54 lines
2.3 KiB
Markdown
54 lines
2.3 KiB
Markdown
|
# Work WSL box — `emmathorpe-edaas`
|
||
|
|
|
||
|
|
Flake host: `emmathorpe-edaas` (`x86_64-linux`). NixOS running under
|
||
|
|
**NixOS-WSL** on the corporate Windows machine. Headless: no Sway desktop
|
||
|
|
(`features.swayDesktop.enable = false`), plain WSL shell login. Files:
|
||
|
|
`configuration.nix`.
|
||
|
|
|
||
|
|
## What this host is
|
||
|
|
|
||
|
|
The day-to-day work environment. It layers the corporate Kubernetes / Helm /
|
||
|
|
Terraform / cloud toolchain and a couple of work-only editor language servers on
|
||
|
|
top of the shared home profile. The system config here is thin — it is mostly
|
||
|
|
WSL plumbing; the user-facing tooling lives in
|
||
|
|
[`../../users/emmathorpe/work.nix`](../../users/emmathorpe/work.nix).
|
||
|
|
|
||
|
|
## WSL specifics
|
||
|
|
|
||
|
|
- `wsl.enable`, default user `emmathorpe`, Windows PATH interop and start-menu
|
||
|
|
launchers on. `/etc/hosts` generation is off (`generateHosts = false`).
|
||
|
|
- **Docker Desktop integration**, not the native daemon as the primary path:
|
||
|
|
`wsl.extraBin` shims the coreutils/`groupadd`/`usermod` binaries Docker
|
||
|
|
Desktop's `wsl-distro-proxy` expects, and `docker-desktop-proxy.script` is
|
||
|
|
patched to the real proxy path. The native `virtualisation.docker` is also
|
||
|
|
enabled (with `enableOnBoot` + `autoPrune`).
|
||
|
|
- `programs.ssh.systemd-ssh-proxy.enable = false` — the NixOS-WSL store is a
|
||
|
|
read-only VHD owned by `nobody`, and OpenSSH rejects the generated
|
||
|
|
`ssh-proxy` Include as "Bad owner or permissions", which would break ssh/git
|
||
|
|
for every command. The vsock proxy it provides is unused under WSL.
|
||
|
|
- `networking.hostName = "emmathorpe-edaas"` matches the flake attribute so
|
||
|
|
`nh os switch` resolves without `-H`.
|
||
|
|
|
||
|
|
## Renovate review timer
|
||
|
|
|
||
|
|
The host-table entry sets `users.emmathorpe.linger = true` so the user's
|
||
|
|
`systemd --user` instance stays alive without an open login session. That keeps
|
||
|
|
the daily headless **Renovate PR review** timer firing — defined in
|
||
|
|
[`../../users/emmathorpe/renovate-review.nix`](../../users/emmathorpe/renovate-review.nix)
|
||
|
|
(imported only from `work.nix`, so it exists on this machine alone). See that
|
||
|
|
file's header for the auth (Vertex AI ADC), triage policy, and caveats.
|
||
|
|
|
||
|
|
## stateVersion
|
||
|
|
|
||
|
|
`system.stateVersion = "24.11"` — the release this box was first installed on.
|
||
|
|
Leave it; it freezes stateful defaults and is not meant to track the current
|
||
|
|
nixpkgs.
|
||
|
|
|
||
|
|
## Apply
|
||
|
|
|
||
|
|
```sh
|
||
|
|
sudo nixos-rebuild switch --flake .#emmathorpe-edaas
|
||
|
|
# or, since the hostname matches the attribute:
|
||
|
|
nh os switch
|
||
|
|
```
|