Darkone NixOS Framework

• Documentation: Official EN • Official FR • Readme FR • To-Do FR
• Subprojects: Boilerplate • Example • Generator • Documentation

A multi-user, multi-services & multi-host configuration

• 🔥 Declarative, reproducible, immutable.
• 🚀 Ready-to-use modules.
• ❄️ Simple main configuration.
• 🧩 Consistent structure.
• 🌎 A full network.

This project is constantly evolving according to my needs. If you'd like to be informed about upcoming stable versions, please let me know on GitHub or by subscribing to my YouTube channel (FR). Thank you!

Versioning

Releases follow SemVer. While in 0.x, MINOR carries the breaking changes (etc/config.yaml schema, darkone.* options, public just recipes, usr/ layout); PATCH never does. 1.0.0 marks the public launch.

Pin a release and commit your flake.lock:

dnf.url = "github:darkone-linux/darkone-nixos-framework/v0.1.0";

See the CHANGELOG, the upgrade guide and, for contributors, the release procedure.

Main features

	Feature	Description
⚙️	Automated install	Fully automated host install / update with nixos-anywhere, disko & colmena
👤	User profiles	User profiles and modules with Home Manager (admin, gamer, beginner...)
🖥️	Host profiles	Host profiles (servers, containers, network nodes, workstations...)
🌐	Tailnet VPN	Full-mesh VPN with headscale + tailscale, independent subnets
🛡️	Ad-Free web	Secure, ad-free internet with AdguardHome and effective firewall (nftables)
🧩	Single Sign On	SSO strategy with Kanidm: one identity for (almost) all services
🤗	Smart services	Immich, Nextcloud, Forgejo, Vaultwarden, Mattermost, Jellyfin, etc.
💻	Clean Gnome	NixOS hosts with streamlined GNOME UI + stable and useful apps
💾	3-2-1 Backups	Robust, simplified, and widespread backups with Restic
🤖	Generative AI	Secure, on-premises generative AI, using Open WebUI and Ollama
🏠	Homepage	Automated homepage -> quick access to all configured services

Under the hood

	Specificity	Description
❄️	Declarative & Immutable	Fully reproducible configuration based on Nix / NixOS and its ecosystem
🔑	Enhanced security	Simple and reliable security strategy powered by sops-nix
📦	High-level modules	High-level NixOS modules, easy to enable and configure
📐	Consistent architecture	Extensible and scalable architecture, consistent and customizable
✴️	Reverse proxy	Services distributed across network servers through Caddy proxies
🛜	Auto-networking	Zero-conf network plumbing (DNS, DHCP, firewall...) with dnsmasq
✅	Monitoring & Alerts	Supervision with Prometheus, Grafana and Alertmanager

SSO status

• OAuth2 = supports OAuth2 / OIDC
• Native = no plugin or external component required; can be configured directly
• PKCE = supports PKCE
• Declarative = all settings can be declared in NixOS
• OK = works on my configuration
• ☑️ = applied by an idempotent script / daemon (not pure declarative)

Application	OAuth2	Native	PKCE	Declarative	OK	Comments
Outline	✅	✅	✅	✅	✅	Works perfectly
Mealie	✅	✅	✅	✅	✅	Works perfectly
Vaultwarden	✅	✅	✅	✅	✅	Fill the right e-mail first
Matrix Synapse	✅	✅	✅	✅	✅	Works fine (+Element +Coturn)
Open WebUI	✅	✅	✅	✅	✅	Works fine (+Ollama)
Grafana	✅	✅	✅	✅	✅	Works fine
LaSuite Docs	✅	✅	✅	✅	✅	Works fine
Immich	✅	✅	✅	✅	✅	Declarative (settings + secretSettings)
Forgejo	✅	✅	✅	☑️	✅	Declarative via auth add-oauth oneshot
Nextcloud	✅	✅	✅	☑️	✅	user_oidc, occ-provisioned
OAuth2 Proxy	✅	✅	✅	✅	✅	Linked to Caddy & Kanidm
Homepage	🔁	🔁	🔁	🔁	✅	Via OAuth2 Proxy
Prometheus	🔁	🔁	🔁	🔁	✅	Via OAuth2 Proxy
Jellyfin	ℹ️	ℹ️	ℹ️	ℹ️	ℹ️	Common access
AdGuard Home	ℹ️	ℹ️	ℹ️	ℹ️	ℹ️	Common access
Geneweb	ℹ️	ℹ️	ℹ️	ℹ️	ℹ️	Common access
Mattermost	❌	❌	❌	❌	❌	No more OAuth2 for the TEAM edition

Homepage screenshot

One configuration for a full network

Easy admin with Just

Easy Nix code clean, generation and fix

Easy multi-host deployment