docs: update READMEs and .gitignore for the restructured layout

Point all path references at the new users/, home/, modules/, hosts/, lib/
locations, and document the user registry, the multi-user host model, and
the portable homeConfigurations / homeModules outputs.

.editorconfig

@@ -8,6 +8,12 @@ indent_size = 2
 trim_trailing_whitespace = true
 insert_final_newline = true
 
+[*.{nix,yaml,yml,json,md,sh,toml}]
+indent_style = space
+indent_size = 2
+trim_trailing_whitespace = true
+insert_final_newline = true
+
 # Markdown uses trailing whitespace for hard line breaks.
 [*.md]
 trim_trailing_whitespace = false

.gitignore

@@ -2,6 +2,3 @@ modules/firmware/*
 
 # vim swap files
 *.swp
-
-# Local scratch project, not part of this flake.
-tf-inspect/

README.md

@@ -52,33 +52,6 @@ The home config is also exposed for use beyond these hosts:
   (`inputs.<this>.homeModules.default`). Consumers must supply the module args
   these expect: `inputs` always, `identity` for git/desktop, `portable` for sway.
 
-## Directory authentication (SSSD → Authentik LDAP)
-
-Every NixOS host authenticates users against the Authentik LDAP outpost via
-SSSD, implemented in [`modules/sssd.nix`](./modules/sssd.nix) and enabled by
-default through the `services.authentikLdap.enable` option (added to
-`baseModules`). The **EDaaS** WSL box opts out
-(`services.authentikLdap.enable = false`) as a work-managed environment; the
-macOS host is unaffected (SSSD is Linux-only).
-
-- Connects over LDAPS to `ldap.lyrapup.pet:636`, search base
-  `dc=ldap,dc=goauthentik,dc=io`, binding as
-  `cn=sssd-bind,ou=users,dc=ldap,dc=goauthentik,dc=io`.
-- The schema mappings match Authentik's non-standard object classes
-  (`goauthentik.io/ldap/user`, `goauthentik.io/ldap/group`) over the POSIX
-  attributes (`uid`, `uidNumber`, `gidNumber`, `homeDirectory`).
-- Home directories are created on first login (`pam_mkhomedir`).
-
-### Secrets (agenix)
-
-The LDAP bind credential is an [agenix](https://github.com/ryantm/agenix)
-secret, decrypted at activation with each host's SSH host key. The decrypted
-plaintext is a full `sssd.conf` drop-in delivered to
-`/etc/sssd/conf.d/01-ldap-authtok.conf`, so the password never enters the Nix
-store. Owner setup (host recipient keys, encrypting the bind password, DNS for
-`ldap.lyrapup.pet`, rebuild) is documented in
-[`secrets/README.md`](./secrets/README.md).
-
 ## Applying
 
 ```sh

flake.lock

@@ -191,22 +191,6 @@
         "type": "github"
       }
     },
-    "kube-tmux": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1779714285,
-        "narHash": "sha256-l1wjg2ReWKCI7h/K11vvX2ykYTs/mVD+tfz/mQsjn/E=",
-        "owner": "jonmosco",
-        "repo": "kube-tmux",
-        "rev": "8b7e1d127c16b6dc87ff5743f4d775b245198b69",
-        "type": "github"
-      },
-      "original": {
-        "owner": "jonmosco",
-        "repo": "kube-tmux",
-        "type": "github"
-      }
-    },
     "nix-darwin": {
       "inputs": {
         "nixpkgs": [
@@ -389,7 +373,6 @@
         "flake-parts": "flake-parts",
         "git-hooks": "git-hooks",
         "home-manager": "home-manager",
-        "kube-tmux": "kube-tmux",
         "nix-darwin": "nix-darwin",
         "nix-homebrew": "nix-homebrew",
         "nix-index-database": "nix-index-database",

flake.nix

@@ -46,15 +46,6 @@
       url = "github:cachix/git-hooks.nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    # agenix: age-encrypted secrets, decrypted at activation with each host's
-    # SSH host key. Provides the SSSD LDAP bind credential (secrets/, see
-    # modules/sssd.nix). The darwin module is intentionally unused (SSSD is
-    # Linux-only).
-    agenix = {
-      url = "github:ryantm/agenix";
-      inputs.nixpkgs.follows = "nixpkgs";
-      inputs.home-manager.follows = "home-manager";
-    };
     # Declarative Neovim (the editor; see home/editor.nix). Release
     # branch matched to the pinned nixpkgs (26.05); follows our nixpkgs to keep a
     # single nixpkgs in the closure. editor.nix sets programs.nixvim.nixpkgs.source
@@ -69,13 +60,6 @@
       url = "github:NixOS/nixos-hardware";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    # kube-tmux: kube context/namespace for the tmux status line on the work
-    # host. Not in nixpkgs and not a flake -- pinned here as a plain source so
-    # the script is always in the store (no manual checkout). See work.nix.
-    kube-tmux = {
-      url = "github:jonmosco/kube-tmux";
-      flake = false;
-    };
   };
 
   outputs =
@@ -109,9 +93,14 @@
         # Unfree packages permitted to be built (replaces blanket allowUnfree).
         unfreePackages = [
           "claude-code"
+          "lens"
+          "lens-desktop"
         ];
 
-        # Per-user identity, keyed by username. See README "Users".
+        # Identity registry: who each user is (name, email, keys, groups), keyed
+        # by username. Threaded into the system layer as the `userRegistry`
+        # specialArg and into each user's home config as the `identity` module
+        # arg. See users/registry.nix, modules/users.nix, home/git.nix.
         userRegistry = import ./users/registry.nix;
 
         # nixpkgs + nix-daemon settings shared by NixOS and Darwin hosts.
@@ -132,9 +121,7 @@
           ./modules/users.nix
           ./modules/common-nixos.nix
           ./modules/features.nix
-          ./modules/sssd.nix
           commonModule
-          inputs.agenix.nixosModules.default
           home-manager.nixosModules.home-manager
           {
             home-manager.useGlobalPkgs = true;
@@ -145,8 +132,14 @@
           }
         ];
 
-        # Build one NixOS host. `users` is an attrset keyed by username (home
+        # mkHost :: { system, modules, users, portable } -> nixosSystem
-        # modules + optional per-user system bits). See README "Users".
+        # Builds one machine by appending its host-specific modules to the shared
+        # baseModules. `users` is an attrset keyed by username; each value carries
+        # that user's home-module list and optional per-host-user system bits
+        # (e.g. linger). Per-user identity is injected into each home config via
+        # the `identity` module arg (extraSpecialArgs is per-host, so it cannot
+        # carry per-user data); the system layer reads the global `userRegistry`
+        # restricted to this host's `hostUsers` set.
         mkHost =
           {
             system,
@@ -197,8 +190,11 @@
           }
         ];
 
-        # Darwin counterpart of mkHost: single-user (macOS owns the account),
+        # mkDarwinHost :: { system, username, modules, homeModules } -> darwinSystem
-        # identity still from the registry. See README "Users".
+        # Darwin counterpart of mkHost. macOS already owns the login user, so we
+        # only attach the platform and home-manager; no NixOS user module here.
+        # Stays single-user (macOS owns the account); identity is still sourced
+        # from the registry so the shared home modules behave as on NixOS.
         mkDarwinHost =
           {
             system,
@@ -227,8 +223,12 @@
               ];
           };
 
-        # Host table — one entry per machine, realised into a nixosConfiguration
+        # Host table — declarative registry of every machine. To add a host:
-        # of the same name below. See README "Hosts" / "Users".
+        # give it a name, its `system`, its `users` set (each user's home-module
+        # list, plus optional per-host-user bits like linger), and the system
+        # `modules`. mapAttrs below turns each entry into a nixosConfiguration of
+        # the same name. Per-user home configs compose ./home (the shared bundle)
+        # with any per-user modules (e.g. ./users/emmathorpe/work.nix).
         hosts = {
           lyrathorpe-mbp = {
             system = "aarch64-linux";
@@ -240,7 +240,6 @@
             ];
             users.lyrathorpe.homeModules = [
               ./home
-              ./users/lyrathorpe/home.nix
               ./home/desktop.nix
             ];
           };
@@ -262,7 +261,6 @@
             ];
             users.lyrathorpe.homeModules = [
               ./home
-              ./users/lyrathorpe/home.nix
               ./home/desktop.nix
             ];
           };
@@ -280,7 +278,6 @@
             ];
             users.lyrathorpe.homeModules = [
               ./home
-              ./users/lyrathorpe/home.nix
               ./home/desktop.nix
             ];
           };
@@ -314,10 +311,7 @@
               inputs.nixos-hardware.nixosModules.raspberry-pi-5
               ./modules/ssh.nix
             ];
-            users.lyrathorpe.homeModules = [
+            users.lyrathorpe.homeModules = [ ./home ];
-              ./home
-              ./users/lyrathorpe/home.nix
-            ];
           };
         };
 
@@ -333,7 +327,6 @@
             ];
             homeModules = [
               ./home
-              ./users/lyrathorpe/home.nix
             ];
           };
         };
@@ -425,8 +418,14 @@
         flake.nixosConfigurations = lib.mapAttrs (_name: mkHost) hosts;
         flake.darwinConfigurations = lib.mapAttrs (_name: mkDarwinHost) darwinHosts;
 
-        # Reusable home modules, exported for use off these hosts. See README
+        # Reusable home modules, exported so this config can be consumed off these
-        # "Portable home" for the consumer module-arg expectations.
+        # hosts -- by a standalone home-manager on a non-NixOS machine, or as an
+        # input to someone else's flake. `default` is the portable bundle
+        # (shell + git + editor + claude). Consumers must supply the module args
+        # these expect: `inputs` always; `identity` (see users/registry.nix) for
+        # git/desktop; `portable` for sway. `desktop`/`sway` additionally require
+        # a NixOS host that provides the Sway/Firefox binary -- they are not
+        # standalone-portable.
         flake.homeModules = {
           default = ./home;
           shell = ./home/shell.nix;
@@ -437,8 +436,13 @@
           sway = ./home/sway.nix;
         };
 
-        # Standalone home-manager configs (portable bundle) for machines not
+        # Standalone home-manager configurations: the portable bundle built for a
-        # managed by this flake. See README "Portable home".
+        # machine NOT managed by this flake (`home-manager switch --flake
+        # .#"<user>@<system>"`). Only the portable subset is exposed; the desktop
+        # suite stays NixOS-only. homeConfigurations are not per-system, so the
+        # system is encoded in the attribute name, and home.username/homeDirectory
+        # are set explicitly (the NixOS module sets them automatically; standalone
+        # does not).
         flake.homeConfigurations =
           let
             mkHome =

home/README.md

@@ -110,23 +110,23 @@ declaratively with **nixvim**, so the same plugins and config are baked in on
 every host. Migrated from plain vim; the practical gain is a real LSP stack in
 place of the old (inert) ALE.
 
-| Feature        | Notes                                                                                     |
+| Feature        | Notes                                                                                  |
-| -------------- | ----------------------------------------------------------------------------------------- |
+| -------------- | -------------------------------------------------------------------------------------- |
-| Colorscheme    | Catppuccin Mocha (matches the terminal and the rest of the desktop)                       |
+| Colorscheme    | Catppuccin Mocha (matches the terminal and the rest of the desktop)                    |
-| File tree      | nvim-tree, toggled with `,,` (comma twice; was nerdtree)                                  |
+| File tree      | nvim-tree, toggled with `,,` (comma twice; was nerdtree)                               |
-| Fuzzy finder   | telescope (+fzf-native): `<leader>ff` files, `<leader>fg` grep, `<leader>fb` buffers      |
+| Fuzzy finder   | telescope (+fzf-native): `<leader>ff` files, `<leader>fg` grep, `<leader>fb` buffers   |
-| Format on save | conform-nvim (nixfmt, stylua, ruff, shfmt, prettier, gofumpt; LSP fallback otherwise)     |
+| Format on save | conform-nvim (nixfmt, stylua, ruff, shfmt, prettier, gofumpt; LSP fallback otherwise)  |
-| Git            | fugitive (`:Git …`) + gitsigns gutter signs/blame                                         |
+| Git            | fugitive (`:Git …`) + gitsigns gutter signs/blame                                      |
-| Diagnostics    | inline + trouble list (`<leader>xx`)                                                      |
+| Diagnostics    | inline + trouble list (`<leader>xx`)                                                   |
-| Completion     | nvim-cmp (LSP/buffer/path) with luasnip snippet expansion                                 |
+| Completion     | nvim-cmp (LSP/buffer/path) with luasnip snippet expansion                              |
-| Indent guides  | indent-blankline, on by default (was vim-indent-guides)                                   |
+| Indent guides  | indent-blankline, on by default (was vim-indent-guides)                                |
-| Statusline     | lualine (Catppuccin theme)                                                                |
+| Statusline     | lualine (Catppuccin theme)                                                             |
-| Editing        | which-key hints, comment (`gc`/`gcc`), autopairs, treesitter textobjects                  |
+| Editing        | which-key hints, comment (`gc`/`gcc`), autopairs, treesitter textobjects               |
-| Pane nav       | vim-tmux-navigator — `Ctrl`+`h/j/k/l` moves across vim splits and tmux panes              |
+| Pane nav       | vim-tmux-navigator — `Ctrl`+`h/j/k/l` moves across vim splits and tmux panes           |
-| Syntax         | tree-sitter (nix, lua, bash, markdown, groovy, c#, python, terraform, yaml)               |
+| Syntax         | tree-sitter (nix, lua, bash, markdown, groovy, c#, python, terraform, yaml)            |
-| LSP            | nvim-cmp completion + servers `nil_ls` (Nix), `lua_ls`, `pyright` (Python), `terraformls` |
+| LSP            | nvim-cmp completion + servers `nil` (Nix), `lua_ls`, `pyright` (Python), `terraformls` |
-| Indentation    | 2-wide hard tabs (`noexpandtab`, `tabstop`/`shiftwidth` = 2); line numbers on             |
+| Indentation    | 2-wide hard tabs (`noexpandtab`, `tabstop`/`shiftwidth` = 2); line numbers on          |
-| Filetypes      | `*Jenkinsfile` → groovy                                                                   |
+| Filetypes      | `*Jenkinsfile` → groovy                                                                |
 
 Leader is `Space`. LSP keymaps (`gd`, `gr`, `K`, `<leader>rn`, `<leader>ca`) and
 the file-tree toggle are listed in

home/git.nix

@@ -1,5 +1,6 @@
-# Version control: git + delta + commitizen + lazygit. Committer identity comes
+# Version control: git + delta pager + commitizen + lazygit. The committer
-# from the per-user `identity` arg (the registry). See README "Users".
+# identity (name, email, signing key) comes from the per-user `identity` arg,
+# derived from the registry (users/registry.nix) by mkHost.
 {
   pkgs,
   lib,
@@ -19,7 +20,8 @@ in
     package = pkgs.gitFull;
     settings = {
       user.name = identity.fullName;
-      # mkDefault so a host-specific module can still override it.
+      # Identity from the registry. mkDefault so a host-specific module can still
+      # override it without conflicting.
       user.email = lib.mkDefault identity.email;
       push.autoSetupRemote = true;
       init.defaultBranch = "main";
@@ -76,8 +78,9 @@ in
         cc = "!cz commit";
       };
 
-      # SSH signing, key from the registry. mkDefault so a host lacking the key
+      # SSH commit signing, key from the registry. mkDefault on the key and on
-      # in its agent can set gpgsign = false instead of failing every commit.
+      # gpgsign so a host without that key in its ssh-agent can override gpgsign
+      # to false rather than fail every commit.
       gpg.format = "ssh";
       user.signingkey = lib.mkDefault identity.signingKey;
       commit.gpgsign = lib.mkDefault true;

home/shell.nix

@@ -341,6 +341,9 @@ in
         IdentityFile = "~/.ssh/code.emmathe.dev";
         IdentitiesOnly = true;
       };
+      "dockerpi.inf.cbg.emmaisvery.gay" = {
+        User = "emmathorpe";
+      };
     };
   };
 

home/sway.nix

@@ -334,12 +334,13 @@ in
     ];
   };
 
-  # Night light. Manual location (no geoclue dependency); warmer at night,
+  # Night light. Manual location (no geoclue dependency); adjust the coordinates
-  # neutral by day. Coordinates come from the per-user module (e.g.
+  # to taste. Warmer at night, neutral by day.
-  # users/lyrathorpe/home.nix), not this shared module.
   services.gammastep = {
     enable = true;
     provider = "manual";
+    latitude = 51.5;
+    longitude = -0.13; # London-ish; set to your actual location
     temperature = {
       day = 6500;
       night = 3700;

hosts/EDaaS/configuration.nix

@@ -62,11 +62,6 @@
 
   features.swayDesktop.enable = false;
 
-  # Opt out of fleet-wide SSSD/Authentik LDAP auth: this is a work-managed WSL
-  # box, not part of the personal directory. Every other NixOS host inherits the
-  # default-true from modules/sssd.nix.
-  services.authentikLdap.enable = false;
-
   # NOTE: this user's systemd --user lingering -- so the home-manager renovate
   # timer fires without an open login session -- is enabled from the host table
   # in flake.nix (users.emmathorpe.linger = true) and applied by

hosts/MacPro31/configuration.nix

@@ -26,8 +26,10 @@
   # workstation.nix is the backstop).
   zramSwap.enable = true;
 
-  # sshd (daemon, port 22, key-only policy) comes from ../../modules/ssh.nix;
+  # This host accepts SSH, so open 22 (the firewall itself is enabled in
-  # the firewall itself is enabled in workstation.nix with a default-deny policy.
+  # workstation.nix with a default-deny policy).
+  services.openssh.enable = true;
+  networking.firewall.allowedTCPPorts = [ 22 ];
 
   # Dual Harpertown Xeon microcode. Redistributable firmware (GPU/NIC blobs) is
   # enabled in workstation.nix.

hosts/RPi5/configuration.nix

@@ -25,12 +25,15 @@
   boot.loader.grub.enable = false;
   boot.loader.generic-extlinux-compatible.enable = true;
 
-  # Remote administration: the daemon, port 22 and key-only policy all come from
+  # Remote administration. Key-only policy and the authorized key come from
-  # ../../modules/ssh.nix.
+  # ../../modules/ssh.nix; here we just enable the daemon and open the port.
+  services.openssh.enable = true;
 
-  # Default-deny inbound; the Docker and nginx submodules open their own ports
+  # Default-deny inbound. Open only SSH here; the Docker and nginx submodules
-  # (Docker via a source-restricted nftables rule, nginx via 80/443).
+  # open their own ports (Docker via a source-restricted nftables rule, nginx
+  # via 80/443). List-valued, so these merge with the submodule definitions.
   networking.firewall.enable = true;
+  networking.firewall.allowedTCPPorts = [ 22 ];
 
   # See `man configuration.nix` / the stateVersion docs before changing.
   system.stateVersion = "26.05";

hosts/RPi5/docker.nix

@@ -8,10 +8,6 @@
 # secure upgrade path is mutual TLS on 2376 (--tlsverify with client certs);
 # that needs out-of-band cert provisioning and is intentionally not wired here.
 { ... }:
-let
-  # LAN allowed to reach the unauthenticated Docker TCP socket (see SECURITY above).
-  trustedSubnet = "10.187.1.0/24";
-in
 {
   virtualisation.docker.enable = true;
 
@@ -33,6 +29,6 @@ in
   # CIDR to match the LAN that should reach the Docker API.
   networking.nftables.enable = true;
   networking.firewall.extraInputRules = ''
-    ip saddr ${trustedSubnet} tcp dport 2375 accept
+    ip saddr 10.187.1.0/24 tcp dport 2375 accept
   '';
 }

hosts/T400/configuration.nix

@@ -21,8 +21,10 @@
   # Low-RAM host (4 GiB max): a compressed RAM swap reduces disk paging.
   zramSwap.enable = true;
 
-  # sshd (daemon, port 22, key-only policy) comes from ../../modules/ssh.nix;
+  # This host accepts SSH, so open 22 (the firewall itself is enabled in
-  # the firewall itself is enabled in laptop.nix with a default-deny policy.
+  # laptop.nix with a default-deny policy).
+  services.openssh.enable = true;
+  networking.firewall.allowedTCPPorts = [ 22 ];
 
   # Intel Core 2 (Penryn) microcode. Redistributable firmware (enabled in
   # workstation.nix) supplies the iwlwifi blobs (Intel WiFi Link 5100/5300) and

modules/ssh.nix

@@ -1,11 +1,11 @@
-# sshd for the hosts that run it (T400, Mac Pro, RPi5): enable the daemon, open
+# Key-only SSH hardening, imported by the hosts that run sshd (T400, Mac Pro,
-# port 22, and apply a key-only policy. Authorized keys are owned per-user by the
+# RPi5). The host config still does `services.openssh.enable = true` and opens
-# registry (modules/users.nix), not here.
+# port 22 next to where it documents the listening service; this module only
+# tightens the policy so a host opting into sshd cannot accidentally ship
+# password/root login. Authorized keys are owned per-user by the identity
+# registry (users/registry.nix, applied via modules/users.nix), not here.
 { ... }:
 {
-  services.openssh.enable = true;
-  networking.firewall.allowedTCPPorts = [ 22 ];
-
   services.openssh.settings = {
     PasswordAuthentication = false; # keys only
     KbdInteractiveAuthentication = false; # no keyboard-interactive fallback

modules/sssd.nix

@@ -1,130 +0,0 @@
-# Authentik LDAP authentication for NixOS hosts.
-#
-# Wires SSSD (System Security Services Daemon) to the Authentik LDAP outpost so
-# every Linux host authenticates users against the same directory that backs the
-# SSO stack. Enabled by default on every NixOS host via baseModules; the EDaaS
-# WSL box opts out (services.authentikLdap.enable = false) because it is a
-# work-managed Windows-hosted environment.
-#
-# The Authentik LDAP provider exposes NON-standard object classes/attributes
-# (goauthentik.io/ldap/user, goauthentik.io/ldap/group) alongside the POSIX
-# attributes (uid, uidNumber, gidNumber, homeDirectory), so the schema mappings
-# below are explicit rather than relying on an RFC2307 default.
-#
-# The bind password is NOT inlined: services.sssd.config renders to the world-
-# readable Nix store, so the credential is delivered out-of-band by agenix as an
-# sssd.conf drop-in under /etc/sssd/conf.d/ (SSSD merges conf.d/*.conf after the
-# main file). See secrets/README.md.
-{
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.services.authentikLdap;
-
-  # Directory coordinates for the Authentik LDAP provider.
-  ldapUri = "ldaps://ldap.lyrapup.pet:636";
-  searchBase = "dc=ldap,dc=goauthentik,dc=io";
-  bindDn = "cn=sssd-bind,ou=users,dc=ldap,dc=goauthentik,dc=io";
-in
-{
-  options.services.authentikLdap.enable =
-    lib.mkEnableOption "SSSD authentication against the Authentik LDAP outpost"
-    // {
-      default = true;
-    };
-
-  config = lib.mkIf cfg.enable {
-    services.sssd = {
-      enable = true;
-
-      # Non-secret sssd.conf. The bind password is injected separately via the
-      # agenix conf.d drop-in (ldap_default_authtok lives there, not here) to
-      # keep it out of the Nix store.
-      config = ''
-        [sssd]
-        config_file_version = 2
-        services = nss, pam
-        domains = default
-
-        [nss]
-        # Do not walk the whole directory for `getent passwd` etc.
-        filter_users = root
-        filter_groups = root
-
-        [pam]
-
-        [domain/default]
-        # --- Providers --------------------------------------------------------
-        id_provider = ldap
-        auth_provider = ldap
-        chpass_provider = none
-        access_provider = permit
-
-        # --- Connection -------------------------------------------------------
-        ldap_uri = ${ldapUri}
-        ldap_search_base = ${searchBase}
-        ldap_default_bind_dn = ${bindDn}
-        ldap_default_authtok_type = password
-        # ldap_default_authtok is supplied by the agenix drop-in in conf.d.
-
-        # --- TLS (LDAPS on 636; no StartTLS) ---------------------------------
-        ldap_id_use_start_tls = false
-        ldap_tls_reqcert = demand
-
-        # --- Schema: Authentik LDAP provider ---------------------------------
-        # Authentik returns DN-valued group membership (member/memberOf), so
-        # rfc2307bis (not rfc2307) is the correct base schema.
-        ldap_schema = rfc2307bis
-
-        # Users: goauthentik.io/ldap/user, keyed by uid; POSIX attrs are
-        # standard names (uidNumber/gidNumber/homeDirectory).
-        ldap_user_object_class = goauthentik.io/ldap/user
-        ldap_user_name = uid
-        ldap_user_uid_number = uidNumber
-        ldap_user_gid_number = gidNumber
-        ldap_user_home_directory = homeDirectory
-        ldap_user_gecos = displayName
-        ldap_user_shell = loginShell
-
-        # Groups: goauthentik.io/ldap/group, keyed by cn.
-        ldap_group_object_class = goauthentik.io/ldap/group
-        ldap_group_name = cn
-        ldap_group_gid_number = gidNumber
-        ldap_group_member = member
-
-        # --- Behaviour --------------------------------------------------------
-        cache_credentials = true
-        enumerate = false
-      '';
-    };
-
-    # agenix delivers the bind password as an sssd.conf drop-in. The decrypted
-    # plaintext IS a valid conf.d snippet:
-    #
-    #   [domain/default]
-    #   ldap_default_authtok = <the bind password>
-    #
-    # SSSD requires conf.d files to be root-owned and 0600 or it ignores them.
-    age.secrets.ldap-bind = {
-      file = ../secrets/ldap-bind.age;
-      path = "/etc/sssd/conf.d/01-ldap-authtok.conf";
-      owner = "root";
-      group = "root";
-      mode = "0600";
-    };
-
-    # Restart SSSD when the credential drop-in changes. agenix writes secrets in
-    # a system activation script that runs before systemd (re)starts services on
-    # a `switch`, so the file is present by the time sssd starts; the trigger
-    # picks up rotations of the bind password.
-    systemd.services.sssd.restartTriggers = [ config.age.secrets.ldap-bind.path ];
-
-    # Create home directories on first login for LDAP users (they have no
-    # locally-provisioned home). NixOS wires nss + the SSSD PAM stack when
-    # services.sssd.enable is true; mkHomeDir adds pam_mkhomedir to it.
-    security.pam.services.login.makeHomeDir = true;
-    security.pam.services.sshd.makeHomeDir = true;
-  };
-}

modules/users.nix

@@ -1,5 +1,9 @@
-# System user accounts, built from the registry (users/registry.nix) for the
+# System-level user accounts, built from the identity registry
-# host's `hostUsers` set. See README "Users".
+# (users/registry.nix). `hostUsers` is the host's user set, threaded by mkHost
+# from the flake host table; `userRegistry` is the global identity table passed
+# as a specialArg. Every account's identity -- description, groups, authorized
+# keys -- comes from its registry entry, so no user data is hardcoded here and a
+# host may declare any number of users.
 {
   config,
   pkgs,
@@ -25,7 +29,9 @@
       openssh.authorizedKeys.keys = id.sshAuthorizedKeys;
       shell = pkgs.zsh;
     }
-    # linger opt-in (host table); left unmanaged when unset.
+    # Keep this user's systemd --user instance running without an open login
+    # session (e.g. for home-manager user timers). Only emitted when the host
+    # table opts in, so hosts that don't set it leave linger entirely unmanaged.
     // lib.optionalAttrs (spec ? linger) { inherit (spec) linger; }
   ) hostUsers;
 

secrets/README.md

@@ -1,92 +0,0 @@
-# Secrets (agenix)
-
-Encrypted secrets for the fleet, managed with [agenix](https://github.com/ryantm/agenix).
-
-Each secret is an age-encrypted file (`*.age`) encrypted to a set of recipient
-public keys declared in [`secrets.nix`](./secrets.nix). A host decrypts its
-secrets at activation using its SSH **host** key
-(`/etc/ssh/ssh_host_ed25519_key`), so every host that must read a secret has to
-be listed as a recipient for it.
-
-`secrets.nix` is read only by the `agenix` CLI. It is never imported into the
-NixOS evaluation.
-
-## Secrets in this repo
-
-| File            | Purpose                                                                 | Recipients                          |
-| --------------- | ----------------------------------------------------------------------- | ----------------------------------- |
-| `ldap-bind.age` | SSSD → Authentik LDAP bind credential, as an `sssd.conf` drop-in snippet | all SSSD-enabled hosts (not EDaaS)  |
-
-Consumed by [`modules/sssd.nix`](../modules/sssd.nix) via
-`age.secrets.ldap-bind.path`, which places the decrypted snippet at
-`/etc/sssd/conf.d/01-ldap-authtok.conf`.
-
-> **`ldap-bind.age` is not committed yet.** Only `ldap-bind.age.PLACEHOLDER`
-> ships in this change (real host recipient keys and the real password were not
-> available when it was written). Follow the steps below to create the real
-> secret, then delete the `.PLACEHOLDER`.
-
-## Owner setup checklist
-
-Run these once (per new host or when the bind password rotates):
-
-### 1. Collect host recipient keys
-
-On each SSSD-enabled host (all Linux hosts **except** EDaaS):
-
-```sh
-cat /etc/ssh/ssh_host_ed25519_key.pub
-```
-
-Paste each value into the matching placeholder in `secrets.nix`, replacing the
-`AAAA_PLACEHOLDER_REPLACE_ME_*` strings. (Optionally uncomment and set `admin`
-to an operator user key so the secret can be edited off-host.)
-
-### 2. Encrypt the bind password
-
-The plaintext must be a **full sssd.conf drop-in snippet**, because SSSD cannot
-read `ldap_default_authtok` from a separate file — it only merges `conf.d/*.conf`.
-The content is exactly:
-
-```ini
-[domain/default]
-ldap_default_authtok = <the sssd-bind service-account password>
-```
-
-Use the password of the `sssd-bind` (Terraform: `sssd-bind`) Authentik LDAP
-service account. Then, from the repo root:
-
-```sh
-# Requires the agenix CLI: `nix run github:ryantm/agenix -- -e secrets/ldap-bind.age`
-cd secrets
-agenix -e ldap-bind.age
-```
-
-An `$EDITOR` opens; paste the two-line snippet above, save, quit. agenix writes
-the encrypted `ldap-bind.age`. Commit it and delete `ldap-bind.age.PLACEHOLDER`.
-
-### 3. Rekey after changing recipients
-
-If you add/remove hosts in `secrets.nix`, re-encrypt every secret to the new
-recipient set:
-
-```sh
-cd secrets
-agenix -r
-```
-
-### 4. DNS
-
-`ldap.lyrapup.pet` must resolve to the Authentik LDAP outpost and serve LDAPS on
-port 636 with a certificate the hosts trust (`ldap_tls_reqcert = demand`). If the
-cert is not from a system-trusted CA, add it to the hosts' trust store
-(`security.pki.certificateFiles`) or relax `ldap_tls_reqcert` in
-`modules/sssd.nix`.
-
-### 5. Rebuild
-
-```sh
-sudo nixos-rebuild switch --flake .#<host>
-```
-
-Verify with `getent passwd <ldap-user>` and `id <ldap-user>`.

secrets/ldap-bind.age.PLACEHOLDER

@@ -1,21 +0,0 @@
-THIS IS A PLACEHOLDER, NOT A REAL AGE SECRET.
-
-The real secrets/ldap-bind.age is produced by the repo owner with `agenix -e`
-(see secrets/README.md) and is a binary age-encrypted blob. It is intentionally
-NOT committed here because:
-  * the real host age recipients are not available to the author of this change
-    (they are each host's /etc/ssh/ssh_host_ed25519_key.pub), and
-  * fabricating an encrypted blob or fake host keys would be misleading.
-
-Committing this file as `ldap-bind.age` would let modules/sssd.nix reference
-`../secrets/ldap-bind.age` and evaluate, but SSSD would fail to decrypt it at
-runtime. Do ONE of the following before deploying:
-
-  1. Preferred: generate the real secret (secrets/README.md), commit it as
-     secrets/ldap-bind.age, and delete this .PLACEHOLDER file.
-
-The decrypted plaintext must be a valid sssd.conf drop-in (NOT the bare
-password):
-
-    [domain/default]
-    ldap_default_authtok = <the sssd-bind service-account password>

secrets/secrets.nix

@@ -1,15 +0,0 @@
-let
-  lyrathorpe-mbp = "ssh-ed25519 AAAA_PLACEHOLDER_REPLACE_ME_mbp";
-  lyrathorpe-t400 = "ssh-ed25519 AAAA_PLACEHOLDER_REPLACE_ME_t400";
-  lyrathorpe-macpro31 = "ssh-ed25519 AAAA_PLACEHOLDER_REPLACE_ME_macpro31";
-  lyrathorpe-rpi5 = "ssh-ed25519 AAAA_PLACEHOLDER_REPLACE_ME_rpi5";
-  sssdHosts = [
-    lyrathorpe-mbp
-    lyrathorpe-t400
-    lyrathorpe-macpro31
-    lyrathorpe-rpi5
-  ];
-in
-{
-  "ldap-bind.age".publicKeys = sssdHosts;
-}

users/emmathorpe/work.nix

@@ -1,11 +1,8 @@
-# Work (EDaaS/WSL) home profile: corporate toolchain + tmux tweaks. Git identity
+# Home-manager module for the work (EDaaS/WSL) profile: corporate work toolchain
-# comes from the registry (users/registry.nix), not here.
+# packages and tmux tweaks. Imported only by the work host. The corporate git
-{
+# identity (email + signing key) is the emmathorpe entry in the identity
-  pkgs,
+# registry (users/registry.nix), applied by the shared home/git.nix.
-  lib,
+{ pkgs, lib, ... }:
-  inputs,
-  ...
-}:
 
 {
   # Host-scoped extras for this machine only (the EDaaS/WSL host).
@@ -29,6 +26,7 @@
     pkgs.powershell
     pkgs.nuget
     pkgs.gedit
+    pkgs.lens
     pkgs.python3
     pkgs.gnumake
     pkgs.gcc
@@ -52,10 +50,8 @@
     docker = "/run/current-system/sw/bin/docker";
   };
   programs.tmux = {
-    # kube context/namespace in the status line. kube-tmux is pinned as a flake
-    # input (it is not in nixpkgs), so the script is always present in the store.
     extraConfig = ''
-      set -g status-right "#(${pkgs.bash}/bin/bash ${inputs.kube-tmux}/kube.tmux 250 red black)"
+      			set -g status-right "#(/run/current-system/sw/bin/bash $HOME/code/kube-tmux/kube.tmux 250 red black)"		
     '';
   };
   programs.go = {

users/lyrathorpe/home.nix

@@ -1,17 +0,0 @@
-# Lyra's personal home extras, imported on her hosts (not the work box). Keeps
-# personal data out of the shared home/ modules. See README "Users".
-{ pkgs, lib, ... }:
-{
-  # Personal ssh host shortcut.
-  programs.ssh.settings."dockerpi.inf.cbg.emmaisvery.gay" = {
-    User = "emmathorpe";
-  };
-
-  # Night-light location for gammastep (the service itself is enabled by
-  # home/sway.nix on graphical hosts). Linux-guarded so Darwin, which imports
-  # this module but has no gammastep, skips it.
-  services.gammastep = lib.mkIf pkgs.stdenv.hostPlatform.isLinux {
-    latitude = 51.5;
-    longitude = -0.13;
-  };
-}

users/registry.nix

@@ -1,5 +1,14 @@
-# User identity registry -- pure data, keyed by username. See README "Users".
+# User identity registry -- pure data, no machinery. Keyed by username.
-# (`identity.username` is injected by mkHost, so it is not repeated here.)
+#
+# Each entry describes WHO a user is (display name, email, authorized/signing
+# keys, supplementary groups). The reusable modules read this indirectly:
+#   - system: modules/users.nix builds users.users.* from `userRegistry`
+#     (specialArg) restricted to the host's `hostUsers` set.
+#   - home:   home/git.nix and home/desktop.nix read the per-user `identity`
+#     module arg, which mkHost derives from the matching registry entry.
+#
+# The login name is injected by mkHost as `identity.username`, so it is not
+# repeated inside each entry here.
 {
   lyrathorpe = {
     fullName = "Lyra Thorpe";
@@ -21,7 +30,10 @@
       "wheel"
       "docker"
     ];
-    # No personal key on file yet; add one if SSH login as emmathorpe is wanted.
+    # No personal authorized key on file yet. The previous shared user module
+    # applied Lyra's key to every account, including this one -- a defect. Leave
+    # this empty until a real key is provisioned; SSH login is moot on the WSL
+    # host (entered via wsl.exe, not sshd).
     sshAuthorizedKeys = [ ];
     signingKey = "key::ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAJMVgeRKnfX1G8coU3nAobI485aeUpGTMqH7+zbKI8o emma.thorpe@cloud.com";
   };