NixDaemon

install.md (15156B)

---

 <div align="center">
   <img src="images/headers/03-installation.png" width="800" alt="[02] INSTALLATION — ANY MACHINE"/>
 </div>
 
 # Installing NixDaemon
 
 NixDaemon installs as the **generic host** (`nixosConfigurations.nixdaemon`,
 `modules/hosts/generic/`). It works on a PC, a laptop or a virtual machine,
 Intel/AMD or ARM, UEFI or legacy BIOS. You change **two files** and nothing
 else:
 
 | File | What goes in it |
 |---|---|
 | `modules/hosts/generic/_settings.nix` | user name, hostname, CPU architecture, boot mode, hypervisor, desktop, which toolkit categories |
 | `modules/hosts/generic/_hardware-configuration.nix` | your disks and kernel modules, generated by `nixos-generate-config` |
 
 > `modules/hosts/laptop/` is the author's own machine. It needs his secrets
 > and private dotfiles and **will not build for you** — ignore it.
 
 **Contents**
 
 1. [Requirements](#1-requirements)
 2. [Pick your path](#2-pick-your-path)
 3. [Path A — fresh install (bare metal or VM)](#3-path-a--fresh-install-bare-metal-or-vm)
 4. [Path B — you already run NixOS](#4-path-b--you-already-run-nixos)
 5. [Path C — just the tools (any Linux, WSL)](#5-path-c--just-the-tools-any-linux-wsl)
 6. [Hypervisor notes](#6-hypervisor-notes)
 7. [First boot](#7-first-boot)
 8. [Updating, rolling back, more machines](#8-updating-rolling-back-more-machines)
 9. [When something goes wrong](#9-when-something-goes-wrong)
 
 ---
 
 ## 1. Requirements
 
 | | Minimum | Comfortable |
 |---|---|---|
 | CPU | x86_64 or aarch64, 2 cores | 4+ cores |
 | RAM | 4 GB (install with `--max-jobs 1`) | 8–16 GB (BloodHound wants 4 GB on its own) |
 | Disk | 60 GB | 100 GB+ (old generations, wordlists, VMs) |
 | Network | needed for the whole install | wired or a stable Wi-Fi |
 
 The installed system is about **23 GB**, of which ~10 GB is downloaded
 pre-built from cache.nixos.org. Some things are compiled on your machine:
 the Python 3.12 AD tooling (impacket, certipy, lsassy …), the
 ligolo-ng/chisel/fscan/pspy agents cross-built for every OS and CPU, and a
 few editor plugins. Expect a first install to take **30–90 minutes**
 depending on CPU and bandwidth.
 
 **Architecture support.** Everything works on x86_64. On aarch64 (Apple
 Silicon VMs, ARM servers) BloodHound CE is switched off automatically (its
 pinned neo4j is x86_64-only) and the `mobile` category cannot be enabled.
 
 ---
 
 ## 2. Pick your path
 
 ```text
 Do you already run NixOS on this machine?
 ├── yes ─────────────────────────────────────────────▶ Path B
 └── no
     ├── want a full NixDaemon machine (PC or VM) ────▶ Path A
     └── want only the tools on your current Linux ───▶ Path C
 ```
 
 ---
 
 ## 3. Path A — fresh install (bare metal or VM)
 
 ### 3.1 Get the installer
 
 Download the **minimal ISO** from <https://nixos.org/download/#nixos-iso>:
 `x86_64` for Intel/AMD, `aarch64` for ARM (Apple Silicon with UTM/Parallels/
 VMware Fusion, ARM servers). Write it to a USB stick (`dd`, Ventoy, Rufus,
 balenaEtcher) or attach it to your VM — see [Hypervisor notes](#6-hypervisor-notes)
 first if you are in one.
 
 Boot it. On real hardware, **turn Secure Boot off** in the firmware setup;
 NixOS does not sign its bootloader by default.
 
 ### 3.2 Get online
 
 ```sh
 sudo -i                    # everything below runs as root
 ping -c1 nixos.org         # wired / VM networking: usually already up
 nmtui                      # Wi-Fi: pick the network, enter the password
 ```
 
 ### 3.3 Check how the machine booted
 
 ```sh
 [ -d /sys/firmware/efi ] && echo UEFI || echo BIOS
 lsblk                      # find your disk: /dev/nvme0n1, /dev/sda, /dev/vda …
 DISK=/dev/sda              # ← set this to YOUR disk. Everything on it is erased.
 ```
 
 ### 3.4 Partition, format, mount
 
 The labels (`nixos`, `boot`) matter: the placeholder hardware file finds the
 partitions by them.
 
 **UEFI** (most PCs since 2012, VMware, Hyper-V Gen 2, UTM, QEMU with OVMF):
 
 ```sh
 parted "$DISK" -- mklabel gpt
 parted "$DISK" -- mkpart ESP fat32 1MiB 1GiB
 parted "$DISK" -- set 1 esp on
 parted "$DISK" -- mkpart root ext4 1GiB 100%
 
 # partition names: /dev/sda1 /dev/sda2, but /dev/nvme0n1p1 /dev/nvme0n1p2
 P1=${DISK}1; P2=${DISK}2; case "$DISK" in *nvme*|*mmcblk*) P1=${DISK}p1; P2=${DISK}p2;; esac
 
 mkfs.fat -F 32 -n boot "$P1"
 mkfs.ext4 -L nixos "$P2"
 mount /dev/disk/by-label/nixos /mnt
 mkdir -p /mnt/boot
 mount -o umask=077 /dev/disk/by-label/boot /mnt/boot
 ```
 
 **BIOS** (old PCs; VirtualBox unless *Enable EFI* is ticked):
 
 ```sh
 parted "$DISK" -- mklabel msdos
 parted "$DISK" -- mkpart primary ext4 1MiB 100%
 mkfs.ext4 -L nixos "${DISK}1"
 mount /dev/disk/by-label/nixos /mnt
 ```
 
 Want swap? After install, a swap file is one line in `_hardware-configuration.nix`:
 `swapDevices = [ { device = "/var/lib/swapfile"; size = 8192; } ];`.
 Want full-disk encryption, btrfs or ZFS? Partition your way (the
 [NixOS manual](https://nixos.org/manual/nixos/stable/#sec-installation-manual-partitioning)
 has the recipes); just make sure to generate the hardware file in step 3.6.
 
 ### 3.5 Get NixDaemon
 
 Pick your user name now — it must match `user` in `_settings.nix` (step 3.6).
 
 ```sh
 U=operator                                     # ← your user name
 nix-shell -p git                               # git is not on the ISO
 git clone https://gitlab.com/DAEMON-404/NixDaemon.git /mnt/home/$U/NixDaemon
 cd /mnt/home/$U/NixDaemon
 ```
 
 ### 3.6 Configure
 
 ```sh
 nano modules/hosts/generic/_settings.nix
 ```
 
 Set at least `user` (same as `$U`), `system`, `boot` (and `biosDevice` for
 BIOS), `vm`, `desktop` and `timeZone`. Every option is explained in the file.
 
 Then generate the hardware file **into the repo**:
 
 ```sh
 nixos-generate-config --root /mnt --show-hardware-configuration \
   > modules/hosts/generic/_hardware-configuration.nix
 ```
 
 (Skipping this works only if you partitioned exactly as in 3.4 — the
 placeholder assumes those labels. Generating it is always the safer choice.)
 
 > **Flakes only see files git knows about.** Editing the two files above is
 > fine (they are already tracked). If you ever *add* a file, `git add` it
 > before building, or Nix will say it does not exist.
 
 ### 3.7 Install
 
 ```sh
 nixos-install --flake .#nixdaemon
 # low RAM (≤ 4 GB)?    nixos-install --flake .#nixdaemon --max-jobs 1 --cores 2
 ```
 
 It asks for a **root password** at the end. Then:
 
 ```sh
 reboot                     # remove the ISO / USB when the machine powers off
 ```
 
 Continue with [First boot](#7-first-boot).
 
 ---
 
 ## 4. Path B — you already run NixOS
 
 ```sh
 git clone https://gitlab.com/DAEMON-404/NixDaemon.git ~/NixDaemon
 cd ~/NixDaemon
 cp /etc/nixos/hardware-configuration.nix modules/hosts/generic/_hardware-configuration.nix
 nano modules/hosts/generic/_settings.nix
 ```
 
 In `_settings.nix`, make these **match your current system** or it may not
 boot:
 
 - `user` — your existing user name (your files are kept; the account is
   re-declared by NixDaemon, so groups and shell follow `_settings.nix`).
 - `boot` — `"efi"` if `/sys/firmware/efi` exists (this switches you to
   systemd-boot), else `"bios"` with `biosDevice` set to the disk GRUB is on now.
 - `hostName`, `timeZone`, `keyboard`.
 
 Build first, switch on the next boot (safest):
 
 ```sh
 sudo nixos-rebuild boot --flake .#nixdaemon
 sudo reboot
 ```
 
 Your old configuration stays in the boot menu as an earlier generation, so
 you can always go back. `/etc/nixos` is no longer used.
 
 ---
 
 ## 5. Path C — just the tools (any Linux, WSL)
 
 No NixOS needed: install Nix, then open a shell with the whole toolkit on
 `PATH`. Nothing is installed system-wide, and leaving the shell leaves no
 trace.
 
 ```sh
 # 1. Nix (Linux, WSL2). Determinate's installer enables flakes for you:
 curl -fsSL https://install.determinate.systems/nix | sh -s -- install
 
 # 2. the toolkit (x86_64-linux):
 nix develop gitlab:DAEMON-404/NixDaemon#pentest           # everything
 nix develop gitlab:DAEMON-404/NixDaemon#pentest-recon     # one category: -ad -web -crack -pivot …
 ```
 
 Limits: the dev shell has the **tools**, not the machine. `htbvpn`, `htbtarget`
 (`/etc/hosts`), the `~/pentesting` arsenal and `sudo nmap` need the NixOS
 install. The dev shells are x86_64-linux only (several tools exist only
 for x86_64); on ARM, install the generic host instead (Path A). macOS is not
 supported — use a VM ([UTM](https://mac.getutm.app/) + Path A).
 
 **WSL**: Path C works in WSL2. A full NixDaemon *inside* WSL is not supported
 (no systemd units for the VPN, no desktop); use Hyper-V or VMware instead.
 
 ---
 
 ## 6. Hypervisor notes
 
 Set `vm` in `_settings.nix` to install the matching guest tools (shared
 clipboard, automatic resolution, time sync). Give the VM **8 GB RAM, 4 CPUs,
 100 GB disk** if you can.
 
 > **The X11 desktops are off until you pick one.** `desktop` defaults to
 > `"niri"`. For a VM without working 3D set it to `"xfce"` (a full desktop,
 > Rosé Pine) or `"i3"` (a lightweight tiling window manager, Rosé Pine — the
 > whole VM idles around 0.9 GB). Both are newer than the Niri desktop and less
 > tested: expect the odd rough edge.
 
 | Hypervisor | `vm =` | Firmware → `boot =` | Graphics → `desktop =` |
 |---|---|---|---|
 | **VMware** Workstation / Fusion (x86) | `"vmware"` | set *UEFI* in VM options → `"efi"` | enable *Accelerate 3D graphics* → `"niri"` |
 | **VMware Fusion** on Apple Silicon | `"vmware"` | UEFI → `"efi"`, `system = "aarch64-linux"` | 3D on → `"niri"`, else `"xfce"` |
 | **VirtualBox** | `"virtualbox"` | default is BIOS → `"bios"` (`biosDevice = "/dev/sda"`); or tick *Enable EFI* → `"efi"` | VirtualBox's 3D is unreliable → `"xfce"` or `"i3"` |
 | **QEMU / KVM / virt-manager** | `"qemu"` | OVMF (UEFI) → `"efi"`, SeaBIOS → `"bios"` | *Virtio* video with *3D acceleration* + Spice *OpenGL* → `"niri"`; otherwise `"xfce"` |
 | **Proxmox** | `"qemu"` | OVMF → `"efi"` | no host GPU → `"xfce"` / `"i3"`, or `"none"` + SSH |
 | **UTM** (Apple Silicon) | `"qemu"` | UEFI → `"efi"`, `system = "aarch64-linux"` | *virtio-gpu-gl-pci* → `"niri"`, else `"xfce"` |
 | **Parallels** (Apple Silicon) | `"none"` | UEFI → `"efi"`, `system = "aarch64-linux"` | `"xfce"` |
 | **Hyper-V** | `"hyperv"` | Generation 2, **Secure Boot off** → `"efi"` | no 3D → `"xfce"` / `"i3"` |
 | **Cloud / headless server** | `"qemu"` or `"none"` | provider's default | `"none"`, `ssh = true` + your key |
 
 **Niri needs working 3D.** If you log in and get a black screen or are
 thrown back to the greeter, the VM has no usable OpenGL: switch to
 `desktop = "xfce"` or `"i3"` (see [§9](#9-when-something-goes-wrong)).
 
 **Shared folders**: set `sharedFolders = true;` and enable sharing in the
 hypervisor too. VMware mounts them at `/mnt/hgfs/<name>` (on first access);
 VirtualBox puts them at `/media/sf_<name>` and adds your user to `vboxsf`.
 Under XFCE and i3, VMware's clipboard and auto-resize come from
 open-vm-tools; on Niri (Wayland) the clipboard is not shared.
 
 **Disk device names differ**: VirtIO disks are `/dev/vda`, SATA/SCSI are
 `/dev/sda`, NVMe is `/dev/nvme0n1`. Check with `lsblk` before partitioning,
 and use the right one for `biosDevice`.
 
 ---
 
 ## 7. First boot
 
 1. Log in as your `user` with the `initialPassword` from `_settings.nix`
    (default `nixdaemon`), then **change it at once**:
 
    ```sh
    passwd
    ```
 
 2. Fix ownership of the checkout (it was cloned as root in Path A):
 
    ```sh
    sudo chown -R "$USER":users ~/NixDaemon
    ```
 
 3. Find your way around:
 
    ```sh
    pentest-cheat              # the toolkit card: htb workflow, recon, AD, pivot, crack, web …
    niri-cheat                 # the desktop's keys (Super+Return terminal, Super+Space launcher)
    htbpaths                   # the ~/pentesting arsenal and its $variables
    ```
 
 4. HTB / lab VPN: put your `.ovpn` file(s) in `~/.config/htb/vpn/`, then
    `htbup` (or `htbvpn up <name>`). `htbip` prints your tunnel address.
 
 5. Start a box:
 
    ```sh
    htbbox new Sauna 10.10.10.175 windows easy     # directory, box.json, $TARGET, /etc/hosts
    htbscan full                                    # nmap → recon/, ports into box.json
    revshell bash                                   # a reverse shell for your tunnel IP
    ```
 
 ---
 
 ## 8. Updating, rolling back, more machines
 
 ```sh
 cd ~/NixDaemon
 nh os switch -H nixdaemon              # rebuild after editing _settings.nix (shows a diff, asks for sudo)
 nix flake update && nh os switch -H nixdaemon     # update every input (nixpkgs etc.)
 git pull && nh os switch -H nixdaemon             # take upstream NixDaemon changes
 ```
 
 If you kept `hostName = "nixdaemon"`, plain `nh os switch` works without `-H`.
 The plain-Nix equivalent of all of these is
 `sudo nixos-rebuild switch --flake ~/NixDaemon#nixdaemon`.
 
 **Rolling back**: every rebuild is a new generation. Pick an older one in the
 boot menu, or `sudo nixos-rebuild switch --rollback`.
 
 **More than one machine** from one checkout: in your fork, add a file such as
 `modules/hosts/mine.nix`:
 
 ```nix
 { self, ... }:
 {
   flake.nixosConfigurations.vm = self.lib.mkHost (
     import ./generic/_settings.nix // {
       hostName = "vm";
       vm = "qemu";
       hardware = ./_vm-hardware.nix;   # that machine's nixos-generate-config output
     }
   );
 }
 ```
 
 then `git add` both files and install it with `--flake .#vm`.
 
 ---
 
 ## 9. When something goes wrong
 
 | Symptom | Fix |
 |---|---|
 | `error: … does not provide attribute … nixdaemon` or "path does not exist" | A new file is not tracked: `git add -A`, build again. |
 | `Failed assertions: _settings.nix: …` | A value in `_settings.nix` is misspelled; the message names it. |
 | Black screen / back at the greeter after choosing Niri | No 3D in the VM. Set `desktop = "xfce"` (or `"i3"`), then from a text console (Ctrl+Alt+F2) run `sudo nixos-rebuild switch --flake ~/NixDaemon#nixdaemon`. |
 | Machine does not boot after install | Wrong `boot` mode, or BIOS `biosDevice` pointing at the wrong disk. Boot the ISO, mount (3.4), fix `_settings.nix`, run `nixos-install` again. |
 | `No space left on device` during install | The disk is too small (60 GB minimum), or the target is not mounted at `/mnt`. |
 | Install killed / machine freezes while building | Out of RAM: `--max-jobs 1 --cores 2`, or give the VM more memory. |
 | `hash mismatch` fetching a payload | Upstream replaced a release file. Run `pentest-update` (re-pins), or turn that category off for now. |
 | Clock-skew errors from Kerberos tools | `htbtime` syncs your clock to the target's DC (and restores it after). |
 | You want the previous system back | Choose an older generation in the boot menu, or `sudo nixos-rebuild switch --rollback`. |
 
 **Ask Claude.** NixDaemon installs a Claude Code skill at
 `~/.claude/skills/nixdaemon` (source: [skills/nixdaemon/SKILL.md](../skills/nixdaemon/SKILL.md)):
 run `claude` and describe the problem — it knows which file to edit, the
 traps above and where the logs are. It shows changes before making them and
 leaves `sudo` to you.
 
 Still stuck? `nix flake check` runs every category's smoke test and the VM
 tests, and usually names the broken piece.