Mixin modules

Note

A mixin module defines a collection of standard modules with a consistent common configuration.

📦 darkone.host.ai-space

AI space: headless host running the agents of one space (owner + members).

Server base with secrets isolated from the fleet: agents read untrusted input (mail, web, chat), so the host only decrypts its own usr/secrets/hosts/<hostname>.yaml. Usually a microVM guest (features: ["microvm-guest:<hypervisor>"]), bare metal works too.

Agent tooling, declared once per space (usr/machines/<host>/configuration.nix) and shared by the OpenClaw assistant and every member’s Claude Code / Codex / OpenCode (darkone.home.aiSpace, on by default in the space-member home):

• mcp: MCP servers, local (command) or remote (url);
• skills: SKILL.md content, a file or a skill directory, by name;
• enableClaude, enableCodex, enableOpenCode: CLIs for members and for OpenClaw delegation;
• packages: tools on the agents’ PATH and in members’ homes;
• projectsDir: shared projects, writable by every member and the agent (group projects, setgid, default ACL), ~/projects in members’ homes.

darkone.host.ai-space = {
  mcp.fetch = { command = "uvx"; args = [ "mcp-server-fetch" ]; };
  mcp.github = {
    command = "github-mcp-server";
    args = [ "stdio" ];
    secretEnv = [ "GITHUB_PERSONAL_ACCESS_TOKEN" ]; # sops: mcp/github/<VAR>
  };
  skills.commit-style = ./skills/commit-style;
  packages = [ pkgs.uv pkgs.pandoc pkgs.github-mcp-server ];
};

Secrets: secretEnv only

env and headers end up in the world-readable Nix store. secretEnv reads the space’s sops file, for local servers: a remote server takes no secret.

• enable bool AI space host (isolated agents workspace)
• mcp attrs MCP servers of the space: OpenClaw and members’ Claude Code / Codex / OpenCode.
• skills attrs Skills of the space, by name: inline SKILL.md, a SKILL.md file or a skill directory. Given to OpenClaw and members’ Claude Code / Codex / OpenCode.
• enableClaude bool Claude Code for members and for OpenClaw (coding-agent delegation).
• enableCodex bool Codex CLI for members and for OpenClaw (coding-agent delegation).
• enableOpenCode bool OpenCode for members and for OpenClaw (coding-agent delegation).
• packages listOf package Tools of the space: OpenClaw PATH and members’ homes.
• projectsDir str Shared projects of the space: every member and the OpenClaw agent (its working dir) read and write them, ~/projects in members’ homes.

darkone.host.ai-space = {
  enable = false;
  mcp = { };
  skills = { };
  enableClaude = true;
  enableCodex = true;
  enableOpenCode = true;
  packages = [ ];
  projectsDir = "/var/lib/projects";
};

---

📦 darkone.host.desktop

A full desktop configuration with gnome, multimedia and office tools.

• enable bool Desktop optimized host configuration

darkone.host.desktop.enable = false;

---

📦 darkone.host.gateway.backup-links

DNF gateway: backup uplinks. Doc: ../gateway.nix header.

• backupLinks attrs Fallback uplinks, used when the WAN has no link, no lease or no Internet. Name: [a-z][a-z0-9-]*.
  • type enum [ "ethernet" "wifi" ] ethernet: DHCP client on a spare port, always up. wifi: WPA2/WPA3 client, radio off (rfkill) until no preferred link reaches the Internet; SSID and passphrase are read from sops (backup-link/<name>/ssid, backup-link/<name>/psk).
  • interface str Interface carrying the link: neither the WAN, a LAN port nor a hostapd radio.
  • priority ints.between 1 99 Lower is preferred among backup links (route metric 200 + 10 × priority, the WAN staying at 100).
• linkCheck.targets nonEmptyListOf str IP addresses pinged through each uplink; one answer is enough. IP literals only: the probe must not depend on DNS.
• linkCheck.interval ints.positive Seconds between two probe rounds.
• linkCheck.failAfter ints.positive Failed rounds before an uplink is penalised.
• linkCheck.recoverAfter ints.positive Good rounds before a penalised uplink is restored (hysteresis).

darkone.host.gateway.backup-links = {
  backupLinks.type = null;
  backupLinks.interface = "wlp4s0";
  backupLinks.priority = 10;
  linkCheck.targets = internetProbeTargets;
  linkCheck.interval = 10;
  linkCheck.failAfter = 3;
  linkCheck.recoverAfter = 6;
};

---

📦 darkone.host.gateway

The main gateway / router of a local network zone.

A ready-to-use gateway!

The gateway is configured in etc/config.yaml file. Additional enabled services (homepage, adguardhome, forgejo, nix-cache…) are automatically configured with consistent network plumbing on the gateway and all machines on the local network.

Routed traffic is filtered

filterForward = true: only LAN <-> WAN and LAN <-> tailnet cross. Anything else is dropped — add it to networking.firewall.extraForwardRules.

Sub-module (gateway/): backup-links.nix, backup uplinks.

Backup uplinks (backup-links.nix)

Backup links: Internet in degraded mode

backupLinks adds uplinks (spare ethernet port, wifi client such as a phone hotspot) the zone falls back to when the WAN loses its link, its lease or the Internet:

darkone.host.gateway.backupLinks.phone = {
  type = "wifi";          # SSID + passphrase: sops `backup-link/phone/{ssid,psk}`
  interface = "wlp4s0";
  priority = 10;          # lower = preferred among backups
};

Route metrics steer the default route; dnf-uplink-monitor pings through each link, penalises one without Internet and keeps one back from an outage on probation until it answers. A wifi backup keeps its radio off until no preferred link reaches the Internet; an ethernet one stays up, idle. Details: lib/uplinks.nix.

• enable bool Enable gateway features for the current host (dhcp, dns, proxy, etc.)

darkone.host.gateway.enable = false;

---

📦 darkone.host.hcs

The main headscale coordination server.

A ready-to-use headscale server!

The network is configured in etc/config.yaml file. Additional enabled services (authentication, etc.) are automatically configured with consistent network plumbing on your global network.

Zsh alias “h” for “headscale”.

Public SSH

Port 22 is open on every interface, Internet included — the only host of the fleet in that case: it runs the tailnet control plane, so reaching it must not require the tailnet.

• enable bool Enable headscale coordination server
• enableClient bool Enable tailscale client on HCS node (recommended to host services)

darkone.host.hcs = {
  enable = false;
  enableClient = true;
};

---

📦 darkone.host.laptop

Desktop config + laptop specific tools & configuration.

• enable bool Laptop optimized host configuration

darkone.host.laptop.enable = false;

---

📦 darkone.host.minimal

Every host configuration is based on this minimal config.

Services declaration

A number of services (immich, nextcloud, forgejo, etc.) can be declared in etc/config.yaml of each host, regardless of its type (server, laptop, desktop, etc.). It is advisable to declare them in the yaml file so that the service is visible across the entire network!

• enable bool Minimal host configuration
• secure bool Prefer more secure options (disable mutable users…)

darkone.host.minimal = {
  enable = false;
  secure = false;
};

---

📦 darkone.host.portable

Portable configuration for a bootable USB drive containing a NixOS machine from the local network.

• enable bool Portable host configuration for usb keys

darkone.host.portable.enable = false;

---

📦 darkone.host.server

Improved configuration for servers (minimal, no sleep, watchdog…).

Emergency mode is disabled

We prefer the system to attempt to continue booting so that we can hopefully still access it remotely. (cf. srvos)

• enable bool Server host minimal configuration
• enableWatchdog bool Enable systemd watchdog

darkone.host.server = {
  enable = false;
  enableWatchdog = true;
};

---

📦 darkone.host.umi

Host profile: UMI (Unified Multimodal Input) workstation, usable without keyboard/mouse.

UMI: Unified Multimodal Input

Accessibility goal: coordinated inputs (touch, voice, gaze…) replace keyboard and mouse, combined to fit the user’s abilities. Current stack: Onboard on a touchscreen, Talon voice commands, Tobii Eye Tracker 5 driven through Talon.

Extends desktop

Inherits the full desktop profile (GNOME, multimedia, office) and adds the UMI prerequisites: a Cinnamon X11 session for UMI users (dark mode by default), auto-login, uinput event injection and Tobii udev rules.

X11 / Wayland coexistence

Talon requires X11 (Wayland unsupported upstream, not planned) and GNOME 50 dropped its Xorg session, so UMI sessions run Cinnamon (X11, GNOME-like UX, native tray) while other users keep GNOME Wayland. The host users whose home enables darkone.home.umi (umi user profile) get their saved GDM session pinned to “cinnamon” through AccountsService, at every boot: a keyboard-free user cannot pick a session at the greeter.

Talon package

pkgs.talon comes from the talon-nix input wired in the DNF flake (x86_64-linux only, unfree upstream tarball). With package = null, udev/uinput/a11y are still configured and Talon can be run manually (steam-run on the upstream tarball, which keeps auto-update working).

First run

The Tobii 5 firmware must be initialized once on a Windows machine (Tobii Experience). On first Talon start, replug the tracker then restart Talon (udev), and run the calibration from the Talon menu.

No mousetweaks

muffin does dwell clicks itself (click types from the panel). A mousetweaks daemon in the session would dwell in parallel with plain left clicks (the chosen type is never used), pop its “Hover Click” window and grab the mouse wheel on the root window until logout (XGrabButton on buttons 4/5).

Expected kernel noise

The tracker declares two video-class interfaces (raw IR eye cameras) that uvcvideo cannot handle: Unknown video format, No supported video formats found, probe with driver uvcvideo failed with error -22. Harmless and wanted: no kernel driver claims the interfaces, so libusb gets them free. The tracker is reached through interface 0 (vendor-specific, bulk endpoints), never through /dev/video*.

• enable bool UMI host configuration: multimodal input, touch + voice + gaze (Onboard, Talon, Tobii)
• autoLoginUser nullOr str Auto-login user (mandatory for a keyboard-free session), a host user with the umi profile.
• package nullOr package Talon package (defaults to pkgs.talon from the talon-nix overlay when available).

darkone.host.umi = {
  enable = false;
  autoLoginUser = null;
  package = pkgs.talon or null;
};

---

📦 darkone.host.vm

Virtual machines guest tools.

• enableVirtualbox bool Virtualbox client
• enableQemu bool Qemu/KVM client
• enableXen bool Xen client

darkone.host.vm = {
  enableVirtualbox = false;
  enableQemu = false;
  enableXen = false;
};

---

📦 darkone.profile.advanced

Profile for advanced users (computer scientists, developers, admins).

Host profile vs Home profile

This module enables features for all users of the system. Use HomeManager profiles to provide software tailored to each user (admin, advanced, student, child, teenager, etc.).

• enable bool Advanced user (admin sys, developper)

darkone.profile.advanced.enable = false;

---