SrvOS is a production-grade NixOS and nix-darwin configuration framework that provides opinionated, modular server configurations. The codebase exports NixOS modules organized into machine types (common, server, desktop), hardware profiles (Hetzner, AWS, DigitalOcean, Vultr), roles (GitHub Actions runner, Nix remote builder), and mixins (telegraf, nginx, terminfo). It uses Nix flakes for dependency management and includes comprehensive test configurations that validate module evaluation across multiple platforms. The architecture follows NixOS module patterns with clear separation between shared configurations, platform-specific modules, and role-based configurations. Key entry points are default.nix and flake.nix, which expose nixosModules and darwinModules for consumption. The codebase demonstrates strong engineering practices with security-focused defaults (SSH hardening, sudo restrictions), comprehensive systemd service configurations, and production-ready monitoring setups. Notable for its GitHub Actions runner implementation, which includes sophisticated token management via GitHub Apps, ephemeral runner support, and secure systemd sandboxing. The Prometheus alert rules provide production monitoring capabilities with well-defined alert conditions for infrastructure health.
NUR (Nix User Repository) is a community package registry and distribution layer for Nix. In production it maintains a registry of several hundred user-contributed Nix repositories in repos.json, pins every entry to a specific revision in repos.json.lock, and exposes the aggregate as a Nix flake/overlay/package set. The Nix entry points (default.nix, flake.nix, lib/evalRepo.nix, lib/repoSource.nix) lazily translate locked registry entries into `nur.repos.<name>.<pkg>` attributes, including typed support for NixOS, Home Manager, Darwin, and flake-parts modules and overlays via flake-parts. The operational core is a small, typed Python CLI (`bin/nur` and `ci/nur/`) with subcommands for updating the lockfile, evaluating repos, formatting the manifest, generating a combined monorepo, and producing a search index. Updates run hourly via GitHub Actions: each repo is concurrently prefetched using either the Git smart HTTP protocol or GitHub/GitLab archive endpoints, evaluated in a sandboxed `nix-env` run to catch breakage, and then either locked to a new revision or pruned from the registry if deleted. A separate set of CI scripts publishes `nur-combined` and updates package search data. The architecture is cleanly split between Nix expression logic and Python automation, with careful handling of async concurrency, evaluation failures, and safety guards against accidental mass repository loss.
This repository is a personal Nix configuration (dotfiles) for managing a heterogeneous fleet of machines: NixOS desktops and servers, macOS laptops (via nix-darwin), and Kubernetes clusters (k3s, KubeVirt). It is structured as a Nix flake with modular components for system configuration, home-manager profiles, package overlays, secrets management (agenix), and infrastructure monitoring (Grafana, Prometheus, VictoriaMetrics, Loki). The codebase demonstrates advanced Nix patterns: parameterized module generators for K3s and KubeVirt, automatic file scanning for module imports, declarative disk partitioning (disko), ephemeral root filesystems with persistent state (preservation), and sandboxed GUI applications (nixpak, bwrap). It also includes a custom desktop shell (noctalia) and extensive input method customization (Rime/Fcitx5). While highly personalized and not intended for direct reuse, the architectural patterns and modular design serve as a reference for building complex Nix-based infrastructure. The repository is actively maintained with eval tests and CI, but lacks integration tests for runtime services.