mirror of
https://github.com/Misterio77/Foundry.git
synced 2026-08-24 10:04:09 -05:00
124 lines
5.2 KiB
Markdown
124 lines
5.2 KiB
Markdown
[](https://builtwithnix.org)
|
|
[](https://hydra.m7.rs/jobset/foundry/main#tabs-jobs)
|
|
|
|
# Foundry
|
|
|
|
My public infrastructure monorepo: the NixOS/home-manager configuration that
|
|
runs all my machines, plus the source of the personal projects it deploys.
|
|
Requires [Nix flakes](https://nixos.wiki/wiki/Flakes).
|
|
|
|
Looking for something simpler to start out with flakes? Try [my starter config repo](https://github.com/Misterio77/nix-starter-config).
|
|
|
|
## Repository layout
|
|
|
|
```text
|
|
hosts/nixos/ per-machine NixOS configurations (atlas, alcyone, ...)
|
|
hosts/system-manager/ configurations for non-NixOS Linux systems
|
|
home/ home-manager configuration (feature-flagged)
|
|
modules/ reusable nixos/ and home-manager/ modules
|
|
overlays/, pkgs/ package overlays and custom packages (including wallpapers)
|
|
lib/ pure-Nix Material You color engine
|
|
projects/ my public projects deployed from here (e.g. the m7.rs website)
|
|
```
|
|
|
|
**Highlights**:
|
|
|
|
- **NixOS configurations**: desktop, laptop, servers
|
|
- **Opt-in persistence** through impermanence + blank snapshotting
|
|
- **Encrypted** single **BTRFS** partition (with **disko** for declarative partitioning)
|
|
- **Secure Boot** via **lanzaboote**
|
|
- Fully **declarative** **self-hosted** stuff
|
|
- Deployment **secrets** using **sops-nix**
|
|
- **Mesh networked** hosts with **tailscale** and **headscale**
|
|
- Flexible **Home Manager** configs through **feature flags**
|
|
- Extensively configured **hyprland** environment
|
|
- **Declarative theming**: wallpapers and a pure-Nix **Material You** color engine
|
|
- **Hydra CI/CD** builds every host, serves a binary cache, and hosts auto-upgrade by pull deployment
|
|
|
|
|
|
## About the installation
|
|
|
|
All my computers use a single btrfs (encrypted on all except headless systems)
|
|
partition, with subvolumes for `/nix`, a `/persist` directory (which I opt in
|
|
using `impermanence`), swap file, and a root subvolume (cleared on every boot).
|
|
|
|
Home-manager is used as a NixOS module, integrated via `home-manager.users`.
|
|
|
|
|
|
## Secrets
|
|
|
|
For deployment secrets (such as user passwords and server service secrets), I'm
|
|
using the awesome [`sops-nix`](https://github.com/Mic92/sops-nix). All secrets
|
|
are encrypted with my personal PGP key (stored on a YubiKey), as well as the
|
|
relevant systems' SSH host keys.
|
|
|
|
On my desktop and laptop, I use `pass` for managing passwords, which are
|
|
encrypted using (you bet) my PGP key. This same key is also used for mail
|
|
signing, as well as for SSH'ing around.
|
|
|
|
## Tooling and applications I use
|
|
|
|
Most relevant user apps daily drivers:
|
|
|
|
- hyprland + hypridle + hyprlock
|
|
- waybar
|
|
- helix
|
|
- fish
|
|
- alacritty
|
|
- qutebrowser
|
|
- neomutt + mbsync
|
|
- khal + khard + todoman + vdirsyncer
|
|
- gpg + pass
|
|
- tailscale
|
|
- podman
|
|
- zathura
|
|
- wofi
|
|
- bat + fd + rg
|
|
- kdeconnect
|
|
|
|
Some of the services I host:
|
|
|
|
- hydra
|
|
- jellyfin
|
|
- *arrs (including torrent and usenet)
|
|
- prometheus
|
|
- websites (such as https://m7.rs)
|
|
- minecraft
|
|
- headscale
|
|
|
|
Nixy stuff:
|
|
|
|
- sops-nix
|
|
- impermanence
|
|
- disko
|
|
- lanzaboote
|
|
- home-manager
|
|
- and NixOS and nix itself, of course :)
|
|
|
|
Let me know if you have any questions about them :)
|
|
|
|
## Unixpornish stuff
|
|
|
|
|
|
|
|
## AI usage note
|
|
|
|
Since June 2026, I've been trying out LLM assistance in my workflows. So far it feels pretty good; brainstorming helps me a lot with decision paralysis. I'm trying to keep my use bounded and disclosed. I think it's a useful tool, but it should be adopted with care.
|
|
|
|
I will write a decent blog post about my opinions on AI at some point. The gist is:
|
|
|
|
- These things are useful for bounded tasks with good docs and reviews, but suck at owning architecture or accountability
|
|
- There's no going back now that open-weight models run on consumer hardware, we can't uninvent them
|
|
- Boycotting AI does not help by itself; non-use is not a political strategy
|
|
- We need clear LLM policy on projects rather than trying (and failing) to forbid it
|
|
- Disclosure is very important, and trying to pass LLM output off as human-written is disrespectful
|
|
- LLMs should never have been built by scraping and exploiting our art and work
|
|
- If copyright doesn't protect our creations, it shouldn't protect their models; support open-weight models and distillation as harm reduction
|
|
- We need regulation, decentralization, and redistribution of the value LLMs generate
|
|
- Machines can't be horny, thus can't create art; LLMs are for utility, not art or craft. Pay an artist instead
|
|
|
|
Some bibliography I'd recommend:
|
|
- Alice's ["AI Sucks. Hating it is not enough."](https://shaping.systems/blog/ai-sucks-hating-it-is-not-enough/) (please read it, it's an amazing piece)
|
|
- Drew's ["The cults of TDD and GenAI"](https://drewdevault.com/blog/Cult-of-TDD-and-LLMs/) (I don't really agree with the non-use perspective, but otherwise I think it's solid)
|
|
- Armin's ["Communities of Not"](https://lucumr.pocoo.org/2026/6/6/communities-of-not/) and ["The Center Has a Bias"](https://lucumr.pocoo.org/2026/4/11/the-center-has-a-bias/) (I'm not a centrist politically, though)
|