Modules¶
Importable NixOS modules — services, hardening, setup building blocks.
79 recipes
-
A thin NixOS module (acmeCerts) over security.acme.certs for issuing DNS-01 wildcard certificates — with the one fix that makes them actually work behind a split-horizon /…
-
A NixOS module that runs bitcoind inside a privateNetwork systemd-nspawn container, with the chain data bind-mounted from the host.
-
A NixOS module that bundles the blackbox exporter with the Prometheus scrape job that drives it, so one targets list configures…
-
A registry plus WebSSH multiplexer for terminal sessions spread across many hosts. Each host self-registers its live sessions with a small server; from one browser page you see…
-
A hardened, long-running systemd probe for diagnosing intermittent DNS and reachability flaps — the kind that are gone by the time you SSH in to look.
-
A single NixOS module that picks your container engine (Docker or rootless Podman) behind one flag, and — crucially — keeps that choice decoupled from the CDI/GPU-passthrough and…
-
A NixOS module that runs a LAN-wide pull-through cache for Docker/OCI registries on top of rpardini/docker-registry-proxy.
-
Confine a network interface — a VM bridge, a container network — so the guests behind it can reach only a named allowlist of domains, and nothing else on the internet.
-
A NixOS module: encrypted DNS (DNSCrypt / DNS-over-HTTPS) fronted by a local dnsmasq cache.
-
A NixOS module that runs an etcd cluster whose peer and client traffic rides only a private mesh interface (Tailscale, WireGuard, or a private VLAN) and is…
-
fail2ban-ipset-geoip-cloudflare
A NixOS module that backs fail2ban with kernel ipsets instead of the stock one-iptables-rule-per-ban action, seeds a whitelist from GeoIP country ranges and your CDN/reverse-proxy…
-
Self-host Firecrawl on NixOS from OCI images — api + worker + headless-Chromium, with a dedicated Redis and an optional Postgres "NuQ"…
-
A NixOS module that geo-filters inbound traffic by the source IP's country, using ipset hash tables and iptables/ip6tables (IPv4 + IPv6).
-
forgejo-bidirectional-safe-sync
A NixOS module that keeps two Forgejo instances mirrored to each other from a neutral third box — so neither forge depends on the other for backup or HA.
-
forgejo-declarative-admin-user
A NixOS module that declaratively creates and keeps in sync a Forgejo admin user — the kind you need for automated, unattended auth (API scripts, repo mirroring/bisync, CI).
-
A NixOS module for self-hosting Forgejo behind an nginx TLS front-end. It supports two deployment shapes behind one option set
-
A NixOS module that wraps upstream services.garage so a Garage S3-compatible object store is fully declared in Nix — cluster layout, buckets, and…
-
A single, credential-free NixOS provider for the MaxMind GeoLite2 databases (City, Country, ASN).
-
A NixOS module that serves GoAccess's real-time HTML log dashboard over nginx, updated live in the browser over a WebSocket, and gated to an IP allow-list.
-
A NixOS module that configures a hardened GnuPG agent (tuned for a YubiKey / smartcard) and makes a host able to receive a gpg-agent forwarded to it over SSH — so the key material…
-
A small, single-file NixOS module that forwards Grafana alerts into a Matrix room, with no bridge, no bot framework, and no third-party dependency — just Python stdlib on loopback.
-
harmonia-cache-with-upstream-fallback
Self-host a signed Nix binary cache (harmonia) behind nginx so that one substituter URL transparently covers two things
-
A timer that compares the addresses headscale actually handed out against the addresses you expect each host to hold, and fails the unit when they diverge.
-
A thin, top-level home. namespace that any NixOS module can contribute to, forwarded into one or more Home Manager users — so modules never have to know which* user owns the Home…
-
Self-host Hydra — the Nix-native CI/CD server — behind nginx, backed by a PostgreSQL database you provision declaratively instead of letting Hydra…
-
installer-iso-secrets-partition
A NixOS installer ISO that auto-joins a mesh VPN and can clone from a private forge — while the image itself contains no credentials at all.
-
Run Jaeger distributed tracing as an OCI/Docker container on NixOS, with the UI behind nginx+TLS and the OTLP ingest ports left raw for trusted…
-
Run Jellyfin inside a NixOS declarative container that is network-isolated on a private veth pair — only the host's nginx reverse proxy can reach it — while still getting Intel…
-
A NixOS module that runs a GPU/CUDA JupyterLab as a native systemd service under a strict systemd sandbox — the full lockdown treatment, minus exactly the two knobs CUDA cannot…
-
A NixOS module that wraps the upstream services.keycloak and provisions realms, OIDC clients, and users through the admin REST API on first boot — so a whole Keycloak identity…
-
local-built-docker-service-with-nix-pinned-config-merge
A NixOS module for running a self-hosted app from a Docker image built on the host (no registry, no dockerTools), while keeping the security-relevant slice of the app's runtime…
-
Keep a declarative name → overlay address map honest against the live mesh, and repair the control plane when a node re-registers under a new address.
-
Per-project throwaway dev VMs that spawn in under a second. A NixOS module that gives you a vm command: cd into any project, run vm, and you're dropped into a fresh, isolated…
-
A reusable NixOS module that turns nfdump's nfpcapd into a declarative, per-interface NetFlow/IPFIX capture service.
-
Wrap your $EDITOR — or any interactive program — in a no-network sandbox, as a NixOS / nix-darwin module. The editor runs with loopback only: no outbound, no allowlist, no proxy.
-
A small NixOS module that layers a set of opinionated defaults onto services.nginx, plus a few per-virtual-host knobs.
-
A pure-nginx caching proxy in front of cache.nixos.org (or any Nix binary cache). No nix-serve, no extra daemon — just nginx's own proxy_cache_path.
-
A tiny NixOS module that hands Nix an authenticated GitHub personal access token (PAT) so flake and fetchFromGitHub fetches stop hitting github.com's rate limit — without ever…
-
A table of remote Nix builders, a routing rule that decides which of them each host may use, and the generated ssh_config that makes the whole thing work — plus nix-builder-bench…
-
Opt-in, stackable NixOS kernel/network hardening tiers in one module. A host picks how much it wants (basic / medium / advanced, plus independent antivirus and malloc toggles)…
-
Workload-class performance defaults for NixOS: builder, services, workstation, hypervisor.
-
A drop-in NixOS module that wires a locally-attached UPS into NUT (Network UPS Tools) and the Prometheus NUT exporter, with everything bound to 127.
-
A NixOS module that makes docker run --gpus all ... actually work with an NVIDIA GPU — as a single import, not a half-configured trap.
-
Pin an exact NVIDIA driver version and carry the kernel build patches that version needs, so a bleeding-edge kernel (6.18 / 6.19 / newer) doesn't silently break the out-of-tree…
-
Per-process egress rules for OpenSnitch, written as Nix expressions, that keep matching after the package is rebuilt.
-
A single NixOS module that runs Open WebUI in front of an OpenAI-compatible backend (e.g.
-
Turn named package bundles into per-host enable toggles, where each bundle's human description is its mkEnableOption text — plus a linuxOnly helper that silently drops…
-
paperless-ngx behind gVisor + podman
Run paperless-ngx as a gVisor-isolated podman container behind an nginx TLS reverse proxy, with dedicated loopback Redis and host-persisted…
-
An opinionated NixOS module that wraps upstream services.patroni for running a PostgreSQL high-availability cluster whose etcd voting quorum is pinned to one region.
-
A NixOS module: a local HAProxy that gives PostgreSQL clients a fixed local endpoint that always lands on the current Patroni leader.
-
Run an untrusted program — a code agent, a scraper, a vendored build script you did not read — as its own uid, inside bubblewrap, with no network at all except a loopback CONNECT…
-
Run pgAdmin (or any bundled web DB admin) inside a private-network NixOS container that reaches the host's PostgreSQL over a bind-mounted /run/postgresql Unix socket — not TCP.
-
postgresql-external-role-reconciler
A NixOS module that drives role passwords, database ownership and read-only grants into a PostgreSQL server this host does not run: a managed cloud instance, a Patroni cluster…
-
A NixOS module that performs a PostgreSQL major-version upgrade by dump and restore, as a systemd unit ordered before postgresql.service.
-
A NixOS module that wraps the upstream services.postgresql with typed, named pg_hba.conf / ident rules, function-based extensions, and a post-init SQL oneshot ordered before…
-
Register a self-hosted binary cache as a substituter on your NixOS hosts — but gate it behind a pathExists check on the cache's public-key file, so a host that hasn't received the…
-
A NixOS module for the receiver half of a push-based observability stack. Remote hosts push their journald logs and node metrics to this box over the Vector protocol; the box fans…
-
A local, outage-resilient caching proxy for PyPI. Point a client's index URL at it to cut WAN traffic and to keep installing even when PyPI is unreachable.
-
Remotely unlock a LUKS-encrypted root over SSH from the initrd, so a headless / remote machine with full-disk encryption can finish booting without someone at the physical console.
-
A single declarative Samba (SMB) share for a NixOS host — with the one thing NixOS can't declare, SMB passwords, bridged in via a guarded oneshot service.
-
Run your own Firefox Sync server (syncstorage-rs) as a single self-contained container — the sync server and its MariaDB…
-
Gate systemd consumers on actual service readiness
After= orders unit startup; it does not prove that a dependency is ready. systemd considers a Type=simple service started as soon as its process forks, often before migrations…
-
Expose a NixOS store as a signed binary cache over HTTPS, so other machines can pull pre-built derivations from it instead of recompiling.
-
Keep a bearer token out of unprivileged sandboxes. Producers only drop JSON manifests into a shared, sticky spool directory; one small hardened watcher holds the credential and is…
-
A write-only artifact drop-box over SSH. CI boxes rsync a directory in and can never read, list, delete or overwrite anything.
-
A NixOS module that runs Syncthing as a discovery-free mesh pinned to a tailnet (Tailscale / any WireGuard VPN), and sets the Web GUI password…
-
Push an externally-issued ACME certificate into a Synology DSM 7 NAS — automatically, on a timer, with a minimal blast radius if the pusher is ever compromised.
-
Two EFI system partitions on two different disks, kept byte-identical, plus a pinned recovery boot entry that the bootloader's own garbage collector cannot reap — and the ZFS…
-
A NixOS module that self-hosts a Tailscale DERP relay behind nginx, with ACME certificates and abuse filtering.
-
A NixOS module that selectively diverts chosen egress off a Tailscale exit node and back onto the host's own WAN — per destination CIDR, and optionally per destination port.
-
A NixOS module that turns one box into a full LAN router: a bridge over its physical ports, NAT to the WAN, Kea for DHCP, and Blocky for caching + ad-blocking DNS — with optional…
-
Run one primary tailscaled plus any number of extra tailscaled instances — each joined to a separate Headscale server — on a single NixOS host, and survive the two non-obvious…
-
Keep SSH agent forwarding alive inside long-lived tmux panes by pinning $SSH_AUTH_SOCK to one stable symlink that each new login re-points at the current live forwarded socket.
-
Keep SSH agent forwarding alive across tmux reattaches — and across any long-lived, detached process — by pinning SSH_AUTH_SOCK to a stable symlink that every new login re-points…
-
A NixOS module that runs a self-hosted Vaultwarden (Bitwarden-compatible) password vault as a gVisor-sandboxed podman container…
-
One NixOS module that gates four VM/container back-ends behind a single boolean each
-
Bring up N WireGuard exits side by side and pin individual services to them by numeric uid: one daemon leaves through exit A, another through exit B, and everything else on the…
-
Wipe-on-boot for ZFS: declare which datasets get rolled back to a blank snapshot inside the initrd, and get the systemd ordering, the neededForBoot guard rail and the loud-failure…
-
Unlock ZFS native encryption on non-root pools from a runtime key file (agenix / sops-nix / systemd-creds / a ramfs drop), with the ordering that makes it safe: the key loads…