From c06a57f24957ee3bff88d79b8d4343213f03c0f0 Mon Sep 17 00:00:00 2001 From: lyrathorpe Date: Mon, 29 Jun 2026 14:09:38 +0100 Subject: [PATCH] chore: post-refactor cleanups (#50-#53) (#54) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary Follow-up cleanups from the post-refactor audit (issues #50–#53). All behaviour-preserving except the work-host changes (kube-tmux + Lens removal). ## Changes - **#51** `refactor(ssh)` — move `services.openssh.enable` + `firewall.allowedTCPPorts = [ 22 ]` into `modules/ssh.nix`; drop the duplicated lines from T400, MacPro31, RPi5. - **#50** `fix/feat(work)` — load kube-tmux from a pinned `flake = false` input (it is not in nixpkgs) and reference `${inputs.kube-tmux}/kube.tmux` directly, so the status line no longer depends on a manual `$HOME/code/kube-tmux` checkout. (Supersedes the interim file-existence guard.) - **#52** `chore` — gitignore the untracked `tf-inspect/` scratch project. - **#53** `chore` — remove the unused Lens package entirely (`pkgs.lens` + its unfree entry; `unfreePackages` is now just `claude-code`), fix the `nil`→`nil_ls` LSP doc, remove the redundant `.editorconfig` block, name the RPi5 Docker subnet in a `let` binding. ## Deferred (from #53, noted in the commit) - `.gitignore` firmware entry — documented behaviour, low value, left as-is. - Per-eval `nixpkgs-unstable` overlay import — inherently per-system; no clean single-import hoist. ## Verification - `nix flake check` passes (treefmt, deadnix, statix, pre-commit, all hosts + Darwin + homeConfigurations). - Derivation-path diff vs `main`: `lyrathorpe-mbp`, `lyrathorpe-t400`, `lyrathorpe-macpro31`, `lyrathorpe-rpi5` are byte-identical (confirms #51 and the subnet `let` binding change nothing). Only `emmathorpe-edaas` differs — the kube-tmux input (#50) and the Lens removal (#53). Closes #50, #51, #52, #53. --------- Co-authored-by: Emma Thorpe Reviewed-on: https://code.emmathe.dev/lyrathorpe/nixfiles/pulls/54 --- .editorconfig | 6 ------ .gitignore | 3 +++ flake.lock | 17 ++++++++++++++++ flake.nix | 9 +++++++-- home/README.md | 34 ++++++++++++++++---------------- hosts/MacPro31/configuration.nix | 6 ++---- hosts/RPi5/configuration.nix | 11 ++++------- hosts/RPi5/docker.nix | 6 +++++- hosts/T400/configuration.nix | 6 ++---- modules/ssh.nix | 9 ++++++--- users/emmathorpe/work.nix | 12 ++++++++--- 11 files changed, 72 insertions(+), 47 deletions(-) diff --git a/.editorconfig b/.editorconfig index 6b19e96..18a0a98 100644 --- a/.editorconfig +++ b/.editorconfig @@ -8,12 +8,6 @@ indent_size = 2 trim_trailing_whitespace = true insert_final_newline = true -[*.{nix,yaml,yml,json,md,sh,toml}] -indent_style = space -indent_size = 2 -trim_trailing_whitespace = true -insert_final_newline = true - # Markdown uses trailing whitespace for hard line breaks. [*.md] trim_trailing_whitespace = false diff --git a/.gitignore b/.gitignore index 596783b..d9b9b84 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,6 @@ modules/firmware/* # vim swap files *.swp + +# Local scratch project, not part of this flake. +tf-inspect/ diff --git a/flake.lock b/flake.lock index 21b3b7d..8f2afd1 100644 --- a/flake.lock +++ b/flake.lock @@ -191,6 +191,22 @@ "type": "github" } }, + "kube-tmux": { + "flake": false, + "locked": { + "lastModified": 1779714285, + "narHash": "sha256-l1wjg2ReWKCI7h/K11vvX2ykYTs/mVD+tfz/mQsjn/E=", + "owner": "jonmosco", + "repo": "kube-tmux", + "rev": "8b7e1d127c16b6dc87ff5743f4d775b245198b69", + "type": "github" + }, + "original": { + "owner": "jonmosco", + "repo": "kube-tmux", + "type": "github" + } + }, "nix-darwin": { "inputs": { "nixpkgs": [ @@ -373,6 +389,7 @@ "flake-parts": "flake-parts", "git-hooks": "git-hooks", "home-manager": "home-manager", + "kube-tmux": "kube-tmux", "nix-darwin": "nix-darwin", "nix-homebrew": "nix-homebrew", "nix-index-database": "nix-index-database", diff --git a/flake.nix b/flake.nix index 2f6a4dd..87bc70d 100644 --- a/flake.nix +++ b/flake.nix @@ -60,6 +60,13 @@ url = "github:NixOS/nixos-hardware"; inputs.nixpkgs.follows = "nixpkgs"; }; + # kube-tmux: kube context/namespace for the tmux status line on the work + # host. Not in nixpkgs and not a flake -- pinned here as a plain source so + # the script is always in the store (no manual checkout). See work.nix. + kube-tmux = { + url = "github:jonmosco/kube-tmux"; + flake = false; + }; }; outputs = @@ -93,8 +100,6 @@ # Unfree packages permitted to be built (replaces blanket allowUnfree). unfreePackages = [ "claude-code" - "lens" - "lens-desktop" ]; # Per-user identity, keyed by username. See README "Users". diff --git a/home/README.md b/home/README.md index e100128..173f1d9 100644 --- a/home/README.md +++ b/home/README.md @@ -110,23 +110,23 @@ declaratively with **nixvim**, so the same plugins and config are baked in on every host. Migrated from plain vim; the practical gain is a real LSP stack in place of the old (inert) ALE. -| Feature | Notes | -| -------------- | -------------------------------------------------------------------------------------- | -| Colorscheme | Catppuccin Mocha (matches the terminal and the rest of the desktop) | -| File tree | nvim-tree, toggled with `,,` (comma twice; was nerdtree) | -| Fuzzy finder | telescope (+fzf-native): `ff` files, `fg` grep, `fb` buffers | -| Format on save | conform-nvim (nixfmt, stylua, ruff, shfmt, prettier, gofumpt; LSP fallback otherwise) | -| Git | fugitive (`:Git …`) + gitsigns gutter signs/blame | -| Diagnostics | inline + trouble list (`xx`) | -| Completion | nvim-cmp (LSP/buffer/path) with luasnip snippet expansion | -| Indent guides | indent-blankline, on by default (was vim-indent-guides) | -| Statusline | lualine (Catppuccin theme) | -| Editing | which-key hints, comment (`gc`/`gcc`), autopairs, treesitter textobjects | -| Pane nav | vim-tmux-navigator — `Ctrl`+`h/j/k/l` moves across vim splits and tmux panes | -| Syntax | tree-sitter (nix, lua, bash, markdown, groovy, c#, python, terraform, yaml) | -| LSP | nvim-cmp completion + servers `nil` (Nix), `lua_ls`, `pyright` (Python), `terraformls` | -| Indentation | 2-wide hard tabs (`noexpandtab`, `tabstop`/`shiftwidth` = 2); line numbers on | -| Filetypes | `*Jenkinsfile` → groovy | +| Feature | Notes | +| -------------- | ----------------------------------------------------------------------------------------- | +| Colorscheme | Catppuccin Mocha (matches the terminal and the rest of the desktop) | +| File tree | nvim-tree, toggled with `,,` (comma twice; was nerdtree) | +| Fuzzy finder | telescope (+fzf-native): `ff` files, `fg` grep, `fb` buffers | +| Format on save | conform-nvim (nixfmt, stylua, ruff, shfmt, prettier, gofumpt; LSP fallback otherwise) | +| Git | fugitive (`:Git …`) + gitsigns gutter signs/blame | +| Diagnostics | inline + trouble list (`xx`) | +| Completion | nvim-cmp (LSP/buffer/path) with luasnip snippet expansion | +| Indent guides | indent-blankline, on by default (was vim-indent-guides) | +| Statusline | lualine (Catppuccin theme) | +| Editing | which-key hints, comment (`gc`/`gcc`), autopairs, treesitter textobjects | +| Pane nav | vim-tmux-navigator — `Ctrl`+`h/j/k/l` moves across vim splits and tmux panes | +| Syntax | tree-sitter (nix, lua, bash, markdown, groovy, c#, python, terraform, yaml) | +| LSP | nvim-cmp completion + servers `nil_ls` (Nix), `lua_ls`, `pyright` (Python), `terraformls` | +| Indentation | 2-wide hard tabs (`noexpandtab`, `tabstop`/`shiftwidth` = 2); line numbers on | +| Filetypes | `*Jenkinsfile` → groovy | Leader is `Space`. LSP keymaps (`gd`, `gr`, `K`, `rn`, `ca`) and the file-tree toggle are listed in diff --git a/hosts/MacPro31/configuration.nix b/hosts/MacPro31/configuration.nix index 77b1a16..6faae6d 100644 --- a/hosts/MacPro31/configuration.nix +++ b/hosts/MacPro31/configuration.nix @@ -26,10 +26,8 @@ # workstation.nix is the backstop). zramSwap.enable = true; - # This host accepts SSH, so open 22 (the firewall itself is enabled in - # workstation.nix with a default-deny policy). - services.openssh.enable = true; - networking.firewall.allowedTCPPorts = [ 22 ]; + # sshd (daemon, port 22, key-only policy) comes from ../../modules/ssh.nix; + # the firewall itself is enabled in workstation.nix with a default-deny policy. # Dual Harpertown Xeon microcode. Redistributable firmware (GPU/NIC blobs) is # enabled in workstation.nix. diff --git a/hosts/RPi5/configuration.nix b/hosts/RPi5/configuration.nix index 632c6da..4e3630d 100644 --- a/hosts/RPi5/configuration.nix +++ b/hosts/RPi5/configuration.nix @@ -25,15 +25,12 @@ boot.loader.grub.enable = false; boot.loader.generic-extlinux-compatible.enable = true; - # Remote administration. Key-only policy and the authorized key come from - # ../../modules/ssh.nix; here we just enable the daemon and open the port. - services.openssh.enable = true; + # Remote administration: the daemon, port 22 and key-only policy all come from + # ../../modules/ssh.nix. - # Default-deny inbound. Open only SSH here; the Docker and nginx submodules - # open their own ports (Docker via a source-restricted nftables rule, nginx - # via 80/443). List-valued, so these merge with the submodule definitions. + # Default-deny inbound; the Docker and nginx submodules open their own ports + # (Docker via a source-restricted nftables rule, nginx via 80/443). networking.firewall.enable = true; - networking.firewall.allowedTCPPorts = [ 22 ]; # See `man configuration.nix` / the stateVersion docs before changing. system.stateVersion = "26.05"; diff --git a/hosts/RPi5/docker.nix b/hosts/RPi5/docker.nix index ff4dc88..1fe1b4f 100644 --- a/hosts/RPi5/docker.nix +++ b/hosts/RPi5/docker.nix @@ -8,6 +8,10 @@ # secure upgrade path is mutual TLS on 2376 (--tlsverify with client certs); # that needs out-of-band cert provisioning and is intentionally not wired here. { ... }: +let + # LAN allowed to reach the unauthenticated Docker TCP socket (see SECURITY above). + trustedSubnet = "10.187.1.0/24"; +in { virtualisation.docker.enable = true; @@ -29,6 +33,6 @@ # CIDR to match the LAN that should reach the Docker API. networking.nftables.enable = true; networking.firewall.extraInputRules = '' - ip saddr 10.187.1.0/24 tcp dport 2375 accept + ip saddr ${trustedSubnet} tcp dport 2375 accept ''; } diff --git a/hosts/T400/configuration.nix b/hosts/T400/configuration.nix index 52c8931..96c05d1 100644 --- a/hosts/T400/configuration.nix +++ b/hosts/T400/configuration.nix @@ -21,10 +21,8 @@ # Low-RAM host (4 GiB max): a compressed RAM swap reduces disk paging. zramSwap.enable = true; - # This host accepts SSH, so open 22 (the firewall itself is enabled in - # laptop.nix with a default-deny policy). - services.openssh.enable = true; - networking.firewall.allowedTCPPorts = [ 22 ]; + # sshd (daemon, port 22, key-only policy) comes from ../../modules/ssh.nix; + # the firewall itself is enabled in laptop.nix with a default-deny policy. # Intel Core 2 (Penryn) microcode. Redistributable firmware (enabled in # workstation.nix) supplies the iwlwifi blobs (Intel WiFi Link 5100/5300) and diff --git a/modules/ssh.nix b/modules/ssh.nix index f56ec95..f486656 100644 --- a/modules/ssh.nix +++ b/modules/ssh.nix @@ -1,8 +1,11 @@ -# Key-only sshd hardening, imported by hosts that run sshd (T400, Mac Pro, -# RPi5). Authorized keys are owned per-user by the registry (modules/users.nix), -# not here. +# sshd for the hosts that run it (T400, Mac Pro, RPi5): enable the daemon, open +# port 22, and apply a key-only policy. Authorized keys are owned per-user by the +# registry (modules/users.nix), not here. { ... }: { + services.openssh.enable = true; + networking.firewall.allowedTCPPorts = [ 22 ]; + services.openssh.settings = { PasswordAuthentication = false; # keys only KbdInteractiveAuthentication = false; # no keyboard-interactive fallback diff --git a/users/emmathorpe/work.nix b/users/emmathorpe/work.nix index 049f047..1b76ffc 100644 --- a/users/emmathorpe/work.nix +++ b/users/emmathorpe/work.nix @@ -1,6 +1,11 @@ # Work (EDaaS/WSL) home profile: corporate toolchain + tmux tweaks. Git identity # comes from the registry (users/registry.nix), not here. -{ pkgs, lib, ... }: +{ + pkgs, + lib, + inputs, + ... +}: { # Host-scoped extras for this machine only (the EDaaS/WSL host). @@ -24,7 +29,6 @@ pkgs.powershell pkgs.nuget pkgs.gedit - pkgs.lens pkgs.python3 pkgs.gnumake pkgs.gcc @@ -48,8 +52,10 @@ docker = "/run/current-system/sw/bin/docker"; }; programs.tmux = { + # kube context/namespace in the status line. kube-tmux is pinned as a flake + # input (it is not in nixpkgs), so the script is always present in the store. extraConfig = '' - set -g status-right "#(/run/current-system/sw/bin/bash $HOME/code/kube-tmux/kube.tmux 250 red black)" + set -g status-right "#(${pkgs.bash}/bin/bash ${inputs.kube-tmux}/kube.tmux 250 red black)" ''; }; programs.go = {