Compare commits
2
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Emma Thorpe
|
ea3e75e0af | ||
|
Emma Thorpe
|
10cc6cceed |
@@ -8,6 +8,12 @@ indent_size = 2
|
||||
trim_trailing_whitespace = true
|
||||
insert_final_newline = true
|
||||
|
||||
[*.{nix,yaml,yml,json,md,sh,toml}]
|
||||
indent_style = space
|
||||
indent_size = 2
|
||||
trim_trailing_whitespace = true
|
||||
insert_final_newline = true
|
||||
|
||||
# Markdown uses trailing whitespace for hard line breaks.
|
||||
[*.md]
|
||||
trim_trailing_whitespace = false
|
||||
|
||||
@@ -2,6 +2,3 @@ modules/firmware/*
|
||||
|
||||
# vim swap files
|
||||
*.swp
|
||||
|
||||
# Local scratch project, not part of this flake.
|
||||
tf-inspect/
|
||||
|
||||
@@ -1,63 +0,0 @@
|
||||
# Working on this flake
|
||||
|
||||
Project notes for changes to this repository. Persona and memory rules live in
|
||||
the user-global config; this file is about the flake's checks and conventions.
|
||||
|
||||
## Before you commit: run the formatter
|
||||
|
||||
Formatting and linting are driven by the flake. CI (`.gitea/workflows/ci.yaml`)
|
||||
runs `nix flake check`, which fails the build if any file is unformatted or trips
|
||||
a lint. From the repo root:
|
||||
|
||||
- `nix fmt` — format the whole tree (writes changes).
|
||||
- `nix flake check` — run every check read-only (what CI runs).
|
||||
- `nix develop` — dev shell; its `shellHook` installs the git pre-commit hooks so
|
||||
the same gates run on `git commit`.
|
||||
|
||||
Never commit with `--no-verify`. A bypassed commit ships unformatted content and
|
||||
turns CI red on the next push to `main` (see "Docs are checked too").
|
||||
|
||||
## What gets checked
|
||||
|
||||
Defined in `flake.nix` (the `treefmt`, `pre-commit`, and `checks` blocks) and
|
||||
`statix.toml`:
|
||||
|
||||
| Check | Tool | Covers |
|
||||
| ------------ | --------------------------------- | ------------------------------------------------------- |
|
||||
| `formatting` | treefmt → `nixfmt` | all `*.nix` |
|
||||
| `formatting` | treefmt → `shfmt` | shell scripts |
|
||||
| `formatting` | treefmt → `prettier` | **Markdown, YAML, JSON** (incl. `README.md`, this file) |
|
||||
| `deadnix` | deadnix | dead Nix bindings (`--no-lambda-pattern-names`) |
|
||||
| `statix` | statix | Nix antipatterns (config in `statix.toml`) |
|
||||
| pre-commit | nixfmt-rfc-style, deadnix, statix | the same gates, run on commit |
|
||||
|
||||
Excluded from formatting: `*/hardware-configuration.nix` (generated by
|
||||
`nixos-generate-config`) and `flake.lock`. Editor defaults (indent, EOL, final
|
||||
newline) are in `.editorconfig`; note Markdown keeps trailing whitespace, which
|
||||
encodes hard line breaks.
|
||||
|
||||
## Docs are checked too — the common trap
|
||||
|
||||
prettier formats `*.md`, so **documentation edits must be run through `nix fmt`**
|
||||
exactly like code. prettier re-aligns Markdown tables in particular; hand-editing
|
||||
a table almost always leaves it non-conformant and fails the `formatting` check.
|
||||
|
||||
Beware a false green: the CI `detect` step skips the heavy checks on a pull
|
||||
request that touches **no** `.nix`, `flake.lock`, or the workflow file — so a
|
||||
docs-only PR reports success without ever running prettier. The failure then
|
||||
surfaces on the push-to-`main` run (which always runs the full check) or on the
|
||||
next unrelated PR that does touch Nix. Run `nix flake check` locally before
|
||||
merging a docs change, regardless of what the PR check shows.
|
||||
|
||||
## Host evaluation
|
||||
|
||||
CI also evaluates every `nixosConfigurations` / `darwinConfigurations` host's
|
||||
toplevel (eval only, no build) on an x86_64 runner, so eval errors fail cheaply.
|
||||
Reproduce locally:
|
||||
|
||||
```sh
|
||||
nix eval --raw ".#nixosConfigurations.<host>.config.system.build.toplevel.drvPath"
|
||||
```
|
||||
|
||||
Host lists are discovered from the flake, so adding or removing a host needs no
|
||||
change to the workflow.
|
||||
@@ -12,67 +12,16 @@ Defined in the host table in [`flake.nix`](./flake.nix):
|
||||
| `lyrathorpe-mbp` | `aarch64-linux` | MacBook Pro (Apple Silicon, Asahi) |
|
||||
| `lyrathorpe-t400` | `x86_64-linux` | ThinkPad T400 — [install notes](./hosts/T400/README.md) |
|
||||
| `lyrathorpe-macpro31` | `x86_64-linux` | Mac Pro 3,1, desktop — [install notes](./hosts/MacPro31/README.md) |
|
||||
| `emmathorpe-edaas` | `x86_64-linux` | Work WSL box (NixOS-WSL) — [notes](./hosts/EDaaS/README.md) |
|
||||
| `emmathorpe-edaas` | `x86_64-linux` | Work WSL box (NixOS-WSL) |
|
||||
| `lyrathorpe-rpi5` | `aarch64-linux` | Raspberry Pi 5 headless server: Docker host + nginx reverse proxy — [install notes](./hosts/RPi5/README.md) |
|
||||
| `lyrathorpe-mac` | `aarch64-darwin` | macOS (nix-darwin) — [notes](./hosts/Darwin/README.md) |
|
||||
| `lyrathorpe-mac` | `aarch64-darwin` | macOS (nix-darwin) |
|
||||
|
||||
Shared layers: `home` (home-manager: shell, git, editor),
|
||||
`modules/common-nixos.nix` (all NixOS hosts: fonts, nix-ld, caches),
|
||||
`modules/workstation.nix` (physical graphical hosts: audio, thermald,
|
||||
earlyoom, fwupd), `modules/laptop.nix` (laptops: Wi-Fi, Bluetooth, power,
|
||||
lid), `modules/desktop.nix` (wired desktops: NetworkManager), and
|
||||
`modules/ssh.nix` (key-only sshd). The x86 hosts also pull `nixos-hardware`
|
||||
profiles. The full module catalogue is below.
|
||||
|
||||
## Repository layout
|
||||
|
||||
```
|
||||
flake.nix # inputs, mkHost/mkDarwinHost, the host tables, dev shell + checks
|
||||
flake.lock # pinned input revisions (Renovate keeps this fresh)
|
||||
modules/ # reusable NixOS system modules (see "Module catalogue")
|
||||
home/ # home-manager profile: shell, git, editor, claude, desktop, sway
|
||||
users/ # identity registry + per-user home extras (see "Users")
|
||||
hosts/<Name>/ # per-machine config: configuration.nix + hardware-configuration.nix
|
||||
lib/ # small pure helpers (currently the Catppuccin Mocha palette)
|
||||
.gitea/workflows/ # CI (nix flake check + per-host eval)
|
||||
statix.toml # lint config (house-style lints disabled)
|
||||
.editorconfig # base whitespace style
|
||||
tf-inspect/ # UNRELATED scratch project (gitignored, its own git repo);
|
||||
# RouterOS / home-services Terraform, not part of this flake
|
||||
```
|
||||
|
||||
Each `nixosConfiguration` / `darwinConfiguration` is assembled in `flake.nix`
|
||||
from three layers: the shared `baseModules` (or `darwinBaseModules`), the
|
||||
per-form-factor and `nixos-hardware` modules listed in the host table, and the
|
||||
per-machine `hosts/<Name>/configuration.nix`. Home-manager is wired in as a
|
||||
system module; each user's home is composed from the `homeModules` list in that
|
||||
host's table entry.
|
||||
|
||||
## Module catalogue
|
||||
|
||||
Reusable NixOS modules under [`modules/`](./modules). "Imported by" says how a
|
||||
module reaches a host: **baseModules** (every NixOS host, via `flake.nix`),
|
||||
**host table** (listed explicitly per host in `flake.nix`), or **transitively**
|
||||
(pulled in by another module's `imports`).
|
||||
|
||||
| Module | Imported by | What it does / when to use it |
|
||||
| -------------------- | --------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| `common-nixos.nix` | baseModules (all NixOS) | Timezone/locale, store hygiene (auto-optimise, big download buffer, **no** auto-GC), the nix-community binary cache, `nix-ld`, base CLI (`git`, `fastfetch`), and the fleet-wide font stack. |
|
||||
| `users.nix` | baseModules (all NixOS) | Builds `users.users` from the registry for the host's `hostUsers`; enables zsh; enables Firefox + Thunderbird **only** when `features.swayDesktop.enable` is on. Applies per-user `linger`. |
|
||||
| `features.nix` | baseModules (all NixOS) | Declares feature-flag options (currently `features.swayDesktop.enable`) so any host can read/set them without importing the heavy implementation module. |
|
||||
| `workstation.nix` | transitively (via laptop/desktop) | Form-factor-agnostic base for physical graphical hosts: turns on `swayDesktop`, Dvorak console, PipeWire, firewall (default-deny), fstrim, earlyoom, fwupd, thermald (x86), redistributable fw. |
|
||||
| `laptop.nix` | host table (MBP, T400) | `imports` workstation.nix, then adds the portable bits: iwd Wi-Fi, lid suspend/lock, Bluetooth + blueman. |
|
||||
| `desktop.nix` | host table (Mac Pro) | `imports` workstation.nix, then swaps Wi-Fi for wired NetworkManager. Pair with `portable = false` in the host table. |
|
||||
| `sway.nix` | host table (graphical hosts) | Implementation of `features.swayDesktop`: the system Sway package, the greetd/ReGreet (cage) greeter forced to Dvorak, xdg-portal, Wayland utility packages. Home-side Sway config is in `home/sway.nix`. |
|
||||
| `ssh.nix` | host table (T400, Mac Pro, RPi5) | Enables sshd, opens port 22, enforces a key-only policy (no password / keyboard-interactive, no root). Authorized keys come from the registry via `users.nix`. |
|
||||
| `firmware/` | referenced by MBP host config | Committed Apple peripheral firmware blobs for the Asahi MBP (see "MacBook (Asahi) firmware"). |
|
||||
|
||||
Form-factor decision: a **laptop** imports `laptop.nix` (default
|
||||
`portable = true`); a **wired desktop** imports `desktop.nix` and sets
|
||||
`portable = false`; a **headless server** imports neither (leaves
|
||||
`features.swayDesktop.enable` at its default `false`) and adds only what it
|
||||
serves. `portable` is threaded through to `home/sway.nix`, which drops the
|
||||
battery block and brightness keys on desktops.
|
||||
lid), and `modules/ssh.nix` (key-only sshd). The x86 hosts also pull
|
||||
`nixos-hardware` profiles.
|
||||
|
||||
## Users
|
||||
|
||||
@@ -89,16 +38,6 @@ Identity is data, kept separate from the reusable modules:
|
||||
identity into that user's home config as the `identity` module arg. A host can
|
||||
therefore declare any number of users.
|
||||
|
||||
Per-user home extras live under `users/<name>/`:
|
||||
|
||||
- [`users/lyrathorpe/home.nix`](./users/lyrathorpe/home.nix) — personal extras
|
||||
(an ssh host shortcut, gammastep coordinates); imported on Lyra's hosts.
|
||||
- [`users/emmathorpe/work.nix`](./users/emmathorpe/work.nix) — the work
|
||||
toolchain (kubectl/helm/az/etc.), work-only LSP servers, and the corporate ssh
|
||||
handling; imports
|
||||
[`users/emmathorpe/renovate-review.nix`](./users/emmathorpe/renovate-review.nix),
|
||||
the daily headless Renovate-PR review timer (EDaaS only).
|
||||
|
||||
### Portable home (off-NixOS / external consumers)
|
||||
|
||||
The home config is also exposed for use beyond these hosts:
|
||||
@@ -122,36 +61,6 @@ sudo nixos-rebuild switch --flake .#<configuration>
|
||||
darwin-rebuild switch --flake .#lyrathorpe-mac
|
||||
```
|
||||
|
||||
On a host whose `networking.hostName` matches its flake attribute (the WSL box
|
||||
and the Pi are set up this way), `nh os switch` resolves the configuration from
|
||||
the hostname with no `--flake`/`-H` flag.
|
||||
|
||||
## Adding a new host
|
||||
|
||||
1. **Create `hosts/<Name>/`.** Add `configuration.nix` with the host-specific
|
||||
bits only: `networking.hostName`, bootloader (firmware-specific — it is
|
||||
deliberately not set in the shared modules), and any per-machine hardware
|
||||
quirks. Keep anything reusable in `modules/` instead.
|
||||
2. **Hardware config.** Generate `hardware-configuration.nix` on the real
|
||||
machine with `nixos-generate-config` and commit it. If the machine does not
|
||||
exist yet, commit a clearly-labelled placeholder so the host still evaluates
|
||||
in CI (see the existing T400 / RPi5 placeholders), and replace it at install.
|
||||
These files are excluded from the formatter and linters.
|
||||
3. **Add a host-table entry in `flake.nix`.** Under `hosts` (NixOS) or
|
||||
`darwinHosts` (macOS), set `system`, the `modules` list (host config + form
|
||||
factor + any `nixos-hardware` profiles), and the `users` map (each user's
|
||||
`homeModules`). Choose the form factor per the decision note above; a headless
|
||||
host imports neither `laptop.nix` nor `desktop.nix`.
|
||||
4. **Users.** If the host introduces a new person, add them to
|
||||
`users/registry.nix` first; otherwise reference an existing username.
|
||||
5. **Verify.** `nix flake check` formats, lints, and evaluates every host —
|
||||
including the new one — so a broken entry fails locally before CI. Then
|
||||
`sudo nixos-rebuild switch --flake .#<configuration>` on the machine.
|
||||
|
||||
No change to CI is needed: the host-eval step discovers hosts from the flake
|
||||
(`attrNames` of the configuration sets), so a new entry is picked up
|
||||
automatically.
|
||||
|
||||
## Shell environment & keybindings
|
||||
|
||||
- Interactive shell features (zsh, tmux, git, ssh, CLI tools, auto-tmux):
|
||||
@@ -202,7 +111,4 @@ A dev shell and a formatting/lint gate are wired through the flake:
|
||||
|
||||
[`.gitea/workflows/ci.yaml`](./.gitea/workflows/ci.yaml) runs `nix flake check`
|
||||
(formatting, `deadnix`, `statix`, the pre-commit hooks) and evaluates every
|
||||
NixOS and Darwin host configuration on push/PR. It always runs (no `paths:`
|
||||
filter) so the required check never hangs pending; the heavy Nix steps are
|
||||
skipped when a PR touches no `.nix`/lockfile/workflow file, and the job still
|
||||
reports green.
|
||||
NixOS and Darwin host configuration on push/PR.
|
||||
|
||||
Generated
-17
@@ -191,22 +191,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"kube-tmux": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1779714285,
|
||||
"narHash": "sha256-l1wjg2ReWKCI7h/K11vvX2ykYTs/mVD+tfz/mQsjn/E=",
|
||||
"owner": "jonmosco",
|
||||
"repo": "kube-tmux",
|
||||
"rev": "8b7e1d127c16b6dc87ff5743f4d775b245198b69",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "jonmosco",
|
||||
"repo": "kube-tmux",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nix-darwin": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -389,7 +373,6 @@
|
||||
"flake-parts": "flake-parts",
|
||||
"git-hooks": "git-hooks",
|
||||
"home-manager": "home-manager",
|
||||
"kube-tmux": "kube-tmux",
|
||||
"nix-darwin": "nix-darwin",
|
||||
"nix-homebrew": "nix-homebrew",
|
||||
"nix-index-database": "nix-index-database",
|
||||
|
||||
@@ -60,13 +60,6 @@
|
||||
url = "github:NixOS/nixos-hardware";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
# kube-tmux: kube context/namespace for the tmux status line on the work
|
||||
# host. Not in nixpkgs and not a flake -- pinned here as a plain source so
|
||||
# the script is always in the store (no manual checkout). See work.nix.
|
||||
kube-tmux = {
|
||||
url = "github:jonmosco/kube-tmux";
|
||||
flake = false;
|
||||
};
|
||||
};
|
||||
|
||||
outputs =
|
||||
@@ -100,9 +93,14 @@
|
||||
# Unfree packages permitted to be built (replaces blanket allowUnfree).
|
||||
unfreePackages = [
|
||||
"claude-code"
|
||||
"lens"
|
||||
"lens-desktop"
|
||||
];
|
||||
|
||||
# Per-user identity, keyed by username. See README "Users".
|
||||
# Identity registry: who each user is (name, email, keys, groups), keyed
|
||||
# by username. Threaded into the system layer as the `userRegistry`
|
||||
# specialArg and into each user's home config as the `identity` module
|
||||
# arg. See users/registry.nix, modules/users.nix, home/git.nix.
|
||||
userRegistry = import ./users/registry.nix;
|
||||
|
||||
# nixpkgs + nix-daemon settings shared by NixOS and Darwin hosts.
|
||||
@@ -134,8 +132,14 @@
|
||||
}
|
||||
];
|
||||
|
||||
# Build one NixOS host. `users` is an attrset keyed by username (home
|
||||
# modules + optional per-user system bits). See README "Users".
|
||||
# mkHost :: { system, modules, users, portable } -> nixosSystem
|
||||
# Builds one machine by appending its host-specific modules to the shared
|
||||
# baseModules. `users` is an attrset keyed by username; each value carries
|
||||
# that user's home-module list and optional per-host-user system bits
|
||||
# (e.g. linger). Per-user identity is injected into each home config via
|
||||
# the `identity` module arg (extraSpecialArgs is per-host, so it cannot
|
||||
# carry per-user data); the system layer reads the global `userRegistry`
|
||||
# restricted to this host's `hostUsers` set.
|
||||
mkHost =
|
||||
{
|
||||
system,
|
||||
@@ -186,8 +190,11 @@
|
||||
}
|
||||
];
|
||||
|
||||
# Darwin counterpart of mkHost: single-user (macOS owns the account),
|
||||
# identity still from the registry. See README "Users".
|
||||
# mkDarwinHost :: { system, username, modules, homeModules } -> darwinSystem
|
||||
# Darwin counterpart of mkHost. macOS already owns the login user, so we
|
||||
# only attach the platform and home-manager; no NixOS user module here.
|
||||
# Stays single-user (macOS owns the account); identity is still sourced
|
||||
# from the registry so the shared home modules behave as on NixOS.
|
||||
mkDarwinHost =
|
||||
{
|
||||
system,
|
||||
@@ -216,8 +223,12 @@
|
||||
];
|
||||
};
|
||||
|
||||
# Host table — one entry per machine, realised into a nixosConfiguration
|
||||
# of the same name below. See README "Hosts" / "Users".
|
||||
# Host table — declarative registry of every machine. To add a host:
|
||||
# give it a name, its `system`, its `users` set (each user's home-module
|
||||
# list, plus optional per-host-user bits like linger), and the system
|
||||
# `modules`. mapAttrs below turns each entry into a nixosConfiguration of
|
||||
# the same name. Per-user home configs compose ./home (the shared bundle)
|
||||
# with any per-user modules (e.g. ./users/emmathorpe/work.nix).
|
||||
hosts = {
|
||||
lyrathorpe-mbp = {
|
||||
system = "aarch64-linux";
|
||||
@@ -229,7 +240,6 @@
|
||||
];
|
||||
users.lyrathorpe.homeModules = [
|
||||
./home
|
||||
./users/lyrathorpe/home.nix
|
||||
./home/desktop.nix
|
||||
];
|
||||
};
|
||||
@@ -251,7 +261,6 @@
|
||||
];
|
||||
users.lyrathorpe.homeModules = [
|
||||
./home
|
||||
./users/lyrathorpe/home.nix
|
||||
./home/desktop.nix
|
||||
];
|
||||
};
|
||||
@@ -269,7 +278,6 @@
|
||||
];
|
||||
users.lyrathorpe.homeModules = [
|
||||
./home
|
||||
./users/lyrathorpe/home.nix
|
||||
./home/desktop.nix
|
||||
];
|
||||
};
|
||||
@@ -303,10 +311,7 @@
|
||||
inputs.nixos-hardware.nixosModules.raspberry-pi-5
|
||||
./modules/ssh.nix
|
||||
];
|
||||
users.lyrathorpe.homeModules = [
|
||||
./home
|
||||
./users/lyrathorpe/home.nix
|
||||
];
|
||||
users.lyrathorpe.homeModules = [ ./home ];
|
||||
};
|
||||
};
|
||||
|
||||
@@ -322,7 +327,6 @@
|
||||
];
|
||||
homeModules = [
|
||||
./home
|
||||
./users/lyrathorpe/home.nix
|
||||
];
|
||||
};
|
||||
};
|
||||
@@ -414,8 +418,14 @@
|
||||
flake.nixosConfigurations = lib.mapAttrs (_name: mkHost) hosts;
|
||||
flake.darwinConfigurations = lib.mapAttrs (_name: mkDarwinHost) darwinHosts;
|
||||
|
||||
# Reusable home modules, exported for use off these hosts. See README
|
||||
# "Portable home" for the consumer module-arg expectations.
|
||||
# Reusable home modules, exported so this config can be consumed off these
|
||||
# hosts -- by a standalone home-manager on a non-NixOS machine, or as an
|
||||
# input to someone else's flake. `default` is the portable bundle
|
||||
# (shell + git + editor + claude). Consumers must supply the module args
|
||||
# these expect: `inputs` always; `identity` (see users/registry.nix) for
|
||||
# git/desktop; `portable` for sway. `desktop`/`sway` additionally require
|
||||
# a NixOS host that provides the Sway/Firefox binary -- they are not
|
||||
# standalone-portable.
|
||||
flake.homeModules = {
|
||||
default = ./home;
|
||||
shell = ./home/shell.nix;
|
||||
@@ -426,8 +436,13 @@
|
||||
sway = ./home/sway.nix;
|
||||
};
|
||||
|
||||
# Standalone home-manager configs (portable bundle) for machines not
|
||||
# managed by this flake. See README "Portable home".
|
||||
# Standalone home-manager configurations: the portable bundle built for a
|
||||
# machine NOT managed by this flake (`home-manager switch --flake
|
||||
# .#"<user>@<system>"`). Only the portable subset is exposed; the desktop
|
||||
# suite stays NixOS-only. homeConfigurations are not per-system, so the
|
||||
# system is encoded in the attribute name, and home.username/homeDirectory
|
||||
# are set explicitly (the NixOS module sets them automatically; standalone
|
||||
# does not).
|
||||
flake.homeConfigurations =
|
||||
let
|
||||
mkHome =
|
||||
|
||||
+17
-17
@@ -110,23 +110,23 @@ declaratively with **nixvim**, so the same plugins and config are baked in on
|
||||
every host. Migrated from plain vim; the practical gain is a real LSP stack in
|
||||
place of the old (inert) ALE.
|
||||
|
||||
| Feature | Notes |
|
||||
| -------------- | ----------------------------------------------------------------------------------------- |
|
||||
| Colorscheme | Catppuccin Mocha (matches the terminal and the rest of the desktop) |
|
||||
| File tree | nvim-tree, toggled with `,,` (comma twice; was nerdtree) |
|
||||
| Fuzzy finder | telescope (+fzf-native): `<leader>ff` files, `<leader>fg` grep, `<leader>fb` buffers |
|
||||
| Format on save | conform-nvim (nixfmt, stylua, ruff, shfmt, prettier, gofumpt; LSP fallback otherwise) |
|
||||
| Git | fugitive (`:Git …`) + gitsigns gutter signs/blame |
|
||||
| Diagnostics | inline + trouble list (`<leader>xx`) |
|
||||
| Completion | nvim-cmp (LSP/buffer/path) with luasnip snippet expansion |
|
||||
| Indent guides | indent-blankline, on by default (was vim-indent-guides) |
|
||||
| Statusline | lualine (Catppuccin theme) |
|
||||
| Editing | which-key hints, comment (`gc`/`gcc`), autopairs, treesitter textobjects |
|
||||
| Pane nav | vim-tmux-navigator — `Ctrl`+`h/j/k/l` moves across vim splits and tmux panes |
|
||||
| Syntax | tree-sitter (nix, lua, bash, markdown, groovy, c#, python, terraform, yaml) |
|
||||
| LSP | nvim-cmp completion + servers `nil_ls` (Nix), `lua_ls`, `pyright` (Python), `terraformls` |
|
||||
| Indentation | 2-wide hard tabs (`noexpandtab`, `tabstop`/`shiftwidth` = 2); line numbers on |
|
||||
| Filetypes | `*Jenkinsfile` → groovy |
|
||||
| Feature | Notes |
|
||||
| -------------- | -------------------------------------------------------------------------------------- |
|
||||
| Colorscheme | Catppuccin Mocha (matches the terminal and the rest of the desktop) |
|
||||
| File tree | nvim-tree, toggled with `,,` (comma twice; was nerdtree) |
|
||||
| Fuzzy finder | telescope (+fzf-native): `<leader>ff` files, `<leader>fg` grep, `<leader>fb` buffers |
|
||||
| Format on save | conform-nvim (nixfmt, stylua, ruff, shfmt, prettier, gofumpt; LSP fallback otherwise) |
|
||||
| Git | fugitive (`:Git …`) + gitsigns gutter signs/blame |
|
||||
| Diagnostics | inline + trouble list (`<leader>xx`) |
|
||||
| Completion | nvim-cmp (LSP/buffer/path) with luasnip snippet expansion |
|
||||
| Indent guides | indent-blankline, on by default (was vim-indent-guides) |
|
||||
| Statusline | lualine (Catppuccin theme) |
|
||||
| Editing | which-key hints, comment (`gc`/`gcc`), autopairs, treesitter textobjects |
|
||||
| Pane nav | vim-tmux-navigator — `Ctrl`+`h/j/k/l` moves across vim splits and tmux panes |
|
||||
| Syntax | tree-sitter (nix, lua, bash, markdown, groovy, c#, python, terraform, yaml) |
|
||||
| LSP | nvim-cmp completion + servers `nil` (Nix), `lua_ls`, `pyright` (Python), `terraformls` |
|
||||
| Indentation | 2-wide hard tabs (`noexpandtab`, `tabstop`/`shiftwidth` = 2); line numbers on |
|
||||
| Filetypes | `*Jenkinsfile` → groovy |
|
||||
|
||||
Leader is `Space`. LSP keymaps (`gd`, `gr`, `K`, `<leader>rn`, `<leader>ca`) and
|
||||
the file-tree toggle are listed in
|
||||
|
||||
@@ -9,4 +9,3 @@
|
||||
- [Review and comments workflow](workflow_review_and_comments.md) — show PR body and non-trivial Jira comments before posting; terse IaC code comments; PR body content rules
|
||||
- [Sandbox prompts](feedback_sandbox_prompts.md) — don't prompt for sandbox-disable or routine read-only shell ops; broaden permissions instead
|
||||
- [Dev clusters disposable](dev_clusters_disposable.md) — Lyra's dev clusters are recreatable; mutate/break freely, no confirmation needed
|
||||
- [Nix shell tooling](nix_shell_tooling.md) — any nixpkgs tool runs ad hoc via `nix run`/`nix shell nixpkgs#<pkg>`; a missing command is never a dead end
|
||||
|
||||
@@ -1,23 +0,0 @@
|
||||
---
|
||||
name: nix-shell-tooling
|
||||
description: "Any nixpkgs tool can be run ad hoc via nix run / nix shell — a missing command is never a dead end during development"
|
||||
metadata:
|
||||
node_type: memory
|
||||
type: feedback
|
||||
originSessionId: dfb56b58-518b-4daf-b531-7119bb4a9534
|
||||
---
|
||||
|
||||
Any tool in nixpkgs can be run without installing it into the environment. If a
|
||||
command is missing during development, pull it from nixpkgs on the fly instead
|
||||
of working around its absence or reporting the tool as unavailable.
|
||||
|
||||
**Why:** Lyra runs NixOS; the ambient PATH is deliberately minimal, but the full
|
||||
nixpkgs set is always one command away. "command not found" is not a blocker.
|
||||
|
||||
**How to apply:**
|
||||
|
||||
- One-off run: `nix run nixpkgs#<pkg> -- <args>` (e.g. `nix run nixpkgs#jq -- .`).
|
||||
- Tools on PATH for a session: `nix shell nixpkgs#<pkg> [nixpkgs#<pkg2> ...]`,
|
||||
then run commands normally.
|
||||
- Legacy form also works: `nix-shell -p <pkg> --run '<cmd>'`.
|
||||
- Prefer this over hand-rolling a substitute for a tool that exists in nixpkgs.
|
||||
+8
-5
@@ -1,5 +1,6 @@
|
||||
# Version control: git + delta + commitizen + lazygit. Committer identity comes
|
||||
# from the per-user `identity` arg (the registry). See README "Users".
|
||||
# Version control: git + delta pager + commitizen + lazygit. The committer
|
||||
# identity (name, email, signing key) comes from the per-user `identity` arg,
|
||||
# derived from the registry (users/registry.nix) by mkHost.
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
@@ -19,7 +20,8 @@ in
|
||||
package = pkgs.gitFull;
|
||||
settings = {
|
||||
user.name = identity.fullName;
|
||||
# mkDefault so a host-specific module can still override it.
|
||||
# Identity from the registry. mkDefault so a host-specific module can still
|
||||
# override it without conflicting.
|
||||
user.email = lib.mkDefault identity.email;
|
||||
push.autoSetupRemote = true;
|
||||
init.defaultBranch = "main";
|
||||
@@ -76,8 +78,9 @@ in
|
||||
cc = "!cz commit";
|
||||
};
|
||||
|
||||
# SSH signing, key from the registry. mkDefault so a host lacking the key
|
||||
# in its agent can set gpgsign = false instead of failing every commit.
|
||||
# SSH commit signing, key from the registry. mkDefault on the key and on
|
||||
# gpgsign so a host without that key in its ssh-agent can override gpgsign
|
||||
# to false rather than fail every commit.
|
||||
gpg.format = "ssh";
|
||||
user.signingkey = lib.mkDefault identity.signingKey;
|
||||
commit.gpgsign = lib.mkDefault true;
|
||||
|
||||
@@ -341,6 +341,9 @@ in
|
||||
IdentityFile = "~/.ssh/code.emmathe.dev";
|
||||
IdentitiesOnly = true;
|
||||
};
|
||||
"dockerpi.inf.cbg.emmaisvery.gay" = {
|
||||
User = "emmathorpe";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
+4
-3
@@ -334,12 +334,13 @@ in
|
||||
];
|
||||
};
|
||||
|
||||
# Night light. Manual location (no geoclue dependency); warmer at night,
|
||||
# neutral by day. Coordinates come from the per-user module (e.g.
|
||||
# users/lyrathorpe/home.nix), not this shared module.
|
||||
# Night light. Manual location (no geoclue dependency); adjust the coordinates
|
||||
# to taste. Warmer at night, neutral by day.
|
||||
services.gammastep = {
|
||||
enable = true;
|
||||
provider = "manual";
|
||||
latitude = 51.5;
|
||||
longitude = -0.13; # London-ish; set to your actual location
|
||||
temperature = {
|
||||
day = 6500;
|
||||
night = 3700;
|
||||
|
||||
@@ -1,51 +0,0 @@
|
||||
# macOS (nix-darwin) — `lyrathorpe-mac`
|
||||
|
||||
Flake host: `lyrathorpe-mac` (`aarch64-darwin`). Apple Silicon Mac managed by
|
||||
**nix-darwin** from this same flake. Built via `mkDarwinHost` (single-user —
|
||||
macOS owns the account; identity still comes from the registry). Files:
|
||||
`configuration.nix`.
|
||||
|
||||
## What this host is
|
||||
|
||||
A macOS workstation. The interactive user environment (shell, git, editor,
|
||||
Claude) is the **shared `../../home` bundle** — the same modules the Linux hosts
|
||||
use — so the terminal experience matches. The Linux-only `desktop.nix`/`sway.nix`
|
||||
are intentionally left out. This host config covers the macOS-specific layer:
|
||||
system packages, Homebrew, and macOS UI defaults.
|
||||
|
||||
## Package sourcing
|
||||
|
||||
- **nixpkgs** (`environment.systemPackages`) for CLI tooling and libraries.
|
||||
- **Homebrew**, owned declaratively by `nix-homebrew` (Rosetta enabled for
|
||||
x86_64 formulae). The `brews`/`casks` lists are **authoritative**:
|
||||
`onActivation.cleanup = "zap"` uninstalls anything not declared. GUI apps are
|
||||
casks (nixpkgs darwin GUI support is unreliable); a few version-pinned
|
||||
toolchains and the PWA host stay on brew for continuity.
|
||||
- **Mac App Store** apps are **not** declarative: nix-darwin 26.05 runs
|
||||
activation as root, and `mas` cannot reach the App Store session from root.
|
||||
Install them by hand with `mas install <id>` from a GUI Terminal (the `mas`
|
||||
CLI is in `environment.systemPackages`).
|
||||
|
||||
## macOS integration
|
||||
|
||||
- `security.pam.services.sudo_local` — **Touch ID for sudo** (and
|
||||
`darwin-rebuild`'s sudo prompt), kept in `sudo_local` so it survives OS
|
||||
updates. `reattach` pulls in `pam_reattach` so Touch ID works inside tmux
|
||||
(which the terminals auto-start).
|
||||
- `system.defaults` — declarative dock / finder / global / trackpad preferences,
|
||||
applied on activation and reversible. This is the main reason to run nix-darwin
|
||||
beyond package management.
|
||||
- The JetBrainsMono Nerd Font is installed to `/Library/Fonts`; set it in
|
||||
iTerm2 (Settings → Profiles → Text → Font) so the tmux statusline glyphs
|
||||
render.
|
||||
|
||||
## stateVersion
|
||||
|
||||
`system.stateVersion = 5` (the nix-darwin state version, an integer — not a
|
||||
NixOS release string). Read `darwin-rebuild changelog` before changing it.
|
||||
|
||||
## Apply
|
||||
|
||||
```sh
|
||||
darwin-rebuild switch --flake .#lyrathorpe-mac
|
||||
```
|
||||
@@ -1,53 +0,0 @@
|
||||
# Work WSL box — `emmathorpe-edaas`
|
||||
|
||||
Flake host: `emmathorpe-edaas` (`x86_64-linux`). NixOS running under
|
||||
**NixOS-WSL** on the corporate Windows machine. Headless: no Sway desktop
|
||||
(`features.swayDesktop.enable = false`), plain WSL shell login. Files:
|
||||
`configuration.nix`.
|
||||
|
||||
## What this host is
|
||||
|
||||
The day-to-day work environment. It layers the corporate Kubernetes / Helm /
|
||||
Terraform / cloud toolchain and a couple of work-only editor language servers on
|
||||
top of the shared home profile. The system config here is thin — it is mostly
|
||||
WSL plumbing; the user-facing tooling lives in
|
||||
[`../../users/emmathorpe/work.nix`](../../users/emmathorpe/work.nix).
|
||||
|
||||
## WSL specifics
|
||||
|
||||
- `wsl.enable`, default user `emmathorpe`, Windows PATH interop and start-menu
|
||||
launchers on. `/etc/hosts` generation is off (`generateHosts = false`).
|
||||
- **Docker Desktop integration**, not the native daemon as the primary path:
|
||||
`wsl.extraBin` shims the coreutils/`groupadd`/`usermod` binaries Docker
|
||||
Desktop's `wsl-distro-proxy` expects, and `docker-desktop-proxy.script` is
|
||||
patched to the real proxy path. The native `virtualisation.docker` is also
|
||||
enabled (with `enableOnBoot` + `autoPrune`).
|
||||
- `programs.ssh.systemd-ssh-proxy.enable = false` — the NixOS-WSL store is a
|
||||
read-only VHD owned by `nobody`, and OpenSSH rejects the generated
|
||||
`ssh-proxy` Include as "Bad owner or permissions", which would break ssh/git
|
||||
for every command. The vsock proxy it provides is unused under WSL.
|
||||
- `networking.hostName = "emmathorpe-edaas"` matches the flake attribute so
|
||||
`nh os switch` resolves without `-H`.
|
||||
|
||||
## Renovate review timer
|
||||
|
||||
The host-table entry sets `users.emmathorpe.linger = true` so the user's
|
||||
`systemd --user` instance stays alive without an open login session. That keeps
|
||||
the daily headless **Renovate PR review** timer firing — defined in
|
||||
[`../../users/emmathorpe/renovate-review.nix`](../../users/emmathorpe/renovate-review.nix)
|
||||
(imported only from `work.nix`, so it exists on this machine alone). See that
|
||||
file's header for the auth (Vertex AI ADC), triage policy, and caveats.
|
||||
|
||||
## stateVersion
|
||||
|
||||
`system.stateVersion = "24.11"` — the release this box was first installed on.
|
||||
Leave it; it freezes stateful defaults and is not meant to track the current
|
||||
nixpkgs.
|
||||
|
||||
## Apply
|
||||
|
||||
```sh
|
||||
sudo nixos-rebuild switch --flake .#emmathorpe-edaas
|
||||
# or, since the hostname matches the attribute:
|
||||
nh os switch
|
||||
```
|
||||
@@ -48,7 +48,7 @@ gigabit ports.
|
||||
## Login
|
||||
|
||||
Graphical login via a Wayland greeter — `greetd` running ReGreet inside the
|
||||
`cage` kiosk compositor — configured centrally in `../../modules/sway.nix` for
|
||||
`cage` kiosk compositor — configured centrally in `lyrathorpe/swaywm.nix` for
|
||||
every Sway host (gated on `features.swayDesktop.enable`). The greeter is forced
|
||||
to the Dvorak layout to match the console and Sway session. Set the user
|
||||
password (`passwd lyrathorpe`) after install, or the greeter cannot
|
||||
|
||||
@@ -26,8 +26,10 @@
|
||||
# workstation.nix is the backstop).
|
||||
zramSwap.enable = true;
|
||||
|
||||
# sshd (daemon, port 22, key-only policy) comes from ../../modules/ssh.nix;
|
||||
# the firewall itself is enabled in workstation.nix with a default-deny policy.
|
||||
# This host accepts SSH, so open 22 (the firewall itself is enabled in
|
||||
# workstation.nix with a default-deny policy).
|
||||
services.openssh.enable = true;
|
||||
networking.firewall.allowedTCPPorts = [ 22 ];
|
||||
|
||||
# Dual Harpertown Xeon microcode. Redistributable firmware (GPU/NIC blobs) is
|
||||
# enabled in workstation.nix.
|
||||
|
||||
@@ -15,7 +15,7 @@ Headless `aarch64-linux` server with two roles:
|
||||
```sh
|
||||
nixos-generate-config --root /mnt
|
||||
# copy /mnt/etc/nixos/hardware-configuration.nix over
|
||||
# hosts/RPi5/hardware-configuration.nix in this repo, then commit
|
||||
# system/machine/RPi5/hardware-configuration.nix in this repo, then commit
|
||||
```
|
||||
`hardware-configuration.nix` in this directory is a **placeholder** committed
|
||||
only so the host evaluates in CI. The machine will not boot correctly until it
|
||||
@@ -28,8 +28,7 @@ Headless `aarch64-linux` server with two roles:
|
||||
nh os switch
|
||||
```
|
||||
4. Give the login user a password (`passwd lyrathorpe`) and confirm the key in
|
||||
the user registry (`../../users/registry.nix`, applied by
|
||||
`../../modules/ssh.nix`) is the one you will connect with.
|
||||
`system/modules/ssh.nix` is the one you will connect with.
|
||||
|
||||
## Docker socket (security)
|
||||
|
||||
|
||||
@@ -25,12 +25,15 @@
|
||||
boot.loader.grub.enable = false;
|
||||
boot.loader.generic-extlinux-compatible.enable = true;
|
||||
|
||||
# Remote administration: the daemon, port 22 and key-only policy all come from
|
||||
# ../../modules/ssh.nix.
|
||||
# Remote administration. Key-only policy and the authorized key come from
|
||||
# ../../modules/ssh.nix; here we just enable the daemon and open the port.
|
||||
services.openssh.enable = true;
|
||||
|
||||
# Default-deny inbound; the Docker and nginx submodules open their own ports
|
||||
# (Docker via a source-restricted nftables rule, nginx via 80/443).
|
||||
# Default-deny inbound. Open only SSH here; the Docker and nginx submodules
|
||||
# open their own ports (Docker via a source-restricted nftables rule, nginx
|
||||
# via 80/443). List-valued, so these merge with the submodule definitions.
|
||||
networking.firewall.enable = true;
|
||||
networking.firewall.allowedTCPPorts = [ 22 ];
|
||||
|
||||
# See `man configuration.nix` / the stateVersion docs before changing.
|
||||
system.stateVersion = "26.05";
|
||||
|
||||
@@ -8,10 +8,6 @@
|
||||
# secure upgrade path is mutual TLS on 2376 (--tlsverify with client certs);
|
||||
# that needs out-of-band cert provisioning and is intentionally not wired here.
|
||||
{ ... }:
|
||||
let
|
||||
# LAN allowed to reach the unauthenticated Docker TCP socket (see SECURITY above).
|
||||
trustedSubnet = "10.187.1.0/24";
|
||||
in
|
||||
{
|
||||
virtualisation.docker.enable = true;
|
||||
|
||||
@@ -33,6 +29,6 @@ in
|
||||
# CIDR to match the LAN that should reach the Docker API.
|
||||
networking.nftables.enable = true;
|
||||
networking.firewall.extraInputRules = ''
|
||||
ip saddr ${trustedSubnet} tcp dport 2375 accept
|
||||
ip saddr 10.187.1.0/24 tcp dport 2375 accept
|
||||
'';
|
||||
}
|
||||
|
||||
@@ -35,7 +35,7 @@ change and `radeon` stays idle.
|
||||
## Login
|
||||
|
||||
Graphical login via a Wayland greeter — `greetd` running ReGreet inside the
|
||||
`cage` kiosk compositor — configured centrally in `../../modules/sway.nix` for
|
||||
`cage` kiosk compositor — configured centrally in `lyrathorpe/swaywm.nix` for
|
||||
every Sway host (gated on `features.swayDesktop.enable`). The greeter is forced
|
||||
to the Dvorak layout to match the console and Sway session. Set the user
|
||||
password (`passwd lyrathorpe`) after install, or the greeter cannot
|
||||
|
||||
@@ -21,8 +21,10 @@
|
||||
# Low-RAM host (4 GiB max): a compressed RAM swap reduces disk paging.
|
||||
zramSwap.enable = true;
|
||||
|
||||
# sshd (daemon, port 22, key-only policy) comes from ../../modules/ssh.nix;
|
||||
# the firewall itself is enabled in laptop.nix with a default-deny policy.
|
||||
# This host accepts SSH, so open 22 (the firewall itself is enabled in
|
||||
# laptop.nix with a default-deny policy).
|
||||
services.openssh.enable = true;
|
||||
networking.firewall.allowedTCPPorts = [ 22 ];
|
||||
|
||||
# Intel Core 2 (Penryn) microcode. Redistributable firmware (enabled in
|
||||
# workstation.nix) supplies the iwlwifi blobs (Intel WiFi Link 5100/5300) and
|
||||
|
||||
+6
-6
@@ -1,11 +1,11 @@
|
||||
# sshd for the hosts that run it (T400, Mac Pro, RPi5): enable the daemon, open
|
||||
# port 22, and apply a key-only policy. Authorized keys are owned per-user by the
|
||||
# registry (modules/users.nix), not here.
|
||||
# Key-only SSH hardening, imported by the hosts that run sshd (T400, Mac Pro,
|
||||
# RPi5). The host config still does `services.openssh.enable = true` and opens
|
||||
# port 22 next to where it documents the listening service; this module only
|
||||
# tightens the policy so a host opting into sshd cannot accidentally ship
|
||||
# password/root login. Authorized keys are owned per-user by the identity
|
||||
# registry (users/registry.nix, applied via modules/users.nix), not here.
|
||||
{ ... }:
|
||||
{
|
||||
services.openssh.enable = true;
|
||||
networking.firewall.allowedTCPPorts = [ 22 ];
|
||||
|
||||
services.openssh.settings = {
|
||||
PasswordAuthentication = false; # keys only
|
||||
KbdInteractiveAuthentication = false; # no keyboard-interactive fallback
|
||||
|
||||
+9
-3
@@ -1,5 +1,9 @@
|
||||
# System user accounts, built from the registry (users/registry.nix) for the
|
||||
# host's `hostUsers` set. See README "Users".
|
||||
# System-level user accounts, built from the identity registry
|
||||
# (users/registry.nix). `hostUsers` is the host's user set, threaded by mkHost
|
||||
# from the flake host table; `userRegistry` is the global identity table passed
|
||||
# as a specialArg. Every account's identity -- description, groups, authorized
|
||||
# keys -- comes from its registry entry, so no user data is hardcoded here and a
|
||||
# host may declare any number of users.
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
@@ -25,7 +29,9 @@
|
||||
openssh.authorizedKeys.keys = id.sshAuthorizedKeys;
|
||||
shell = pkgs.zsh;
|
||||
}
|
||||
# linger opt-in (host table); left unmanaged when unset.
|
||||
# Keep this user's systemd --user instance running without an open login
|
||||
# session (e.g. for home-manager user timers). Only emitted when the host
|
||||
# table opts in, so hosts that don't set it leave linger entirely unmanaged.
|
||||
// lib.optionalAttrs (spec ? linger) { inherit (spec) linger; }
|
||||
) hostUsers;
|
||||
|
||||
|
||||
@@ -1,11 +1,8 @@
|
||||
# Work (EDaaS/WSL) home profile: corporate toolchain + tmux tweaks. Git identity
|
||||
# comes from the registry (users/registry.nix), not here.
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
inputs,
|
||||
...
|
||||
}:
|
||||
# Home-manager module for the work (EDaaS/WSL) profile: corporate work toolchain
|
||||
# packages and tmux tweaks. Imported only by the work host. The corporate git
|
||||
# identity (email + signing key) is the emmathorpe entry in the identity
|
||||
# registry (users/registry.nix), applied by the shared home/git.nix.
|
||||
{ pkgs, lib, ... }:
|
||||
|
||||
{
|
||||
# Host-scoped extras for this machine only (the EDaaS/WSL host).
|
||||
@@ -29,6 +26,7 @@
|
||||
pkgs.powershell
|
||||
pkgs.nuget
|
||||
pkgs.gedit
|
||||
pkgs.lens
|
||||
pkgs.python3
|
||||
pkgs.gnumake
|
||||
pkgs.gcc
|
||||
@@ -52,10 +50,8 @@
|
||||
docker = "/run/current-system/sw/bin/docker";
|
||||
};
|
||||
programs.tmux = {
|
||||
# kube context/namespace in the status line. kube-tmux is pinned as a flake
|
||||
# input (it is not in nixpkgs), so the script is always present in the store.
|
||||
extraConfig = ''
|
||||
set -g status-right "#(${pkgs.bash}/bin/bash ${inputs.kube-tmux}/kube.tmux 250 red black)"
|
||||
set -g status-right "#(/run/current-system/sw/bin/bash $HOME/code/kube-tmux/kube.tmux 250 red black)"
|
||||
'';
|
||||
};
|
||||
programs.go = {
|
||||
|
||||
@@ -1,17 +0,0 @@
|
||||
# Lyra's personal home extras, imported on her hosts (not the work box). Keeps
|
||||
# personal data out of the shared home/ modules. See README "Users".
|
||||
{ pkgs, lib, ... }:
|
||||
{
|
||||
# Personal ssh host shortcut.
|
||||
programs.ssh.settings."dockerpi.inf.cbg.emmaisvery.gay" = {
|
||||
User = "emmathorpe";
|
||||
};
|
||||
|
||||
# Night-light location for gammastep (the service itself is enabled by
|
||||
# home/sway.nix on graphical hosts). Linux-guarded so Darwin, which imports
|
||||
# this module but has no gammastep, skips it.
|
||||
services.gammastep = lib.mkIf pkgs.stdenv.hostPlatform.isLinux {
|
||||
latitude = 51.5;
|
||||
longitude = -0.13;
|
||||
};
|
||||
}
|
||||
+15
-3
@@ -1,5 +1,14 @@
|
||||
# User identity registry -- pure data, keyed by username. See README "Users".
|
||||
# (`identity.username` is injected by mkHost, so it is not repeated here.)
|
||||
# User identity registry -- pure data, no machinery. Keyed by username.
|
||||
#
|
||||
# Each entry describes WHO a user is (display name, email, authorized/signing
|
||||
# keys, supplementary groups). The reusable modules read this indirectly:
|
||||
# - system: modules/users.nix builds users.users.* from `userRegistry`
|
||||
# (specialArg) restricted to the host's `hostUsers` set.
|
||||
# - home: home/git.nix and home/desktop.nix read the per-user `identity`
|
||||
# module arg, which mkHost derives from the matching registry entry.
|
||||
#
|
||||
# The login name is injected by mkHost as `identity.username`, so it is not
|
||||
# repeated inside each entry here.
|
||||
{
|
||||
lyrathorpe = {
|
||||
fullName = "Lyra Thorpe";
|
||||
@@ -21,7 +30,10 @@
|
||||
"wheel"
|
||||
"docker"
|
||||
];
|
||||
# No personal key on file yet; add one if SSH login as emmathorpe is wanted.
|
||||
# No personal authorized key on file yet. The previous shared user module
|
||||
# applied Lyra's key to every account, including this one -- a defect. Leave
|
||||
# this empty until a real key is provisioned; SSH login is moot on the WSL
|
||||
# host (entered via wsl.exe, not sshd).
|
||||
sshAuthorizedKeys = [ ];
|
||||
signingKey = "key::ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAJMVgeRKnfX1G8coU3nAobI485aeUpGTMqH7+zbKI8o emma.thorpe@cloud.com";
|
||||
};
|
||||
|
||||
Reference in New Issue
Block a user