refactor(flake): user registry, multi-user hosts, and portable home outputs (#49)
CI / flake (push) Successful in 3m26s
CI / flake (push) Successful in 3m26s
## Summary Separates user identity (data) from the reusable Nix modules and lets a host declare any number of users, replacing the previous one-user-per-host structure. Also restructures the tree and exposes the home config for use off these hosts. ## Changes - **User registry** (`users/registry.nix`): per-user identity (name, email, groups, authorized + signing keys) as the single source of truth; no user data hardcoded in modules. - **Multi-user `mkHost`**: a host declares a `users` set keyed by username; per-user identity is injected into each home config via the `identity` module arg. - **Restructured layout**: `users/`, `home/`, `modules/`, `hosts/`, `lib/` replace the former `lyrathorpe/` and `system/` trees. - **Portable outputs**: standalone `homeConfigurations."<user>@<system>"` (the portable subset — shell, git, editor, claude) plus an exported `homeModules` for use on machines not managed by this flake, or as an input to other flakes. - Docs (`README.md`, `home/README.md`) and `.gitignore` updated for the new paths. ## Fixes - Closes #46 — shared user module authorized one user's SSH key for every account. - Closes #47 — git committer identity hardcoded as defaults instead of per-user. - Closes #48 — EDaaS systemd linger hardcoded to a literal username. ## Verification - `nix flake check` passes: treefmt, deadnix, statix, pre-commit, and evaluation of all NixOS hosts + Darwin + homeConfigurations. - Derivation-path comparison vs `main`: `lyrathorpe-mbp` and `emmathorpe-edaas` are byte-identical; `lyrathorpe-t400`, `lyrathorpe-macpro31` and `lyrathorpe-rpi5` differ only by de-duplicating a repeated `authorized_keys` entry (confirmed with nix-diff — no other change). - Standalone `homeConfigurations."lyrathorpe@x86_64-linux".activationPackage` builds. ## Notes - `emmathorpe` has no personal authorized key yet (it previously inherited Lyra's key via the bug in #46); the registry entry is intentionally empty — add a real key if SSH login as `emmathorpe` is wanted (moot on the WSL host). - A two-repo (public dotfiles / private systems) split is deferred by design; this internal restructure is the prerequisite for it. --------- Co-authored-by: Emma Thorpe <emma.thorpe@citrix.com> Reviewed-on: #49
This commit was merged in pull request #49.
This commit is contained in:
Emma Thorpe
@@ -0,0 +1,184 @@
|
||||
# Default nix-darwin host. Minimal macOS baseline; the user environment
|
||||
# (shell, git, editor) is carried by the shared ./home modules,
|
||||
# the same ones used by the Linux hosts. nixpkgs.hostPlatform is set by
|
||||
# mkDarwinHost in flake.nix.
|
||||
{ pkgs, username, ... }:
|
||||
{
|
||||
programs.zsh.enable = true;
|
||||
|
||||
# Install the Nerd Font into /Library/Fonts so iTerm2 can use it (set it in
|
||||
# iTerm2 -> Settings -> Profiles -> Text -> Font: "JetBrainsMono Nerd Font").
|
||||
# Provides the powerline/Nerd glyphs the tmux statusline draws.
|
||||
fonts.packages = [ pkgs.nerd-fonts.jetbrains-mono ];
|
||||
|
||||
# CLI tooling sourced from nixpkgs instead of Homebrew formulae. Pure library
|
||||
# dependencies are omitted; nix pulls them into closures automatically.
|
||||
environment.systemPackages = with pkgs; [
|
||||
# Build & toolchain
|
||||
autoconf
|
||||
automake
|
||||
cmake
|
||||
coreutils
|
||||
gcc
|
||||
gettext
|
||||
gnumake
|
||||
pkgconf
|
||||
ruby
|
||||
zig
|
||||
# Version control & dev workflow
|
||||
pre-commit
|
||||
deno
|
||||
opentofu
|
||||
# Compression
|
||||
lz4
|
||||
p7zip
|
||||
xz
|
||||
zstd
|
||||
# Crypto & networking
|
||||
gnupg
|
||||
gnutls
|
||||
openssl
|
||||
pinentry_mac
|
||||
unbound
|
||||
wget
|
||||
# Media
|
||||
ffmpeg
|
||||
svt-av1
|
||||
yt-dlp
|
||||
# Graphics / Vulkan / SDL
|
||||
glslang
|
||||
moltenvk
|
||||
spirv-tools
|
||||
vulkan-loader
|
||||
vulkan-tools
|
||||
SDL2
|
||||
sdl3
|
||||
# Embedded
|
||||
esptool
|
||||
picotool
|
||||
# Misc utilities
|
||||
f3
|
||||
gnused
|
||||
lua5_4
|
||||
magic-wormhole
|
||||
ncurses
|
||||
mas
|
||||
sqlite
|
||||
];
|
||||
|
||||
# Account that runs user-level activation and Homebrew.
|
||||
system.primaryUser = username;
|
||||
|
||||
# nix-homebrew owns and installs the Homebrew prefix declaratively, so brew
|
||||
# itself no longer needs a manual bootstrap. enableRosetta permits x86_64
|
||||
# formulae via Rosetta 2 on Apple Silicon.
|
||||
nix-homebrew = {
|
||||
autoMigrate = true;
|
||||
enable = true;
|
||||
enableRosetta = true;
|
||||
user = username;
|
||||
};
|
||||
|
||||
# Declarative Homebrew for packages with no nixpkgs equivalent or that must be
|
||||
# the vendor build (GUI casks).
|
||||
homebrew = {
|
||||
enable = true;
|
||||
onActivation = {
|
||||
autoUpdate = true;
|
||||
upgrade = true;
|
||||
# Lists below are authoritative: anything not declared is uninstalled.
|
||||
cleanup = "zap";
|
||||
};
|
||||
taps = [ ];
|
||||
# Formulae kept on brew: vendor PWA host and version-pinned toolchains that
|
||||
# are simpler to track via brew than to match exactly in nixpkgs.
|
||||
brews = [
|
||||
"firefoxpwa"
|
||||
"llvm@21"
|
||||
"lld@21"
|
||||
"python@3.14"
|
||||
"dosbox-staging"
|
||||
];
|
||||
# GUI applications. macOS app bundles are managed as casks; nixpkgs darwin
|
||||
# GUI support is unreliable, so these stay on brew for continuity.
|
||||
casks = [
|
||||
"alfred"
|
||||
"android-platform-tools"
|
||||
"angry-ip-scanner"
|
||||
"arduino-ide"
|
||||
"autodesk-fusion"
|
||||
"bambu-studio"
|
||||
"bitwarden"
|
||||
"citrix-workspace"
|
||||
"curseforge"
|
||||
"discord"
|
||||
"firefox"
|
||||
"freecad"
|
||||
"gcc-arm-embedded"
|
||||
"google-chrome"
|
||||
"istat-menus"
|
||||
"iterm2"
|
||||
"macfuse"
|
||||
"microsoft-teams"
|
||||
"nextcloud"
|
||||
"obs"
|
||||
"omnidisksweeper"
|
||||
"openscad@snapshot"
|
||||
"orcaslicer"
|
||||
"plex"
|
||||
"plexamp"
|
||||
"postman"
|
||||
"signal"
|
||||
"steam"
|
||||
"thunderbird"
|
||||
"virtualbox"
|
||||
"visual-studio-code"
|
||||
"vnc-viewer"
|
||||
"vscodium"
|
||||
"winbox"
|
||||
];
|
||||
# Mac App Store apps are not managed declaratively: nix-darwin 26.05 forces
|
||||
# activation to run as root, and `mas` cannot reach the App Store session
|
||||
# from root, so installs silently fail. Install them by hand with
|
||||
# `mas install <id>` from a GUI Terminal (the `mas` CLI is in
|
||||
# environment.systemPackages above).
|
||||
};
|
||||
|
||||
# Touch ID authorises sudo (and darwin-rebuild's sudo prompt) instead of a
|
||||
# typed password. sudo_local keeps the change in /etc/pam.d/sudo_local so it
|
||||
# survives macOS updates. reattach pulls in pam_reattach: pam_tid (Touch ID)
|
||||
# otherwise fails inside tmux/screen because the process is detached from the
|
||||
# GUI login session -- and terminals here auto-start tmux, so it is required.
|
||||
security.pam.services.sudo_local = {
|
||||
touchIdAuth = true;
|
||||
reattach = true;
|
||||
};
|
||||
|
||||
# Declarative macOS UI defaults -- the main reason to run nix-darwin beyond
|
||||
# package management. Applied on activation; all reversible.
|
||||
system.defaults = {
|
||||
dock = {
|
||||
show-recents = false;
|
||||
mru-spaces = false; # don't reorder spaces by use
|
||||
};
|
||||
finder = {
|
||||
AppleShowAllExtensions = true;
|
||||
ShowPathbar = true;
|
||||
FXPreferredViewStyle = "Nlsv"; # list view
|
||||
_FXShowPosixPathInTitle = true;
|
||||
};
|
||||
NSGlobalDomain = {
|
||||
AppleInterfaceStyle = "Dark";
|
||||
ApplePressAndHoldEnabled = false; # key-repeat instead of the accent popup
|
||||
InitialKeyRepeat = 15;
|
||||
KeyRepeat = 2;
|
||||
};
|
||||
trackpad = {
|
||||
Clicking = true; # tap to click
|
||||
TrackpadThreeFingerDrag = true;
|
||||
};
|
||||
};
|
||||
|
||||
# Used for backwards compatibility; read `darwin-rebuild changelog` before changing.
|
||||
system.stateVersion = 5;
|
||||
}
|
||||
Reference in New Issue
Block a user