A NixOS template for
your AI agent host.

tentaflake is an open-source NixOS flake template. Your entire agent host — packages, users, firewall, secrets, and every agent — is declared as code and deployed with a single nixos-rebuild switch. Change a line, rebuild, and the system updates atomically — or roll back just as fast.

Composable modules

Each module configures one slice of the host — boot, locale, networking (nftables), hardening (AppArmor, sysctl), Tailscale, Nix settings, users, packages, local Piper TTS, a filesystem audit daemon, an operator shell, and an optional Neovim editor. Import modules/default.nix to get them all, then override only what you need.

One builder per runtime

Define agents with the runtime builders: mkHermesAgent for local assistant tentacles and mkZeroClawAgent for autonomous gateway agents. Each builder turns a small attrset — a name, a secrets file, some settings — into a fully isolated agent: its own Linux user, state directory, container, and encrypted environment.

{
  inputs.tentaflake.url = "github:timfewi/tentaflake";

  nixosConfigurations.my-host = nixpkgs.lib.nixosSystem {
    modules = [
      tentaflake.nixosModules.default
      { tentaflake.hostName = "my-host"; }
    ];
  };
}

Secrets stay encrypted in the repo

Per-agent secrets are encrypted in-repo with agenix (age) and decrypted only at runtime into /run/agenix — never written to the Nix store, never committed in plaintext. Reach your agents over the tailnet with Tailscale SSH, exposed to nothing else.