nexus

NixOS host framework for an Allod nexus: a libvirt/QEMU VM host with agenix secrets and the provisioning/rotation script toolchain.

The flake exports:

• nixosModules.host: virtualization, networking, security defaults, provisioning tools, and host utilities.
• homeModules.host: Allod operator commands and the provisioning scripts.

This repository contains no machine identity, disk UUIDs, credentials, or personal packages. It is designed to be consumed alongside a private profiles fork.

Flake input

Add the framework to the consumer flake and follow its shared dependencies:

nexus = {
  url = "git+ssh://git@forge.example.org:2222/owner/nexus.git";
  inputs.nixpkgs.follows = "nixpkgs";
  inputs.home-manager.follows = "home-manager";
  inputs.agenix.follows = "agenix";
};

Import nexus.nixosModules.host into the host's NixOS module list and nexus.homeModules.host into the host user's Home Manager imports.

Host System Support

nexus exposes packages and checks for these Linux host systems:

System	Status
x86_64-linux	Tested development target.
aarch64-linux	Exposed Tier 1 target, not yet validated on project hardware.

The flake system list controls where the framework can evaluate its packages and checks. It is separate from deployment inventory: consumers still define VM target systems, machine data, and credentials in their own inventory and secrets inputs.

ARM users should be able to evaluate the framework without patching the flake. Provisioning on ARM still needs hardware validation because QEMU machine types, KVM availability, and UEFI firmware packages differ from the tested x86_64 path.

Documentation

• Integration: module arguments and consumer-owned configuration.
• Credentials: authentication paths for private inputs.
• Host key rotation: Nexus host key rotation, external SSH trust gates, and operator validation points.
• Provisioning scripts: commands, development, deployment, and stale PATH recovery.
• VM provisioning test plan: planned regression coverage and rollout phases.