Self Host Blocks is available as a flake. To use it in your project, add the following flake input:

inputs.selfhostblocks.url = "github:ibizaman/selfhostblocks";

Then, in your nixosConfigurations, import the module with:

imports = [
  inputs.selfhostblocks.nixosModules.x86_64-linux.default
];

You can also use the public cache as a substituter with:

nix.settings.trusted-public-keys = [
  "selfhostblocks.cachix.org-1:H5h6Uj188DObUJDbEbSAwc377uvcjSFOfpxyCFP7cVs="
];

nix.settings.substituters = [
  "https://selfhostblocks.cachix.org"
];

Self Host Blocks provides its own nixpkgs input so both can be updated in lock step, ensuring maximum compatibility. It is recommended to use the following nixpkgs as input for your deployments. Also, patches can be applied by Self Host Blocks. To handle all this, you need the following code instead wherever you import nixpkgs:

let
  system = "x86_64-linux";
  originPkgs = selfhostblocks.inputs.nixpkgs;

  nixpkgs' = originPkgs.legacyPackages.${system}.applyPatches {
    name = "nixpkgs-patched";
    src = originPkgs;
    patches = selfhostblocks.patches.${system};
  };
in
  nixpkgs = import nixpkgs' {
    inherit system;
  };

Advanced users can if they wish use a version of nixpkgs of their choosing but then we cannot guarantee Self Host Block won’t use a non-existing option from nixpkgs.

To avoid manually updating the nixpkgs version, the GitHub repository for Self Host Blocks tries to update the nixpkgs input daily, verifying all tests pass before accepting this new nixpkgs version. The setup is explained in this blog post.

The following snippets show how to deploy Self Host Blocks using the standard deployment system nixos-rebuild.

{
  inputs = {
    selfhostblocks.url = "github:ibizaman/selfhostblocks";
  };

  outputs = { self, selfhostblocks }: {
    nixosConfigurations = {
      machine = selfhostblocks.inputs.nixpkgs.lib.nixosSystem {
        system = "x86_64-linux";
        modules = [
          selfhostblocks.nixosModules.${system}.default
        ];

        # Machine specific configuration goes here.
      };
    };
  };
}

The above snippet is very minimal as it assumes you have only one machine to deploy to, so nixpkgs is defined exclusively by the selfhostblocks.inputs.nixpkgs input. If some machines are not using Self Host Blocks, you can do the following:

{
  inputs = {
    selfhostblocks.url = "github:ibizaman/selfhostblocks";
  };

  outputs = { self, selfhostblocks }: {
    nixosConfigurations = {
      machine1 = nixpkgs.lib.nixosSystem {
      };

      machine2 = selfhostblocks.inputs.nixpkgs.lib.nixosSystem {
        system = "x86_64-linux";
        modules = [
          selfhostblocks.nixosModules.${system}.default
        ];

        # Machine specific configuration goes here.
      };
    };
  };
}

The following snippets show how to deploy Self Host Blocks using the deployment system Colmena.

{
  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";

    selfhostblocks.url = "github:ibizaman/selfhostblocks";
  };

  outputs = { self, selfhostblocks }: {
    colmena =
      let
        system = "x86_64-linux";
      in {
        meta = {
          nixpkgs = import selfhostblocks.inputs.nixpkgs { inherit system; };
        };

        machine = { selfhostblocks, ... }: {
          imports = [
            selfhostblocks.nixosModules.${system}.default
          ];

          # Machine specific configuration goes here.
        };
      };
  };
}

The above snippet is very minimal as it assumes you have only one machine to deploy to, so nixpkgs is defined exclusively by the selfhostblocks input. It is more likely that you have multiple machines, in this case you can use the colmena.meta.nodeNixpkgs option:

{
  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";

    selfhostblocks.url = "github:ibizaman/selfhostblocks";
  };

  outputs = { self, selfhostblocks }: {
    colmena = {
      let
        system = "x86_64-linux";
      in {
        meta =
          nixpkgs = import nixpkgs { inherit system; };
          nodeNixpkgs = {
            machine2 = import selfhostblocks.inputs.nixpkgs { inherit system; };
          };
        };

        machine1 = ...;

        machine2 = { selfhostblocks, ... }: {
          imports = [
            selfhostblocks.nixosModules.${system}.default
          ];

          # Machine specific configuration goes here.
        };
    };
  };
}

In the above snippet, machine1 will use the nixpkgs version from your inputs while machine2 will use the nixpkgs version from selfhostblocks.

This section complements the official sops-nix guide.

Managing secrets is an important aspect of deploying. You cannot store your secrets in nix directly because they get stored unencrypted and you don’t want that. We need to use another system that encrypts secrets when storing in the nix store and then decrypts them on the target host upon system activation. sops-nix is one of such system.

Sops-nix works by encrypting the secrets file with at least 2 keys. Your private key and a private key from the target host. This way, you can edit the secrets and the target host can decrypt the secrets. Separating the keys this way is good practice because it reduces the impact of having one being compromised.

One way to setup secrets management using sops-nix: