chore(secrets): placeholder for the LDAP bind secret

## Summary

Follow-up cleanups from the post-refactor audit (issues #50–#53). All behaviour-preserving except the work-host changes (kube-tmux + Lens removal).

## Changes

- **#51** `refactor(ssh)` — move `services.openssh.enable` + `firewall.allowedTCPPorts = [ 22 ]` into `modules/ssh.nix`; drop the duplicated lines from T400, MacPro31, RPi5.
- **#50** `fix/feat(work)` — load kube-tmux from a pinned `flake = false` input (it is not in nixpkgs) and reference `${inputs.kube-tmux}/kube.tmux` directly, so the status line no longer depends on a manual `$HOME/code/kube-tmux` checkout. (Supersedes the interim file-existence guard.)
- **#52** `chore` — gitignore the untracked `tf-inspect/` scratch project.
- **#53** `chore` — remove the unused Lens package entirely (`pkgs.lens` + its unfree entry; `unfreePackages` is now just `claude-code`), fix the `nil`→`nil_ls` LSP doc, remove the redundant `.editorconfig` block, name the RPi5 Docker subnet in a `let` binding.

## Deferred (from #53, noted in the commit)

- `.gitignore` firmware entry — documented behaviour, low value, left as-is.
- Per-eval `nixpkgs-unstable` overlay import — inherently per-system; no clean single-import hoist.

## Verification

- `nix flake check` passes (treefmt, deadnix, statix, pre-commit, all hosts + Darwin + homeConfigurations).
- Derivation-path diff vs `main`: `lyrathorpe-mbp`, `lyrathorpe-t400`, `lyrathorpe-macpro31`, `lyrathorpe-rpi5` are byte-identical (confirms #51 and the subnet `let` binding change nothing). Only `emmathorpe-edaas` differs — the kube-tmux input (#50) and the Lens removal (#53).

Closes #50, #51, #52, #53.

---------

Co-authored-by: Emma Thorpe <emma.thorpe@citrix.com>
Reviewed-on: #54

.editorconfig

@@ -8,12 +8,6 @@ indent_size = 2
 trim_trailing_whitespace = true
 insert_final_newline = true
 
-[*.{nix,yaml,yml,json,md,sh,toml}]
-indent_style = space
-indent_size = 2
-trim_trailing_whitespace = true
-insert_final_newline = true
-
 # Markdown uses trailing whitespace for hard line breaks.
 [*.md]
 trim_trailing_whitespace = false

.gitea/workflows/ci.yaml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           # Full history so the detect step can diff the PR against its base.
           fetch-depth: 0

.gitignore

@@ -1,4 +1,7 @@
-system/modules/firmware/*
+modules/firmware/*
 
 # vim swap files
 *.swp
+
+# Local scratch project, not part of this flake.
+tf-inspect/

README.md

@@ -7,21 +7,78 @@ single flake.
 
 Defined in the host table in [`flake.nix`](./flake.nix):
 
-| Configuration         | System           | Machine                                                                     |
-| --------------------- | ---------------- | --------------------------------------------------------------------------- |
-| `lyrathorpe-mbp`      | `aarch64-linux`  | MacBook Pro (Apple Silicon, Asahi)                                          |
-| `lyrathorpe-t400`     | `x86_64-linux`   | ThinkPad T400 — [install notes](./system/machine/T400/README.md)            |
-| `lyrathorpe-macpro31` | `x86_64-linux`   | Mac Pro 3,1, desktop — [install notes](./system/machine/MacPro31/README.md) |
-| `emmathorpe-edaas`    | `x86_64-linux`   | Work WSL box (NixOS-WSL)                                                    |
-| `lyrathorpe-mac`      | `aarch64-darwin` | macOS (nix-darwin)                                                          |
+| Configuration         | System           | Machine                                                                                                     |
+| --------------------- | ---------------- | ----------------------------------------------------------------------------------------------------------- |
+| `lyrathorpe-mbp`      | `aarch64-linux`  | MacBook Pro (Apple Silicon, Asahi)                                                                          |
+| `lyrathorpe-t400`     | `x86_64-linux`   | ThinkPad T400 — [install notes](./hosts/T400/README.md)                                                     |
+| `lyrathorpe-macpro31` | `x86_64-linux`   | Mac Pro 3,1, desktop — [install notes](./hosts/MacPro31/README.md)                                          |
+| `emmathorpe-edaas`    | `x86_64-linux`   | Work WSL box (NixOS-WSL)                                                                                    |
+| `lyrathorpe-rpi5`     | `aarch64-linux`  | Raspberry Pi 5 headless server: Docker host + nginx reverse proxy — [install notes](./hosts/RPi5/README.md) |
+| `lyrathorpe-mac`      | `aarch64-darwin` | macOS (nix-darwin)                                                                                          |
 
-Shared layers: `lyrathorpe/home` (home-manager: shell, git, editor),
-`system/modules/common-nixos.nix` (all NixOS hosts: fonts, nix-ld, caches),
-`system/modules/workstation.nix` (physical graphical hosts: audio, thermald,
-earlyoom, fwupd), `system/modules/laptop.nix` (laptops: Wi-Fi, Bluetooth, power,
-lid), and `system/modules/ssh.nix` (key-only sshd). The x86 hosts also pull
+Shared layers: `home` (home-manager: shell, git, editor),
+`modules/common-nixos.nix` (all NixOS hosts: fonts, nix-ld, caches),
+`modules/workstation.nix` (physical graphical hosts: audio, thermald,
+earlyoom, fwupd), `modules/laptop.nix` (laptops: Wi-Fi, Bluetooth, power,
+lid), and `modules/ssh.nix` (key-only sshd). The x86 hosts also pull
 `nixos-hardware` profiles.
 
+## Users
+
+Identity is data, kept separate from the reusable modules:
+
+- [`users/registry.nix`](./users/registry.nix) — one entry per user (display
+  name, email, supplementary groups, authorized + signing keys). This is the
+  single source of identity; no user data is hardcoded in the modules.
+- Each host's table entry declares a `users` set keyed by username; every entry
+  lists that user's home-module composition (the shared `./home` bundle plus any
+  per-user modules, e.g. [`users/emmathorpe/work.nix`](./users/emmathorpe/work.nix))
+  and optional per-host-user system bits such as `linger`.
+- `mkHost` builds each account from the registry and injects the matching
+  identity into that user's home config as the `identity` module arg. A host can
+  therefore declare any number of users.
+
+### Portable home (off-NixOS / external consumers)
+
+The home config is also exposed for use beyond these hosts:
+
+- `homeConfigurations."<user>@<system>"` — a standalone home-manager profile
+  (the portable subset: shell + git + editor + claude) that can be activated on a
+  machine this flake does **not** manage:
+  `home-manager switch --flake .#"lyrathorpe@x86_64-linux"`. The desktop/sway
+  modules are intentionally excluded (they rely on a NixOS-provided Sway/Firefox
+  binary).
+- `homeModules` — the reusable modules exported so another flake can import them
+  (`inputs.<this>.homeModules.default`). Consumers must supply the module args
+  these expect: `inputs` always, `identity` for git/desktop, `portable` for sway.
+
+## Directory authentication (SSSD → Authentik LDAP)
+
+Every NixOS host authenticates users against the Authentik LDAP outpost via
+SSSD, implemented in [`modules/sssd.nix`](./modules/sssd.nix) and enabled by
+default through the `services.authentikLdap.enable` option (added to
+`baseModules`). The **EDaaS** WSL box opts out
+(`services.authentikLdap.enable = false`) as a work-managed environment; the
+macOS host is unaffected (SSSD is Linux-only).
+
+- Connects over LDAPS to `ldap.lyrapup.pet:636`, search base
+  `dc=ldap,dc=goauthentik,dc=io`, binding as
+  `cn=sssd-bind,ou=users,dc=ldap,dc=goauthentik,dc=io`.
+- The schema mappings match Authentik's non-standard object classes
+  (`goauthentik.io/ldap/user`, `goauthentik.io/ldap/group`) over the POSIX
+  attributes (`uid`, `uidNumber`, `gidNumber`, `homeDirectory`).
+- Home directories are created on first login (`pam_mkhomedir`).
+
+### Secrets (agenix)
+
+The LDAP bind credential is an [agenix](https://github.com/ryantm/agenix)
+secret, decrypted at activation with each host's SSH host key. The decrypted
+plaintext is a full `sssd.conf` drop-in delivered to
+`/etc/sssd/conf.d/01-ldap-authtok.conf`, so the password never enters the Nix
+store. Owner setup (host recipient keys, encrypting the bind password, DNS for
+`ldap.lyrapup.pet`, rebuild) is documented in
+[`secrets/README.md`](./secrets/README.md).
+
 ## Applying
 
 ```sh
@@ -34,23 +91,25 @@ darwin-rebuild switch --flake .#lyrathorpe-mac
 ## Shell environment & keybindings
 
 - Interactive shell features (zsh, tmux, git, ssh, CLI tools, auto-tmux):
-  [`lyrathorpe/home/README.md`](./lyrathorpe/home/README.md).
+  [`home/README.md`](./home/README.md).
 - All Sway / tmux / foot / zsh keyboard shortcuts:
-  [`lyrathorpe/home/KEYBINDINGS.md`](./lyrathorpe/home/KEYBINDINGS.md).
+  [`home/KEYBINDINGS.md`](./home/KEYBINDINGS.md).
 
 ## Login / greeter
 
 Graphical (Sway) hosts log in through a Wayland greeter — `greetd` running
-ReGreet inside the `cage` kiosk compositor — configured centrally in
-[`lyrathorpe/swaywm.nix`](./lyrathorpe/swaywm.nix), gated on
-`features.swayDesktop.enable`. The greeter is forced to Dvorak to match the
-console and Sway session. Hosts with `features.swayDesktop.enable = false` (the
-WSL work box) keep plain TTY login. The target account needs a password
+ReGreet inside the `cage` kiosk compositor — implemented in
+[`modules/sway.nix`](./modules/sway.nix), gated on
+`features.swayDesktop.enable` (the option is declared in
+[`modules/features.nix`](./modules/features.nix), so headless hosts
+can leave it off without importing `modules/sway.nix`). The greeter is forced to Dvorak
+to match the console and Sway session. Headless hosts (the WSL work box and the
+Raspberry Pi server) keep plain TTY login. The target account needs a password
 (`passwd <user>`) before it can log in.
 
 ## MacBook (Asahi) firmware
 
-The MBP host references `system/modules/firmware/` for Apple peripheral
+The MBP host references `modules/firmware/` for Apple peripheral
 firmware (Wi-Fi/Bluetooth). These blobs are **committed** (tracked) even though
 `.gitignore` lists the directory: the flake is `git+file`, so it only sees
 tracked files — untracking them breaks `lyrathorpe-mbp` evaluation (and the CI
@@ -60,7 +119,7 @@ redistributable; the repo is private.
 To refresh them, copy the firmware extracted during the Asahi install (from
 `/etc/nixos/firmware`, or re-extract per the
 [Asahi NixOS docs](https://github.com/tpwrules/nixos-apple-silicon)) into
-`system/modules/firmware/` and commit with `git add -f`.
+`modules/firmware/` and commit with `git add -f`.
 
 ## Development
 

flake.lock

@@ -25,11 +25,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1781409739,
-        "narHash": "sha256-6dadOVlqPpjy0w4WuwvX+Qx0Kkaabm3tahMrCrr72Rg=",
+        "lastModified": 1782014564,
+        "narHash": "sha256-F/royQHyJAyKWKrV8AaG4Yf1yjzxa+PFk5xvTdvBrzk=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "ef56de5faccb3ac59d95aa31cce551ff72e35bed",
+        "rev": "d6668e34bbce788459883a1097bf0ee170f49c61",
         "type": "gitlab"
       },
       "original": {
@@ -136,11 +136,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778507602,
-        "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=",
+        "lastModified": 1781733627,
+        "narHash": "sha256-U3yTuGBnmXvXoQI3qkpfEDsn9RovQPAjN7ndRco+3u0=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a",
+        "rev": "3bbec39bc90eadfa031e6f3b77272f3f60803e39",
         "type": "github"
       },
       "original": {
@@ -177,11 +177,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781319724,
-        "narHash": "sha256-ZGuxexEMo4Xv28KJ0dX/m/PHN4oZIOnxHZpNTyrvx4M=",
+        "lastModified": 1781981105,
+        "narHash": "sha256-/1nNBbA7PrSQpTc9Qazkhl4kIPg+TNl0CjxS3UQJKlw=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "8355f0a16b2dbb06a97959a918af5b239bbe05ae",
+        "rev": "7bfff44b465909f69a442701293bc0badcf476dc",
         "type": "github"
       },
       "original": {
@@ -191,6 +191,22 @@
         "type": "github"
       }
     },
+    "kube-tmux": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1779714285,
+        "narHash": "sha256-l1wjg2ReWKCI7h/K11vvX2ykYTs/mVD+tfz/mQsjn/E=",
+        "owner": "jonmosco",
+        "repo": "kube-tmux",
+        "rev": "8b7e1d127c16b6dc87ff5743f4d775b245198b69",
+        "type": "github"
+      },
+      "original": {
+        "owner": "jonmosco",
+        "repo": "kube-tmux",
+        "type": "github"
+      }
+    },
     "nix-darwin": {
       "inputs": {
         "nixpkgs": [
@@ -198,11 +214,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781190061,
-        "narHash": "sha256-QRMpLbsmlciMGv4yx75FUoIl54K02JbIX1tgdPHPw1s=",
+        "lastModified": 1781772065,
+        "narHash": "sha256-xIbRSwDB1GBAUsWsQZUjudGfAGQt3BOpsWaO/ugVa4w=",
         "owner": "nix-darwin",
         "repo": "nix-darwin",
-        "rev": "f2b3fdb347f91dfd344ad196666a0b0fe8aad05c",
+        "rev": "adda04f0bf4819575b1978c2f8d78401b3c2be12",
         "type": "github"
       },
       "original": {
@@ -237,11 +253,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781422160,
-        "narHash": "sha256-W7S8O86bVrw2gaomEwkHStOzmPpnFIHQ6lS4Q2HffJ0=",
+        "lastModified": 1782030356,
+        "narHash": "sha256-h4WpMr455AfRub0FXBaon6Vcpe0waUyJ4GivIW6oyd4=",
         "owner": "nix-community",
         "repo": "nix-index-database",
-        "rev": "854d04e2368fb2e9c328a36b3c0a04cd713bfae1",
+        "rev": "3017088b49efd404f78e3b104f553b97e4af786b",
         "type": "github"
       },
       "original": {
@@ -258,11 +274,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781108254,
-        "narHash": "sha256-acCLKPvXbyLVd8Vui/6GuQp2JQ409riBOe00nr/qe+w=",
+        "lastModified": 1781520503,
+        "narHash": "sha256-XuqQQG1qRyc3o8ld937sDLQNx+QrGV852KJ0dNglJDg=",
         "owner": "nix-community",
         "repo": "nixos-apple-silicon",
-        "rev": "53ae7e036433331013bd7c03ae927da554482816",
+        "rev": "43043ad207529650f9fa68e1705f7cf9c08bfdeb",
         "type": "github"
       },
       "original": {
@@ -278,11 +294,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781168557,
-        "narHash": "sha256-LOnLQ2tpYF9gqIDDr3+j3DbpJJr/QCH6zPRT2GzEUOE=",
+        "lastModified": 1781622756,
+        "narHash": "sha256-JrPh4M6S7aPsEE9tOENuZrxC6o2szSLlK+t4+nLke9s=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "6358ff76821101c178e3ab4919a62799bfe3652e",
+        "rev": "08018c72174a4df5657f8d94178ac69fb9c243e5",
         "type": "github"
       },
       "original": {
@@ -330,11 +346,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1781074563,
-        "narHash": "sha256-md8WlXOlfnIeHeOScMTTHFyf2d6iaTwPl2apR5EQ3P4=",
+        "lastModified": 1781577229,
+        "narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "9ae611a455b90cf061d8f332b977e387bda8e1ca",
+        "rev": "567a49d1913ce81ac6e9582e3553dd90a955875f",
         "type": "github"
       },
       "original": {
@@ -353,11 +369,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1781388570,
-        "narHash": "sha256-prn8ws642FWX4pEU3Rl6m5QlrJl5MjEMHGfII9Ho9t0=",
+        "lastModified": 1781971008,
+        "narHash": "sha256-T2u2RQZWKvD1J+TgcxjiJr8IymBr/PrUNeAGhMZFZU4=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "0e73e3cb254a806d344bd70d996ab77896d3e3a8",
+        "rev": "7afca458f064f166d3a9c98db3b41a984fe46492",
         "type": "github"
       },
       "original": {
@@ -373,6 +389,7 @@
         "flake-parts": "flake-parts",
         "git-hooks": "git-hooks",
         "home-manager": "home-manager",
+        "kube-tmux": "kube-tmux",
         "nix-darwin": "nix-darwin",
         "nix-homebrew": "nix-homebrew",
         "nix-index-database": "nix-index-database",

flake.nix

@@ -23,7 +23,7 @@
     # Provides mkFlake: the systems/perSystem scaffolding used below.
     flake-parts.url = "github:hercules-ci/flake-parts";
     flake-parts.inputs.nixpkgs-lib.follows = "nixpkgs";
-    # Declarative Firefox add-ons (e.g. the Catppuccin theme); see lyrathorpe/user.nix.
+    # Declarative Firefox add-ons (e.g. the Catppuccin theme); see modules/users.nix.
     firefox-addons = {
       url = "gitlab:rycee/nur-expressions?dir=pkgs/firefox-addons";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -46,7 +46,16 @@
       url = "github:cachix/git-hooks.nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    # Declarative Neovim (the editor; see lyrathorpe/home/editor.nix). Release
+    # agenix: age-encrypted secrets, decrypted at activation with each host's
+    # SSH host key. Provides the SSSD LDAP bind credential (secrets/, see
+    # modules/sssd.nix). The darwin module is intentionally unused (SSSD is
+    # Linux-only).
+    agenix = {
+      url = "github:ryantm/agenix";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.home-manager.follows = "home-manager";
+    };
+    # Declarative Neovim (the editor; see home/editor.nix). Release
     # branch matched to the pinned nixpkgs (26.05); follows our nixpkgs to keep a
     # single nixpkgs in the closure. editor.nix sets programs.nixvim.nixpkgs.source
     # to this same input so the home module doesn't warn about the pin.
@@ -60,6 +69,13 @@
       url = "github:NixOS/nixos-hardware";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    # kube-tmux: kube context/namespace for the tmux status line on the work
+    # host. Not in nixpkgs and not a flake -- pinned here as a plain source so
+    # the script is always in the store (no manual checkout). See work.nix.
+    kube-tmux = {
+      url = "github:jonmosco/kube-tmux";
+      flake = false;
+    };
   };
 
   outputs =
@@ -93,10 +109,11 @@
         # Unfree packages permitted to be built (replaces blanket allowUnfree).
         unfreePackages = [
           "claude-code"
-          "lens"
-          "lens-desktop"
         ];
 
+        # Per-user identity, keyed by username. See README "Users".
+        userRegistry = import ./users/registry.nix;
+
         # nixpkgs + nix-daemon settings shared by NixOS and Darwin hosts.
         commonModule = {
           nixpkgs.overlays = overlays;
@@ -112,9 +129,12 @@
 
         # Shared scaffolding for every NixOS host: common user, settings, home-manager.
         baseModules = [
-          ./lyrathorpe/user.nix
-          ./system/modules/common-nixos.nix
+          ./modules/users.nix
+          ./modules/common-nixos.nix
+          ./modules/features.nix
+          ./modules/sssd.nix
           commonModule
+          inputs.agenix.nixosModules.default
           home-manager.nixosModules.home-manager
           {
             home-manager.useGlobalPkgs = true;
@@ -125,18 +145,13 @@
           }
         ];
 
-        # mkHost :: { system, username, fullName, modules, homeModules } -> nixosSystem
-        # Builds one machine by appending its host-specific modules to the shared
-        # baseModules. The user identity (username/fullName) is threaded through
-        # specialArgs so user.nix and the home modules stay host-agnostic, and the
-        # home-manager profile is keyed by the host's username.
+        # Build one NixOS host. `users` is an attrset keyed by username (home
+        # modules + optional per-user system bits). See README "Users".
         mkHost =
           {
             system,
-            username,
-            fullName,
             modules,
-            homeModules,
+            users,
             # Host form factor. Laptops inherit the default; a desktop host sets
             # `portable = false` to drop mobile components (battery block,
             # brightness keys) from the home-manager Sway config.
@@ -147,8 +162,7 @@
             specialArgs = {
               inherit
                 inputs
-                username
-                fullName
+                userRegistry
                 portable
                 ;
             };
@@ -156,16 +170,15 @@
               baseModules
               ++ modules
               ++ [
+                { _module.args.hostUsers = users; }
                 {
-                  home-manager.extraSpecialArgs = {
-                    inherit
-                      inputs
-                      username
-                      fullName
-                      portable
-                      ;
-                  };
-                  home-manager.users.${username}.imports = homeModules;
+                  home-manager.extraSpecialArgs = { inherit inputs portable; };
+                  home-manager.users = lib.mapAttrs (name: spec: {
+                    imports = spec.homeModules;
+                    _module.args.identity = userRegistry.${name} // {
+                      username = name;
+                    };
+                  }) users;
                 }
               ];
           };
@@ -184,19 +197,17 @@
           }
         ];
 
-        # mkDarwinHost :: { system, username, fullName, modules, homeModules } -> darwinSystem
-        # Darwin counterpart of mkHost. macOS already owns the login user, so we
-        # only attach the platform and home-manager; no NixOS user module here.
+        # Darwin counterpart of mkHost: single-user (macOS owns the account),
+        # identity still from the registry. See README "Users".
         mkDarwinHost =
           {
             system,
             username,
-            fullName,
             modules,
             homeModules,
           }:
           nix-darwin.lib.darwinSystem {
-            specialArgs = { inherit inputs username fullName; };
+            specialArgs = { inherit inputs username; };
             modules =
               darwinBaseModules
               ++ modules
@@ -205,40 +216,41 @@
                   nixpkgs.hostPlatform = system;
                   # macOS owns the account; point home-manager at its home dir.
                   users.users.${username}.home = "/Users/${username}";
-                  home-manager.extraSpecialArgs = { inherit inputs username fullName; };
-                  home-manager.users.${username}.imports = homeModules;
+                  home-manager.extraSpecialArgs = { inherit inputs; };
+                  home-manager.users.${username} = {
+                    imports = homeModules;
+                    _module.args.identity = userRegistry.${username} // {
+                      inherit username;
+                    };
+                  };
                 }
               ];
           };
 
-        # Host table — declarative registry of every machine. To add a host:
-        # give it a name, its `system`, the owning user, and the module lists.
-        # mapAttrs below turns each entry into a nixosConfiguration of the same name.
+        # Host table — one entry per machine, realised into a nixosConfiguration
+        # of the same name below. See README "Hosts" / "Users".
         hosts = {
           lyrathorpe-mbp = {
             system = "aarch64-linux";
-            username = "lyrathorpe";
-            fullName = "Lyra Thorpe";
             modules = [
-              ./system/machine/MBP-Asahi/configuration.nix
-              ./system/modules/laptop.nix
+              ./hosts/MBP-Asahi/configuration.nix
+              ./modules/laptop.nix
               nixos-apple-silicon.nixosModules.default
-              ./lyrathorpe/swaywm.nix
+              ./modules/sway.nix
             ];
-            homeModules = [
-              ./lyrathorpe/home
-              ./lyrathorpe/home/desktop.nix
+            users.lyrathorpe.homeModules = [
+              ./home
+              ./users/lyrathorpe/home.nix
+              ./home/desktop.nix
             ];
           };
 
           lyrathorpe-t400 = {
             system = "x86_64-linux";
-            username = "lyrathorpe";
-            fullName = "Lyra Thorpe";
             modules = [
-              ./system/machine/T400/configuration.nix
-              ./system/modules/laptop.nix
-              ./system/modules/ssh.nix
+              ./hosts/T400/configuration.nix
+              ./modules/laptop.nix
+              ./modules/ssh.nix
               # No t400-specific profile exists; compose the generic ThinkPad +
               # laptop/SSD/Intel building blocks (tp_smapi/acpi_call for battery
               # thresholds, SSD + microcode defaults).
@@ -246,62 +258,82 @@
               inputs.nixos-hardware.nixosModules.common-pc-laptop
               inputs.nixos-hardware.nixosModules.common-pc-laptop-ssd
               inputs.nixos-hardware.nixosModules.common-cpu-intel
-              ./lyrathorpe/swaywm.nix
+              ./modules/sway.nix
             ];
-            homeModules = [
-              ./lyrathorpe/home
-              ./lyrathorpe/home/desktop.nix
+            users.lyrathorpe.homeModules = [
+              ./home
+              ./users/lyrathorpe/home.nix
+              ./home/desktop.nix
             ];
           };
 
           lyrathorpe-macpro31 = {
             system = "x86_64-linux";
-            username = "lyrathorpe";
-            fullName = "Lyra Thorpe";
             portable = false;
             modules = [
-              ./system/machine/MacPro31/configuration.nix
-              ./system/modules/desktop.nix
-              ./system/modules/ssh.nix
+              ./hosts/MacPro31/configuration.nix
+              ./modules/desktop.nix
+              ./modules/ssh.nix
               inputs.nixos-hardware.nixosModules.common-pc-ssd
               inputs.nixos-hardware.nixosModules.common-cpu-intel
-              ./lyrathorpe/swaywm.nix
+              ./modules/sway.nix
             ];
-            homeModules = [
-              ./lyrathorpe/home
-              ./lyrathorpe/home/desktop.nix
+            users.lyrathorpe.homeModules = [
+              ./home
+              ./users/lyrathorpe/home.nix
+              ./home/desktop.nix
             ];
           };
 
           emmathorpe-edaas = {
             system = "x86_64-linux";
-            username = "emmathorpe";
-            fullName = "Emma Thorpe";
             modules = [
-              ./system/machine/EDaaS/configuration.nix
+              ./hosts/EDaaS/configuration.nix
               nixos-wsl.nixosModules.default
-              ./lyrathorpe/swaywm.nix
+              ./modules/sway.nix
             ];
-            homeModules = [
-              ./lyrathorpe/home
-              ./lyrathorpe/home/work.nix
+            users.emmathorpe = {
+              homeModules = [
+                ./home
+                ./users/emmathorpe/work.nix
+              ];
+              # Keep the systemd --user instance alive without a login session so
+              # the renovate-review home timer fires on schedule.
+              linger = true;
+            };
+          };
+
+          lyrathorpe-rpi5 = {
+            system = "aarch64-linux";
+            portable = false;
+            # Headless server: Docker host + nginx reverse proxy. No sway.nix
+            # (no desktop); the raspberry-pi-5 profile supplies kernel/firmware,
+            # ssh.nix adds key-only sshd.
+            modules = [
+              ./hosts/RPi5/configuration.nix
+              inputs.nixos-hardware.nixosModules.raspberry-pi-5
+              ./modules/ssh.nix
+            ];
+            users.lyrathorpe.homeModules = [
+              ./home
+              ./users/lyrathorpe/home.nix
             ];
           };
         };
 
         # Darwin host table — macOS machines built via mkDarwinHost. The shared
-        # ./lyrathorpe/home modules (shell, git, editor) are reused; the Linux-only
+        # ./home bundle (shell, git, editor) is reused directly; the Linux-only
         # desktop/sway modules are intentionally left out.
         darwinHosts = {
           lyrathorpe-mac = {
             system = "aarch64-darwin";
             username = "lyrathorpe";
-            fullName = "Lyra Thorpe";
             modules = [
-              ./system/machine/Darwin/configuration.nix
+              ./hosts/Darwin/configuration.nix
             ];
             homeModules = [
-              ./lyrathorpe/home
+              ./home
+              ./users/lyrathorpe/home.nix
             ];
           };
         };
@@ -392,6 +424,59 @@
         # Realise the host tables: each entry becomes a {nixos,darwin}Configuration.
         flake.nixosConfigurations = lib.mapAttrs (_name: mkHost) hosts;
         flake.darwinConfigurations = lib.mapAttrs (_name: mkDarwinHost) darwinHosts;
+
+        # Reusable home modules, exported for use off these hosts. See README
+        # "Portable home" for the consumer module-arg expectations.
+        flake.homeModules = {
+          default = ./home;
+          shell = ./home/shell.nix;
+          git = ./home/git.nix;
+          editor = ./home/editor.nix;
+          claude = ./home/claude.nix;
+          desktop = ./home/desktop.nix;
+          sway = ./home/sway.nix;
+        };
+
+        # Standalone home-manager configs (portable bundle) for machines not
+        # managed by this flake. See README "Portable home".
+        flake.homeConfigurations =
+          let
+            mkHome =
+              {
+                system,
+                name,
+              }:
+              home-manager.lib.homeManagerConfiguration {
+                pkgs = import nixpkgs {
+                  inherit system overlays;
+                  config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) unfreePackages;
+                };
+                extraSpecialArgs = {
+                  inherit inputs;
+                  portable = true;
+                  identity = userRegistry.${name} // {
+                    username = name;
+                  };
+                };
+                modules = [
+                  ./home
+                  {
+                    home.username = name;
+                    home.homeDirectory = "/home/${name}";
+                  }
+                ];
+              };
+          in
+          {
+            "lyrathorpe@x86_64-linux" = mkHome {
+              system = "x86_64-linux";
+              name = "lyrathorpe";
+            };
+            "lyrathorpe@aarch64-linux" = mkHome {
+              system = "aarch64-linux";
+              name = "lyrathorpe";
+            };
+          };
       }
     );
 }

home/KEYBINDINGS.md

@@ -188,10 +188,22 @@ across vim splits and tmux panes seamlessly. Everything else is stock vim, plus:
 | `<leader>rn`           | Rename symbol (LSP; `<leader>` is `Space`)                |
 | `<leader>ca`           | Code action (LSP)                                         |
 
-LSP covers Nix, Lua, Python and Terraform (the work box adds C# and Helm);
-completion (nvim-cmp) appears as you type. Files are formatted on save
-(conform-nvim). `:Git` opens fugitive; gitsigns shows gutter signs. which-key
-pops up after `<leader>` to show the rest.
+### Completion menu (nvim-cmp)
+
+Active only while the completion popup is open (it appears as you type, e.g.
+file paths):
+
+| Shortcut                | Action                                                             |
+| ----------------------- | ------------------------------------------------------------------ |
+| `Tab` / `Shift`+`Tab`   | Select next / previous item                                        |
+| `Ctrl`+`n` / `Ctrl`+`p` | Select next / previous item                                        |
+| `Ctrl`+`Space`          | Open the completion menu                                           |
+| `Enter`                 | Confirm the highlighted item (no auto-select; otherwise a newline) |
+| `Ctrl`+`e`              | Dismiss the menu                                                   |
+
+LSP covers Nix, Lua, Python and Terraform (the work box adds C# and Helm).
+Files are formatted on save (conform-nvim). `:Git` opens fugitive; gitsigns
+shows gutter signs. which-key pops up after `<leader>` to show the rest.
 
 ---
 

home/README.md

@@ -15,8 +15,10 @@ Keyboard shortcuts have their own reference: [`KEYBINDINGS.md`](./KEYBINDINGS.md
 | GUI apps, GTK/Firefox theming, cursor  | [`desktop.nix`](./desktop.nix) (graphical hosts only) |
 
 Shared by every host via [`default.nix`](./default.nix); the work box also layers
-[`work.nix`](./work.nix) on top (work email, its own ssh config, extra packages,
-and the C#/Helm language servers).
+[`work.nix`](../users/emmathorpe/work.nix) on top (its own ssh config, extra
+packages, and the C#/Helm language servers). The committer identity (name, email,
+signing key) comes from the user registry
+([`../users/registry.nix`](../users/registry.nix)), not this module.
 
 ---
 
@@ -55,7 +57,7 @@ and the C#/Helm language servers).
 | `hyperfine` / `sd`      | command-line benchmarking; saner find-and-replace than sed                                                                                                                                                                          |
 
 **Theming:** `fzf`, `bat`, `btop`, `lazygit` and `git`'s `delta` pager are all
-Catppuccin Mocha, driven from the shared `../catppuccin-mocha.nix` palette / the
+Catppuccin Mocha, driven from the shared `../lib/catppuccin-mocha.nix` palette / the
 catppuccin upstream themes.
 
 **Env & defaults:** `xdg.enable` on; `PAGER`/`MANPAGER` (bat) set in `default.nix`
@@ -108,23 +110,23 @@ declaratively with **nixvim**, so the same plugins and config are baked in on
 every host. Migrated from plain vim; the practical gain is a real LSP stack in
 place of the old (inert) ALE.
 
-| Feature        | Notes                                                                                  |
-| -------------- | -------------------------------------------------------------------------------------- |
-| Colorscheme    | Catppuccin Mocha (matches the terminal and the rest of the desktop)                    |
-| File tree      | nvim-tree, toggled with `,,` (comma twice; was nerdtree)                               |
-| Fuzzy finder   | telescope (+fzf-native): `<leader>ff` files, `<leader>fg` grep, `<leader>fb` buffers   |
-| Format on save | conform-nvim (nixfmt, stylua, ruff, shfmt, prettier, gofumpt; LSP fallback otherwise)  |
-| Git            | fugitive (`:Git …`) + gitsigns gutter signs/blame                                      |
-| Diagnostics    | inline + trouble list (`<leader>xx`)                                                   |
-| Completion     | nvim-cmp (LSP/buffer/path) with luasnip snippet expansion                              |
-| Indent guides  | indent-blankline, on by default (was vim-indent-guides)                                |
-| Statusline     | lualine (Catppuccin theme)                                                             |
-| Editing        | which-key hints, comment (`gc`/`gcc`), autopairs, treesitter textobjects               |
-| Pane nav       | vim-tmux-navigator — `Ctrl`+`h/j/k/l` moves across vim splits and tmux panes           |
-| Syntax         | tree-sitter (nix, lua, bash, markdown, groovy, c#, python, terraform, yaml)            |
-| LSP            | nvim-cmp completion + servers `nil` (Nix), `lua_ls`, `pyright` (Python), `terraformls` |
-| Indentation    | 2-wide hard tabs (`noexpandtab`, `tabstop`/`shiftwidth` = 2); line numbers on          |
-| Filetypes      | `*Jenkinsfile` → groovy                                                                |
+| Feature        | Notes                                                                                     |
+| -------------- | ----------------------------------------------------------------------------------------- |
+| Colorscheme    | Catppuccin Mocha (matches the terminal and the rest of the desktop)                       |
+| File tree      | nvim-tree, toggled with `,,` (comma twice; was nerdtree)                                  |
+| Fuzzy finder   | telescope (+fzf-native): `<leader>ff` files, `<leader>fg` grep, `<leader>fb` buffers      |
+| Format on save | conform-nvim (nixfmt, stylua, ruff, shfmt, prettier, gofumpt; LSP fallback otherwise)     |
+| Git            | fugitive (`:Git …`) + gitsigns gutter signs/blame                                         |
+| Diagnostics    | inline + trouble list (`<leader>xx`)                                                      |
+| Completion     | nvim-cmp (LSP/buffer/path) with luasnip snippet expansion                                 |
+| Indent guides  | indent-blankline, on by default (was vim-indent-guides)                                   |
+| Statusline     | lualine (Catppuccin theme)                                                                |
+| Editing        | which-key hints, comment (`gc`/`gcc`), autopairs, treesitter textobjects                  |
+| Pane nav       | vim-tmux-navigator — `Ctrl`+`h/j/k/l` moves across vim splits and tmux panes              |
+| Syntax         | tree-sitter (nix, lua, bash, markdown, groovy, c#, python, terraform, yaml)               |
+| LSP            | nvim-cmp completion + servers `nil_ls` (Nix), `lua_ls`, `pyright` (Python), `terraformls` |
+| Indentation    | 2-wide hard tabs (`noexpandtab`, `tabstop`/`shiftwidth` = 2); line numbers on             |
+| Filetypes      | `*Jenkinsfile` → groovy                                                                   |
 
 Leader is `Space`. LSP keymaps (`gd`, `gr`, `K`, `<leader>rn`, `<leader>ca`) and
 the file-tree toggle are listed in
@@ -147,17 +149,17 @@ current (`gc`/`fetch.writeCommitGraph`) so `lg` stays fast.
 | `lg`                     | graph log, all branches                                            |
 | `cz` `cc`                | `git cz <sub>` (e.g. `git cz c`) and `git cc` → commitizen prompt  |
 
-| Behaviour      |                                                                                                                                                                          |
-| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Pulls          | rebase, with autostash + autosquash                                                                                                                                      |
-| Fetch          | prune deleted remote branches                                                                                                                                            |
-| Conflicts      | `zdiff3` (shows the common ancestor)                                                                                                                                     |
-| Diffs          | histogram algorithm, colour-moved                                                                                                                                        |
-| `rerere`       | remembers + replays conflict resolutions                                                                                                                                 |
-| Commit editor  | full diff shown (`commit.verbose`)                                                                                                                                       |
-| Misc           | branches sorted by date, `column.ui = auto`, `help.autocorrect = prompt`, `push.autoSetupRemote`                                                                         |
-| Global ignores | `result`, `result-*`, `.direnv`, `*.swp`, `.DS_Store`                                                                                                                    |
-| Signing        | SSH commit + tag signing (`mkDefault`, so a host without the key in its agent can disable it). Personal email `iam@emmathe.dev`; the work box overrides email + signing. |
+| Behaviour      |                                                                                                                                                                                                                |
+| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Pulls          | rebase, with autostash + autosquash                                                                                                                                                                            |
+| Fetch          | prune deleted remote branches                                                                                                                                                                                  |
+| Conflicts      | `zdiff3` (shows the common ancestor)                                                                                                                                                                           |
+| Diffs          | histogram algorithm, colour-moved                                                                                                                                                                              |
+| `rerere`       | remembers + replays conflict resolutions                                                                                                                                                                       |
+| Commit editor  | full diff shown (`commit.verbose`)                                                                                                                                                                             |
+| Misc           | branches sorted by date, `column.ui = auto`, `help.autocorrect = prompt`, `push.autoSetupRemote`                                                                                                               |
+| Global ignores | `result`, `result-*`, `.direnv`, `*.swp`, `.DS_Store`                                                                                                                                                          |
+| Signing        | SSH commit + tag signing (`mkDefault`, so a host without the key in its agent can disable it). Name, email and signing key all come from the per-user `identity` (the user registry, `../users/registry.nix`). |
 
 ## ssh
 

home/desktop.nix

@@ -1,12 +1,13 @@
 # Graphical desktop layer: GUI apps, Wayland session env, and cursor theme.
 # Imported only on hosts that run Sway (MBP, T400, Mac Pro); never pulled onto
 # the headless WSL host. Login (and the Sway session launch) is handled by the
-# greetd/ReGreet greeter -- see ../swaywm.nix -- so there is no tty1 autostart.
+# greetd/ReGreet greeter -- see ../modules/sway.nix -- so there is no tty1
+# autostart.
 {
   pkgs,
   config,
   inputs,
-  username,
+  identity,
   ...
 }:
 {
@@ -89,7 +90,7 @@
   };
 
   # Firefox is themed at the browser level (it does not follow the GTK theme).
-  # The system installs the binary (programs.firefox in ../user.nix); here
+  # The system installs the binary (programs.firefox in ../modules/users.nix); here
   # home-manager owns only the profile, hence package = null. Apply the
   # Catppuccin Mocha theme add-on (only the mauve accent is packaged upstream;
   # the rest of the desktop uses blue) and make content + UI dark.
@@ -101,7 +102,7 @@
     # stateVersion<26.05 default-change warning (the new XDG path depends on
     # Firefox's own profile support).
     configPath = ".mozilla/firefox";
-    profiles.${username} = {
+    profiles.${identity.username} = {
       id = 0;
       isDefault = true;
       extensions = {

home/editor.nix

@@ -89,6 +89,18 @@
         enable = true;
         autoEnableSources = true;
         settings = {
+          # nvim-cmp ships no default keymaps; without these the menu shows but
+          # nothing accepts it. confirm uses select=false so a bare <CR> stays a
+          # newline unless an entry is explicitly highlighted.
+          mapping = {
+            "<C-n>" = "cmp.mapping.select_next_item()";
+            "<C-p>" = "cmp.mapping.select_prev_item()";
+            "<Tab>" = "cmp.mapping.select_next_item()";
+            "<S-Tab>" = "cmp.mapping.select_prev_item()";
+            "<CR>" = "cmp.mapping.confirm({ select = false })";
+            "<C-Space>" = "cmp.mapping.complete()";
+            "<C-e>" = "cmp.mapping.abort()";
+          };
           snippet.expand = "function(args) require('luasnip').lsp_expand(args.body) end";
           sources = [
             { name = "nvim_lsp"; }
@@ -109,7 +121,7 @@
       trouble.enable = true; # project-wide diagnostics/quickfix list
       lualine = {
         enable = true;
-        settings.options.theme = "catppuccin";
+        settings.options.theme = "catppuccin-mocha";
       };
       comment.enable = true; # gc / gcc comment toggling
       nvim-autopairs.enable = true;

home/git.nix

@@ -1,13 +1,13 @@
-# Version control: git + delta pager + commitizen + lazygit. The work host
-# layers commit signing and an email override on top (see work.nix).
+# Version control: git + delta + commitizen + lazygit. Committer identity comes
+# from the per-user `identity` arg (the registry). See README "Users".
 {
   pkgs,
   lib,
-  fullName,
+  identity,
   ...
 }:
 let
-  ctp = import ../catppuccin-mocha.nix;
+  ctp = import ../lib/catppuccin-mocha.nix;
 in
 {
   home.packages = [
@@ -18,10 +18,9 @@ in
     enable = true;
     package = pkgs.gitFull;
     settings = {
-      user.name = fullName;
-      # Personal identity. mkDefault so the work module overrides it on the work
-      # host (and to merge cleanly with that plain definition there).
-      user.email = lib.mkDefault "iam@emmathe.dev";
+      user.name = identity.fullName;
+      # mkDefault so a host-specific module can still override it.
+      user.email = lib.mkDefault identity.email;
       push.autoSetupRemote = true;
       init.defaultBranch = "main";
 
@@ -77,14 +76,10 @@ in
         cc = "!cz commit";
       };
 
-      # SSH commit signing. This personal key is the default; the work module
-      # (work.nix) overrides it with the work key on the EDaaS host, the same way
-      # user.email is overridden -- so mkDefault here lets that plain definition
-      # win instead of conflicting. gpgsign is mkDefault too, so a host without
-      # the key in its ssh-agent can override it to false rather than fail every
-      # commit.
+      # SSH signing, key from the registry. mkDefault so a host lacking the key
+      # in its agent can set gpgsign = false instead of failing every commit.
       gpg.format = "ssh";
-      user.signingkey = lib.mkDefault "key::ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDxHvdMTOzpFWUFMtCP7C/4tIOUO3GIO2QPvaifSnWH lyrathorpe@Lyra-MBA";
+      user.signingkey = lib.mkDefault identity.signingKey;
       commit.gpgsign = lib.mkDefault true;
       tag.gpgsign = lib.mkDefault true;
     };

home/shell.nix

@@ -8,7 +8,7 @@
 }:
 let
   # Shared Catppuccin Mocha palette: raw 6-hex strings, no leading "#".
-  ctp = import ../catppuccin-mocha.nix;
+  ctp = import ../lib/catppuccin-mocha.nix;
 in
 {
   imports = [

home/sway.nix

@@ -2,7 +2,7 @@
 # Imported via ./desktop.nix, so only graphical hosts get it.
 #
 # The compositor binary, PAM and the polkit *daemon* come from the system-level
-# programs.sway (see ../swaywm.nix); package = null below reuses it instead of
+# programs.sway (see ../modules/sway.nix); package = null below reuses it instead of
 # pulling a second Sway. The polkit authentication *agent* (the thing that draws
 # the GUI auth dialog) is a user service started here. home-manager owns the user
 # config (~/.config/sway) and wires the systemd user session (sway-session.target),
@@ -20,7 +20,7 @@ let
   # Catppuccin Mocha (shared with the ReGreet greeter). Raw hex; prefix "#"
   # where a consumer needs it -- Sway/i3status/dunst want "#", foot/swaylock do
   # not.
-  ctp = import ../catppuccin-mocha.nix;
+  ctp = import ../lib/catppuccin-mocha.nix;
 
   # Focused-window screenshot -> swappy editor (the dotfiles' grimshot.sh logic).
   # Full store paths so it needs nothing on PATH.
@@ -334,13 +334,12 @@ in
     ];
   };
 
-  # Night light. Manual location (no geoclue dependency); adjust the coordinates
-  # to taste. Warmer at night, neutral by day.
+  # Night light. Manual location (no geoclue dependency); warmer at night,
+  # neutral by day. Coordinates come from the per-user module (e.g.
+  # users/lyrathorpe/home.nix), not this shared module.
   services.gammastep = {
     enable = true;
     provider = "manual";
-    latitude = 51.5;
-    longitude = -0.13; # London-ish; set to your actual location
     temperature = {
       day = 6500;
       night = 3700;

hosts/Darwin/configuration.nix

@@ -1,5 +1,5 @@
 # Default nix-darwin host. Minimal macOS baseline; the user environment
-# (shell, git, editor) is carried by the shared ./lyrathorpe/home modules,
+# (shell, git, editor) is carried by the shared ./home modules,
 # the same ones used by the Linux hosts. nixpkgs.hostPlatform is set by
 # mkDarwinHost in flake.nix.
 { pkgs, username, ... }:
@@ -97,6 +97,7 @@
       "llvm@21"
       "lld@21"
       "python@3.14"
+      "dosbox-staging"
     ];
     # GUI applications. macOS app bundles are managed as casks; nixpkgs darwin
     # GUI support is unreliable, so these stay on brew for continuity.

hosts/EDaaS/configuration.nix

@@ -19,9 +19,7 @@
     defaultUser = "emmathorpe";
     wslConf.automount.root = "/mnt";
     wslConf.interop.appendWindowsPath = true;
-    wslConf.interop.register = true;
     wslConf.interop.enabled = true;
-    wslConf.interop.includePath = true;
     wslConf.network.generateHosts = false;
     startMenuLaunchers = true;
     docker-desktop.enable = false;
@@ -64,12 +62,16 @@
 
   features.swayDesktop.enable = false;
 
-  # Keep this user's systemd --user instance running without an open login
-  # session, so the home-manager user timer (renovate-review.nix) fires on
-  # schedule even when no terminal is attached. On WSL the timer still only runs
-  # while the distro itself is up; Persistent=true catches up a missed run at
-  # next start.
-  users.users.emmathorpe.linger = true;
+  # Opt out of fleet-wide SSSD/Authentik LDAP auth: this is a work-managed WSL
+  # box, not part of the personal directory. Every other NixOS host inherits the
+  # default-true from modules/sssd.nix.
+  services.authentikLdap.enable = false;
+
+  # NOTE: this user's systemd --user lingering -- so the home-manager renovate
+  # timer fires without an open login session -- is enabled from the host table
+  # in flake.nix (users.emmathorpe.linger = true) and applied by
+  # modules/users.nix.
+
   # programs.nix-ld is enabled for all NixOS hosts in common-nixos.nix.
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions

hosts/MacPro31/configuration.nix

@@ -26,10 +26,8 @@
   # workstation.nix is the backstop).
   zramSwap.enable = true;
 
-  # This host accepts SSH, so open 22 (the firewall itself is enabled in
-  # workstation.nix with a default-deny policy).
-  services.openssh.enable = true;
-  networking.firewall.allowedTCPPorts = [ 22 ];
+  # sshd (daemon, port 22, key-only policy) comes from ../../modules/ssh.nix;
+  # the firewall itself is enabled in workstation.nix with a default-deny policy.
 
   # Dual Harpertown Xeon microcode. Redistributable firmware (GPU/NIC blobs) is
   # enabled in workstation.nix.
@@ -42,7 +40,7 @@
   #   - ATI Radeon HD 2600 XT -> "radeon" (older) or "amdgpu" KMS
   #   - NVIDIA GeForce 8800 GT -> "nouveau" KMS
   # These come up automatically via the in-tree drivers + KMS, and the graphics
-  # stack itself is enabled by swaywm.nix. If a card needs to be forced, add it
+  # stack itself is enabled by modules/sway.nix. If a card needs to be forced, add it
   # here, e.g. `services.xserver.videoDrivers = [ "radeon" ];` (or "nouveau"),
   # and/or `boot.initrd.kernelModules = [ "radeon" ];` in
   # hardware-configuration.nix for early KMS.

hosts/RPi5/README.md

@@ -0,0 +1,68 @@
+# Raspberry Pi 5 (`lyrathorpe-rpi5`)
+
+Headless `aarch64-linux` server with two roles:
+
+- **Docker host** — daemon exposed over the network (`docker.nix`).
+- **nginx reverse proxy** — declarative `virtualHosts` (`reverse-proxy.nix`).
+
+## Install
+
+1. Flash a NixOS `aarch64` SD image (or USB) and boot the Pi. The
+   `raspberry-pi-5` profile from `nixos-hardware` (wired in the flake host table)
+   supplies the kernel, firmware and device tree; boot is U-Boot + extlinux.
+2. Partition/mount the target, then **regenerate the hardware config on the
+   device** and replace the committed placeholder:
+   ```sh
+   nixos-generate-config --root /mnt
+   # copy /mnt/etc/nixos/hardware-configuration.nix over
+   # system/machine/RPi5/hardware-configuration.nix in this repo, then commit
+   ```
+   `hardware-configuration.nix` in this directory is a **placeholder** committed
+   only so the host evaluates in CI. The machine will not boot correctly until it
+   is replaced with the generated one.
+3. Set the host name to match the flake attribute (already done in
+   `configuration.nix`: `lyrathorpe-rpi5`) and build:
+   ```sh
+   sudo nixos-rebuild switch --flake .#lyrathorpe-rpi5
+   # or, once the hostname is live:
+   nh os switch
+   ```
+4. Give the login user a password (`passwd lyrathorpe`) and confirm the key in
+   `system/modules/ssh.nix` is the one you will connect with.
+
+## Docker socket (security)
+
+The daemon listens on **plain TCP `2375`, no TLS, no auth**. Access is
+root-equivalent on this host. The only protection is the nftables rule in
+`docker.nix`, which accepts `2375` **only** from the trusted LAN subnet
+(`10.187.1.0/24` by default — change it to match your network). Do not widen
+that subnet to anything untrusted.
+
+From a LAN client:
+
+```sh
+export DOCKER_HOST=tcp://lyrathorpe-rpi5:2375
+docker info
+```
+
+The secure upgrade path is mutual TLS on `2376` (`--tlsverify` with a CA and
+client certs); it needs out-of-band cert provisioning and is intentionally not
+wired here.
+
+## Adding a reverse-proxy site
+
+Each proxied service is a Nix entry in `reverse-proxy.nix`:
+
+```nix
+services.nginx.virtualHosts."app.example.lan" = {
+  # enableACME = true; forceSSL = true;   # once a DNS name + cert exist
+  locations."/" = {
+    proxyPass = "http://127.0.0.1:8080";  # e.g. a local container
+    proxyWebsockets = true;
+  };
+};
+```
+
+The example vhost is HTTP-only by design. Turn on `enableACME`/`forceSSL`
+per-vhost once the host has a real DNS name and the ACME challenge can be met;
+`443` is already open in the firewall.

hosts/RPi5/configuration.nix

@@ -0,0 +1,37 @@
+# Raspberry Pi 5 (aarch64) headless server. Two roles, split into submodules:
+# ./docker.nix (Docker host with a network socket) and ./reverse-proxy.nix
+# (native nginx). The raspberry-pi-5 nixos-hardware profile (kernel, firmware,
+# device tree) and key-only sshd (../../modules/ssh.nix) are layered on in the
+# flake host table. Install notes: see ./README.md.
+{ ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./docker.nix
+    ./reverse-proxy.nix
+  ];
+
+  # Match the flake's nixosConfigurations attribute name so `nh os switch`
+  # (which selects by the local hostname) resolves without an explicit -H flag.
+  networking.hostName = "lyrathorpe-rpi5";
+
+  # Headless server: the Sway desktop is intentionally not set up. modules/sway.nix is
+  # not imported and features.swayDesktop.enable defaults to false (declared in
+  # system/modules/features.nix), so this host keeps plain TTY/SSH login.
+
+  # Raspberry Pi boots via U-Boot + extlinux, not GRUB/systemd-boot. The
+  # raspberry-pi-5 nixos-hardware profile supplies the kernel, firmware and
+  # device tree.
+  boot.loader.grub.enable = false;
+  boot.loader.generic-extlinux-compatible.enable = true;
+
+  # Remote administration: the daemon, port 22 and key-only policy all come from
+  # ../../modules/ssh.nix.
+
+  # Default-deny inbound; the Docker and nginx submodules open their own ports
+  # (Docker via a source-restricted nftables rule, nginx via 80/443).
+  networking.firewall.enable = true;
+
+  # See `man configuration.nix` / the stateVersion docs before changing.
+  system.stateVersion = "26.05";
+}

hosts/RPi5/docker.nix

@@ -0,0 +1,38 @@
+# Docker host with the daemon socket exposed over the network.
+#
+# SECURITY: the daemon listens on plain TCP 2375 with NO TLS and NO auth. Access
+# to that port is root-equivalent on this host (the Docker API can mount the
+# host filesystem and run privileged containers). The ONLY thing protecting it
+# is the nftables rule below, which accepts 2375 solely from the trusted LAN
+# subnet. Do not widen that subnet to anything you do not fully trust. The
+# secure upgrade path is mutual TLS on 2376 (--tlsverify with client certs);
+# that needs out-of-band cert provisioning and is intentionally not wired here.
+{ ... }:
+let
+  # LAN allowed to reach the unauthenticated Docker TCP socket (see SECURITY above).
+  trustedSubnet = "10.187.1.0/24";
+in
+{
+  virtualisation.docker.enable = true;
+
+  # Expose the daemon over TCP by extending systemd socket activation rather than
+  # setting daemon.settings.hosts. The NixOS docker unit starts dockerd with
+  # `-H fd://` and takes its listeners from this socket; putting `hosts` in
+  # daemon.json as well would conflict with that and dockerd would refuse to
+  # start. Adding the TCP listener here keeps a single source of truth.
+  # The leading "" resets the unit's default (unix-socket-only) ListenStream list.
+  systemd.sockets.docker.socketConfig.ListenStream = [
+    ""
+    "/run/docker.sock"
+    "0.0.0.0:2375"
+  ];
+
+  # Source-restricted firewall rule for the Docker TCP port. 2375 is deliberately
+  # NOT added to networking.firewall.allowedTCPPorts (that would open it to every
+  # source); instead nftables accepts it only from the trusted subnet. Adjust the
+  # CIDR to match the LAN that should reach the Docker API.
+  networking.nftables.enable = true;
+  networking.firewall.extraInputRules = ''
+    ip saddr ${trustedSubnet} tcp dport 2375 accept
+  '';
+}

hosts/RPi5/hardware-configuration.nix

@@ -0,0 +1,31 @@
+# PLACEHOLDER hardware configuration for the Raspberry Pi 5.
+#
+# This file is NOT the real generated config -- it exists only so the host
+# evaluates in CI before the Pi is provisioned. The machine will not boot from
+# it as-is. On first install, regenerate this file on the device with
+#   nixos-generate-config --root /mnt
+# and replace this placeholder with the output (commit it). See ./README.md.
+#
+# Like every hardware-configuration.nix in this repo, this file is excluded from
+# the formatter and linters (see the pre-commit/treefmt excludes in flake.nix).
+{ modulesPath, ... }:
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  nixpkgs.hostPlatform = "aarch64-linux";
+
+  # The Raspberry Pi 5 boots from an SD card / USB with a FAT firmware partition
+  # and an ext4 root. Labels match the conventional sd-image layout; the real
+  # generated config will use by-uuid device paths instead.
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/NIXOS_SD";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot/firmware" = {
+    device = "/dev/disk/by-label/FIRMWARE";
+    fsType = "vfat";
+  };
+
+  swapDevices = [ ];
+}

hosts/RPi5/reverse-proxy.nix

@@ -0,0 +1,39 @@
+# Native nginx reverse proxy. The proxy configuration is declarative Nix:
+# every proxied service is an entry under services.nginx.virtualHosts, so the
+# whole routing table lives in this file and is built/version-controlled with
+# the rest of the system.
+#
+# To add a proxied service, add another virtualHosts."<host>" entry following
+# the example below. To serve it over HTTPS, uncomment enableACME + forceSSL on
+# that vhost once it has a real DNS name and the ACME HTTP-01/DNS-01 challenge
+# can be satisfied (see security.acme for the account/email and DNS settings).
+{ ... }:
+{
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true; # sane proxy_set_header defaults (Host, X-Forwarded-*)
+    recommendedTlsSettings = true;
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
+
+    virtualHosts = {
+      # Example reverse-proxy vhost. Replace the name and upstream with a real
+      # service (e.g. a container published by the Docker host on this machine).
+      "example.lan" = {
+        # enableACME = true;   # request a Let's Encrypt cert for this host
+        # forceSSL = true;     # redirect HTTP -> HTTPS once the cert exists
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:8080";
+          proxyWebsockets = true; # forward Upgrade/Connection for WebSocket apps
+        };
+      };
+    };
+  };
+
+  # Public reverse-proxy ports. 443 is opened now so flipping a vhost to TLS
+  # needs no firewall change.
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
+}

hosts/T400/configuration.nix

@@ -21,10 +21,8 @@
   # Low-RAM host (4 GiB max): a compressed RAM swap reduces disk paging.
   zramSwap.enable = true;
 
-  # This host accepts SSH, so open 22 (the firewall itself is enabled in
-  # laptop.nix with a default-deny policy).
-  services.openssh.enable = true;
-  networking.firewall.allowedTCPPorts = [ 22 ];
+  # sshd (daemon, port 22, key-only policy) comes from ../../modules/ssh.nix;
+  # the firewall itself is enabled in laptop.nix with a default-deny policy.
 
   # Intel Core 2 (Penryn) microcode. Redistributable firmware (enabled in
   # workstation.nix) supplies the iwlwifi blobs (Intel WiFi Link 5100/5300) and

lib/catppuccin-mocha.nix

@@ -1,6 +1,6 @@
 # Catppuccin Mocha palette. Raw 6-digit hex (no leading "#"); consumers add a
 # "#" where their format needs it. Shared by the Sway desktop theming
-# (home/sway.nix) and the ReGreet greeter (swaywm.nix) so the two stay in sync.
+# (home/sway.nix) and the ReGreet greeter (modules/sway.nix) so the two stay in sync.
 {
   base = "1e1e2e";
   mantle = "181825";

lyrathorpe/user.nix

@@ -1,28 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  username,
-  fullName,
-  ...
-}:
-
-{
-  programs.zsh.enable = true;
-  users.users.${username} = {
-    isNormalUser = true;
-    home = "/home/${username}";
-    description = fullName;
-    extraGroups = [
-      "wheel"
-      "docker"
-    ];
-    shell = pkgs.zsh;
-  };
-  programs.firefox = lib.mkIf (config.features.swayDesktop.enable == true) {
-    enable = true;
-  };
-  programs.thunderbird = lib.mkIf (config.features.swayDesktop.enable == true) {
-    enable = true;
-  };
-}

modules/desktop.nix

@@ -2,7 +2,7 @@
 # shared ./workstation.nix base and swaps the mobile Wi-Fi backend for wired
 # NetworkManager. A desktop host also sets `portable = false` in its host-table
 # entry (flake.nix), which drops the battery block and brightness keybindings
-# from the Sway bar -- see lyrathorpe/home/sway.nix.
+# from the Sway bar -- see home/sway.nix.
 { ... }:
 {
   imports = [ ./workstation.nix ];

modules/features.nix

@@ -0,0 +1,12 @@
+# Feature-flag option declarations shared by every NixOS host (imported via
+# baseModules in flake.nix). Declaring the flags here -- rather than inside the
+# module that implements them -- means a host can read or set a flag without
+# importing the (often large) implementation module. In particular,
+# features.swayDesktop.enable is read by modules/users.nix on every host, but a
+# headless host (e.g. the Pi) must be able to leave it at its default without
+# pulling in modules/sway.nix. The implementation lives in modules/sway.nix,
+# gated on this flag.
+{ lib, ... }:
+{
+  options.features.swayDesktop.enable = lib.mkEnableOption "the Sway desktop";
+}

modules/laptop.nix

@@ -2,7 +2,7 @@
 # flake.nix. Shared graphical-workstation settings live in ./workstation.nix;
 # the only laptop-specific bit is the Wi-Fi backend. Mobile home-manager
 # components (battery block, brightness keys) are gated by the `portable` flag
-# threaded through mkHost -- see lyrathorpe/home/sway.nix.
+# threaded through mkHost -- see home/sway.nix.
 { ... }:
 {
   imports = [ ./workstation.nix ];

modules/ssh.nix

@@ -0,0 +1,14 @@
+# sshd for the hosts that run it (T400, Mac Pro, RPi5): enable the daemon, open
+# port 22, and apply a key-only policy. Authorized keys are owned per-user by the
+# registry (modules/users.nix), not here.
+{ ... }:
+{
+  services.openssh.enable = true;
+  networking.firewall.allowedTCPPorts = [ 22 ];
+
+  services.openssh.settings = {
+    PasswordAuthentication = false; # keys only
+    KbdInteractiveAuthentication = false; # no keyboard-interactive fallback
+    PermitRootLogin = "no";
+  };
+}

modules/sssd.nix

@@ -0,0 +1,130 @@
+# Authentik LDAP authentication for NixOS hosts.
+#
+# Wires SSSD (System Security Services Daemon) to the Authentik LDAP outpost so
+# every Linux host authenticates users against the same directory that backs the
+# SSO stack. Enabled by default on every NixOS host via baseModules; the EDaaS
+# WSL box opts out (services.authentikLdap.enable = false) because it is a
+# work-managed Windows-hosted environment.
+#
+# The Authentik LDAP provider exposes NON-standard object classes/attributes
+# (goauthentik.io/ldap/user, goauthentik.io/ldap/group) alongside the POSIX
+# attributes (uid, uidNumber, gidNumber, homeDirectory), so the schema mappings
+# below are explicit rather than relying on an RFC2307 default.
+#
+# The bind password is NOT inlined: services.sssd.config renders to the world-
+# readable Nix store, so the credential is delivered out-of-band by agenix as an
+# sssd.conf drop-in under /etc/sssd/conf.d/ (SSSD merges conf.d/*.conf after the
+# main file). See secrets/README.md.
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.authentikLdap;
+
+  # Directory coordinates for the Authentik LDAP provider.
+  ldapUri = "ldaps://ldap.lyrapup.pet:636";
+  searchBase = "dc=ldap,dc=goauthentik,dc=io";
+  bindDn = "cn=sssd-bind,ou=users,dc=ldap,dc=goauthentik,dc=io";
+in
+{
+  options.services.authentikLdap.enable =
+    lib.mkEnableOption "SSSD authentication against the Authentik LDAP outpost"
+    // {
+      default = true;
+    };
+
+  config = lib.mkIf cfg.enable {
+    services.sssd = {
+      enable = true;
+
+      # Non-secret sssd.conf. The bind password is injected separately via the
+      # agenix conf.d drop-in (ldap_default_authtok lives there, not here) to
+      # keep it out of the Nix store.
+      config = ''
+        [sssd]
+        config_file_version = 2
+        services = nss, pam
+        domains = default
+
+        [nss]
+        # Do not walk the whole directory for `getent passwd` etc.
+        filter_users = root
+        filter_groups = root
+
+        [pam]
+
+        [domain/default]
+        # --- Providers --------------------------------------------------------
+        id_provider = ldap
+        auth_provider = ldap
+        chpass_provider = none
+        access_provider = permit
+
+        # --- Connection -------------------------------------------------------
+        ldap_uri = ${ldapUri}
+        ldap_search_base = ${searchBase}
+        ldap_default_bind_dn = ${bindDn}
+        ldap_default_authtok_type = password
+        # ldap_default_authtok is supplied by the agenix drop-in in conf.d.
+
+        # --- TLS (LDAPS on 636; no StartTLS) ---------------------------------
+        ldap_id_use_start_tls = false
+        ldap_tls_reqcert = demand
+
+        # --- Schema: Authentik LDAP provider ---------------------------------
+        # Authentik returns DN-valued group membership (member/memberOf), so
+        # rfc2307bis (not rfc2307) is the correct base schema.
+        ldap_schema = rfc2307bis
+
+        # Users: goauthentik.io/ldap/user, keyed by uid; POSIX attrs are
+        # standard names (uidNumber/gidNumber/homeDirectory).
+        ldap_user_object_class = goauthentik.io/ldap/user
+        ldap_user_name = uid
+        ldap_user_uid_number = uidNumber
+        ldap_user_gid_number = gidNumber
+        ldap_user_home_directory = homeDirectory
+        ldap_user_gecos = displayName
+        ldap_user_shell = loginShell
+
+        # Groups: goauthentik.io/ldap/group, keyed by cn.
+        ldap_group_object_class = goauthentik.io/ldap/group
+        ldap_group_name = cn
+        ldap_group_gid_number = gidNumber
+        ldap_group_member = member
+
+        # --- Behaviour --------------------------------------------------------
+        cache_credentials = true
+        enumerate = false
+      '';
+    };
+
+    # agenix delivers the bind password as an sssd.conf drop-in. The decrypted
+    # plaintext IS a valid conf.d snippet:
+    #
+    #   [domain/default]
+    #   ldap_default_authtok = <the bind password>
+    #
+    # SSSD requires conf.d files to be root-owned and 0600 or it ignores them.
+    age.secrets.ldap-bind = {
+      file = ../secrets/ldap-bind.age;
+      path = "/etc/sssd/conf.d/01-ldap-authtok.conf";
+      owner = "root";
+      group = "root";
+      mode = "0600";
+    };
+
+    # Restart SSSD when the credential drop-in changes. agenix writes secrets in
+    # a system activation script that runs before systemd (re)starts services on
+    # a `switch`, so the file is present by the time sssd starts; the trigger
+    # picks up rotations of the bind password.
+    systemd.services.sssd.restartTriggers = [ config.age.secrets.ldap-bind.path ];
+
+    # Create home directories on first login for LDAP users (they have no
+    # locally-provisioned home). NixOS wires nss + the SSSD PAM stack when
+    # services.sssd.enable is true; mkHomeDir adds pam_mkhomedir to it.
+    security.pam.services.login.makeHomeDir = true;
+    security.pam.services.sshd.makeHomeDir = true;
+  };
+}

modules/sway.nix

@@ -7,13 +7,13 @@
 
 let
   cfg = config.features.swayDesktop;
-  # Catppuccin Mocha (shared with the Sway desktop, see lyrathorpe/home/sway.nix).
-  ctp = import ./catppuccin-mocha.nix;
+  # Catppuccin Mocha (shared with the Sway desktop, see home/sway.nix).
+  ctp = import ../lib/catppuccin-mocha.nix;
 in
 {
-  options = {
-    features.swayDesktop.enable = lib.mkEnableOption "Enable Sway Desktop";
-  };
+  # The features.swayDesktop.enable option is declared in
+  # system/modules/features.nix (so headless hosts can read/set it without
+  # importing this module). This module only provides its implementation.
   config = lib.mkIf cfg.enable {
     programs.sway = {
       enable = true;

modules/users.nix

@@ -0,0 +1,38 @@
+# System user accounts, built from the registry (users/registry.nix) for the
+# host's `hostUsers` set. See README "Users".
+{
+  config,
+  pkgs,
+  lib,
+  hostUsers,
+  userRegistry,
+  ...
+}:
+
+{
+  programs.zsh.enable = true;
+
+  users.users = lib.mapAttrs (
+    name: spec:
+    let
+      id = userRegistry.${name};
+    in
+    {
+      isNormalUser = true;
+      home = "/home/${name}";
+      description = id.fullName;
+      inherit (id) extraGroups;
+      openssh.authorizedKeys.keys = id.sshAuthorizedKeys;
+      shell = pkgs.zsh;
+    }
+    # linger opt-in (host table); left unmanaged when unset.
+    // lib.optionalAttrs (spec ? linger) { inherit (spec) linger; }
+  ) hostUsers;
+
+  programs.firefox = lib.mkIf (config.features.swayDesktop.enable == true) {
+    enable = true;
+  };
+  programs.thunderbird = lib.mkIf (config.features.swayDesktop.enable == true) {
+    enable = true;
+  };
+}

secrets/README.md

@@ -0,0 +1,92 @@
+# Secrets (agenix)
+
+Encrypted secrets for the fleet, managed with [agenix](https://github.com/ryantm/agenix).
+
+Each secret is an age-encrypted file (`*.age`) encrypted to a set of recipient
+public keys declared in [`secrets.nix`](./secrets.nix). A host decrypts its
+secrets at activation using its SSH **host** key
+(`/etc/ssh/ssh_host_ed25519_key`), so every host that must read a secret has to
+be listed as a recipient for it.
+
+`secrets.nix` is read only by the `agenix` CLI. It is never imported into the
+NixOS evaluation.
+
+## Secrets in this repo
+
+| File            | Purpose                                                                 | Recipients                          |
+| --------------- | ----------------------------------------------------------------------- | ----------------------------------- |
+| `ldap-bind.age` | SSSD → Authentik LDAP bind credential, as an `sssd.conf` drop-in snippet | all SSSD-enabled hosts (not EDaaS)  |
+
+Consumed by [`modules/sssd.nix`](../modules/sssd.nix) via
+`age.secrets.ldap-bind.path`, which places the decrypted snippet at
+`/etc/sssd/conf.d/01-ldap-authtok.conf`.
+
+> **`ldap-bind.age` is not committed yet.** Only `ldap-bind.age.PLACEHOLDER`
+> ships in this change (real host recipient keys and the real password were not
+> available when it was written). Follow the steps below to create the real
+> secret, then delete the `.PLACEHOLDER`.
+
+## Owner setup checklist
+
+Run these once (per new host or when the bind password rotates):
+
+### 1. Collect host recipient keys
+
+On each SSSD-enabled host (all Linux hosts **except** EDaaS):
+
+```sh
+cat /etc/ssh/ssh_host_ed25519_key.pub
+```
+
+Paste each value into the matching placeholder in `secrets.nix`, replacing the
+`AAAA_PLACEHOLDER_REPLACE_ME_*` strings. (Optionally uncomment and set `admin`
+to an operator user key so the secret can be edited off-host.)
+
+### 2. Encrypt the bind password
+
+The plaintext must be a **full sssd.conf drop-in snippet**, because SSSD cannot
+read `ldap_default_authtok` from a separate file — it only merges `conf.d/*.conf`.
+The content is exactly:
+
+```ini
+[domain/default]
+ldap_default_authtok = <the sssd-bind service-account password>
+```
+
+Use the password of the `sssd-bind` (Terraform: `sssd-bind`) Authentik LDAP
+service account. Then, from the repo root:
+
+```sh
+# Requires the agenix CLI: `nix run github:ryantm/agenix -- -e secrets/ldap-bind.age`
+cd secrets
+agenix -e ldap-bind.age
+```
+
+An `$EDITOR` opens; paste the two-line snippet above, save, quit. agenix writes
+the encrypted `ldap-bind.age`. Commit it and delete `ldap-bind.age.PLACEHOLDER`.
+
+### 3. Rekey after changing recipients
+
+If you add/remove hosts in `secrets.nix`, re-encrypt every secret to the new
+recipient set:
+
+```sh
+cd secrets
+agenix -r
+```
+
+### 4. DNS
+
+`ldap.lyrapup.pet` must resolve to the Authentik LDAP outpost and serve LDAPS on
+port 636 with a certificate the hosts trust (`ldap_tls_reqcert = demand`). If the
+cert is not from a system-trusted CA, add it to the hosts' trust store
+(`security.pki.certificateFiles`) or relax `ldap_tls_reqcert` in
+`modules/sssd.nix`.
+
+### 5. Rebuild
+
+```sh
+sudo nixos-rebuild switch --flake .#<host>
+```
+
+Verify with `getent passwd <ldap-user>` and `id <ldap-user>`.

secrets/ldap-bind.age.PLACEHOLDER

@@ -0,0 +1,21 @@
+THIS IS A PLACEHOLDER, NOT A REAL AGE SECRET.
+
+The real secrets/ldap-bind.age is produced by the repo owner with `agenix -e`
+(see secrets/README.md) and is a binary age-encrypted blob. It is intentionally
+NOT committed here because:
+  * the real host age recipients are not available to the author of this change
+    (they are each host's /etc/ssh/ssh_host_ed25519_key.pub), and
+  * fabricating an encrypted blob or fake host keys would be misleading.
+
+Committing this file as `ldap-bind.age` would let modules/sssd.nix reference
+`../secrets/ldap-bind.age` and evaluate, but SSSD would fail to decrypt it at
+runtime. Do ONE of the following before deploying:
+
+  1. Preferred: generate the real secret (secrets/README.md), commit it as
+     secrets/ldap-bind.age, and delete this .PLACEHOLDER file.
+
+The decrypted plaintext must be a valid sssd.conf drop-in (NOT the bare
+password):
+
+    [domain/default]
+    ldap_default_authtok = <the sssd-bind service-account password>

secrets/secrets.nix

@@ -0,0 +1,15 @@
+let
+  lyrathorpe-mbp = "ssh-ed25519 AAAA_PLACEHOLDER_REPLACE_ME_mbp";
+  lyrathorpe-t400 = "ssh-ed25519 AAAA_PLACEHOLDER_REPLACE_ME_t400";
+  lyrathorpe-macpro31 = "ssh-ed25519 AAAA_PLACEHOLDER_REPLACE_ME_macpro31";
+  lyrathorpe-rpi5 = "ssh-ed25519 AAAA_PLACEHOLDER_REPLACE_ME_rpi5";
+  sssdHosts = [
+    lyrathorpe-mbp
+    lyrathorpe-t400
+    lyrathorpe-macpro31
+    lyrathorpe-rpi5
+  ];
+in
+{
+  "ldap-bind.age".publicKeys = sssdHosts;
+}

system/modules/ssh.nix

@@ -1,19 +0,0 @@
-# Key-only SSH hardening, imported by the hosts that run sshd (T400, Mac Pro).
-# The host config still does `services.openssh.enable = true` and opens port 22
-# next to where it documents the listening service; this module only tightens
-# the policy and installs the authorized key, so a host opting into sshd cannot
-# accidentally ship password/root login.
-{ username, ... }:
-{
-  services.openssh.settings = {
-    PasswordAuthentication = false; # keys only
-    KbdInteractiveAuthentication = false; # no keyboard-interactive fallback
-    PermitRootLogin = "no";
-  };
-
-  # The key permitted to log in as the primary user. Add more entries here as
-  # new client machines are provisioned.
-  users.users.${username}.openssh.authorizedKeys.keys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDxHvdMTOzpFWUFMtCP7C/4tIOUO3GIO2QPvaifSnWH lyrathorpe@Lyra-MBA"
-  ];
-}

users/emmathorpe/work.nix

@@ -1,6 +1,11 @@
-# Home-manager module for the work (EDaaS/WSL) profile: corporate git signing,
-# work toolchain packages and tmux tweaks. Imported only by the work host.
-{ pkgs, lib, ... }:
+# Work (EDaaS/WSL) home profile: corporate toolchain + tmux tweaks. Git identity
+# comes from the registry (users/registry.nix), not here.
+{
+  pkgs,
+  lib,
+  inputs,
+  ...
+}:
 
 {
   # Host-scoped extras for this machine only (the EDaaS/WSL host).
@@ -12,15 +17,6 @@
   # programs.ssh (shell.nix) take it over. The ssh-agent below still runs.
   programs.ssh.enable = lib.mkForce false;
 
-  programs.git = {
-    settings = {
-      commit.gpgsign = true;
-      tag.gpgsign = true;
-      gpg.format = "ssh";
-      user.signingkey = "key::ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAJMVgeRKnfX1G8coU3nAobI485aeUpGTMqH7+zbKI8o emma.thorpe@cloud.com";
-      user.email = "emma.thorpe@citrix.com";
-    };
-  };
   home.packages = [
     pkgs.kubectl
     pkgs.argo-rollouts
@@ -33,7 +29,6 @@
     pkgs.powershell
     pkgs.nuget
     pkgs.gedit
-    pkgs.lens
     pkgs.python3
     pkgs.gnumake
     pkgs.gcc
@@ -57,8 +52,10 @@
     docker = "/run/current-system/sw/bin/docker";
   };
   programs.tmux = {
+    # kube context/namespace in the status line. kube-tmux is pinned as a flake
+    # input (it is not in nixpkgs), so the script is always present in the store.
     extraConfig = ''
-      			set -g status-right "#(/run/current-system/sw/bin/bash $HOME/code/kube-tmux/kube.tmux 250 red black)"		
+      set -g status-right "#(${pkgs.bash}/bin/bash ${inputs.kube-tmux}/kube.tmux 250 red black)"
     '';
   };
   programs.go = {
@@ -66,7 +63,7 @@
   };
 
   # LSP servers only relevant to work: C# (omnisharp) and Helm charts (helm_ls).
-  # The shared editor (lyrathorpe/home/editor.nix) carries the universal ones;
+  # The shared editor (home/editor.nix) carries the universal ones;
   # these are gated to this host so the heavy omnisharp closure stays off the
   # personal machines. Tree-sitter grammars (highlighting) remain global there.
   programs.nixvim.plugins.lsp.servers = {

users/lyrathorpe/home.nix

@@ -0,0 +1,17 @@
+# Lyra's personal home extras, imported on her hosts (not the work box). Keeps
+# personal data out of the shared home/ modules. See README "Users".
+{ pkgs, lib, ... }:
+{
+  # Personal ssh host shortcut.
+  programs.ssh.settings."dockerpi.inf.cbg.emmaisvery.gay" = {
+    User = "emmathorpe";
+  };
+
+  # Night-light location for gammastep (the service itself is enabled by
+  # home/sway.nix on graphical hosts). Linux-guarded so Darwin, which imports
+  # this module but has no gammastep, skips it.
+  services.gammastep = lib.mkIf pkgs.stdenv.hostPlatform.isLinux {
+    latitude = 51.5;
+    longitude = -0.13;
+  };
+}

users/registry.nix

@@ -0,0 +1,28 @@
+# User identity registry -- pure data, keyed by username. See README "Users".
+# (`identity.username` is injected by mkHost, so it is not repeated here.)
+{
+  lyrathorpe = {
+    fullName = "Lyra Thorpe";
+    email = "iam@emmathe.dev";
+    extraGroups = [
+      "wheel"
+      "docker"
+    ];
+    sshAuthorizedKeys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDxHvdMTOzpFWUFMtCP7C/4tIOUO3GIO2QPvaifSnWH lyrathorpe@Lyra-MBA"
+    ];
+    signingKey = "key::ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDxHvdMTOzpFWUFMtCP7C/4tIOUO3GIO2QPvaifSnWH lyrathorpe@Lyra-MBA";
+  };
+
+  emmathorpe = {
+    fullName = "Emma Thorpe";
+    email = "emma.thorpe@citrix.com";
+    extraGroups = [
+      "wheel"
+      "docker"
+    ];
+    # No personal key on file yet; add one if SSH login as emmathorpe is wanted.
+    sshAuthorizedKeys = [ ];
+    signingKey = "key::ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAJMVgeRKnfX1G8coU3nAobI485aeUpGTMqH7+zbKI8o emma.thorpe@cloud.com";
+  };
+}