Scopes & Roles

NixFleet uses a scope system to compose host configurations. Scopes ship in the nixfleet-scopes companion repository - a standalone collection of infrastructure modules, roles, and disk templates that work with any NixFleet-managed host.

Scopes are NixOS modules that self-activate based on configuration flags. Each scope wraps its config block in lib.mkIf so it produces no configuration when its condition is false. Options live under nixfleet.*. Roles compose scopes and set defaults with lib.mkDefault - consumers override with lib.mkForce when needed.

Repository: github.com/arcanesys/nixfleet-scopes - MIT licensed, works standalone or via inputs.nixfleet.scopes re-export.

Framework Service Scopes

These ship with NixFleet and are auto-included by mkHost (disabled by default).

The impermanence scope from nixfleet-scopes is also auto-imported by mkHost. It is inert unless nixfleet.impermanence.enable is set.

Infrastructure Scopes

From nixfleet-scopes. Import via roles or individually.

Platform variants exist for: base (Darwin, HM), operators (Darwin), backup (Darwin), impermanence (HM), home-manager (Darwin).

Operators

The operators scope manages user accounts declaratively. One operator is designated primaryUser - the identity anchor for Home Manager, secrets, and impermanence paths.

Each operator (users.<name>) supports:

• isAdmin - adds wheel group (sudo access)
• sshAuthorizedKeys - SSH public keys for authorized_keys
• shell - login shell (default: bash)
• homeManager.enable - apply the profile’s HM stack to this operator
• hashedPassword / hashedPasswordFile - password authentication
• extraGroups - additional groups on top of roleGroups

Top-level options:

• primaryUser - identity anchor (auto-detected when only one operator exists)
• roleGroups - groups added to all operators (set by roles, e.g. workstation adds networkmanager/video/audio/docker)
• rootSshKeys - root SSH access, independent of operator accounts
• mutableUsers - allow imperative passwd changes (default: false)

nixfleet.operators = {
  primaryUser = "alice";
  users.alice = {
    isAdmin = true;
    sshAuthorizedKeys = [ "ssh-ed25519 AAAA... alice@workstation" ];
    homeManager.enable = true;
    shell = pkgs.zsh;
  };
  users.bob = {
    sshAuthorizedKeys = [ "ssh-ed25519 BBBB... bob@laptop" ];
  };
  rootSshKeys = config.nixfleet.operators._adminSshKeys;
};

Roles

Roles compose scopes with sensible defaults. Import one role per host.

Disk Templates

Pre-built disko configurations for common partition layouts.

Access via inputs.nixfleet-scopes.scopes.disk-templates.<name>.

What Belongs Where