dpi-tunnel is now the default full tunnel. Keep the sing-box TUN for
manual use (systemctl start sing-box) instead of starting it at boot.

Assisted-by: Claude:opus-5-5

2026-11-08 05:08:45 +04:00

1.6 KiB

Raw Blame History

NixOS

Assisted-by: Claude (claude-opus-4-5 → claude-opus-4-6 → claude-opus-4-7 → claude-opus-4-8 → claude-fable-5)

Flake-based NixOS configuration for a ThinkPad P14s Gen 6 (AMD), tracking nixos-unstable.

Highlights

Secure Boot via lanzaboote
Secrets: sops-nix with age — xray config, WireGuard, SSH keys, private routes/hosts; encrypted files stay out of the repo (only .example structure files are tracked), decrypted to /run/secrets at activation
Desktop: GNOME on Wayland, AMD GPU
Local LLMs: Ollama with ROCm (gfx1151) + Lemonade for XDNA2 NPU serving via nix-amd-ai
Networking: dpi-tunnel (Xray VLESS+Reality+PQ, full tunnel on tun1), Xray+sing-box TUN (on demand), WireGuard, WWAN modem
Gaming: Steam with gamescope, declarative Flatpaks via nix-flatpak
Litecoin Core (MWEB): vendored package build, revived after removal from nixpkgs
Power: AMD P-State tuning, zram swap ahead of disk swap

Layout

flake.nix              # inputs and host definition
configuration.nix      # entry point, imports modules
modules/               # one module per concern (boot, desktop, ollama, xray, ...)
secrets/               # sops-encrypted (age) secrets, gitignored; .example files document structure

Usage

sudo nixos-rebuild switch --flake /etc/nixos#meow

Fresh install: restore secrets/ and the age key (/var/lib/sops-nix/key.txt) from out-of-band backup first.

TODO

Evaluate Home Manager