profiles

Allod NixOS profile layer. This repo assembles VM and hypervisor configurations from the public framework repos (vm, nexus) plus consumer-owned inventory, identity, and secrets data. It ships synthetic example profiles; fork it and point the inputs at your own inventory/secrets to describe real machines.

Ownership

This repo owns:

• per-profile NixOS modules under hosts/<archetype>/<name>/configuration.nix
• per-profile Home Manager modules under hosts/<archetype>/<name>/home.nix
• shared profile modules under modules/

This repo does not own:

• VM framework modules, disk layout, or base guest policy: vm
• hypervisor framework modules and lifecycle scripts: nexus
• machine inventory, VM specs, repository registry, IPs, MACs, and platforms: inventory
• identity data, credential inventory, Forge hosts/users, token paths, and git policy data: secrets
• hypervisor-side provisioning, rebuild, token rotation, and VM SSH host-key commands: nexus

Archetypes

Archetype	Path	Access model	Rebuild model
dev	hosts/dev/<name>/	Forge access and workspace clones	self-rebuild, or driven from the hypervisor
privacy	hosts/privacy/<name>/	no forge access; isolated networking	driven from the hypervisor
hypervisor	hosts/nexus/	the physical machine (not a guest)	rebuilt in place

The initial public set ships one dev profile (dev-1) and the nexus hypervisor. The privacy builder is available but no privacy instance ships yet (a generic Tor privacy VM is planned). A service archetype is future work.

The concrete set of deployed machines comes from inventory.machines. flake.nix asserts that inventory machine names and secrets identities match before producing nixosConfigurations.

Inputs

profiles follows version pins from the framework inputs and consumes deployment data from inventory and secrets:

profiles -> vm -> nixpkgs, nixpkgs-unstable, home-manager, agenix, disko
profiles -> nexus
profiles -> inventory
profiles -> secrets
profiles -> allod-tools

Public Allod repos need no authentication for reads, so the default HTTPS/SSH URLs work without tokens. Forks that make their inventory/secrets private supply their own credentials following the existing netrc and SSH-key architecture; keep the transport split intact rather than flattening it.

Common Commands

Run checks:

nix flake check

Build or switch a dev profile from inside that VM when the inventory entry allows self-rebuild:

sudo nixos-rebuild switch --flake .#dev-1

Build the hypervisor profile without switching:

nix build .#nixosConfigurations.nexus.config.system.build.toplevel --no-link

Provisioning, rebuild, token rotation, and VM SSH host-key commands are hypervisor-side and owned by nexus — see the nexus docs.

Adding A Profile

1. Add the profile module files under hosts/<archetype>/<vm-name>/.
2. Add or update machine data in inventory (scripts/vm-specs.json).
3. Add or update repository aliases in inventory (scripts/repositories.json).
4. Add or update identity and credential metadata in secrets.
5. Initialize the VM's SSH host key (that lifecycle lives in nexus).
6. Commit owner repos separately, then update downstream flake locks.
7. Provision or rebuild from the hypervisor.

Do not duplicate IPs, MACs, usernames, Forge key aliases, repo lists, or token paths in profile modules. Consume them through the inventory and secrets interfaces.