New x86_64 host for a 4th-gen Core i7 (Haswell) with a GTX 1070 8 GB,
wired to a television and driven with a Bluetooth controller.
Session: greetd gets an initial_session, so the machine autologins into
the gamescope Steam session at boot with no greeter and no keyboard.
Quitting Steam falls back to greetd's default_session (ReGreet), where
the ordinary Sway session is available for keyboard-and-mouse work.
Graphics: the GTX 1070 is Pascal, so it needs driver branch 580
(nvidiaPackages.legacy_580) like the Mac Pro's Quadro P400 -- the
nixpkgs default (production, 595.x) dropped Pascal support.
Games: RetroArch built through retroarch-bare.wrapper with 17 cores
covering NES through PS2, GameCube and Wii; Clone Hero; and Steam with
Proton-GE and protontricks. RetroArch's menu toggle is bound to L3+R3,
without which there is no way to exit a running core on a machine with
no keyboard.
Proton prerequisites beyond what programs.steam already arranges: the
esync file-descriptor hard limit is raised from systemd's default
524288 to 1048576 (soft limit untouched), and Proton-GE is wired in via
extraCompatPackages. vm.max_map_count already defaults high enough in
nixpkgs and needs no override.
Content lives in a shared /srv/games tree created by systemd.tmpfiles,
laid out one directory per system under roms/ using the libretro/ES-DE
naming convention, plus bios/, saves/, states/, a Steam library folder
and Clone Hero's songs. RetroArch is pointed at it declaratively.
hardware-configuration.nix is a placeholder, not a hardware scan: the
machine is not installed yet. It assumes partition labels `nixos` and
`BOOT` and must be replaced with nixos-generate-config output.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The docs-site build syncs this repo's README.md and docs/ into the site
tree; nothing else is copied. All prose apart from the README therefore lived
outside the sync and never appeared on https://docs.lyrapup.pet/nixfiles/, and
the one page that did publish carried 18 link targets that resolved to nothing.
Moves:
home/README.md -> docs/shell.md
home/KEYBINDINGS.md -> docs/keybindings.md
hosts/<Name>/README.md -> docs/hosts/<name>.md
docs/.pages and docs/hosts/.pages give the awesome-pages plugin an explicit
order; new pages are picked up by the trailing '...' without an edit.
Links are rewritten so a single URL is correct in both Gitea and the published
site: absolute Gitea source URLs for .nix files and directories, relative links
between pages under docs/, and absolute docs.lyrapup.pet URLs from the root
README, which the build republishes at a different depth from the rest of the
tree. In-code comments that pointed at a moved README are updated to the new
path.
The README gains a Documentation section covering the sync contract and the
linking rules, and CLAUDE.md carries the short version so future edits do not
reintroduce unsynced pages or dead links.
Verified by reproducing the docs-site assembly locally against its pinned
toolchain (mkdocs 1.6.1, mkdocs-material 9.7.7, awesome-pages 2.10.1): pages
render at the URLs used above and in the declared order.
security.sudo-rs.enable sets security.sudo.enable = false via mkDefault, so
this is a straight swap; the two modules assert against being on together.
The fleet only uses the stock policy -- wheel may run anything, with a password
-- which sudo-rs implements fully. It does not cover host aliases, LDAP/SSSD
sudoers, sudoreplay or most Defaults settings; needing any of those means
reverting to security.sudo. The macOS host is unaffected and keeps Apple's sudo
with Touch ID.
Recovery from a host that will not escalate is documented in the module and in
home/README.md: get a root shell that does not go through sudo, then roll back
the generation.
Adds Rust/Go replacements for the day-to-day utilities and shadows four of
them with aliases. Only read-only commands are shadowed (cat, du, df, ps), so a
wrong flag costs a retype rather than data; rm, grep, find and sed keep their
originals and the replacements are reached by their own names.
The aliases land in .zshrc, so they apply to interactive zsh only -- scripts,
`sudo <cmd>` and anything exec'd by another program still get the real binary.
New on every host: dust, dysk, procs, trash-cli, doggo, xh, ouch, jnv, hexyl,
fq and tealdeer. dysk is used rather than duf, which is unmaintained upstream.
git gains difftastic behind a `git dft` alias. diff.external is deliberately
left unset so delta remains the renderer for git diff/show and for anything
parsing them.
The work box gains kubecolor, aliased over kubectl; it wraps the real kubectl
and drops colour when stdout is not a terminal, so pipes are unchanged.
home/README.md documents the alias map, the flag incompatibilities (including
the two that fail silently: dust -s is --apparent-size, and procs reads a bare
`aux` as a search keyword) and the rationale for what was left alone.
Claude Code runs on Node, whose V8 build requires SSE4.2 and POPCNT
(x86-64-v2). On an older x86_64 CPU it does not run, so it must not be
installed there in the first place.
Nix cannot detect the CPU (pure evaluation, hosts often built elsewhere),
so add features.cpu.microarchLevel: the psABI level a host declares about
itself, defaulting to 2. features.claudeCode.enable derives from it, and
home/claude.nix reads that through home-manager's osConfig and installs
nothing -- CLI, CLAUDE.md, output style or memory symlink -- when it is
off. Hosts without the option (Darwin, the standalone homeConfigurations)
keep the tool enabled.
An assertion fails evaluation if a host force-enables the flag below the
required level, so the mistake surfaces in nix flake check rather than as
an illegal-instruction crash on the machine.
gcx stores its OAuth access and refresh tokens in the system keychain
unconditionally -- its config file keeps only opaque `keychain:gcx:v2:...`
handles -- and exposes no plaintext fallback. With nothing owning
org.freedesktop.secrets on this headless WSL box, `gcx login` authenticates
against Grafana and then dies writing its config: "The name is not activatable".
Add services.headlessSecretService: gnome-keyring as a systemd --user service,
unlocking the login keyring at start. home-manager's own services.gnome-keyring
does not fit here on two counts -- it is WantedBy graphical-session-pre.target,
which never activates without a desktop session, and it passes no --unlock, so
writes would block on a GUI prompter that does not exist.
Only the secrets component is started. The ssh component is deliberately off: it
would claim SSH_AUTH_SOCK and displace services.ssh-agent, breaking SSH auth and
signed commits.
The unlock password defaults to a random one generated on first activation under
$XDG_DATA_HOME. The passwordFile option is the seam for supplying it from an
agenix secret instead, once that lands.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The module-catalogue table in README.md was committed without prettier's
alignment, so the treefmt formatting flake check fails. This has left
CI (nix flake check) red on main since the #56 docs merge and blocks
every PR that triggers the full check.
Reformat with the flake's pinned formatter; no content change.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
## Summary
Separates user identity (data) from the reusable Nix modules and lets a host declare any number of users, replacing the previous one-user-per-host structure. Also restructures the tree and exposes the home config for use off these hosts.
## Changes
- **User registry** (`users/registry.nix`): per-user identity (name, email, groups, authorized + signing keys) as the single source of truth; no user data hardcoded in modules.
- **Multi-user `mkHost`**: a host declares a `users` set keyed by username; per-user identity is injected into each home config via the `identity` module arg.
- **Restructured layout**: `users/`, `home/`, `modules/`, `hosts/`, `lib/` replace the former `lyrathorpe/` and `system/` trees.
- **Portable outputs**: standalone `homeConfigurations."<user>@<system>"` (the portable subset — shell, git, editor, claude) plus an exported `homeModules` for use on machines not managed by this flake, or as an input to other flakes.
- Docs (`README.md`, `home/README.md`) and `.gitignore` updated for the new paths.
## Fixes
- Closes#46 — shared user module authorized one user's SSH key for every account.
- Closes#47 — git committer identity hardcoded as defaults instead of per-user.
- Closes#48 — EDaaS systemd linger hardcoded to a literal username.
## Verification
- `nix flake check` passes: treefmt, deadnix, statix, pre-commit, and evaluation of all NixOS hosts + Darwin + homeConfigurations.
- Derivation-path comparison vs `main`: `lyrathorpe-mbp` and `emmathorpe-edaas` are byte-identical; `lyrathorpe-t400`, `lyrathorpe-macpro31` and `lyrathorpe-rpi5` differ only by de-duplicating a repeated `authorized_keys` entry (confirmed with nix-diff — no other change).
- Standalone `homeConfigurations."lyrathorpe@x86_64-linux".activationPackage` builds.
## Notes
- `emmathorpe` has no personal authorized key yet (it previously inherited Lyra's key via the bug in #46); the registry entry is intentionally empty — add a real key if SSH login as `emmathorpe` is wanted (moot on the WSL host).
- A two-repo (public dotfiles / private systems) split is deferred by design; this internal restructure is the prerequisite for it.
---------
Co-authored-by: Emma Thorpe <emma.thorpe@citrix.com>
Reviewed-on: #49
Add system/machine/RPi5/README.md (flash/boot, regenerate hardware-config,
Docker-socket security caveat and remote-client usage, how to add a
reverse-proxy vhost). Add lyrathorpe-rpi5 to the README host table and note
that the swayDesktop flag now lives in system/modules/features.nix so headless
hosts keep TTY login.
Update the home README (editor plugins + format-on-save, btop/lazygit/
hyperfine/sd, git aliases, tmux extrakto, fonts/emoji coverage),
KEYBINDINGS (telescope/trouble/comment), and the top README (shared
module layers + nix-flake-check CI). Correct the last work/default.nix
reference in default.nix.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- treefmt-nix drives `nix fmt` and the formatting check (nixfmt/shfmt/
prettier; generated files and flake.lock excluded). Replaces the
bespoke find-based check.
- deadnix and statix as flake checks and pre-commit hooks; deadnix
ignores module-arg patterns, statix.toml disables the two house-style
lints (repeated_keys, empty_pattern). Fixed the one real deadnix hit
(unused overlay arg) and statix hit (use inherit for claude-code).
- git-hooks.nix installs the pre-commit gate via the devShell.
- .editorconfig for the base style.
- Move system/modules/work/default.nix -> lyrathorpe/home/work.nix (it is
a home-manager module). README gains a Development section; docs
reformatted by the new formatter.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add lyrathorpe/home/README.md covering the zsh / CLI tools / tmux / git /
ssh features and nice-to-haves configured across shell.nix and git.nix
(history, fzf/zoxide/direnv/eza/bat, nix-index, nh, tmux plugins +
auto-start, git aliases/settings/signing, ssh agent + Gitea host, the
zcompdump/GC maintenance behaviours, and per-host differences). Link it
from the top-level README alongside the keybindings reference.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Document every configured shortcut in lyrathorpe/home/KEYBINDINGS.md,
compiled from the rendered configs (so it includes the home-manager Sway
module defaults alongside the custom binds and modes), and link it from
the top-level README. Notes the Dvorak keysym caveat and the
laptop-only brightness keys.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Document the greetd/ReGreet greeter in the top-level README and the T400
and Mac Pro install notes, including that the user account needs a
password set before the greeter can authenticate.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add system/machine/{T400,MacPro31}/README.md covering the placeholder
hardware-configuration regeneration, partition labels, bootloader selection
(T400 boot variants; Mac Pro EFI quirks), and GPU notes. Link each from its
configuration.nix header, and refresh the top-level README host table (T400
replaces X1, Mac Pro 3,1 added) with links to both.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Document the host table, rebuild commands, and that the MBP Asahi firmware
dir is gitignored and must be populated out-of-band before that host builds.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
lyrathorpe