refactor(flake): add user registry and multi-user host support

Separate user identity (data) from the reusable modules, and let a host
declare any number of users instead of exactly one.

- users/registry.nix: per-user identity (name, email, groups, authorized
  and signing keys) as the single source of identity; no user data is
  hardcoded in the modules.
- mkHost takes a `users` set keyed by username; per-user identity is
  injected into each home config via the `identity` module arg
  (extraSpecialArgs is per-host, so it cannot carry per-user data).
- modules/users.nix builds accounts from the registry; modules/ssh.nix no
  longer defines authorized keys (the registry owns them); home/git.nix
  and home/desktop.nix read `identity`; users/emmathorpe/work.nix drops
  its now-redundant git identity override.
- Restructure the tree: users/, home/, modules/, hosts/, lib/ replace the
  former lyrathorpe/ and system/ layout.
- Add standalone homeConfigurations (the portable subset: shell, git,
  editor, claude) and an exported homeModules output for use on machines
  not managed by this flake, or as an input to other flakes.

Behaviour-preserving for existing hosts: lyrathorpe-mbp and
emmathorpe-edaas evaluate to identical derivations; lyrathorpe-t400,
lyrathorpe-macpro31 and lyrathorpe-rpi5 differ only by de-duplicating a
repeated authorized_keys entry. Fixes the SSH authorized-key leak (one
user's key was applied to every account), the hardcoded default git
identity, and the hardcoded EDaaS linger setting.

.gitignore

@@ -1,4 +1,4 @@
-system/modules/firmware/*
+modules/firmware/*
 
 # vim swap files
 *.swp

flake.nix

@@ -23,7 +23,7 @@
     # Provides mkFlake: the systems/perSystem scaffolding used below.
     flake-parts.url = "github:hercules-ci/flake-parts";
     flake-parts.inputs.nixpkgs-lib.follows = "nixpkgs";
-    # Declarative Firefox add-ons (e.g. the Catppuccin theme); see lyrathorpe/user.nix.
+    # Declarative Firefox add-ons (e.g. the Catppuccin theme); see modules/users.nix.
     firefox-addons = {
       url = "gitlab:rycee/nur-expressions?dir=pkgs/firefox-addons";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -46,7 +46,7 @@
       url = "github:cachix/git-hooks.nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    # Declarative Neovim (the editor; see lyrathorpe/home/editor.nix). Release
+    # Declarative Neovim (the editor; see home/editor.nix). Release
     # branch matched to the pinned nixpkgs (26.05); follows our nixpkgs to keep a
     # single nixpkgs in the closure. editor.nix sets programs.nixvim.nixpkgs.source
     # to this same input so the home module doesn't warn about the pin.
@@ -97,6 +97,12 @@
           "lens-desktop"
         ];
 
+        # Identity registry: who each user is (name, email, keys, groups), keyed
+        # by username. Threaded into the system layer as the `userRegistry`
+        # specialArg and into each user's home config as the `identity` module
+        # arg. See users/registry.nix, modules/users.nix, home/git.nix.
+        userRegistry = import ./users/registry.nix;
+
         # nixpkgs + nix-daemon settings shared by NixOS and Darwin hosts.
         commonModule = {
           nixpkgs.overlays = overlays;
@@ -112,9 +118,9 @@
 
         # Shared scaffolding for every NixOS host: common user, settings, home-manager.
         baseModules = [
-          ./lyrathorpe/user.nix
-          ./system/modules/common-nixos.nix
-          ./system/modules/features.nix
+          ./modules/users.nix
+          ./modules/common-nixos.nix
+          ./modules/features.nix
           commonModule
           home-manager.nixosModules.home-manager
           {
@@ -126,18 +132,19 @@
           }
         ];
 
-        # mkHost :: { system, username, fullName, modules, homeModules } -> nixosSystem
+        # mkHost :: { system, modules, users, portable } -> nixosSystem
         # Builds one machine by appending its host-specific modules to the shared
-        # baseModules. The user identity (username/fullName) is threaded through
-        # specialArgs so user.nix and the home modules stay host-agnostic, and the
-        # home-manager profile is keyed by the host's username.
+        # baseModules. `users` is an attrset keyed by username; each value carries
+        # that user's home-module list and optional per-host-user system bits
+        # (e.g. linger). Per-user identity is injected into each home config via
+        # the `identity` module arg (extraSpecialArgs is per-host, so it cannot
+        # carry per-user data); the system layer reads the global `userRegistry`
+        # restricted to this host's `hostUsers` set.
         mkHost =
           {
             system,
-            username,
-            fullName,
             modules,
-            homeModules,
+            users,
             # Host form factor. Laptops inherit the default; a desktop host sets
             # `portable = false` to drop mobile components (battery block,
             # brightness keys) from the home-manager Sway config.
@@ -148,8 +155,7 @@
             specialArgs = {
               inherit
                 inputs
-                username
-                fullName
+                userRegistry
                 portable
                 ;
             };
@@ -157,16 +163,15 @@
               baseModules
               ++ modules
               ++ [
+                { _module.args.hostUsers = users; }
                 {
-                  home-manager.extraSpecialArgs = {
-                    inherit
-                      inputs
-                      username
-                      fullName
-                      portable
-                      ;
-                  };
-                  home-manager.users.${username}.imports = homeModules;
+                  home-manager.extraSpecialArgs = { inherit inputs portable; };
+                  home-manager.users = lib.mapAttrs (name: spec: {
+                    imports = spec.homeModules;
+                    _module.args.identity = userRegistry.${name} // {
+                      username = name;
+                    };
+                  }) users;
                 }
               ];
           };
@@ -185,19 +190,20 @@
           }
         ];
 
-        # mkDarwinHost :: { system, username, fullName, modules, homeModules } -> darwinSystem
+        # mkDarwinHost :: { system, username, modules, homeModules } -> darwinSystem
         # Darwin counterpart of mkHost. macOS already owns the login user, so we
         # only attach the platform and home-manager; no NixOS user module here.
+        # Stays single-user (macOS owns the account); identity is still sourced
+        # from the registry so the shared home modules behave as on NixOS.
         mkDarwinHost =
           {
             system,
             username,
-            fullName,
             modules,
             homeModules,
           }:
           nix-darwin.lib.darwinSystem {
-            specialArgs = { inherit inputs username fullName; };
+            specialArgs = { inherit inputs username; };
             modules =
               darwinBaseModules
               ++ modules
@@ -206,40 +212,44 @@
                   nixpkgs.hostPlatform = system;
                   # macOS owns the account; point home-manager at its home dir.
                   users.users.${username}.home = "/Users/${username}";
-                  home-manager.extraSpecialArgs = { inherit inputs username fullName; };
-                  home-manager.users.${username}.imports = homeModules;
+                  home-manager.extraSpecialArgs = { inherit inputs; };
+                  home-manager.users.${username} = {
+                    imports = homeModules;
+                    _module.args.identity = userRegistry.${username} // {
+                      inherit username;
+                    };
+                  };
                 }
               ];
           };
 
         # Host table — declarative registry of every machine. To add a host:
-        # give it a name, its `system`, the owning user, and the module lists.
-        # mapAttrs below turns each entry into a nixosConfiguration of the same name.
+        # give it a name, its `system`, its `users` set (each user's home-module
+        # list, plus optional per-host-user bits like linger), and the system
+        # `modules`. mapAttrs below turns each entry into a nixosConfiguration of
+        # the same name. Per-user home configs compose ./home (the shared bundle)
+        # with any per-user modules (e.g. ./users/emmathorpe/work.nix).
         hosts = {
           lyrathorpe-mbp = {
             system = "aarch64-linux";
-            username = "lyrathorpe";
-            fullName = "Lyra Thorpe";
             modules = [
-              ./system/machine/MBP-Asahi/configuration.nix
-              ./system/modules/laptop.nix
+              ./hosts/MBP-Asahi/configuration.nix
+              ./modules/laptop.nix
               nixos-apple-silicon.nixosModules.default
-              ./lyrathorpe/swaywm.nix
+              ./modules/sway.nix
             ];
-            homeModules = [
-              ./lyrathorpe/home
-              ./lyrathorpe/home/desktop.nix
+            users.lyrathorpe.homeModules = [
+              ./home
+              ./home/desktop.nix
             ];
           };
 
           lyrathorpe-t400 = {
             system = "x86_64-linux";
-            username = "lyrathorpe";
-            fullName = "Lyra Thorpe";
             modules = [
-              ./system/machine/T400/configuration.nix
-              ./system/modules/laptop.nix
-              ./system/modules/ssh.nix
+              ./hosts/T400/configuration.nix
+              ./modules/laptop.nix
+              ./modules/ssh.nix
               # No t400-specific profile exists; compose the generic ThinkPad +
               # laptop/SSD/Intel building blocks (tp_smapi/acpi_call for battery
               # thresholds, SSD + microcode defaults).
@@ -247,78 +257,76 @@
               inputs.nixos-hardware.nixosModules.common-pc-laptop
               inputs.nixos-hardware.nixosModules.common-pc-laptop-ssd
               inputs.nixos-hardware.nixosModules.common-cpu-intel
-              ./lyrathorpe/swaywm.nix
+              ./modules/sway.nix
             ];
-            homeModules = [
-              ./lyrathorpe/home
-              ./lyrathorpe/home/desktop.nix
+            users.lyrathorpe.homeModules = [
+              ./home
+              ./home/desktop.nix
             ];
           };
 
           lyrathorpe-macpro31 = {
             system = "x86_64-linux";
-            username = "lyrathorpe";
-            fullName = "Lyra Thorpe";
             portable = false;
             modules = [
-              ./system/machine/MacPro31/configuration.nix
-              ./system/modules/desktop.nix
-              ./system/modules/ssh.nix
+              ./hosts/MacPro31/configuration.nix
+              ./modules/desktop.nix
+              ./modules/ssh.nix
               inputs.nixos-hardware.nixosModules.common-pc-ssd
               inputs.nixos-hardware.nixosModules.common-cpu-intel
-              ./lyrathorpe/swaywm.nix
+              ./modules/sway.nix
             ];
-            homeModules = [
-              ./lyrathorpe/home
-              ./lyrathorpe/home/desktop.nix
+            users.lyrathorpe.homeModules = [
+              ./home
+              ./home/desktop.nix
             ];
           };
 
           emmathorpe-edaas = {
             system = "x86_64-linux";
-            username = "emmathorpe";
-            fullName = "Emma Thorpe";
             modules = [
-              ./system/machine/EDaaS/configuration.nix
+              ./hosts/EDaaS/configuration.nix
               nixos-wsl.nixosModules.default
-              ./lyrathorpe/swaywm.nix
-            ];
-            homeModules = [
-              ./lyrathorpe/home
-              ./lyrathorpe/home/work.nix
+              ./modules/sway.nix
             ];
+            users.emmathorpe = {
+              homeModules = [
+                ./home
+                ./users/emmathorpe/work.nix
+              ];
+              # Keep the systemd --user instance alive without a login session so
+              # the renovate-review home timer fires on schedule.
+              linger = true;
+            };
           };
 
           lyrathorpe-rpi5 = {
             system = "aarch64-linux";
-            username = "lyrathorpe";
-            fullName = "Lyra Thorpe";
             portable = false;
-            # Headless server: Docker host + nginx reverse proxy. No swaywm.nix
+            # Headless server: Docker host + nginx reverse proxy. No sway.nix
             # (no desktop); the raspberry-pi-5 profile supplies kernel/firmware,
             # ssh.nix adds key-only sshd.
             modules = [
-              ./system/machine/RPi5/configuration.nix
+              ./hosts/RPi5/configuration.nix
               inputs.nixos-hardware.nixosModules.raspberry-pi-5
-              ./system/modules/ssh.nix
+              ./modules/ssh.nix
             ];
-            homeModules = [ ./lyrathorpe/home ];
+            users.lyrathorpe.homeModules = [ ./home ];
           };
         };
 
         # Darwin host table — macOS machines built via mkDarwinHost. The shared
-        # ./lyrathorpe/home modules (shell, git, editor) are reused; the Linux-only
+        # ./home bundle (shell, git, editor) is reused directly; the Linux-only
         # desktop/sway modules are intentionally left out.
         darwinHosts = {
           lyrathorpe-mac = {
             system = "aarch64-darwin";
             username = "lyrathorpe";
-            fullName = "Lyra Thorpe";
             modules = [
-              ./system/machine/Darwin/configuration.nix
+              ./hosts/Darwin/configuration.nix
             ];
             homeModules = [
-              ./lyrathorpe/home
+              ./home
             ];
           };
         };
@@ -409,6 +417,70 @@
         # Realise the host tables: each entry becomes a {nixos,darwin}Configuration.
         flake.nixosConfigurations = lib.mapAttrs (_name: mkHost) hosts;
         flake.darwinConfigurations = lib.mapAttrs (_name: mkDarwinHost) darwinHosts;
+
+        # Reusable home modules, exported so this config can be consumed off these
+        # hosts -- by a standalone home-manager on a non-NixOS machine, or as an
+        # input to someone else's flake. `default` is the portable bundle
+        # (shell + git + editor + claude). Consumers must supply the module args
+        # these expect: `inputs` always; `identity` (see users/registry.nix) for
+        # git/desktop; `portable` for sway. `desktop`/`sway` additionally require
+        # a NixOS host that provides the Sway/Firefox binary -- they are not
+        # standalone-portable.
+        flake.homeModules = {
+          default = ./home;
+          shell = ./home/shell.nix;
+          git = ./home/git.nix;
+          editor = ./home/editor.nix;
+          claude = ./home/claude.nix;
+          desktop = ./home/desktop.nix;
+          sway = ./home/sway.nix;
+        };
+
+        # Standalone home-manager configurations: the portable bundle built for a
+        # machine NOT managed by this flake (`home-manager switch --flake
+        # .#"<user>@<system>"`). Only the portable subset is exposed; the desktop
+        # suite stays NixOS-only. homeConfigurations are not per-system, so the
+        # system is encoded in the attribute name, and home.username/homeDirectory
+        # are set explicitly (the NixOS module sets them automatically; standalone
+        # does not).
+        flake.homeConfigurations =
+          let
+            mkHome =
+              {
+                system,
+                name,
+              }:
+              home-manager.lib.homeManagerConfiguration {
+                pkgs = import nixpkgs {
+                  inherit system overlays;
+                  config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) unfreePackages;
+                };
+                extraSpecialArgs = {
+                  inherit inputs;
+                  portable = true;
+                  identity = userRegistry.${name} // {
+                    username = name;
+                  };
+                };
+                modules = [
+                  ./home
+                  {
+                    home.username = name;
+                    home.homeDirectory = "/home/${name}";
+                  }
+                ];
+              };
+          in
+          {
+            "lyrathorpe@x86_64-linux" = mkHome {
+              system = "x86_64-linux";
+              name = "lyrathorpe";
+            };
+            "lyrathorpe@aarch64-linux" = mkHome {
+              system = "aarch64-linux";
+              name = "lyrathorpe";
+            };
+          };
       }
     );
 }

home/desktop.nix

@@ -1,12 +1,13 @@
 # Graphical desktop layer: GUI apps, Wayland session env, and cursor theme.
 # Imported only on hosts that run Sway (MBP, T400, Mac Pro); never pulled onto
 # the headless WSL host. Login (and the Sway session launch) is handled by the
-# greetd/ReGreet greeter -- see ../swaywm.nix -- so there is no tty1 autostart.
+# greetd/ReGreet greeter -- see ../modules/sway.nix -- so there is no tty1
+# autostart.
 {
   pkgs,
   config,
   inputs,
-  username,
+  identity,
   ...
 }:
 {
@@ -89,7 +90,7 @@
   };
 
   # Firefox is themed at the browser level (it does not follow the GTK theme).
-  # The system installs the binary (programs.firefox in ../user.nix); here
+  # The system installs the binary (programs.firefox in ../modules/users.nix); here
   # home-manager owns only the profile, hence package = null. Apply the
   # Catppuccin Mocha theme add-on (only the mauve accent is packaged upstream;
   # the rest of the desktop uses blue) and make content + UI dark.
@@ -101,7 +102,7 @@
     # stateVersion<26.05 default-change warning (the new XDG path depends on
     # Firefox's own profile support).
     configPath = ".mozilla/firefox";
-    profiles.${username} = {
+    profiles.${identity.username} = {
       id = 0;
       isDefault = true;
       extensions = {

home/git.nix

@@ -1,13 +1,14 @@
-# Version control: git + delta pager + commitizen + lazygit. The work host
-# layers commit signing and an email override on top (see work.nix).
+# Version control: git + delta pager + commitizen + lazygit. The committer
+# identity (name, email, signing key) comes from the per-user `identity` arg,
+# derived from the registry (users/registry.nix) by mkHost.
 {
   pkgs,
   lib,
-  fullName,
+  identity,
   ...
 }:
 let
-  ctp = import ../catppuccin-mocha.nix;
+  ctp = import ../lib/catppuccin-mocha.nix;
 in
 {
   home.packages = [
@@ -18,10 +19,10 @@ in
     enable = true;
     package = pkgs.gitFull;
     settings = {
-      user.name = fullName;
-      # Personal identity. mkDefault so the work module overrides it on the work
-      # host (and to merge cleanly with that plain definition there).
-      user.email = lib.mkDefault "iam@emmathe.dev";
+      user.name = identity.fullName;
+      # Identity from the registry. mkDefault so a host-specific module can still
+      # override it without conflicting.
+      user.email = lib.mkDefault identity.email;
       push.autoSetupRemote = true;
       init.defaultBranch = "main";
 
@@ -77,14 +78,11 @@ in
         cc = "!cz commit";
       };
 
-      # SSH commit signing. This personal key is the default; the work module
-      # (work.nix) overrides it with the work key on the EDaaS host, the same way
-      # user.email is overridden -- so mkDefault here lets that plain definition
-      # win instead of conflicting. gpgsign is mkDefault too, so a host without
-      # the key in its ssh-agent can override it to false rather than fail every
-      # commit.
+      # SSH commit signing, key from the registry. mkDefault on the key and on
+      # gpgsign so a host without that key in its ssh-agent can override gpgsign
+      # to false rather than fail every commit.
       gpg.format = "ssh";
-      user.signingkey = lib.mkDefault "key::ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDxHvdMTOzpFWUFMtCP7C/4tIOUO3GIO2QPvaifSnWH lyrathorpe@Lyra-MBA";
+      user.signingkey = lib.mkDefault identity.signingKey;
       commit.gpgsign = lib.mkDefault true;
       tag.gpgsign = lib.mkDefault true;
     };

home/shell.nix

@@ -8,7 +8,7 @@
 }:
 let
   # Shared Catppuccin Mocha palette: raw 6-hex strings, no leading "#".
-  ctp = import ../catppuccin-mocha.nix;
+  ctp = import ../lib/catppuccin-mocha.nix;
 in
 {
   imports = [

home/sway.nix

@@ -2,7 +2,7 @@
 # Imported via ./desktop.nix, so only graphical hosts get it.
 #
 # The compositor binary, PAM and the polkit *daemon* come from the system-level
-# programs.sway (see ../swaywm.nix); package = null below reuses it instead of
+# programs.sway (see ../modules/sway.nix); package = null below reuses it instead of
 # pulling a second Sway. The polkit authentication *agent* (the thing that draws
 # the GUI auth dialog) is a user service started here. home-manager owns the user
 # config (~/.config/sway) and wires the systemd user session (sway-session.target),
@@ -20,7 +20,7 @@ let
   # Catppuccin Mocha (shared with the ReGreet greeter). Raw hex; prefix "#"
   # where a consumer needs it -- Sway/i3status/dunst want "#", foot/swaylock do
   # not.
-  ctp = import ../catppuccin-mocha.nix;
+  ctp = import ../lib/catppuccin-mocha.nix;
 
   # Focused-window screenshot -> swappy editor (the dotfiles' grimshot.sh logic).
   # Full store paths so it needs nothing on PATH.

hosts/Darwin/configuration.nix

@@ -1,5 +1,5 @@
 # Default nix-darwin host. Minimal macOS baseline; the user environment
-# (shell, git, editor) is carried by the shared ./lyrathorpe/home modules,
+# (shell, git, editor) is carried by the shared ./home modules,
 # the same ones used by the Linux hosts. nixpkgs.hostPlatform is set by
 # mkDarwinHost in flake.nix.
 { pkgs, username, ... }:

hosts/EDaaS/configuration.nix

@@ -62,12 +62,11 @@
 
   features.swayDesktop.enable = false;
 
-  # Keep this user's systemd --user instance running without an open login
-  # session, so the home-manager user timer (renovate-review.nix) fires on
-  # schedule even when no terminal is attached. On WSL the timer still only runs
-  # while the distro itself is up; Persistent=true catches up a missed run at
-  # next start.
-  users.users.emmathorpe.linger = true;
+  # NOTE: this user's systemd --user lingering -- so the home-manager renovate
+  # timer fires without an open login session -- is enabled from the host table
+  # in flake.nix (users.emmathorpe.linger = true) and applied by
+  # modules/users.nix.
+
   # programs.nix-ld is enabled for all NixOS hosts in common-nixos.nix.
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions

hosts/MacPro31/configuration.nix

@@ -42,7 +42,7 @@
   #   - ATI Radeon HD 2600 XT -> "radeon" (older) or "amdgpu" KMS
   #   - NVIDIA GeForce 8800 GT -> "nouveau" KMS
   # These come up automatically via the in-tree drivers + KMS, and the graphics
-  # stack itself is enabled by swaywm.nix. If a card needs to be forced, add it
+  # stack itself is enabled by modules/sway.nix. If a card needs to be forced, add it
   # here, e.g. `services.xserver.videoDrivers = [ "radeon" ];` (or "nouveau"),
   # and/or `boot.initrd.kernelModules = [ "radeon" ];` in
   # hardware-configuration.nix for early KMS.

hosts/RPi5/configuration.nix

@@ -15,7 +15,7 @@
   # (which selects by the local hostname) resolves without an explicit -H flag.
   networking.hostName = "lyrathorpe-rpi5";
 
-  # Headless server: the Sway desktop is intentionally not set up. swaywm.nix is
+  # Headless server: the Sway desktop is intentionally not set up. modules/sway.nix is
   # not imported and features.swayDesktop.enable defaults to false (declared in
   # system/modules/features.nix), so this host keeps plain TTY/SSH login.
 

lib/catppuccin-mocha.nix

@@ -1,6 +1,6 @@
 # Catppuccin Mocha palette. Raw 6-digit hex (no leading "#"); consumers add a
 # "#" where their format needs it. Shared by the Sway desktop theming
-# (home/sway.nix) and the ReGreet greeter (swaywm.nix) so the two stay in sync.
+# (home/sway.nix) and the ReGreet greeter (modules/sway.nix) so the two stay in sync.
 {
   base = "1e1e2e";
   mantle = "181825";

lyrathorpe/user.nix

@@ -1,31 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  username,
-  fullName,
-  ...
-}:
-
-{
-  programs.zsh.enable = true;
-  users.users.${username} = {
-    isNormalUser = true;
-    home = "/home/${username}";
-    description = fullName;
-    extraGroups = [
-      "wheel"
-      "docker"
-    ];
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDxHvdMTOzpFWUFMtCP7C/4tIOUO3GIO2QPvaifSnWH lyrathorpe@Lyra-MBA"
-    ];
-    shell = pkgs.zsh;
-  };
-  programs.firefox = lib.mkIf (config.features.swayDesktop.enable == true) {
-    enable = true;
-  };
-  programs.thunderbird = lib.mkIf (config.features.swayDesktop.enable == true) {
-    enable = true;
-  };
-}

modules/desktop.nix

@@ -2,7 +2,7 @@
 # shared ./workstation.nix base and swaps the mobile Wi-Fi backend for wired
 # NetworkManager. A desktop host also sets `portable = false` in its host-table
 # entry (flake.nix), which drops the battery block and brightness keybindings
-# from the Sway bar -- see lyrathorpe/home/sway.nix.
+# from the Sway bar -- see home/sway.nix.
 { ... }:
 {
   imports = [ ./workstation.nix ];

modules/features.nix

@@ -2,9 +2,9 @@
 # baseModules in flake.nix). Declaring the flags here -- rather than inside the
 # module that implements them -- means a host can read or set a flag without
 # importing the (often large) implementation module. In particular,
-# features.swayDesktop.enable is read by lyrathorpe/user.nix on every host, but a
+# features.swayDesktop.enable is read by modules/users.nix on every host, but a
 # headless host (e.g. the Pi) must be able to leave it at its default without
-# pulling in lyrathorpe/swaywm.nix. The implementation lives in swaywm.nix,
+# pulling in modules/sway.nix. The implementation lives in modules/sway.nix,
 # gated on this flag.
 { lib, ... }:
 {

modules/laptop.nix

@@ -2,7 +2,7 @@
 # flake.nix. Shared graphical-workstation settings live in ./workstation.nix;
 # the only laptop-specific bit is the Wi-Fi backend. Mobile home-manager
 # components (battery block, brightness keys) are gated by the `portable` flag
-# threaded through mkHost -- see lyrathorpe/home/sway.nix.
+# threaded through mkHost -- see home/sway.nix.
 { ... }:
 {
   imports = [ ./workstation.nix ];

modules/ssh.nix

@@ -0,0 +1,14 @@
+# Key-only SSH hardening, imported by the hosts that run sshd (T400, Mac Pro,
+# RPi5). The host config still does `services.openssh.enable = true` and opens
+# port 22 next to where it documents the listening service; this module only
+# tightens the policy so a host opting into sshd cannot accidentally ship
+# password/root login. Authorized keys are owned per-user by the identity
+# registry (users/registry.nix, applied via modules/users.nix), not here.
+{ ... }:
+{
+  services.openssh.settings = {
+    PasswordAuthentication = false; # keys only
+    KbdInteractiveAuthentication = false; # no keyboard-interactive fallback
+    PermitRootLogin = "no";
+  };
+}

modules/sway.nix

@@ -7,8 +7,8 @@
 
 let
   cfg = config.features.swayDesktop;
-  # Catppuccin Mocha (shared with the Sway desktop, see lyrathorpe/home/sway.nix).
-  ctp = import ./catppuccin-mocha.nix;
+  # Catppuccin Mocha (shared with the Sway desktop, see home/sway.nix).
+  ctp = import ../lib/catppuccin-mocha.nix;
 in
 {
   # The features.swayDesktop.enable option is declared in

modules/users.nix

@@ -0,0 +1,44 @@
+# System-level user accounts, built from the identity registry
+# (users/registry.nix). `hostUsers` is the host's user set, threaded by mkHost
+# from the flake host table; `userRegistry` is the global identity table passed
+# as a specialArg. Every account's identity -- description, groups, authorized
+# keys -- comes from its registry entry, so no user data is hardcoded here and a
+# host may declare any number of users.
+{
+  config,
+  pkgs,
+  lib,
+  hostUsers,
+  userRegistry,
+  ...
+}:
+
+{
+  programs.zsh.enable = true;
+
+  users.users = lib.mapAttrs (
+    name: spec:
+    let
+      id = userRegistry.${name};
+    in
+    {
+      isNormalUser = true;
+      home = "/home/${name}";
+      description = id.fullName;
+      inherit (id) extraGroups;
+      openssh.authorizedKeys.keys = id.sshAuthorizedKeys;
+      shell = pkgs.zsh;
+    }
+    # Keep this user's systemd --user instance running without an open login
+    # session (e.g. for home-manager user timers). Only emitted when the host
+    # table opts in, so hosts that don't set it leave linger entirely unmanaged.
+    // lib.optionalAttrs (spec ? linger) { inherit (spec) linger; }
+  ) hostUsers;
+
+  programs.firefox = lib.mkIf (config.features.swayDesktop.enable == true) {
+    enable = true;
+  };
+  programs.thunderbird = lib.mkIf (config.features.swayDesktop.enable == true) {
+    enable = true;
+  };
+}

system/modules/ssh.nix

@@ -1,19 +0,0 @@
-# Key-only SSH hardening, imported by the hosts that run sshd (T400, Mac Pro).
-# The host config still does `services.openssh.enable = true` and opens port 22
-# next to where it documents the listening service; this module only tightens
-# the policy and installs the authorized key, so a host opting into sshd cannot
-# accidentally ship password/root login.
-{ username, ... }:
-{
-  services.openssh.settings = {
-    PasswordAuthentication = false; # keys only
-    KbdInteractiveAuthentication = false; # no keyboard-interactive fallback
-    PermitRootLogin = "no";
-  };
-
-  # The key permitted to log in as the primary user. Add more entries here as
-  # new client machines are provisioned.
-  users.users.${username}.openssh.authorizedKeys.keys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDxHvdMTOzpFWUFMtCP7C/4tIOUO3GIO2QPvaifSnWH lyrathorpe@Lyra-MBA"
-  ];
-}

users/emmathorpe/work.nix

@@ -1,5 +1,7 @@
-# Home-manager module for the work (EDaaS/WSL) profile: corporate git signing,
-# work toolchain packages and tmux tweaks. Imported only by the work host.
+# Home-manager module for the work (EDaaS/WSL) profile: corporate work toolchain
+# packages and tmux tweaks. Imported only by the work host. The corporate git
+# identity (email + signing key) is the emmathorpe entry in the identity
+# registry (users/registry.nix), applied by the shared home/git.nix.
 { pkgs, lib, ... }:
 
 {
@@ -12,15 +14,6 @@
   # programs.ssh (shell.nix) take it over. The ssh-agent below still runs.
   programs.ssh.enable = lib.mkForce false;
 
-  programs.git = {
-    settings = {
-      commit.gpgsign = true;
-      tag.gpgsign = true;
-      gpg.format = "ssh";
-      user.signingkey = "key::ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAJMVgeRKnfX1G8coU3nAobI485aeUpGTMqH7+zbKI8o emma.thorpe@cloud.com";
-      user.email = "emma.thorpe@citrix.com";
-    };
-  };
   home.packages = [
     pkgs.kubectl
     pkgs.argo-rollouts
@@ -66,7 +59,7 @@
   };
 
   # LSP servers only relevant to work: C# (omnisharp) and Helm charts (helm_ls).
-  # The shared editor (lyrathorpe/home/editor.nix) carries the universal ones;
+  # The shared editor (home/editor.nix) carries the universal ones;
   # these are gated to this host so the heavy omnisharp closure stays off the
   # personal machines. Tree-sitter grammars (highlighting) remain global there.
   programs.nixvim.plugins.lsp.servers = {

users/registry.nix

@@ -0,0 +1,40 @@
+# User identity registry -- pure data, no machinery. Keyed by username.
+#
+# Each entry describes WHO a user is (display name, email, authorized/signing
+# keys, supplementary groups). The reusable modules read this indirectly:
+#   - system: modules/users.nix builds users.users.* from `userRegistry`
+#     (specialArg) restricted to the host's `hostUsers` set.
+#   - home:   home/git.nix and home/desktop.nix read the per-user `identity`
+#     module arg, which mkHost derives from the matching registry entry.
+#
+# The login name is injected by mkHost as `identity.username`, so it is not
+# repeated inside each entry here.
+{
+  lyrathorpe = {
+    fullName = "Lyra Thorpe";
+    email = "iam@emmathe.dev";
+    extraGroups = [
+      "wheel"
+      "docker"
+    ];
+    sshAuthorizedKeys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDxHvdMTOzpFWUFMtCP7C/4tIOUO3GIO2QPvaifSnWH lyrathorpe@Lyra-MBA"
+    ];
+    signingKey = "key::ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDxHvdMTOzpFWUFMtCP7C/4tIOUO3GIO2QPvaifSnWH lyrathorpe@Lyra-MBA";
+  };
+
+  emmathorpe = {
+    fullName = "Emma Thorpe";
+    email = "emma.thorpe@citrix.com";
+    extraGroups = [
+      "wheel"
+      "docker"
+    ];
+    # No personal authorized key on file yet. The previous shared user module
+    # applied Lyra's key to every account, including this one -- a defect. Leave
+    # this empty until a real key is provisioned; SSH login is moot on the WSL
+    # host (entered via wsl.exe, not sshd).
+    sshAuthorizedKeys = [ ];
+    signingKey = "key::ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAJMVgeRKnfX1G8coU3nAobI485aeUpGTMqH7+zbKI8o emma.thorpe@cloud.com";
+  };
+}