chore(deps): lock file maintenance flake inputs

.editorconfig

@@ -8,6 +8,12 @@ indent_size = 2
 trim_trailing_whitespace = true
 insert_final_newline = true
 
+[*.{nix,yaml,yml,json,md,sh,toml}]
+indent_style = space
+indent_size = 2
+trim_trailing_whitespace = true
+insert_final_newline = true
+
 # Markdown uses trailing whitespace for hard line breaks.
 [*.md]
 trim_trailing_whitespace = false

.gitignore

@@ -2,6 +2,3 @@ modules/firmware/*
 
 # vim swap files
 *.swp
-
-# Local scratch project, not part of this flake.
-tf-inspect/

flake.lock

@@ -191,22 +191,6 @@
         "type": "github"
       }
     },
-    "kube-tmux": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1779714285,
-        "narHash": "sha256-l1wjg2ReWKCI7h/K11vvX2ykYTs/mVD+tfz/mQsjn/E=",
-        "owner": "jonmosco",
-        "repo": "kube-tmux",
-        "rev": "8b7e1d127c16b6dc87ff5743f4d775b245198b69",
-        "type": "github"
-      },
-      "original": {
-        "owner": "jonmosco",
-        "repo": "kube-tmux",
-        "type": "github"
-      }
-    },
     "nix-darwin": {
       "inputs": {
         "nixpkgs": [
@@ -389,7 +373,6 @@
         "flake-parts": "flake-parts",
         "git-hooks": "git-hooks",
         "home-manager": "home-manager",
-        "kube-tmux": "kube-tmux",
         "nix-darwin": "nix-darwin",
         "nix-homebrew": "nix-homebrew",
         "nix-index-database": "nix-index-database",

flake.nix

@@ -60,13 +60,6 @@
       url = "github:NixOS/nixos-hardware";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    # kube-tmux: kube context/namespace for the tmux status line on the work
-    # host. Not in nixpkgs and not a flake -- pinned here as a plain source so
-    # the script is always in the store (no manual checkout). See work.nix.
-    kube-tmux = {
-      url = "github:jonmosco/kube-tmux";
-      flake = false;
-    };
   };
 
   outputs =
@@ -100,6 +93,8 @@
         # Unfree packages permitted to be built (replaces blanket allowUnfree).
         unfreePackages = [
           "claude-code"
+          "lens"
+          "lens-desktop"
         ];
 
         # Per-user identity, keyed by username. See README "Users".

home/README.md

@@ -111,7 +111,7 @@ every host. Migrated from plain vim; the practical gain is a real LSP stack in
 place of the old (inert) ALE.
 
 | Feature        | Notes                                                                                  |
-| -------------- | ----------------------------------------------------------------------------------------- |
+| -------------- | -------------------------------------------------------------------------------------- |
 | Colorscheme    | Catppuccin Mocha (matches the terminal and the rest of the desktop)                    |
 | File tree      | nvim-tree, toggled with `,,` (comma twice; was nerdtree)                               |
 | Fuzzy finder   | telescope (+fzf-native): `<leader>ff` files, `<leader>fg` grep, `<leader>fb` buffers   |
@@ -124,7 +124,7 @@ place of the old (inert) ALE.
 | Editing        | which-key hints, comment (`gc`/`gcc`), autopairs, treesitter textobjects               |
 | Pane nav       | vim-tmux-navigator — `Ctrl`+`h/j/k/l` moves across vim splits and tmux panes           |
 | Syntax         | tree-sitter (nix, lua, bash, markdown, groovy, c#, python, terraform, yaml)            |
-| LSP            | nvim-cmp completion + servers `nil_ls` (Nix), `lua_ls`, `pyright` (Python), `terraformls` |
+| LSP            | nvim-cmp completion + servers `nil` (Nix), `lua_ls`, `pyright` (Python), `terraformls` |
 | Indentation    | 2-wide hard tabs (`noexpandtab`, `tabstop`/`shiftwidth` = 2); line numbers on          |
 | Filetypes      | `*Jenkinsfile` → groovy                                                                |
 

hosts/MacPro31/configuration.nix

@@ -26,8 +26,10 @@
   # workstation.nix is the backstop).
   zramSwap.enable = true;
 
-  # sshd (daemon, port 22, key-only policy) comes from ../../modules/ssh.nix;
+  # This host accepts SSH, so open 22 (the firewall itself is enabled in
-  # the firewall itself is enabled in workstation.nix with a default-deny policy.
+  # workstation.nix with a default-deny policy).
+  services.openssh.enable = true;
+  networking.firewall.allowedTCPPorts = [ 22 ];
 
   # Dual Harpertown Xeon microcode. Redistributable firmware (GPU/NIC blobs) is
   # enabled in workstation.nix.

hosts/RPi5/configuration.nix

@@ -25,12 +25,15 @@
   boot.loader.grub.enable = false;
   boot.loader.generic-extlinux-compatible.enable = true;
 
-  # Remote administration: the daemon, port 22 and key-only policy all come from
+  # Remote administration. Key-only policy and the authorized key come from
-  # ../../modules/ssh.nix.
+  # ../../modules/ssh.nix; here we just enable the daemon and open the port.
+  services.openssh.enable = true;
 
-  # Default-deny inbound; the Docker and nginx submodules open their own ports
+  # Default-deny inbound. Open only SSH here; the Docker and nginx submodules
-  # (Docker via a source-restricted nftables rule, nginx via 80/443).
+  # open their own ports (Docker via a source-restricted nftables rule, nginx
+  # via 80/443). List-valued, so these merge with the submodule definitions.
   networking.firewall.enable = true;
+  networking.firewall.allowedTCPPorts = [ 22 ];
 
   # See `man configuration.nix` / the stateVersion docs before changing.
   system.stateVersion = "26.05";

hosts/RPi5/docker.nix

@@ -8,10 +8,6 @@
 # secure upgrade path is mutual TLS on 2376 (--tlsverify with client certs);
 # that needs out-of-band cert provisioning and is intentionally not wired here.
 { ... }:
-let
-  # LAN allowed to reach the unauthenticated Docker TCP socket (see SECURITY above).
-  trustedSubnet = "10.187.1.0/24";
-in
 {
   virtualisation.docker.enable = true;
 
@@ -33,6 +29,6 @@ in
   # CIDR to match the LAN that should reach the Docker API.
   networking.nftables.enable = true;
   networking.firewall.extraInputRules = ''
-    ip saddr ${trustedSubnet} tcp dport 2375 accept
+    ip saddr 10.187.1.0/24 tcp dport 2375 accept
   '';
 }

hosts/T400/configuration.nix

@@ -21,8 +21,10 @@
   # Low-RAM host (4 GiB max): a compressed RAM swap reduces disk paging.
   zramSwap.enable = true;
 
-  # sshd (daemon, port 22, key-only policy) comes from ../../modules/ssh.nix;
+  # This host accepts SSH, so open 22 (the firewall itself is enabled in
-  # the firewall itself is enabled in laptop.nix with a default-deny policy.
+  # laptop.nix with a default-deny policy).
+  services.openssh.enable = true;
+  networking.firewall.allowedTCPPorts = [ 22 ];
 
   # Intel Core 2 (Penryn) microcode. Redistributable firmware (enabled in
   # workstation.nix) supplies the iwlwifi blobs (Intel WiFi Link 5100/5300) and

modules/ssh.nix

@@ -1,11 +1,8 @@
-# sshd for the hosts that run it (T400, Mac Pro, RPi5): enable the daemon, open
+# Key-only sshd hardening, imported by hosts that run sshd (T400, Mac Pro,
-# port 22, and apply a key-only policy. Authorized keys are owned per-user by the
+# RPi5). Authorized keys are owned per-user by the registry (modules/users.nix),
-# registry (modules/users.nix), not here.
+# not here.
 { ... }:
 {
-  services.openssh.enable = true;
-  networking.firewall.allowedTCPPorts = [ 22 ];
-
   services.openssh.settings = {
     PasswordAuthentication = false; # keys only
     KbdInteractiveAuthentication = false; # no keyboard-interactive fallback

users/emmathorpe/work.nix

@@ -1,11 +1,6 @@
 # Work (EDaaS/WSL) home profile: corporate toolchain + tmux tweaks. Git identity
 # comes from the registry (users/registry.nix), not here.
-{
+{ pkgs, lib, ... }:
-  pkgs,
-  lib,
-  inputs,
-  ...
-}:
 
 {
   # Host-scoped extras for this machine only (the EDaaS/WSL host).
@@ -29,6 +24,7 @@
     pkgs.powershell
     pkgs.nuget
     pkgs.gedit
+    pkgs.lens
     pkgs.python3
     pkgs.gnumake
     pkgs.gcc
@@ -52,10 +48,8 @@
     docker = "/run/current-system/sw/bin/docker";
   };
   programs.tmux = {
-    # kube context/namespace in the status line. kube-tmux is pinned as a flake
-    # input (it is not in nixpkgs), so the script is always present in the store.
     extraConfig = ''
-      set -g status-right "#(${pkgs.bash}/bin/bash ${inputs.kube-tmux}/kube.tmux 250 red black)"
+      			set -g status-right "#(/run/current-system/sw/bin/bash $HOME/code/kube-tmux/kube.tmux 250 red black)"		
     '';
   };
   programs.go = {