the sops documentation for usage instructions.
These root inputs pin shared dependencies used through .follows declarations. systems keeps the canonical nix-systems input name even though dependency inputs also follow it. The table lists dedicated dedupe roots and canonical non-nixpkgs roots; ordinary root followers such as nixpkgs are declared beside each dependent input. Remove any dedupe_* input once no .follows declaration references it.
| Input | Followed By |
|---|---|
dedupe_flake-compat |
make-shell.inputs.flake-compat, nix-cachyos-kernel.inputs.flake-compat |
dedupe_flake-utils |
claude-desktop-linux-flake.inputs.flake-utils |
dedupe_nur |
stylix.inputs.nur |
systems |
dedupe_flake-utils.inputs.systems, stylix.inputs.systems |
The following files are defined in Nix and generated via mightyiam/files using nix develop path:. -c write-files (drop path:. in the primary checkout):
.actrc.githooks/post-checkout.gitignore.gitleaks-gitlink.toml.gitleaks-secrets.toml.gitleaks.toml.sops.yamlREADME.md