Robotnix

https://docs.robotnix.org/
Admin
Robotnix is a build system for Android (AOSP) images on top of the Nix package manager, simplifying...
Tokens:19,114
Snippets:289
Trust Score:5
Update:3 months ago
Show doc for...
Tokens:
Raw
### Configure productName

Source: https://docs.robotnix.org/print.html

Example of setting the product name for lunch.

```json
{"_type":"literalExpression","text":"\"aosp_crosshatch\""}
```

--------------------------------

### Configure webview providers

Source: https://docs.robotnix.org/options.html

Example configuration for enabling a specific webview provider.

```nix
{
  bromite = {
    enable = true;
  };
}
```

--------------------------------

### Enable adevtool module

Source: https://docs.robotnix.org/options.html

Example configuration to enable the adevtool module.

```json
{"_type":"literalExpression","text":"true"}
```

--------------------------------

### Manually start restore activity

Source: https://docs.robotnix.org/modules/seedvault.html

Execute this command to trigger the restore activity manually, particularly useful for the vanilla flavor which lacks SetupWizard integration.

```bash
adb shell am start-activity -a com.stevesoltys.seedvault.RESTORE_BACKUP
```

--------------------------------

### Define a robotnix configuration file

Source: https://docs.robotnix.org/configuration.html

Example of a structured configuration file for complex builds, including signing and module enablement.

```nix
{
  # Most uses of robotnix should at least set the device and flavor options.
  device = "crosshatch";
  flavor = "vanilla";

  # variant = "user"; # Other options are userdebug, or eng. Builds used in production should use "user"

  # Signing should be enabled for builds used in production.
  signing.enable = true;
  # When signing is enabled, keyStorePath should refer to a path containing keys created by `genereteKeysScript`
  # This is used to automatically obtain key fingerprints / metadata from the generated public keys.
  # Alternatively, it may be possible to manually set the required options like `signing.avb.fingerprint` or `apps.prebuilt.<name>.fingerprint` to avoid including this path.
  signing.keyStorePath = "/var/secrets/android-keys";

  # Additional modules can be enabled and included in the build. See individual module documentation
  apps.fdroid.enable = true;
  microg.enable = true;
}
```

--------------------------------

### Example F-Droid Repository Index XML

Source: https://docs.robotnix.org/modules/f-droid.html

The index.xml file contains repository metadata, including the public key required for preloading the repository.

```xml
<?xml version="1.0" encoding="utf-8"?>
<fdroid>
    <repo name="microG F-Droid repo" icon="fdroid-icon.png" url="https://microg.org/fdroid/repo" version="19" timestamp="1606314565" pubkey="308202ed308201d5a003020102020426ffa009300d06092a864886f70d01010b05003027310b300906035504061302444531183016060355040a130f4e4f47415050532050726f6a656374301e170d3132313030363132303533325a170d3337303933303132303533325a3027310b300906035504061302444531183016060355040a130f4e4f47415050532050726f6a65637430820122300d06092a864886f70d01010105000382010f003082010a02820101009a8d2a5336b0eaaad89ce447828c7753b157459b79e3215dc962ca48f58c2cd7650df67d2dd7bda0880c682791f32b35c504e43e77b43c3e4e541f86e35a8293a54fb46e6b16af54d3a4eda458f1a7c8bc1b7479861ca7043337180e40079d9cdccb7e051ada9b6c88c9ec635541e2ebf0842521c3024c826f6fd6db6fd117c74e859d5af4db04448965ab5469b71ce719939a06ef30580f50febf96c474a7d265bb63f86a822ff7b643de6b76e966a18553c2858416cf3309dd24278374bdd82b4404ef6f7f122cec93859351fc6e5ea947e3ceb9d67374fe970e593e5cd05c905e1d24f5a5484f4aadef766e498adf64f7cf04bddd602ae8137b6eea40722d0203010001a321301f301d0603551d0e04160414110b7aa9ebc840b20399f69a431f4dba6ac42a64300d06092a864886f70d01010b0500038201010007c32ad893349cf86952fb5a49cfdc9b13f5e3c800aece77b2e7e0e9c83e34052f140f357ec7e6f4b432dc1ed542218a14835acd2df2deea7efd3fd5e8f1c34e1fb39ec6a427c6e6f4178b609b369040ac1f8844b789f3694dc640de06e44b247afed11637173f36f5886170fafd74954049858c6096308fc93c1bc4dd5685fa7a1f982a422f2a3b36baa8c9500474cf2af91c39cbec1bc898d10194d368aa5e91f1137ec115087c31962d8f76cd120d28c249cf76f4c70f5baa08c70a7234ce4123be080cee789477401965cfe537b924ef36747e8caca62dfefdd1a6288dcb1c4fd2aaa6131a7ad254e9742022cfd597d2ca5c660ce9e41ff537e5a4041e37">
        <description>This is a repository of microG apps to be used with F-Droid. Applications in this repository are signed official binaries built by the microG Team from the corresponding source code. </description>
    </repo>
    <application id="...">
        <!-- ... list of contained applications ... -->
    </application>
</fdroid>
```

--------------------------------

### Run minimal build testing

Source: https://docs.robotnix.org/development.html

Execute the minimal build checks defined in release.nix to ensure the Android build process starts correctly.

```bash
nix-build ./release.nix -A check
```

--------------------------------

### Configure Nginx for OTA Updates

Source: https://docs.robotnix.org/modules/ota.html

Example NixOS server configuration to serve the OTA directory via Nginx.

```nix
# NixOS server configuration
{
  services.nginx.enable = true;
  systemd.services.nginx.serviceConfig.ReadOnlyPaths = [ "/var/www" ];
  services.nginx.virtualHosts."example.com" = {
    forceSSL = true;
    enableACME = true;
    locations."/android/" = {
      root = "/var/www";
      tryFiles = "$uri $uri/ =404";
    };
  };
}
```

--------------------------------

### Configure Auditor domain

Source: https://docs.robotnix.org/options.html

Example configuration for setting the Auditor domain.

```json
{"_type":"literalExpression","text":"\"attestation.example.com\""}
```

--------------------------------

### Flash factory image

Source: https://docs.robotnix.org/installation.html

Executes the provided flash script to install the Robotnix factory image.

```bash
$ ./flash-all.sh
```

--------------------------------

### Enable MicroG in Robotnix

Source: https://docs.robotnix.org/modules/microg.html

Add this configuration to your Robotnix setup to enable MicroG support.

```nix
{
  microg.enable = true;
}
```

--------------------------------

### Set backup transport via ADB

Source: https://docs.robotnix.org/modules/seedvault.html

Use these commands to manually configure the backup transport if Seedvault was added to an existing installation without wiping userdata.

```bash
$ adb shell bmgr enable true
$ adb shell bmgr transport com.stevesoltys.seedvault.transport.ConfigurableBackupTransport
```

--------------------------------

### Build using a configuration file

Source: https://docs.robotnix.org/configuration.html

Builds an image by passing a path to a .nix configuration file.

```bash
$ nix-build --arg configuration ./crosshatch.nix -A img
```

--------------------------------

### Build a vanilla image via command line

Source: https://docs.robotnix.org/configuration.html

Builds a vanilla image for the crosshatch device using inline Nix configuration.

```bash
$ nix-build --arg configuration '{ device="crosshatch"; flavor="vanilla"; }' -A img
```

--------------------------------

### Running PKCS#11 signing script

Source: https://docs.robotnix.org/signing.html

Execute the release script with a PIN file for hardware token authentication.

```bash
$ nix build .#robotnixConfigurations.foo.releaseScript --out-link release-script
$ tree my-keys/
my-keys
└── tegu
    ├── avb_pkmd.bin
    ├── avb.pub
    ├── avb.x509.pem
    ├── bluetooth.x509.pem
    ├── gmscompat_lib.x509.pem
    ├── media.x509.pem
    ├── networkstack.x509.pem
    ├── nfc.x509.pem
    ├── platform.x509.pem
    ├── releasekey.x509.pem
    ├── sdk_sandbox.x509.pem
    └── shared.x509.pem
$ PIN_FILE=$(mktemp)
$ echo -n "123456" > $PIN_FILE
$ ./release-script my-keys/ "2026021200" "$PIN_FILE"
```

--------------------------------

### Build Android image via command line

Source: https://docs.robotnix.org/print.html

Builds a vanilla image for the crosshatch device using nix-build with inline configuration.

```bash
$ nix-build --arg configuration '{ device="crosshatch"; flavor="vanilla"; }' -A img
```

```bash
$ nix-build $HOME/src/robotnix --arg configuration '{ device="crosshatch"; flavor="vanilla"; }' -A img
```

--------------------------------

### Initialize and build with Nix flakes

Source: https://docs.robotnix.org/configuration.html

Commands to initialize a project using the robotnix flake template and build the configuration.

```bash
$ mkdir flake-test
$ cd flake-test
$ nix flake init -t github:danielfullmer/robotnix
$ # Edit flake.nix in current directory
$ nix build .#robotnixConfigurations.dailydriver.img
```

--------------------------------

### Enable F-Droid and Privileged Extension

Source: https://docs.robotnix.org/modules/f-droid.html

Add this configuration to your Robotnix build to enable the F-Droid app and the privileged extension for background installations.

```nix
{
    apps.fdroid.enable = true;
}
```

--------------------------------

### Set up CCache for build acceleration

Source: https://docs.robotnix.org/modules/other.html

Run these commands as root to prepare the directory for CCache usage in the Android build process.

```bash
# mkdir -p -m0770 /var/cache/ccache
# chown root:nixbld /var/cache/ccache
# echo max_size = 100G > /var/cache/ccache/ccache.conf
```

--------------------------------

### Importing modules with modulesPath

Source: https://docs.robotnix.org/options.html

Demonstrates how to use the modulesPath argument to import additional modules from the nixpkgs tree.

```nix
{
  modulesPath, ...
}: {
  imports = [
    (modulesPath + "/profiles/minimal.nix")
  ];
}
```

--------------------------------

### Deploy OTA Directory to Web Server

Source: https://docs.robotnix.org/modules/ota.html

Copy the generated OTA directory to the web server directory.

```bash
$ cp --no-dereference ota-dir /var/www/android
```

--------------------------------

### Include a custom repository

Source: https://docs.robotnix.org/modules/source.html

Use source.dirs.<name>.src to define a new repository source using a Nix derivation.

```nix
{
  source.dirs."foo/bar".src = pkgs.fetchGit {
    url = "https://example.com/repo/foobar.git";
    rev = "f506faf86b8f01f9c09aae877e00ad0a2b4bc511";
    sha256 = "0000000000000000000000000000000000000000000000000000000000000000";
  };
}
```

--------------------------------

### Configure webview.<name>.enable

Source: https://docs.robotnix.org/print.html

Enables or disables a specific webview provider.

```nix
{   _type = "literalExpression";   text = "false"; }
```

```nix
{"_type":"literalExpression","text":"true"}
```

--------------------------------

### Build and run the Android emulator

Source: https://docs.robotnix.org/development.html

Use the emulator Nix output to build and execute an Android emulator with a vanilla system image. This command is currently optimized for the generic x86_64 device.

```bash
$ nix-build ./default.nix --arg configuration '{device="x86_64"; flavor="vanilla";}' -A emulator
$ ./result
```

--------------------------------

### Build a vanilla image from a specific directory

Source: https://docs.robotnix.org/configuration.html

Executes a build using a robotnix checkout located in a specific path.

```bash
$ nix-build $HOME/src/robotnix --arg configuration '{ device="crosshatch"; flavor="vanilla"; }' -A img
```

--------------------------------

### Build an Android component with nix-build

Source: https://docs.robotnix.org/development.html

Use this command to build a specific component, such as adb, defined in components.nix.

```bash
$ nix-build ./components.nix -A adb
```

--------------------------------

### Build and sign release using a script

Source: https://docs.robotnix.org/building.html

Builds a release script that performs signing outside the Nix sandbox.

```bash
$ nix-build --arg configuration ./crosshatch.nix -A releaseScript -o release
$ ./release ./keys
```

--------------------------------

### Configure source directory enable default

Source: https://docs.robotnix.org/options.html

Default value for enabling a source directory.

```nix
{   _type = "literalExpression";   text = "true"; }
```

--------------------------------

### Import Keys to YubiKey

Source: https://docs.robotnix.org/signing.html

Build and execute the script to import pre-existing keys into a YubiKey, useful for provisioning backups.

```bash
$ nix build .#robotnixConfigurations.foo.yubikeyImportKeysScript --out-link yubikey-import-keys-script
$ ./yubikey-import-keys-script my-keys/
```

--------------------------------

### Configure source directories default

Source: https://docs.robotnix.org/options.html

Default value for source directories.

```nix
{   _type = "literalExpression";   text = "{ }"; }
```

--------------------------------

### Configure source manifest enable default

Source: https://docs.robotnix.org/options.html

Default value for enabling manifest import.

```nix
{   _type = "literalExpression";   text = "false"; }
```

--------------------------------

### Configure webview.<name>.packageName

Source: https://docs.robotnix.org/print.html

Sets the Android package name for the webview APK.

```nix
{   _type = "literalExpression";   text = "\"com.android.webview\""; }
```

--------------------------------

### Build a Robotnix image

Source: https://docs.robotnix.org/building.html

Builds an image zip from a specified configuration file using nix-build.

```bash
$ nix-build --arg configuration ./config.nix -A img
```

--------------------------------

### Enable YubiKey PIV PKCS#11 Preset

Source: https://docs.robotnix.org/signing.html

Configure the signing module to use the YubiKey PIV preset in your Nix configuration.

```nix
{
    signing.pkcs11 = {
        enable = true;
        presets.yubikey-piv.enable = true;
    };
}
```

--------------------------------

### Configure webview.<name>.description

Source: https://docs.robotnix.org/print.html

Sets the display name for the webview provider in developer settings.

```nix
{   _type = "literalExpression";   text = "\"Android System WebView\""; }
```

--------------------------------

### Signing with local release keys

Source: https://docs.robotnix.org/signing.html

Execute the releaseScript to sign build artifacts using a directory of local release keys.

```bash
$ nix build .#robotnixConfigurations.foo.releaseScript --out-link release-script
$ ./release-script my-keys/
$ ll tegu-*
-rw-r--r-- 1 c5h10 users 1741206178 Mar 22 20:02 tegu-factory-2026032000.zip
-rw-r--r-- 1 c5h10 users 1688149504 Mar 22 20:01 tegu-img-2026032000.zip
-rw-r--r-- 1 c5h10 users 1310723050 Mar 22 20:01 tegu-ota_update-2026032000.zip
-rw------- 1 c5h10 users 3369654024 Mar 22 19:58 tegu-signed_target_files-2026032000.zip
```

--------------------------------

### Configure Prebuilt Application Package Name

Source: https://docs.robotnix.org/print.html

Sets the Java-style package name for a prebuilt application, required when using privileged permissions.

```nix
{"_type":"literalExpression","text":"\"com.android.test\""}
```

--------------------------------

### Configure a prebuilt application in Robotnix

Source: https://docs.robotnix.org/modules/prebuilt.html

Defines a prebuilt application using a URL source, enabling privileged permissions and specifying the package name.

```nix
{
  pkgs, ...
}:
{
  apps.prebuilt.ExampleApp = {
    apk = (pkgs.fetchurl {
      url = "https://example.com/test.apk";
      sha256 = "0000000000000000000000000000000000000000000000000000000000000000";
    });
    privileged = true;  # Enable if the application needs access to privileged permissions
    privappPermissions = [ "INSTALL_PACKAGES "];
    packageName = "com.example.test";  # Needs to be set if using privappPermissions
  };
}
```

--------------------------------

### Build and sign release inside Nix

Source: https://docs.robotnix.org/building.html

Builds final products entirely within the Nix sandbox, requiring sandbox exceptions for key access.

```bash
$ nix-build ./default.nix --arg configuration ./crosshatch.nix -A img --option extra-sandbox-paths /keys=$(pwd)/keys
```

--------------------------------

### View OTA Directory Structure

Source: https://docs.robotnix.org/modules/ota.html

Inspect the generated OTA directory structure using the tree command.

```bash
$ tree -l ota-dir
├── sunfish-ota_update-2021.02.06.16.zip -> /nix/store/wwr49all6x868f0mdl11369ybfwyir0f-sunfish-ota_update-2021.02.06.16.zip
├── sunfish-stable -> /nix/store/c1rp46m9spncanacglqs5mxk6znfs44s-sunfish-stable
└── sunfish-target_files-2021.02.06.16.zip -> /nix/store/8ys21rzjqhi2055d7bd4iwa15fv1m446-sunfish-signed_target_files-2021.02.06.16.zip
```

```bash
$ tree -l /var/www
/var/www
└── android -> /nix/store/dbjcl9lwn6xif9c0fy8d2wwpn9zi4hw4-sunfish-otaDir
    ├── sunfish-ota_update-2021.02.06.16.zip -> /nix/store/wwr49all6x868f0mdl11369ybfwyir0f-sunfish-ota_update-2021.02.06.16.zip
    ├── sunfish-stable -> /nix/store/c1rp46m9spncanacglqs5mxk6znfs44s-sunfish-stable
    └── sunfish-target_files-2021.02.06.16.zip -> /nix/store/8ys21rzjqhi2055d7bd4iwa15fv1m446-sunfish-signed_target_files-2021.02.06.16.zip
```

--------------------------------

### Configure Attestation Server in NixOS

Source: https://docs.robotnix.org/modules/attestation.html

Import the Robotnix module and configure the attestation server with the previously obtained fingerprints.

```nix
{ config, lib, pkgs, ... }:
{
  imports = [
    ((builtins.fetchTarball {
      name = "robotnix";
      # Replace the git revision and sha256 with ones referring to a recent commit
      url =
        "https://github.com/danielfullmer/robotnix/archive/61b91d145f0b08cf0d4d73fb1d7ba74b9899b788.zip";
      sha256 = "1dihmdw5w891jq2fm7mcx30ydjjd33ggbb60898841x5pzjx6ynv";
    }) + "/nixos")
  ];

  services.attestation-server = {
    enable = true;
    domain = "attestation.example.com";
    device = "sunfish";
    signatureFingerprint = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
    avbFingerprint = "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB";
    #disableAccountCreation = true; # optionally uncomment after creating your account
    #nginx.enableACME = true; # optionally uncomment if you want to use Let's Encrypt for HTTPS
  };
}
```

--------------------------------

### Configure source directory src default

Source: https://docs.robotnix.org/options.html

Default value for source directory path.

```nix
{   _type = "literalExpression";   text = "<derivation empty>"; }
```

--------------------------------

### Configure additional package resources

Source: https://docs.robotnix.org/options.html

Defines custom resource configurations for specific package paths.

```json
{"_type":"literalExpression","text":"{\n  \"frameworks/base/core/res\" = {\n    config_enableAutoPowerModes = true;\n  };\n}"}
```

--------------------------------

### Generate device signing keys

Source: https://docs.robotnix.org/building.html

Generates required device and application keys for signed builds.

```bash
$ nix-build --arg configuration ./crosshatch.nix -A generateKeysScript -o generate-keys
$ ./generate-keys ./keys
```

--------------------------------

### Configure ROBOTNIX_GIT_MIRRORS environment variable

Source: https://docs.robotnix.org/development.html

Set the ROBOTNIX_GIT_MIRRORS environment variable to map remote Android source URLs to local mirror paths.

```bash
ROBOTNIX_GIT_MIRRORS=https://android.googlesource.com=/mnt/cache/mirror|https://github.com/LineageOS=/mnt/cache/lineageos/LineageOS
```

--------------------------------

### Reboot to bootloader

Source: https://docs.robotnix.org/installation.html

Returns the device to the bootloader state.

```bash
$ fastboot reboot bootloader
```

--------------------------------

### Include External Nix Module

Source: https://docs.robotnix.org/development.html

Use this configuration to import an external module from a GitHub repository by pinning it with a URL and SHA256 hash.

```nix
{
    imports = [ (builtins.fetchTarball {
        url = "https://github.com/owner/repo/archive/9b034054166e1f01b3bdb6a1948daa3bdafe039a.tar.gz";
        sha256 = "0000000000000000000000000000000000000000000000000000000000000000";
    }) ];
}
```

--------------------------------

### Verify device connection

Source: https://docs.robotnix.org/installation.html

Check that the device is correctly recognized by fastboot.

```bash
$ fastboot devices
09071JEC217048  device
```

--------------------------------

### Copy OTA Directory to Remote Host

Source: https://docs.robotnix.org/modules/ota.html

Use nix copy to transfer the OTA directory to a remote server.

```bash
$ nix copy --to ssh://user@example.com ./ota-dir
```

--------------------------------

### Verify Sideload Connection

Source: https://docs.robotnix.org/installation.html

Command to confirm the device is correctly recognized in sideload mode.

```bash
$ adb devices
List of devices attached
09071JEC217048  sideload
```

--------------------------------

### Configure Privileged App Permissions

Source: https://docs.robotnix.org/options.html

Sets the privileged permissions for a prebuilt application.

```json
{"_type":"literalExpression","text":"[\n  \"INSTALL_PACKAGES\"\n]"}
```

--------------------------------

### Configure grapheneos.release

Source: https://docs.robotnix.org/print.html

Sets the GrapheneOS release tag for the build.

```json
{"_type":"literalExpression","text":"\"2025073000\""}
```

--------------------------------

### Patching source directories

Source: https://docs.robotnix.org/modules/source.html

Apply patches or execute shell commands post-patching using the patches and postPatch attributes.

```nix
{
  # source.dirs.<name>.patches can refer to a list of patches to apply
  source.dirs."frameworks/base".patches = [ ./example.patch ];

  # source.dirs.<name>.postPatch can refer to a snippet of shell script to modify the source tree
  source.dirs."frameworks/base".postPatch = ''
    sed -i 's/hello/there/' example.txt
  '';
}
```

--------------------------------

### Enable webview provider

Source: https://docs.robotnix.org/options.html

Boolean flag to enable or disable a specific webview provider.

```nix
true
```

--------------------------------

### Enable Seedvault in Nix configuration

Source: https://docs.robotnix.org/modules/seedvault.html

Add this snippet to your Robotnix configuration to enable the Seedvault backup application.

```nix
{
  apps.seedvault.enable = true;
}
```

--------------------------------

### Configure Device for OTA Updates

Source: https://docs.robotnix.org/print.html

Set the updater URL in the device configuration to point to the web server hosting OTA files.

```nix
# Device configuration
{
  apps = {
    updater.enable = true;
    updater.url = "https://example.com/android/";
  };
}
```

--------------------------------

### Generate YubiKey Signing Keys

Source: https://docs.robotnix.org/signing.html

Build and execute the script to generate signing keys on the YubiKey and export public keys to the specified directory.

```bash
$ nix build .#robotnixConfigurations.foo.yubikeyGenerateKeysScript --out-link yubikey-generate-keys-script
$ ./yubikey-generate-keys-script my-keys/
```

--------------------------------

### Configure source directory relpath default

Source: https://docs.robotnix.org/options.html

Default value for relative path placement.

```nix
{   _type = "literalExpression";   text = "\"‹name›\""; }
```

--------------------------------

### Generate Release Keys with Robotnix

Source: https://docs.robotnix.org/signing.html

Use the generateKeysScript build target to create a set of release keys for signing build components.

```bash
$ nix build .#robotnixConfigurations.foo.generateKeysScript --out-link generate-keys-script
$ ./generate-keys-script my-keys/
$ tree my-keys/
my-keys
└── tegu
    ├── avb.pem
    ├── avb_pkmd.bin
    ├── avb.pub
    ├── avb.x509.pem
    ├── bluetooth.pk8
    ├── bluetooth.x509.pem
    ├── gmscompat_lib.pk8
    ├── gmscompat_lib.x509.pem
    ├── media.pk8
    ├── media.x509.pem
    ├── networkstack.pk8
    ├── networkstack.x509.pem
    ├── nfc.pk8
    ├── nfc.x509.pem
    ├── platform.pk8
    ├── platform.x509.pem
    ├── releasekey.pk8
    ├── releasekey.x509.pem
    ├── sdk_sandbox.pk8
    ├── sdk_sandbox.x509.pem
    ├── shared.pk8
    └── shared.x509.pem
```

--------------------------------

### Configure source directory copyfiles default

Source: https://docs.robotnix.org/options.html

Default value for files to copy from source directories.

```nix
{   _type = "literalExpression";   text = "[ ]"; }
```

--------------------------------

### Configuring PKCS#11 signing

Source: https://docs.robotnix.org/signing.html

Define the PKCS#11 module and map key/certificate labels in the Robotnix configuration.

```nix
{ pkgs, ... }:
{
    signing.pkcs11 = {
        enable = true;
        module = "${pkgs.yubico-piv-tool}/bin/libykcs11.so";
        privateKeyLabels = {
            "${config.device}/releasekey" = "Private key for Retired Key 1";
            "${config.device}/media" = "Private key for Retired Key 2";
            "${config.device}/shared" = "Private key for Retired Key 3";
            "${config.device}/platform" = "Private key for Retired Key 4";
            [...]
        };
        certificateLabels = {
            "${config.device}/releasekey" = "X.509 Certificate for Retired Key 1";
            "${config.device}/media" = "X.509 Certificate for Retired Key 2";
            "${config.device}/shared" = "X.509 Certificate for Retired Key 3";
            "${config.device}/platform" = "X.509 Certificate for Retired Key 4";
            [...]
        };
    };
}
```

--------------------------------

### Set PKCS#11 signing module

Source: https://docs.robotnix.org/options.html

Specifies the path to the PKCS#11 shared library.

```json
{"_type":"literalExpression","text":"\"\\${pkgs.yubico-piv-tool}/lib/libykcs11.so\""}
```

--------------------------------

### Set NixOS configuration for local mirrors

Source: https://docs.robotnix.org/development.html

Use this NixOS configuration to set the environment variable for the Nix daemon and add mirror paths to sandbox exceptions.

```nix
let
  mirrors = {
    "https://android.googlesource.com" = "/mnt/cache/mirror";
    "https://github.com/LineageOS" = "/mnt/cache/lineageos/LineageOS";
  };
in
{
  nix.envVars.ROBOTNIX_GIT_MIRRORS = lib.concatStringsSep "|" (lib.mapAttrsToList (local: remote: "${local}=${remote}") mirrors);

  # Also add local mirrors to nix sandbox exceptions
  nix.sandboxPaths = lib.attrValues mirrors;
}
```

--------------------------------

### Reboot to bootloader via ADB

Source: https://docs.robotnix.org/installation.html

Use this command to enter the bootloader mode from a device with USB debugging enabled.

```bash
$ adb reboot bootloader
```

--------------------------------

### Configure Chromium browser and webview in Robotnix

Source: https://docs.robotnix.org/modules/browsers.html

Use these settings to enable the Chromium browser and configure its behavior as a system webview provider. Similar configurations apply to Vanadium and Bromite.

```nix
{
  apps.chromium.enable = true;
  webview.chromium.enable = true;
  webview.chromium.availableByDefault = true; # At least one webview must be availableByDefault
  webview.chromium.isFallback = true; # If true, this provider will be disabled and only used if no others are available. At most one webview can be isFallback.
}
```

--------------------------------

### Configure stateVersion default

Source: https://docs.robotnix.org/options.html

Default value for the system state version.

```nix
{   _type = "literalExpression";   text = "\"3\""; }
```

--------------------------------

### Configure build variant default

Source: https://docs.robotnix.org/options.html

Default value for the build variant.

```nix
{   _type = "literalExpression";   text = "\"user\""; }
```

--------------------------------

### Configure source directory postPatch default

Source: https://docs.robotnix.org/options.html

Default value for postPatch commands.

```nix
{   _type = "literalExpression";   text = "\"\""; }
```

--------------------------------

### Build Robotnix using flakes

Source: https://docs.robotnix.org/building.html

Produces Robotnix outputs when the configuration is defined within a flake.

```bash
$ nix build .#robotnixConfigurations.dailydriver.img
```

--------------------------------

### Configure source manifest lockfile default

Source: https://docs.robotnix.org/options.html

Default value for the manifest lockfile path.

```nix
{   _type = "literalExpression";   text = "null"; }
```

--------------------------------

### Configure flavor

Source: https://docs.robotnix.org/print.html

Selects the supported Robotnix flavor.

```json
{"_type":"literalExpression","text":"\"vanilla\""}
```

--------------------------------

### Configure YubiKey PIV slot mapping

Source: https://docs.robotnix.org/options.html

Maps specific Robotnix key names to YubiKey PIV slots.

```nix
{
  "'''''${config.device}/releasekey" = "82";
  "'''''${config.device}/media" = "83";
  "'''''${config.device}/shared" = "84";
  "'''''${config.device}/platform" = "85";
  "'''''${config.device}/sdk_sandbox" = "86";
  "'''''${config.device}/nfc" = "87";
  "'''''${config.device}/networkstack" = "88";
  "'''''${config.device}/avb" = "89";
  # grapheneos gmscompat_lib is mapped to 8a
  "'''''${config.device}/bluetooth" = "8b";
}
```

--------------------------------

### Export YubiKey Certificates

Source: https://docs.robotnix.org/signing.html

Build and execute the script to export existing public keys from the YubiKey to the specified directory.

```bash
$ nix build .#robotnixConfigurations.foo.yubikeyExportCertificatesScript --out-link yubikey-export-certificates-script
$ ./yubikey-export-certificates-script my-keys/
```

--------------------------------

### Configure deviceDisplayName

Source: https://docs.robotnix.org/print.html

Sets the display name for the device build target.

```json
{"_type":"literalExpression","text":"\"Pixel XL\""}
```
Tokens:
Raw