nixos/base.nix

The base Fil-C NixOS machine that filnix ships as a disk image: a whole Fil-C system (nixos/default.nix) set up to try. The console and the serial line log in as demo, who has sudo without a password; SSH takes keys only. /etc/nixos holds a flake pinned to the filnix revision the image was built from, with filc.cachix.org configured, so a first sudonixos-rebuild switch substitutes instead of compiling the world.

nix run github:mbrock/filnix#nixos-vm            # boot it in QEMU
nix build github:mbrock/filnix#nixos-image       # the compressed qcow2

system.build.qcow2 builds the image with the native package set: the disk image tools (rsync, parted, e2fsprogs, lkl, qemu-img) come from pkgs in Nixpkgs' make-disk-image, and here pkgs is Fil-C.

λfilnix

λconfig, lib, modulesPath, pkgs, …

let

23cfg=

config.filnix

used by flake

24rev=

filnix.rev or "main"

used by config flake

25cache=

26substituter=

"https://filc.cachix.org"

27key=

"filc.cachix.org-1:8rA7kXyu1HaJuMTsAKfA9fU/+r8YtLv5KiZ5hfDNZMk="

used by config flake

29native=

config.filc.nativePackages ≢ null

→

config.filc.nativePackages

else

filnix.lib.${config.filc.system}.nativePackages

used by config

What /etc/nixos starts with. nixos-rebuild picks the configuration named after the host.

37flake=

pkgs.writeText"flake.nix"

{

# The filnix revision this machine was built from. Change it to update.

inputs.filnix.url = "github:mbrock/filnix/${rev}";

nixConfig.extra-substituters = [ "${cache.substituter}" ];

nixConfig.extra-trusted-public-keys = [ "${cache.key}" ];

# filnix's ${cfg.configuration} configuration, with your changes.

outputs = { filnix, ... }: {

nixosConfigurations.${config.networking.hostName} =

filnix.nixosConfigurations.${cfg.configuration}.extendModules {

modules = [ ./configuration.nix ];

};

}

uses cache cfg rev used by config

54configuration=

pkgs.writeText"configuration.nix"

# Your changes to the base Fil-C machine (filnix's nixos/base.nix).

# Apply them with: sudo nixos-rebuild switch

{ pkgs, ... }:

{

# Programs and services come from `pkgs`, which is Fil-C:

# environment.systemPackages = [ pkgs.git pkgs.htop ];

# services.lighttpd.enable = true;

# Rust and Go programs have no Fil-C build; keep them native:

# filc.native = native: { inherit (native) ripgrep; };

# Log in over SSH with your key:

# users.users.demo.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAA..." ];

}

used by config

72imports=

"${modulesPath}/profiles/qemu-guest.nix"

74options.filnix.configuration=

lib.mkOption

75type=

lib.types.str

76default=

"base"

77description=

The attribute of filnix's nixosConfigurations this machine is, which the flake in /etc/nixos extends with configuration.nix. Unchanged, a first rebuild then makes the same system, which is in the cache.

84config=

85filc.enable=

true

87boot.loader.grub.device=

lib.mkDefault"/dev/vda"

88boot.loader.timeout=

89boot.growPartition=

true

90fileSystems."/"=

91device=

"/dev/disk/by-label/nixos"

92fsType=

"ext4"

93autoResize=

true

The serial console last, so it gets the kernel's and systemd's output.

96boot.kernelParams=

"console=tty0" "console=ttyS0,115200n8"

101networking.hostName=

lib.mkDefault"filc"

103users.users.demo=

104isNormalUser=

true

105extraGroups=

"wheel"

107services.getty.autologinUser=

"demo"

108security.sudo.wheelNeedsPassword=

false

110services.openssh=

111enable=

true

112settings=

113PasswordAuthentication=

false

114KbdInteractiveAuthentication=

false

115PermitRootLogin=

"no"

119users.motd=

This is NixOS with a Fil-C userland: systemd, PAM, OpenSSH, Bash and

every service are memory-safe Fil-C builds. `sudo filc-ps` shows that

nothing else runs native but the allowed exceptions.

You are logged in as demo, with sudo and no password. SSH takes keys

only. /etc/nixos is a flake pinned to filnix ${builtins.substring0 12 rev}; edit

configuration.nix there and run `sudo nixos-rebuild switch`. Give the

machine at least 2 GiB of memory.

132nix.settings=

133experimental-features=

"nix-command" "flakes"

137extra-substituters=

cache.substituter

138extra-trusted-public-keys=

cache.key

NixOS marks the system itself and its small generated files allowSubstitutes = false, so with max-jobs 0 (filnix-first-switch, filnix-update) Nix planned to build them although the cache has them, and failed. Substitute whatever the caches have.

143always-allow-substitutes=

true

Copied once, so that they can be edited.

147systemd.tmpfiles.rules=

"d /etc/nixos 0755 root root -" "C /etc/nixos/flake.nix - - - - ${flake}" "C /etc/nixos/configuration.nix - - - - ${configuration}" "z /etc/nixos/flake.nix 0644 root root -" "z /etc/nixos/configuration.nix 0644 root root -"

Not git: github: flake inputs come as tarballs, and the Fil-C git with its Perl, Python and GnuPG would double the image.

157environment.systemPackages=

with pkgs; nano curl

162system.stateVersion=

"26.05"

164system.build.qcow2=

import"${native.path}/nixos/lib/make-disk-image.nix"

165pkgs=

native

166inherit

lib config

167name=

"filnix-nixos-image"

168baseName=

"filnix-nixos-${config.system.nixos.label}"

169format=

"qcow2-compressed"

170partitionTableType=

"legacy"

Room for a few rebuilds; free space compresses away. growpart takes the root file system further on a bigger disk.

173additionalSpace=

"8G"

174copyChannel=

false

175memSize=

2048

uses cache configuration flake native rev