refactor(flake): user registry, multi-user hosts, and portable home outputs (#49)

## Summary

Separates user identity (data) from the reusable Nix modules and lets a host declare any number of users, replacing the previous one-user-per-host structure. Also restructures the tree and exposes the home config for use off these hosts.

## Changes

- **User registry** (`users/registry.nix`): per-user identity (name, email, groups, authorized + signing keys) as the single source of truth; no user data hardcoded in modules.
- **Multi-user `mkHost`**: a host declares a `users` set keyed by username; per-user identity is injected into each home config via the `identity` module arg.
- **Restructured layout**: `users/`, `home/`, `modules/`, `hosts/`, `lib/` replace the former `lyrathorpe/` and `system/` trees.
- **Portable outputs**: standalone `homeConfigurations."<user>@<system>"` (the portable subset — shell, git, editor, claude) plus an exported `homeModules` for use on machines not managed by this flake, or as an input to other flakes.
- Docs (`README.md`, `home/README.md`) and `.gitignore` updated for the new paths.

## Fixes

- Closes #46 — shared user module authorized one user's SSH key for every account.
- Closes #47 — git committer identity hardcoded as defaults instead of per-user.
- Closes #48 — EDaaS systemd linger hardcoded to a literal username.

## Verification

- `nix flake check` passes: treefmt, deadnix, statix, pre-commit, and evaluation of all NixOS hosts + Darwin + homeConfigurations.
- Derivation-path comparison vs `main`: `lyrathorpe-mbp` and `emmathorpe-edaas` are byte-identical; `lyrathorpe-t400`, `lyrathorpe-macpro31` and `lyrathorpe-rpi5` differ only by de-duplicating a repeated `authorized_keys` entry (confirmed with nix-diff — no other change).
- Standalone `homeConfigurations."lyrathorpe@x86_64-linux".activationPackage` builds.

## Notes

- `emmathorpe` has no personal authorized key yet (it previously inherited Lyra's key via the bug in #46); the registry entry is intentionally empty — add a real key if SSH login as `emmathorpe` is wanted (moot on the WSL host).
- A two-repo (public dotfiles / private systems) split is deferred by design; this internal restructure is the prerequisite for it.

---------

Co-authored-by: Emma Thorpe <emma.thorpe@citrix.com>
Reviewed-on: #49

modules/common-nixos.nix

@@ -0,0 +1,62 @@
+# Options shared by every NixOS host (laptops and the WSL box). Imported via
+# baseModules in flake.nix. Host- and platform-specific settings stay in the
+# per-machine configs; laptop-only settings live in ./laptop.nix.
+{ pkgs, ... }:
+{
+  time.timeZone = "Europe/London";
+  i18n.defaultLocale = "en_GB.UTF-8";
+
+  # Store hygiene. auto-optimise-store hard-links identical files in the store
+  # after each build (cheap dedupe; NOT a garbage collector -- there is
+  # deliberately no automatic GC timer). The larger download buffer avoids
+  # "buffer full" stalls when fetching big NARs over a fast link.
+  nix.settings.auto-optimise-store = true;
+  nix.settings.download-buffer-size = 134217728; # 128 MiB
+
+  # Extra binary cache for the nix-community toolchain (home-manager, nixvim,
+  # treefmt, ...). Merges with any host-specific caches (e.g. the Asahi cache on
+  # the MBP) rather than replacing them.
+  nix.settings.substituters = [ "https://nix-community.cachix.org" ];
+  nix.settings.trusted-public-keys = [
+    "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+  ];
+
+  # Run dynamically-linked foreign binaries (VS Code remote server, prebuilt
+  # toolchains, language-server downloads) on every NixOS host, not just WSL.
+  programs.nix-ld.enable = true;
+
+  # Minimal system-level CLI available before the home-manager profile loads
+  # (e.g. early boot / rescue). User-level tooling lives in home-manager.
+  environment.systemPackages = with pkgs; [
+    git
+    fastfetch
+  ];
+
+  # Fonts on every host. The Nerd Font carries the powerline/Nerd glyphs the
+  # tmux statusline uses (foot names it explicitly in home/sway.nix); Noto sans +
+  # colour emoji prevent tofu in terminals/TUIs/Firefox -- important on the WSL
+  # box, which does not pull the graphical hosts' default Noto stack. The Mac
+  # installs the Nerd Font via the Darwin config.
+  fonts.packages = with pkgs; [
+    nerd-fonts.jetbrains-mono
+    noto-fonts
+    noto-fonts-color-emoji
+  ];
+  # Map the generic fontconfig families so anything asking for "monospace" gets
+  # the Nerd Font (with emoji fallback), not DejaVu.
+  fonts.fontconfig.defaultFonts = {
+    monospace = [
+      "JetBrainsMono Nerd Font"
+      "Noto Color Emoji"
+    ];
+    sansSerif = [
+      "Noto Sans"
+      "Noto Color Emoji"
+    ];
+    serif = [
+      "Noto Serif"
+      "Noto Color Emoji"
+    ];
+    emoji = [ "Noto Color Emoji" ];
+  };
+}

modules/desktop.nix

@@ -0,0 +1,13 @@
+# Desktop (non-portable) NixOS hosts. Counterpart to ./laptop.nix: imports the
+# shared ./workstation.nix base and swaps the mobile Wi-Fi backend for wired
+# NetworkManager. A desktop host also sets `portable = false` in its host-table
+# entry (flake.nix), which drops the battery block and brightness keybindings
+# from the Sway bar -- see home/sway.nix.
+{ ... }:
+{
+  imports = [ ./workstation.nix ];
+
+  # Wired networking. NetworkManager handles DHCP/connections itself; do not
+  # combine with networking.wireless.* (laptop.nix) -- the two backends conflict.
+  networking.networkmanager.enable = true;
+}

modules/features.nix

@@ -0,0 +1,12 @@
+# Feature-flag option declarations shared by every NixOS host (imported via
+# baseModules in flake.nix). Declaring the flags here -- rather than inside the
+# module that implements them -- means a host can read or set a flag without
+# importing the (often large) implementation module. In particular,
+# features.swayDesktop.enable is read by modules/users.nix on every host, but a
+# headless host (e.g. the Pi) must be able to leave it at its default without
+# pulling in modules/sway.nix. The implementation lives in modules/sway.nix,
+# gated on this flag.
+{ lib, ... }:
+{
+  options.features.swayDesktop.enable = lib.mkEnableOption "the Sway desktop";
+}

modules/laptop.nix

@@ -0,0 +1,31 @@
+# Portable NixOS hosts (X1, MBP-Asahi). Imported from the host table in
+# flake.nix. Shared graphical-workstation settings live in ./workstation.nix;
+# the only laptop-specific bit is the Wi-Fi backend. Mobile home-manager
+# components (battery block, brightness keys) are gated by the `portable` flag
+# threaded through mkHost -- see home/sway.nix.
+{ ... }:
+{
+  imports = [ ./workstation.nix ];
+
+  # Wi-Fi via iwd with its built-in DHCP/network configuration.
+  networking.wireless.iwd = {
+    enable = true;
+    settings.General.EnableNetworkConfiguration = true;
+  };
+
+  # Lid behaviour: suspend on battery, lock on external power (swayidle's
+  # before-sleep hook locks before the suspend completes either way).
+  services.logind.settings.Login = {
+    HandleLidSwitch = "suspend";
+    HandleLidSwitchExternalPower = "lock";
+  };
+
+  # Bluetooth. The Asahi MBP loads Apple's BT firmware (see its host config) and
+  # the T400 has an optional BT module; enable bluez on both, with blueman as the
+  # GUI/tray manager for the Sway session.
+  hardware.bluetooth = {
+    enable = true;
+    powerOnBoot = true;
+  };
+  services.blueman.enable = true;
+}

modules/ssh.nix

@@ -0,0 +1,11 @@
+# Key-only sshd hardening, imported by hosts that run sshd (T400, Mac Pro,
+# RPi5). Authorized keys are owned per-user by the registry (modules/users.nix),
+# not here.
+{ ... }:
+{
+  services.openssh.settings = {
+    PasswordAuthentication = false; # keys only
+    KbdInteractiveAuthentication = false; # no keyboard-interactive fallback
+    PermitRootLogin = "no";
+  };
+}

modules/sway.nix

@@ -0,0 +1,161 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.features.swayDesktop;
+  # Catppuccin Mocha (shared with the Sway desktop, see home/sway.nix).
+  ctp = import ../lib/catppuccin-mocha.nix;
+in
+{
+  # The features.swayDesktop.enable option is declared in
+  # system/modules/features.nix (so headless hosts can read/set it without
+  # importing this module). This module only provides its implementation.
+  config = lib.mkIf cfg.enable {
+    programs.sway = {
+      enable = true;
+      wrapperFeatures.gtk = true;
+      extraSessionCommands = ''
+        # QT
+        export QT_QPA_PLATFORM="wayland;xcb"
+        export QT_QPA_PLATFORMTHEME=qt5ct
+        # SDL
+        export SDL_VIDEODRIVER=wayland
+        # Java
+        export _JAVA_AWT_WM_NONREPARENTING=1
+        # Misc
+        export CLUTTER_BACKEND=wayland
+        export WINIT_UNIX_BACKEND=wayland
+        export MOZ_ENABLE_WAYLAND=1
+      '';
+      # Core Wayland utilities. The lock screen, idle daemon, status bar and
+      # notification daemon are configured per-user in home/sway.nix.
+      extraPackages = with pkgs; [
+        brightnessctl
+        foot
+        grim
+        slurp # region selection for screenshots
+        swappy # screenshot annotation/save
+        jq # used by the focused-window screenshot bind
+        playerctl # MPRIS media keys
+        sway-launcher-desktop
+        pavucontrol
+      ];
+    };
+    fonts.packages = with pkgs; [
+      noto-fonts
+      noto-fonts-color-emoji
+      font-awesome
+    ];
+
+    # Wayland login screen (replaces console/getty login on every Sway host).
+    # greetd runs ReGreet inside the cage kiosk compositor; the Sway session is
+    # offered automatically because programs.sway registers itself via
+    # services.displayManager.sessionPackages. Hosts that turn off
+    # features.swayDesktop (e.g. EDaaS) keep plain TTY login.
+    programs.regreet.enable = true;
+    # Theme the greeter to match the Sway desktop (Catppuccin Mocha). ReGreet is
+    # GTK; recolour via CSS (covering both libadwaita named colours and plain
+    # GTK node selectors) and use the same Noto Sans as the bar/notifications.
+    programs.regreet.font = {
+      name = "Noto Sans";
+      package = pkgs.noto-fonts;
+      size = 16;
+    };
+    programs.regreet.extraCss = ''
+      /* GTK4 Adwaita legacy names (what plain GTK4 actually references). */
+      @define-color theme_bg_color #${ctp.base};
+      @define-color theme_fg_color #${ctp.text};
+      @define-color theme_base_color #${ctp.mantle};
+      @define-color theme_text_color #${ctp.text};
+      @define-color theme_selected_bg_color #${ctp.blue};
+      @define-color theme_selected_fg_color #${ctp.base};
+      @define-color insensitive_bg_color #${ctp.mantle};
+      @define-color insensitive_fg_color #${ctp.overlay0};
+      @define-color borders #${ctp.surface1};
+      @define-color warning_color #${ctp.peach};
+      @define-color error_color #${ctp.red};
+      @define-color success_color #${ctp.green};
+
+      /* libadwaita names (inert on plain GTK4, kept for forward-compat). */
+      @define-color window_bg_color #${ctp.base};
+      @define-color window_fg_color #${ctp.text};
+      @define-color view_bg_color #${ctp.mantle};
+      @define-color view_fg_color #${ctp.text};
+      @define-color card_bg_color #${ctp.surface0};
+      @define-color card_fg_color #${ctp.text};
+      @define-color accent_bg_color #${ctp.blue};
+      @define-color accent_fg_color #${ctp.base};
+      @define-color accent_color #${ctp.blue};
+      @define-color destructive_bg_color #${ctp.red};
+      @define-color destructive_fg_color #${ctp.base};
+
+      window {
+        background-color: #${ctp.base};
+        color: #${ctp.text};
+      }
+
+      label {
+        color: #${ctp.text};
+      }
+
+      entry {
+        background-color: #${ctp.surface0};
+        color: #${ctp.text};
+        border: 1px solid #${ctp.surface1};
+      }
+
+      entry:focus-within {
+        border-color: #${ctp.blue};
+      }
+
+      button,
+      combobox button {
+        background-color: #${ctp.surface0};
+        color: #${ctp.text};
+        border: 1px solid #${ctp.surface1};
+      }
+
+      button:hover {
+        background-color: #${ctp.surface1};
+      }
+
+      button:active,
+      button:checked {
+        background-color: #${ctp.blue};
+        color: #${ctp.base};
+      }
+    '';
+    # cage reads the XKB_* environment at startup, so force the greeter onto the
+    # same Dvorak layout as the Sway session (home/sway.nix) -- otherwise the
+    # password field would be QWERTY. Dvorak is the "us" layout's variant, NOT a
+    # layout of its own: "dvorak" alone has no symbols/ file, so the keymap
+    # fails to compile and the greeter ends up with no keyboard at all (the
+    # greeter has no fallback, unlike a running Sway session). This overrides the
+    # greetd command regreet sets with mkDefault.
+    services.greetd.settings.default_session.command =
+      let
+        greeter = pkgs.writeShellScript "regreet-cage" ''
+          export XKB_DEFAULT_LAYOUT=us
+          export XKB_DEFAULT_VARIANT=dvorak
+          # ReGreet is plain GTK4 (no libadwaita); force the dark Adwaita variant
+          # so the extraCss accents sit on a dark base instead of light Adwaita.
+          export GTK_THEME=Adwaita:dark
+          exec ${pkgs.dbus}/bin/dbus-run-session ${lib.getExe pkgs.cage} -s -- ${lib.getExe config.programs.regreet.package}
+        '';
+      in
+      "${greeter}";
+
+    # Desktop portals: enables screen sharing (wlroots) and native file pickers
+    # for Wayland apps such as Element and Firefox.
+    xdg.portal = {
+      enable = true;
+      wlr.enable = true;
+      extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
+      config.common.default = "*";
+    };
+  };
+}

modules/users.nix

@@ -0,0 +1,38 @@
+# System user accounts, built from the registry (users/registry.nix) for the
+# host's `hostUsers` set. See README "Users".
+{
+  config,
+  pkgs,
+  lib,
+  hostUsers,
+  userRegistry,
+  ...
+}:
+
+{
+  programs.zsh.enable = true;
+
+  users.users = lib.mapAttrs (
+    name: spec:
+    let
+      id = userRegistry.${name};
+    in
+    {
+      isNormalUser = true;
+      home = "/home/${name}";
+      description = id.fullName;
+      inherit (id) extraGroups;
+      openssh.authorizedKeys.keys = id.sshAuthorizedKeys;
+      shell = pkgs.zsh;
+    }
+    # linger opt-in (host table); left unmanaged when unset.
+    // lib.optionalAttrs (spec ? linger) { inherit (spec) linger; }
+  ) hostUsers;
+
+  programs.firefox = lib.mkIf (config.features.swayDesktop.enable == true) {
+    enable = true;
+  };
+  programs.thunderbird = lib.mkIf (config.features.swayDesktop.enable == true) {
+    enable = true;
+  };
+}

modules/workstation.nix

@@ -0,0 +1,49 @@
+# Form-factor-agnostic base for the physical graphical NixOS machines. Imported
+# by both ./laptop.nix and ./desktop.nix; those add only the bits that differ
+# between portable and desktop hosts (chiefly the networking backend).
+#
+# The bootloader is NOT set here -- it is firmware-specific, not form-factor:
+# UEFI hosts (MBP, Mac Pro 3,1) use systemd-boot, the BIOS-only T400 uses GRUB.
+# Each machine config declares its own.
+{ lib, pkgs, ... }:
+{
+  features.swayDesktop.enable = true;
+
+  console.keyMap = "dvorak";
+
+  # Intel thermal management. x86 only -- the Asahi MBP governs its own SoC
+  # thermals, and thermald is an Intel-platform daemon.
+  services.thermald.enable = lib.mkIf pkgs.stdenv.hostPlatform.isx86_64 true;
+
+  # Default-deny inbound. Hosts that run a listening service open their own
+  # ports next to where the service is enabled (e.g. sshd -> 22 on X1).
+  networking.firewall.enable = true;
+
+  # Disk hygiene for the physical hosts. fstrim reclaims unused SSD blocks on a
+  # weekly timer; cleanOnBoot wipes /tmp at every boot.
+  services.fstrim.enable = true;
+  boot.tmp.cleanOnBoot = true;
+
+  # Userspace OOM killer: act on memory pressure early instead of letting the
+  # kernel OOM-thrash. Matters on the 4 GiB T400 and the elderly Mac Pro.
+  services.earlyoom.enable = true;
+
+  # Firmware updates via LVFS. No-op on the Asahi MBP (Apple-managed firmware),
+  # useful for UEFI/SSD updates on the x86 hosts.
+  services.fwupd.enable = true;
+
+  # Audio. PipeWire with the PulseAudio shim covers every graphical host; no
+  # per-machine audio config is needed.
+  services.pipewire = {
+    enable = true;
+    pulse.enable = true;
+  };
+
+  # swaylock PAM stack. None of these machines has working fingerprint auth, so
+  # an empty service is enough -- swaylock falls back to password.
+  security.pam.services.swaylock = { };
+
+  # Redistributable firmware (GPU/Wi-Fi/NIC blobs) for the x86 hosts. Harmless
+  # on the Asahi MBP, which supplies its own peripheral firmware out-of-band.
+  hardware.enableRedistributableFirmware = true;
+}