# NixOS

# /nix/store

#### List top storage users of files in the nix store

```bash
nix path-info -rS /run/current-system | sort -nk2 | tail -20 | numfmt --field=2 --to=iec --suffix=B
```

# home-manager setup

```
nix run home-manager -- switch --flake '.#<config>'
```

# Provisioning a new nixOS Host

```shell
nix run nixos-anywhere -- --flake '.#<host>' --generate-hardware-config nixos-generate-config ./hosts/<host>/hardware-configuration.nix nixos@<ip>
```

# Sops-Nix Env Files

1. Create the plaintext env file to be used 
    
    <p class="callout danger">Do not commit any plaintext env files into version control</p>
2. Run the command to encrypt the file: `sops --input-type binary --output-type binary -e [file]`
3. To edit the file, run the following code: `sops --input-type binary --output-type binary [file]`

# Sops-Nix Setup

To set up the system to run sops-nix, I usually use the host SSH key like so:

```bash
nix run 'nixpkgs#ssh-to-age' -- -private-key -i /etc/ssh/ssh_host_ed25519_key  
```

Copy the generated private key to `/var/lib/sops/age/keys.txt` . This is the location set in the sopsFile option in `base/secrets.nix`.

No need to change from root permissions.

Afterwards, generate the public key from the private key and then copy and paste this into the .sops.yaml config file on the nix config:

```
nix shell 'nixpkgs#age' -c age-keygen -y /var/lib/sops/age/keys.txt 
```

<p class="callout info">Don't forget to run a `sops updatekeys` command if you are performing these steps after the secrets file has been created</p>