[{"content":"\u003cp\u003eI recently finished reading \u003ca href=\"https://amzn.to/4aLRts8\" title=\"Amazon Affiliate Link\"\u003eLiars and Outliers\u003c/a\u003e by \u003ca href=\"https://www.schneier.com/blog/about/\" title=\"About Bruce Schneier\"\u003eBruce Schneier\u003c/a\u003e and it was not what I expected and in a lot of ways that is a good thing.\n\u003cem\u003e(Disclosure: the book link above is an Amazon affiliate link — I may earn a small commission if you buy through it.)\u003c/em\u003e\nIt is so easy to get focused on the technology and forget that at the end of the day, people are at the core of what we do.\nIn his book, Schneier does an excellent job of abstracting the concept of security to a point where we can understand contracts and societal pressures as forms of security in addition to cryptography and EDR tools.\nThis allows him to draw an accurate picture of the relationship between trust and security.\u003c/p\u003e\n\u003ch2 id=\"incentivize-the-right-behavior\"\u003eIncentivize the Right Behavior\u003c/h2\u003e\n\u003cp\u003eThere was a lot to unpack! A good portion of the book talked about one of my favorite topics which is competing interests and intended consequences. In the spirit of application, I try to always ask myself:\u003c/p\u003e\n\u003cp\u003eWhat behavior is this going to incentivize?\u003c/p\u003e\n\u003cp\u003eAnother way of thinking about it is:\u003c/p\u003e\n\u003cp\u003eWhat new behaviors will come about because of my decision or change?\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eProhibition incentivized organized criminals to engage in bootlegging.\u003c/li\u003e\n\u003cli\u003eTax laws and loopholes drive accounting practices and investment decisions.\u003c/li\u003e\n\u003cli\u003eUnrealistic standards tend to incentivize apathy, corner cutting, or outright lying.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eBack in the boat times (my submarining days) I had a lot of time, seriously a lot, to ponder these topics. Being trapped in a steel tube with all your best friends for months on end gives a unique opportunity to observe behavior over a long period of time. You could see how decisions made by peers and leadership, or changes in the schedule, could impact an individual\u0026rsquo;s attitude and behavior.\u003c/p\u003e\n\u003cp\u003eI love this topic so much I wrote my capstone paper for my master\u0026rsquo;s degree on it: \u003ca href=\"https://drive.google.com/file/d/1Z-wZJvANBDXdCaAdtCtC7omgrGjDH0f6/view?usp=drive_link\" title=\"My capstone paper I wrote for my M.S. in cybersecurity at DePaul University\"\u003ecapstone paper\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eYou can read it if you want, if not I won\u0026rsquo;t be offended. That style of writing is not my preferred one but I poured the figurative \u0026lsquo;blood, sweat, and tears\u0026rsquo; into that paper so I figure I better share it.\u003c/p\u003e\n\u003ch2 id=\"human-capacity-for-trust\"\u003eHuman Capacity for Trust\u003c/h2\u003e\n\u003cp\u003eWhat really struck me though came in the first several chapters and formed part of the foundation for the book: Dunbar\u0026rsquo;s numbers.\u003c/p\u003e\n\u003cp\u003eTo quote \u003ca href=\"https://en.wikipedia.org/wiki/Dunbar%27s_number\" title=\"Dunbar's Number\"\u003eWikipedia\u003c/a\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003eDunbar\u0026rsquo;s number is a suggested cognitive limit to the number of people with whom one can maintain stable social relationships—relationships in which an individual knows who each person is and how each person relates to every other person\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003eThis wasn\u0026rsquo;t the first I\u0026rsquo;d encountered this number but it was the first time that I had really given it much thought. What struck me was this quote from Dunbar:\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e\u0026hellip;when there are more than about 150 individuals, they cannot control the behaviour of members by peer pressure.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003eThis quote was in reference to the Hutterites and Schneier included a second quote, most likely to soften the message, and quoted Hardin as saying \u0026ldquo;Perhaps we should say a community below 150 really is managed\u0026ndash;managed by conscience.\u0026rdquo;\u003c/p\u003e\n\u003cp\u003eFast attack submarines usually have about 120 or so crew members and I can attest that peer pressure is one of the biggest drivers of accountability and behavior. Submariners are constantly observing and correcting the behavior of other sailors both up and down the chain of command. Turns out that holding a standard matters when everyone\u0026rsquo;s literal lives are on the line.\u003c/p\u003e\n\u003ch3 id=\"size-of-the-organization-and-the-human-capacity-for-trust\"\u003eSize of the Organization and the Human Capacity for Trust\u003c/h3\u003e\n\u003cp\u003eSchneier spends the rest of the book referencing Dunbar\u0026rsquo;s numbers, because yes there is actually more than one. The general idea is that as social groups, whether that be communities, companies, families, etc. expand, people need systems, processes, and abstract entities like governments to allow them to continue to trust. This is as opposed to smaller groups where peer pressure is sufficient.\u003c/p\u003e\n\u003cp\u003eAs an organization grows, it would do well to keep these numbers in mind and have a plan in place for implementing scalable systems in place of peer pressure as they grow. If the transition doesn\u0026rsquo;t happen as it should, there is a good chance that the culture of excellence that the organization (hopefully) built might start to degrade.\u003c/p\u003e\n\u003cp\u003eAs a security professional, I often find myself tasked with maintaining trust with end users. I find that trust to be important in order to help build security into the culture but also to make sure the end user feels like they can come to me when they need to. I\u0026rsquo;m a big fan of Jason Meller\u0026rsquo;s Honest Security principles ( I usually refer to this as his Honest Security Manifesto, but that\u0026rsquo;s my term not his ). \u003ca href=\"https://honest.security/\" title=\"Jason Meller's Honest Security - Guide to Endpoint Security and Device Management\"\u003eHonest Security\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eTraditional corporate security sends a message to the end user of \u0026ldquo;We don\u0026rsquo;t trust you\u0026rdquo; and it often doesn\u0026rsquo;t scale. Requesting new tooling is an arduous process that leaves most employees just making do with what might be a substandard tool for the job. Agents and scanners are installed on the end user\u0026rsquo;s device without their knowledge and the first time they hear from security is when something goes wrong. That sets an odd tone, and can also feel accusatory. This point and more are covered in Jason\u0026rsquo;s principles. Tools like \u003ca href=\"https://www.kolide.com/\" title=\"Kolide Device Trust\"\u003eKolide\u003c/a\u003e, which is Jason\u0026rsquo;s company, can help fix this transparency issue.\u003c/p\u003e\n\u003cp\u003eBut I digress, we are supposed to be talking about the human capacity for trust here. Vulnerability scanners and EDR agents are important right? Absolutely. They provide much needed telemetry about devices on our networks and are critical components in the IR process. But many users are put off by EDR tools. Partly, they don\u0026rsquo;t like losing control over their device, but often times it comes down to \u0026ldquo;What, you don\u0026rsquo;t trust me?\u0026rdquo;\u003c/p\u003e\n\u003cp\u003eHere is the big takeaway from Schneier\u0026rsquo;s book and Dunbar\u0026rsquo;s numbers. It isn\u0026rsquo;t that I don\u0026rsquo;t, it\u0026rsquo;s that I can\u0026rsquo;t. I literally lack the capacity. There are 1000 of you and 1 of me. I\u0026rsquo;d love to know each and every one of you but I can\u0026rsquo;t even remember every member of my family tree! I need the EDR agents and vulnerability scanning agents in place because I can\u0026rsquo;t enforce good behavior through peer pressure alone. Even if I could, I need a way to hand over objective evidence to auditors and regulators that everything is as it is supposed to be (yay compliance).\u003c/p\u003e\n\u003cp\u003eSo where does that leave us? When users push back on rolling out EDR for the first time, there are two points that I think are crucial to make:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eIt isn\u0026rsquo;t that I don\u0026rsquo;t trust you, it\u0026rsquo;s that I can\u0026rsquo;t. I can\u0026rsquo;t possibly personally verify every user\u0026rsquo;s technical aptitude.\u003c/li\u003e\n\u003cli\u003eI need this data to prove that it isn\u0026rsquo;t you should something originate from your device.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSo what is that second point about? If a user\u0026rsquo;s laptop is identified as the source of malicious activity, without the right telemetry it might be impossible to say whether the end user is to blame or if their device has been compromised and they are just a victim.\u003c/p\u003e\n\u003ch2 id=\"conclusion\"\u003eConclusion\u003c/h2\u003e\n\u003cp\u003eWe as humans have a limited capacity for trust and relationships. This ends up putting a limit on how large our social groups can be while still maintaining order through peer pressure (conscience) alone. Scale your systems accordingly, and make sure you have a plan for transitioning to tooling and systems for trust. Hopefully, this proves useful. It was a somewhat stream of consciousness type of post.\u003c/p\u003e\n","description":"My takeaways from Bruce Schneier's Liars and Outliers, incentivizing behavior and managing security expectations based on organizational size.","image":null,"permalink":"https://sebsec.io/blog/liars-and-outliers/","title":"Liars and Outliers - Headcount Matters"},{"content":"\u003ch2 id=\"i-make-systems-and-people-more-secure\"\u003eI make systems and people more secure!\u003c/h2\u003e\n\u003cp\u003eI like to get my hands dirty where I can whether that is writing policy or code or doing incident response.\nBefore I was doing InfoSec things, I was in the United States Navy where I split atoms underwater (submarine nuclear power plant operator).\u003c/p\u003e\n\u003ch3 id=\"view-my-resume\"\u003eView my Resume!\u003c/h3\u003e\n\u003cdiv id=\"downloadButtonContainer\"\u003e\n    \u003ca id=\"downloadButton\" href=\"https://docs.google.com/document/d/1S3BjChcOwAHodipMJDYLGcPjXpexbuGkNNzTLbEoIoY/preview\" target=\"_blank\" rel=\"noopener\"\u003eMy Resume\u003c/a\u003e\n\u003c/div\u003e\n\n\u003cstyle\u003e\n    #downloadButtonContainer {\n        text-align: center;\n        margin-top: 20px;\n    }\n\n    #downloadButton {\n        display: inline-block;\n        padding: 10px 20px;\n        font-size: 16px;\n        background-color: #007bff;\n        color: #fff;\n        border: none;\n        border-radius: 5px;\n        cursor: pointer;\n        text-decoration: none;\n        transition: background-color 0.3s ease;\n    }\n\n    #downloadButton:hover {\n        background-color: #0056b3;\n        color: #fff;\n    }\n\u003c/style\u003e\n\n\u003ch3 id=\"when-im-not-doing-infosec-stuff\"\u003eWhen I\u0026rsquo;m not doing InfoSec stuff:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eHobbies:\u003c/strong\u003e Weight lifting, hiking, and reading\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCommunity:\u003c/strong\u003e Volunteering with my church and local charities to help resettle Ukranian refugees.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eVideo Games:\u003c/strong\u003e My top games recently are Elden Ring and Baldur\u0026rsquo;s Gate 3 but I\u0026rsquo;ve also been playing Rogue Trader and Palworld on and off.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eBooks\u003c/strong\u003e I\u0026rsquo;m mostly a fantasy nerd, but I\u0026rsquo;ve been known to enjoy a variety of books.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch4 id=\"thanks-for-stopping-by\"\u003eThanks for stopping by!\u003c/h4\u003e\n\u003cp\u003e\u003cimg src=\"/images/Oly.jpg\" alt=\"Alt text\" loading=\"lazy\" decoding=\"async\"\u003e\u003cbr\u003e\nUSS Olympia (SSN-717) pulling into Pearl Harbor, Hawaii. This was taken the day I returned from sea for the last time! I would have been somewhere in the back 1/3 and definitely below the waterline.\u003c/p\u003e\n","description":"The about me page for Sebastian Whiting, an Information Security Professional","image":null,"permalink":"https://sebsec.io/about/","title":"About Me - Sebastian Whiting"},{"content":"\u003cp\u003eMy personal website was due for an overhaul (and in many ways a simplification) and I\u0026rsquo;ve been working around Nix long enough that I decided to build out my new site on it. Well, this is it!\u003c/p\u003e\n\u003cp\u003eAt a high level, these are the tools I used:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eDigitalOcean\u003c/strong\u003e for hosting the server (configured with Terraform)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eA custom NixOS image\u003c/strong\u003e which I found directions for \u003ca href=\"https://notes.abhinavsarkar.net/2022/DO-nixos-image\" title=\"Digital Ocean NixOS Image\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eFlakes\u003c/strong\u003e for configuration.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eA flake for the hugo site\u003c/strong\u003e, which I derived from \u003ca href=\"https://www.chrisportela.com/posts/this-site-is-a-flake/\"\u003ehere\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"getting-up-to-speed\"\u003eGetting up to Speed\u003c/h2\u003e\n\u003cp\u003eBefore I could really get started, I decided to do a deeper dive into Nix. I had some working knowledge of Nix prior to this project so it was more a matter of filling in gaps. I specifically wanted to make sure I understood Flakes as they seemingly continue to grow in popularity. If you, like me, are just diving into Nix(OS) these should help you out as well!\u003c/p\u003e\n\u003ch3 id=\"the-resources-i-used\"\u003eThe resources I used:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://zero-to-nix.com/\"\u003ehttps://zero-to-nix.com/\u003c/a\u003e\u003c/strong\u003e from Determinate Systems for getting up and running.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://nix.dev/tutorials/nix-language\"\u003ehttps://nix.dev/tutorials/nix-language\u003c/a\u003e\u003c/strong\u003e for getting a handle on the language. Lots of great resources here that I plan on referencing in the future.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://haskellbook.com/\" title=\"Haskell Programming from First Principles Book\"\u003eHaskell Programming from First Principles\u003c/a\u003e\u003c/strong\u003e Really just the first chapter or two here is super helpful, and you could probably find other tutorials. Functional programming is new to me so going over Lambda Calculus was very beneficial. I happened to have started this book just before this endeavor.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"hosting-on-digital-ocean\"\u003eHosting on Digital Ocean\u003c/h2\u003e\n\u003cp\u003eThere are two options for hosting a NixOS machine on Digital Ocean:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003e\n\u003cp\u003eUse \u003ca href=\"https://github.com/elitak/nixos-infect\" title=\"NixOS-Infect GitHub Repository\"\u003eNixOS-Infect\u003c/a\u003e. A lot of people online seem to have success with this method but I lost SSH access to the box every time I ran the script despite having my keys appropriately staged on it. I\u0026rsquo;m not ruling this out as a method, I might have made mistakes but I found the second option to be the easier way forward.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUse a \u003ca href=\"https://notes.abhinavsarkar.net/2022/DO-nixos-image\" title=\"Digital Ocean NixOS Image\"\u003ecustom NixOS Image\u003c/a\u003e. Once you have the image, simply upload it to your Digital Ocean account and fire up the instance!\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"configuration-with-flakes\"\u003eConfiguration with Flakes\u003c/h2\u003e\n\u003cp\u003eBelow is my \u003ccode\u003econfiguration.nix\u003c/code\u003e file for this server. The only thing I modified here was \u003ccode\u003enix.settings.experimental-features\u003c/code\u003e and \u003ccode\u003esystem.stateVersion\u003c/code\u003e. The \u003ccode\u003eimports\u003c/code\u003e were setup when I created the NixOS image and are what enables this image to work on Digital Ocean. They are best left alone!\u003c/p\u003e\n\u003ch3 id=\"configurationnix\"\u003eConfiguration.nix\u003c/h3\u003e\n\u003cdiv class=\"highlight\"\u003e\u003cpre tabindex=\"0\" style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;\"\u003e\u003ccode class=\"language-nix\" data-lang=\"nix\"\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e{ modulesPath\u003cspan style=\"color:#f92672\"\u003e,\u003c/span\u003e lib\u003cspan style=\"color:#f92672\"\u003e,\u003c/span\u003e pkgs\u003cspan style=\"color:#f92672\"\u003e,\u003c/span\u003e \u003cspan style=\"color:#f92672\"\u003e...\u003c/span\u003e }:\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e{\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e  imports \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e lib\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003eoptional (builtins\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003epathExists \u003cspan style=\"color:#e6db74\"\u003e./do-userdata.nix\u003c/span\u003e) \u003cspan style=\"color:#e6db74\"\u003e./do-userdata.nix\u003c/span\u003e \u003cspan style=\"color:#f92672\"\u003e++\u003c/span\u003e [\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e    (modulesPath \u003cspan style=\"color:#f92672\"\u003e+\u003c/span\u003e \u003cspan style=\"color:#e6db74\"\u003e\u0026#34;/virtualisation/digital-ocean-config.nix\u0026#34;\u003c/span\u003e)\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e  ];\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e  nix\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003esettings\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003eexperimental-features \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e [ \u003cspan style=\"color:#e6db74\"\u003e\u0026#34;nix-command\u0026#34;\u003c/span\u003e \u003cspan style=\"color:#e6db74\"\u003e\u0026#34;flakes\u0026#34;\u003c/span\u003e ];\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e  system\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003estateVersion \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#e6db74\"\u003e\u0026#34;23.11\u0026#34;\u003c/span\u003e;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e}\n\u003c/span\u003e\u003c/span\u003e\u003c/code\u003e\u003c/pre\u003e\u003c/div\u003e\u003cp\u003eSo there isn\u0026rsquo;t much in \u003ccode\u003econfiguration.nix\u003c/code\u003e because I\u0026rsquo;m using Flakes to manage this server. My \u003ccode\u003eflake.nix\u003c/code\u003e is below.\u003c/p\u003e\n\u003ch3 id=\"flakenix\"\u003eFlake.nix\u003c/h3\u003e\n\u003cp\u003e\u003cstrong\u003eNotes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eThe \u003ccode\u003einputs\u003c/code\u003e section calls all the flakes I use in \u003ccode\u003eoutputs\u003c/code\u003e. Some of these are referenced using \u003ccode\u003egit+ssh\u003c/code\u003e and others just use the relative file path. All my NixOS work lives in the same monorepo so I could have just stuck with relative filepaths for everything but I was experimenting.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eMy only output is a \u003ccode\u003enixosConfiguration\u003c/code\u003e called \u003ccode\u003esebsec\u003c/code\u003e.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eWithin that we have a handful of modules being imported. The first is my \u003ccode\u003econfiguration.nix\u003c/code\u003e file from above, the next two are some flakes which define my users and standard packages for the machine.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe last one is calling in some additional configuration which I was not able to setup within a flake. Specifically, it sets up \u003ccode\u003eservices.openssh.enable = true\u003c/code\u003e and some other OpenSSH related settings. Apparently pulling in additional \u003ccode\u003enixosConfigurations\u003c/code\u003e from other flakes isn\u0026rsquo;t quite supported as indicated by this wonderfully snarky error message:\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ccode\u003eWhile loading a configuration into the module system is a very sensible idea, it can not be done cleanly in practice.\u003c/code\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eAlso note that it calls my \u003ccode\u003ehugo-site\u003c/code\u003e package (using the \u003ccode\u003esystem\u003c/code\u003e variable to ensure we grab the right version) which we will see defined below and in the \u003ccode\u003enginx\u003c/code\u003e settings points the root to where the package will live in \u003ccode\u003e/nix/store\u003c/code\u003e. This is extremely important because each time changes are made, that filepath will change to reflect the hash of the new build.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe last section  does what it says, it sets up \u003ccode\u003enginx\u003c/code\u003e and handles generating the SSL certificate. Realistically, I could move this to its own module file similar to \u003ccode\u003ebaseConfig.nix\u003c/code\u003e in order to keep my main \u003ccode\u003eflake.nix\u003c/code\u003e as clean as possible. And of course, it opens up the required ports.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003cdiv class=\"highlight\"\u003e\u003cpre tabindex=\"0\" style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;\"\u003e\u003ccode class=\"language-nix\" data-lang=\"nix\"\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e{\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e  description \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#e6db74\"\u003e\u0026#34;flake for yourHostNameGoesHere\u0026#34;\u003c/span\u003e;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e  inputs \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e {\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e    nixpkgs \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e {\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e      url \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#e6db74\"\u003e\u0026#34;github:NixOS/nixpkgs/nixos-23.11\u0026#34;\u003c/span\u003e;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e    };\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e    flake-utils\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003eurl \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#e6db74\"\u003e\u0026#34;github:numtide/flake-utils\u0026#34;\u003c/span\u003e;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e    users-flake\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003eurl \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#e6db74\"\u003e\u0026#34;git+ssh://git@github.com/sjdwhiting/NixOS.git?dir=users\u0026#34;\u003c/span\u003e;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e    users-flake\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003einputs\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003enixpkgs\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003efollows \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#e6db74\"\u003e\u0026#34;nixpkgs\u0026#34;\u003c/span\u003e;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e    packages-flake\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003eurl \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#e6db74\"\u003e\u0026#34;git+ssh://git@github.com/sjdwhiting/NixOS.git?dir=systemPackages\u0026#34;\u003c/span\u003e;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e    packages-flake\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003einputs\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003enixpkgs\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003efollows \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#e6db74\"\u003e\u0026#34;nixpkgs\u0026#34;\u003c/span\u003e;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e    hugo-site\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003eurl \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#e6db74\"\u003e\u0026#34;../../packages/hugo\u0026#34;\u003c/span\u003e;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e    hugo-site\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003einputs\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003enixpkgs\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003efollows \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#e6db74\"\u003e\u0026#34;nixpkgs\u0026#34;\u003c/span\u003e;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e  };\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e  outputs \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e { self\u003cspan style=\"color:#f92672\"\u003e,\u003c/span\u003e nixpkgs\u003cspan style=\"color:#f92672\"\u003e,\u003c/span\u003e flake-utils\u003cspan style=\"color:#f92672\"\u003e,\u003c/span\u003e users-flake\u003cspan style=\"color:#f92672\"\u003e,\u003c/span\u003e packages-flake\u003cspan style=\"color:#f92672\"\u003e,\u003c/span\u003e hugo-site\u003cspan style=\"color:#f92672\"\u003e,\u003c/span\u003e \u003cspan style=\"color:#f92672\"\u003e...\u003c/span\u003e }: {\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e    nixosConfigurations \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e {\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e      sebsec \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e nixpkgs\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003elib\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003enixosSystem \u003cspan style=\"color:#66d9ef\"\u003erec\u003c/span\u003e {\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e        system \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#e6db74\"\u003e\u0026#34;x86_64-linux\u0026#34;\u003c/span\u003e;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e        modules \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e [\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e          \u003cspan style=\"color:#e6db74\"\u003e./configuration.nix\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e          users-flake\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003enixosModules\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003eusers\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e          packages-flake\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003enixosModules\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003edefaultPackages\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e          \u003cspan style=\"color:#e6db74\"\u003e../../modules/baseConfig.nix\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e  \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e          \u003cspan style=\"color:#75715e\"\u003e# Sets up the static website based on flake\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e          ({ pkgs\u003cspan style=\"color:#f92672\"\u003e,\u003c/span\u003e \u003cspan style=\"color:#f92672\"\u003e...\u003c/span\u003e }: {\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e            environment\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003esystemPackages \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#66d9ef\"\u003ewith\u003c/span\u003e pkgs; [\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e              hugo-site\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003epackages\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003e\u003cspan style=\"color:#e6db74\"\u003e${\u003c/span\u003esystem\u003cspan style=\"color:#e6db74\"\u003e}\u003c/span\u003e\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003ewebsite\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e            ];\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e            \u003cspan style=\"color:#75715e\"\u003e# Sets up NGINX and points it to the updated website.\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e            networking\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003efirewall\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003eallowedTCPPorts \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e [ \u003cspan style=\"color:#ae81ff\"\u003e80\u003c/span\u003e \u003cspan style=\"color:#ae81ff\"\u003e443\u003c/span\u003e ]; \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e            services\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003enginx\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003eenable \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#66d9ef\"\u003etrue\u003c/span\u003e;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e            security\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003eacme\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003eacceptTerms \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#66d9ef\"\u003etrue\u003c/span\u003e;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e            security\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003eacme\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003edefaults\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003eemail \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#e6db74\"\u003e\u0026#34;you@example.com\u0026#34;\u003c/span\u003e;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e            services\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003enginx\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003evirtualHosts\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003e\u003cspan style=\"color:#e6db74\"\u003e\u0026#34;sebsec.io\u0026#34;\u003c/span\u003e \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e {\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e              enableACME \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#66d9ef\"\u003etrue\u003c/span\u003e;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e              forceSSL \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#66d9ef\"\u003etrue\u003c/span\u003e;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e              root \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#e6db74\"\u003e\u0026#34;\u003c/span\u003e\u003cspan style=\"color:#e6db74\"\u003e${\u003c/span\u003ehugo-site\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003epackages\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003e\u003cspan style=\"color:#e6db74\"\u003e${\u003c/span\u003esystem\u003cspan style=\"color:#e6db74\"\u003e}\u003c/span\u003e\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003ewebsite\u003cspan style=\"color:#e6db74\"\u003e}\u003c/span\u003e\u003cspan style=\"color:#e6db74\"\u003e\u0026#34;\u003c/span\u003e;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e              locations\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003e\u003cspan style=\"color:#e6db74\"\u003e\u0026#34;/\u0026#34;\u003c/span\u003e\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003eextraConfig \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#e6db74\"\u003e\u0026#39;\u0026#39;\n\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\u003cspan style=\"color:#e6db74\"\u003e                try_files $uri $uri/ /index.html;\n\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\u003cspan style=\"color:#e6db74\"\u003e              \u0026#39;\u0026#39;\u003c/span\u003e;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e            };\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e          })\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e        ];\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e      };\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e    };\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e  };\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e}\n\u003c/span\u003e\u003c/span\u003e\u003c/code\u003e\u003c/pre\u003e\u003c/div\u003e\u003ch3 id=\"hugo-flake\"\u003eHugo Flake\u003c/h3\u003e\n\u003cp\u003eLastly, we have the \u003ccode\u003eflake.nix\u003c/code\u003e for \u003ccode\u003eHugo\u003c/code\u003e which we imported in the \u003ccode\u003eflake.nix\u003c/code\u003e above. What I appreciate about this is the simplicity, it made for a great way to get my hands on using flakes and achieve the goal of launching this site on NixOS.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eNotes\u003c/strong\u003e\u003c/p\u003e\n\u003ch4 id=\"inputs\"\u003eInputs\u003c/h4\u003e\n\u003col\u003e\n\u003cli\u003e\u003ccode\u003enixpkgs\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003ehugo-coder\u003c/code\u003e which is a theme. I\u0026rsquo;m not actively using that theme, nor am I using inputs for my theme at this time but I left it in as an example of how you can ensure your themes are always up to date using Nix.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch4 id=\"outputs\"\u003eOutputs\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003eutils.lib.eachSystem\u003c/code\u003e ensures this will build on multiple systems. Adjust based on your needs.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eWe are building the package and a development shell. The build of the package is pretty straightforward, but I did have to modify it a bit and you can see it contains some debugging commands.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003col\u003e\n\u003cli\u003e\n\u003cp\u003eIt links any themes you called as inputs into the \u003ccode\u003ethemes\u003c/code\u003e folder of your hugo project\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eIt runs \u003ccode\u003ehugo\u003c/code\u003e to build the site\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eIn the \u003ccode\u003einstallPhase\u003c/code\u003e it copies the results of running \u003ccode\u003ehugo\u003c/code\u003e, which is simply the \u003ccode\u003epublic\u003c/code\u003e folder, to \u003ccode\u003e$out\u003c/code\u003e which is the \u003ccode\u003e/nix/store\u003c/code\u003e path and what we referenced in the above \u003ccode\u003eflake.nix\u003c/code\u003e.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ol\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eThe development shell allows you to easily work on the hugo site by either running \u003ccode\u003enix develop\u003c/code\u003e while in the same directory as your flake or by using \u003ccode\u003edirenv\u003c/code\u003e to automatically utilize the shell defined in the flake. \u003ca href=\"https://determinate.systems/posts/nix-direnv/\" title=\"How to setup direnv with Nix from Determinate Systems\"\u003edirenv and Nix\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFor some added context this is what my file structure looks like. Eventually, this could support multiple websites but for now you can see how the hugo site lives under the \u003ccode\u003esebsec\u003c/code\u003e folder which is why in the \u003ccode\u003ebuildPhase\u003c/code\u003e there is that \u003ccode\u003ecd sebsec\u003c/code\u003e command. \u003ca href=\"https://gohugo.io/getting-started/quick-start/\" title=\"gohugo.io quick start guide\"\u003eCheck out this quick start guide for getting up and running with \u003ccode\u003ehugo\u003c/code\u003e\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch4 id=\"file-structure\"\u003eFile Structure\u003c/h4\u003e\n\u003cdiv class=\"highlight\"\u003e\u003cpre tabindex=\"0\" style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;\"\u003e\u003ccode class=\"language-txt\" data-lang=\"txt\"\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e├── hugo\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e│   ├── flake.lock\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e│   ├── flake.nix\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e│   └── sebsec\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e│       ├── archetypes\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e│       ├── assets\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e│       ├── content\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e│       ├── data\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e│       ├── hugo.toml\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e│       ├── i18n\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e│       ├── layouts\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e│       ├── public\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e│       ├── resources\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e│       ├── static\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e│       └── themes\n\u003c/span\u003e\u003c/span\u003e\u003c/code\u003e\u003c/pre\u003e\u003c/div\u003e\u003ch4 id=\"the-actual-flake\"\u003eThe actual flake\u003c/h4\u003e\n\u003cdiv class=\"highlight\"\u003e\u003cpre tabindex=\"0\" style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;\"\u003e\u003ccode class=\"language-nix\" data-lang=\"nix\"\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\u003cspan style=\"color:#75715e\"\u003e# To use a new theme:\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\u003cspan style=\"color:#75715e\"\u003e# 1. Add the theme as an input\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\u003cspan style=\"color:#75715e\"\u003e# 2. Symlink the theme to the themes directory\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\u003cspan style=\"color:#75715e\"\u003e# 3. Update the hugo.toml file to use the new theme\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\u003cspan style=\"color:#75715e\"\u003e# Alternativeliy, download and add the theme folder to sebsec/themes and updae hugo.toml\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\u003cspan style=\"color:#75715e\"\u003e# This option allows you to customize the theme files if you desire. \u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e{\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e  description \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#e6db74\"\u003e\u0026#34;Personal website for Sebastian\u0026#34;\u003c/span\u003e;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e  inputs \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e {\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e    nixpkgs\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003eurl \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#e6db74\"\u003e\u0026#34;github:NixOS/nixpkgs\u0026#34;\u003c/span\u003e;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e    utils\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003eurl \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#e6db74\"\u003e\u0026#34;github:numtide/flake-utils\u0026#34;\u003c/span\u003e;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e    hugo-coder \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e {\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e      url \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#e6db74\"\u003e\u0026#34;github:luizdepra/hugo-coder\u0026#34;\u003c/span\u003e;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e      flake \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#66d9ef\"\u003efalse\u003c/span\u003e;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e    };\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e  };\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e  outputs \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e inputs\u003cspan style=\"color:#f92672\"\u003e@\u003c/span\u003e{ self\u003cspan style=\"color:#f92672\"\u003e,\u003c/span\u003e nixpkgs\u003cspan style=\"color:#f92672\"\u003e,\u003c/span\u003e utils\u003cspan style=\"color:#f92672\"\u003e,\u003c/span\u003e \u003cspan style=\"color:#f92672\"\u003e...\u003c/span\u003e }:\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e    utils\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003elib\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003eeachSystem [\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e      utils\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003elib\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003esystem\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003ex86_64-darwin\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e      utils\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003elib\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003esystem\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003ex86_64-linux\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e      utils\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003elib\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003esystem\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003eaarch64-darwin\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e      utils\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003elib\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003esystem\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003eaarch64-linux\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e    ]\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e      (system:\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e        \u003cspan style=\"color:#66d9ef\"\u003elet\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e          pkgs \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#f92672\"\u003eimport\u003c/span\u003e nixpkgs {\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e            \u003cspan style=\"color:#66d9ef\"\u003einherit\u003c/span\u003e system;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e          };\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e        \u003cspan style=\"color:#66d9ef\"\u003ein\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e        \u003cspan style=\"color:#66d9ef\"\u003erec\u003c/span\u003e {\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e          packages\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003ewebsite \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e pkgs\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003estdenv\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003emkDerivation {\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e            name \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#e6db74\"\u003e\u0026#34;website\u0026#34;\u003c/span\u003e;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e            src \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e self;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e            buildInputs \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e [ pkgs\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003egit pkgs\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003enodePackages\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003eprettier ];\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e            \u003cspan style=\"color:#75715e\"\u003e# I\u0026#39;ve kept these debug statements because I\u0026#39;ve hadd occasional issues with the build phase and \u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e            \u003cspan style=\"color:#75715e\"\u003e# its proven valuable to have this info in the logs\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e            buildPhase \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#e6db74\"\u003e\u0026#39;\u0026#39; \n\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\u003cspan style=\"color:#e6db74\"\u003e              cd sebsec\n\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\u003cspan style=\"color:#e6db74\"\u003e              echo \u0026#34;Currently in the following directory:\u0026#34;\n\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\u003cspan style=\"color:#e6db74\"\u003e              pwd\n\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\u003cspan style=\"color:#e6db74\"\u003e              ln -s \u003c/span\u003e\u003cspan style=\"color:#e6db74\"\u003e${\u003c/span\u003einputs\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003ehugo-coder\u003cspan style=\"color:#e6db74\"\u003e}\u003c/span\u003e\u003cspan style=\"color:#e6db74\"\u003e themes/hugo-coder\n\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\u003cspan style=\"color:#e6db74\"\u003e              echo \u0026#34;themes folder currently contains:\u0026#34;\n\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\u003cspan style=\"color:#e6db74\"\u003e              ls themes\n\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\u003cspan style=\"color:#e6db74\"\u003e              echo \u0026#34;Running hugo -v \u0026#34;\n\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\u003cspan style=\"color:#e6db74\"\u003e              \u003c/span\u003e\u003cspan style=\"color:#e6db74\"\u003e${\u003c/span\u003epkgs\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003ehugo\u003cspan style=\"color:#e6db74\"\u003e}\u003c/span\u003e\u003cspan style=\"color:#e6db74\"\u003e/bin/hugo --logLevel info\n\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\u003cspan style=\"color:#e6db74\"\u003e            \u0026#39;\u0026#39;\u003c/span\u003e;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e            installPhase \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#e6db74\"\u003e\u0026#39;\u0026#39;\n\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\u003cspan style=\"color:#e6db74\"\u003e            cp -r public $out\n\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\u003cspan style=\"color:#e6db74\"\u003e            \u0026#39;\u0026#39;\u003c/span\u003e;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e          };\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e        \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e          packages\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003edefault \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e packages\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003ewebsite;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e          apps \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e \u003cspan style=\"color:#66d9ef\"\u003erec\u003c/span\u003e {\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e            hugo \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e utils\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003elib\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003emkApp { drv \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e pkgs\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003ehugo; };\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e            default \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e hugo;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e          };\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e          devShells\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003edefault \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e pkgs\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003emkShell {\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e             buildInputs \u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003e [ pkgs\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003egit pkgs\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003enixpkgs-fmt pkgs\u003cspan style=\"color:#f92672\"\u003e.\u003c/span\u003ehugo ]; };\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e        });\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e}\n\u003c/span\u003e\u003c/span\u003e\u003c/code\u003e\u003c/pre\u003e\u003c/div\u003e\u003ch2 id=\"conclusion\"\u003eConclusion\u003c/h2\u003e\n\u003cp\u003eAll in all, I\u0026rsquo;m happy with how things turned out. The site is easy to maintain now, especially with some GitHub actions setup that automate my deploys and the ability to run \u003ccode\u003ehugo server\u003c/code\u003e to do local development. I made a lot of silly mistakes as I wrestled with Nix\u0026rsquo;s syntax but I\u0026rsquo;m in a much stronger place and ready to jump into my next Nix project! As I maintain this site, I already have some plans to clean up my configs further and make things more consistent but I wanted to post everything as is right now in hopes that it will help others on their Nix journey.\u003c/p\u003e\n\u003cp\u003e\u003cimg src=\"/images/honest-work_hu_af01b229e9a05076.webp\" srcset=\"/images/honest-work_hu_af01b229e9a05076.webp 800w, /images/honest-work_hu_84d5efd6318a3985.webp 1020w\" sizes=\"(max-width: 800px) 100vw, 800px\"\n  width=\"800\" height=\"600\" loading=\"lazy\" decoding=\"async\"\n  alt=\"It ain\u0026rsquo;t much but it\u0026rsquo;s honest work\"\u003e\u003c/p\u003e\n","description":"How I built this site using NixOS (with flakes) and Hugo including resources on how to get started with Nix and NixOS","image":null,"permalink":"https://sebsec.io/blog/nixos/","title":"This Site is Built on NixOS"}]