posts
The responses don't have to be strictly NixOS or Linux specific as I expect the general process to be very similar.
I never hardened a system before so I'm not sure what things I should be focusing on and what solutions are out there. I'm hearing a lot good on SELinux and apparmour but but those sadly aren't supported on NixOS. Recently I set up adguard home with somewhat strict blocklists and SearxNG to take control over my web searches. In the coming days I intend to set up wireguard and a VPN in my config and I also have some firefox extensions for blocking ads, trackers, JS, port scanning, etc. but it all feels surface level and I don't know where to take things from there. What are you guys doing with your setups?
Usually I prefer to never ask questions and look things up myself but reddit will soon block everything with a login wall and that's where I get most info from so I'm finally giving it a shot. :p
Hey folks, for about 10 months or so been working on a hobby project just to get more practice in Linux application packaging, the Rust ecosystem/utilities, and software development on Nix and NixOS (as well as solve some personal pain points in using a HDMI TVs and projectors with PCs).
I'm posting here as while the project isn't still fully stable, it's daily drivable and fully documented, and I feel other Nix users aren't too shy of beta software. While the pedantic app code may not be much to write home about, I'd be curious here on feedback of my nix packing approach, use of flakes for development and distribution, dev shell setup, and systemd services & permissions.
The app itself follows more of a distributed pub/sub architecture (my background is in robotics and cyber-physical system design, not desktop software), so converging on IPC and middle-ware libraries I've been meaning to experiment while keeping the installable setup self contained was a balance.
I've also adopted Cachix into the release pipeline (sparing my poor laptop and RPi from building the arm binaries with every release), but would be interested in finding other (Rust?) projects making use of Nix in CI for development to learn from, as that remains a large gap in GitHub Actions setup that is still imperatively Ubuntu based.
Links to the rendered docs and source repo (NixOS install instruction included if you'd like to try it).
Cheers
Hey guys, i could use some help.
I am trying to build cuprate: https://github.com/Cuprate/cuprate/ with the instructions found in https://github.com/Cuprate/cuprate/pull/728/changes/48ee1bb9ed2dc3a0d7b53f66bb48f6273c964a26
It builds fine, but when attempting to run it i get
[nix-shell:~/build/cuprate/cuprate/target/release]$ ./cuprated -h
./cuprated: error while loading shared libraries: libstdc++.so.6: cannot open shared object file: No such file or directory
[nix-shell:~/build/cuprate/cuprate/target/release]$
There is a build problem that started just when the update got merged. Does anyone know what happened?
Tired of rolling back to an old NixOS generation and having no idea which commit it was built from? Here's how to fix that: ikskoder.dev/blog/nixos-generations-git-commits
soooo i'm new to nix and nixos and i want to switch from gnome to hyprland. however there is a reallly steep learning curve for both and in the meantime i am looking for a working out of the box flake or configuration repo that i can just add to my configs as a starter to get hyprland up and running. is that a thing? thanks!
edit: thanks everyone for enlightening me about hyprland's bad origins, let's reframe it to - any hyprland alternative that aren't Nazi adjacent?
On my raspberry pi (aka oliserver) I removed ~/.local but I forgot that nix profiles are stored there, and now I can't access my home manager packages (commands, terminfo etc.). Is there a way to restore the ~/.local/state/nix/profiles/profile symlink? I already tried switching the config again. I am using nixos module home manager with den.nix, dots are here
edit: solved by setting uninstall = true in home manager, switching, and rolling back
So recently I've been working on creating a declarative PrismLauncher setup in Nix
While it's usable , there are still some things to be done
Check it out: https://codeberg.org/OliMoli/prismix
Feature requests / PRs / other contributions are welcome :)
nixpkgs is on Shithub and so are many of its dependencies. git mirrors of those dependencies can exist on other forges e.g KDE and Gnome have their own Gitlab instances. This project is an overlay that overrides pkgs.fetchFromGitHub to try and clone from those forges first if they are known to the overlay. The old fetchFromGitHub is only used when no alternative is known to the overlay. You could consider this an index of alternative forges hosting the git repo. How to contribute
Mirror a git repo used by nixpkgs or find an existing mirror Create a PR to add it to the list of alternatives
Tip: to find out which repos still need mirroring, use warnOnShitHub = true; when activating the overlay and run nixos-rebuild on your config. Why? Shithub decided to rate-limit unauthenticated git clones about 2 weeks ago because of "AI scapers" (which they of course also run) and that broke my system for a day. I see this as the writing on the wall that Microslop is moving forward in their EEE-ways. They embraced ShitHub, extended it, and have been slowly restricting unauthenticated operations. I can barely search for code without getting a rate limit warning. Sometimes even clicking on files too quickly will trigger a rate limit. Microslop will only make Shithub worse for unauthenticated people and at some point, they'll require payment.
new to nixos. I have found a flake.nix file on the internet which I used to build my system. in that flake file I found the following line:
{
inputs = {
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
antigravity-nix = {
url = "github:jacopone/antigravity-nix";
inputs.nixpkgs.follows = "nixpkgs";
};
};
outputs = { self, nixpkgs, antigravity-nix, ... }: {
nixosConfigurations.your-hostname = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
modules = [
./configuration.nix
./hardware-configuration.nix
{
environment.systemPackages = [
antigravity-nix.packages.x86_64-linux.default # Base App
antigravity-nix.packages.x86_64-linux.google-antigravity-ide # IDE
antigravity-nix.packages.x86_64-linux.google-antigravity-cli # CLI
];
}
];
};
};
}
if I understood correctly the flake also has outputs variable in the attribute set and it's returning nixpkgs whose url is set to the unstable. does it mean I am running unstable version of nixos?
Thanks in advance!
They also have a website with docs: https://nixmultiverse.com/docs/
The website can also be used to search for specific package versions in nixpkgs, to get the nixpkgs revision: https://nixmultiverse.com/
The above feature is similar to: https://lazamar.co.uk/nix-versions/ or https://www.nixhub.io/ , but using this project is a way easier alternative than searching for an pinning revisions.
I'm a relatively new user and I've successfully set up Hyprland with home manager. I wanted to try out Niri though but it's a bit more confusing for me. What's the point of that repo? Does the Niri that's in nixpkgs not work with home manager? Is that repo, and that repo alone, expected if you're using home manager and want to manage Niri with it?
Thanks!
I'm really liking Jujutsu (a.k.a jj) for version control! If you're not familiar, jj is a version control system that interoperates with git. It removes a lot of possible states git can get into, adds much more helpful oopsie recovery, and adds some useful abstractions.
I'm working on setting up my workflow to cover the functionality that I previously got from git hooks. I'm used to using one of my projects, git-format-staged, to automatically format code. Here's an example Nix project config that does that.
(I don't like to set my editor to format on save because that doesn't go well with autosave. Thus hooks.)
I saw that there is discussion on using pre-commit with jj in this thread. That has spawned two projects, jj-pre-push and jj-hooks, that can both run pre-commit - but they run it before pushing to a git remote, not on at commit time, because running a hook on every commit change doesn't work well with jj's model.
I'm trying something different because I want formatting to run earlier than on push. And of course I want my setup to be automated with a Nix devShell!
I thought a natural point to "hook in" would be on bookmark moves.
In jj branches are anonymous, but there are named "bookmarks".
Bookmarks don't move automatically like git branch pointers - you move them manually.
When working with an upstream git repo you get bookmarks that are associated with remote
branches - they're similar to local tracking branches in git.
When you run jj git push it updates remote branches to the commits the
matching bookmarks are on.
So I think of bookmarks as my plan for what I'm going to push.
The typical workflow is:
- do some work
- advance a bookmark to the latest commit I'm ready to push
jj git pushdoes basically whatgit pushdoes if you setpush.default = matching(or if you rungit push origin :)
Usually the latest commit in your anonymous branch in jj is the "working copy"
which you probably don't want to push. So it's common to advance the bookmark to
the most recent "finished" commit: the parent of the working copy. That commit is
referenced by the expression @-
All that to say, I'm trying out an alias that automatically advances the
"closest" bookmark to @-, and runs jj fix on all of the commits that are now
in the bookmark's history that weren't before. (This is a Home Manager config
snippet):
# Move closest bookmark to @-, and run jj fix;
programs.jujutsu.settings.aliases.tug = [
"util"
"exec"
"--"
"bash"
"-c"
''
set -euo pipefail
jj fix -s 'heads(::@- & bookmarks())..@- & mutable()' # fix revisions after bookmark, up to and including @-
jj bookmark move --from 'heads(::@- & bookmarks())' --to '@-'
''
"" # last string becomes $0 -- see jj docs
# TODO: accept an argument to override @- as the new bookmark target
];
The tug alias has been floating around. My addition is the jj fix command.
If I use this alias my changes get automatically formatted before I commit to
pushing them.
jj fix is intended specifically for automatic code formatting. Because jj is
especially good at editing history, the fix command is good at retroactively
formatting commits. It identifies changed files in each of the given commits,
and runs their content through formatters via stdio. It's capable of formatting
only changed portions of files if you configure formatters to accept line ranges.
Understanding that script requires spending some time learning jj's revset language. The very short version is:
jj fix -s <expression>runs configured fix tools on the specified commitsheads(::@- & bookmarks())is a fancy way of identifying the closest commit with a bookmark on the DAGheads(::@- & bookmarks())..@-selects commits after that bookmark, up through@-& mutable()filters out commits that have already been pushed tomain(in case you're pushing a merge). Commits already in your upstream trunk are considered "immutable" by default
I'd prefer a native hook to be able to run commands on any jj command that moves a bookmark. Maybe someday!
The last step is configuring the formatters that jj fix runs. This is where
the real Nix configuration comes in!
Formatters are set up in the jj config file.
Like with git you have a global config, and also a repo-specific config.
Also like with git, jj has a command to programmatically set config values.
I set up this devShell to use that command to automatically set up the repo-specific config for my project:
# Set formatters for `jj fix` to use for this repo
{
perSystem = { lib, pkgs, ... }: {
devShells.jj-fix =
let
# A JSON array is also a valid TOML array, so builtins.toJSON gives us
# a value literal that `jj config set` will accept for `command` and
# `patterns`.
tomlArg = value: lib.escapeShellArg (builtins.toJSON value);
set-tool-config = tool-name: config: /* bash */ ''
jj config set --repo fix.tools.${tool-name}.command ${tomlArg config.command}
jj config set --repo fix.tools.${tool-name}.patterns ${tomlArg config.patterns}
'';
# This variable holds the actual configuration for my three formatters
fix-tools = {
nixfmt = {
command = [
(lib.getExe pkgs.nixfmt)
"--filename=$path"
];
patterns = [ "glob:'**/*.nix'" ];
};
prettier = {
command = [
(lib.getExe pkgs.prettier)
"--stdin-filepath=$path"
];
patterns = [
''
(glob:'**/*.[jt]s' | glob:'**/*.[jt]sx' | glob:'**/*.json' | glob:'**/*.css' | glob:'**/*.md')
~ glob:'.expo/types/**' ~ glob:'**/.sqlx/**'
''
];
};
rustfmt = {
command = [
(lib.getExe pkgs.rustfmt)
"--edition=2024"
"--emit=stdout"
];
patterns = [ "glob:'**/*.rs'" ];
};
};
in
pkgs.mkShell {
shellHook = builtins.concatStringsSep "\n" (lib.mapAttrsToList set-tool-config fix-tools);
};
};
}
# TODO: Does not automatically remove tools from jj config if they are removed from the devShell
That's my first pass. At some point I might publish a flake-parts module that abstracts out the boilerplate to make this nicer to use.
In theory it's sort of like using git-format-staged. Formatting runs less frequently than with a pre-commit hook. That might mean a higher chance of conflicts. But the jj fix docs make bold claims about never introducing conflicts. We'll see. I'm still experimenting with this setup.
Another possible workflow is hooking into jj new to run fix on the commit
that just stopped being the working copy.
The main functionality that's still missing for me is a replacement for the git
pre-commit hook that I had that runs cargo prepare sqlx on pre-commit.
That command needs to be able to read changed source files, and to output
separate files to add to version control. There's an upcoming jj run command
that might do the
trick.
ive got a surface tablet at work running nixos. it mostly is used to view security cameras.
the machine is fairly low spec and bogs itself down after a coupke days, so id like it to auto reboot at 9am. i work a late shift and often don't leave til around 2am.
i guess we don't use cron anymore? i really don't understand how the systemd timers work... the wiki doesnt really give great details...
systemd.timers."autoreboot" = {
wantedBy = [ "timers.target" ];
timerConfig = { OnCalendar="*-*-* 9:00:00"; Unit = "autoreboot.service"; };};
systemd.services."autoreboot" = {
script = ''
set -eu ${pkgs.coreutils}/run/current-system/sw/bin/reboot'';
serviceConfig = {
Type = "oneshot"; User = "root";};
};
the systemd target seems to be created, but it reports as dead when i check it...
any advice?
Recently garnix shutdown, which mean trying to rebuild my config while having it as a subsituter just failswith a bad gateway. Issue is, to remove it from my config, i gotta rebuild my config, which obviously fails since it tries to check for garnix. Not sure what to do here
EDIT: I fixed by by "overriding" my nix config, I jsut copied the substituter related entry in the nix.conf geberated by nix, pasted them in ~/.config/nix/nix.conf and removed garnix from those, then just rebuild the config and boom it worked. Just dot forget to then remove those lines from the user nix config
Fair warning, I used Claude for a lot of the details. Architecturally, it's my design.
Got NixOS running on my reMarkable Pro Paper Move (codename: chiappa) because when I got this tiny tablet, it was with the goal of replacing my iPad Mini (which I mainly used to read books on anyway) and wanting to use something that ran Linux (I use NixOS on every other machine I touch except my Phone...).
Finally got around to (helping Claude) port NixOS though so now, besides having my config live alongside the rest of my machines, I can boot right into KOReader and not play silly games with Xochitl everytime I reboot. Plus, being my own NixOS config, I can (WIP/testing) load/use other applications with ease.
The details and how to set it up are mostly in the NixOS flake/associated repo over here:
https://github.com/gitman-101111/remarkable-nixos
If you want to use the e-ink bridge/associated tools to port to another OS of your choice (I tried and succeeded in porting to PostmarketOS but they have a strict no generative AI policy), you can use this repo (which the flake also references):
https://github.com/gitman-101111/chiappa
All the hardware works with KOReader with some minor patching. Feel free to play around with different configurations, etc.
Details on the setup and specifics are in the repos.
Lastly, I wouldn't recommend this to people unfamiliar with NixOS or at least some Linux experience. There's a lot of information here on how to essentially brick your device lol. Be careful out there! :)
Pretty much the title. Please bear with me, since I'm sort of a beginner 😅
I am trying to use nixpak to sandbox iamb, but for whatever reason, it doesn't start up and run properly. Here's the relevant section of the config
environment.systemPackages = [
(mkNixPak {
config = { pkgs, sloth, ... }: {
app.package = pkgs.iamb;
bubblewrap = {
network = true;
shareIpc = false;
dieWithParent = true;
bind.rw = [
[
(sloth.mkdir (sloth.concat' sloth.homeDir "/Downloads/iamb"))
(sloth.concat' sloth.homeDir "/Downloads")
]
(sloth.mkdir (sloth.concat' sloth.xdgConfigHome "/iamb"))
(sloth.mkdir (sloth.concat' sloth.xdgDataHome "/iamb"))
(sloth.mkdir (sloth.concat' sloth.xdgStateHome "/iamb"))
(sloth.mkdir (sloth.concat' sloth.xdgCacheHome "/iamb"))
];
bind.ro = [
"/etc"
"/usr"
# To mount the systemd resolution stuff and so on
"/run/systemd"
];
apivfs = {
proc = true;
dev = true;
};
bind.dev = [
"/dev"
];
tmpfs = [
(sloth.mkdir "/tmp/iamb")
];
env = {
TERMINFO = "${pkgs.kitty}/lib/kitty/terminfo";
};
};
};
}).config.env
];
The full config can be found here
The following bubblewrap command works as-is on nixos, and doesn't lead to any errors whatsoever:
bwrap --ro-bind /usr /usr \
--ro-bind /etc /etc \
--proc /proc \
--ro-bind /home/innocentzero/.local/state/nix/profile /home/innocentzero/.local/state/nix/profile \
--ro-bind /nix/store /nix/store \
--ro-bind /run/systemd /run/systemd \
--dev /dev \
--tmpfs /tmp \
--unshare-all \
--share-net \
--die-with-parent \
--bind /home/innocentzero/.config/iamb /home/innocentzero/.config/iamb \
--bind /home/innocentzero/.cache/iamb /home/innocentzero/.cache/iamb \
--bind /home/innocentzero/.local/share/iamb /home/innocentzero/.local/share/iamb \
iamb
However, executing the nixpak wrapped iamb produces the following (including the control characters):
^[[?62;4;22;28;52c^[[6;25;11t^[[0n* Logging in for @innocentzer0:cyberia.club...
Any ideas/suggestions? I'm not sure how exactly to get this to work. From what I see in the nixpak module, the generated command should be about the same. Any help is appreciated. Thanks!
This may be an unusual thing but I realised that use nix run a lot instead of putting the package in my nixos configuration. It's often on packages I run at most once every 3 days
Am I the only one that does that?
I need to find out how much garbage can be cleared when 'nix-collect-garbage -d' is run for a personal project but I haven't been able to find any answer about this on documentations and DDG.
I've tried 'du -sh /nix/store' but it would print the size everything in /nix/store however 'nix-collect-garbage -d' does not remove everything when it's executed so that's not gonna work. I've also tried executing "nix-store --gc --print-dead | grep '^/nix*'" ('--print-dead' produces output that which contains store paths that are not live and will not be used, with respect to roots) and then executing "stat -c '%s'" on each path ('stat -c "%s" $file_name' produces output containing the bytes of the concerned file in bytes) however that doesn't seem to work as well for some unknown reason as they all seem to add up to a few kilobytes (despite the actual amount that 'nix-collect-garbage -d' deletes being about 400MB).
I know that the code below is extremely shit but that's because that's not my main project but a separate script solely for trying to find out what I am doing wrong and how I can properly implement this in my main project.
Thanks for any help!
`#!/usr/bin/env bash
tmp() {
declare -a str byt
str=( $(nix-store --gc --print-dead 2>/dev/null | grep '/nix*') )
for garbage in "${str[@]}"; do
byt+=( $( stat -c '%s' $garbage ) )
done
total=0
for filesize in "${byt[@]}"; do
total=$(( $total + $filesize ))
done
convertedtotal="$(( ( $total / 1024 ) /1024 ))MB"
echo "$total"
echo "$convertedtotal"
}
tmp`
Some responses from people on other platforms that did not work perfectly:
"I had the same issue a couple months back, i asked claude back then and got: sudo nix-store --gc --print-dead 2>/dev/null | xargs -I{} du -s {} 2>/dev/null | awk '{sum += $1} END {printf "%.2f GB\n", sum/1024/1024}'"
And
"```
bytes=$(
nix-store --gc --print-dead |
xargs du -sb |
awk '{s+=$1} END {print s}'
)
numfmt --to=iec "$bytes"
some like this should work for you"
Both of them had one issue:
`$ nix-store --gc --print-dead | grep '^/nix*' | xargs du -sh | awk '{ print $1 }'
finding garbage collector roots...
determining live/dead paths...
8.0K
8.0K
8.0K
4.0K
1.6M
1.9M
8.0K
2.3M
8.0K
45M
4.0K
4.0K
8.0K
4.0K
4.0K
4.0K
684K
8.0K
8.0K
4.0K
8.0K
8.0K
7.7M
692K
4.0K
728K
8.0K
8.8M
344K
492K
4.0K
572K
8.0K
1.1M
4.0K
4.0K
8.0K
4.0K
8.0K
36K
8.0K
8.0K
8.0K
4.0K
4.0K
8.0K
# All of that is about 72MB.
$ nix-collect-garbage -d
removing old generations of profile /home/north/.local/state/nix/profiles/home-manager
removing old generations of profile /home/north/.local/state/nix/profiles/profile
finding garbage collector roots...
deleting garbage...
deleting '/nix/store/vdixm6r047a3rw1wx8pqsjh40nl886jj-kate-26.04.2.drv'
deleting '/nix/store/s5i0c135x2x5dz9ah01zxvl3prywqb30-kate-26.04.2.tar.xz.drv'
...
deleting '/nix/store/rivv4fh68mkqnc4v225mflmi3a9damcj-xfconf-4.20.0'
deleting '/nix/store/9nj1k063j54qfxzcm49dspwwl1sxhqs0-libxfce4util-4.20.1'
deleting unused links...
note: hard linking is currently saving 0.0 KiB
46 store paths deleted, 64.8 MiB freed`
Now what's strange is that 'nix-store --gc --print-dead' outputs these 46 paths (which add up to ~72MB) and 'nix-collect-garbage -d' deletes 46 paths but somehow, 64.8 MiB, which is about 68MB, is freed instead of 72MB. I tried to replicate this again and it worked, there's always some amount of inaccuracy. Of course, a few megabytes don't matter but this can create significant inaccuracies on systems with more cache, but this definitely is a lot better.
So I came here while researching for the problems with qt5 theme. So in the archi wiki it says -
3.1 QGtk3Style
This is a platform theme built into qt5-base starting with version 5.7.0 [2] and qt6-base. It can be used to style Qt5 and Qt6 applications according to current GTK3 style. It can be enabled by setting the following environment variable: QT_QPA_PLATFORMTHEME=gtk3.
I am on nixos and if i set the same envionment variable qt6 apps like pcmanfm-qt, qbittorrent correctly use the same colors as my gtk3 theme, but it seems qt5 apps (like wpa_supplicant_gui, keepassxc, picard) even though in logs they seem to load the plugin, dont theme accordingly and show the default white color. I just want to know is the plugin abandoned? Meaning its no use trying to wait for it to update and be fixed or should i just switch to qtstyleplugins for qt5 apps?
I Can confirm this if i run
QT_DEBUG_PLUGINS=1 QT_QPA_PLATFORMTHEME=gtk3 wpa_gui 2>&1 | grep -i gtk3
and logs show
QFactoryLoader::QFactoryLoader() looking at "/nix/store/64qmp7fap3740hxd2bsnpy10s9ndy5qx-qtbase-5.15.18-bin/lib/qt-5.15.18/plugins/platformthemes/libqgtk3.so"
Found metadata in lib /nix/store/.../libqgtk3.so, metadata=
"gtk3"
"className": "QGtk3ThemePlugin",
Got keys from plugin meta data ("gtk3")
loaded library "/nix/store/.../libqgtk3.so"
- Note: The old qt5-styleplugins do work just need to set the variabled to gtk3 instead of gtk2
Side by side comparison
- qbittorrent (qt6 app)
Its using qt6, i can confirm
nix why-depends nixpkgs#qbittorrent nixpkgs#qt6.qtbase
/nix/store/i8r2n73xzlxk7sfchjlkdxajs8jbqbv0-qbittorrent-5.2.1
└───/nix/store/wzvm2pvf98a71v0scgfhmi01lqcxahfr-qtbase-6.11.0

- picard (qt5 app)
Its using qt5, i can confirm
nix why-depends nixpkgs#picard nixpkgs#qt5.qtbase
/nix/store/wzqlnryvnjl95a93fiwwivlbz3ypixk7-picard-2.13.3
└───/nix/store/64qmp7fap3740hxd2bsnpy10s9ndy5qx-qtbase-5.15.18-bin

I can confirm the same behaviour for the other aforementioned apps.
Sorry if this is an ignorant question. I love Nix, but as a user it feels absurd that changing an option from true to false in a home-manager managed config file that then gets transpiled from Nix to TOML, for instance, takes like 10 seconds on a decently modern machine.
In my world that kind of transpilation should be instant. I get that there's more happening behind the scenes than just doing Nix -> TOML, but still. Imagine if the transpilation of config files were instant, so you could have home-manager automagically do the transpilation every time you save the file. That would be awesome, especially for programs that support hot-reloading like Hyprland or Niri.
Is this a Nix issue or a home-manager issue? How much of speedup would it yield to rewrite Nix and/or home-manager in a faster language like Zig or Rust?
"Faust et al." is about to be published as a result of the Akademie AIR residency I did last year at Schmiede. It's an algorithmic #comic where I drew, by hand, a conversation with a tuned Gemma3 model in Ollama (run locally on my laptop).Conversation is around power, knowledge, agency and anthropomorphizing A.I.I used Ollama and @Krita on a @nix machinee.pcloud.link/publink/show?cod