gamut

A single NixOS flake covering every machine I run.

Gamut: the complete range of colours a device can reproduce. The hosts are named for colours, so the repo is named for the set of them.

Host	Machine	Arch	Role
red	laptop	x86_64	main workstation, dual-boots Arch
amber	desktop	x86_64	heavy/GPU work, NVIDIA, dual-boots Windows, intermittently online
green	Raspberry Pi 5	aarch64	NAS, NVMe SSD, always on
blue	VPS	x86_64	always-on public host

Channel: nixpkgs 26.05 (stable) everywhere. Dotfiles via Home Manager.

Usage

Common tasks are just recipes -- run just on its own to list them.

just nix-switch blue      # apply this config to blue, permanently
just nix-test blue        # apply it only until the next reboot
just rollback blue        # undo the last rebuild
just generations blue     # what you could roll back to
just gc blue              # prune generations older than 30 days
just hs-join              # join THIS machine to the tailnet
just hs-join amber        # join amber to the tailnet, over SSH

The underlying commands, if you want them directly:

# Rebuild the machine you're sitting at
sudo nixos-rebuild switch --flake .#amber

# Try a change without making it the default boot entry
sudo nixos-rebuild test --flake .#amber

# Deploy to another machine over SSH/Tailscale.
# NB: 26.05 uses --sudo; --use-remote-sudo was the pre-25.05 spelling.
nixos-rebuild switch --flake .#blue --target-host danzi@blue --sudo --ask-sudo-password

# Update pinned inputs
nix flake update

If a rebuild breaks the machine, pick the previous generation from the boot menu. Nothing is destroyed by a bad config.

Layout

flake.nix          inputs (pinned) + nixosConfigurations
CLAUDE.md          conventions for working in this repo
GLOSSARY.md        NixOS terminology
hosts/<name>/      per-machine config, and that machine's INSTALL.md
modules/common/    applies to every host
modules/desktop/   niri, greetd, audio, fonts       (Phase 3)
modules/dev/       toolchains                       (Phase 3)
modules/server/    NAS services                     (Phase 4)
home/danzi/        Home Manager -- dotfiles, user packages

Per-host install runbooks live beside the host they describe: hosts/blue/INSTALL.md, hosts/red/INSTALL.md.

Roadmap

Ordered by risk, lowest first -- though green jumped the queue, because the services it hosts are wanted before the desktop is.

• Phase 0 -- repo skeleton, flake evaluates
• Phase 1 -- blue (VPS). Installed 2026-09-06 with nixos-anywhere. Headscale 0.28 behind Caddy at https://blue.danzi.gay, Let's Encrypt certificate issued automatically. Took three attempts: missing virtio drivers, then a BIOS->UEFI firmware change on reimage. Both recorded in hosts/blue/INSTALL.md
• Phase 2 -- green (Pi 5). Installed 2026-09-07 from a running Raspbian, using nixos-raspberrypi because the generic aarch64 image will not boot this board. Forgejo serving at https://git.danzi.gay, proxied from blue over the tailnet. See hosts/green/INSTALL.md
• Phase 3 -- rest of green's services: NFS shares, restic backup target
• Phase 4 -- amber (desktop) to a minimal booting box: console + SSH + Tailscale, NVIDIA still commented out
• Phase 5 -- the real amber: NVIDIA, niri desktop, toolchains. Factor shared parts into modules/desktop and modules/dev
• Phase 6 -- red (laptop), following hosts/red/INSTALL.md. Highest risk: shared 1 GiB ESP with Arch
• Later -- Forgejo Actions runner on amber for CI; photo hosting (Immich needs 6 GB RAM, so not on a 2 GB Pi)

Secrets (sops-nix) deferred until something actually needs one.

Known rough edges

• just nix-switch green occasionally fails at activation with sudo: no password was provided, after a long build. Re-running works. Cause not established -- nixos-rebuild pipes the password rather than relying on sudo's timestamp, so a build taking a while should not matter.
• Forgejo's SSH clone URLs are tailnet-only (SSH_DOMAIN = green.tail.internal). Caddy proxies HTTP, not SSH, so outside collaborators must clone over HTTPS.
• blue's Caddy points at 100.64.0.2, green's headscale-assigned address, rather than a name. If green ever re-registers and changes address, that line in hosts/blue/default.nix needs updating.