# nixfiles

NixOS / nix-darwin / home-manager configuration for all hosts, built from a
single flake.

## Hosts

Defined in the host table in [`flake.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/flake.nix):

| Configuration         | System           | Machine                                                                                                                               |
| --------------------- | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
| `lyrathorpe-mbp`      | `aarch64-linux`  | MacBook Pro (Apple Silicon, Asahi)                                                                                                    |
| `lyrathorpe-t400`     | `x86_64-linux`   | ThinkPad T400 — [install notes](https://docs.lyrapup.pet/nixfiles/hosts/t400/)                                                        |
| `lyrathorpe-macpro31` | `x86_64-linux`   | Mac Pro 3,1, desktop — [install notes](https://docs.lyrapup.pet/nixfiles/hosts/macpro31/)                                             |
| `lyrathorpe-console`  | `x86_64-linux`   | Living-room games machine (Haswell i7 + GTX 1070) on a television — [install notes](https://docs.lyrapup.pet/nixfiles/hosts/console/) |
| `emmathorpe-edaas`    | `x86_64-linux`   | Work WSL box (NixOS-WSL) — [notes](https://docs.lyrapup.pet/nixfiles/hosts/edaas/)                                                    |
| `lyrathorpe-rpi5`     | `aarch64-linux`  | Raspberry Pi 5 headless server: Docker host + nginx reverse proxy — [install notes](https://docs.lyrapup.pet/nixfiles/hosts/rpi5/)    |
| `lyrathorpe-mac`      | `aarch64-darwin` | macOS (nix-darwin) — [notes](https://docs.lyrapup.pet/nixfiles/hosts/darwin/)                                                         |

Shared layers: `home` (home-manager: shell, git, editor),
`modules/common-nixos.nix` (all NixOS hosts: fonts, nix-ld, caches),
`modules/workstation.nix` (physical graphical hosts: audio, thermald,
earlyoom, fwupd), `modules/laptop.nix` (laptops: Wi-Fi, Bluetooth, power,
lid), `modules/desktop.nix` (wired desktops: NetworkManager), and
`modules/ssh.nix` (key-only sshd). The x86 hosts also pull `nixos-hardware`
profiles. The full module catalogue is below.

## Repository layout

```
flake.nix              # inputs, mkHost/mkDarwinHost, the host tables, dev shell + checks
flake.lock             # pinned input revisions (Renovate keeps this fresh)
modules/               # reusable NixOS system modules (see "Module catalogue")
home/                  # home-manager profile: shell, git, editor, claude, secret-service, desktop, sway
docs/                  # all prose documentation; published to docs.lyrapup.pet (see "Documentation")
users/                 # identity registry + per-user home extras (see "Users")
hosts/<Name>/          # per-machine config: configuration.nix + hardware-configuration.nix
lib/                   # small pure helpers (currently the Catppuccin Mocha palette)
.gitea/workflows/      # CI (nix flake check + per-host eval)
statix.toml            # lint config (house-style lints disabled)
.editorconfig          # base whitespace style
tf-inspect/            # UNRELATED scratch project (gitignored, its own git repo);
                       #   RouterOS / home-services Terraform, not part of this flake
```

Each `nixosConfiguration` / `darwinConfiguration` is assembled in `flake.nix`
from three layers: the shared `baseModules` (or `darwinBaseModules`), the
per-form-factor and `nixos-hardware` modules listed in the host table, and the
per-machine `hosts/<Name>/configuration.nix`. Home-manager is wired in as a
system module; each user's home is composed from the `homeModules` list in that
host's table entry.

## Module catalogue

Reusable NixOS modules under [`modules/`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/modules). "Imported by" says how a
module reaches a host: **baseModules** (every NixOS host, via `flake.nix`),
**host table** (listed explicitly per host in `flake.nix`), or **transitively**
(pulled in by another module's `imports`).

| Module             | Imported by                       | What it does / when to use it                                                                                                                                                                                                                                                                                                 |
| ------------------ | --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `common-nixos.nix` | baseModules (all NixOS)           | Timezone/locale, store hygiene (auto-optimise, big download buffer, **no** auto-GC), the nix-community binary cache, `nix-ld`, **sudo-rs** in place of sudo, base CLI (`git`, `fastfetch`), and the fleet-wide font stack.                                                                                                    |
| `users.nix`        | baseModules (all NixOS)           | Builds `users.users` from the registry for the host's `hostUsers`; enables zsh; enables Firefox + Thunderbird **only** when `features.swayDesktop.enable` is on. Applies per-user `linger`.                                                                                                                                   |
| `features.nix`     | baseModules (all NixOS)           | Declares the feature-flag options (`features.swayDesktop.enable`, `features.claudeCode.enable`) so any host can read/set them without importing the heavy implementation module, plus the CPU capability fact they derive from (`features.cpu.microarchLevel`) and the assertion that guards it. See "CPU capability gating". |
| `workstation.nix`  | transitively (via laptop/desktop) | Form-factor-agnostic base for physical graphical hosts: turns on `swayDesktop`, Dvorak console, PipeWire, firewall (default-deny), fstrim, earlyoom, fwupd, thermald (x86), redistributable fw.                                                                                                                               |
| `laptop.nix`       | host table (MBP, T400)            | `imports` workstation.nix, then adds the portable bits: iwd Wi-Fi, lid suspend/lock, Bluetooth + blueman.                                                                                                                                                                                                                     |
| `desktop.nix`      | host table (Mac Pro)              | `imports` workstation.nix, then swaps Wi-Fi for wired NetworkManager. Pair with `portable = false` in the host table.                                                                                                                                                                                                         |
| `sway.nix`         | host table (graphical hosts)      | Implementation of `features.swayDesktop`: the system Sway package, the greetd/ReGreet (cage) greeter forced to Dvorak, xdg-portal, Wayland utility packages. Home-side Sway config is in `home/sway.nix`.                                                                                                                     |
| `ssh.nix`          | host table (T400, Mac Pro, RPi5)  | Enables sshd, opens port 22, enforces a key-only policy (no password / keyboard-interactive, no root). Authorized keys come from the registry via `users.nix`.                                                                                                                                                                |
| `firmware/`        | referenced by MBP host config     | Committed Apple peripheral firmware blobs for the Asahi MBP (see "MacBook (Asahi) firmware").                                                                                                                                                                                                                                 |

Form-factor decision: a **laptop** imports `laptop.nix` (default
`portable = true`); a **wired desktop** imports `desktop.nix` and sets
`portable = false`; a **headless server** imports neither (leaves
`features.swayDesktop.enable` at its default `false`) and adds only what it
serves. `portable` is threaded through to `home/sway.nix`, which drops the
battery block and brightness keys on desktops.

## CPU capability gating

Not every host can run everything the fleet installs. Nix cannot probe the CPU
(evaluation is pure, and a host may be built elsewhere), so each machine
declares what it is and the shared modules derive from that:

- `features.cpu.microarchLevel` — the x86-64 psABI level the CPU implements
  (1 = baseline, 2 = SSE4.2/POPCNT, 3 = AVX2, 4 = AVX-512). Defaults to **2**;
  only a host older than that sets it (the Mac Pro 3,1's 2008 Harpertown Xeons
  are level 1). Ignored on non-x86_64 hosts.
- `features.claudeCode.enable` — derived: on unless the host is below
  x86-64-v2, because Claude Code's Node runtime needs SSE4.2/POPCNT.
  [`home/claude.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/home/claude.nix) reads it through home-manager's
  `osConfig` and installs nothing (CLI, `CLAUDE.md`, output style, memory
  symlink) when it is off. Hosts with no such option — the Darwin host and the
  standalone `homeConfigurations` — fall back to enabled.
- An assertion in `features.nix` fails evaluation if a host force-enables a
  flag its declared CPU level cannot support, so the mistake surfaces in
  `nix flake check`/CI rather than as an illegal-instruction crash on the box.

Adding another CPU-sensitive tool means deriving one more flag there, not
editing every host.

## Users

Identity is data, kept separate from the reusable modules:

- [`users/registry.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/users/registry.nix) — one entry per user (display
  name, email, supplementary groups, authorized + signing keys). This is the
  single source of identity; no user data is hardcoded in the modules.
- Each host's table entry declares a `users` set keyed by username; every entry
  lists that user's home-module composition (the shared `./home` bundle plus any
  per-user modules, e.g. [`users/emmathorpe/work.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/users/emmathorpe/work.nix))
  and optional per-host-user system bits such as `linger`.
- `mkHost` builds each account from the registry and injects the matching
  identity into that user's home config as the `identity` module arg. A host can
  therefore declare any number of users.

Per-user home extras live under `users/<name>/`:

- [`users/lyrathorpe/home.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/users/lyrathorpe/home.nix) — personal extras
  (an ssh host shortcut, gammastep coordinates); imported on Lyra's hosts.
- [`users/emmathorpe/work.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/users/emmathorpe/work.nix) — the work
  toolchain (kubectl/helm/az/etc.), work-only LSP servers, the corporate ssh
  handling, and the headless Secret Service that gcx needs for its keychain
  tokens (see [`home/secret-service.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/home/secret-service.nix)); imports
  [`users/emmathorpe/renovate-review.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/users/emmathorpe/renovate-review.nix),
  the daily headless Renovate-PR review timer (EDaaS only).

### Portable home (off-NixOS / external consumers)

The home config is also exposed for use beyond these hosts:

- `homeConfigurations."<user>@<system>"` — a standalone home-manager profile
  (the portable subset: shell + git + editor + claude) that can be activated on a
  machine this flake does **not** manage:
  `home-manager switch --flake .#"lyrathorpe@x86_64-linux"`. The desktop/sway
  modules are intentionally excluded (they rely on a NixOS-provided Sway/Firefox
  binary).
- `homeModules` — the reusable modules exported so another flake can import them
  (`inputs.<this>.homeModules.default`). Consumers must supply the module args
  these expect: `inputs` always, `identity` for git/desktop, `portable` for sway.

## Applying

```sh
# NixOS
sudo nixos-rebuild switch --flake .#<configuration>
# Darwin
darwin-rebuild switch --flake .#lyrathorpe-mac
```

On a host whose `networking.hostName` matches its flake attribute (the WSL box
and the Pi are set up this way), `nh os switch` resolves the configuration from
the hostname with no `--flake`/`-H` flag.

## Adding a new host

1. **Create `hosts/<Name>/`.** Add `configuration.nix` with the host-specific
   bits only: `networking.hostName`, bootloader (firmware-specific — it is
   deliberately not set in the shared modules), and any per-machine hardware
   quirks. Keep anything reusable in `modules/` instead.
2. **Hardware config.** Generate `hardware-configuration.nix` on the real
   machine with `nixos-generate-config` and commit it. If the machine does not
   exist yet, commit a clearly-labelled placeholder so the host still evaluates
   in CI (see the existing T400 / RPi5 placeholders), and replace it at install.
   These files are excluded from the formatter and linters.
3. **Add a host-table entry in `flake.nix`.** Under `hosts` (NixOS) or
   `darwinHosts` (macOS), set `system`, the `modules` list (host config + form
   factor + any `nixos-hardware` profiles), and the `users` map (each user's
   `homeModules`). Choose the form factor per the decision note above; a headless
   host imports neither `laptop.nix` nor `desktop.nix`.
4. **Users.** If the host introduces a new person, add them to
   `users/registry.nix` first; otherwise reference an existing username.
5. **Verify.** `nix flake check` formats, lints, and evaluates every host —
   including the new one — so a broken entry fails locally before CI. Then
   `sudo nixos-rebuild switch --flake .#<configuration>` on the machine.

No change to CI is needed: the host-eval step discovers hosts from the flake
(`attrNames` of the configuration sets), so a new entry is picked up
automatically.

## Shell environment & keybindings

- Interactive shell features (zsh, tmux, git, ssh, CLI tools, auto-tmux):
  [`docs/shell.md`](https://docs.lyrapup.pet/nixfiles/shell/).
- Which classic utilities are shadowed by modern replacements, and the flag
  differences that will bite:
  [`docs/shell.md` → "Replacing the classics"](https://docs.lyrapup.pet/nixfiles/shell/#replacing-the-classics).
- All Sway / tmux / foot / zsh keyboard shortcuts:
  [`docs/keybindings.md`](https://docs.lyrapup.pet/nixfiles/keybindings/).

## Login / greeter

Graphical (Sway) hosts log in through a Wayland greeter — `greetd` running
ReGreet inside the `cage` kiosk compositor — implemented in
[`modules/sway.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/modules/sway.nix), gated on
`features.swayDesktop.enable` (the option is declared in
[`modules/features.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/modules/features.nix), so headless hosts
can leave it off without importing `modules/sway.nix`). The greeter is forced to Dvorak
to match the console and Sway session. Headless hosts (the WSL work box and the
Raspberry Pi server) keep plain TTY login. The target account needs a password
(`passwd <user>`) before it can log in.

## MacBook (Asahi) firmware

The MBP host references `modules/firmware/` for Apple peripheral
firmware (Wi-Fi/Bluetooth). These blobs are **committed** (tracked) even though
`.gitignore` lists the directory: the flake is `git+file`, so it only sees
tracked files — untracking them breaks `lyrathorpe-mbp` evaluation (and the CI
host-eval) because the config can't find the firmware. They are not
redistributable; the repo is private.

To refresh them, copy the firmware extracted during the Asahi install (from
`/etc/nixos/firmware`, or re-extract per the
[Asahi NixOS docs](https://github.com/tpwrules/nixos-apple-silicon)) into
`modules/firmware/` and commit with `git add -f`.

## Documentation

All prose documentation lives in [`docs/`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/docs); this README is the overview. The pages are
published to **<https://docs.lyrapup.pet/nixfiles/>** by the
[`docs-site`](https://code.emmathe.dev/lyrathorpe/docs-site) repository, which clones this repo on
every build (on its own push, nightly, or on demand) and assembles the tree:

```
README.md   ->  docs/nixfiles/index.md     # this file becomes the section landing page
docs/       ->  docs/nixfiles/             # everything here, ordering from docs/.pages
```

Nothing is pushed from this side and there is no build step here — editing a
page and merging is all that is required. Files outside `docs/` (bar this
README) are **not** synced, so a doc kept next to the code it describes will
never appear on the site.

### Linking rules

The site has no copy of the source tree, and this README is republished at a
different depth from the rest of `docs/`. Both facts break naive relative
links, so:

| Link from         | To                      | Use                                                              |
| ----------------- | ----------------------- | ---------------------------------------------------------------- |
| anywhere          | a source file or dir    | absolute `https://code.emmathe.dev/.../src/branch/main/…`        |
| a page in `docs/` | another page in `docs/` | relative (`./keybindings.md`) — correct in Gitea and on the site |
| this README       | a page in `docs/`       | absolute `https://docs.lyrapup.pet/nixfiles/…`                   |

`mkdocs build` runs non-strict on the docs-site side, so a broken link fails
silently rather than failing the build. Check links by hand when moving a page.

## Development

A dev shell and a formatting/lint gate are wired through the flake:

- `nix develop` — shell with `deadnix`, `statix`, `treefmt`, and the git
  `pre-commit` hooks (installed automatically on first entry).
- `nix fmt` — formats the tree via `treefmt` (nixfmt + shfmt + prettier;
  generated files and `flake.lock` are excluded).
- `nix flake check` — runs formatting, `deadnix`, `statix`, the pre-commit
  hooks, and evaluates every host. `.editorconfig` carries the base style;
  `statix.toml` disables the two house-style lints (`repeated_keys`,
  `empty_pattern`).

## CI

[`.gitea/workflows/ci.yaml`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/.gitea/workflows/ci.yaml) runs `nix flake check`
(formatting, `deadnix`, `statix`, the pre-commit hooks) and evaluates every
NixOS and Darwin host configuration on push/PR. It always runs (no `paths:`
filter) so the required check never hangs pending; the heavy Nix steps are
skipped when a PR touches no `.nix`/lockfile/workflow file, and the job still
reports green.
