Upstream will stop defaulting hardware.asahi.enable to true and currently emits an evaluation warning to that effect. Set it explicitly on the lyrathorpe-mbp (MBP-Asahi) host to silence the warning and be robust to the future default change. Verified the warning no longer appears in the host toplevel eval.
Add programs.zsh.envExtra to the EDaaS work profile so ~/.jenkinsenv is
sourced from ~/.zshenv on every zsh invocation (login, interactive, and
non-interactive), exporting the JENKINS_UCE_/JENKINS_STF_ tokens the Jenkins
MCP servers read via ${JENKINS_*} expansion. Guarded so a missing file does
not break the shell; the file is kept out of the world-readable nix store
because it holds secrets.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The code.emmathe.dev key is now loaded in the ssh-agent, so git push works with sandbox off and PRs are raised via the tea CLI. Correct the git-network-ops memory that said Gitea always needs hand-off; keep hand-off as the fallback only if the key drops from the agent.
The gpg.ssh.allowedSignersFile error and %G?=N mean git cannot verify locally, not that the commit is unsigned. Add how to confirm via gpgsig header and how to enable local verification.
Record WSP project field map: issue-type IDs, the six required Bug fields with their allowed values/option IDs and JSON shapes, the Task shortcut that avoids them, and platform-relevant component IDs. Cross-links jira-tooling.
Persist the state of the Psion Workabout MX reverse-engineering / barcode-inventory project so it can be resumed in a future session after a reboot.
Adds `home/claude/memory/sibo_workabout_mx_scanner.md` (project memory) and indexes it in `MEMORY.md`. Records: the repo/branch and committed docs, the confirmed scanner behaviour, the key finding that the scanner is an OO library object driven via p_getlibh/p_newsend/p_send, the blocker (on-device ordinal capture), the RE toolchain, and where the continuation procedure lives.
Takes effect after a home-manager rebuild.
Reviewed-on: #60
Record that any nixpkgs tool can be run on the fly via nix run / nix
shell, so a missing command during development is not a dead end. Takes
effect after a home-manager rebuild.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Document the formatting and lint gates (treefmt/nixfmt/shfmt/prettier,
deadnix, statix, pre-commit) and how to run them, so changes -- docs
included -- are formatted before commit. Notes the CI detect step that
skips heavy checks on docs-only PRs, which can report a false green.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The module-catalogue table in README.md was committed without prettier's
alignment, so the treefmt formatting flake check fails. This has left
CI (nix flake check) red on main since the #56 docs merge and blocks
every PR that triggers the full check.
Reformat with the flake's pinned formatter; no content change.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
## Summary
Follow-up cleanups from the post-refactor audit (issues #50–#53). All behaviour-preserving except the work-host changes (kube-tmux + Lens removal).
## Changes
- **#51** `refactor(ssh)` — move `services.openssh.enable` + `firewall.allowedTCPPorts = [ 22 ]` into `modules/ssh.nix`; drop the duplicated lines from T400, MacPro31, RPi5.
- **#50** `fix/feat(work)` — load kube-tmux from a pinned `flake = false` input (it is not in nixpkgs) and reference `${inputs.kube-tmux}/kube.tmux` directly, so the status line no longer depends on a manual `$HOME/code/kube-tmux` checkout. (Supersedes the interim file-existence guard.)
- **#52** `chore` — gitignore the untracked `tf-inspect/` scratch project.
- **#53** `chore` — remove the unused Lens package entirely (`pkgs.lens` + its unfree entry; `unfreePackages` is now just `claude-code`), fix the `nil`→`nil_ls` LSP doc, remove the redundant `.editorconfig` block, name the RPi5 Docker subnet in a `let` binding.
## Deferred (from #53, noted in the commit)
- `.gitignore` firmware entry — documented behaviour, low value, left as-is.
- Per-eval `nixpkgs-unstable` overlay import — inherently per-system; no clean single-import hoist.
## Verification
- `nix flake check` passes (treefmt, deadnix, statix, pre-commit, all hosts + Darwin + homeConfigurations).
- Derivation-path diff vs `main`: `lyrathorpe-mbp`, `lyrathorpe-t400`, `lyrathorpe-macpro31`, `lyrathorpe-rpi5` are byte-identical (confirms #51 and the subnet `let` binding change nothing). Only `emmathorpe-edaas` differs — the kube-tmux input (#50) and the Lens removal (#53).
Closes#50, #51, #52, #53.
---------
Co-authored-by: Emma Thorpe <emma.thorpe@citrix.com>
Reviewed-on: #54
## Summary
Separates user identity (data) from the reusable Nix modules and lets a host declare any number of users, replacing the previous one-user-per-host structure. Also restructures the tree and exposes the home config for use off these hosts.
## Changes
- **User registry** (`users/registry.nix`): per-user identity (name, email, groups, authorized + signing keys) as the single source of truth; no user data hardcoded in modules.
- **Multi-user `mkHost`**: a host declares a `users` set keyed by username; per-user identity is injected into each home config via the `identity` module arg.
- **Restructured layout**: `users/`, `home/`, `modules/`, `hosts/`, `lib/` replace the former `lyrathorpe/` and `system/` trees.
- **Portable outputs**: standalone `homeConfigurations."<user>@<system>"` (the portable subset — shell, git, editor, claude) plus an exported `homeModules` for use on machines not managed by this flake, or as an input to other flakes.
- Docs (`README.md`, `home/README.md`) and `.gitignore` updated for the new paths.
## Fixes
- Closes#46 — shared user module authorized one user's SSH key for every account.
- Closes#47 — git committer identity hardcoded as defaults instead of per-user.
- Closes#48 — EDaaS systemd linger hardcoded to a literal username.
## Verification
- `nix flake check` passes: treefmt, deadnix, statix, pre-commit, and evaluation of all NixOS hosts + Darwin + homeConfigurations.
- Derivation-path comparison vs `main`: `lyrathorpe-mbp` and `emmathorpe-edaas` are byte-identical; `lyrathorpe-t400`, `lyrathorpe-macpro31` and `lyrathorpe-rpi5` differ only by de-duplicating a repeated `authorized_keys` entry (confirmed with nix-diff — no other change).
- Standalone `homeConfigurations."lyrathorpe@x86_64-linux".activationPackage` builds.
## Notes
- `emmathorpe` has no personal authorized key yet (it previously inherited Lyra's key via the bug in #46); the registry entry is intentionally empty — add a real key if SSH login as `emmathorpe` is wanted (moot on the WSL host).
- A two-repo (public dotfiles / private systems) split is deferred by design; this internal restructure is the prerequisite for it.
---------
Co-authored-by: Emma Thorpe <emma.thorpe@citrix.com>
Reviewed-on: #49
The NixOS-WSL module's wslConf.interop submodule declares only `enabled`
and `appendWindowsPath`. `register` and `includePath` are not valid
wsl.conf interop keys, and the freeform INI type does not cover keys
nested under the already-declared `interop` group, so they were rejected
as unknown options. Remove them.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Closes#39.
nvim-cmp ships no default keymaps, so the completion menu (including the path source) appeared but nothing could navigate or accept it.
Bind the usual set in `plugins.cmp.settings.mapping`:
- `<C-n>` / `<C-p>` and `<Tab>` / `<S-Tab>` — select next/previous
- `<C-Space>` — open the menu
- `<C-e>` — abort
- `<CR>` — confirm with `select = false` (bare Enter stays a newline unless an entry is highlighted)
Documentation: `KEYBINDINGS.md` gains a completion-menu table under the Neovim section covering these keys, and the Neovim summary is reworded accordingly.
Verified by rendering the generated nvim config: the mappings emit as raw Lua (e.g. `["<CR>"] = cmp.mapping.confirm({ select = false })`), not quoted strings.
---------
Co-authored-by: Emma Thorpe <emma.thorpe@citrix.com>
Reviewed-on: #40
catppuccin v2.0.0 renamed its lualine theme files; there is no longer a
plain "catppuccin" theme, only per-flavour files (catppuccin-mocha, etc.)
and catppuccin-nvim. The old name no longer resolved, so lualine fell back
to the auto theme and emitted a notice. Pin to catppuccin-mocha to match
the configured colorscheme flavour.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
lyrathorpe
Emma Thorpe
renovate-bot