dotfiles

Personal dotfiles that can be placed in the public repository
Also known as 盆栽(bonsai) 🌳

block-beta
    columns 2

    block:os:2
        nixos(("❄")) windows(("🪟"))
    end

    block:vm:2
        lima("Lima") wsl2("WSL2")
    end

    block:container:2
        podman("🦭") k8s("☸️") 
    end

    nixos --> lima
    windows --> wsl2

    vm --> container
    nixos --> container

Loading

For visitors

If you are using Podman, you can test the pre-built ubuntu container-image as follows.

bash <(curl -fsSL https://raw.githubusercontent.com/kachick/dotfiles/main/containers/sandbox-with-ghcr.bash) latest

Or, you can directly use some commands with nix run without any installation steps.

nix run 'github:kachick/dotfiles#todo'

List them

nix flake show 'github:kachick/dotfiles' --json 2>/dev/null | jq '.packages | ."x86_64-linux" | to_entries | map("\(.key) # \(.value.description)")'

NixOS

List defined hostnames

nix eval --json 'github:kachick/dotfiles#nixosConfigurations' --apply 'builtins.attrNames' | jq '.[]'

Using flake style is disabled in NixOS by default and you should inject git command to use flakes.

NOTICE: This command might drop all existing users except those defined in the configurations.

nix --extra-experimental-features 'nix-command flakes' shell 'github:NixOS/nixpkgs/nixos-26.05#gitMinimal' \
	--command sudo nixos-rebuild switch \
	--flake "github:kachick/dotfiles#$(hostname)" \
	--show-trace

Finally, reboot the device

sudo reboot now

Refer to the sample flake for an example of inheriting modules from another repository.

home-manager

List definitions

nix eval --json 'github:kachick/dotfiles#homeConfigurations' --apply 'builtins.attrNames' | jq '.[]'

Ubuntu

1. Install and configure Nix:

   curl -fsSL https://raw.githubusercontent.com/kachick/dotfiles/main/scripts/install-nix.bash | bash

2. If you forgot to add something during the installation phase, manually add it.
   Some configurations require a reboot to be applied, such as trusted-users.

3. Make sure there is a nix directory that is used in the home-manager.
   This is a workaround, See the thread for details

   mkdir -p ~/.local/state/nix/profiles

4. Restart current shell to load Nix as a PATH

   bash

5. Apply dotfiles

   NIX_CONFIG='accept-flake-config = true' nix run 'github:kachick/dotfiles#home-manager' -- switch -b backup --flake 'github:kachick/dotfiles#user@wsl-ubuntu'

6. Apply system level dotfiles with sudo for nix command

   sudoc nix run 'github:kachick/dotfiles#apply-system'

7. Enable tailscale ssh if required

   sudoc tailscale up --ssh

Podman on Ubuntu

1. Install uidmap without Nix for use of podman even if the podman will be installed from nixpkgs

   • "shadow" in nixpkg is not enough for podman - NixOS/nixpkgs#138423

   sudo apt-get install --assume-yes uidmap

2. Make sure the cgroup v1 is disabled if you are on WSL, See the docs

3. Make sure you can run containers as podman run public.ecr.aws/debian/debian:stable-slim cat /etc/os-release

Debian

After installing missing tools, you can complete the same steps as on Ubuntu

sudo apt update
sudo apt upgrade
sudo apt install --assume-yes curl
sudo apt install --assume-yes dbus-user-session # For podman

Remember to set special config and reboot if you are on WSL

echo '
[boot]
systemd=true' | sudo tee /etc/wsl.conf

Windows

1. Install WSL2 with default Ubuntu. Activate home-manager as user@wsl-ubuntu
2. Install NixOS-WSL. Apply NixOS config.
3. Adjust Windows experience as written in extracted steps and as written in CI for further details.

Multi-booting on Windows and Linux

Check traps

Lima

1. Base Environment Setup

1. Create the clean base instance with Nix and Home Manager, then stop it:

   limactl start --name=docker-nix-clean template:docker-nix
   limactl stop docker-nix-clean
   rm -rf ~/.lima/docker-nix-clean/sock # Avoid a Lima bug where empty sock dir causes permission warnings in clones

   • Host ~/repos/github.com/kachick is mounted without mounting $HOME (keeping SSH, GPG, and secrets isolated).
   • When ~/repos/github.com/kachick/dotfiles exists on the host, the VM automatically provisions using your local working copy (reflecting current branch and edits).

2. Clone and start the standard docker-nix instance for daily use:

   limactl clone docker-nix-clean docker-nix --start

   • docker-nix is configured to autostart with user sessions.

   • Run containers:

     limactl shell docker-nix docker run --rm hello-world

2. Disposable Sandbox (Suitable for AI Agents and Experiments)

Clone a quick sandbox instance from docker-nix-clean for safe experiments:

1. Clone and start a sandbox instance:

   • Standard Sandbox (Mounts ~/repos/github.com/kachick like base):

     INSTANCE="sandbox-$(head -c 16 /dev/urandom | sha256sum | cut -c1-4)"
     limactl clone docker-nix-clean "$INSTANCE" --start

   • Strict Project Isolation (Mounts only current directory without other repos):

     INSTANCE="sandbox-$(head -c 16 /dev/urandom | sha256sum | cut -c1-4)"
     limactl clone docker-nix-clean "$INSTANCE" --mount-only .:w --start

     Pass additional --mount-only /path:w flags if you want to attach other directories (do not use --mount, as it conflicts with --mount-only).

2. Work inside the sandbox:

   lima --instance "$INSTANCE"

3. Destroy when done:

   limactl delete -f "$INSTANCE"

Windows on Lima

Check latest instruction for Windows guests.
If you want windows-11 rather than windows-2025, you should manually download the "English ISO file" from microsoft.

How to setup secrets

Extracted to wiki

Shorthand

If you are developing this repository, putting .env makes easy reactivations.

echo 'HM_HOST_SLUG=wsl-ubuntu' >.env

Then you can enable configurations with

task apply