chore(deps): lock file maintenance flake inputs

chore: post-refactor cleanups (#50-#53) (#54 )
## Summary Follow-up cleanups from the post-refactor audit (issues #50–#53). All behaviour-preserving except the work-host changes (kube-tmux + Lens removal). ## Changes - **#51** `refactor(ssh)` — move `services.openssh.enable` + `firewall.allowedTCPPorts = [ 22 ]` into `modules/ssh.nix`; drop the duplicated lines from T400, MacPro31, RPi5. - **#50** `fix/feat(work)` — load kube-tmux from a pinned `flake = false` input (it is not in nixpkgs) and reference `${inputs.kube-tmux}/kube.tmux` directly, so the status line no longer depends on a manual `$HOME/code/kube-tmux` checkout. (Supersedes the interim file-existence guard.) - **#52** `chore` — gitignore the untracked `tf-inspect/` scratch project. - **#53** `chore` — remove the unused Lens package entirely (`pkgs.lens` + its unfree entry; `unfreePackages` is now just `claude-code`), fix the `nil`→`nil_ls` LSP doc, remove the redundant `.editorconfig` block, name the RPi5 Docker subnet in a `let` binding. ## Deferred (from #53, noted in the commit) - `.gitignore` firmware entry — documented behaviour, low value, left as-is. - Per-eval `nixpkgs-unstable` overlay import — inherently per-system; no clean single-import hoist. ## Verification - `nix flake check` passes (treefmt, deadnix, statix, pre-commit, all hosts + Darwin + homeConfigurations). - Derivation-path diff vs `main`: `lyrathorpe-mbp`, `lyrathorpe-t400`, `lyrathorpe-macpro31`, `lyrathorpe-rpi5` are byte-identical (confirms #51 and the subnet `let` binding change nothing). Only `emmathorpe-edaas` differs — the kube-tmux input (#50) and the Lens removal (#53). Closes #50, #51, #52, #53. --------- Co-authored-by: Emma Thorpe <emma.thorpe@citrix.com> Reviewed-on: #54
2026-06-29 14:02:15 +00:00 · 2026-06-29 14:09:38 +01:00
11 changed files with 93 additions and 68 deletions
@@ -8,12 +8,6 @@ indent_size = 2
 trim_trailing_whitespace = true
 insert_final_newline = true

-[*.{nix,yaml,yml,json,md,sh,toml}]
-indent_style = space
-indent_size = 2
-trim_trailing_whitespace = true
-insert_final_newline = true
-
 # Markdown uses trailing whitespace for hard line breaks.
 [*.md]
 trim_trailing_whitespace = false
@@ -2,3 +2,6 @@ modules/firmware/*

 # vim swap files
 *.swp
+
+# Local scratch project, not part of this flake.
+tf-inspect/
@@ -25,11 +25,11 @@
      },
      "locked": {
        "dir": "pkgs/firefox-addons",
-        "lastModified": 1782014564,
-        "narHash": "sha256-F/royQHyJAyKWKrV8AaG4Yf1yjzxa+PFk5xvTdvBrzk=",
+        "lastModified": 1782619356,
+        "narHash": "sha256-sde3f0uM5mEUwl6Bxom69P+9KOdpJ9YnSj0umSB2qdQ=",
        "owner": "rycee",
        "repo": "nur-expressions",
-        "rev": "d6668e34bbce788459883a1097bf0ee170f49c61",
+        "rev": "9ad2019bb522c7eeecd9e3e2d18dd681f697f4d0",
        "type": "gitlab"
      },
      "original": {
@@ -177,11 +177,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1781981105,
-        "narHash": "sha256-/1nNBbA7PrSQpTc9Qazkhl4kIPg+TNl0CjxS3UQJKlw=",
+        "lastModified": 1782704057,
+        "narHash": "sha256-G1I1gd32F7mp9LAe1DaZ4ZL7NX5gyiKwdCMwro1Vrck=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "7bfff44b465909f69a442701293bc0badcf476dc",
+        "rev": "868d0a692de703c2de98fab61968e4e310b7c28e",
        "type": "github"
      },
      "original": {
@@ -191,6 +191,22 @@
        "type": "github"
      }
    },
+    "kube-tmux": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1779714285,
+        "narHash": "sha256-l1wjg2ReWKCI7h/K11vvX2ykYTs/mVD+tfz/mQsjn/E=",
+        "owner": "jonmosco",
+        "repo": "kube-tmux",
+        "rev": "8b7e1d127c16b6dc87ff5743f4d775b245198b69",
+        "type": "github"
+      },
+      "original": {
+        "owner": "jonmosco",
+        "repo": "kube-tmux",
+        "type": "github"
+      }
+    },
    "nix-darwin": {
      "inputs": {
        "nixpkgs": [
@@ -237,11 +253,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1782030356,
-        "narHash": "sha256-h4WpMr455AfRub0FXBaon6Vcpe0waUyJ4GivIW6oyd4=",
+        "lastModified": 1782636943,
+        "narHash": "sha256-ripjZa7BBLwL1uS5VJF3s/VpZpWt5ZIQEvkJ/FJNpQw=",
        "owner": "nix-community",
        "repo": "nix-index-database",
-        "rev": "3017088b49efd404f78e3b104f553b97e4af786b",
+        "rev": "058b1f9381fa79fcda49982370a750ff92dbba43",
        "type": "github"
      },
      "original": {
@@ -258,11 +274,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1781520503,
-        "narHash": "sha256-XuqQQG1qRyc3o8ld937sDLQNx+QrGV852KJ0dNglJDg=",
+        "lastModified": 1782734462,
+        "narHash": "sha256-0HguXu/4KDgCL1mehqwhQXD96hbR85HS+o0zh73E8AQ=",
        "owner": "nix-community",
        "repo": "nixos-apple-silicon",
-        "rev": "43043ad207529650f9fa68e1705f7cf9c08bfdeb",
+        "rev": "12e3b92363d21fcc550b500370d73a0747484e43",
        "type": "github"
      },
      "original": {
@@ -278,11 +294,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1781622756,
-        "narHash": "sha256-JrPh4M6S7aPsEE9tOENuZrxC6o2szSLlK+t4+nLke9s=",
+        "lastModified": 1782562157,
+        "narHash": "sha256-a7+T6QSeowynwZ1ZJJbP8T8ntAytvrui8kFGJmIZt2c=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "08018c72174a4df5657f8d94178ac69fb9c243e5",
+        "rev": "a9cf7546a938c737b079e738de73934a13de9784",
        "type": "github"
      },
      "original": {
@@ -314,11 +330,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1781216227,
-        "narHash": "sha256-9mUW6gNwoN2SWc/l0fW4svPNOulXLl8ijqKyeSOGgJE=",
+        "lastModified": 1782535326,
+        "narHash": "sha256-ZeRxu4yn6shd3SNF5ZUQb4r7BaVo1zBKMjRhfoNSBmw=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "a0374025a863d007d98e3297f6aa46cc3141c2f0",
+        "rev": "714a5f8c4ead6b31148d829288440ed033ccc041",
        "type": "github"
      },
      "original": {
@@ -330,11 +346,11 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1781577229,
-        "narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=",
+        "lastModified": 1782467914,
+        "narHash": "sha256-pGvFkM8N0xEkIIXDe5YYfbEAvHrk4IxBrjB/x8OomhE=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "567a49d1913ce81ac6e9582e3553dd90a955875f",
+        "rev": "e73de5be04e0eff4190a1432b946d469c794e7b4",
        "type": "github"
      },
      "original": {
@@ -373,6 +389,7 @@
        "flake-parts": "flake-parts",
        "git-hooks": "git-hooks",
        "home-manager": "home-manager",
+        "kube-tmux": "kube-tmux",
        "nix-darwin": "nix-darwin",
        "nix-homebrew": "nix-homebrew",
        "nix-index-database": "nix-index-database",
@@ -60,6 +60,13 @@
      url = "github:NixOS/nixos-hardware";
      inputs.nixpkgs.follows = "nixpkgs";
    };
+    # kube-tmux: kube context/namespace for the tmux status line on the work
+    # host. Not in nixpkgs and not a flake -- pinned here as a plain source so
+    # the script is always in the store (no manual checkout). See work.nix.
+    kube-tmux = {
+      url = "github:jonmosco/kube-tmux";
+      flake = false;
+    };
  };

  outputs =
@@ -93,8 +100,6 @@
        # Unfree packages permitted to be built (replaces blanket allowUnfree).
        unfreePackages = [
          "claude-code"
-          "lens"
-          "lens-desktop"
        ];

        # Per-user identity, keyed by username. See README "Users".
@@ -111,7 +111,7 @@ every host. Migrated from plain vim; the practical gain is a real LSP stack in
 place of the old (inert) ALE.

 | Feature        | Notes                                                                                     |
-| -------------- | -------------------------------------------------------------------------------------- |
+| -------------- | ----------------------------------------------------------------------------------------- |
 | Colorscheme    | Catppuccin Mocha (matches the terminal and the rest of the desktop)                       |
 | File tree      | nvim-tree, toggled with `,,` (comma twice; was nerdtree)                                  |
 | Fuzzy finder   | telescope (+fzf-native): `<leader>ff` files, `<leader>fg` grep, `<leader>fb` buffers      |
@@ -124,7 +124,7 @@ place of the old (inert) ALE.
 | Editing        | which-key hints, comment (`gc`/`gcc`), autopairs, treesitter textobjects                  |
 | Pane nav       | vim-tmux-navigator — `Ctrl`+`h/j/k/l` moves across vim splits and tmux panes              |
 | Syntax         | tree-sitter (nix, lua, bash, markdown, groovy, c#, python, terraform, yaml)               |
-| LSP            | nvim-cmp completion + servers `nil` (Nix), `lua_ls`, `pyright` (Python), `terraformls` |
+| LSP            | nvim-cmp completion + servers `nil_ls` (Nix), `lua_ls`, `pyright` (Python), `terraformls` |
 | Indentation    | 2-wide hard tabs (`noexpandtab`, `tabstop`/`shiftwidth` = 2); line numbers on             |
 | Filetypes      | `*Jenkinsfile` → groovy                                                                   |

@@ -26,10 +26,8 @@
  # workstation.nix is the backstop).
  zramSwap.enable = true;

-  # This host accepts SSH, so open 22 (the firewall itself is enabled in
-  # workstation.nix with a default-deny policy).
-  services.openssh.enable = true;
-  networking.firewall.allowedTCPPorts = [ 22 ];
+  # sshd (daemon, port 22, key-only policy) comes from ../../modules/ssh.nix;
+  # the firewall itself is enabled in workstation.nix with a default-deny policy.

  # Dual Harpertown Xeon microcode. Redistributable firmware (GPU/NIC blobs) is
  # enabled in workstation.nix.
@@ -25,15 +25,12 @@
  boot.loader.grub.enable = false;
  boot.loader.generic-extlinux-compatible.enable = true;

-  # Remote administration. Key-only policy and the authorized key come from
-  # ../../modules/ssh.nix; here we just enable the daemon and open the port.
-  services.openssh.enable = true;
+  # Remote administration: the daemon, port 22 and key-only policy all come from
+  # ../../modules/ssh.nix.

-  # Default-deny inbound. Open only SSH here; the Docker and nginx submodules
-  # open their own ports (Docker via a source-restricted nftables rule, nginx
-  # via 80/443). List-valued, so these merge with the submodule definitions.
+  # Default-deny inbound; the Docker and nginx submodules open their own ports
+  # (Docker via a source-restricted nftables rule, nginx via 80/443).
  networking.firewall.enable = true;
-  networking.firewall.allowedTCPPorts = [ 22 ];

  # See `man configuration.nix` / the stateVersion docs before changing.
  system.stateVersion = "26.05";
@@ -8,6 +8,10 @@
 # secure upgrade path is mutual TLS on 2376 (--tlsverify with client certs);
 # that needs out-of-band cert provisioning and is intentionally not wired here.
 { ... }:
+let
+  # LAN allowed to reach the unauthenticated Docker TCP socket (see SECURITY above).
+  trustedSubnet = "10.187.1.0/24";
+in
 {
  virtualisation.docker.enable = true;

@@ -29,6 +33,6 @@
  # CIDR to match the LAN that should reach the Docker API.
  networking.nftables.enable = true;
  networking.firewall.extraInputRules = ''
-    ip saddr 10.187.1.0/24 tcp dport 2375 accept
+    ip saddr ${trustedSubnet} tcp dport 2375 accept
  '';
 }
@@ -21,10 +21,8 @@
  # Low-RAM host (4 GiB max): a compressed RAM swap reduces disk paging.
  zramSwap.enable = true;

-  # This host accepts SSH, so open 22 (the firewall itself is enabled in
-  # laptop.nix with a default-deny policy).
-  services.openssh.enable = true;
-  networking.firewall.allowedTCPPorts = [ 22 ];
+  # sshd (daemon, port 22, key-only policy) comes from ../../modules/ssh.nix;
+  # the firewall itself is enabled in laptop.nix with a default-deny policy.

  # Intel Core 2 (Penryn) microcode. Redistributable firmware (enabled in
  # workstation.nix) supplies the iwlwifi blobs (Intel WiFi Link 5100/5300) and
@@ -1,8 +1,11 @@
-# Key-only sshd hardening, imported by hosts that run sshd (T400, Mac Pro,
-# RPi5). Authorized keys are owned per-user by the registry (modules/users.nix),
-# not here.
+# sshd for the hosts that run it (T400, Mac Pro, RPi5): enable the daemon, open
+# port 22, and apply a key-only policy. Authorized keys are owned per-user by the
+# registry (modules/users.nix), not here.
 { ... }:
 {
+  services.openssh.enable = true;
+  networking.firewall.allowedTCPPorts = [ 22 ];
+
  services.openssh.settings = {
    PasswordAuthentication = false; # keys only
    KbdInteractiveAuthentication = false; # no keyboard-interactive fallback
@@ -1,6 +1,11 @@
 # Work (EDaaS/WSL) home profile: corporate toolchain + tmux tweaks. Git identity
 # comes from the registry (users/registry.nix), not here.
-{ pkgs, lib, ... }:
+{
+  pkgs,
+  lib,
+  inputs,
+  ...
+}:

 {
  # Host-scoped extras for this machine only (the EDaaS/WSL host).
@@ -24,7 +29,6 @@
    pkgs.powershell
    pkgs.nuget
    pkgs.gedit
-    pkgs.lens
    pkgs.python3
    pkgs.gnumake
    pkgs.gcc
@@ -48,8 +52,10 @@
    docker = "/run/current-system/sw/bin/docker";
  };
  programs.tmux = {
+    # kube context/namespace in the status line. kube-tmux is pinned as a flake
+    # input (it is not in nixpkgs), so the script is always present in the store.
    extraConfig = ''
-      			set -g status-right "#(/run/current-system/sw/bin/bash $HOME/code/kube-tmux/kube.tmux 250 red black)"		
+      set -g status-right "#(${pkgs.bash}/bin/bash ${inputs.kube-tmux}/kube.tmux 250 red black)"
    '';
  };
  programs.go = {