nixos-config

Personal den/flake-parts configuration for three machines.

Host	System	Role
chidi	aarch64-darwin	Work laptop
janet	aarch64-darwin	Personal laptop
tahani	x86_64-linux	Home server

Layout

Every .nix file under modules/ is a flake-parts module, auto-imported by import-tree. Underscore-prefixed paths are not imported; they hold data and helpers used by the module next to them.

• modules/den.nix — den setup, foundational flake inputs, host inventory, defaults
• modules/profiles.nix — host-* and user-* bundles that hosts include
• modules/hosts/ — one file per machine
• modules/features/{system,interactive,development,ai,services,personal}/ — one aspect per capability. Feature-specific flake inputs live in the feature that uses them.
• modules/_lib/ — user constants, theme palette, one systemd helper
• secrets/ — SOPS-encrypted files (see .sops.yaml)

Commands

nix run .#apply                    # sudo {darwin,nixos}-rebuild switch --flake .
nix run .#update -- [input...]     # nix flake update, then regenerate flake.nix
nix build .#darwinConfigurations.janet.system
nix build .#nixosConfigurations.tahani.config.system.build.toplevel
nix fmt
nix flake check

Roll back with darwin-rebuild --rollback or nixos-rebuild switch --rollback.

flake.nix is generated by flake-file. After changing a flake-file.inputs declaration, run nix run .#write-flake && nix flake lock && nix fmt.

Do not bump system.stateVersion or home.stateVersion.

T3 Connect on Tahani

The T3 aspect installs a t3 launcher and its relay client, cloudflared, through Nix. Terminal commands and the service use the same launcher, which runs t3@0.0.45-nightly.20260930.2468 through npm with installation scripts disabled to preserve the bundled native binaries. npm caches the nightly in the user's home directory; the first invocation requires network access. Both login shells and the t3code service use T3CODE_CLOUDFLARED_PATH to select the Nix package. T3 starts and supervises the tunnel itself.

Both environments also receive the production relay URL, Clerk publishable key, and CLI OAuth client ID from upstream's public configuration. These public identifiers configure T3 Connect for both the CLI and server; they are separate from the credentials created when you authenticate.

After applying the configuration, open a fresh SSH session to Tahani as cschmatzler and authenticate:

t3 connect link --headless
sudo systemctl restart t3code
t3 connect status

Follow the authentication instructions printed by the first command. Use connect link to authorize the existing Nix-managed server; plain t3 connect also offers to install an upstream background service. Run authentication as your normal user so it shares the server's T3 state directory. Credentials remain in T3's writable user state, outside the Nix store.

The existing Tailscale endpoint remains available alongside T3 Connect. Inspect tunnel startup with journalctl -u t3code -f.

CLIProxyAPI on Tahani

CLIProxyAPI runs from a pinned upstream Docker image. Its official management UI is served at https://cliproxyapi.manticore-hippocampus.ts.net/management.html; the API base URL is https://cliproxyapi.manticore-hippocampus.ts.net/v1. The Tailscale service svc:cliproxyapi must be approved in the tailnet, as with the other Tailscale services. Only the loopback port 8317 is published locally.

Initial credentials are SOPS-encrypted in secrets/cliproxyapi. After applying, retrieve the management key with sudo cat /run/secrets/cliproxyapi-management-key and the client API key with sudo cat /run/secrets/cliproxyapi-api-key on Tahani. Connect provider accounts through the web UI; no provider accounts are preconfigured.

The initial configuration is copied once into /var/lib/cliproxyapi/config.yaml. Web UI settings, authentication files, and downloaded UI assets persist in that directory across restarts and upgrades. Later edits to the Nix seed or SOPS keys do not overwrite the live configuration; rotate live keys through the UI and update the encrypted seed separately. The UI assets follow upstream automatic updates independently of the pinned server image.