fix(docs): reformat README module table to satisfy treefmt

The module-catalogue table in README.md was committed without prettier's alignment, so the treefmt formatting flake check fails. This has left CI (nix flake check) red on main since the #56 docs merge and blocks every PR that triggers the full check. Reformat with the flake's pinned formatter; no content change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Merge pull request 'docs: repo layout, module catalogue, host READMEs, stale-path fixes' (#56 ) from docs/audit-improvements into main
2026-07-10 11:10:02 +01:00 · 2026-07-06 15:37:28 +01:00 · 2026-07-06 15:27:03 +01:00 · 2026-07-06 15:27:02 +01:00 · 2026-07-06 15:27:02 +01:00 · 2026-07-06 15:27:01 +01:00
67 changed files with 1196 additions and 320 deletions
@@ -8,12 +8,6 @@ indent_size = 2
 trim_trailing_whitespace = true
 insert_final_newline = true
 [*.{nix,yaml,yml,json,md,sh,toml}]
 indent_style = space
 indent_size = 2
 trim_trailing_whitespace = true
 insert_final_newline = true
 # Markdown uses trailing whitespace for hard line breaks.
 [*.md]
 trim_trailing_whitespace = false
@@ -2,27 +2,58 @@
 # plus an explicit per-host evaluation pass for granular output.
 name: CI
 # Deliberately no `paths:` filter. This job is a required status check on main,
 # and a path-filtered workflow is *skipped* (never runs) for PRs that touch no
 # matching file -- which leaves the required check pending forever and blocks the
 # merge (e.g. a .renovaterc.json-only change). So the workflow always runs and
 # always reports. To avoid burning a full Nix evaluation on changes that can't
 # affect it, the "detect" step below diffs the PR and the heavy steps run only
 # when a .nix file, flake.lock, or this workflow changed; otherwise they skip and
 # the job still passes. The required check is therefore always green-reportable.
 on:
  push:
    branches: [main]
    paths:
      - "**.nix"
      - "flake.lock"
      - ".gitea/workflows/ci.yaml"
  pull_request:
    paths:
      - "**.nix"
      - "flake.lock"
      - ".gitea/workflows/ci.yaml"
 jobs:
  flake:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          # Full history so the detect step can diff the PR against its base.
          fetch-depth: 0
      # Decide whether the Nix steps need to run. On a pull_request, diff the PR
      # against its base and look for files that can affect the flake: any .nix,
      # the lockfile, or this workflow. On any other event (push to main) always
      # run. The job itself always succeeds, so the required status check is
      # reported even when the heavy steps are skipped.
      - name: Detect Nix-relevant changes
        id: detect
        run: |
          set -euo pipefail
          if [ "${{ github.event_name }}" != "pull_request" ]; then
            echo "Event ${{ github.event_name }}: running full checks."
            echo "run=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          base='${{ github.event.pull_request.base.sha }}'
          head='${{ github.event.pull_request.head.sha }}'
          changed=$(git diff --name-only "$base...$head")
          echo "Changed files:"
          echo "$changed"
          if echo "$changed" | grep -Eq '(\.nix$|^flake\.lock$|^\.gitea/workflows/ci\.yaml$)'; then
            echo "Nix-relevant changes found: running checks."
            echo "run=true" >> "$GITHUB_OUTPUT"
          else
            echo "No Nix-relevant changes: skipping checks (job still passes)."
            echo "run=false" >> "$GITHUB_OUTPUT"
          fi
      - name: Install Nix
        if: steps.detect.outputs.run == 'true'
        uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31
        with:
          extra_nix_config: |
@@ -34,6 +65,7 @@ jobs:
      # Runs every flake check: treefmt formatting, deadnix, statix, and the
      # pre-commit hooks (so a --no-verify commit can't ship unlinted).
      - name: Flake check
        if: steps.detect.outputs.run == 'true'
        run: nix flake check --print-build-logs
      # Evaluate (not build) each host's toplevel so eval errors fail CI cheaply.
@@ -44,6 +76,7 @@ jobs:
      # nixos/darwinConfigurations) rather than hard-coded, so adding or removing
      # a host needs no change to this workflow.
      - name: Evaluate NixOS host configurations
        if: steps.detect.outputs.run == 'true'
        run: |
          set -euo pipefail
          hosts=$(nix eval --raw '.#nixosConfigurations' \
@@ -56,6 +89,7 @@ jobs:
          done
      - name: Evaluate Darwin host configurations
        if: steps.detect.outputs.run == 'true'
        run: |
          set -euo pipefail
          hosts=$(nix eval --raw '.#darwinConfigurations' \
@@ -1,4 +1,7 @@
-system/modules/firmware/*
+modules/firmware/*
 # vim swap files
 *.swp
 # Local scratch project, not part of this flake.
 tf-inspect/
@@ -6,7 +6,8 @@
  },
  "lockFileMaintenance": {
    "enabled": true,
-    "schedule": ["before 6am on monday"]
+    "schedule": ["before 6am on monday"],
    "automerge": true
  },
  "git-submodules": {
    "enabled": false
@@ -8,19 +8,110 @@ single flake.
 Defined in the host table in [`flake.nix`](./flake.nix):
 | Configuration         | System           | Machine                                                                                                     |
-| --------------------- | ---------------- | --------------------------------------------------------------------------- |
+| --------------------- | ---------------- | ----------------------------------------------------------------------------------------------------------- |
 | `lyrathorpe-mbp`      | `aarch64-linux`  | MacBook Pro (Apple Silicon, Asahi)                                                                          |
-| `lyrathorpe-t400`     | `x86_64-linux`   | ThinkPad T400 — [install notes](./system/machine/T400/README.md)            |
+| `lyrathorpe-t400`     | `x86_64-linux`   | ThinkPad T400 — [install notes](./hosts/T400/README.md)                                                     |
-| `lyrathorpe-macpro31` | `x86_64-linux`   | Mac Pro 3,1, desktop — [install notes](./system/machine/MacPro31/README.md) |
+| `lyrathorpe-macpro31` | `x86_64-linux`   | Mac Pro 3,1, desktop — [install notes](./hosts/MacPro31/README.md)                                          |
-| `emmathorpe-edaas`    | `x86_64-linux`   | Work WSL box (NixOS-WSL)                                                    |
+| `emmathorpe-edaas`    | `x86_64-linux`   | Work WSL box (NixOS-WSL) — [notes](./hosts/EDaaS/README.md)                                                 |
-| `lyrathorpe-mac`      | `aarch64-darwin` | macOS (nix-darwin)                                                          |
+| `lyrathorpe-rpi5`     | `aarch64-linux`  | Raspberry Pi 5 headless server: Docker host + nginx reverse proxy — [install notes](./hosts/RPi5/README.md) |
 | `lyrathorpe-mac`      | `aarch64-darwin` | macOS (nix-darwin) — [notes](./hosts/Darwin/README.md)                                                      |
-Shared layers: `lyrathorpe/home` (home-manager: shell, git, editor),
+Shared layers: `home` (home-manager: shell, git, editor),
-`system/modules/common-nixos.nix` (all NixOS hosts: fonts, nix-ld, caches),
+`modules/common-nixos.nix` (all NixOS hosts: fonts, nix-ld, caches),
-`system/modules/workstation.nix` (physical graphical hosts: audio, thermald,
+`modules/workstation.nix` (physical graphical hosts: audio, thermald,
-earlyoom, fwupd), `system/modules/laptop.nix` (laptops: Wi-Fi, Bluetooth, power,
+earlyoom, fwupd), `modules/laptop.nix` (laptops: Wi-Fi, Bluetooth, power,
-lid), and `system/modules/ssh.nix` (key-only sshd). The x86 hosts also pull
+lid), `modules/desktop.nix` (wired desktops: NetworkManager), and
-`nixos-hardware` profiles.
+`modules/ssh.nix` (key-only sshd). The x86 hosts also pull `nixos-hardware`
 profiles. The full module catalogue is below.
 ## Repository layout
 ```
 flake.nix              # inputs, mkHost/mkDarwinHost, the host tables, dev shell + checks
 flake.lock             # pinned input revisions (Renovate keeps this fresh)
 modules/               # reusable NixOS system modules (see "Module catalogue")
 home/                  # home-manager profile: shell, git, editor, claude, desktop, sway
 users/                 # identity registry + per-user home extras (see "Users")
 hosts/<Name>/          # per-machine config: configuration.nix + hardware-configuration.nix
 lib/                   # small pure helpers (currently the Catppuccin Mocha palette)
 .gitea/workflows/      # CI (nix flake check + per-host eval)
 statix.toml            # lint config (house-style lints disabled)
 .editorconfig          # base whitespace style
 tf-inspect/            # UNRELATED scratch project (gitignored, its own git repo);
                       #   RouterOS / home-services Terraform, not part of this flake
 ```
 Each `nixosConfiguration` / `darwinConfiguration` is assembled in `flake.nix`
 from three layers: the shared `baseModules` (or `darwinBaseModules`), the
 per-form-factor and `nixos-hardware` modules listed in the host table, and the
 per-machine `hosts/<Name>/configuration.nix`. Home-manager is wired in as a
 system module; each user's home is composed from the `homeModules` list in that
 host's table entry.
 ## Module catalogue
 Reusable NixOS modules under [`modules/`](./modules). "Imported by" says how a
 module reaches a host: **baseModules** (every NixOS host, via `flake.nix`),
 **host table** (listed explicitly per host in `flake.nix`), or **transitively**
 (pulled in by another module's `imports`).
 | Module             | Imported by                       | What it does / when to use it                                                                                                                                                                             |
 | ------------------ | --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `common-nixos.nix` | baseModules (all NixOS)           | Timezone/locale, store hygiene (auto-optimise, big download buffer, **no** auto-GC), the nix-community binary cache, `nix-ld`, base CLI (`git`, `fastfetch`), and the fleet-wide font stack.              |
 | `users.nix`        | baseModules (all NixOS)           | Builds `users.users` from the registry for the host's `hostUsers`; enables zsh; enables Firefox + Thunderbird **only** when `features.swayDesktop.enable` is on. Applies per-user `linger`.               |
 | `features.nix`     | baseModules (all NixOS)           | Declares feature-flag options (currently `features.swayDesktop.enable`) so any host can read/set them without importing the heavy implementation module.                                                  |
 | `workstation.nix`  | transitively (via laptop/desktop) | Form-factor-agnostic base for physical graphical hosts: turns on `swayDesktop`, Dvorak console, PipeWire, firewall (default-deny), fstrim, earlyoom, fwupd, thermald (x86), redistributable fw.           |
 | `laptop.nix`       | host table (MBP, T400)            | `imports` workstation.nix, then adds the portable bits: iwd Wi-Fi, lid suspend/lock, Bluetooth + blueman.                                                                                                 |
 | `desktop.nix`      | host table (Mac Pro)              | `imports` workstation.nix, then swaps Wi-Fi for wired NetworkManager. Pair with `portable = false` in the host table.                                                                                     |
 | `sway.nix`         | host table (graphical hosts)      | Implementation of `features.swayDesktop`: the system Sway package, the greetd/ReGreet (cage) greeter forced to Dvorak, xdg-portal, Wayland utility packages. Home-side Sway config is in `home/sway.nix`. |
 | `ssh.nix`          | host table (T400, Mac Pro, RPi5)  | Enables sshd, opens port 22, enforces a key-only policy (no password / keyboard-interactive, no root). Authorized keys come from the registry via `users.nix`.                                            |
 | `firmware/`        | referenced by MBP host config     | Committed Apple peripheral firmware blobs for the Asahi MBP (see "MacBook (Asahi) firmware").                                                                                                             |
 Form-factor decision: a **laptop** imports `laptop.nix` (default
 `portable = true`); a **wired desktop** imports `desktop.nix` and sets
 `portable = false`; a **headless server** imports neither (leaves
 `features.swayDesktop.enable` at its default `false`) and adds only what it
 serves. `portable` is threaded through to `home/sway.nix`, which drops the
 battery block and brightness keys on desktops.
 ## Users
 Identity is data, kept separate from the reusable modules:
 - [`users/registry.nix`](./users/registry.nix) — one entry per user (display
  name, email, supplementary groups, authorized + signing keys). This is the
  single source of identity; no user data is hardcoded in the modules.
 - Each host's table entry declares a `users` set keyed by username; every entry
  lists that user's home-module composition (the shared `./home` bundle plus any
  per-user modules, e.g. [`users/emmathorpe/work.nix`](./users/emmathorpe/work.nix))
  and optional per-host-user system bits such as `linger`.
 - `mkHost` builds each account from the registry and injects the matching
  identity into that user's home config as the `identity` module arg. A host can
  therefore declare any number of users.
 Per-user home extras live under `users/<name>/`:
 - [`users/lyrathorpe/home.nix`](./users/lyrathorpe/home.nix) — personal extras
  (an ssh host shortcut, gammastep coordinates); imported on Lyra's hosts.
 - [`users/emmathorpe/work.nix`](./users/emmathorpe/work.nix) — the work
  toolchain (kubectl/helm/az/etc.), work-only LSP servers, and the corporate ssh
  handling; imports
  [`users/emmathorpe/renovate-review.nix`](./users/emmathorpe/renovate-review.nix),
  the daily headless Renovate-PR review timer (EDaaS only).
 ### Portable home (off-NixOS / external consumers)
 The home config is also exposed for use beyond these hosts:
 - `homeConfigurations."<user>@<system>"` — a standalone home-manager profile
  (the portable subset: shell + git + editor + claude) that can be activated on a
  machine this flake does **not** manage:
  `home-manager switch --flake .#"lyrathorpe@x86_64-linux"`. The desktop/sway
  modules are intentionally excluded (they rely on a NixOS-provided Sway/Firefox
  binary).
 - `homeModules` — the reusable modules exported so another flake can import them
  (`inputs.<this>.homeModules.default`). Consumers must supply the module args
  these expect: `inputs` always, `identity` for git/desktop, `portable` for sway.
 ## Applying
@@ -31,26 +122,58 @@ sudo nixos-rebuild switch --flake .#<configuration>
 darwin-rebuild switch --flake .#lyrathorpe-mac
 ```
 On a host whose `networking.hostName` matches its flake attribute (the WSL box
 and the Pi are set up this way), `nh os switch` resolves the configuration from
 the hostname with no `--flake`/`-H` flag.
 ## Adding a new host
 1. **Create `hosts/<Name>/`.** Add `configuration.nix` with the host-specific
   bits only: `networking.hostName`, bootloader (firmware-specific — it is
   deliberately not set in the shared modules), and any per-machine hardware
   quirks. Keep anything reusable in `modules/` instead.
 2. **Hardware config.** Generate `hardware-configuration.nix` on the real
   machine with `nixos-generate-config` and commit it. If the machine does not
   exist yet, commit a clearly-labelled placeholder so the host still evaluates
   in CI (see the existing T400 / RPi5 placeholders), and replace it at install.
   These files are excluded from the formatter and linters.
 3. **Add a host-table entry in `flake.nix`.** Under `hosts` (NixOS) or
   `darwinHosts` (macOS), set `system`, the `modules` list (host config + form
   factor + any `nixos-hardware` profiles), and the `users` map (each user's
   `homeModules`). Choose the form factor per the decision note above; a headless
   host imports neither `laptop.nix` nor `desktop.nix`.
 4. **Users.** If the host introduces a new person, add them to
   `users/registry.nix` first; otherwise reference an existing username.
 5. **Verify.** `nix flake check` formats, lints, and evaluates every host —
   including the new one — so a broken entry fails locally before CI. Then
   `sudo nixos-rebuild switch --flake .#<configuration>` on the machine.
 No change to CI is needed: the host-eval step discovers hosts from the flake
 (`attrNames` of the configuration sets), so a new entry is picked up
 automatically.
 ## Shell environment & keybindings
 - Interactive shell features (zsh, tmux, git, ssh, CLI tools, auto-tmux):
-  [`lyrathorpe/home/README.md`](./lyrathorpe/home/README.md).
+  [`home/README.md`](./home/README.md).
 - All Sway / tmux / foot / zsh keyboard shortcuts:
-  [`lyrathorpe/home/KEYBINDINGS.md`](./lyrathorpe/home/KEYBINDINGS.md).
+  [`home/KEYBINDINGS.md`](./home/KEYBINDINGS.md).
 ## Login / greeter
 Graphical (Sway) hosts log in through a Wayland greeter — `greetd` running
-ReGreet inside the `cage` kiosk compositor — configured centrally in
+ReGreet inside the `cage` kiosk compositor — implemented in
-[`lyrathorpe/swaywm.nix`](./lyrathorpe/swaywm.nix), gated on
+[`modules/sway.nix`](./modules/sway.nix), gated on
-`features.swayDesktop.enable`. The greeter is forced to Dvorak to match the
+`features.swayDesktop.enable` (the option is declared in
-console and Sway session. Hosts with `features.swayDesktop.enable = false` (the
+[`modules/features.nix`](./modules/features.nix), so headless hosts
-WSL work box) keep plain TTY login. The target account needs a password
+can leave it off without importing `modules/sway.nix`). The greeter is forced to Dvorak
 to match the console and Sway session. Headless hosts (the WSL work box and the
 Raspberry Pi server) keep plain TTY login. The target account needs a password
 (`passwd <user>`) before it can log in.
 ## MacBook (Asahi) firmware
-The MBP host references `system/modules/firmware/` for Apple peripheral
+The MBP host references `modules/firmware/` for Apple peripheral
 firmware (Wi-Fi/Bluetooth). These blobs are **committed** (tracked) even though
 `.gitignore` lists the directory: the flake is `git+file`, so it only sees
 tracked files — untracking them breaks `lyrathorpe-mbp` evaluation (and the CI
@@ -60,7 +183,7 @@ redistributable; the repo is private.
 To refresh them, copy the firmware extracted during the Asahi install (from
 `/etc/nixos/firmware`, or re-extract per the
 [Asahi NixOS docs](https://github.com/tpwrules/nixos-apple-silicon)) into
-`system/modules/firmware/` and commit with `git add -f`.
+`modules/firmware/` and commit with `git add -f`.
 ## Development
@@ -79,4 +202,7 @@ A dev shell and a formatting/lint gate are wired through the flake:
 [`.gitea/workflows/ci.yaml`](./.gitea/workflows/ci.yaml) runs `nix flake check`
 (formatting, `deadnix`, `statix`, the pre-commit hooks) and evaluates every
-NixOS and Darwin host configuration on push/PR.
+NixOS and Darwin host configuration on push/PR. It always runs (no `paths:`
 filter) so the required check never hangs pending; the heavy Nix steps are
 skipped when a PR touches no `.nix`/lockfile/workflow file, and the job still
 reports green.
@@ -3,16 +3,16 @@
    "brew-src": {
      "flake": false,
      "locked": {
-        "lastModified": 1779646357,
+        "lastModified": 1781226006,
-        "narHash": "sha256-rnnAaESXxItX4D9xCMGvs3hfDBjbbTYht7OluRcvT8k=",
+        "narHash": "sha256-w4ZTuOnhYiDxjaynrMTASzp802QblBWmo3wpB8wVN4Y=",
        "owner": "Homebrew",
        "repo": "brew",
-        "rev": "10a163ac127624caa80cc5cc5a705e97f3615b0e",
+        "rev": "109191be4988470b51a60a5ef1998520aa24c01b",
        "type": "github"
      },
      "original": {
        "owner": "Homebrew",
-        "ref": "5.1.14",
+        "ref": "6.0.1",
        "repo": "brew",
        "type": "github"
      }
@@ -25,11 +25,11 @@
      },
      "locked": {
        "dir": "pkgs/firefox-addons",
-        "lastModified": 1780977789,
+        "lastModified": 1782014564,
-        "narHash": "sha256-UFJfQlvInbsVaTK5XC2lafdqWlwiNP5LuQFYfDKq6Dc=",
+        "narHash": "sha256-F/royQHyJAyKWKrV8AaG4Yf1yjzxa+PFk5xvTdvBrzk=",
        "owner": "rycee",
        "repo": "nur-expressions",
-        "rev": "0b627f105ea3baa2fa10308a6a67a8f8cbbb3e2a",
+        "rev": "d6668e34bbce788459883a1097bf0ee170f49c61",
        "type": "gitlab"
      },
      "original": {
@@ -136,11 +136,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1778507602,
+        "lastModified": 1781733627,
-        "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=",
+        "narHash": "sha256-U3yTuGBnmXvXoQI3qkpfEDsn9RovQPAjN7ndRco+3u0=",
        "owner": "cachix",
        "repo": "git-hooks.nix",
-        "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a",
+        "rev": "3bbec39bc90eadfa031e6f3b77272f3f60803e39",
        "type": "github"
      },
      "original": {
@@ -177,11 +177,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1780361225,
+        "lastModified": 1781981105,
-        "narHash": "sha256-wnV9ttf4fPWNonBIQmvlrSlNpQYgx5HgWWd007mwIFA=",
+        "narHash": "sha256-/1nNBbA7PrSQpTc9Qazkhl4kIPg+TNl0CjxS3UQJKlw=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "e28654b71096e08c019d4861ca26acb646f583d8",
+        "rev": "7bfff44b465909f69a442701293bc0badcf476dc",
        "type": "github"
      },
      "original": {
@@ -191,6 +191,22 @@
        "type": "github"
      }
    },
    "kube-tmux": {
      "flake": false,
      "locked": {
        "lastModified": 1779714285,
        "narHash": "sha256-l1wjg2ReWKCI7h/K11vvX2ykYTs/mVD+tfz/mQsjn/E=",
        "owner": "jonmosco",
        "repo": "kube-tmux",
        "rev": "8b7e1d127c16b6dc87ff5743f4d775b245198b69",
        "type": "github"
      },
      "original": {
        "owner": "jonmosco",
        "repo": "kube-tmux",
        "type": "github"
      }
    },
    "nix-darwin": {
      "inputs": {
        "nixpkgs": [
@@ -198,11 +214,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1780789116,
+        "lastModified": 1781772065,
-        "narHash": "sha256-+/LcDMJGYQVLp3ECZ1jBhj3GcQU+Yt+OTsDsQFz8cMs=",
+        "narHash": "sha256-xIbRSwDB1GBAUsWsQZUjudGfAGQt3BOpsWaO/ugVa4w=",
        "owner": "nix-darwin",
        "repo": "nix-darwin",
-        "rev": "731951a251ca96cbd12a8e1bde63737e21947644",
+        "rev": "adda04f0bf4819575b1978c2f8d78401b3c2be12",
        "type": "github"
      },
      "original": {
@@ -217,11 +233,11 @@
        "brew-src": "brew-src"
      },
      "locked": {
-        "lastModified": 1780492467,
+        "lastModified": 1781389246,
-        "narHash": "sha256-zMEJwtQPmsPPgPczFkyjWHgd1z0HagOPS2Wt2WDYLJY=",
+        "narHash": "sha256-ORqLAo/hoJdsZC7UPAuEHev6S0+XIqKEC7vjo5prz1k=",
        "owner": "zhaofengli",
        "repo": "nix-homebrew",
-        "rev": "562332f97de9f5ba51aa647d70462e88222b2988",
+        "rev": "de7953a08ed4bb9245be043e468561c17b89130d",
        "type": "github"
      },
      "original": {
@@ -237,11 +253,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1780816331,
+        "lastModified": 1782030356,
-        "narHash": "sha256-0BYqs8yKWkOz2Q7+SP18N5E5gmDKSo6LSxIVIa0wWes=",
+        "narHash": "sha256-h4WpMr455AfRub0FXBaon6Vcpe0waUyJ4GivIW6oyd4=",
        "owner": "nix-community",
        "repo": "nix-index-database",
-        "rev": "1a2ea89c917781e88508d9fd2b507f2d2a0e173c",
+        "rev": "3017088b49efd404f78e3b104f553b97e4af786b",
        "type": "github"
      },
      "original": {
@@ -258,11 +274,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1780669925,
+        "lastModified": 1781520503,
-        "narHash": "sha256-inOQx/s7GQjh9bcCjCHXAeX0EHX+sOQUBoo8+bs48ME=",
+        "narHash": "sha256-XuqQQG1qRyc3o8ld937sDLQNx+QrGV852KJ0dNglJDg=",
        "owner": "nix-community",
        "repo": "nixos-apple-silicon",
-        "rev": "5880026520a3fd248d59e1c81c4e4e111aefc6af",
+        "rev": "43043ad207529650f9fa68e1705f7cf9c08bfdeb",
        "type": "github"
      },
      "original": {
@@ -278,11 +294,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1781020964,
+        "lastModified": 1781622756,
-        "narHash": "sha256-fS7xTi2j2iso5Hj7RNZLv/acDlCT+fgMVkVk40A7Uco=",
+        "narHash": "sha256-JrPh4M6S7aPsEE9tOENuZrxC6o2szSLlK+t4+nLke9s=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "32c2cd9e46286c4eced3dc6b613c659126bf3cca",
+        "rev": "08018c72174a4df5657f8d94178ac69fb9c243e5",
        "type": "github"
      },
      "original": {
@@ -299,11 +315,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1780765279,
+        "lastModified": 1781182279,
-        "narHash": "sha256-md6QHmlIx40bQkun43M2eT8aav5GURGkXEMFwof6uZs=",
+        "narHash": "sha256-V5EQQbDnmdiXGQXrEF1PEL7QYsFqfH8N1E89Z5ONwFk=",
        "owner": "nix-community",
        "repo": "NixOS-WSL",
-        "rev": "3e6d8af994e2a2d31af7a91863d7c0d6e278d951",
+        "rev": "5675822ba756e6e56f8f6a5a76e90e0da2ece94d",
        "type": "github"
      },
      "original": {
@@ -314,11 +330,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1780734595,
+        "lastModified": 1781216227,
-        "narHash": "sha256-DmTfP92QFYRLOGXlMIE54MAgxSJjDWocl3gRNOu72Os=",
+        "narHash": "sha256-9mUW6gNwoN2SWc/l0fW4svPNOulXLl8ijqKyeSOGgJE=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "9b696460ac78b5ccfc17c854d8c976f20456e943",
+        "rev": "a0374025a863d007d98e3297f6aa46cc3141c2f0",
        "type": "github"
      },
      "original": {
@@ -330,11 +346,11 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1780243769,
+        "lastModified": 1781577229,
-        "narHash": "sha256-x5UQuRsH3MqI0U9afaXSNqzTPSeZlRLvFAav2Ux1pNw=",
+        "narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "331800de5053fcebacf6813adb5db9c9dca22a0c",
+        "rev": "567a49d1913ce81ac6e9582e3553dd90a955875f",
        "type": "github"
      },
      "original": {
@@ -353,11 +369,11 @@
        "systems": "systems"
      },
      "locked": {
-        "lastModified": 1781038653,
+        "lastModified": 1781971008,
-        "narHash": "sha256-MxUVyE7A5QMJXOEFQhOHsqs4UPhujeDgdFhguE7Wmic=",
+        "narHash": "sha256-T2u2RQZWKvD1J+TgcxjiJr8IymBr/PrUNeAGhMZFZU4=",
        "owner": "nix-community",
        "repo": "nixvim",
-        "rev": "e7ce6708cc5b6275406a8feee06ca50c5cafd6bf",
+        "rev": "7afca458f064f166d3a9c98db3b41a984fe46492",
        "type": "github"
      },
      "original": {
@@ -373,6 +389,7 @@
        "flake-parts": "flake-parts",
        "git-hooks": "git-hooks",
        "home-manager": "home-manager",
        "kube-tmux": "kube-tmux",
        "nix-darwin": "nix-darwin",
        "nix-homebrew": "nix-homebrew",
        "nix-index-database": "nix-index-database",
@@ -23,7 +23,7 @@
    # Provides mkFlake: the systems/perSystem scaffolding used below.
    flake-parts.url = "github:hercules-ci/flake-parts";
    flake-parts.inputs.nixpkgs-lib.follows = "nixpkgs";
-    # Declarative Firefox add-ons (e.g. the Catppuccin theme); see lyrathorpe/user.nix.
+    # Declarative Firefox add-ons (e.g. the Catppuccin theme); see modules/users.nix.
    firefox-addons = {
      url = "gitlab:rycee/nur-expressions?dir=pkgs/firefox-addons";
      inputs.nixpkgs.follows = "nixpkgs";
@@ -46,7 +46,7 @@
      url = "github:cachix/git-hooks.nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
-    # Declarative Neovim (the editor; see lyrathorpe/home/editor.nix). Release
+    # Declarative Neovim (the editor; see home/editor.nix). Release
    # branch matched to the pinned nixpkgs (26.05); follows our nixpkgs to keep a
    # single nixpkgs in the closure. editor.nix sets programs.nixvim.nixpkgs.source
    # to this same input so the home module doesn't warn about the pin.
@@ -60,6 +60,13 @@
      url = "github:NixOS/nixos-hardware";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    # kube-tmux: kube context/namespace for the tmux status line on the work
    # host. Not in nixpkgs and not a flake -- pinned here as a plain source so
    # the script is always in the store (no manual checkout). See work.nix.
    kube-tmux = {
      url = "github:jonmosco/kube-tmux";
      flake = false;
    };
  };
  outputs =
@@ -93,10 +100,11 @@
        # Unfree packages permitted to be built (replaces blanket allowUnfree).
        unfreePackages = [
          "claude-code"
          "lens"
          "lens-desktop"
        ];
        # Per-user identity, keyed by username. See README "Users".
        userRegistry = import ./users/registry.nix;
        # nixpkgs + nix-daemon settings shared by NixOS and Darwin hosts.
        commonModule = {
          nixpkgs.overlays = overlays;
@@ -112,8 +120,9 @@
        # Shared scaffolding for every NixOS host: common user, settings, home-manager.
        baseModules = [
-          ./lyrathorpe/user.nix
+          ./modules/users.nix
-          ./system/modules/common-nixos.nix
+          ./modules/common-nixos.nix
          ./modules/features.nix
          commonModule
          home-manager.nixosModules.home-manager
          {
@@ -125,18 +134,13 @@
          }
        ];
-        # mkHost :: { system, username, fullName, modules, homeModules } -> nixosSystem
+        # Build one NixOS host. `users` is an attrset keyed by username (home
-        # Builds one machine by appending its host-specific modules to the shared
+        # modules + optional per-user system bits). See README "Users".
        # baseModules. The user identity (username/fullName) is threaded through
        # specialArgs so user.nix and the home modules stay host-agnostic, and the
        # home-manager profile is keyed by the host's username.
        mkHost =
          {
            system,
            username,
            fullName,
            modules,
-            homeModules,
+            users,
            # Host form factor. Laptops inherit the default; a desktop host sets
            # `portable = false` to drop mobile components (battery block,
            # brightness keys) from the home-manager Sway config.
@@ -147,8 +151,7 @@
            specialArgs = {
              inherit
                inputs
-                username
+                userRegistry
                fullName
                portable
                ;
            };
@@ -156,16 +159,15 @@
              baseModules
              ++ modules
              ++ [
                { _module.args.hostUsers = users; }
                {
-                  home-manager.extraSpecialArgs = {
+                  home-manager.extraSpecialArgs = { inherit inputs portable; };
-                    inherit
+                  home-manager.users = lib.mapAttrs (name: spec: {
-                      inputs
+                    imports = spec.homeModules;
-                      username
+                    _module.args.identity = userRegistry.${name} // {
-                      fullName
+                      username = name;
                      portable
                      ;
                    };
-                  home-manager.users.${username}.imports = homeModules;
+                  }) users;
                }
              ];
          };
@@ -184,19 +186,17 @@
          }
        ];
-        # mkDarwinHost :: { system, username, fullName, modules, homeModules } -> darwinSystem
+        # Darwin counterpart of mkHost: single-user (macOS owns the account),
-        # Darwin counterpart of mkHost. macOS already owns the login user, so we
+        # identity still from the registry. See README "Users".
        # only attach the platform and home-manager; no NixOS user module here.
        mkDarwinHost =
          {
            system,
            username,
            fullName,
            modules,
            homeModules,
          }:
          nix-darwin.lib.darwinSystem {
-            specialArgs = { inherit inputs username fullName; };
+            specialArgs = { inherit inputs username; };
            modules =
              darwinBaseModules
              ++ modules
@@ -205,40 +205,41 @@
                  nixpkgs.hostPlatform = system;
                  # macOS owns the account; point home-manager at its home dir.
                  users.users.${username}.home = "/Users/${username}";
-                  home-manager.extraSpecialArgs = { inherit inputs username fullName; };
+                  home-manager.extraSpecialArgs = { inherit inputs; };
-                  home-manager.users.${username}.imports = homeModules;
+                  home-manager.users.${username} = {
                    imports = homeModules;
                    _module.args.identity = userRegistry.${username} // {
                      inherit username;
                    };
                  };
                }
              ];
          };
-        # Host table — declarative registry of every machine. To add a host:
+        # Host table — one entry per machine, realised into a nixosConfiguration
-        # give it a name, its `system`, the owning user, and the module lists.
+        # of the same name below. See README "Hosts" / "Users".
        # mapAttrs below turns each entry into a nixosConfiguration of the same name.
        hosts = {
          lyrathorpe-mbp = {
            system = "aarch64-linux";
            username = "lyrathorpe";
            fullName = "Lyra Thorpe";
            modules = [
-              ./system/machine/MBP-Asahi/configuration.nix
+              ./hosts/MBP-Asahi/configuration.nix
-              ./system/modules/laptop.nix
+              ./modules/laptop.nix
              nixos-apple-silicon.nixosModules.default
-              ./lyrathorpe/swaywm.nix
+              ./modules/sway.nix
            ];
-            homeModules = [
+            users.lyrathorpe.homeModules = [
-              ./lyrathorpe/home
+              ./home
-              ./lyrathorpe/home/desktop.nix
+              ./users/lyrathorpe/home.nix
              ./home/desktop.nix
            ];
          };
          lyrathorpe-t400 = {
            system = "x86_64-linux";
            username = "lyrathorpe";
            fullName = "Lyra Thorpe";
            modules = [
-              ./system/machine/T400/configuration.nix
+              ./hosts/T400/configuration.nix
-              ./system/modules/laptop.nix
+              ./modules/laptop.nix
-              ./system/modules/ssh.nix
+              ./modules/ssh.nix
              # No t400-specific profile exists; compose the generic ThinkPad +
              # laptop/SSD/Intel building blocks (tp_smapi/acpi_call for battery
              # thresholds, SSD + microcode defaults).
@@ -246,62 +247,82 @@
              inputs.nixos-hardware.nixosModules.common-pc-laptop
              inputs.nixos-hardware.nixosModules.common-pc-laptop-ssd
              inputs.nixos-hardware.nixosModules.common-cpu-intel
-              ./lyrathorpe/swaywm.nix
+              ./modules/sway.nix
            ];
-            homeModules = [
+            users.lyrathorpe.homeModules = [
-              ./lyrathorpe/home
+              ./home
-              ./lyrathorpe/home/desktop.nix
+              ./users/lyrathorpe/home.nix
              ./home/desktop.nix
            ];
          };
          lyrathorpe-macpro31 = {
            system = "x86_64-linux";
            username = "lyrathorpe";
            fullName = "Lyra Thorpe";
            portable = false;
            modules = [
-              ./system/machine/MacPro31/configuration.nix
+              ./hosts/MacPro31/configuration.nix
-              ./system/modules/desktop.nix
+              ./modules/desktop.nix
-              ./system/modules/ssh.nix
+              ./modules/ssh.nix
              inputs.nixos-hardware.nixosModules.common-pc-ssd
              inputs.nixos-hardware.nixosModules.common-cpu-intel
-              ./lyrathorpe/swaywm.nix
+              ./modules/sway.nix
            ];
-            homeModules = [
+            users.lyrathorpe.homeModules = [
-              ./lyrathorpe/home
+              ./home
-              ./lyrathorpe/home/desktop.nix
+              ./users/lyrathorpe/home.nix
              ./home/desktop.nix
            ];
          };
          emmathorpe-edaas = {
            system = "x86_64-linux";
            username = "emmathorpe";
            fullName = "Emma Thorpe";
            modules = [
-              ./system/machine/EDaaS/configuration.nix
+              ./hosts/EDaaS/configuration.nix
              nixos-wsl.nixosModules.default
-              ./lyrathorpe/swaywm.nix
+              ./modules/sway.nix
            ];
            users.emmathorpe = {
              homeModules = [
-              ./lyrathorpe/home
+                ./home
-              ./lyrathorpe/home/work.nix
+                ./users/emmathorpe/work.nix
              ];
              # Keep the systemd --user instance alive without a login session so
              # the renovate-review home timer fires on schedule.
              linger = true;
            };
          };
          lyrathorpe-rpi5 = {
            system = "aarch64-linux";
            portable = false;
            # Headless server: Docker host + nginx reverse proxy. No sway.nix
            # (no desktop); the raspberry-pi-5 profile supplies kernel/firmware,
            # ssh.nix adds key-only sshd.
            modules = [
              ./hosts/RPi5/configuration.nix
              inputs.nixos-hardware.nixosModules.raspberry-pi-5
              ./modules/ssh.nix
            ];
            users.lyrathorpe.homeModules = [
              ./home
              ./users/lyrathorpe/home.nix
            ];
          };
        };
        # Darwin host table — macOS machines built via mkDarwinHost. The shared
-        # ./lyrathorpe/home modules (shell, git, editor) are reused; the Linux-only
+        # ./home bundle (shell, git, editor) is reused directly; the Linux-only
        # desktop/sway modules are intentionally left out.
        darwinHosts = {
          lyrathorpe-mac = {
            system = "aarch64-darwin";
            username = "lyrathorpe";
            fullName = "Lyra Thorpe";
            modules = [
-              ./system/machine/Darwin/configuration.nix
+              ./hosts/Darwin/configuration.nix
            ];
            homeModules = [
-              ./lyrathorpe/home
+              ./home
              ./users/lyrathorpe/home.nix
            ];
          };
        };
@@ -392,6 +413,59 @@
        # Realise the host tables: each entry becomes a {nixos,darwin}Configuration.
        flake.nixosConfigurations = lib.mapAttrs (_name: mkHost) hosts;
        flake.darwinConfigurations = lib.mapAttrs (_name: mkDarwinHost) darwinHosts;
        # Reusable home modules, exported for use off these hosts. See README
        # "Portable home" for the consumer module-arg expectations.
        flake.homeModules = {
          default = ./home;
          shell = ./home/shell.nix;
          git = ./home/git.nix;
          editor = ./home/editor.nix;
          claude = ./home/claude.nix;
          desktop = ./home/desktop.nix;
          sway = ./home/sway.nix;
        };
        # Standalone home-manager configs (portable bundle) for machines not
        # managed by this flake. See README "Portable home".
        flake.homeConfigurations =
          let
            mkHome =
              {
                system,
                name,
              }:
              home-manager.lib.homeManagerConfiguration {
                pkgs = import nixpkgs {
                  inherit system overlays;
                  config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) unfreePackages;
                };
                extraSpecialArgs = {
                  inherit inputs;
                  portable = true;
                  identity = userRegistry.${name} // {
                    username = name;
                  };
                };
                modules = [
                  ./home
                  {
                    home.username = name;
                    home.homeDirectory = "/home/${name}";
                  }
                ];
              };
          in
          {
            "lyrathorpe@x86_64-linux" = mkHome {
              system = "x86_64-linux";
              name = "lyrathorpe";
            };
            "lyrathorpe@aarch64-linux" = mkHome {
              system = "aarch64-linux";
              name = "lyrathorpe";
            };
          };
      }
    );
 }
@@ -188,10 +188,22 @@ across vim splits and tmux panes seamlessly. Everything else is stock vim, plus:
 | `<leader>rn`           | Rename symbol (LSP; `<leader>` is `Space`)                |
 | `<leader>ca`           | Code action (LSP)                                         |
-LSP covers Nix, Lua, Python and Terraform (the work box adds C# and Helm);
+### Completion menu (nvim-cmp)
-completion (nvim-cmp) appears as you type. Files are formatted on save
+
-(conform-nvim). `:Git` opens fugitive; gitsigns shows gutter signs. which-key
+Active only while the completion popup is open (it appears as you type, e.g.
-pops up after `<leader>` to show the rest.
+file paths):
 | Shortcut                | Action                                                             |
 | ----------------------- | ------------------------------------------------------------------ |
 | `Tab` / `Shift`+`Tab`   | Select next / previous item                                        |
 | `Ctrl`+`n` / `Ctrl`+`p` | Select next / previous item                                        |
 | `Ctrl`+`Space`          | Open the completion menu                                           |
 | `Enter`                 | Confirm the highlighted item (no auto-select; otherwise a newline) |
 | `Ctrl`+`e`              | Dismiss the menu                                                   |
 LSP covers Nix, Lua, Python and Terraform (the work box adds C# and Helm).
 Files are formatted on save (conform-nvim). `:Git` opens fugitive; gitsigns
 shows gutter signs. which-key pops up after `<leader>` to show the rest.
 ---
@@ -15,8 +15,10 @@ Keyboard shortcuts have their own reference: [`KEYBINDINGS.md`](./KEYBINDINGS.md
 | GUI apps, GTK/Firefox theming, cursor  | [`desktop.nix`](./desktop.nix) (graphical hosts only) |
 Shared by every host via [`default.nix`](./default.nix); the work box also layers
-[`work.nix`](./work.nix) on top (work email, its own ssh config, extra packages,
+[`work.nix`](../users/emmathorpe/work.nix) on top (its own ssh config, extra
-and the C#/Helm language servers).
+packages, and the C#/Helm language servers). The committer identity (name, email,
 signing key) comes from the user registry
 ([`../users/registry.nix`](../users/registry.nix)), not this module.
 ---
@@ -55,7 +57,7 @@ and the C#/Helm language servers).
 | `hyperfine` / `sd`      | command-line benchmarking; saner find-and-replace than sed                                                                                                                                                                          |
 **Theming:** `fzf`, `bat`, `btop`, `lazygit` and `git`'s `delta` pager are all
-Catppuccin Mocha, driven from the shared `../catppuccin-mocha.nix` palette / the
+Catppuccin Mocha, driven from the shared `../lib/catppuccin-mocha.nix` palette / the
 catppuccin upstream themes.
 **Env & defaults:** `xdg.enable` on; `PAGER`/`MANPAGER` (bat) set in `default.nix`
@@ -109,7 +111,7 @@ every host. Migrated from plain vim; the practical gain is a real LSP stack in
 place of the old (inert) ALE.
 | Feature        | Notes                                                                                     |
-| -------------- | -------------------------------------------------------------------------------------- |
+| -------------- | ----------------------------------------------------------------------------------------- |
 | Colorscheme    | Catppuccin Mocha (matches the terminal and the rest of the desktop)                       |
 | File tree      | nvim-tree, toggled with `,,` (comma twice; was nerdtree)                                  |
 | Fuzzy finder   | telescope (+fzf-native): `<leader>ff` files, `<leader>fg` grep, `<leader>fb` buffers      |
@@ -122,7 +124,7 @@ place of the old (inert) ALE.
 | Editing        | which-key hints, comment (`gc`/`gcc`), autopairs, treesitter textobjects                  |
 | Pane nav       | vim-tmux-navigator — `Ctrl`+`h/j/k/l` moves across vim splits and tmux panes              |
 | Syntax         | tree-sitter (nix, lua, bash, markdown, groovy, c#, python, terraform, yaml)               |
-| LSP            | nvim-cmp completion + servers `nil` (Nix), `lua_ls`, `pyright` (Python), `terraformls` |
+| LSP            | nvim-cmp completion + servers `nil_ls` (Nix), `lua_ls`, `pyright` (Python), `terraformls` |
 | Indentation    | 2-wide hard tabs (`noexpandtab`, `tabstop`/`shiftwidth` = 2); line numbers on             |
 | Filetypes      | `*Jenkinsfile` → groovy                                                                   |
@@ -148,7 +150,7 @@ current (`gc`/`fetch.writeCommitGraph`) so `lg` stays fast.
 | `cz` `cc`                | `git cz <sub>` (e.g. `git cz c`) and `git cc` → commitizen prompt  |
 | Behaviour      |                                                                                                                                                                                                                |
-| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Pulls          | rebase, with autostash + autosquash                                                                                                                                                                            |
 | Fetch          | prune deleted remote branches                                                                                                                                                                                  |
 | Conflicts      | `zdiff3` (shows the common ancestor)                                                                                                                                                                           |
@@ -157,7 +159,7 @@ current (`gc`/`fetch.writeCommitGraph`) so `lg` stays fast.
 | Commit editor  | full diff shown (`commit.verbose`)                                                                                                                                                                             |
 | Misc           | branches sorted by date, `column.ui = auto`, `help.autocorrect = prompt`, `push.autoSetupRemote`                                                                                                               |
 | Global ignores | `result`, `result-*`, `.direnv`, `*.swp`, `.DS_Store`                                                                                                                                                          |
-| Signing        | SSH commit + tag signing (`mkDefault`, so a host without the key in its agent can disable it). Personal email `iam@emmathe.dev`; the work box overrides email + signing. |
+| Signing        | SSH commit + tag signing (`mkDefault`, so a host without the key in its agent can disable it). Name, email and signing key all come from the per-user `identity` (the user registry, `../users/registry.nix`). |
 ## ssh
@@ -1,12 +1,13 @@
 # Graphical desktop layer: GUI apps, Wayland session env, and cursor theme.
 # Imported only on hosts that run Sway (MBP, T400, Mac Pro); never pulled onto
 # the headless WSL host. Login (and the Sway session launch) is handled by the
-# greetd/ReGreet greeter -- see ../swaywm.nix -- so there is no tty1 autostart.
+# greetd/ReGreet greeter -- see ../modules/sway.nix -- so there is no tty1
 # autostart.
 {
  pkgs,
  config,
  inputs,
-  username,
+  identity,
  ...
 }:
 {
@@ -89,7 +90,7 @@
  };
  # Firefox is themed at the browser level (it does not follow the GTK theme).
-  # The system installs the binary (programs.firefox in ../user.nix); here
+  # The system installs the binary (programs.firefox in ../modules/users.nix); here
  # home-manager owns only the profile, hence package = null. Apply the
  # Catppuccin Mocha theme add-on (only the mauve accent is packaged upstream;
  # the rest of the desktop uses blue) and make content + UI dark.
@@ -101,7 +102,7 @@
    # stateVersion<26.05 default-change warning (the new XDG path depends on
    # Firefox's own profile support).
    configPath = ".mozilla/firefox";
-    profiles.${username} = {
+    profiles.${identity.username} = {
      id = 0;
      isDefault = true;
      extensions = {
@@ -89,6 +89,18 @@
        enable = true;
        autoEnableSources = true;
        settings = {
          # nvim-cmp ships no default keymaps; without these the menu shows but
          # nothing accepts it. confirm uses select=false so a bare <CR> stays a
          # newline unless an entry is explicitly highlighted.
          mapping = {
            "<C-n>" = "cmp.mapping.select_next_item()";
            "<C-p>" = "cmp.mapping.select_prev_item()";
            "<Tab>" = "cmp.mapping.select_next_item()";
            "<S-Tab>" = "cmp.mapping.select_prev_item()";
            "<CR>" = "cmp.mapping.confirm({ select = false })";
            "<C-Space>" = "cmp.mapping.complete()";
            "<C-e>" = "cmp.mapping.abort()";
          };
          snippet.expand = "function(args) require('luasnip').lsp_expand(args.body) end";
          sources = [
            { name = "nvim_lsp"; }
@@ -109,7 +121,7 @@
      trouble.enable = true; # project-wide diagnostics/quickfix list
      lualine = {
        enable = true;
-        settings.options.theme = "catppuccin";
+        settings.options.theme = "catppuccin-mocha";
      };
      comment.enable = true; # gc / gcc comment toggling
      nvim-autopairs.enable = true;
@@ -1,13 +1,13 @@
-# Version control: git + delta pager + commitizen + lazygit. The work host
+# Version control: git + delta + commitizen + lazygit. Committer identity comes
-# layers commit signing and an email override on top (see work.nix).
+# from the per-user `identity` arg (the registry). See README "Users".
 {
  pkgs,
  lib,
-  fullName,
+  identity,
  ...
 }:
 let
-  ctp = import ../catppuccin-mocha.nix;
+  ctp = import ../lib/catppuccin-mocha.nix;
 in
 {
  home.packages = [
@@ -18,10 +18,9 @@ in
    enable = true;
    package = pkgs.gitFull;
    settings = {
-      user.name = fullName;
+      user.name = identity.fullName;
-      # Personal identity. mkDefault so the work module overrides it on the work
+      # mkDefault so a host-specific module can still override it.
-      # host (and to merge cleanly with that plain definition there).
+      user.email = lib.mkDefault identity.email;
      user.email = lib.mkDefault "iam@emmathe.dev";
      push.autoSetupRemote = true;
      init.defaultBranch = "main";
@@ -77,12 +76,10 @@ in
        cc = "!cz commit";
      };
-      # SSH commit signing on personal hosts too (the work module sets the same
+      # SSH signing, key from the registry. mkDefault so a host lacking the key
-      # on the work host). mkDefault so a host without the key in its ssh-agent
+      # in its agent can set gpgsign = false instead of failing every commit.
      # can override to false -- otherwise commits there would fail. Reuses the
      # existing ssh key; a dedicated personal key can be swapped in later.
      gpg.format = "ssh";
-      user.signingkey = "key::ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAJMVgeRKnfX1G8coU3nAobI485aeUpGTMqH7+zbKI8o emma.thorpe@cloud.com";
+      user.signingkey = lib.mkDefault identity.signingKey;
      commit.gpgsign = lib.mkDefault true;
      tag.gpgsign = lib.mkDefault true;
    };
@@ -8,7 +8,7 @@
 }:
 let
  # Shared Catppuccin Mocha palette: raw 6-hex strings, no leading "#".
-  ctp = import ../catppuccin-mocha.nix;
+  ctp = import ../lib/catppuccin-mocha.nix;
 in
 {
  imports = [
@@ -203,12 +203,15 @@ in
    flake = "$HOME/code/nixfiles";
  };
-  # GitHub CLI. Prefer SSH for any git operations it drives, matching the
+  # GitHub CLI. `programs.gh.settings` is deliberately unset: home-manager renders
-  # ssh-based remotes used elsewhere.
+  # ~/.config/gh/config.yml as a read-only /nix/store symlink whenever the module
-  programs.gh = {
+  # is enabled, but gh must rewrite that file on `gh auth login` and `gh config
-    enable = true;
+  # set`, which then fail with a permission error. Suppress the managed config.yml
-    settings.git_protocol = "ssh";
+  # (below) and let gh own it. The token lives in hosts.yml, which is never
-  };
+  # Nix-managed. Set the SSH protocol once at runtime: `gh config set git_protocol
  # ssh` (it can't be declarative here without recreating the immutable file).
  programs.gh.enable = true;
  xdg.configFile."gh/config.yml".enable = lib.mkForce false;
  programs.tmux = {
    enable = true;
@@ -345,6 +348,60 @@ in
  # enables this in the work module; both being true merges cleanly.
  services.ssh-agent.enable = lib.mkIf pkgs.stdenv.hostPlatform.isLinux true;
  # Classic process viewer (complements btop). htop has no custom-theme support
  # -- only a handful of built-in color schemes -- so it can't be hex-themed like
  # btop/bat/fzf. color_scheme = 0 (Default) draws from the terminal's ANSI
  # palette, which is Catppuccin Mocha (foot/iTerm2), so it matches by deferring
  # to the terminal rather than vendoring a theme.
  programs.htop = {
    enable = true;
    settings = {
      color_scheme = 0; # Default -> uses the terminal's Catppuccin palette
      delay = 15; # refresh every 1.5s
      cpu_count_from_one = 1;
      show_cpu_frequency = 1;
      show_cpu_usage = 1; # per-core usage shown in the CPU bars
      highlight_base_name = 1; # highlight the program name within the path
      highlight_megabytes = 1;
      highlight_threads = 1;
      hide_kernel_threads = 1;
      show_program_path = 0; # show just the command, not the full path
      tree_view = 1; # start in process-tree mode
      tree_view_always_by_pid = 0;
      account_guest_in_cpu_meter = 0;
      fields = with config.lib.htop.fields; [
        PID
        USER
        PRIORITY
        NICE
        M_SIZE
        M_RESIDENT
        M_SHARE
        STATE
        PERCENT_CPU
        PERCENT_MEM
        TIME
        COMM
      ];
    }
    // (
      with config.lib.htop;
      leftMeters [
        (bar "AllCPUs2")
        (bar "Memory")
        (bar "Swap")
      ]
    )
    // (
      with config.lib.htop;
      rightMeters [
        (text "Tasks")
        (text "LoadAverage")
        (text "Uptime")
      ]
    );
  };
  # Drop the zsh completion dump on every activation. A stale .zcompdump caches
  # /nix/store paths to completion functions; once a rebuild or a manual GC
  # removes them, compinit fails with "_git: function definition file not found"
@@ -2,7 +2,7 @@
 # Imported via ./desktop.nix, so only graphical hosts get it.
 #
 # The compositor binary, PAM and the polkit *daemon* come from the system-level
-# programs.sway (see ../swaywm.nix); package = null below reuses it instead of
+# programs.sway (see ../modules/sway.nix); package = null below reuses it instead of
 # pulling a second Sway. The polkit authentication *agent* (the thing that draws
 # the GUI auth dialog) is a user service started here. home-manager owns the user
 # config (~/.config/sway) and wires the systemd user session (sway-session.target),
@@ -20,7 +20,7 @@ let
  # Catppuccin Mocha (shared with the ReGreet greeter). Raw hex; prefix "#"
  # where a consumer needs it -- Sway/i3status/dunst want "#", foot/swaylock do
  # not.
-  ctp = import ../catppuccin-mocha.nix;
+  ctp = import ../lib/catppuccin-mocha.nix;
  # Focused-window screenshot -> swappy editor (the dotfiles' grimshot.sh logic).
  # Full store paths so it needs nothing on PATH.
@@ -334,13 +334,12 @@ in
    ];
  };
-  # Night light. Manual location (no geoclue dependency); adjust the coordinates
+  # Night light. Manual location (no geoclue dependency); warmer at night,
-  # to taste. Warmer at night, neutral by day.
+  # neutral by day. Coordinates come from the per-user module (e.g.
  # users/lyrathorpe/home.nix), not this shared module.
  services.gammastep = {
    enable = true;
    provider = "manual";
    latitude = 51.5;
    longitude = -0.13; # London-ish; set to your actual location
    temperature = {
      day = 6500;
      night = 3700;
@@ -0,0 +1,51 @@
 # macOS (nix-darwin) — `lyrathorpe-mac`
 Flake host: `lyrathorpe-mac` (`aarch64-darwin`). Apple Silicon Mac managed by
 **nix-darwin** from this same flake. Built via `mkDarwinHost` (single-user —
 macOS owns the account; identity still comes from the registry). Files:
 `configuration.nix`.
 ## What this host is
 A macOS workstation. The interactive user environment (shell, git, editor,
 Claude) is the **shared `../../home` bundle** — the same modules the Linux hosts
 use — so the terminal experience matches. The Linux-only `desktop.nix`/`sway.nix`
 are intentionally left out. This host config covers the macOS-specific layer:
 system packages, Homebrew, and macOS UI defaults.
 ## Package sourcing
 - **nixpkgs** (`environment.systemPackages`) for CLI tooling and libraries.
 - **Homebrew**, owned declaratively by `nix-homebrew` (Rosetta enabled for
  x86_64 formulae). The `brews`/`casks` lists are **authoritative**:
  `onActivation.cleanup = "zap"` uninstalls anything not declared. GUI apps are
  casks (nixpkgs darwin GUI support is unreliable); a few version-pinned
  toolchains and the PWA host stay on brew for continuity.
 - **Mac App Store** apps are **not** declarative: nix-darwin 26.05 runs
  activation as root, and `mas` cannot reach the App Store session from root.
  Install them by hand with `mas install <id>` from a GUI Terminal (the `mas`
  CLI is in `environment.systemPackages`).
 ## macOS integration
 - `security.pam.services.sudo_local` — **Touch ID for sudo** (and
  `darwin-rebuild`'s sudo prompt), kept in `sudo_local` so it survives OS
  updates. `reattach` pulls in `pam_reattach` so Touch ID works inside tmux
  (which the terminals auto-start).
 - `system.defaults` — declarative dock / finder / global / trackpad preferences,
  applied on activation and reversible. This is the main reason to run nix-darwin
  beyond package management.
 - The JetBrainsMono Nerd Font is installed to `/Library/Fonts`; set it in
  iTerm2 (Settings → Profiles → Text → Font) so the tmux statusline glyphs
  render.
 ## stateVersion
 `system.stateVersion = 5` (the nix-darwin state version, an integer — not a
 NixOS release string). Read `darwin-rebuild changelog` before changing it.
 ## Apply
 ```sh
 darwin-rebuild switch --flake .#lyrathorpe-mac
 ```
@@ -1,5 +1,5 @@
 # Default nix-darwin host. Minimal macOS baseline; the user environment
-# (shell, git, editor) is carried by the shared ./lyrathorpe/home modules,
+# (shell, git, editor) is carried by the shared ./home modules,
 # the same ones used by the Linux hosts. nixpkgs.hostPlatform is set by
 # mkDarwinHost in flake.nix.
 { pkgs, username, ... }:
@@ -80,7 +80,7 @@
  };
  # Declarative Homebrew for packages with no nixpkgs equivalent or that must be
-  # the vendor build (GUI casks, Mac App Store apps).
+  # the vendor build (GUI casks).
  homebrew = {
    enable = true;
    onActivation = {
@@ -97,6 +97,7 @@
      "llvm@21"
      "lld@21"
      "python@3.14"
      "dosbox-staging"
    ];
    # GUI applications. macOS app bundles are managed as casks; nixpkgs darwin
    # GUI support is unreliable, so these stay on brew for continuity.
@@ -136,34 +137,29 @@
      "vscodium"
      "winbox"
    ];
-    masApps = {
+    # Mac App Store apps are not managed declaratively: nix-darwin 26.05 forces
-      Amphetamine = 937984704;
+    # activation to run as root, and `mas` cannot reach the App Store session
-      "Apple Configurator" = 1037126344;
+    # from root, so installs silently fail. Install them by hand with
-      "Game Controller Tester" = 1500593102;
+    # `mas install <id>` from a GUI Terminal (the `mas` CLI is in
-      "Home Assistant" = 1099568401;
+    # environment.systemPackages above).
      Infuse = 1136220934;
      Keynote = 409183694;
      Numbers = 409203825;
      Pages = 409201541;
      PDFgear = 6469021132;
      PL2303Serial = 1624835354;
      WireGuard = 1451685025;
    };
  };
  # Touch ID authorises sudo (and darwin-rebuild's sudo prompt) instead of a
  # typed password. sudo_local keeps the change in /etc/pam.d/sudo_local so it
-  # survives macOS updates.
+  # survives macOS updates. reattach pulls in pam_reattach: pam_tid (Touch ID)
-  security.pam.services.sudo_local.touchIdAuth = true;
+  # otherwise fails inside tmux/screen because the process is detached from the
  # GUI login session -- and terminals here auto-start tmux, so it is required.
  security.pam.services.sudo_local = {
    touchIdAuth = true;
    reattach = true;
  };
  # Declarative macOS UI defaults -- the main reason to run nix-darwin beyond
  # package management. Applied on activation; all reversible.
  system.defaults = {
    dock = {
      autohide = true;
      show-recents = false;
      mru-spaces = false; # don't reorder spaces by use
      tilesize = 48;
    };
    finder = {
      AppleShowAllExtensions = true;
@@ -0,0 +1,53 @@
 # Work WSL box — `emmathorpe-edaas`
 Flake host: `emmathorpe-edaas` (`x86_64-linux`). NixOS running under
 **NixOS-WSL** on the corporate Windows machine. Headless: no Sway desktop
 (`features.swayDesktop.enable = false`), plain WSL shell login. Files:
 `configuration.nix`.
 ## What this host is
 The day-to-day work environment. It layers the corporate Kubernetes / Helm /
 Terraform / cloud toolchain and a couple of work-only editor language servers on
 top of the shared home profile. The system config here is thin — it is mostly
 WSL plumbing; the user-facing tooling lives in
 [`../../users/emmathorpe/work.nix`](../../users/emmathorpe/work.nix).
 ## WSL specifics
 - `wsl.enable`, default user `emmathorpe`, Windows PATH interop and start-menu
  launchers on. `/etc/hosts` generation is off (`generateHosts = false`).
 - **Docker Desktop integration**, not the native daemon as the primary path:
  `wsl.extraBin` shims the coreutils/`groupadd`/`usermod` binaries Docker
  Desktop's `wsl-distro-proxy` expects, and `docker-desktop-proxy.script` is
  patched to the real proxy path. The native `virtualisation.docker` is also
  enabled (with `enableOnBoot` + `autoPrune`).
 - `programs.ssh.systemd-ssh-proxy.enable = false` — the NixOS-WSL store is a
  read-only VHD owned by `nobody`, and OpenSSH rejects the generated
  `ssh-proxy` Include as "Bad owner or permissions", which would break ssh/git
  for every command. The vsock proxy it provides is unused under WSL.
 - `networking.hostName = "emmathorpe-edaas"` matches the flake attribute so
  `nh os switch` resolves without `-H`.
 ## Renovate review timer
 The host-table entry sets `users.emmathorpe.linger = true` so the user's
 `systemd --user` instance stays alive without an open login session. That keeps
 the daily headless **Renovate PR review** timer firing — defined in
 [`../../users/emmathorpe/renovate-review.nix`](../../users/emmathorpe/renovate-review.nix)
 (imported only from `work.nix`, so it exists on this machine alone). See that
 file's header for the auth (Vertex AI ADC), triage policy, and caveats.
 ## stateVersion
 `system.stateVersion = "24.11"` — the release this box was first installed on.
 Leave it; it freezes stateful defaults and is not meant to track the current
 nixpkgs.
 ## Apply
 ```sh
 sudo nixos-rebuild switch --flake .#emmathorpe-edaas
 # or, since the hostname matches the attribute:
 nh os switch
 ```
@@ -19,9 +19,7 @@
    defaultUser = "emmathorpe";
    wslConf.automount.root = "/mnt";
    wslConf.interop.appendWindowsPath = true;
    wslConf.interop.register = true;
    wslConf.interop.enabled = true;
    wslConf.interop.includePath = true;
    wslConf.network.generateHosts = false;
    startMenuLaunchers = true;
    docker-desktop.enable = false;
@@ -43,6 +41,11 @@
    autoPrune.enable = true;
  };
  # Match the flake's nixosConfigurations attribute name so `nh os switch`
  # (which selects by the local hostname) resolves without an explicit
  # -H/--hostname flag. The default would otherwise be the stock NixOS "nixos".
  networking.hostName = "emmathorpe-edaas";
  networking.resolvconf.enable = false;
  # Drop the systemd-ssh-proxy Include from the generated /etc/ssh/ssh_config.
@@ -58,6 +61,12 @@
  systemd.services.docker-desktop-proxy.script = lib.mkForce ''${config.wsl.wslConf.automount.root}/wsl/docker-desktop/docker-desktop-user-distro proxy --docker-desktop-root ${config.wsl.wslConf.automount.root}/wsl/docker-desktop "C:\Program Files\Docker\Docker\resources"'';
  features.swayDesktop.enable = false;
  # NOTE: this user's systemd --user lingering -- so the home-manager renovate
  # timer fires without an open login session -- is enabled from the host table
  # in flake.nix (users.emmathorpe.linger = true) and applied by
  # modules/users.nix.
  # programs.nix-ld is enabled for all NixOS hosts in common-nixos.nix.
  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
@@ -48,7 +48,7 @@ gigabit ports.
 ## Login
 Graphical login via a Wayland greeter — `greetd` running ReGreet inside the
-`cage` kiosk compositor — configured centrally in `lyrathorpe/swaywm.nix` for
+`cage` kiosk compositor — configured centrally in `../../modules/sway.nix` for
 every Sway host (gated on `features.swayDesktop.enable`). The greeter is forced
 to the Dvorak layout to match the console and Sway session. Set the user
 password (`passwd lyrathorpe`) after install, or the greeter cannot
@@ -26,10 +26,8 @@
  # workstation.nix is the backstop).
  zramSwap.enable = true;
-  # This host accepts SSH, so open 22 (the firewall itself is enabled in
+  # sshd (daemon, port 22, key-only policy) comes from ../../modules/ssh.nix;
-  # workstation.nix with a default-deny policy).
+  # the firewall itself is enabled in workstation.nix with a default-deny policy.
  services.openssh.enable = true;
  networking.firewall.allowedTCPPorts = [ 22 ];
  # Dual Harpertown Xeon microcode. Redistributable firmware (GPU/NIC blobs) is
  # enabled in workstation.nix.
@@ -42,7 +40,7 @@
  #   - ATI Radeon HD 2600 XT -> "radeon" (older) or "amdgpu" KMS
  #   - NVIDIA GeForce 8800 GT -> "nouveau" KMS
  # These come up automatically via the in-tree drivers + KMS, and the graphics
-  # stack itself is enabled by swaywm.nix. If a card needs to be forced, add it
+  # stack itself is enabled by modules/sway.nix. If a card needs to be forced, add it
  # here, e.g. `services.xserver.videoDrivers = [ "radeon" ];` (or "nouveau"),
  # and/or `boot.initrd.kernelModules = [ "radeon" ];` in
  # hardware-configuration.nix for early KMS.
@@ -0,0 +1,69 @@
 # Raspberry Pi 5 (`lyrathorpe-rpi5`)
 Headless `aarch64-linux` server with two roles:
 - **Docker host** — daemon exposed over the network (`docker.nix`).
 - **nginx reverse proxy** — declarative `virtualHosts` (`reverse-proxy.nix`).
 ## Install
 1. Flash a NixOS `aarch64` SD image (or USB) and boot the Pi. The
   `raspberry-pi-5` profile from `nixos-hardware` (wired in the flake host table)
   supplies the kernel, firmware and device tree; boot is U-Boot + extlinux.
 2. Partition/mount the target, then **regenerate the hardware config on the
   device** and replace the committed placeholder:
   ```sh
   nixos-generate-config --root /mnt
   # copy /mnt/etc/nixos/hardware-configuration.nix over
   # hosts/RPi5/hardware-configuration.nix in this repo, then commit
   ```
   `hardware-configuration.nix` in this directory is a **placeholder** committed
   only so the host evaluates in CI. The machine will not boot correctly until it
   is replaced with the generated one.
 3. Set the host name to match the flake attribute (already done in
   `configuration.nix`: `lyrathorpe-rpi5`) and build:
   ```sh
   sudo nixos-rebuild switch --flake .#lyrathorpe-rpi5
   # or, once the hostname is live:
   nh os switch
   ```
 4. Give the login user a password (`passwd lyrathorpe`) and confirm the key in
   the user registry (`../../users/registry.nix`, applied by
   `../../modules/ssh.nix`) is the one you will connect with.
 ## Docker socket (security)
 The daemon listens on **plain TCP `2375`, no TLS, no auth**. Access is
 root-equivalent on this host. The only protection is the nftables rule in
 `docker.nix`, which accepts `2375` **only** from the trusted LAN subnet
 (`10.187.1.0/24` by default — change it to match your network). Do not widen
 that subnet to anything untrusted.
 From a LAN client:
 ```sh
 export DOCKER_HOST=tcp://lyrathorpe-rpi5:2375
 docker info
 ```
 The secure upgrade path is mutual TLS on `2376` (`--tlsverify` with a CA and
 client certs); it needs out-of-band cert provisioning and is intentionally not
 wired here.
 ## Adding a reverse-proxy site
 Each proxied service is a Nix entry in `reverse-proxy.nix`:
 ```nix
 services.nginx.virtualHosts."app.example.lan" = {
  # enableACME = true; forceSSL = true;   # once a DNS name + cert exist
  locations."/" = {
    proxyPass = "http://127.0.0.1:8080";  # e.g. a local container
    proxyWebsockets = true;
  };
 };
 ```
 The example vhost is HTTP-only by design. Turn on `enableACME`/`forceSSL`
 per-vhost once the host has a real DNS name and the ACME challenge can be met;
 `443` is already open in the firewall.
@@ -0,0 +1,37 @@
 # Raspberry Pi 5 (aarch64) headless server. Two roles, split into submodules:
 # ./docker.nix (Docker host with a network socket) and ./reverse-proxy.nix
 # (native nginx). The raspberry-pi-5 nixos-hardware profile (kernel, firmware,
 # device tree) and key-only sshd (../../modules/ssh.nix) are layered on in the
 # flake host table. Install notes: see ./README.md.
 { ... }:
 {
  imports = [
    ./hardware-configuration.nix
    ./docker.nix
    ./reverse-proxy.nix
  ];
  # Match the flake's nixosConfigurations attribute name so `nh os switch`
  # (which selects by the local hostname) resolves without an explicit -H flag.
  networking.hostName = "lyrathorpe-rpi5";
  # Headless server: the Sway desktop is intentionally not set up. modules/sway.nix is
  # not imported and features.swayDesktop.enable defaults to false (declared in
  # system/modules/features.nix), so this host keeps plain TTY/SSH login.
  # Raspberry Pi boots via U-Boot + extlinux, not GRUB/systemd-boot. The
  # raspberry-pi-5 nixos-hardware profile supplies the kernel, firmware and
  # device tree.
  boot.loader.grub.enable = false;
  boot.loader.generic-extlinux-compatible.enable = true;
  # Remote administration: the daemon, port 22 and key-only policy all come from
  # ../../modules/ssh.nix.
  # Default-deny inbound; the Docker and nginx submodules open their own ports
  # (Docker via a source-restricted nftables rule, nginx via 80/443).
  networking.firewall.enable = true;
  # See `man configuration.nix` / the stateVersion docs before changing.
  system.stateVersion = "26.05";
 }
@@ -0,0 +1,38 @@
 # Docker host with the daemon socket exposed over the network.
 #
 # SECURITY: the daemon listens on plain TCP 2375 with NO TLS and NO auth. Access
 # to that port is root-equivalent on this host (the Docker API can mount the
 # host filesystem and run privileged containers). The ONLY thing protecting it
 # is the nftables rule below, which accepts 2375 solely from the trusted LAN
 # subnet. Do not widen that subnet to anything you do not fully trust. The
 # secure upgrade path is mutual TLS on 2376 (--tlsverify with client certs);
 # that needs out-of-band cert provisioning and is intentionally not wired here.
 { ... }:
 let
  # LAN allowed to reach the unauthenticated Docker TCP socket (see SECURITY above).
  trustedSubnet = "10.187.1.0/24";
 in
 {
  virtualisation.docker.enable = true;
  # Expose the daemon over TCP by extending systemd socket activation rather than
  # setting daemon.settings.hosts. The NixOS docker unit starts dockerd with
  # `-H fd://` and takes its listeners from this socket; putting `hosts` in
  # daemon.json as well would conflict with that and dockerd would refuse to
  # start. Adding the TCP listener here keeps a single source of truth.
  # The leading "" resets the unit's default (unix-socket-only) ListenStream list.
  systemd.sockets.docker.socketConfig.ListenStream = [
    ""
    "/run/docker.sock"
    "0.0.0.0:2375"
  ];
  # Source-restricted firewall rule for the Docker TCP port. 2375 is deliberately
  # NOT added to networking.firewall.allowedTCPPorts (that would open it to every
  # source); instead nftables accepts it only from the trusted subnet. Adjust the
  # CIDR to match the LAN that should reach the Docker API.
  networking.nftables.enable = true;
  networking.firewall.extraInputRules = ''
    ip saddr ${trustedSubnet} tcp dport 2375 accept
  '';
 }
@@ -0,0 +1,31 @@
 # PLACEHOLDER hardware configuration for the Raspberry Pi 5.
 #
 # This file is NOT the real generated config -- it exists only so the host
 # evaluates in CI before the Pi is provisioned. The machine will not boot from
 # it as-is. On first install, regenerate this file on the device with
 #   nixos-generate-config --root /mnt
 # and replace this placeholder with the output (commit it). See ./README.md.
 #
 # Like every hardware-configuration.nix in this repo, this file is excluded from
 # the formatter and linters (see the pre-commit/treefmt excludes in flake.nix).
 { modulesPath, ... }:
 {
  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
  nixpkgs.hostPlatform = "aarch64-linux";
  # The Raspberry Pi 5 boots from an SD card / USB with a FAT firmware partition
  # and an ext4 root. Labels match the conventional sd-image layout; the real
  # generated config will use by-uuid device paths instead.
  fileSystems."/" = {
    device = "/dev/disk/by-label/NIXOS_SD";
    fsType = "ext4";
  };
  fileSystems."/boot/firmware" = {
    device = "/dev/disk/by-label/FIRMWARE";
    fsType = "vfat";
  };
  swapDevices = [ ];
 }
@@ -0,0 +1,39 @@
 # Native nginx reverse proxy. The proxy configuration is declarative Nix:
 # every proxied service is an entry under services.nginx.virtualHosts, so the
 # whole routing table lives in this file and is built/version-controlled with
 # the rest of the system.
 #
 # To add a proxied service, add another virtualHosts."<host>" entry following
 # the example below. To serve it over HTTPS, uncomment enableACME + forceSSL on
 # that vhost once it has a real DNS name and the ACME HTTP-01/DNS-01 challenge
 # can be satisfied (see security.acme for the account/email and DNS settings).
 { ... }:
 {
  services.nginx = {
    enable = true;
    recommendedProxySettings = true; # sane proxy_set_header defaults (Host, X-Forwarded-*)
    recommendedTlsSettings = true;
    recommendedOptimisation = true;
    recommendedGzipSettings = true;
    virtualHosts = {
      # Example reverse-proxy vhost. Replace the name and upstream with a real
      # service (e.g. a container published by the Docker host on this machine).
      "example.lan" = {
        # enableACME = true;   # request a Let's Encrypt cert for this host
        # forceSSL = true;     # redirect HTTP -> HTTPS once the cert exists
        locations."/" = {
          proxyPass = "http://127.0.0.1:8080";
          proxyWebsockets = true; # forward Upgrade/Connection for WebSocket apps
        };
      };
    };
  };
  # Public reverse-proxy ports. 443 is opened now so flipping a vhost to TLS
  # needs no firewall change.
  networking.firewall.allowedTCPPorts = [
    80
    443
  ];
 }
@@ -35,7 +35,7 @@ change and `radeon` stays idle.
 ## Login
 Graphical login via a Wayland greeter — `greetd` running ReGreet inside the
-`cage` kiosk compositor — configured centrally in `lyrathorpe/swaywm.nix` for
+`cage` kiosk compositor — configured centrally in `../../modules/sway.nix` for
 every Sway host (gated on `features.swayDesktop.enable`). The greeter is forced
 to the Dvorak layout to match the console and Sway session. Set the user
 password (`passwd lyrathorpe`) after install, or the greeter cannot
@@ -21,10 +21,8 @@
  # Low-RAM host (4 GiB max): a compressed RAM swap reduces disk paging.
  zramSwap.enable = true;
-  # This host accepts SSH, so open 22 (the firewall itself is enabled in
+  # sshd (daemon, port 22, key-only policy) comes from ../../modules/ssh.nix;
-  # laptop.nix with a default-deny policy).
+  # the firewall itself is enabled in laptop.nix with a default-deny policy.
  services.openssh.enable = true;
  networking.firewall.allowedTCPPorts = [ 22 ];
  # Intel Core 2 (Penryn) microcode. Redistributable firmware (enabled in
  # workstation.nix) supplies the iwlwifi blobs (Intel WiFi Link 5100/5300) and
@@ -1,6 +1,6 @@
 # Catppuccin Mocha palette. Raw 6-digit hex (no leading "#"); consumers add a
 # "#" where their format needs it. Shared by the Sway desktop theming
-# (home/sway.nix) and the ReGreet greeter (swaywm.nix) so the two stay in sync.
+# (home/sway.nix) and the ReGreet greeter (modules/sway.nix) so the two stay in sync.
 {
  base = "1e1e2e";
  mantle = "181825";
@@ -1,28 +0,0 @@
 {
  config,
  pkgs,
  lib,
  username,
  fullName,
  ...
 }:
 {
  programs.zsh.enable = true;
  users.users.${username} = {
    isNormalUser = true;
    home = "/home/${username}";
    description = fullName;
    extraGroups = [
      "wheel"
      "docker"
    ];
    shell = pkgs.zsh;
  };
  programs.firefox = lib.mkIf (config.features.swayDesktop.enable == true) {
    enable = true;
  };
  programs.thunderbird = lib.mkIf (config.features.swayDesktop.enable == true) {
    enable = true;
  };
 }
@@ -2,7 +2,7 @@
 # shared ./workstation.nix base and swaps the mobile Wi-Fi backend for wired
 # NetworkManager. A desktop host also sets `portable = false` in its host-table
 # entry (flake.nix), which drops the battery block and brightness keybindings
-# from the Sway bar -- see lyrathorpe/home/sway.nix.
+# from the Sway bar -- see home/sway.nix.
 { ... }:
 {
  imports = [ ./workstation.nix ];
@@ -0,0 +1,12 @@
 # Feature-flag option declarations shared by every NixOS host (imported via
 # baseModules in flake.nix). Declaring the flags here -- rather than inside the
 # module that implements them -- means a host can read or set a flag without
 # importing the (often large) implementation module. In particular,
 # features.swayDesktop.enable is read by modules/users.nix on every host, but a
 # headless host (e.g. the Pi) must be able to leave it at its default without
 # pulling in modules/sway.nix. The implementation lives in modules/sway.nix,
 # gated on this flag.
 { lib, ... }:
 {
  options.features.swayDesktop.enable = lib.mkEnableOption "the Sway desktop";
 }
@@ -2,7 +2,7 @@
 # flake.nix. Shared graphical-workstation settings live in ./workstation.nix;
 # the only laptop-specific bit is the Wi-Fi backend. Mobile home-manager
 # components (battery block, brightness keys) are gated by the `portable` flag
-# threaded through mkHost -- see lyrathorpe/home/sway.nix.
+# threaded through mkHost -- see home/sway.nix.
 { ... }:
 {
  imports = [ ./workstation.nix ];
@@ -0,0 +1,14 @@
 # sshd for the hosts that run it (T400, Mac Pro, RPi5): enable the daemon, open
 # port 22, and apply a key-only policy. Authorized keys are owned per-user by the
 # registry (modules/users.nix), not here.
 { ... }:
 {
  services.openssh.enable = true;
  networking.firewall.allowedTCPPorts = [ 22 ];
  services.openssh.settings = {
    PasswordAuthentication = false; # keys only
    KbdInteractiveAuthentication = false; # no keyboard-interactive fallback
    PermitRootLogin = "no";
  };
 }
@@ -7,13 +7,13 @@
 let
  cfg = config.features.swayDesktop;
-  # Catppuccin Mocha (shared with the Sway desktop, see lyrathorpe/home/sway.nix).
+  # Catppuccin Mocha (shared with the Sway desktop, see home/sway.nix).
-  ctp = import ./catppuccin-mocha.nix;
+  ctp = import ../lib/catppuccin-mocha.nix;
 in
 {
-  options = {
+  # The features.swayDesktop.enable option is declared in
-    features.swayDesktop.enable = lib.mkEnableOption "Enable Sway Desktop";
+  # system/modules/features.nix (so headless hosts can read/set it without
-  };
+  # importing this module). This module only provides its implementation.
  config = lib.mkIf cfg.enable {
    programs.sway = {
      enable = true;
@@ -0,0 +1,38 @@
 # System user accounts, built from the registry (users/registry.nix) for the
 # host's `hostUsers` set. See README "Users".
 {
  config,
  pkgs,
  lib,
  hostUsers,
  userRegistry,
  ...
 }:
 {
  programs.zsh.enable = true;
  users.users = lib.mapAttrs (
    name: spec:
    let
      id = userRegistry.${name};
    in
    {
      isNormalUser = true;
      home = "/home/${name}";
      description = id.fullName;
      inherit (id) extraGroups;
      openssh.authorizedKeys.keys = id.sshAuthorizedKeys;
      shell = pkgs.zsh;
    }
    # linger opt-in (host table); left unmanaged when unset.
    // lib.optionalAttrs (spec ? linger) { inherit (spec) linger; }
  ) hostUsers;
  programs.firefox = lib.mkIf (config.features.swayDesktop.enable == true) {
    enable = true;
  };
  programs.thunderbird = lib.mkIf (config.features.swayDesktop.enable == true) {
    enable = true;
  };
 }
@@ -1,19 +0,0 @@
 # Key-only SSH hardening, imported by the hosts that run sshd (T400, Mac Pro).
 # The host config still does `services.openssh.enable = true` and opens port 22
 # next to where it documents the listening service; this module only tightens
 # the policy and installs the authorized key, so a host opting into sshd cannot
 # accidentally ship password/root login.
 { username, ... }:
 {
  services.openssh.settings = {
    PasswordAuthentication = false; # keys only
    KbdInteractiveAuthentication = false; # no keyboard-interactive fallback
    PermitRootLogin = "no";
  };
  # The key permitted to log in as the primary user. Add more entries here as
  # new client machines are provisioned.
  users.users.${username}.openssh.authorizedKeys.keys = [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDxHvdMTOzpFWUFMtCP7C/4tIOUO3GIO2QPvaifSnWH lyrathorpe@Lyra-MBA"
  ];
 }
@@ -0,0 +1,164 @@
 # Daily automated review and triage of Renovate dependency PRs awaiting Emma's
 # review.
 #
 # Host-scoped: imported only from work.nix (the EDaaS/WSL host), so the timer
 # exists on this machine alone. A systemd *user* timer runs Claude Code headless
 # once a day; it queries GitHub via the project-scoped github MCP server and
 # writes a risk-graded summary to the journal (read with
 # `journalctl --user -u renovate-review`).
 #
 # Triage policy:
 #   * PRs that are clearly low risk (patch/minor bumps to tooling, infra, test
 #     or framework libs; symmetric diff; CI green; no application logic) AND not
 #     already approved are AUTO-APPROVED headlessly. These repos enable Renovate
 #     automerge, so an approval lets the PR merge itself with no human in the
 #     loop. This is intentional and was explicitly requested.
 #   * Everything else (medium/high risk, failing/pending CI, stale branches,
 #     anything touching application logic or needing judgement) is left
 #     untouched and surfaced to Emma.
 #
 # The run records two state files under $XDG_STATE_HOME/renovate-review for the
 # once-a-day interactive-shell reminder defined below (programs.zsh.initContent):
 # `last-run` (date of the last successful run) and `needs-review.txt` (the PRs
 # that need Emma's eyes).
 #
 # Caveats (the foundation this stands on, none of it owned by this flake):
 #   * Auth is Vertex AI via gcloud Application Default Credentials
 #     (~/.config/gcloud/application_default_credentials.json). When that token
 #     can no longer refresh the run fails; re-auth with `gcloud auth login`.
 #   * The Vertex project, region and model are hardcoded below, copied from the
 #     interactive environment (the corporate launcher injects them; they live in
 #     no config file). If IT changes them, update them here. Claude Code handles
 #     its own network egress, so no proxy is set.
 #   * The github MCP server is defined in ~/code/.mcp.json, so the job runs with
 #     that directory as its working directory.
 {
  config,
  pkgs,
  lib,
  ...
 }:
 let
  # The review instructions handed to headless Claude: queue -> drop archived
  # repos -> grade risk -> auto-approve the clearly-safe ones, surface the rest.
  reviewPrompt = ''
    Daily Renovate PR review and triage for Emma-Thorpe_citrix.
    1. github MCP search_pull_requests, query: `is:open is:pr review-requested:Emma-Thorpe_citrix author:app/jenkins-stf-jm` (jenkins-stf-jm[bot] is this org's Renovate bot), perPage 50.
    2. Build the archived-repo exclusion set: github MCP search_repositories with query `org:csg-citrix-storefront archived:true`, perPage 100, paginate all pages (~128). Collect each archived repo full_name. Do NOT use the `archived:false` qualifier on the PR search itself; it is mis-indexed and returns zero. Filter by the repo set instead.
    3. Drop any PR whose repository is in the archived set (e.g. csg-citrix-storefront/traefik-fips is archived; a PR to an archived repo cannot merge and is noise).
    4. For each remaining PR: pull_request_read method=get (diff size, mergeable_state, labels, age), method=get_status (CI), and method=get_reviews (existing approvals). Read the body's dependency table for what is bumped.
    5. Grade risk Low / Medium / High. LOW means ALL of: only patch or minor version bumps; the packages are tooling, observability, infrastructure, test, or framework/runtime libraries (not business logic); the diff is small and symmetric (version strings / lockfiles only); CI is passing; nothing security-policy-loosening. Anything that is a major bump, touches application logic, has failing or pending CI, is a stale branch needing rebase, or that you are not confident about is NOT Low.
    6. AUTO-APPROVE the safe ones: for every PR that is Low risk AND has passing CI AND is not already approved by Emma-Thorpe_citrix, submit an approving review with pull_request_review_write (method=create, event=APPROVE, body: a one-line note that this is an automated approval of a low-risk dependency update). Approve only these. NEVER call merge. NEVER approve a Medium/High PR or one you are unsure about. (Note: these repos automerge on approval, so approval effectively merges it.)
    7. Leave for Emma, without approving: every Medium/High risk PR, anything with failing or pending CI, stale branches, and anything needing human judgement.
    8. Print a markdown table (PR linked, repo, change summary, size, CI, risk, action: Auto-approved / Needs review / Held) and terse notes. State how many PRs were excluded as archived.
    9. As the FINAL lines of your output, emit machine-readable triage lines, one per PR, with these EXACT prefixes and nothing else on the line:
       - For each PR you auto-approved:  APPROVED> owner/repo#NUMBER short title
       - For each PR that needs Emma's review:  NEEDS> owner/repo#NUMBER (Risk) one-line reason — https://github.com/owner/repo/pull/NUMBER
       If no PR needs Emma's review, emit no NEEDS> lines at all.
    If the post-filter search returns zero PRs, say so in one line and emit no NEEDS> lines.
  '';
  # Hold the prompt in its own store file rather than inline, so its literal
  # backticks and `$` don't trip shellcheck (SC2016) in the wrapper below.
  promptFile = pkgs.writeText "renovate-review-prompt.md" reviewPrompt;
  # Tools the headless run is permitted to use without interactive prompts.
  # Read-only github MCP calls, plus review_write so it can submit APPROVE
  # reviews on low-risk PRs. Deliberately NOT included: any merge tool.
  allowedTools = lib.concatStringsSep "," [
    "mcp__github-mcp__search_pull_requests"
    "mcp__github-mcp__search_repositories"
    "mcp__github-mcp__pull_request_read"
    "mcp__github-mcp__pull_request_review_write"
  ];
  # Where the run records state for the interactive-shell reminder.
  stateDir = "$HOME/.local/state/renovate-review";
  renovate-review = pkgs.writeShellApplication {
    name = "renovate-review";
    runtimeInputs = [ config.programs.claude-code.package ];
    text = ''
      # The github MCP server is project-scoped to ~/code; run from there.
      cd "$HOME/code"
      # Claude Code auth + endpoint: Vertex AI. These are injected into the
      # interactive shell by the corporate launcher (not present in any config
      # file), so a systemd-spawned process must set them explicitly. Do NOT set
      # HTTP(S)_PROXY: Claude Code self-provisions its own network egress to
      # Vertex; forcing a proxy here points it at a per-session socket that does
      # not exist outside an interactive launch and breaks connectivity.
      export CLAUDE_CODE_USE_VERTEX=1
      export ANTHROPIC_VERTEX_PROJECT_ID=claude-code-citrix
      export CLOUD_ML_REGION=global
      export ANTHROPIC_MODEL='claude-opus-4-8[1m]'
      # Capture the run so we can both log it (journal) and persist the triage
      # for the shell reminder. If claude exits non-zero, errexit aborts here and
      # the state files are left stale, so the reminder will flag a missed run.
      out="$(claude -p "$(cat ${promptFile})" \
        --allowedTools ${lib.escapeShellArg allowedTools} \
        --output-format text)"
      printf '%s\n' "$out"
      # Persist state for programs.zsh.initContent's daily reminder. needs-review
      # gets the PRs Claude flagged for Emma (the NEEDS> lines, prefix stripped);
      # it is empty when nothing needs her attention. grep || true: no matches is
      # the all-clear case, not an error.
      mkdir -p "${stateDir}"
      printf '%s\n' "$out" | grep '^NEEDS> ' | sed 's/^NEEDS> //' > "${stateDir}/needs-review.txt" || true
      date +%F > "${stateDir}/last-run"
    '';
  };
 in
 {
  systemd.user.services.renovate-review = {
    Unit.Description = "Daily Renovate PR review (headless Claude Code)";
    Service = {
      Type = "oneshot";
      ExecStart = lib.getExe renovate-review;
    };
  };
  systemd.user.timers.renovate-review = {
    Unit.Description = "Schedule the daily Renovate PR review";
    Timer = {
      OnCalendar = "*-*-* 08:47:00";
      # Run on next boot if the machine was off at the scheduled time.
      Persistent = true;
      # Avoid firing exactly on the minute boundary.
      RandomizedDelaySec = "5m";
    };
    Install.WantedBy = [ "timers.target" ];
  };
  # Interactive-shell reminder: nudge once per calendar day about the daily
  # Renovate timer -- whether it actually ran, and any PRs that need Emma's eyes
  # (the auto-approved ones need no nudge). Throttled via a `reminded-on` marker
  # so it prints in the first shell/tmux pane of the day, not every pane. mkOrder
  # 1600 runs after shell.nix's tmux re-exec (order 200), so it fires inside the
  # tmux pane where Emma actually reads it.
  programs.zsh.initContent = lib.mkOrder 1600 ''
    if [[ $- == *i* ]]; then
      __rr_dir="$HOME/.local/state/renovate-review"
      __rr_today=$(date +%F)
      if [[ "$(cat "$__rr_dir/reminded-on" 2>/dev/null)" != "$__rr_today" ]]; then
        __rr_last=$(cat "$__rr_dir/last-run" 2>/dev/null)
        if [[ "$__rr_last" != "$__rr_today" ]]; then
          print -P "%F{yellow}renovate:%f last review ''${__rr_last:-never} (not today) -- check: systemctl --user status renovate-review"
        fi
        if [[ -s "$__rr_dir/needs-review.txt" ]]; then
          print -P "%F{red}renovate:%f $(grep -c . "$__rr_dir/needs-review.txt") PR(s) need your review:"
          sed 's/^/  - /' "$__rr_dir/needs-review.txt"
          print -P "  -> journalctl --user -u renovate-review -e"
        elif [[ "$__rr_last" == "$__rr_today" ]]; then
          print -P "%F{green}renovate:%f reviewed today -- low-risk auto-approved, nothing for you."
        fi
        mkdir -p "$__rr_dir" && print -r -- "$__rr_today" > "$__rr_dir/reminded-on"
      fi
      unset __rr_dir __rr_today __rr_last
    fi
  '';
 }
@@ -1,21 +1,22 @@
-# Home-manager module for the work (EDaaS/WSL) profile: corporate git signing,
+# Work (EDaaS/WSL) home profile: corporate toolchain + tmux tweaks. Git identity
-# work toolchain packages and tmux tweaks. Imported only by the work host.
+# comes from the registry (users/registry.nix), not here.
-{ pkgs, lib, ... }:
+{
  pkgs,
  lib,
  inputs,
  ...
 }:
 {
  # Host-scoped extras for this machine only (the EDaaS/WSL host).
  imports = [
    ./renovate-review.nix # daily headless Renovate PR review (systemd user timer)
  ];
  # The work box keeps its own (corporate) ~/.ssh/config; don't let the personal
  # programs.ssh (shell.nix) take it over. The ssh-agent below still runs.
  programs.ssh.enable = lib.mkForce false;
  programs.git = {
    settings = {
      commit.gpgsign = true;
      tag.gpgsign = true;
      gpg.format = "ssh";
      user.signingkey = "key::ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAJMVgeRKnfX1G8coU3nAobI485aeUpGTMqH7+zbKI8o emma.thorpe@cloud.com";
      user.email = "emma.thorpe@citrix.com";
    };
  };
  home.packages = [
    pkgs.kubectl
    pkgs.argo-rollouts
@@ -28,7 +29,6 @@
    pkgs.powershell
    pkgs.nuget
    pkgs.gedit
    pkgs.lens
    pkgs.python3
    pkgs.gnumake
    pkgs.gcc
@@ -52,8 +52,10 @@
    docker = "/run/current-system/sw/bin/docker";
  };
  programs.tmux = {
    # kube context/namespace in the status line. kube-tmux is pinned as a flake
    # input (it is not in nixpkgs), so the script is always present in the store.
    extraConfig = ''
-      			set -g status-right "#(/run/current-system/sw/bin/bash $HOME/code/kube-tmux/kube.tmux 250 red black)"		
+      set -g status-right "#(${pkgs.bash}/bin/bash ${inputs.kube-tmux}/kube.tmux 250 red black)"
    '';
  };
  programs.go = {
@@ -61,7 +63,7 @@
  };
  # LSP servers only relevant to work: C# (omnisharp) and Helm charts (helm_ls).
-  # The shared editor (lyrathorpe/home/editor.nix) carries the universal ones;
+  # The shared editor (home/editor.nix) carries the universal ones;
  # these are gated to this host so the heavy omnisharp closure stays off the
  # personal machines. Tree-sitter grammars (highlighting) remain global there.
  programs.nixvim.plugins.lsp.servers = {
@@ -0,0 +1,17 @@
 # Lyra's personal home extras, imported on her hosts (not the work box). Keeps
 # personal data out of the shared home/ modules. See README "Users".
 { pkgs, lib, ... }:
 {
  # Personal ssh host shortcut.
  programs.ssh.settings."dockerpi.inf.cbg.emmaisvery.gay" = {
    User = "emmathorpe";
  };
  # Night-light location for gammastep (the service itself is enabled by
  # home/sway.nix on graphical hosts). Linux-guarded so Darwin, which imports
  # this module but has no gammastep, skips it.
  services.gammastep = lib.mkIf pkgs.stdenv.hostPlatform.isLinux {
    latitude = 51.5;
    longitude = -0.13;
  };
 }
@@ -0,0 +1,28 @@
 # User identity registry -- pure data, keyed by username. See README "Users".
 # (`identity.username` is injected by mkHost, so it is not repeated here.)
 {
  lyrathorpe = {
    fullName = "Lyra Thorpe";
    email = "iam@emmathe.dev";
    extraGroups = [
      "wheel"
      "docker"
    ];
    sshAuthorizedKeys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDxHvdMTOzpFWUFMtCP7C/4tIOUO3GIO2QPvaifSnWH lyrathorpe@Lyra-MBA"
    ];
    signingKey = "key::ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDxHvdMTOzpFWUFMtCP7C/4tIOUO3GIO2QPvaifSnWH lyrathorpe@Lyra-MBA";
  };
  emmathorpe = {
    fullName = "Emma Thorpe";
    email = "emma.thorpe@citrix.com";
    extraGroups = [
      "wheel"
      "docker"
    ];
    # No personal key on file yet; add one if SSH login as emmathorpe is wanted.
    sshAuthorizedKeys = [ ];
    signingKey = "key::ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAJMVgeRKnfX1G8coU3nAobI485aeUpGTMqH7+zbKI8o emma.thorpe@cloud.com";
  };
 }