Centralize shared values into variables.nix

One file (variables.nix) holding every value that was previously
hardcoded and repeated across modules: LAN domain/CIDR, home/tailnet
domains, cross-host references (nix-cache substituter hostname, NFS
server hostname, remote-builder user), PXE/PBS IPs, timezone, and the
primary username.

Wired in via flake.nix's specialArgs (and home-manager's
extraSpecialArgs for the two home.nix files), so any module picks it
up by just adding `vars` to its function arguments — no explicit
import needed. Two hosts (nix-cache, server) now derive their own
networking.hostName from the same variable other hosts use to reach
them, so there's exactly one place to change either identifier.

Purely mechanical: every substituted value matches what was already
there, confirmed by identical toplevel .drv paths for all 17 targets
before and after.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -46,6 +46,7 @@ nix eval --json .#nixosConfigurations --apply builtins.attrNames | jq -r '.[]'
 | Path | Purpose |
 | --- | --- |
 | `flake.nix` | Flake inputs, the `mkTarget` platform × build-type generator, and `nixosConfigurations` outputs |
+| `variables.nix` | Single source of truth for shared values (LAN domain/CIDR, hostnames, timezone, primary username, storage root, ...) — passed to every module and Home Manager config as the `vars` argument via `specialArgs`/`extraSpecialArgs` |
 | `hosts/<name>/host.nix` | Per-machine identity: hostname, hostId, per-machine secrets, `system.stateVersion` |
 | `hosts/nixos/home.nix` | Workstation-specific Home Manager config (used by the `gui` build type) |
 | `modules/platforms/` | Platform-specific config: virtualisation guest tools, boot method, hardware config (`linode.nix`, `proxmox.nix`, `lxc.nix`) |

flake.nix

@@ -23,6 +23,7 @@
     let
       system = "x86_64-linux";
       inherit (nixpkgs) lib;
+      vars = import ./variables.nix;
 
       # Generates a nixosConfiguration from a platform (what it runs on) and
       # a build type (what it's for), plus the per-identity host.nix that
@@ -46,6 +47,7 @@
               home-manager = {
                 useGlobalPkgs = true;
                 useUserPackages = true;
+                extraSpecialArgs = { inherit vars; };
                 users.nixos = import homeFile;
               };
             }
@@ -53,7 +55,7 @@
             ./modules/nix-cache/client.nix
             ./modules/remote-builder-client.nix
           ];
-          specialArgs = { inherit inputs; };
+          specialArgs = { inherit inputs vars; };
         };
 
       # Generated platform x build-type matrix. pxe-boot has no linode

hosts/nix-cache/host.nix

@@ -1,7 +1,7 @@
-{ config, ... }:
+{ config, vars, ... }:
 
 {
-  networking.hostName = "nix-cache";
+  networking.hostName = vars.nixCacheHost;
 
   sops.secrets."beszel-token".sopsFile = ../../secrets/nix-cache.yaml;
   sops.templates."nix-cache-beszel.env".content = ''

hosts/nixos/home.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, vars, ... }:
 
 {
 
@@ -6,8 +6,8 @@
     ../../modules/common/aliases.nix
   ];
 
-  home.username = "nixos";         # your actual username
-  home.homeDirectory = "/home/nixos";
+  home.username = vars.primaryUser;
+  home.homeDirectory = "/home/${vars.primaryUser}";
   home.stateVersion = "25.05"; # match your NixOS stateVersion
 
   programs.home-manager.enable = true; # mandatory to activate HM
@@ -39,8 +39,8 @@ home.file = {
       [Desktop Entry]
       Type=Application
       Name=Proxmox (Chromium)
-    Exec=chromium --app=https://pve.sweet.home:8006 --window-size=1920,1080 --window-position=0,0
-    Icon=/home/nixos/.local/share/icons/proxmox.png
+      Exec=chromium --app=https://pve.${vars.homeDomain}:8006 --window-size=1920,1080 --window-position=0,0
+      Icon=${config.home.homeDirectory}/.local/share/icons/proxmox.png
       Terminal=false
       Categories=Hypervisor;
       StartupWMClass=PVE
@@ -49,8 +49,8 @@ home.file = {
       [Desktop Entry]
       Type=Application
       Name=Proxmox Backup Server (Chromium)
-    Exec=chromium --app=https://192.168.2.108:8007 --window-size=1920,1080 --window-position=0,0
-    Icon=/home/nixos/.local/share/icons/proxmox.png
+      Exec=chromium --app=https://${vars.pbsIp}:8007 --window-size=1920,1080 --window-position=0,0
+      Icon=${config.home.homeDirectory}/.local/share/icons/proxmox.png
       Terminal=false
       Categories=backup;
 
@@ -59,8 +59,8 @@ home.file = {
       [Desktop Entry]
       Type=Application
       Name=Proxmox (Firefox)
-    Exec=firefox --new-instance https://pve.sweet.home:8006 --profile ProxmoxWebApp --window-size=1920,1080 --class ProxmoxWebApp
-    Icon=/home/nixos/.local/share/icons/proxmox.png
+      Exec=firefox --new-instance https://pve.${vars.homeDomain}:8006 --profile ProxmoxWebApp --window-size=1920,1080 --class ProxmoxWebApp
+      Icon=${config.home.homeDirectory}/.local/share/icons/proxmox.png
       Terminal=false
       Categories=Hypervisor;
       StartupWMClass=PVE
@@ -69,8 +69,8 @@ home.file = {
       [Desktop Entry]
       Type=Application
       Name=Proxmox Backup Server (Firefox)
-    Exec=firefox --new-window https://192.168.2.108:8007 --profile PbsWebApp --window-size=1920,1080 --class PbsWebApp
-    Icon=/home/nixos/.local/share/icons/proxmox.png
+      Exec=firefox --new-window https://${vars.pbsIp}:8007 --profile PbsWebApp --window-size=1920,1080 --class PbsWebApp
+      Icon=${config.home.homeDirectory}/.local/share/icons/proxmox.png
       Terminal=false
       Categories=backup;
       StartupWMClass=PBS

hosts/server/host.nix

@@ -1,7 +1,7 @@
-{ config, ... }:
+{ config, vars, ... }:
 
 {
-  networking.hostName = "server";
+  networking.hostName = vars.nfsServerHost;
   networking.hostId = "6689f93e";
 
   sops.secrets."beszel-token".sopsFile = ../../secrets/server.yaml;
@@ -13,7 +13,7 @@
     #DOCKER_HOST = "tcp://docker-socket-proxy:2375";
     #HUB_URL = "http://docker.sweet.home:8090";
     KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG";
-    EXTRA_FILESYSTEMS = "/tank/docker/volumes";
+    EXTRA_FILESYSTEMS = "${vars.storageRoot}/docker/volumes";
     LOG_LEVEL = "debug";
   };
   services.beszel.agent.environmentFile = config.sops.templates."server-beszel.env".path;

modules/beszel/enable-agent.nix

@@ -1,9 +1,9 @@
-{ ... }:
+{ vars, ... }:
 
 {
   services.beszel.agent.enable = true;
   services.beszel.agent.environment = {
     #DOCKER_HOST = "tcp://docker-socket-proxy:2375";
-HUB_URL = "http://docker.sweet.home:8090";
+    HUB_URL = "http://docker.${vars.homeDomain}:8090";
   };
 }

modules/build-types/pxe-boot.nix

@@ -1,10 +1,10 @@
-{ config, lib, pkgs, inputs, ... }:
+{ config, lib, pkgs, inputs, vars, ... }:
 
 let
   pxeRoot = "/srv/pxe";
   httpRoot = "${pxeRoot}/http";
   tftpRoot = "${pxeRoot}/tftp";
-  pxeBaseUrl = "http://192.168.2.247";
+  pxeBaseUrl = "http://${vars.pxeServerIp}";
 
   bootIpxe = pkgs.writeText "boot.ipxe" ''
     #!ipxe

modules/build-types/server.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ vars, lib, ... }:
 
 {
   imports = [
@@ -6,7 +6,7 @@
     ../services/zfs/enable-service.nix
   ];
 
-  boot.zfs.extraPools = [ "tank" ];
+  boot.zfs.extraPools = [ (lib.removePrefix "/" vars.storageRoot) ];
 
   systemd.services.nfs-server = {
     after = [ "zfs-mount.service" ];
@@ -16,11 +16,11 @@
   services.nfs.server = {
     enable = true;
     exports = ''
-      /tank/docker/config 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
-      /tank/docker/volumes 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
-      /tank/docker/databases 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
-      /tank/docker/nextcloud-data 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
-      /tank/raspi/volumes 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
+      ${vars.storageRoot}/docker/config ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
+      ${vars.storageRoot}/docker/volumes ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
+      ${vars.storageRoot}/docker/databases ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
+      ${vars.storageRoot}/docker/nextcloud-data ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
+      ${vars.storageRoot}/raspi/volumes ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
     '';
   };
 

modules/common/aliases.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, vars, ... }:
 
 let
   # Flake attribute names are now <platform>-<buildtype> (e.g. proxmox-docker)
@@ -9,13 +9,13 @@ let
     sudo nixos-rebuild switch \
       --no-write-lock-file \
       --refresh \
-      --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(cat /etc/flake-target)
+      --flake git+https://${vars.lanDomain}/beatzaplenty/nixos.git#$(cat /etc/flake-target)
   '';
   myTestCmd = ''
     sudo nixos-rebuild test \
       --no-write-lock-file \
       --refresh \
-      --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(cat /etc/flake-target)
+      --flake git+https://${vars.lanDomain}/beatzaplenty/nixos.git#$(cat /etc/flake-target)
   '';
 in
 {

modules/common/configuration.nix

@@ -1,8 +1,9 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, vars, ... }:
 
 {
   imports =
-    [ # Include the results of the hardware scan.
+    [
+      # Include the results of the hardware scan.
       #      ./hardware-configuration.nix
       ../set-locale.nix
     ];
@@ -13,7 +14,7 @@
   networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
 
   # Set your time zone.
-  time.timeZone = "Australia/Brisbane";
+  time.timeZone = vars.timeZone;
 
   # Enable QEMU agent
   services.qemuGuest.enable = true;
@@ -53,7 +54,7 @@ users.users.root = {
   };
 
   # Define a user account. Don't forget to set a password with ‘passwd’.
-  users.users.nixos = {
+  users.users.${vars.primaryUser} = {
     isNormalUser = true;
     extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
     packages = with pkgs; [

modules/common/home.nix

@@ -1,16 +1,17 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, vars, ... }:
 
 let
   remote = "root@proxmox-ip:/var/lib/vz/template/iso";
   localMount = "${config.home.homeDirectory}/proxmox-iso";
-in {
+in
+{
 
   imports = [
     ./aliases.nix
   ];
 
-  home.username = "nixos";         # your actual username
-  home.homeDirectory = "/home/nixos";
+  home.username = vars.primaryUser;
+  home.homeDirectory = "/home/${vars.primaryUser}";
   home.stateVersion = "25.11"; # match your NixOS stateVersion
 
   programs.home-manager.enable = true; # mandatory to activate HM

modules/docker/mount-data.nix

@@ -1,8 +1,8 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, vars, ... }:
 
 {
   fileSystems."/mnt/docker/config" = {
-    device = "server:/tank/docker/config";
+    device = "${vars.nfsServerHost}:${vars.storageRoot}/docker/config";
     fsType = "nfs";
 
     options = [
@@ -14,7 +14,7 @@
   };
 
   fileSystems."/mnt/docker/databases" = {
-    device = "server:/tank/docker/databases";
+    device = "${vars.nfsServerHost}:${vars.storageRoot}/docker/databases";
     fsType = "nfs";
 
     options = [
@@ -26,7 +26,7 @@
   };
 
   fileSystems."/mnt/docker/volumes" = {
-    device = "server:/tank/docker/volumes";
+    device = "${vars.nfsServerHost}:${vars.storageRoot}/docker/volumes";
     fsType = "nfs";
 
     options = [
@@ -38,7 +38,7 @@
   };
 
   fileSystems."/mnt/nextcloud-data" = {
-    device = "server:/tank/docker/nextcloud-data";
+    device = "${vars.nfsServerHost}:${vars.storageRoot}/docker/nextcloud-data";
     fsType = "nfs";
 
     options = [
@@ -50,7 +50,7 @@
   };
 
   fileSystems."/mnt/raspi-backup" = {
-    device = "server:/tank/raspi/volumes";
+    device = "${vars.nfsServerHost}:${vars.storageRoot}/raspi/volumes";
     fsType = "nfs";
 
     options = [

modules/nix-cache/client.nix

@@ -1,9 +1,9 @@
-{ ... }:
+{ vars, ... }:
 
 {
   nix.settings = {
     substituters = [
-      "http://nix-cache"
+      "http://${vars.nixCacheHost}"
       "https://cache.nixos.org/"
     ];
     trusted-public-keys = [

modules/nix-cache/server.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ config, pkgs, vars, ... }:
 
 {
   # Generate the binary cache key pair on the nix-cache host:
@@ -17,7 +17,7 @@
   services.nginx = {
     enable = true;
     recommendedProxySettings = true;
-    virtualHosts."nix-cache" = {
+    virtualHosts.${vars.nixCacheHost} = {
       locations."/" = {
         proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
       };
@@ -26,11 +26,11 @@
 
   networking.firewall.allowedTCPPorts = [ 80 ];
 
-  users.groups.nixremote = {};
+  users.groups.${vars.remoteBuilderUser} = { };
 
-  users.users.nixremote = {
+  users.users.${vars.remoteBuilderUser} = {
     isSystemUser = true;
-    group = "nixremote";
+    group = vars.remoteBuilderUser;
     createHome = true;
     home = "/var/lib/nixremote";
     shell = pkgs.bashInteractive;
@@ -38,17 +38,19 @@
     # openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAA... client@host" ];
     #
     # Avoid absolute keyFiles paths here because they break pure flake evaluation.
-    openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFDEA1S2ikpObREgbP5uVBWMxIOGbY8B+Wx7VTZK1m6t root@server"
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFDEA1S2ikpObREgbP5uVBWMxIOGbY8B+Wx7VTZK1m6t root@server"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPAYIT9ormlmxZ0SziyDQaUntnKI8HK9/s3Qac1ZKjP2 root@docker"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKKzoEPl/ZW9KBRHBcp6/ThOngGpwMv5EhkTlgC4aDf root@nixos"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIGtOWOCS+ImHc7NehguoyD7PbonGosKMZqc9+QR3v/h root@nixos"
-					"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxXTQxFnArK5HXG7czeoybZebCGfxpUdusJkPn+BCSp root@server"];
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxXTQxFnArK5HXG7czeoybZebCGfxpUdusJkPn+BCSp root@server"
+    ];
   };
 
   services.openssh.enable = true;
 
   nix.settings = {
-    trusted-users = [ "root" "nixremote" ];
+    trusted-users = [ "root" vars.remoteBuilderUser ];
     experimental-features = [ "nix-command" "flakes" ];
     auto-optimise-store = true;
     builders-use-substitutes = true;

modules/raspi/mount-data.nix

@@ -1,8 +1,8 @@
-{ ... }:
+{ vars, ... }:
 
 {
   fileSystems."/mnt/raspi" = {
-  device = "raspberrypi.tail13f623.ts.net:/home/raspi/raspi";
+    device = "raspberrypi.${vars.tailnetDomain}:/home/raspi/raspi";
     fsType = "nfs4";
     options = [
       "nofail"

modules/remote-builder-client.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, vars, ... }:
 
 {
   # Install the remote builder key on each client host (do not commit private keys):
@@ -9,9 +9,9 @@
 
   nix.buildMachines = [
     {
-      hostName = "nix-cache";
-      sshUser = "nixremote";
-      sshKey = "/root/.ssh/nixremote";
+      hostName = vars.nixCacheHost;
+      sshUser = vars.remoteBuilderUser;
+      sshKey = "/root/.ssh/${vars.remoteBuilderUser}";
       system = pkgs.stdenv.hostPlatform.system;
       maxJobs = 4;
       speedFactor = 2;

modules/services/docker-health-to-gotify.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, vars, ... }:
 
 {
   systemd.services.docker-health-to-gotify = {
@@ -9,7 +9,7 @@
       # Run as root so it can read /etc/secrets and access docker socket
       # User = "root";
       #EnvironmentFile = "-/etc/secrets/docker-health-alert.env";
-      ExecStart = "${pkgs.bash}/bin/bash /home/nixos/docker/monitoring/gotify/docker-health-to-gotify.sh";
+      ExecStart = "${pkgs.bash}/bin/bash /home/${vars.primaryUser}/docker/monitoring/gotify/docker-health-to-gotify.sh";
       StandardOutput = "journal";
       StandardError = "journal";
     };

modules/services/nextcloud-cron-job.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, vars, ... }:
 
 {
   # Create nextcloud cron scheduled task
@@ -7,7 +7,7 @@ systemd.services.nextcloud = {
     script = ''${pkgs.bash}/bin/bash ~/docker/services-up.sh --profile nextcloud exec -u 33 nextcloud-webapp php ./cron.php'';
     serviceConfig = {
       Type = "oneshot";
-    User = "nixos";
+      User = vars.primaryUser;
     };
     path = with pkgs; [ docker docker-compose ];
   };

modules/tailscale/exit-node.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ vars, ... }:
 
 {
   services.tailscale = {
@@ -6,7 +6,7 @@
 
     extraUpFlags = [
       "--advertise-exit-node"
-      "--advertise-routes=192.168.2.0/24"
+      "--advertise-routes=${vars.lanCidr}"
     ];
   };
 }

variables.nix

@@ -0,0 +1,21 @@
+{
+  # Network / domains
+  lanDomain = "gitea.lan.ddnsgeek.com"; # Gitea/DDNS domain
+  homeDomain = "sweet.home"; # base LAN domain for service subdomains (pve., docker.)
+  tailnetDomain = "tail13f623.ts.net"; # Tailscale MagicDNS suffix
+  lanCidr = "192.168.2.0/24"; # LAN subnet
+  pxeServerIp = "192.168.2.247"; # pxe-boot host's LAN IP
+  pbsIp = "192.168.2.108"; # Proxmox Backup Server LAN IP
+
+  # Cross-host references (LAN hostnames/users other hosts reach over the network)
+  nixCacheHost = "nix-cache"; # substituter/remote-builder hostname
+  nfsServerHost = "server"; # NFS export source hostname
+  remoteBuilderUser = "nixremote"; # remote builder SSH user
+
+  # System
+  timeZone = "Australia/Brisbane";
+  primaryUser = "nixos"; # main interactive user on every host
+
+  # Storage
+  storageRoot = "/tank"; # ZFS pool root on `server`
+}