Add NixOS dual-configuration setup with isolated dev and gaming profiles #1
Reference in New Issue
Block a user
Delete Branch "copilot/create-nixos-dual-configs"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
initialPasswordwithhashedPasswordplaceholder for securityhardware.enableAllFirmwaretohardware.enableRedistributableFirmwareamd_pstate=activekernel param from gaming.nixmitigations=offfor security (was disabling CPU mitigations)system.stateVersionfrom "25.05" to "24.11"Original prompt
NixOS Dual-Configuration Setup Plan
Overview
Create a NixOS system with two fully isolated configurations:
Both share a common base: MangoWC (Wayland compositor) + Noctalia Shell, AMD RDNA 4 GPU support, and a shared
/homedirectory with mutable dotfiles.Why Separate Configs (Not Specialisations)?
NixOS offers "specialisations" for boot-time variants, but this plan uses separate
nixosConfigurationsbecause:Trade-off: You must rebuild both configs separately and keep them in sync to avoid kernel/Mesa version drift (critical for RDNA 4). If you prefer simpler maintenance, specialisations are a valid alternative.
Target System Specifications
Hardware
Software
RDNA 4 Requirements
The RX 9060 XT (released ~June 2025) has specific requirements:
navi44_*.binblobs - must enable all firmwarePrerequisites
Before running this plan:
hardware-configuration.nixmust exist from the installationAmerica/New_York,Europe/London)en_US.UTF-8)Directory Structure
Create the following structure in
/etc/nixos/or a preferred config directory:File Contents
1. flake.nix
Location:
nixos-config/flake.nixPurpose: Defines flake inputs (nixpkgs, MangoWC, Quickshell, Noctalia) and two separate nixosConfigurations.
Required substitutions:
<hostname>in thecommonModulespath with the actual hostname2. modules/common.nix
Location:
nixos-config/modules/common.nixPurpose: Shared configuration for both profiles - hardware, GPU, desktop environment, user account, base packages.
Pull request overview
This PR implements a NixOS flake-based configuration system with two isolated profiles (dev and gaming) that share a common base configuration. The setup targets a specific hardware configuration (AMD Ryzen 7 5700G with AMD RX 9060 XT RDNA 4 GPU) and uses MangoWC compositor with Noctalia shell.
Changes:
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 19 comments.
Show a summary per file
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
@@ -1 +1,228 @@# nixos# NixOS Dual-Configuration SetupThe README states that files must be staged in git before building (line 69: "git add .") and mentions this again in troubleshooting (line 182), but the initial setup instructions in step 4 "Build and Switch" don't explicitly remind users to do this before running nixos-rebuild. Users might miss step 3 and try to build without staging files, leading to confusing errors. Consider adding a reminder or verification step in the build instructions.
The README instructs users to "rename hosts/hostname/ to match your actual hostname" (line 63), but the actual flake.nix expects the path to be "./hosts/<hostname>/hardware-configuration.nix" where <hostname> is a placeholder that needs to be replaced in the flake.nix itself (line 31). This creates ambiguity: should users rename the directory AND update flake.nix, or just update flake.nix? The instructions should be clearer that both the directory name and the reference in flake.nix need to match the actual hostname.
The README instructs users to run "sudo nixos-rebuild boot --profile-name gaming" (line 86) but this will only build the gaming profile without making it immediately available. The user won't be able to boot into the gaming profile until after a reboot. Consider clarifying in the README that the gaming profile will only be available after the next reboot, or consider using "sudo nixos-rebuild test --flake .#gaming" first to verify the gaming config works before committing to it as a boot option.
The autostart script created in lines 138-142 uses "qs -c noctalia-shell" but this requires the quickshell binary to be in PATH. While quickshell is installed as a user package (common.nix line 83), the full command might need to be more specific or use the full path. Additionally, there's no error handling if noctalia-shell fails to start. Consider adding error handling or verification steps to the README.
@@ -2,0 +46,4 @@cd ~/nixos-config# Create the host directory (replace <hostname> with your actual hostname)mkdir -p hosts/<hostname>The README instructs users to "cp /etc/nixos/hardware-configuration.nix hosts/<hostname>/" (line 49), but this assumes the hosts/<hostname>/ directory already exists. If users haven't renamed the directory yet (as per line 63), this command will fail. The setup instructions should specify creating or renaming the directory first, then copying the hardware configuration.
@@ -2,0 +115,4 @@sudo nixos-rebuild boot --profile-name gaming --flake .#gaming```### Updating Flake Inputs OnlyThe update instructions start with "git add ." (line 101) which suggests staging all changes, but this is only appropriate if the user has made configuration changes. If they're just updating flake inputs (as shown in lines 108-112), they only need to stage flake.lock. The "git add ." command could accidentally stage unwanted changes. Consider clarifying when to use "git add ." versus just "git add flake.lock".
@@ -0,0 +1,58 @@{The flake.nix uses "mango.nixosModules.mango" (line 33) but there's no verification that this module exists or is exported by the mango flake. If the mango repository doesn't export a nixosModules.mango output, this will cause a build failure. Consider adding a note in the README about verifying the flake inputs or handling potential issues if the upstream flakes change their output schema.
@@ -0,0 +21,4 @@url = "github:noctalia-dev/noctalia-shell";inputs.nixpkgs.follows = "nixpkgs";inputs.quickshell.follows = "quickshell";};The flake
inputsdeclare third-party NixOS modules (mango,quickshell,noctalia) via mutable GitHub references without a committedflake.lock, so new clones or rebuilds will automatically track whatever commit is at the head of those repositories. Because these modules are integrated into the system as NixOS modules (running code as root at build and runtime), a compromise of any upstream repo or a malicious update could silently introduce arbitrary code into your system. Commit aflake.lockto pin these inputs to specific immutable commits (and update them only vianix flake update) or otherwise explicitly pin them to trusted revisions to reduce this supply-chain risk.@@ -0,0 +1,44 @@# This is a placeholder hardware-configuration.nix file.The filesystem mount configuration is commented out, which means the system won't have any filesystems defined. This will prevent the system from booting. While this is a placeholder file, the commented-out nature makes it more dangerous because it might not fail fast during build time. Consider uncommenting the example filesystem configurations with clear placeholder UUIDs like "REPLACE-WITH-YOUR-ROOT-UUID" to make it more obvious that this needs to be configured.
@@ -0,0 +1,182 @@{ config, pkgs, inputs, system, ... }:Setting initialPassword to a plaintext "changeme" is a security concern. While this is mentioned in the comment as temporary, it means the system will boot with a known weak password. Consider using hashedPassword instead, or at a minimum, add a prominent warning in the README that users must change this password immediately after first boot. The current README does mention changing the password in the Post-Installation section, but it should be more prominent.
The PR description mentions that RDNA 4 requires "navi44_*.bin" firmware blobs and uses "hardware.enableAllFirmware = true" to enable them. However, this setting enables ALL firmware including potentially problematic non-free firmware. A more targeted approach would be to use "hardware.enableRedistributableFirmware = true" which enables AMD GPU firmware but excludes some problematic firmware. If specific navi44 firmware is needed that's not in redistributable, users can be directed to add specific firmware packages.
The comment states "Nerd fonts - syntax changed in nixpkgs after 24.05" and shows the new individual package syntax being used. However, this configuration is explicitly targeting nixos-unstable which should use this syntax. The comment could be misleading for users on unstable who won't encounter the old syntax. Consider updating the comment to clarify this is the current syntax for nixos-unstable (and nixos versions after 24.05).
The system.stateVersion is set to "25.05" which does not follow the NixOS versioning convention. NixOS versions follow the pattern YY.MM (e.g., "24.05", "24.11"), and "25.05" would be released in May 2025. Given the PR description mentions requiring kernel 6.14+ and Mesa 25.0+ from nixos-unstable, and the current date is February 2026, this should likely be "24.11" or "25.05" if that release exists. Verify the correct NixOS release version.
@@ -0,0 +68,4 @@# Enable seatd for session managementservices.seatd.enable = true;The configuration enables seatd (line 70) which is necessary for MangoWC to function, but there's no configuration for starting MangoWC automatically on boot or login. Users have to manually start it or configure it themselves (as shown in the README post-installation section). For a complete setup, consider mentioning in the README that MangoWC needs to be started manually after the first boot, or provide a display manager option.
@@ -0,0 +22,4 @@};};# IMPORTANT: Replace <username> with actual usernameDocker requires the user to log out and log back in after being added to the docker group for the group membership to take effect. Since this configuration adds the user to the docker group, users won't be able to use Docker immediately after the first build without logging out and back in. Consider adding this information to the README in a "Post-Installation" or "First Steps" section for the dev profile.
@@ -0,0 +1,99 @@{ pkgs, ... }:The renice value of 10 will make games run with LOWER priority (higher niceness = lower priority). For gaming performance optimization, this should be a negative value like -10 to give games HIGHER priority. The current setting will degrade gaming performance rather than improve it.
The amd_pstate=active kernel parameter is already set in common.nix (line 49), making this redundant. While the comment mentions it's "for clarity," having duplicate kernel parameters can lead to confusion and maintenance issues. Consider removing this duplicate entry.
The gaming profile sets
boot.kernelParamsto include"mitigations=off", which disables CPU security mitigations for speculative execution and related vulnerabilities. This exposes the system to a broad class of local-attack and potential VM escape primitives, especially in multi-user or virtualization scenarios, purely for a small performance gain. Remove"mitigations=off"(or use more targeted mitigation flags) so the kernel retains its default hardening against these attacks.@@ -0,0 +54,4 @@# the gaming profile. If you need consistent group membership across# both profiles, add these groups to common.nix instead.# IMPORTANT: Replace <username> with actual usernameusers.users.<username>.extraGroups = [ "corectrl" "gamemode" ];Both gaming.nix (line 52) and dev.nix (line 26) attempt to add extraGroups to the same user that is already configured in common.nix (line 76-80). In NixOS, when multiple modules configure the same user attribute (extraGroups in this case), the lists are concatenated. However, the common.nix already defines extraGroups = [ "wheel" "networkmanager" "video" "seat" ], and both profiles add their own groups. This works correctly, but it means switching between profiles will have different group memberships for the same user, which could lead to permission issues if files/processes from one profile expect certain groups. Consider documenting this behavior or ensuring both profiles include all necessary groups.
@copilot apply changes based on the comments in this thread
Applied all review feedback in commit
df02e01. Key changes:Security:
initialPasswordwithhashedPasswordplaceholderenableRedistributableFirmware(more targeted thanenableAllFirmware)mitigations=offkernel parameterBug fixes:
reniceto -10 (was 10, which lowered priority instead of raising it)amd_pstate=activefrom gaming.nixsystem.stateVersionto "24.11"Improvements: