$ show nix-community/srvos
SrvOS is a production-grade NixOS and nix-darwin configuration framework that provides opinionated, modular server configurations. The codebase exports NixOS modules organized into machine types (common, server, desktop), hardware profiles (Hetzner, AWS, DigitalOcean, Vultr), roles (GitHub Actions runner, Nix remote builder), and mixins (telegraf, nginx, terminfo). It uses Nix flakes for dependency management and includes comprehensive test configurations that validate module evaluation across multiple platforms. The architecture follows NixOS module patterns with clear separation between shared configurations, platform-specific modules, and role-based configurations. Key entry points are default.nix and flake.nix, which expose nixosModules and darwinModules for consumption. The codebase demonstrates strong engineering practices with security-focused defaults (SSH hardening, sudo restrictions), comprehensive systemd service configurations, and production-ready monitoring setups. Notable for its GitHub Actions runner implementation, which includes sophisticated token management via GitHub Apps, ephemeral runner support, and secure systemd sandboxing. The Prometheus alert rules provide production monitoring capabilities with well-defined alert conditions for infrastructure health.
The LLM identified 5 files worth highlighting for reuse:
Implements a production-ready GitHub Actions runner systemd service with sophisticated security hardening. Features include dynamic user isolation, private filesystems, capability bounding, and secure token handling via GitHub Apps. The ExecStartPre scripts handle runner registration, token rotation, and state management with proper diff detection for configuration changes. Demonstrates non-obvious skill in systemd sandboxing and secure credential management.
Defines a role-based configuration that dedicates a machine to GitHub Actions runners. Implements multi-instance deployment via count parameter, integrates Cachix watch-store for artifact caching, and supports ephemeral runner mode. The role pattern allows deep configuration changes without conflicts, demonstrating NixOS role-based architecture best practices.
Contains production-grade Prometheus alert rules covering infrastructure health, service monitoring, and system metrics. Includes rules for filesystem capacity, memory pressure, disk latency, ZFS errors, and service restarts. The alert expressions demonstrate deep understanding of monitoring patterns and operational requirements for server infrastructure.
Implements hardened SSH configuration with password authentication disabled, X11 forwarding disabled, and system-level authorized_keys enforcement. The module demonstrates security-first configuration patterns with proper handling of Gitea/GitLab integration scenarios. Shows non-obvious skill in SSH security hardening for server environments.
Configures systemd-networkd with production-ready defaults including PMTU/DHCP support, firewall rules, and network service restart optimization. The stopIfChanged=false pattern prevents network downtime during system updates, demonstrating operational awareness. Shows skill in systemd networking configuration for server environments.