Nixy is a modular NixOS configuration. It is:
- Hardened
- Minimalist
- Stable
- Dendritic
- Focused on TUIs: I f**king love them, so I have a lot of them (why?)
- Consistently themed
- A server config as well (I love to self-host things)
My main use is infosec-related. I do bug bounty, CTF and pentesting using this machine. This is also my main machine, so I do a lot of random stuff on it.
- Impermanence:
/is wiped on boot, only a few files & folders are stored on a persistent partition. - sops-nix: secrets are stored in the repo, encrypted with an age key.
- Sandbox: most of my apps are sandboxed with minimal permissions, using nixpak (see
modules/lib/sandbox.nix). - Kernel hardening config.
- LUKS: encrypted drive, partitioned declaratively with disko.
- Secure boot: enabled on NixOS thanks to lanzaboote.
Nixy follows the dendritic pattern: every file under modules/ is a flake-parts module, auto-imported by import-tree, that defines one feature (an aspect) across every layer it touches: system, user (via hjem), persistence, theming. Aspects are grouped into bundles (base, tui, homelab...), and hosts just pick the bundles and aspects they want.
Nixy is my personal config: it's not meant to be installed as-is (hardware, disks, secrets and users are mine). Feel free to read it, steal modules, and adapt them. Most aspects are self-contained, so copying a single file from modules/ is usually enough.
If you still want to try it:
- Fork the repo and clone it to
~/.config/nixos(or setnixy.configDirectoryto wherever you put it) - Copy a host from
modules/hosts/and replace its hardware configuration, disko layout and secrets with yours (sops+ your own age key) - Pick the bundles/aspects you want in the host's
default.nix - Build with
nixy rebuild(ornh os switch .)
I was on Hyprland for a few years, but I wanted something more minimalist & more stable. Sway does exactly that.
Running unstable and getting the latest features as soon as they land was fun, but now I prefer a config that needs less maintenance. Nixy follows the latest NixOS release, and only a few packages here and there come from nixpkgs-unstable, when I need a specific feature or fix.
They're keyboard-driven, fast to start, light on resources and usually local-first: no account, no Electron, no telemetry. They all live in the same terminal, with the same theme, the same keybindings and the same workflow. And they work the same way on my laptop and over SSH on my server.
With / wiped on every boot, the only state on my machine is the state I explicitly declared. No forgotten config files, no leftovers from a program I tried once, no hidden drift between what the repo says and what the machine is. It's also a security win: anything that would persist outside of /persist (malware, tampered files) is gone after a reboot.
One file = one feature. Everything related to a program (packages, config, persisted folders, sandbox, theme) lives in the same place, so adding a feature means adding a file, and removing it means deleting that file. No imports lists to maintain by hand: import-tree loads everything, and hosts just choose which aspects they enable.