My nix-darwin and NixOS config
fix: correct schema
+91
-54
+3
-2
CLAUDE.md
+3
-2
CLAUDE.md
···
80
80
SVG diagrams are auto-generated from NixOS configs. Physical connections and networks are defined in `topology.nix`.
81
81
82
82
```bash
83
-
nix build .#topology.x86_64-linux.config.output
84
-
# SVGs in ./result/
83
+
# On the server (renderer requires Linux):
84
+
ssh server
85
+
nix build ~/.config/nix-config#topology.x86_64-linux.config.output
85
86
```
86
87
87
88
When adding a new host, add its interfaces and physical connections to `topology.nix`.
+8
-3
README.md
+8
-3
README.md
···
110
110
Physical connections and networks that can't be inferred automatically are
111
111
defined in `topology.nix`.
112
112
113
-
**Render the diagrams:**
113
+
**Render the diagrams** (must run on Linux — SSH to the server or use a remote builder):
114
114
115
115
```bash
116
-
nix build .#topology.x86_64-linux.config.output
117
-
# SVGs are in ./result/
116
+
# On the server:
117
+
ssh server
118
+
nix build ~/.config/nix-config#topology.x86_64-linux.config.output
119
+
120
+
# Or from macOS with the server as a remote builder:
121
+
nix build .#topology.x86_64-linux.config.output \
122
+
--builders 'ssh://server x86_64-linux'
118
123
```
119
124
120
125
This produces two diagrams:
+55
flake.lock
+55
flake.lock
···
74
74
"type": "github"
75
75
}
76
76
},
77
+
"flake-parts_2": {
78
+
"inputs": {
79
+
"nixpkgs-lib": "nixpkgs-lib_2"
80
+
},
81
+
"locked": {
82
+
"lastModified": 1765835352,
83
+
"narHash": "sha256-XswHlK/Qtjasvhd1nOa1e8MgZ8GS//jBoTqWtrS1Giw=",
84
+
"owner": "hercules-ci",
85
+
"repo": "flake-parts",
86
+
"rev": "a34fae9c08a15ad73f295041fec82323541400a9",
87
+
"type": "github"
88
+
},
89
+
"original": {
90
+
"owner": "hercules-ci",
91
+
"repo": "flake-parts",
92
+
"type": "github"
93
+
}
94
+
},
77
95
"flake-utils": {
78
96
"inputs": {
79
97
"systems": [
···
159
177
"type": "github"
160
178
}
161
179
},
180
+
"nix-topology": {
181
+
"inputs": {
182
+
"flake-parts": "flake-parts_2",
183
+
"nixpkgs": [
184
+
"nixpkgs"
185
+
]
186
+
},
187
+
"locked": {
188
+
"lastModified": 1769983422,
189
+
"narHash": "sha256-/zQdD8Aogh16eD5lgFokRMA0EYCm5uQITKCA90/01Oo=",
190
+
"owner": "oddlama",
191
+
"repo": "nix-topology",
192
+
"rev": "20b5c5c698d45cc0f950889b3f6379ced5ce9c4a",
193
+
"type": "github"
194
+
},
195
+
"original": {
196
+
"owner": "oddlama",
197
+
"repo": "nix-topology",
198
+
"type": "github"
199
+
}
200
+
},
162
201
"nix-vscode-extensions": {
163
202
"inputs": {
164
203
"nixpkgs": [
···
196
235
}
197
236
},
198
237
"nixpkgs-lib": {
238
+
"locked": {
239
+
"lastModified": 1765674936,
240
+
"narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=",
241
+
"owner": "nix-community",
242
+
"repo": "nixpkgs.lib",
243
+
"rev": "2075416fcb47225d9b68ac469a5c4801a9c4dd85",
244
+
"type": "github"
245
+
},
246
+
"original": {
247
+
"owner": "nix-community",
248
+
"repo": "nixpkgs.lib",
249
+
"type": "github"
250
+
}
251
+
},
252
+
"nixpkgs-lib_2": {
199
253
"locked": {
200
254
"lastModified": 1765674936,
201
255
"narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=",
···
335
389
"home-manager": "home-manager",
336
390
"mac-app-util": "mac-app-util",
337
391
"nix-darwin": "nix-darwin",
392
+
"nix-topology": "nix-topology",
338
393
"nix-vscode-extensions": "nix-vscode-extensions",
339
394
"nixpkgs": "nixpkgs_6",
340
395
"nixpkgs-unstable": "nixpkgs-unstable",
+25
-49
topology.nix
+25
-49
topology.nix
···
10
10
#
11
11
# Docs: https://oddlama.github.io/nix-topology
12
12
##############################################################################
13
-
{ config, lib, ... }:
13
+
{ config, ... }:
14
+
let
15
+
inherit (config.lib.topology) mkInternet mkRouter mkConnection;
16
+
in
14
17
{
15
18
# ── External devices ───────────────────────────────────────────────────────
16
-
nodes.internet = {
17
-
name = "Internet";
18
-
icon = "services.cloudflare";
19
-
interfaces.tunnel = {
20
-
name = "CF Tunnel";
21
-
network = "cloudflare";
22
-
};
19
+
nodes.internet = mkInternet {
20
+
connections = mkConnection "router" "wan";
23
21
};
24
22
25
-
nodes.router = {
26
-
name = "Router";
27
-
deviceType = "router";
28
-
interfaces.wan = {
29
-
name = "WAN";
30
-
network = "wan";
31
-
};
23
+
nodes.router = mkRouter "Router" {
24
+
interfaces.wan = { };
32
25
interfaces.lan = {
33
-
name = "LAN";
34
26
network = "home";
27
+
physicalConnections = [
28
+
(mkConnection "server" "eth0")
29
+
(mkConnection "laptop" "wlan0")
30
+
];
35
31
};
36
32
};
37
33
···
41
37
cidrv4 = "192.168.1.0/24";
42
38
};
43
39
44
-
networks.cloudflare = {
45
-
name = "Cloudflare Tunnel";
46
-
style.color = "#f48120";
47
-
};
48
-
49
40
networks.tailscale = {
50
41
name = "Tailnet";
51
42
cidrv4 = "100.64.0.0/10";
52
-
style.color = "#4a9eed";
53
43
};
54
44
55
-
# ── Physical connections ───────────────────────────────────────────────────
56
-
# Router LAN → each host's primary ethernet/wifi interface.
57
-
nodes.router.interfaces.lan.physicalConnections = [
58
-
{
59
-
node = "server";
60
-
interface = "eth0";
61
-
}
62
-
{
63
-
node = "laptop";
64
-
interface = "wlan0";
65
-
}
66
-
];
67
-
68
45
# ── Host network assignments ───────────────────────────────────────────────
69
46
nodes.server.interfaces.eth0.network = "home";
70
-
nodes.server.interfaces.tailscale0.network = "tailscale";
47
+
nodes.server.interfaces.tailscale0 = {
48
+
network = "tailscale";
49
+
type = "wireguard";
50
+
virtual = true;
51
+
};
71
52
72
-
nodes.laptop.interfaces.wlan0.network = "home";
73
-
nodes.laptop.interfaces.tailscale0.network = "tailscale";
74
-
75
-
# ── Cloudflare tunnel (logical, outbound-only from server) ─────────────────
76
-
nodes.server.interfaces.cf-tunnel = {
77
-
name = "CF Tunnel";
78
-
network = "cloudflare";
79
-
physicalConnections = [
80
-
{
81
-
node = "internet";
82
-
interface = "tunnel";
83
-
}
84
-
];
53
+
nodes.laptop.interfaces.wlan0 = {
54
+
network = "home";
55
+
type = "wireless";
56
+
};
57
+
nodes.laptop.interfaces.tailscale0 = {
58
+
network = "tailscale";
59
+
type = "wireguard";
60
+
virtual = true;
85
61
};
86
62
}