luochen570/nixos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

modified: README.md

Browse Source 
modified:   flake.nix
	modified:   home/README.md
	modified:   home/ssh.nix
	modified:   hosts/README.md
	modified:   hosts/desktop/README.md
	modified:   hosts/desktop/configuration.nix
	new file:   hosts/nixos-lxc/README.md
	new file:   hosts/nixos-lxc/configuration.nix
	renamed:    modules/wsl/default.nix -> hosts/nixos-lxc/default.nix
	modified:   hosts/server/README.md
	modified:   hosts/server/configuration.nix
	modified:   hosts/virtualbox/README.md
	modified:   hosts/virtualbox/configuration.nix
	modified:   hosts/virtualbox/hardware-configuration.nix
	modified:   hosts/wsl/README.md
	modified:   hosts/wsl/configuration.nix
	modified:   lib/README.md
	modified:   lib/hosts.nix
	modified:   lib/mkHost.nix
	modified:   modules/README.md
	modified:   modules/core/README.md
	modified:   modules/core/core.nix
	modified:   modules/core/users.nix
	modified:   modules/desktop/README.md
	modified:   modules/desktop/de/README.md
	modified:   modules/desktop/wm/README.md
	modified:   modules/desktop/wm/default.nix
	modified:   modules/drivers/README.md
	modified:   modules/drivers/amdgpu.nix
	modified:   modules/server/README.md
	modified:   modules/server/default.nix
	new file:   modules/server/firewall.nix
	modified:   modules/server/pkg.nix
	modified:   modules/server/ssh.nix
	modified:   modules/server/virtualbox-guest.nix
	deleted:    modules/wsl/README.md
	deleted:    modules/wsl/configuration.nix
	modified:   overlays/README.md
	modified:   profiles/README.md
	modified:   profiles/desktop.nix
	new file:   profiles/lxc.nix
	modified:   profiles/wsl.nix
	modified:   secrets/README.md
	modified:   secrets/users/README.md
添加了pve-lxc的配置文件 删除了wsl的配置文件
This commit is contained in:
luochen570
2026-03-01 19:38:51 +08:00
parent 26b5caa6d0
commit e4d82bc580
45 changed files with 206 additions and 115 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
README.md
View File

@@ -1,4 +1,4 @@
# 📦 nixos 配置仓库
# 📦 nixos 配置仓库
基于 Flake 的 NixOS 多主机配置。
@@ -10,9 +10,23 @@
├─ 🧩 lib/ # 公共函数（mkHost）
├─ 🧱 modules/ # 系统模块（core/server/wsl）
├─ 🎨 overlays/ # 包覆盖
├─ 📚 profiles/ # 场景组合（desktop/server/wsl）
├─ 📚 profiles/ # 场景组合（desktop/server/wsl/virtualbox/lxc）
└─ 🔐 secrets/ # sops 密钥模板与密文
```
## 🔗 引用关系
`flake.nix` -> `lib/hosts.nix` + `lib/mkHost.nix` -> `hosts/*` + `profiles/*` -> `modules/*/default.nix` -> 子模块
`networking.hostName` 由 `lib/mkHost.nix` 统一设置，具体值在 `lib/hosts.nix` 每台主机条目里定义。
## 🌐 Nix 模块引入文件树
```text
flake.nix
├─ lib/hosts.nix
├─ lib/mkHost.nix
│ ├─ hosts/<hostname>/default.nix -> configuration.nix
│ ├─ profiles/<profile>.nix -> modules/*
│ └─ home/default.nix -> home/*.nix
└─ modules/core/sops.nix -> secrets/users/*.enc.yaml
```

6
flake.nix
View File

@@ -1,5 +1,5 @@
{
description = "My Infra";
description = "luochen570's NixOS configuration";
inputs = {
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
@@ -9,15 +9,19 @@
inputs.nixpkgs.follows = "nixpkgs";
};
# Nix4NvChad
nix4nvchad = {
url = "github:nix-community/nix4nvchad";
inputs.nixpkgs.follows = "nixpkgs";
};
# NixOS WSL
nixos-wsl.url = "github:nix-community/NixOS-WSL/main";
# VS Code Server
vscode-server.url = "github:nix-community/nixos-vscode-server";
# SOPS for Nix
sops-nix = {
url = "github:Mic92/sops-nix";
inputs.nixpkgs.follows = "nixpkgs";

4
home/README.md
View File

@@ -1,4 +1,4 @@
# 🏠 home 目录说明
# 🏠 home 目录说明
Home Manager 用户级配置目录。
@@ -11,3 +11,5 @@ Home Manager 用户级配置目录。
├─ 💻 zsh.nix # Zsh 与插件
└─ ✨ nvchad.nix # Neovim(NvChad)
```
`r`n

4
home/ssh.nix
View File

@@ -2,11 +2,11 @@
{
programs.ssh.enable = true;
# ~/.ssh/id_rsa comes from a sops secret file.
# ~/.ssh/id_rsa 来自 sops secret 文件。
home.file.".ssh/id_rsa".source =
config.lib.file.mkOutOfStoreSymlink "/run/secrets/users/luochen570/ssh_private_key";
# ~/.ssh/config comes from a sops secret file.
# ~/.ssh/config 来自 sops secret 文件。
home.file.".ssh/config".source =
config.lib.file.mkOutOfStoreSymlink "/run/secrets/users/luochen570/ssh_config";
}

13
hosts/README.md
View File

@@ -1,4 +1,4 @@
# 🖥️ hosts 目录说明
# 🖥️ hosts 目录说明
主机入口层。每台主机目录固定为三文件结构：
- `default.nix`：统一入口，导入 `configuration.nix`
@@ -16,13 +16,12 @@
│ ├─ 🧩 default.nix
│ ├─ ⚙️ configuration.nix
│ └─ 📝 README.md
├─ 📦 virtualbox/
│ ├─ 🧩 default.nix
│ ├─ ⚙️ configuration.nix
│ ├─ 🧱 hardware-configuration.nix
│ └─ 📝 README.md
└─ 🪟 wsl/
└─ 📦 virtualbox/
├─ 🧩 default.nix
├─ ⚙️ configuration.nix
├─ 🧱 hardware-configuration.nix
└─ 📝 README.md
```
`r`n

4
hosts/desktop/README.md
View File

@@ -1,4 +1,4 @@
# 🧑‍💻 hosts/desktop
# 🧑‍💻 hosts/desktop
桌面主机入口。
@@ -9,3 +9,5 @@
├─ ⚙️ configuration.nix # profile + hostName + 机器相关配置
└─ 📝 README.md
```
`r`n

10
hosts/desktop/configuration.nix
View File

@@ -1,11 +1,9 @@
{ ... }:
{
# 可在此合并由 nixos-generate-config 生成的机器专属配置：
# 磁盘布局、引导加载器、文件系统、硬件选项等。
imports = [
../../profiles/desktop.nix
../../modules/drivers/nvidia.nix
../../modules/drivers/amdgpu.nix
];
networking.hostName = "desktop";
# Machine-specific config generated by nixos-generate-config can be
# merged here: disk layout, boot loader, filesystem, hardware options.
}

14
hosts/nixos-lxc/README.md Normal file
View File

@@ -0,0 +1,14 @@
# 📦 hosts/nixos-lxc
Proxmox LXC 主机入口。
## 🌲 目录树
```text
hosts/nixos-lxc
├─ default.nix
├─ configuration.nix
└─ README.md
```
`r`n

42
hosts/nixos-lxc/configuration.nix Normal file
View File

@@ -0,0 +1,42 @@
{ modulesPath, ... }:
{
imports = [
(modulesPath + "/virtualisation/proxmox-lxc.nix")
];
# 修复 LXC 挂载报错
systemd.mounts = [
{ where = "/sys/kernel/debug"; enable = false; }
{ where = "/sys/fs/fuse/connections"; enable = false; }
];
systemd.services."sys-kernel-debug.mount".enable = false;
# 容器运行时设置
nix.settings.sandbox = false;
proxmoxLXC = {
manageNetwork = false;
privileged = true;
};
# 由宿主机处理 fstrim
services.fstrim.enable = false;
services.openssh = {
enable = true;
openFirewall = true;
settings = {
PermitRootLogin = "yes";
PasswordAuthentication = true;
};
};
security.sudo.wheelNeedsPassword = false;
services.resolved = {
extraConfig = ''
Cache=true
CacheFromLocalhost=true
'';
};
}

1
modules/wsl/default.nix → hosts/nixos-lxc/default.nix
View File

@@ -1,4 +1,5 @@
{ ... }:
{
imports = [
./configuration.nix

4
hosts/server/README.md
View File

@@ -1,4 +1,4 @@
# 🗄️ hosts/server
# 🗄️ hosts/server
服务器主机入口。
@@ -9,3 +9,5 @@
├─ ⚙️ configuration.nix # profile + hostName + 机器相关配置
└─ 📝 README.md
```
`r`n

10
hosts/server/configuration.nix
View File

@@ -1,11 +1,5 @@
{ ... }:
{
imports = [
../../profiles/server.nix
];
networking.hostName = "server";
# Machine-specific config generated by nixos-generate-config can be
# merged here: disk layout, boot loader, filesystem, hardware options.
# 可在此合并由 nixos-generate-config 生成的机器专属配置：
# 磁盘布局、引导加载器、文件系统、硬件选项等。
}

4
hosts/virtualbox/README.md
View File

@@ -1,4 +1,4 @@
# 📦 hosts/virtualbox
# 📦 hosts/virtualbox
VirtualBox 虚拟机主机入口。
@@ -10,3 +10,5 @@ VirtualBox 虚拟机主机入口。
├─ 🧱 hardware-configuration.nix # 由 nixos-generate-config 生成的硬件配置
└─ 📝 README.md
```
`r`n

10
hosts/virtualbox/configuration.nix
View File

@@ -1,14 +1,8 @@
{ ... }:
{
imports = [
../../profiles/virtualbox.nix
];
networking.hostName = "virtualbox";
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
# Machine-specific config generated by nixos-generate-config can be
# merged here: disk layout, boot loader, filesystem, hardware options.
# 可在此合并由 nixos-generate-config 生成的机器专属配置：
# 磁盘布局、引导加载器、文件系统、硬件选项等。
}

6
hosts/virtualbox/hardware-configuration.nix
View File

@@ -1,6 +1,6 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
# 请勿直接修改此文件！它由 `nixos-generate-config` 自动生成，
# 后续再次执行生成命令时可能会被覆盖。请改动
# /etc/nixos/configuration.nix。
{ config, lib, pkgs, modulesPath, ... }:
{

4
hosts/wsl/README.md
View File

@@ -1,4 +1,4 @@
# 🪟 hosts/wsl
# 🪟 hosts/wsl
WSL 主机入口。
@@ -9,3 +9,5 @@ WSL 主机入口。
├─ ⚙️ configuration.nix # profile + hostName（可加 WSL 机器项）
└─ 📝 README.md
```
`r`n

9
hosts/wsl/configuration.nix
View File

@@ -1,10 +1,11 @@
{ ... }:
{
imports = [
../../profiles/wsl.nix
inputs.nixos-wsl.nixosModules.default
];
networking.hostName = "nixos-wsl";
# Keep minimal for WSL. Add machine-specific options here if needed.
wsl = {
enable = true;
defaultUser = username;
};
}

4
lib/README.md
View File

@@ -1,4 +1,4 @@
# 🧩 lib 目录说明
# 🧩 lib 目录说明
公共函数目录。
@@ -8,3 +8,5 @@
├─ ⚙️ mkHost.nix # 组装 NixOS system 与 Home Manager（接收 username）
└─ 📋 hosts.nix # 主机清单（system/profile 映射）
```
`r`n

10
lib/hosts.nix
View File

@@ -2,20 +2,30 @@
desktop = {
system = "x86_64-linux";
profile = "desktop";
hostName = "desktop";
};
server = {
system = "x86_64-linux";
profile = "server";
hostName = "server";
};
wsl = {
system = "x86_64-linux";
profile = "wsl";
hostName = "nixos-wsl";
};
virtualbox = {
system = "x86_64-linux";
profile = "virtualbox";
hostName = "virtualbox";
};
nixos-lxc = {
system = "x86_64-linux";
profile = "lxc";
hostName = "nixos-lxc";
};
}

6
lib/mkHost.nix
View File

@@ -1,6 +1,8 @@
{ nixpkgs, home-manager, inputs }:
{
hostname,
hostName ? hostname,
systemStateVersion ? "25.05",
system,
profile,
username,
@@ -17,6 +19,10 @@ nixpkgs.lib.nixosSystem {
inputs.sops-nix.nixosModules.sops
../hosts/${hostname}
../profiles/${profile}.nix
{
networking.hostName = hostName;
system.stateVersion = systemStateVersion;
}
home-manager.nixosModules.home-manager
{
home-manager.useGlobalPkgs = true;

8
modules/README.md
View File

@@ -1,4 +1,4 @@
# 🧱 modules 目录说明
# 🧱 modules 目录说明
系统模块目录。大部分子目录通过 `default.nix` 提供统一入口，驱动目录采用按文件显式引用。
@@ -8,6 +8,8 @@
├─ 🧭 core/ # 全局基础模块
├─ 🖥️ desktop/ # 桌面模块（DE/WM/应用）
├─ 🎮 drivers/ # 硬件驱动模块（如 NVIDIA）
├─ 🗄️ server/ # 服务器模块
└─ 🪟 wsl/ # WSL 模块
└─ 🗄️ server/ # 服务器模块
```
`r`n

4
modules/core/README.md
View File

@@ -1,4 +1,4 @@
# 🧭 modules/core
# 🧭 modules/core
所有主机场景都会引入的基础模块。
@@ -10,3 +10,5 @@
├─ 👤 users.nix # 用户、默认 shell、密码与公钥
└─ 🔐 sops.nix # sops-nix secret 映射
```
`r`n

3
modules/core/core.nix
View File

@@ -24,7 +24,4 @@
time.timeZone = lib.mkDefault "Asia/Shanghai";
i18n.defaultLocale = lib.mkDefault "zh_CN.UTF-8";
networking.firewall.enable = lib.mkDefault true;
system.stateVersion = lib.mkDefault "25.05";
}

2
modules/core/users.nix
View File

@@ -5,7 +5,7 @@
users.users.${username} = {
isNormalUser = true;
extraGroups = [ "wheel" ];
extraGroups = [ "wheel" "networkmanager" ];
shell = pkgs.zsh;
}
// lib.optionalAttrs (!(config.sops.secrets ? "users/luochen570/passwordHash")) {

4
modules/desktop/README.md
View File

@@ -1,4 +1,4 @@
# 🖥️ modules/desktop 目录说明
# 🖥️ modules/desktop 目录说明
桌面能力模块，按“桌面环境（DE）/窗口管理器（WM）/应用”拆分，便于后续扩展到多种桌面方案。
@@ -11,3 +11,5 @@
├─ 📦 pkg.nix # 桌面软件包
└─ 📱 apps.nix # 桌面应用与默认浏览器关联
```
`r`n

4
modules/desktop/de/README.md
View File

@@ -1,4 +1,4 @@
# 🧭 modules/desktop/de 目录说明
# 🧭 modules/desktop/de 目录说明
桌面环境（Desktop Environment）目录。
@@ -8,3 +8,5 @@
├─ 📦 default.nix # 聚合入口（当前仅 KDE）
└─ ⚙️ kde.nix # SDDM + Plasma 6
```
`r`n

4
modules/desktop/wm/README.md
View File

@@ -1,4 +1,4 @@
# 🪟 modules/desktop/wm 目录说明
# 🪟 modules/desktop/wm 目录说明
窗口管理器（Window Manager）目录，当前为预留结构。
@@ -7,3 +7,5 @@
🪟 modules/desktop/wm
└─ 📦 default.nix # 预留 future imports（hyprland/sway 等）
```
`r`n

2
modules/desktop/wm/default.nix
View File

@@ -1,7 +1,7 @@
{ ... }:
{
imports = [
# Future WM modules:
# 未来可引入的 WM 模块：
# ./hyprland.nix
# ./sway.nix
];

4
modules/drivers/README.md
View File

@@ -1,4 +1,4 @@
# 🎮 modules/drivers 目录说明
# 🎮 modules/drivers 目录说明
硬件驱动模块目录，用于集中管理显卡等驱动配置。
@@ -9,3 +9,5 @@
├─ 🔴 amdgpu.nix # AMD iGPU(9700X) 用户态图形/计算支持
└─ 📝 README.md
```
`r`n

6
modules/drivers/amdgpu.nix
View File

@@ -1,8 +1,8 @@
{ pkgs, ... }:
{
# Ryzen 7 9700X iGPU (RDNA2) related userspace support.
# Keep as a secondary GPU setup; X primary driver is still controlled
# by the desktop profile / nvidia module.
# Ryzen 7 9700X 核显（RDNA2）相关的用户态支持。
# 作为辅助显卡配置保留；X 的主显卡驱动仍由
# desktop profile / nvidia 模块控制。
hardware.graphics = {
enable = true;
extraPackages = with pkgs; [

4
modules/server/README.md
View File

@@ -1,4 +1,4 @@
# 🗄️ modules/server
# 🗄️ modules/server
服务器专用模块。
@@ -7,8 +7,10 @@
🗄️ modules/server
├─ 📦 default.nix # 聚合入口
├─ 📦 pkg.nix # 服务器常用软件包
├─ 🔥 firewall.nix # 防火墙默认策略
├─ 🔐 ssh.nix # OpenSSH 参数
├─ 🐳 docker.nix # Docker 与清理策略
├─ 📦 virtualbox-guest.nix # VirtualBox Guest 增强配置
└─ 🧠 vscode-server.nix # VS Code Server 模块
```

1
modules/server/default.nix
View File

@@ -2,6 +2,7 @@
{
imports = [
./pkg.nix
./firewall.nix
./docker.nix
./ssh.nix
];

4
modules/server/firewall.nix Normal file
View File

@@ -0,0 +1,4 @@
{ lib, ... }:
{
networking.firewall.enable = lib.mkDefault true;
}

2
modules/server/pkg.nix
View File

@@ -1,6 +1,6 @@
{ pkgs, ... }:
{
environment.systemPackages = with pkgs; [
jq
];
}

2
modules/server/ssh.nix
View File

@@ -2,13 +2,13 @@
{
services.openssh = {
enable = true;
openFirewall = true;
settings = {
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
PermitRootLogin = "no";
X11Forwarding = false;
};
openFirewall = true;
};
}

2
modules/server/virtualbox-guest.nix
View File

@@ -1,6 +1,6 @@
{ ... }:
{
# virtualbox-guest
# VirtualBox Guest 增强支持
virtualisation.virtualbox.guest.enable = true;
virtualisation.virtualbox.guest.dragAndDrop = true;
}

11
modules/wsl/README.md
View File

@@ -1,11 +0,0 @@
# 🪟 modules/wsl
WSL 集成模块。
## 🌲 目录树
```text
🪟 modules/wsl
├─ 📦 default.nix # 聚合入口
├─ ⚙️ configuration.nix # WSL 配置实现
└─ 📝 README.md
```

14
modules/wsl/configuration.nix
View File

@@ -1,14 +0,0 @@
{ inputs, username, ... }:
{
imports = [
inputs.nixos-wsl.nixosModules.default
../server/vscode-server.nix
];
wsl = {
enable = true;
defaultUser = username;
};
users.users.${username}.extraGroups = [ "vscode" "docker" "wheel" ];
}

4
overlays/README.md
View File

@@ -1,4 +1,4 @@
# 🎨 overlays 目录说明
# 🎨 overlays 目录说明
`nixpkgs` 包覆盖目录。
@@ -7,3 +7,5 @@
🎨 overlays
└─ (自定义 overlay 文件)
```
`r`n

7
profiles/README.md
View File

@@ -1,4 +1,4 @@
# 📚 profiles 目录说明
# 📚 profiles 目录说明
场景化组合层，负责选择 `modules/*`。
@@ -8,5 +8,8 @@
├─ 🧑‍💻 desktop.nix # core + desktop + drivers
├─ 🗄️ server.nix # core + server(default.nix)
├─ 📦 virtualbox.nix # core + desktop + virtualbox guest + 远程开发
└─ 🪟 wsl.nix # core + wsl(default.nix)
├─ 🪟 wsl.nix # core + wsl(default.nix)
└─ 📦 lxc.nix # core + LXC 主机自定义配置
```
`r`n

2
profiles/desktop.nix
View File

@@ -3,7 +3,5 @@
imports = [
../modules/core
../modules/desktop
../modules/drivers/nvidia.nix
../modules/drivers/amdgpu.nix
];
}

6
profiles/lxc.nix Normal file
View File

@@ -0,0 +1,6 @@
{ ... }:
{
imports = [
../modules/core
];
}

4
profiles/wsl.nix
View File

@@ -2,10 +2,8 @@
{
imports = [
../modules/core
../modules/wsl
../modules/server/ssh.nix
../modules/server/vscode-server.nix
];
networking.firewall.enable = false;
}

4
secrets/README.md
View File

@@ -1,4 +1,4 @@
# 🔐 secrets 目录说明
# 🔐 secrets 目录说明
`sops-nix` 密钥目录。
@@ -11,3 +11,5 @@
建议：
- 仅提交加密后的 `*.enc.yaml`
- 明文仅保留 `*.example` 模板
`r`n

4
secrets/users/README.md
View File

@@ -1,4 +1,4 @@
# 👤 secrets/users 目录说明
# 👤 secrets/users 目录说明
用户级 secret 模板与密文。
@@ -13,3 +13,5 @@
- 你可以在本目录维护 `*.source` 文件作为本地敏感源文件（例如真实域名和 IP）。
- 这些文件已被仓库 `.gitignore` 屏蔽，不会被 Git 收集和推送。
- 示例：`luochen570.ssh_config.source`、`luochen570.id_rsa.source`
`r`n