feat(hosts): add the Raspberry Pi Zero 2 W Psion sidecar

A headless aarch64 companion for a Psion 5MX: PPP over RS232 with NAT out to wifi and a telnet login, plus a cleartext POP3/SMTP proxy for the Psion's mail client. - hosts/PiZero2W/: host config, serial-ppp.nix, email-proxy.nix, an SD-image variant, and a hardware-configuration.nix placeholder. - Host table entry on nixos-hardware's raspberry-pi-3 profile; the Zero 2 W is the Pi 3's BCM2837 SoC. nixpkgs' linuxPackages_rpi02w is deprecated and warns that the linux-rpi series is being removed in favour of nixos-hardware. - The host owns its firmware partition (hardware.raspberry-pi.firmware), which is what puts the disable-bt and uart0/ctsrts overlays in config.txt so /dev/ttyAMA0 is the RS232 header rather than Bluetooth. uboot.enable keeps the U-Boot -> extlinux boot path the rewritten config.txt would otherwise lose. - packages.aarch64-linux.zero2w-sd-image: the host's own configuration as an installable card. The board has no Ethernet and no free serial port, so a generic image would leave no way in. - The mail proxy comes from the legacy-email-proxy flake, which provides the package and the NixOS module; nothing about it is vendored here. - docs/hosts/pizero2w.md, plus README host table and shared-layer notes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Merge pull request 'fix(docs): pin the site section title so it renders as nixfiles' (#97 ) from fix/docs-section-title into main
2026-08-21 13:38:27 +01:00 · 2026-08-19 18:24:40 +01:00 · 2026-08-19 18:15:48 +01:00 · 2026-08-19 17:51:40 +01:00 · 2026-08-19 17:38:50 +01:00 · 2026-08-19 17:21:40 +01:00
24 changed files with 703 additions and 70 deletions
@@ -42,6 +42,17 @@ prettier formats `*.md`, so **documentation edits must be run through `nix fmt`*
 exactly like code. prettier re-aligns Markdown tables in particular; hand-editing
 a table almost always leaves it non-conformant and fails the `formatting` check.

+Prose documentation lives in `docs/` and is **published** to
+<https://docs.lyrapup.pet/nixfiles/> by the separate `docs-site` repo, which
+clones this one at build time. Two consequences when editing docs:
+
+- A markdown file outside `docs/` (other than the root `README.md`) is not
+  synced and will never appear on the site. Put new prose in `docs/`.
+- Links must follow the rules in the README's "Documentation" section: absolute
+  Gitea URLs to source files, relative links between `docs/` pages, and
+  absolute `docs.lyrapup.pet` URLs from the root README into `docs/`. The site
+  builds non-strict, so a broken link is silent.
+
 The CI `formatting` step runs on **every** PR — including docs- and config-only
 changes — so a Markdown/YAML/JSON edit is format-checked before merge, not just
 after it lands on `main`. (The heavier `deadnix`/`statix`/`pre-commit` lints and
@@ -5,24 +5,25 @@ single flake.

 ## Hosts

-Defined in the host table in [`flake.nix`](./flake.nix):
+Defined in the host table in [`flake.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/flake.nix):

-| Configuration         | System           | Machine                                                                                                     |
-| --------------------- | ---------------- | ----------------------------------------------------------------------------------------------------------- |
-| `lyrathorpe-mbp`      | `aarch64-linux`  | MacBook Pro (Apple Silicon, Asahi)                                                                          |
-| `lyrathorpe-t400`     | `x86_64-linux`   | ThinkPad T400 — [install notes](./hosts/T400/README.md)                                                     |
-| `lyrathorpe-macpro31` | `x86_64-linux`   | Mac Pro 3,1, desktop — [install notes](./hosts/MacPro31/README.md)                                          |
-| `emmathorpe-edaas`    | `x86_64-linux`   | Work WSL box (NixOS-WSL) — [notes](./hosts/EDaaS/README.md)                                                 |
-| `lyrathorpe-rpi5`     | `aarch64-linux`  | Raspberry Pi 5 headless server: Docker host + nginx reverse proxy — [install notes](./hosts/RPi5/README.md) |
-| `lyrathorpe-mac`      | `aarch64-darwin` | macOS (nix-darwin) — [notes](./hosts/Darwin/README.md)                                                      |
+| Configuration         | System           | Machine                                                                                                                                        |
+| --------------------- | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
+| `lyrathorpe-mbp`      | `aarch64-linux`  | MacBook Pro (Apple Silicon, Asahi)                                                                                                             |
+| `lyrathorpe-t400`     | `x86_64-linux`   | ThinkPad T400 — [install notes](https://docs.lyrapup.pet/nixfiles/hosts/t400/)                                                                 |
+| `lyrathorpe-macpro31` | `x86_64-linux`   | Mac Pro 3,1, desktop — [install notes](https://docs.lyrapup.pet/nixfiles/hosts/macpro31/)                                                      |
+| `emmathorpe-edaas`    | `x86_64-linux`   | Work WSL box (NixOS-WSL) — [notes](https://docs.lyrapup.pet/nixfiles/hosts/edaas/)                                                             |
+| `lyrathorpe-rpi5`     | `aarch64-linux`  | Raspberry Pi 5 headless server: Docker host + nginx reverse proxy — [install notes](https://docs.lyrapup.pet/nixfiles/hosts/rpi5/)             |
+| `lyrathorpe-zero2w`   | `aarch64-linux`  | Raspberry Pi Zero 2 W "Psion sidecar": PPP over RS232 + legacy mail proxy — [install notes](https://docs.lyrapup.pet/nixfiles/hosts/pizero2w/) |
+| `lyrathorpe-mac`      | `aarch64-darwin` | macOS (nix-darwin) — [notes](https://docs.lyrapup.pet/nixfiles/hosts/darwin/)                                                                  |

 Shared layers: `home` (home-manager: shell, git, editor),
 `modules/common-nixos.nix` (all NixOS hosts: fonts, nix-ld, caches),
 `modules/workstation.nix` (physical graphical hosts: audio, thermald,
 earlyoom, fwupd), `modules/laptop.nix` (laptops: Wi-Fi, Bluetooth, power,
 lid), `modules/desktop.nix` (wired desktops: NetworkManager), and
-`modules/ssh.nix` (key-only sshd). The x86 hosts also pull `nixos-hardware`
-profiles. The full module catalogue is below.
+`modules/ssh.nix` (key-only sshd). The x86 hosts and both Raspberry Pis also
+pull `nixos-hardware` profiles. The full module catalogue is below.

 ## Repository layout

@@ -31,6 +32,7 @@ flake.nix              # inputs, mkHost/mkDarwinHost, the host tables, dev shell
 flake.lock             # pinned input revisions (Renovate keeps this fresh)
 modules/               # reusable NixOS system modules (see "Module catalogue")
 home/                  # home-manager profile: shell, git, editor, claude, secret-service, desktop, sway
+docs/                  # all prose documentation; published to docs.lyrapup.pet (see "Documentation")
 users/                 # identity registry + per-user home extras (see "Users")
 hosts/<Name>/          # per-machine config: configuration.nix + hardware-configuration.nix
 lib/                   # small pure helpers (currently the Catppuccin Mocha palette)
@@ -50,22 +52,22 @@ host's table entry.

 ## Module catalogue

-Reusable NixOS modules under [`modules/`](./modules). "Imported by" says how a
+Reusable NixOS modules under [`modules/`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/modules). "Imported by" says how a
 module reaches a host: **baseModules** (every NixOS host, via `flake.nix`),
 **host table** (listed explicitly per host in `flake.nix`), or **transitively**
 (pulled in by another module's `imports`).

-| Module             | Imported by                       | What it does / when to use it                                                                                                                                                                                                                                                                                                 |
-| ------------------ | --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `common-nixos.nix` | baseModules (all NixOS)           | Timezone/locale, store hygiene (auto-optimise, big download buffer, **no** auto-GC), the nix-community binary cache, `nix-ld`, **sudo-rs** in place of sudo, base CLI (`git`, `fastfetch`), and the fleet-wide font stack.                                                                                                    |
-| `users.nix`        | baseModules (all NixOS)           | Builds `users.users` from the registry for the host's `hostUsers`; enables zsh; enables Firefox + Thunderbird **only** when `features.swayDesktop.enable` is on. Applies per-user `linger`.                                                                                                                                   |
-| `features.nix`     | baseModules (all NixOS)           | Declares the feature-flag options (`features.swayDesktop.enable`, `features.claudeCode.enable`) so any host can read/set them without importing the heavy implementation module, plus the CPU capability fact they derive from (`features.cpu.microarchLevel`) and the assertion that guards it. See "CPU capability gating". |
-| `workstation.nix`  | transitively (via laptop/desktop) | Form-factor-agnostic base for physical graphical hosts: turns on `swayDesktop`, Dvorak console, PipeWire, firewall (default-deny), fstrim, earlyoom, fwupd, thermald (x86), redistributable fw.                                                                                                                               |
-| `laptop.nix`       | host table (MBP, T400)            | `imports` workstation.nix, then adds the portable bits: iwd Wi-Fi, lid suspend/lock, Bluetooth + blueman.                                                                                                                                                                                                                     |
-| `desktop.nix`      | host table (Mac Pro)              | `imports` workstation.nix, then swaps Wi-Fi for wired NetworkManager. Pair with `portable = false` in the host table.                                                                                                                                                                                                         |
-| `sway.nix`         | host table (graphical hosts)      | Implementation of `features.swayDesktop`: the system Sway package, the greetd/ReGreet (cage) greeter forced to Dvorak, xdg-portal, Wayland utility packages. Home-side Sway config is in `home/sway.nix`.                                                                                                                     |
-| `ssh.nix`          | host table (T400, Mac Pro, RPi5)  | Enables sshd, opens port 22, enforces a key-only policy (no password / keyboard-interactive, no root). Authorized keys come from the registry via `users.nix`.                                                                                                                                                                |
-| `firmware/`        | referenced by MBP host config     | Committed Apple peripheral firmware blobs for the Asahi MBP (see "MacBook (Asahi) firmware").                                                                                                                                                                                                                                 |
+| Module             | Imported by                          | What it does / when to use it                                                                                                                                                                                                                                                                                                 |
+| ------------------ | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `common-nixos.nix` | baseModules (all NixOS)              | Timezone/locale, store hygiene (auto-optimise, big download buffer, **no** auto-GC), the nix-community binary cache, `nix-ld`, **sudo-rs** in place of sudo, base CLI (`git`, `fastfetch`), and the fleet-wide font stack.                                                                                                    |
+| `users.nix`        | baseModules (all NixOS)              | Builds `users.users` from the registry for the host's `hostUsers`; enables zsh; enables Firefox + Thunderbird **only** when `features.swayDesktop.enable` is on. Applies per-user `linger`.                                                                                                                                   |
+| `features.nix`     | baseModules (all NixOS)              | Declares the feature-flag options (`features.swayDesktop.enable`, `features.claudeCode.enable`) so any host can read/set them without importing the heavy implementation module, plus the CPU capability fact they derive from (`features.cpu.microarchLevel`) and the assertion that guards it. See "CPU capability gating". |
+| `workstation.nix`  | transitively (via laptop/desktop)    | Form-factor-agnostic base for physical graphical hosts: turns on `swayDesktop`, Dvorak console, PipeWire, firewall (default-deny), fstrim, earlyoom, fwupd, thermald (x86), redistributable fw.                                                                                                                               |
+| `laptop.nix`       | host table (MBP, T400)               | `imports` workstation.nix, then adds the portable bits: iwd Wi-Fi, lid suspend/lock, Bluetooth + blueman.                                                                                                                                                                                                                     |
+| `desktop.nix`      | host table (Mac Pro)                 | `imports` workstation.nix, then swaps Wi-Fi for wired NetworkManager. Pair with `portable = false` in the host table.                                                                                                                                                                                                         |
+| `sway.nix`         | host table (graphical hosts)         | Implementation of `features.swayDesktop`: the system Sway package, the greetd/ReGreet (cage) greeter forced to Dvorak, xdg-portal, Wayland utility packages. Home-side Sway config is in `home/sway.nix`.                                                                                                                     |
+| `ssh.nix`          | host table (T400, Mac Pro, both Pis) | Enables sshd, opens port 22, enforces a key-only policy (no password / keyboard-interactive, no root). Authorized keys come from the registry via `users.nix`.                                                                                                                                                                |
+| `firmware/`        | referenced by MBP host config        | Committed Apple peripheral firmware blobs for the Asahi MBP (see "MacBook (Asahi) firmware").                                                                                                                                                                                                                                 |

 Form-factor decision: a **laptop** imports `laptop.nix` (default
 `portable = true`); a **wired desktop** imports `desktop.nix` and sets
@@ -86,7 +88,7 @@ declares what it is and the shared modules derive from that:
  are level 1). Ignored on non-x86_64 hosts.
 - `features.claudeCode.enable` — derived: on unless the host is below
  x86-64-v2, because Claude Code's Node runtime needs SSE4.2/POPCNT.
-  [`home/claude.nix`](./home/claude.nix) reads it through home-manager's
+  [`home/claude.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/home/claude.nix) reads it through home-manager's
  `osConfig` and installs nothing (CLI, `CLAUDE.md`, output style, memory
  symlink) when it is off. Hosts with no such option — the Darwin host and the
  standalone `homeConfigurations` — fall back to enabled.
@@ -101,12 +103,12 @@ editing every host.

 Identity is data, kept separate from the reusable modules:

- [`users/registry.nix`](./users/registry.nix) — one entry per user (display
+- [`users/registry.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/users/registry.nix) — one entry per user (display
  name, email, supplementary groups, authorized + signing keys). This is the
  single source of identity; no user data is hardcoded in the modules.
 - Each host's table entry declares a `users` set keyed by username; every entry
  lists that user's home-module composition (the shared `./home` bundle plus any
-  per-user modules, e.g. [`users/emmathorpe/work.nix`](./users/emmathorpe/work.nix))
+  per-user modules, e.g. [`users/emmathorpe/work.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/users/emmathorpe/work.nix))
  and optional per-host-user system bits such as `linger`.
 - `mkHost` builds each account from the registry and injects the matching
  identity into that user's home config as the `identity` module arg. A host can
@@ -114,13 +116,13 @@ Identity is data, kept separate from the reusable modules:

 Per-user home extras live under `users/<name>/`:

- [`users/lyrathorpe/home.nix`](./users/lyrathorpe/home.nix) — personal extras
+- [`users/lyrathorpe/home.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/users/lyrathorpe/home.nix) — personal extras
  (an ssh host shortcut, gammastep coordinates); imported on Lyra's hosts.
- [`users/emmathorpe/work.nix`](./users/emmathorpe/work.nix) — the work
+- [`users/emmathorpe/work.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/users/emmathorpe/work.nix) — the work
  toolchain (kubectl/helm/az/etc.), work-only LSP servers, the corporate ssh
  handling, and the headless Secret Service that gcx needs for its keychain
-  tokens (see [`home/secret-service.nix`](./home/secret-service.nix)); imports
-  [`users/emmathorpe/renovate-review.nix`](./users/emmathorpe/renovate-review.nix),
+  tokens (see [`home/secret-service.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/home/secret-service.nix)); imports
+  [`users/emmathorpe/renovate-review.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/users/emmathorpe/renovate-review.nix),
  the daily headless Renovate-PR review timer (EDaaS only).

 ### Portable home (off-NixOS / external consumers)
@@ -179,20 +181,20 @@ automatically.
 ## Shell environment & keybindings

 - Interactive shell features (zsh, tmux, git, ssh, CLI tools, auto-tmux):
-  [`home/README.md`](./home/README.md).
+  [`docs/shell.md`](https://docs.lyrapup.pet/nixfiles/shell/).
 - Which classic utilities are shadowed by modern replacements, and the flag
  differences that will bite:
-  [`home/README.md` → "Replacing the classics"](./home/README.md#replacing-the-classics).
+  [`docs/shell.md` → "Replacing the classics"](https://docs.lyrapup.pet/nixfiles/shell/#replacing-the-classics).
 - All Sway / tmux / foot / zsh keyboard shortcuts:
-  [`home/KEYBINDINGS.md`](./home/KEYBINDINGS.md).
+  [`docs/keybindings.md`](https://docs.lyrapup.pet/nixfiles/keybindings/).

 ## Login / greeter

 Graphical (Sway) hosts log in through a Wayland greeter — `greetd` running
 ReGreet inside the `cage` kiosk compositor — implemented in
-[`modules/sway.nix`](./modules/sway.nix), gated on
+[`modules/sway.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/modules/sway.nix), gated on
 `features.swayDesktop.enable` (the option is declared in
-[`modules/features.nix`](./modules/features.nix), so headless hosts
+[`modules/features.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/modules/features.nix), so headless hosts
 can leave it off without importing `modules/sway.nix`). The greeter is forced to Dvorak
 to match the console and Sway session. Headless hosts (the WSL work box and the
 Raspberry Pi server) keep plain TTY login. The target account needs a password
@@ -212,6 +214,38 @@ To refresh them, copy the firmware extracted during the Asahi install (from
 [Asahi NixOS docs](https://github.com/tpwrules/nixos-apple-silicon)) into
 `modules/firmware/` and commit with `git add -f`.

+## Documentation
+
+All prose documentation lives in [`docs/`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/docs); this README is the overview. The pages are
+published to **<https://docs.lyrapup.pet/nixfiles/>** by the
+[`docs-site`](https://code.emmathe.dev/lyrathorpe/docs-site) repository, which clones this repo on
+every build (on its own push, nightly, or on demand) and assembles the tree:
+
+```
+README.md   ->  docs/nixfiles/index.md     # this file becomes the section landing page
+docs/       ->  docs/nixfiles/             # everything here, ordering from docs/.pages
+```
+
+Nothing is pushed from this side and there is no build step here — editing a
+page and merging is all that is required. Files outside `docs/` (bar this
+README) are **not** synced, so a doc kept next to the code it describes will
+never appear on the site.
+
+### Linking rules
+
+The site has no copy of the source tree, and this README is republished at a
+different depth from the rest of `docs/`. Both facts break naive relative
+links, so:
+
+| Link from         | To                      | Use                                                              |
+| ----------------- | ----------------------- | ---------------------------------------------------------------- |
+| anywhere          | a source file or dir    | absolute `https://code.emmathe.dev/.../src/branch/main/…`        |
+| a page in `docs/` | another page in `docs/` | relative (`./keybindings.md`) — correct in Gitea and on the site |
+| this README       | a page in `docs/`       | absolute `https://docs.lyrapup.pet/nixfiles/…`                   |
+
+`mkdocs build` runs non-strict on the docs-site side, so a broken link fails
+silently rather than failing the build. Check links by hand when moving a page.
+
 ## Development

 A dev shell and a formatting/lint gate are wired through the flake:
@@ -227,7 +261,7 @@ A dev shell and a formatting/lint gate are wired through the flake:

 ## CI

-[`.gitea/workflows/ci.yaml`](./.gitea/workflows/ci.yaml) runs `nix flake check`
+[`.gitea/workflows/ci.yaml`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/.gitea/workflows/ci.yaml) runs `nix flake check`
 (formatting, `deadnix`, `statix`, the pre-commit hooks) and evaluates every
 NixOS and Darwin host configuration on push/PR. It always runs (no `paths:`
 filter) so the required check never hangs pending; the heavy Nix steps are
@@ -0,0 +1,16 @@
+# Section title and ordering for the MkDocs awesome-pages plugin on
+# docs.lyrapup.pet.
+#
+# The title is set explicitly: with no entry in the site's nav, MkDocs derives
+# the section name from the directory and renders it title-cased as "Nixfiles".
+title: nixfiles
+
+# `index.md` is this repository's root README, copied in by the docs-site build
+# before this directory is synced over the top. The trailing `...` picks up any
+# page added later, so a new file needs no edit here.
+nav:
+  - index.md
+  - shell.md
+  - keybindings.md
+  - hosts
+  - ...
@@ -0,0 +1 @@
+title: Hosts
@@ -11,7 +11,7 @@ The day-to-day work environment. It layers the corporate Kubernetes / Helm /
 Terraform / cloud toolchain and a couple of work-only editor language servers on
 top of the shared home profile. The system config here is thin — it is mostly
 WSL plumbing; the user-facing tooling lives in
-[`../../users/emmathorpe/work.nix`](../../users/emmathorpe/work.nix).
+[`../../users/emmathorpe/work.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/users/emmathorpe/work.nix).

 ## WSL specifics

@@ -34,7 +34,7 @@ WSL plumbing; the user-facing tooling lives in
 The host-table entry sets `users.emmathorpe.linger = true` so the user's
 `systemd --user` instance stays alive without an open login session. That keeps
 the daily headless **Renovate PR review** timer firing — defined in
-[`../../users/emmathorpe/renovate-review.nix`](../../users/emmathorpe/renovate-review.nix)
+[`../../users/emmathorpe/renovate-review.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/users/emmathorpe/renovate-review.nix)
 (imported only from `work.nix`, so it exists on this machine alone). See that
 file's header for the auth (Vertex AI ADC), triage policy, and caveats.

@@ -53,7 +53,7 @@ name is not activatable".
 Home-manager's own `services.gnome-keyring` does not work here: it is
 `WantedBy=graphical-session-pre.target`, which never activates on this headless
 box, and it cannot unlock the keyring. See
-[`../../home/secret-service.nix`](../../home/secret-service.nix) for the full
+[`../../home/secret-service.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/home/secret-service.nix) for the full
 rationale and the security trade-off of an auto-unlocked keyring.

 Only the `secrets` component is started. The `ssh` component is deliberately off
@@ -31,7 +31,7 @@ Partition the disk GPT with an ESP (vfat).

 The stock card (**ATI Radeon HD 2600 XT** or **NVIDIA GeForce 8800 GT**,
 depending on the unit) has been replaced with an **NVIDIA Quadro P400** (Pascal,
-GP108). Everything driver-related lives in [`nvidia.nix`](./nvidia.nix):
+GP108). Everything driver-related lives in [`nvidia.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/hosts/MacPro31/nvidia.nix):

 - **Driver branch 580** (`nvidiaPackages.legacy_580`), _not_ the nixpkgs default
  (`production`, currently 595.x). 580 is the last branch that supports
@@ -48,7 +48,7 @@ GP108). Everything driver-related lives in [`nvidia.nix`](./nvidia.nix):
 The driver is unfree, so it is **not in the binary cache**: the kernel module is
 compiled on the machine, which on these 2008 Xeons is slow — budget for a long
 first rebuild and again after every kernel bump. The package names are
-allowlisted in `unfreePackages` in [`flake.nix`](../../flake.nix).
+allowlisted in `unfreePackages` in [`flake.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/flake.nix).

 Note the Mac Pro shows no EFI boot screen with a stock PC card (no Apple EFI
 ROM): the machine boots blind until KMS brings the display up. That is expected,
@@ -113,7 +113,7 @@ it, so that should not happen).
 The dual Harpertown Xeons are **x86-64-v1** (SSE4.1, but no SSE4.2/POPCNT) and
 the Node runtime Claude Code ships on requires x86-64-v2. `configuration.nix`
 declares `features.cpu.microarchLevel = 1`, which switches the tool off through
-the fleet-wide gate in [`../../modules/features.nix`](../../modules/features.nix)
+the fleet-wide gate in [`../../modules/features.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/modules/features.nix)
 — see the root README. Forcing `features.claudeCode.enable` on here is an
 evaluation error, not a broken install.

@@ -0,0 +1,205 @@
+# Raspberry Pi Zero 2 W (`lyrathorpe-zero2w`)
+
+Headless `aarch64-linux` "Psion sidecar": an RS232 companion for a Psion 5MX,
+after [Kian Ryan's PPP modem and terminal
+write-up](https://www.kianryan.co.uk/2022-11-28-psion-sidecar-ppp-modem-and-terminal/).
+Two roles, split into submodules:
+
+- **PPP link + telnet** (`serial-ppp.nix`) — `pppd` on `/dev/ttyAMA0`, the Psion
+  on the far end of a null-modem cable, NAT out to Wi-Fi, and a telnet login for
+  the Psion's terminal client.
+- **Legacy mail proxy** (`email-proxy.nix`) — cleartext POP3/SMTP for the
+  Psion's built-in mail client, forwarded to authenticated IMAPS/SMTPS by
+  [legacy-email-proxy](https://code.emmathe.dev/lyrathorpe/legacy-email-proxy).
+  That project ships its own package and NixOS module, so `email-proxy.nix`
+  here is only `services.legacy-email-proxy.enable` plus a path to the
+  credentials — nothing about the proxy is vendored into this flake.
+
+`sd-image.nix` in the same directory is not part of the running system: it is
+the one-shot install card, built as `packages.aarch64-linux.zero2w-sd-image`.
+See "Install".
+
+## Hardware and boot
+
+The Zero 2 W is a BCM2837 — the Pi 3's SoC — so the host table uses
+`nixos-hardware`'s `raspberry-pi-3` profile for the kernel, firmware and device
+tree. Boot is the same U-Boot + extlinux path as the other Pi.
+
+Unlike the Pi 5, this host owns the firmware partition declaratively
+(`hardware.raspberry-pi.firmware.enable`): every `switch` rewrites
+`/boot/firmware`, including `config.txt`. Two settings there matter:
+
+| `config.txt`             | Why                                                                                                                                                 |
+| ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `dtoverlay=disable-bt`   | Moves the PL011 UART off Bluetooth onto GPIO 14/15, so `/dev/ttyAMA0` is the RS232 header. The mini UART (`ttyS0`) drifts at 115200.                |
+| `dtoverlay=uart0,ctsrts` | RTS/CTS on GPIO 16/17. Both `pppd` and the Psion's modem profile use hardware flow control.                                                         |
+| `kernel=u-boot.bin`      | `hardware.raspberry-pi.firmware.uboot.enable`. Without it the rewritten `config.txt` would have no `kernel=` line and the board would stop booting. |
+
+`gpu_mem=16`, `start_x=0`, `camera_auto_detect=0` and `display_auto_detect=0`
+hand the VideoCore the minimum: the board has 512 MB total and no display.
+
+## Never build on the Pi
+
+512 MB of RAM and an SD card. It cannot compile its own system, and there is
+deliberately no swap partition (SD cards wear out under swap writes) — zram
+takes its place. Build somewhere else and push the result:
+
+```sh
+# from a workstation, using another aarch64 machine as the builder
+nixos-rebuild switch --flake .#lyrathorpe-zero2w \
+  --build-host lyrathorpe@lyrathorpe-rpi5 \
+  --target-host lyrathorpe@<pi-address> --use-remote-sudo
+```
+
+The `raspberry-pi-3` profile builds the vendor kernel from source and it is not
+in the binary cache, so the first build is long (hours on the Pi 5, less on the
+MacBook). Later builds reuse it. The same applies to the SD image below: it
+contains that kernel, so it needs an `aarch64-linux` builder too. From an
+`x86_64` box or a Mac, that means a remote builder (`nix.buildMachines`) or, on
+Darwin, `nix.linux-builder.enable`.
+
+## Install
+
+The card is built from this flake, not downloaded. A generic NixOS image would
+boot, but there would be no way into the machine afterwards: it has no Ethernet,
+no wifi credentials, and this configuration hands the serial port to `pppd`, so
+there is no console either. Building the host's own image sidesteps all three —
+the first boot is already the real system, with the SSH key from the registry
+in place.
+
+1. **Set the SSID.** `networking.wireless.networks` in `configuration.nix` still
+   says `CHANGE-ME-SSID`. It is baked into the image at build time; only the PSK
+   is read at runtime.
+2. **Build and write the card.** On an `aarch64-linux` machine (or with one
+   configured as a builder):
+   ```sh
+   nix build .#packages.aarch64-linux.zero2w-sd-image
+   sudo dd if=result/sd-image/nixos-zero2w.img of=/dev/sdX bs=4M conv=fsync status=progress
+   ```
+   Check `/dev/sdX` twice. `dd` does not ask.
+3. **Seed the secrets before first boot.** They are not in the image. Mount the
+   card's second partition (the ext4 root) and write both files described under
+   "Secrets" below:
+   ```sh
+   sudo mount /dev/sdX2 /mnt
+   sudo mkdir -p /mnt/var/lib/wpa_supplicant /mnt/var/lib/legacy-email-proxy
+   printf 'psk_home=%s\n' 'the-pre-shared-key' \
+     | sudo tee /mnt/var/lib/wpa_supplicant/secrets.conf > /dev/null
+   sudo chmod 600 /mnt/var/lib/wpa_supplicant/secrets.conf
+   # ... and /mnt/var/lib/legacy-email-proxy/backend.env, same permissions
+   sudo umount /mnt
+   ```
+   Skip the PSK and the board boots with no network at all.
+4. **Boot it.** Give it a few minutes on first boot — it resizes the root
+   partition and generates host keys on a slow card. Then:
+   ```sh
+   ssh lyrathorpe@lyrathorpe-zero2w.local   # mDNS; services.avahi publishes it
+   ```
+5. **Give the login user a password** (`passwd lyrathorpe`) if you want console
+   or telnet login; the SSH key from
+   [`users/registry.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/users/registry.nix)
+   already works without one.
+6. Thereafter, rebuild from another machine as in the previous section.
+
+`hosts/PiZero2W/hardware-configuration.nix` is a **placeholder** — but its
+layout (`/` on label `NIXOS_SD`, `/boot/firmware` on label `FIRMWARE`) is
+exactly what the SD image produces, so there is nothing to regenerate for a card
+install. Run `nixos-generate-config` and replace it only if you deviate from
+that layout.
+
+If the board never appears on the network, it is almost always the PSK file.
+Re-mount the card and check it. Failing that, a mini-HDMI monitor and a
+micro-USB keyboard get you a console on `tty1` — the serial port will not,
+because `pppd` holds it.
+
+## Secrets (not in the Nix store)
+
+Both files are created on the device, owned by root, mode `0600`. Neither is
+managed by this flake; the units that read them fail loudly if they are absent.
+
+**Wi-Fi PSK** — `/var/lib/wpa_supplicant/secrets.conf`:
+
+```
+psk_home=<the pre-shared key>
+```
+
+The SSID itself _is_ in `configuration.nix` and is currently the placeholder
+`CHANGE-ME-SSID`; set it to the real network. `wpa_supplicant` resolves
+`pskRaw = "ext:psk_home"` against this file at runtime.
+
+**Mail backend** — `/var/lib/legacy-email-proxy/backend.env`, a systemd
+`EnvironmentFile`:
+
+```
+BACKEND_IMAP_HOST=imap.example.com
+BACKEND_IMAP_USER=someone@example.com
+BACKEND_IMAP_PASS=<app password>
+BACKEND_SMTP_HOST=smtp.example.com
+BACKEND_SMTP_USER=someone@example.com
+BACKEND_SMTP_PASS=<app password>
+```
+
+Ports and TLS default sensibly (IMAPS 993, SMTPS 465); the full variable list is
+in the proxy's README.
+
+### Why POP3 and not IMAP
+
+The Psion's built-in mail client speaks POP only, so POP3 is what the proxy
+exposes. If a third-party IMAP client is ever installed on the device, the
+answer is **not** to add an IMAP frontend to the proxy: the backend is already
+IMAP, so there is no protocol to translate, only TLS to remove. An `stunnel`
+client (plaintext 143 on the PPP link, IMAPS 993 outbound) does that in a few
+lines with no code, and credentials pass straight through — IMAP clients always
+authenticate.
+
+SMTP stays on the proxy either way. A client of this vintage cannot do SMTP
+AUTH, which is exactly why the proxy injects the backend credentials.
+
+## Psion configuration
+
+Matches the addressing in `serial-ppp.nix` (`10.0.0.1` the Pi, `10.0.0.2` the
+Psion):
+
+- **Modem** control panel, a "Direct Cable Connection" profile: 115200 baud,
+  Hardware (RTS/CTS) flow control; on the Advanced tab, Terminal Detect and
+  Carrier Detect both **off**.
+- **Internet** control panel, a new profile: Connection Type **Direct**, Manual
+  Login **True**. Addresses: get IP from server **False**, static **10.0.0.2**.
+  Get DNS from server **True** — `pppd` sends resolvers over the link
+  (`ms-dns`), so nothing is hard-coded on the Psion.
+- Advanced: PPP extensions **False**, plain-text authentication **True**.
+- Terminal client: telnet to **10.0.0.1 port 23**. It renders non-ANSI output
+  far better than the raw serial console does.
+- Mail client: POP3 and SMTP server **10.0.0.1**, no encryption, no
+  authentication.
+
+## Security
+
+Everything on this host that the Psion talks to is unauthenticated and
+unencrypted, because a 1999 palmtop speaks no TLS:
+
+- **telnet on 23** — cleartext login, including the password.
+- **POP3 on 110 / SMTP on 25** — full mailbox access and an open relay to anyone
+  who reaches them.
+
+The confinement is the firewall, and it is the only thing standing there:
+`ppp0` is a trusted interface, `wlan0` is not, and those ports are never opened
+on it. The proxy binds `0.0.0.0` rather than `10.0.0.1` on purpose — the PPP
+address only exists while the Psion is plugged in, and a bind-time dependency on
+a serial cable is a restart loop waiting to happen. Do not add these ports to
+`networking.firewall.allowedTCPPorts`, and do not put this board on an untrusted
+network.
+
+Only sshd (port 22, key-only, via
+[`modules/ssh.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/modules/ssh.nix))
+is reachable over Wi-Fi.
+
+## Troubleshooting
+
+| Symptom                                         | Check                                                                                                                                                                            |
+| ----------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| No PPP at all                                   | `systemctl status pppd-psion`, then `journalctl -u pppd-psion -f` while the Psion dials. `passive`/`persist` mean it waits, not fails.                                           |
+| PPP negotiates, then hangs                      | Flow control. Confirm `dtoverlay=uart0,ctsrts` is in `/boot/firmware/config.txt` and that the Psion's modem profile is set to Hardware.                                          |
+| `/dev/ttyAMA0` missing or is a Bluetooth device | `disable-bt` did not apply — the firmware partition was not rewritten. Confirm `/boot/firmware` is a mounted partition; the activation script skips with a warning if it is not. |
+| Something else holds the port                   | `systemctl status serial-getty@ttyAMA0` — it is disabled in `serial-ppp.nix`, and must stay that way.                                                                            |
+| Mail proxy dead                                 | `systemctl status legacy-email-proxy`. A missing `backend.env` fails the unit before it starts.                                                                                  |
@@ -4,13 +4,13 @@ Every keyboard shortcut configured across this desktop, and where it is defined.
 Everything here is managed declaratively through Nix — edit the listed file and
 rebuild, never the generated dotfiles.

-| Area              | Defined in                                                                                                            |
-| ----------------- | --------------------------------------------------------------------------------------------------------------------- |
-| Sway (compositor) | [`sway.nix`](./sway.nix) `config.keybindings` + `config.modes`, plus the home-manager Sway module's built-in defaults |
-| tmux              | [`shell.nix`](./shell.nix) `programs.tmux`                                                                            |
-| zsh line editor   | [`shell.nix`](./shell.nix) `programs.zsh.historySubstringSearch`                                                      |
-| Neovim            | [`editor.nix`](./editor.nix) `programs.nixvim`                                                                        |
-| foot (terminal)   | foot package defaults — only colours are themed (in `sway.nix`)                                                       |
+| Area              | Defined in                                                                                                                                                                            |
+| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Sway (compositor) | [`sway.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/home/sway.nix) `config.keybindings` + `config.modes`, plus the home-manager Sway module's built-in defaults |
+| tmux              | [`shell.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/home/shell.nix) `programs.tmux`                                                                            |
+| zsh line editor   | [`shell.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/home/shell.nix) `programs.zsh.historySubstringSearch`                                                      |
+| Neovim            | [`editor.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/home/editor.nix) `programs.nixvim`                                                                        |
+| foot (terminal)   | foot package defaults — only colours are themed (in `sway.nix`)                                                                                                                       |

 **Conventions**

@@ -4,21 +4,21 @@ Everything the shell, terminal multiplexer, git and ssh do beyond their defaults
 and where each is defined. All of it is managed declaratively through
 home-manager — edit the listed file and rebuild, never the generated dotfiles.

-Keyboard shortcuts have their own reference: [`KEYBINDINGS.md`](./KEYBINDINGS.md).
+Keyboard shortcuts have their own reference: [`keybindings.md`](./keybindings.md).

-| Area                                   | Defined in                                            |
-| -------------------------------------- | ----------------------------------------------------- |
-| zsh, CLI tools, tmux, ssh, auto-tmux   | [`shell.nix`](./shell.nix)                            |
-| git (+ delta, commitizen)              | [`git.nix`](./git.nix)                                |
-| Neovim (nixvim) + LSP                  | [`editor.nix`](./editor.nix)                          |
-| Claude Code (CLAUDE.md, style, memory) | [`claude.nix`](./claude.nix)                          |
-| GUI apps, GTK/Firefox theming, cursor  | [`desktop.nix`](./desktop.nix) (graphical hosts only) |
+| Area                                   | Defined in                                                                                                            |
+| -------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
+| zsh, CLI tools, tmux, ssh, auto-tmux   | [`shell.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/home/shell.nix)                            |
+| git (+ delta, commitizen)              | [`git.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/home/git.nix)                                |
+| Neovim (nixvim) + LSP                  | [`editor.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/home/editor.nix)                          |
+| Claude Code (CLAUDE.md, style, memory) | [`claude.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/home/claude.nix)                          |
+| GUI apps, GTK/Firefox theming, cursor  | [`desktop.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/home/desktop.nix) (graphical hosts only) |

-Shared by every host via [`default.nix`](./default.nix); the work box also layers
-[`work.nix`](../users/emmathorpe/work.nix) on top (its own ssh config, extra
+Shared by every host via [`default.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/home/default.nix); the work box also layers
+[`work.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/users/emmathorpe/work.nix) on top (its own ssh config, extra
 packages, kubecolor, and the C#/Helm language servers). The committer identity (name, email,
 signing key) comes from the user registry
-([`../users/registry.nix`](../users/registry.nix)), not this module.
+([`../users/registry.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/users/registry.nix)), not this module.

 ---

@@ -257,7 +257,7 @@ place of the old (inert) ALE.

 Leader is `Space`. LSP keymaps (`gd`, `gr`, `K`, `<leader>rn`, `<leader>ca`) and
 the file-tree toggle are listed in
-[`KEYBINDINGS.md`](./KEYBINDINGS.md#neovim). Add a universal language server by
+[`keybindings.md`](./keybindings.md#neovim). Add a universal language server by
 enabling it under `programs.nixvim.plugins.lsp.servers` in `editor.nix`;
 host-specific ones go in that host's module — the work box (`work.nix`) adds
 `omnisharp` (C#) and `helm_ls` (Helm), kept off the personal machines.
@@ -310,7 +310,7 @@ forced off there) but still runs the agent.

 ## Claude Code

-Managed declaratively by [`claude.nix`](./claude.nix) on every host whose CPU
+Managed declaratively by [`claude.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/home/claude.nix) on every host whose CPU
 can run it (the CLI is `pkgs.claude-code`, tracked to unstable via the flake
 overlay).

@@ -332,7 +332,7 @@ and the standalone `homeConfigurations` — keep it enabled.
 break.

 **Memory is sourced from this repo.** The files in
-[`claude/memory/`](./claude/memory) are the source of truth; they are symlinked
+[`claude/memory/`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/home/claude/memory) are the source of truth; they are symlinked
 read-only into `~/.claude/memory`, so recall works but the runtime "save a
 memory" path does not. To add/change/remove a memory, edit `claude/memory/`
 (one file per memory + the `MEMORY.md` index) and rebuild — `CLAUDE.md` tells
@@ -185,6 +185,26 @@
        "type": "github"
      }
    },
+    "legacy-email-proxy": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1787315211,
+        "narHash": "sha256-FuZ9nXMRtnMPO/wbjYkpsKn6K/FFc64P5XDmCyfyxGs=",
+        "ref": "refs/heads/main",
+        "rev": "f1e1373fd350fd77f1848eddfa67ed9e00724c25",
+        "revCount": 13,
+        "type": "git",
+        "url": "https://code.emmathe.dev/lyrathorpe/legacy-email-proxy"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://code.emmathe.dev/lyrathorpe/legacy-email-proxy"
+      }
+    },
    "nix-darwin": {
      "inputs": {
        "nixpkgs": [
@@ -368,6 +388,7 @@
        "git-hooks": "git-hooks",
        "home-manager": "home-manager",
        "kube-tmux": "kube-tmux",
+        "legacy-email-proxy": "legacy-email-proxy",
        "nix-darwin": "nix-darwin",
        "nix-homebrew": "nix-homebrew",
        "nix-index-database": "nix-index-database",
@@ -67,6 +67,13 @@
      url = "github:jonmosco/kube-tmux";
      flake = false;
    };
+    # legacy-email-proxy: cleartext POP3/SMTP front end for the Psion's mail
+    # client, proxied to authenticated IMAPS/SMTPS. Ships its own package and
+    # NixOS module; the Pi Zero 2 W host just enables the service.
+    legacy-email-proxy = {
+      url = "git+https://code.emmathe.dev/lyrathorpe/legacy-email-proxy";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
  };

  outputs =
@@ -327,6 +334,26 @@
              ./users/lyrathorpe/home.nix
            ];
          };
+
+          lyrathorpe-zero2w = {
+            system = "aarch64-linux";
+            portable = false;
+            # Headless "Psion sidecar": PPP over RS232 plus a legacy mail proxy
+            # (hosts/PiZero2W/). No sway.nix; the raspberry-pi-3 profile carries
+            # the kernel/firmware/device tree (the Zero 2 W is the Pi 3's
+            # BCM2837 SoC) and ssh.nix adds key-only sshd. This board has 512 MB
+            # of RAM and never builds its own system -- see
+            # docs/hosts/pizero2w.md.
+            modules = [
+              ./hosts/PiZero2W/configuration.nix
+              inputs.nixos-hardware.nixosModules.raspberry-pi-3
+              ./modules/ssh.nix
+            ];
+            users.lyrathorpe.homeModules = [
+              ./home
+              ./users/lyrathorpe/home.nix
+            ];
+          };
        };

        # Darwin host table — macOS machines built via mkDarwinHost. The shared
@@ -365,8 +392,24 @@
        # nixpkgs instance for that system. Outputs here become per-system
        # attrsets automatically (e.g. devShells.<system>.default).
        perSystem =
-          { config, pkgs, ... }:
          {
+            config,
+            pkgs,
+            system,
+            ...
+          }:
+          {
+            # One-shot SD card for bringing the Pi Zero 2 W up: that host's own
+            # configuration plus the sd-image module, so the first boot is
+            # already the real system. aarch64-linux only -- building it needs
+            # an aarch64 Linux builder. See docs/hosts/pizero2w.md.
+            packages = lib.optionalAttrs (system == "aarch64-linux") {
+              zero2w-sd-image =
+                ((mkHost hosts.lyrathorpe-zero2w).extendModules {
+                  modules = [ ./hosts/PiZero2W/sd-image.nix ];
+                }).config.system.build.sdImage;
+            };
+
            # treefmt drives `nix fmt` and the formatting check below. nixfmt
            # stays the .nix formatter (the tree is already nixfmt-formatted);
            # shfmt covers shell and prettier covers markdown/yaml/json.
@@ -31,7 +31,7 @@ in
    # are aliased over the original name (see shellAliases below); the rest keep
    # their own name so nothing changes shape under a script's feet. The alias
    # map and the flag-compatibility differences are documented in
-    # ./README.md, "Replacing the classics".
+    # ../docs/shell.md, "Replacing the classics".
    pkgs.dust # du: tree-shaped, size-sorted disk usage
    pkgs.dysk # df: mounted filesystems (duf is unmaintained upstream)
    pkgs.procs # ps: process list with tree, ports and container columns
@@ -165,7 +165,7 @@ in
      # Shadow the classics with their modern equivalents. Only read-only
      # commands are shadowed: a wrong flag costs a retype, never data. The
      # flag vocabularies are NOT compatible (`du -sh`, `df -h`, `ps aux` all
-      # fail here) -- see ./README.md, "Replacing the classics".
+      # fail here) -- see ../docs/shell.md, "Replacing the classics".
      #
      # Blast radius is bounded by where these live: shellAliases lands in
      # .zshrc, so only interactive zsh sees them. Scripts, `sudo <cmd>` and
@@ -1,7 +1,7 @@
 # Apple Mac Pro 3,1 (Early 2008, dual Xeon Harpertown, x86_64). Desktop host:
 # shared graphical/wired options live in ../../modules/desktop.nix; only
 # host-specific settings are here. Install notes (EFI booting, GPU, partitions):
-# see ./README.md.
+# see ../../docs/hosts/macpro31.md.
 { ... }:

 {
@@ -0,0 +1,111 @@
+# Raspberry Pi Zero 2 W (aarch64) "Psion sidecar": an RS232 companion for a
+# Psion 5MX. Two roles, split into submodules: ./serial-ppp.nix (PPP over the
+# serial line, NAT out to wifi, telnet login) and ./email-proxy.nix (cleartext
+# POP3/SMTP front end for the Psion's mail client). The raspberry-pi-3
+# nixos-hardware profile (the Zero 2 W is the same BCM2837 SoC as the Pi 3) and
+# key-only sshd (../../modules/ssh.nix) are layered on in the flake host table.
+# Install notes: see ../../docs/hosts/pizero2w.md.
+{ lib, ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./serial-ppp.nix
+    ./email-proxy.nix
+  ];
+
+  # Match the flake's nixosConfigurations attribute name so `nh os switch`
+  # (which selects by the local hostname) resolves without an explicit -H flag.
+  networking.hostName = "lyrathorpe-zero2w";
+
+  # Headless server: modules/sway.nix is not imported and
+  # features.swayDesktop.enable defaults to false, so this host keeps plain
+  # TTY/SSH login.
+
+  # Claude Code is a Node application. It runs on aarch64, but not usefully in
+  # 512 MB of RAM, and its closure is unwelcome on an SD card.
+  features.claudeCode.enable = false;
+
+  # 512 MB total and no swap partition -- SD cards wear out under swap writes.
+  # Compressed RAM swap instead; zstd is the best ratio-per-cycle the SoC can
+  # sustain.
+  zramSwap = {
+    enable = true;
+    algorithm = "zstd";
+  };
+
+  # The NixOS manual and man page index cost build time and a chunk of the card
+  # for a box that is administered over SSH from elsewhere.
+  documentation.nixos.enable = false;
+
+  # Own the firmware partition declaratively: every switch rewrites config.txt,
+  # the vendor device trees and the overlays below. Without this the card keeps
+  # whatever config.txt the flashed image wrote and the UART overlays never
+  # load. uboot.enable keeps the GPU firmware chainloading U-Boot -> extlinux,
+  # which is how the NixOS aarch64 SD image boots; leaving it off would rewrite
+  # config.txt without a `kernel=` line and the board would stop booting.
+  hardware.raspberry-pi.firmware = {
+    enable = true;
+    uboot.enable = true;
+  };
+
+  hardware.raspberry-pi.configtxt = {
+    settings.all = {
+      # Headless: hand the VideoCore the minimum and leave the rest to Linux.
+      # start_x/camera_auto_detect otherwise reserve VRAM for a camera stack
+      # this board does not have.
+      gpu_mem = 16;
+      start_x = 0;
+      camera_auto_detect = false;
+      # Left on, the firmware auto-loads the KMS display overlay, which wants
+      # more VRAM than this board can spare for a monitor it will never have.
+      display_auto_detect = false;
+    };
+
+    # Replaces the profile's default (vc4-kms-v3d), which is display hardware
+    # this host never uses.
+    deviceTreeOverlays.all = [
+      # Move the PL011 UART off Bluetooth and onto GPIO 14/15, so /dev/ttyAMA0
+      # is the RS232 header. The mini UART (ttyS0) derives its baud rate from
+      # the core clock and drifts at 115200.
+      { disable-bt = { }; }
+      # RTS/CTS on GPIO 16/17: the Psion's modem profile uses hardware flow
+      # control, and so does pppd in ./serial-ppp.nix.
+      { uart0.ctsrts = true; }
+    ];
+  };
+
+  # Wifi is the Pi's uplink and the route the Psion reaches the internet over
+  # (./serial-ppp.nix masquerades onto it).
+  networking.interfaces.wlan0.useDHCP = true;
+  networking.wireless = {
+    enable = true;
+    interfaces = [ "wlan0" ];
+    # PSKs stay out of the Nix store: wpa_supplicant reads them at runtime from
+    # this file, which is created on the device (root-owned, 0600) and contains
+    #   psk_home=<the pre-shared key>
+    # See ../../docs/hosts/pizero2w.md.
+    secretsFile = "/var/lib/wpa_supplicant/secrets.conf";
+    networks."CHANGE-ME-SSID".pskRaw = "ext:psk_home";
+  };
+
+  # The board takes a DHCP lease over wifi, so its address moves. mDNS makes it
+  # findable as lyrathorpe-zero2w.local instead of hunting through the router's
+  # lease table -- which matters most on first boot, when it is the only way in.
+  services.avahi = {
+    enable = true;
+    openFirewall = true;
+    publish = {
+      enable = true;
+      addresses = true;
+      workstation = true;
+    };
+  };
+
+  # Default-deny inbound. sshd opens 22 (../../modules/ssh.nix); everything the
+  # Psion talks to is reached over the PPP link, which ./serial-ppp.nix marks
+  # trusted.
+  networking.firewall.enable = true;
+
+  # See `man configuration.nix` / the stateVersion docs before changing.
+  system.stateVersion = "26.05";
+}
@@ -0,0 +1,25 @@
+# legacy-email-proxy: a cleartext POP3 (110) and SMTP (25) front end for the
+# Psion's built-in mail client, forwarded to authenticated IMAPS/SMTPS.
+#
+# The package, the systemd unit and its hardening all live upstream
+# (https://code.emmathe.dev/lyrathorpe/legacy-email-proxy); this host only
+# enables the service and points it at the credentials.
+{ inputs, ... }:
+{
+  imports = [ inputs.legacy-email-proxy.nixosModules.default ];
+
+  services.legacy-email-proxy = {
+    enable = true;
+
+    # The listeners are unauthenticated and unencrypted by design, so the
+    # firewall is what confines them: ppp0 is trusted, wlan0 is not, and 110/25
+    # are never opened there (./serial-ppp.nix). They stay on the default
+    # 0.0.0.0 rather than the PPP address because 10.0.0.1 exists only while
+    # the Psion is plugged in, and a bind-time dependency on a serial cable is
+    # a restart loop waiting to happen.
+
+    # Backend hostnames and credentials. Kept out of the Nix store: created on
+    # the device, root-owned 0600. See ../../docs/hosts/pizero2w.md.
+    environmentFile = "/var/lib/legacy-email-proxy/backend.env";
+  };
+}
@@ -0,0 +1,33 @@
+# PLACEHOLDER hardware configuration for the Raspberry Pi Zero 2 W.
+#
+# This file is NOT the real generated config -- it exists only so the host
+# evaluates in CI before the Pi is provisioned. The machine will not boot from
+# it as-is. On first install, regenerate this file on the device with
+#   nixos-generate-config --root /mnt
+# and replace this placeholder with the output (commit it). See ../../docs/hosts/pizero2w.md.
+#
+# Like every hardware-configuration.nix in this repo, this file is excluded from
+# the formatter and linters (see the pre-commit/treefmt excludes in flake.nix).
+{ modulesPath, ... }:
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  nixpkgs.hostPlatform = "aarch64-linux";
+
+  # The Zero 2 W boots from an SD card with a FAT firmware partition and an ext4
+  # root. Labels match the conventional sd-image layout; the real generated
+  # config will use by-uuid device paths instead.
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/NIXOS_SD";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot/firmware" = {
+    device = "/dev/disk/by-label/FIRMWARE";
+    fsType = "vfat";
+  };
+
+  # 512 MB of RAM and an SD card: no swap partition (SD cards wear out under
+  # swap writes). zram takes its place; see ../../hosts/PiZero2W/configuration.nix.
+  swapDevices = [ ];
+}
@@ -0,0 +1,44 @@
+# SD-card image of this host, used exactly once: to bring the board up.
+#
+# Deliberately NOT imported by ./configuration.nix. The flake extends the host
+# with it (see packages.aarch64-linux.zero2w-sd-image in ../../flake.nix), so
+# the card carries the host's own kernel, config.txt and SSH keys rather than a
+# generic installer that then has to be reconfigured over a console this host
+# does not have -- pppd owns the serial port (./serial-ppp.nix).
+#
+# It does not carry the runtime secrets. Seed those into the card's root
+# partition before first boot; see ../../docs/hosts/pizero2w.md.
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
+{
+  imports = [ "${modulesPath}/installer/sd-card/sd-image.nix" ];
+
+  # sd-image.nix pulls in profiles/all-hardware.nix, which is every driver and
+  # firmware blob NixOS knows about. The raspberry-pi-3 profile already carries
+  # what this board has, and the card is small.
+  hardware.enableAllHardware = lib.mkForce false;
+
+  image.baseName = "nixos-zero2w";
+
+  sdImage = {
+    # Compressing costs a long single-threaded pass and buys nothing: the image
+    # is written straight to a card with dd.
+    compressImage = false;
+
+    # The default 30 MiB does not hold the vendor GPU firmware, U-Boot and the
+    # BCM2837 device trees and overlays that nixos-hardware installs here.
+    firmwareSize = 128;
+
+    # The firmware partition is populated by nixos-hardware's firmware module
+    # (it takes over sdImage.populateFirmwareCommands); the root side is the
+    # stock extlinux install, which no longer arrives with it.
+    populateRootCommands = ''
+      mkdir -p ./files/boot
+      ${config.boot.loader.generic-extlinux-compatible.populateCmd} -c ${config.system.build.toplevel} -d ./files/boot
+    '';
+  };
+}
@@ -0,0 +1,89 @@
+# The serial half of the Psion sidecar: a PPP link to a Psion 5MX over
+# /dev/ttyAMA0 (RS232 level shifter on the GPIO header, 115200 8N1 with
+# RTS/CTS), masqueraded out of wifi, plus a telnet login for the Psion's
+# terminal client.
+#
+# Cleartext telnet and unauthenticated PPP are safe *only* because the link is
+# a two-node cable: the peer is a machine from 1999 that speaks no TLS. Nothing
+# here is exposed to wlan0.
+{ pkgs, ... }:
+let
+  # Point-to-point addresses for the serial link; nothing else routes here.
+  piAddress = "10.0.0.1";
+  psionAddress = "10.0.0.2";
+in
+{
+  # pppd needs exclusive use of the port. NixOS starts a getty on any serial
+  # console named in boot.kernelParams; ttyAMA0 is not one today, but disable it
+  # explicitly so a later kernel-param change cannot silently steal the line.
+  systemd.services."serial-getty@ttyAMA0".enable = false;
+
+  services.pppd = {
+    enable = true;
+    peers.psion.config = ''
+      /dev/ttyAMA0
+      115200
+      ${piAddress}:${psionAddress}
+
+      # Hardware flow control, matching the Psion's modem profile.
+      crtscts
+
+      # A null-modem cable has no carrier detect and no peer to authenticate.
+      local
+      noauth
+
+      # The systemd unit is Type=notify, so pppd must stay in the foreground.
+      nodetach
+      lock
+
+      # Wait for the Psion rather than failing when it is unplugged, and keep
+      # waiting for the next time it is plugged back in.
+      passive
+      persist
+      maxfail 0
+      holdoff 1
+
+      # Hand the Psion resolvers over the link, so its Internet profile can set
+      # "get DNS from server = True" instead of hard-coding them.
+      ms-dns 1.1.1.1
+      ms-dns 8.8.8.8
+    '';
+  };
+
+  # The Psion's route to the internet. The original write-up used pppd's
+  # proxyarp instead; NAT keeps the Psion out of the LAN broadcast domain and
+  # does not depend on what the wifi router tolerates.
+  networking.nat = {
+    enable = true;
+    externalInterface = "wlan0";
+    internalIPs = [ "${psionAddress}/32" ];
+  };
+
+  # Everything the Psion connects to (telnet here, POP3/SMTP in
+  # ./email-proxy.nix) is reachable over the PPP link and nowhere else.
+  networking.firewall.trustedInterfaces = [ "ppp0" ];
+
+  # The Psion's terminal client speaks telnet over TCP, which it renders far
+  # better than the raw serial console. Socket-activated, one process per
+  # connection; busybox's telnetd in inetd mode hands straight over to login.
+  systemd.sockets.telnetd = {
+    description = "Telnet login socket for the Psion";
+    wantedBy = [ "sockets.target" ];
+    listenStreams = [ "${piAddress}:23" ];
+    socketConfig = {
+      Accept = true;
+      # ppp0 (and with it 10.0.0.1) only exists while the Psion is connected;
+      # FreeBind lets the socket be listening before that.
+      FreeBind = true;
+    };
+  };
+
+  systemd.services."telnetd@" = {
+    description = "Telnet login for the Psion";
+    serviceConfig = {
+      ExecStart = "-${pkgs.busybox}/bin/busybox telnetd -i -l ${pkgs.shadow}/bin/login";
+      StandardInput = "socket";
+      StandardError = "journal";
+    };
+  };
+}
@@ -2,7 +2,7 @@
 # ./docker.nix (Docker host with a network socket) and ./reverse-proxy.nix
 # (native nginx). The raspberry-pi-5 nixos-hardware profile (kernel, firmware,
 # device tree) and key-only sshd (../../modules/ssh.nix) are layered on in the
-# flake host table. Install notes: see ./README.md.
+# flake host table. Install notes: see ../../docs/hosts/rpi5.md.
 { ... }:
 {
  imports = [
@@ -4,7 +4,7 @@
 # evaluates in CI before the Pi is provisioned. The machine will not boot from
 # it as-is. On first install, regenerate this file on the device with
 #   nixos-generate-config --root /mnt
-# and replace this placeholder with the output (commit it). See ./README.md.
+# and replace this placeholder with the output (commit it). See ../../docs/hosts/rpi5.md.
 #
 # Like every hardware-configuration.nix in this repo, this file is excluded from
 # the formatter and linters (see the pre-commit/treefmt excludes in flake.nix).
@@ -1,6 +1,6 @@
 # ThinkPad T400 (NixOS). Shared laptop options live in ../../modules/laptop.nix;
 # only host-specific settings are here. Install notes (boot variants, GPU,
-# partitions): see ./README.md.
+# partitions): see ../../docs/hosts/t400.md.
 { config, ... }:

 {
Author	SHA1	Message	Date
Emma ThorpeandClaude Opus 5	a94a749f29	feat(hosts): add the Raspberry Pi Zero 2 W Psion sidecar CI / flake (push) Skipped CI / flake (pull_request) Successful in 4m16s Details A headless aarch64 companion for a Psion 5MX: PPP over RS232 with NAT out to wifi and a telnet login, plus a cleartext POP3/SMTP proxy for the Psion's mail client. - hosts/PiZero2W/: host config, serial-ppp.nix, email-proxy.nix, an SD-image variant, and a hardware-configuration.nix placeholder. - Host table entry on nixos-hardware's raspberry-pi-3 profile; the Zero 2 W is the Pi 3's BCM2837 SoC. nixpkgs' linuxPackages_rpi02w is deprecated and warns that the linux-rpi series is being removed in favour of nixos-hardware. - The host owns its firmware partition (hardware.raspberry-pi.firmware), which is what puts the disable-bt and uart0/ctsrts overlays in config.txt so /dev/ttyAMA0 is the RS232 header rather than Bluetooth. uboot.enable keeps the U-Boot -> extlinux boot path the rewritten config.txt would otherwise lose. - packages.aarch64-linux.zero2w-sd-image: the host's own configuration as an installable card. The board has no Ethernet and no free serial port, so a generic image would leave no way in. - The mail proxy comes from the legacy-email-proxy flake, which provides the package and the NixOS module; nothing about it is vendored here. - docs/hosts/pizero2w.md, plus README host table and shared-layer notes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-21 13:38:27 +01:00
lyrathorpe	1ff333a896	Merge pull request 'fix(docs): pin the site section title so it renders as nixfiles' (#97 ) from fix/docs-section-title into main CI / flake (push) Successful in 6m33s Details Reviewed-on: #97	2026-08-19 18:24:40 +01:00
Emma Thorpe	9d199bc087	fix(docs): pin the site section title so it renders as nixfiles CI / flake (push) Skipped CI / flake (pull_request) Successful in 1m10s Details With no entry in the docs-site nav (removed there so awesome-pages can discover the synced trees), MkDocs derives the section name from the directory and title-cases it, rendering "Nixfiles". The previous hardcoded nav spelled it lowercase. Setting title in docs/.pages restores that without reintroducing a nav entry. Verified by rebuilding the aggregated site locally with both source trees synced as the workflow does.	2026-08-19 18:15:48 +01:00
lyrathorpe	c7adcccbb3	Merge pull request 'docs: publish the prose documentation to docs.lyrapup.pet' (#96 ) from docs/publish-to-docs-site into main CI / flake (push) Successful in 4m9s Details Reviewed-on: #96	2026-08-19 17:51:40 +01:00
Emma Thorpe	dcc13f94e0	docs: move prose documentation into docs/ so the docs site publishes it CI / flake (push) Skipped CI / flake (pull_request) Successful in 4m21s Details The docs-site build syncs this repo's README.md and docs/ into the site tree; nothing else is copied. All prose apart from the README therefore lived outside the sync and never appeared on https://docs.lyrapup.pet/nixfiles/, and the one page that did publish carried 18 link targets that resolved to nothing. Moves: home/README.md -> docs/shell.md home/KEYBINDINGS.md -> docs/keybindings.md hosts/<Name>/README.md -> docs/hosts/<name>.md docs/.pages and docs/hosts/.pages give the awesome-pages plugin an explicit order; new pages are picked up by the trailing '...' without an edit. Links are rewritten so a single URL is correct in both Gitea and the published site: absolute Gitea source URLs for .nix files and directories, relative links between pages under docs/, and absolute docs.lyrapup.pet URLs from the root README, which the build republishes at a different depth from the rest of the tree. In-code comments that pointed at a moved README are updated to the new path. The README gains a Documentation section covering the sync contract and the linking rules, and CLAUDE.md carries the short version so future edits do not reintroduce unsynced pages or dead links. Verified by reproducing the docs-site assembly locally against its pinned toolchain (mkdocs 1.6.1, mkdocs-material 9.7.7, awesome-pages 2.10.1): pages render at the URLs used above and in the declared order.	2026-08-19 17:38:50 +01:00
lyrathorpe	d30d8f9892	Merge pull request 'feat(cli): modern replacements for the classic coreutils tools, and sudo-rs' (#95 ) from feat/modern-cli-replacements into main CI / flake (push) Successful in 4m4s Details Reviewed-on: #95	2026-08-19 17:21:40 +01:00