Eliminate invisible state
Manual setup drifts, installation steps become folklore, and credentials are difficult to audit or reproduce safely.
Developer systems / reproducibility
A reproducible NixOS workstation.
Machine setup expressed as reviewed source: pinned dependencies, composable host and user modules, encrypted secrets, automated checks, and atomic activation.
Interactive configuration graph
Intent composes before activation.
Pinned inputs flow into host, home, and secret modules; checks guard the boundary before the system changes.
Case study
A workstation as a dependency graph
Compose explicit intent
A flake pins inputs and composes hosts, reusable modules, Home Manager state, and sops-nix secrets.
Publish the live structure
The repository exposes host definitions, modules, the flake lock, encrypted-secret policy, checks, and recovery documentation.
Configuration detail
A guarded path to activation
Pin inputs
Record exact upstream revisions so the same source graph resolves consistently.
Compose modules
Separate machine-specific intent from reusable system and user configuration.
Decrypt at runtime
Keep ciphertext in Git while sops-nix materializes secrets only on the target host.
Check and activate
Evaluate the flake, scan for leaks, and switch atomically with a recoverable prior generation.
Evidence boundary
The repository is the running design, with secrets excluded.
The public tree demonstrates structure, pinning, module boundaries, and encrypted-secret wiring. Host-specific plaintext and credentials are intentionally absent.