Refactor/flake dedup and wsl input (#3)

* fix: configure docker for EDaaS WSL VDI

Enable rootful docker with the Docker Desktop proxy patch, add emmathorpe to the docker group, disable resolvconf and enable nix-ld.

* feat: flesh out work module and pin claude-code to nixpkgs unstable

Migrate git config to the settings option, fix the signing key path and email, add argo-rollouts/google-cloud-sdk and other tooling, and enable go. claude-code is sourced from the nixpkgs-unstable overlay.

* chore: update personal git, delta and editor config

Move git config to the settings option, switch to the standalone programs.delta module with git integration, add commitizen, and treat Jenkinsfiles as groovy.

* refactor: dedupe flake with mkHost and add nixos-wsl flake input

Extract a shared mkHost helper to remove duplicated home-manager scaffolding, add nixos-wsl as a flake input so the EDaaS host builds without --impure, source claude-code via a nixpkgs-unstable overlay, and expose a nixfmt formatter output.

* style: format nix files with nixfmt

* refactor: migrate to stable nixpkgs 26.05 and track upstream asahi flake

Pin nixpkgs to nixos-26.05 and home-manager to release-26.05; claude-code stays bleeding-edge via the nixpkgs-unstable overlay.

Centralize allowUnfree and experimental-features in mkHost and pin nix.registry/nixPath to the flake nixpkgs.

Replace the vendored apple-silicon-support module with the nixos-apple-silicon flake input, dropping ~8.8k lines of vendored code.

Fix stable-induced package renames: neofetch -> fastfetch, noto-fonts-emoji -> noto-fonts-color-emoji.

* refactor: adopt flake-parts with host table and scoped unfree

Wrap outputs in flake-parts.lib.mkFlake, replacing forAllSystems boilerplate with systems + perSystem. Drop the unused self argument.

Collapse the three mkHost calls into a hosts attrset mapped with lib.mapAttrs; adding a machine is now a single table entry.

Replace blanket allowUnfree with an allowUnfreePredicate allowlist (claude-code, lens). Add devShells.default (nixfmt, nil, git) and a checks.formatting nixfmt --check gate.

* docs(flake): annotate inputs, mkHost, host table and perSystem

Explanatory comments only; no eval change (drvPath identical).

* refactor(home): split home-manager into focused modules; clarify desktop scope

Break the home.nix monolith into emmathorpe/home/{default,shell,git,editor,desktop}.nix. The host table now composes desktop.nix onto graphical hosts only, so element-desktop, the Sway session vars and cursor theme are no longer installed on the headless WSL host.

Consolidate chat apps: legcord moves from user.nix (system) into the home desktop module alongside element-desktop. The tty1 'exec sway' autostart moves into desktop.nix so it never runs on headless hosts.

Desktop functionality: add xdg.portal (wlr + gtk) in swaywm.nix to enable screen sharing and native file pickers for Element and Firefox under wlroots.

* feat(desktop): declarative Sway config with idle-lock, notifications and bar

Add emmathorpe/home/sway.nix managing wayland.windowManager.sway (package = null, reusing the system Sway wrapper) plus swaylock, swayidle, dunst and an i3status-rust bar. home-manager's systemd integration wires sway-session.target so the swayidle/dunst user services start with the session.

swayidle locks after 5 min, powers outputs off after 10, and locks before sleep. Media/brightness keys use wpctl (pipewire) and brightnessctl; the launcher is sway-launcher-desktop in a floating foot window; keyboard is set to dvorak to match the console.

Move swaylock/swayidle/dunst/i3status-rust out of the system programs.sway extraPackages (now home-managed). Add security.pam.services.swaylock on the MBP host so the lock screen can authenticate (X1 already had it with fingerprint auth).

---------

Co-authored-by: Emma Thorpe <emma.thorpe@citrix.com>

emmathorpe/home/sway.nix

@@ -0,0 +1,133 @@
+# Declarative Sway window manager, status bar, lock, idle and notifications.
+# Imported via ./desktop.nix, so only graphical hosts get it.
+#
+# The compositor binary, PAM and polkit integration come from the system-level
+# programs.sway (see ../swaywm.nix); package = null below reuses it instead of
+# pulling a second Sway. home-manager owns the user config (~/.config/sway) and
+# wires the systemd user session (sway-session.target), which is what lets the
+# swayidle/dunst user services start with the desktop.
+{ pkgs, lib, ... }:
+{
+  wayland.windowManager.sway = {
+    enable = true;
+    package = null;
+    # `sway --validate` needs a real package; skip it since package = null.
+    checkConfig = false;
+    config = rec {
+      modifier = "Mod4";
+      terminal = "${pkgs.foot}/bin/foot";
+      # Launcher: sway-launcher-desktop running inside a floating foot window.
+      menu = "${pkgs.foot}/bin/foot --app-id=launcher ${pkgs.sway-launcher-desktop}/bin/sway-launcher-desktop";
+
+      input."type:keyboard".xkb_layout = "dvorak";
+
+      window.commands = [
+        {
+          criteria.app_id = "launcher";
+          command = "floating enable, resize set 800 500";
+        }
+      ];
+
+      bars = [
+        {
+          position = "top";
+          statusCommand = "${pkgs.i3status-rust}/bin/i3status-rs ~/.config/i3status-rust/config-default.toml";
+          fonts = {
+            names = [
+              "Noto Sans"
+              "Font Awesome 6 Free"
+            ];
+            size = 11.0;
+          };
+        }
+      ];
+
+      keybindings = lib.mkOptionDefault {
+        "${modifier}+l" = "exec ${pkgs.swaylock}/bin/swaylock -f";
+        "Print" = "exec ${pkgs.grim}/bin/grim ~/screenshot-$(date +%F-%H%M%S).png";
+        "XF86MonBrightnessUp" = "exec ${pkgs.brightnessctl}/bin/brightnessctl set 5%+";
+        "XF86MonBrightnessDown" = "exec ${pkgs.brightnessctl}/bin/brightnessctl set 5%-";
+        "XF86AudioRaiseVolume" = "exec ${pkgs.wireplumber}/bin/wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%+";
+        "XF86AudioLowerVolume" = "exec ${pkgs.wireplumber}/bin/wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%-";
+        "XF86AudioMute" = "exec ${pkgs.wireplumber}/bin/wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle";
+      };
+    };
+  };
+
+  programs.swaylock = {
+    enable = true;
+    settings = {
+      color = "1e1e2e";
+      indicator-radius = 100;
+      indicator-thickness = 7;
+      show-failed-attempts = true;
+    };
+  };
+
+  # Lock on idle, turn screens off shortly after, and lock before sleep.
+  services.swayidle = {
+    enable = true;
+    timeouts = [
+      {
+        timeout = 300;
+        command = "${pkgs.swaylock}/bin/swaylock -f";
+      }
+      {
+        timeout = 600;
+        command = "${pkgs.sway}/bin/swaymsg 'output * power off'";
+        resumeCommand = "${pkgs.sway}/bin/swaymsg 'output * power on'";
+      }
+    ];
+    events = {
+      before-sleep = "${pkgs.swaylock}/bin/swaylock -f";
+      lock = "${pkgs.swaylock}/bin/swaylock -f";
+    };
+  };
+
+  services.dunst = {
+    enable = true;
+    settings = {
+      global = {
+        font = "Noto Sans 11";
+        frame_color = "#89b4fa";
+        separator_color = "frame";
+        offset = "10x10";
+        corner_radius = 5;
+      };
+      urgency_critical = {
+        frame_color = "#fab387";
+        timeout = 0;
+      };
+    };
+  };
+
+  programs.i3status-rust = {
+    enable = true;
+    bars.default = {
+      theme = "gruvbox-dark";
+      icons = "awesome6";
+      blocks = [
+        {
+          block = "disk_space";
+          path = "/";
+          format = " $icon $available ";
+        }
+        {
+          block = "memory";
+          format = " $icon $mem_used_percents ";
+        }
+        {
+          block = "cpu";
+          interval = 2;
+        }
+        { block = "sound"; }
+        { block = "battery"; }
+        {
+          block = "time";
+          interval = 5;
+          format = " $timestamp.datetime(f:'%a %d/%m %R') ";
+        }
+      ];
+    };
+  };
+}