chore: post-refactor cleanups (#50-#53) (#54)

## Summary

Follow-up cleanups from the post-refactor audit (issues #50–#53). All behaviour-preserving except the work-host changes (kube-tmux + Lens removal).

## Changes

- **#51** `refactor(ssh)` — move `services.openssh.enable` + `firewall.allowedTCPPorts = [ 22 ]` into `modules/ssh.nix`; drop the duplicated lines from T400, MacPro31, RPi5.
- **#50** `fix/feat(work)` — load kube-tmux from a pinned `flake = false` input (it is not in nixpkgs) and reference `${inputs.kube-tmux}/kube.tmux` directly, so the status line no longer depends on a manual `$HOME/code/kube-tmux` checkout. (Supersedes the interim file-existence guard.)
- **#52** `chore` — gitignore the untracked `tf-inspect/` scratch project.
- **#53** `chore` — remove the unused Lens package entirely (`pkgs.lens` + its unfree entry; `unfreePackages` is now just `claude-code`), fix the `nil`→`nil_ls` LSP doc, remove the redundant `.editorconfig` block, name the RPi5 Docker subnet in a `let` binding.

## Deferred (from #53, noted in the commit)

- `.gitignore` firmware entry — documented behaviour, low value, left as-is.
- Per-eval `nixpkgs-unstable` overlay import — inherently per-system; no clean single-import hoist.

## Verification

- `nix flake check` passes (treefmt, deadnix, statix, pre-commit, all hosts + Darwin + homeConfigurations).
- Derivation-path diff vs `main`: `lyrathorpe-mbp`, `lyrathorpe-t400`, `lyrathorpe-macpro31`, `lyrathorpe-rpi5` are byte-identical (confirms #51 and the subnet `let` binding change nothing). Only `emmathorpe-edaas` differs — the kube-tmux input (#50) and the Lens removal (#53).

Closes #50, #51, #52, #53.

---------

Co-authored-by: Emma Thorpe <emma.thorpe@citrix.com>
Reviewed-on: #54

.editorconfig

@@ -8,12 +8,6 @@ indent_size = 2
 trim_trailing_whitespace = true
 insert_final_newline = true
 
-[*.{nix,yaml,yml,json,md,sh,toml}]
-indent_style = space
-indent_size = 2
-trim_trailing_whitespace = true
-insert_final_newline = true
-
 # Markdown uses trailing whitespace for hard line breaks.
 [*.md]
 trim_trailing_whitespace = false

.gitignore

@@ -2,3 +2,6 @@ modules/firmware/*
 
 # vim swap files
 *.swp
+
+# Local scratch project, not part of this flake.
+tf-inspect/

flake.lock

@@ -191,6 +191,22 @@
         "type": "github"
       }
     },
+    "kube-tmux": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1779714285,
+        "narHash": "sha256-l1wjg2ReWKCI7h/K11vvX2ykYTs/mVD+tfz/mQsjn/E=",
+        "owner": "jonmosco",
+        "repo": "kube-tmux",
+        "rev": "8b7e1d127c16b6dc87ff5743f4d775b245198b69",
+        "type": "github"
+      },
+      "original": {
+        "owner": "jonmosco",
+        "repo": "kube-tmux",
+        "type": "github"
+      }
+    },
     "nix-darwin": {
       "inputs": {
         "nixpkgs": [
@@ -373,6 +389,7 @@
         "flake-parts": "flake-parts",
         "git-hooks": "git-hooks",
         "home-manager": "home-manager",
+        "kube-tmux": "kube-tmux",
         "nix-darwin": "nix-darwin",
         "nix-homebrew": "nix-homebrew",
         "nix-index-database": "nix-index-database",

flake.nix

@@ -60,6 +60,13 @@
       url = "github:NixOS/nixos-hardware";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    # kube-tmux: kube context/namespace for the tmux status line on the work
+    # host. Not in nixpkgs and not a flake -- pinned here as a plain source so
+    # the script is always in the store (no manual checkout). See work.nix.
+    kube-tmux = {
+      url = "github:jonmosco/kube-tmux";
+      flake = false;
+    };
   };
 
   outputs =
@@ -93,8 +100,6 @@
         # Unfree packages permitted to be built (replaces blanket allowUnfree).
         unfreePackages = [
           "claude-code"
-          "lens"
-          "lens-desktop"
         ];
 
         # Per-user identity, keyed by username. See README "Users".

home/README.md

@@ -111,7 +111,7 @@ every host. Migrated from plain vim; the practical gain is a real LSP stack in
 place of the old (inert) ALE.
 
 | Feature        | Notes                                                                                     |
-| -------------- | -------------------------------------------------------------------------------------- |
+| -------------- | ----------------------------------------------------------------------------------------- |
 | Colorscheme    | Catppuccin Mocha (matches the terminal and the rest of the desktop)                       |
 | File tree      | nvim-tree, toggled with `,,` (comma twice; was nerdtree)                                  |
 | Fuzzy finder   | telescope (+fzf-native): `<leader>ff` files, `<leader>fg` grep, `<leader>fb` buffers      |
@@ -124,7 +124,7 @@ place of the old (inert) ALE.
 | Editing        | which-key hints, comment (`gc`/`gcc`), autopairs, treesitter textobjects                  |
 | Pane nav       | vim-tmux-navigator — `Ctrl`+`h/j/k/l` moves across vim splits and tmux panes              |
 | Syntax         | tree-sitter (nix, lua, bash, markdown, groovy, c#, python, terraform, yaml)               |
-| LSP            | nvim-cmp completion + servers `nil` (Nix), `lua_ls`, `pyright` (Python), `terraformls` |
+| LSP            | nvim-cmp completion + servers `nil_ls` (Nix), `lua_ls`, `pyright` (Python), `terraformls` |
 | Indentation    | 2-wide hard tabs (`noexpandtab`, `tabstop`/`shiftwidth` = 2); line numbers on             |
 | Filetypes      | `*Jenkinsfile` → groovy                                                                   |
 

hosts/MacPro31/configuration.nix

@@ -26,10 +26,8 @@
   # workstation.nix is the backstop).
   zramSwap.enable = true;
 
-  # This host accepts SSH, so open 22 (the firewall itself is enabled in
-  # workstation.nix with a default-deny policy).
-  services.openssh.enable = true;
-  networking.firewall.allowedTCPPorts = [ 22 ];
+  # sshd (daemon, port 22, key-only policy) comes from ../../modules/ssh.nix;
+  # the firewall itself is enabled in workstation.nix with a default-deny policy.
 
   # Dual Harpertown Xeon microcode. Redistributable firmware (GPU/NIC blobs) is
   # enabled in workstation.nix.

hosts/RPi5/configuration.nix

@@ -25,15 +25,12 @@
   boot.loader.grub.enable = false;
   boot.loader.generic-extlinux-compatible.enable = true;
 
-  # Remote administration. Key-only policy and the authorized key come from
-  # ../../modules/ssh.nix; here we just enable the daemon and open the port.
-  services.openssh.enable = true;
+  # Remote administration: the daemon, port 22 and key-only policy all come from
+  # ../../modules/ssh.nix.
 
-  # Default-deny inbound. Open only SSH here; the Docker and nginx submodules
-  # open their own ports (Docker via a source-restricted nftables rule, nginx
-  # via 80/443). List-valued, so these merge with the submodule definitions.
+  # Default-deny inbound; the Docker and nginx submodules open their own ports
+  # (Docker via a source-restricted nftables rule, nginx via 80/443).
   networking.firewall.enable = true;
-  networking.firewall.allowedTCPPorts = [ 22 ];
 
   # See `man configuration.nix` / the stateVersion docs before changing.
   system.stateVersion = "26.05";

hosts/RPi5/docker.nix

@@ -8,6 +8,10 @@
 # secure upgrade path is mutual TLS on 2376 (--tlsverify with client certs);
 # that needs out-of-band cert provisioning and is intentionally not wired here.
 { ... }:
+let
+  # LAN allowed to reach the unauthenticated Docker TCP socket (see SECURITY above).
+  trustedSubnet = "10.187.1.0/24";
+in
 {
   virtualisation.docker.enable = true;
 
@@ -29,6 +33,6 @@
   # CIDR to match the LAN that should reach the Docker API.
   networking.nftables.enable = true;
   networking.firewall.extraInputRules = ''
-    ip saddr 10.187.1.0/24 tcp dport 2375 accept
+    ip saddr ${trustedSubnet} tcp dport 2375 accept
   '';
 }

hosts/T400/configuration.nix

@@ -21,10 +21,8 @@
   # Low-RAM host (4 GiB max): a compressed RAM swap reduces disk paging.
   zramSwap.enable = true;
 
-  # This host accepts SSH, so open 22 (the firewall itself is enabled in
-  # laptop.nix with a default-deny policy).
-  services.openssh.enable = true;
-  networking.firewall.allowedTCPPorts = [ 22 ];
+  # sshd (daemon, port 22, key-only policy) comes from ../../modules/ssh.nix;
+  # the firewall itself is enabled in laptop.nix with a default-deny policy.
 
   # Intel Core 2 (Penryn) microcode. Redistributable firmware (enabled in
   # workstation.nix) supplies the iwlwifi blobs (Intel WiFi Link 5100/5300) and

modules/ssh.nix

@@ -1,8 +1,11 @@
-# Key-only sshd hardening, imported by hosts that run sshd (T400, Mac Pro,
-# RPi5). Authorized keys are owned per-user by the registry (modules/users.nix),
-# not here.
+# sshd for the hosts that run it (T400, Mac Pro, RPi5): enable the daemon, open
+# port 22, and apply a key-only policy. Authorized keys are owned per-user by the
+# registry (modules/users.nix), not here.
 { ... }:
 {
+  services.openssh.enable = true;
+  networking.firewall.allowedTCPPorts = [ 22 ];
+
   services.openssh.settings = {
     PasswordAuthentication = false; # keys only
     KbdInteractiveAuthentication = false; # no keyboard-interactive fallback

users/emmathorpe/work.nix

@@ -1,6 +1,11 @@
 # Work (EDaaS/WSL) home profile: corporate toolchain + tmux tweaks. Git identity
 # comes from the registry (users/registry.nix), not here.
-{ pkgs, lib, ... }:
+{
+  pkgs,
+  lib,
+  inputs,
+  ...
+}:
 
 {
   # Host-scoped extras for this machine only (the EDaaS/WSL host).
@@ -24,7 +29,6 @@
     pkgs.powershell
     pkgs.nuget
     pkgs.gedit
-    pkgs.lens
     pkgs.python3
     pkgs.gnumake
     pkgs.gcc
@@ -48,8 +52,10 @@
     docker = "/run/current-system/sw/bin/docker";
   };
   programs.tmux = {
+    # kube context/namespace in the status line. kube-tmux is pinned as a flake
+    # input (it is not in nixpkgs), so the script is always present in the store.
     extraConfig = ''
-      			set -g status-right "#(/run/current-system/sw/bin/bash $HOME/code/kube-tmux/kube.tmux 250 red black)"		
+      set -g status-right "#(${pkgs.bash}/bin/bash ${inputs.kube-tmux}/kube.tmux 250 red black)"
     '';
   };
   programs.go = {