asxpi/nixOS
asxpi/nixOS
1
0
Fork 0
Code Issues Pull requests Activity
My nixOS config
97 commits 1 branch 0 tags 294 KiB
  • Nix 100%
Find a file
Sergei Poljanski ffb7554594
 dpi-tunnel: add an Xray Reality PQ full-tunnel client 
DPI on some uplinks throttles WireGuard. Tunnel everything through Xray
VLESS + REALITY with post-quantum VLESS Encryption on tun1. Routes in
the main table that are more specific than the default (LAN, wg*
prefixes) keep priority; prefixes listed in the routes secret are
forced through the tunnel. The client's own uplink is fwmarked so it
never loops back into tun1.

UDP sessions on the tun device stay pinned to a dead mux link after
suspend or Wi-Fi loss, so restart the client on resume and whenever
NetworkManager brings up a new uplink. Stopping the unit removes all
the rules and routes.

Secrets come from secrets/dpi-tunnel.yaml through sops. Only the
.example skeleton is tracked.

Assisted-by: Claude:opus-5-5
2026-11-08 05:08:45 +04:00
modules dpi-tunnel: add an Xray Reality PQ full-tunnel client 2026-11-08 05:08:45 +04:00
patches patches: add traced mutter touch-cancel patches 2026-10-20 12:10:06 +04:00
secrets dpi-tunnel: add an Xray Reality PQ full-tunnel client 2026-11-08 05:08:45 +04:00
.gitignore sops: introduce sops-nix (age), ssh keys from encrypted tarball, .example secrets 2026-07-14 12:24:21 +04:00
.sops.yaml sops: introduce sops-nix (age), ssh keys from encrypted tarball, .example secrets 2026-07-14 12:24:21 +04:00
configuration.nix dpi-tunnel: add an Xray Reality PQ full-tunnel client 2026-11-08 05:08:45 +04:00
flake.lock flake: update inputs 2026-11-08 05:08:44 +04:00
flake.nix lemonade: XDNA2 NPU LLM serving via nix-amd-ai 2026-07-11 22:36:00 +04:00
hardware-configuration.nix power: drop the disk swapfile and hibernate 2026-11-08 05:08:45 +04:00
README.md readme: add Assisted-by 2026-07-14 12:44:17 +04:00

README.md

NixOS

Assisted-by: Claude (claude-opus-4-5 → claude-opus-4-6 → claude-opus-4-7 → claude-opus-4-8 → claude-fable-5)

Flake-based NixOS configuration for a ThinkPad P14s Gen 6 (AMD), tracking nixos-unstable.

Highlights

  • Secure Boot via lanzaboote
  • Secrets: sops-nix with age — xray config, WireGuard, SSH keys, private routes/hosts; encrypted files stay out of the repo (only .example structure files are tracked), decrypted to /run/secrets at activation
  • Desktop: GNOME on Wayland, AMD GPU
  • Local LLMs: Ollama with ROCm (gfx1151) + Lemonade for XDNA2 NPU serving via nix-amd-ai
  • Networking: Xray VLESS+Reality with sing-box TUN, WireGuard, WWAN modem
  • Gaming: Steam with gamescope, declarative Flatpaks via nix-flatpak
  • Litecoin Core (MWEB): vendored package build, revived after removal from nixpkgs
  • Power: AMD P-State tuning, zram swap ahead of disk swap

Layout

flake.nix              # inputs and host definition
configuration.nix      # entry point, imports modules
modules/               # one module per concern (boot, desktop, ollama, xray, ...)
secrets/               # sops-encrypted (age) secrets, gitignored; .example files document structure

Usage

sudo nixos-rebuild switch --flake /etc/nixos#meow

Fresh install: restore secrets/ and the age key (/var/lib/sops-nix/key.txt) from out-of-band backup first.

TODO

  • Evaluate Home Manager