chore: minor cleanups (lens unfree name, LSP doc, editorconfig, docker subnet)

- flake.nix: drop the dead "lens" unfree entry; pkgs.lens is named
  "lens-desktop", which is the name the predicate actually matches.
- home/README.md: the Nix LSP is nil_ls, not nil.
- .editorconfig: remove the rule block that duplicated the [*] defaults.
- hosts/RPi5/docker.nix: name the trusted Docker subnet in a let binding
  rather than repeating the literal CIDR.

Deferred from the audit bundle: the .gitignore firmware entry (documented,
low value) and the per-eval nixpkgs-unstable overlay import (inherently
per-system, no clean hoist).

Closes #53

README.md

@@ -12,67 +12,16 @@ Defined in the host table in [`flake.nix`](./flake.nix):
 | `lyrathorpe-mbp`      | `aarch64-linux`  | MacBook Pro (Apple Silicon, Asahi)                                                                          |
 | `lyrathorpe-t400`     | `x86_64-linux`   | ThinkPad T400 — [install notes](./hosts/T400/README.md)                                                     |
 | `lyrathorpe-macpro31` | `x86_64-linux`   | Mac Pro 3,1, desktop — [install notes](./hosts/MacPro31/README.md)                                          |
-| `emmathorpe-edaas`    | `x86_64-linux`   | Work WSL box (NixOS-WSL) — [notes](./hosts/EDaaS/README.md)                                                 |
+| `emmathorpe-edaas`    | `x86_64-linux`   | Work WSL box (NixOS-WSL)                                                                                    |
 | `lyrathorpe-rpi5`     | `aarch64-linux`  | Raspberry Pi 5 headless server: Docker host + nginx reverse proxy — [install notes](./hosts/RPi5/README.md) |
-| `lyrathorpe-mac`      | `aarch64-darwin` | macOS (nix-darwin) — [notes](./hosts/Darwin/README.md)                                                      |
+| `lyrathorpe-mac`      | `aarch64-darwin` | macOS (nix-darwin)                                                                                          |
 
 Shared layers: `home` (home-manager: shell, git, editor),
 `modules/common-nixos.nix` (all NixOS hosts: fonts, nix-ld, caches),
 `modules/workstation.nix` (physical graphical hosts: audio, thermald,
 earlyoom, fwupd), `modules/laptop.nix` (laptops: Wi-Fi, Bluetooth, power,
-lid), `modules/desktop.nix` (wired desktops: NetworkManager), and
+lid), and `modules/ssh.nix` (key-only sshd). The x86 hosts also pull
-`modules/ssh.nix` (key-only sshd). The x86 hosts also pull `nixos-hardware`
+`nixos-hardware` profiles.
-profiles. The full module catalogue is below.
-
-## Repository layout
-
-```
-flake.nix              # inputs, mkHost/mkDarwinHost, the host tables, dev shell + checks
-flake.lock             # pinned input revisions (Renovate keeps this fresh)
-modules/               # reusable NixOS system modules (see "Module catalogue")
-home/                  # home-manager profile: shell, git, editor, claude, desktop, sway
-users/                 # identity registry + per-user home extras (see "Users")
-hosts/<Name>/          # per-machine config: configuration.nix + hardware-configuration.nix
-lib/                   # small pure helpers (currently the Catppuccin Mocha palette)
-.gitea/workflows/      # CI (nix flake check + per-host eval)
-statix.toml            # lint config (house-style lints disabled)
-.editorconfig          # base whitespace style
-tf-inspect/            # UNRELATED scratch project (gitignored, its own git repo);
-                       #   RouterOS / home-services Terraform, not part of this flake
-```
-
-Each `nixosConfiguration` / `darwinConfiguration` is assembled in `flake.nix`
-from three layers: the shared `baseModules` (or `darwinBaseModules`), the
-per-form-factor and `nixos-hardware` modules listed in the host table, and the
-per-machine `hosts/<Name>/configuration.nix`. Home-manager is wired in as a
-system module; each user's home is composed from the `homeModules` list in that
-host's table entry.
-
-## Module catalogue
-
-Reusable NixOS modules under [`modules/`](./modules). "Imported by" says how a
-module reaches a host: **baseModules** (every NixOS host, via `flake.nix`),
-**host table** (listed explicitly per host in `flake.nix`), or **transitively**
-(pulled in by another module's `imports`).
-
-| Module             | Imported by                       | What it does / when to use it                                                                                                                                                                             |
-| ------------------ | --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `common-nixos.nix` | baseModules (all NixOS)           | Timezone/locale, store hygiene (auto-optimise, big download buffer, **no** auto-GC), the nix-community binary cache, `nix-ld`, base CLI (`git`, `fastfetch`), and the fleet-wide font stack.              |
-| `users.nix`        | baseModules (all NixOS)           | Builds `users.users` from the registry for the host's `hostUsers`; enables zsh; enables Firefox + Thunderbird **only** when `features.swayDesktop.enable` is on. Applies per-user `linger`.               |
-| `features.nix`     | baseModules (all NixOS)           | Declares feature-flag options (currently `features.swayDesktop.enable`) so any host can read/set them without importing the heavy implementation module.                                                  |
-| `workstation.nix`  | transitively (via laptop/desktop) | Form-factor-agnostic base for physical graphical hosts: turns on `swayDesktop`, Dvorak console, PipeWire, firewall (default-deny), fstrim, earlyoom, fwupd, thermald (x86), redistributable fw.           |
-| `laptop.nix`       | host table (MBP, T400)            | `imports` workstation.nix, then adds the portable bits: iwd Wi-Fi, lid suspend/lock, Bluetooth + blueman.                                                                                                 |
-| `desktop.nix`      | host table (Mac Pro)              | `imports` workstation.nix, then swaps Wi-Fi for wired NetworkManager. Pair with `portable = false` in the host table.                                                                                     |
-| `sway.nix`         | host table (graphical hosts)      | Implementation of `features.swayDesktop`: the system Sway package, the greetd/ReGreet (cage) greeter forced to Dvorak, xdg-portal, Wayland utility packages. Home-side Sway config is in `home/sway.nix`. |
-| `ssh.nix`          | host table (T400, Mac Pro, RPi5)  | Enables sshd, opens port 22, enforces a key-only policy (no password / keyboard-interactive, no root). Authorized keys come from the registry via `users.nix`.                                            |
-| `firmware/`        | referenced by MBP host config     | Committed Apple peripheral firmware blobs for the Asahi MBP (see "MacBook (Asahi) firmware").                                                                                                             |
-
-Form-factor decision: a **laptop** imports `laptop.nix` (default
-`portable = true`); a **wired desktop** imports `desktop.nix` and sets
-`portable = false`; a **headless server** imports neither (leaves
-`features.swayDesktop.enable` at its default `false`) and adds only what it
-serves. `portable` is threaded through to `home/sway.nix`, which drops the
-battery block and brightness keys on desktops.
 
 ## Users
 
@@ -89,16 +38,6 @@ Identity is data, kept separate from the reusable modules:
   identity into that user's home config as the `identity` module arg. A host can
   therefore declare any number of users.
 
-Per-user home extras live under `users/<name>/`:
-
-- [`users/lyrathorpe/home.nix`](./users/lyrathorpe/home.nix) — personal extras
-  (an ssh host shortcut, gammastep coordinates); imported on Lyra's hosts.
-- [`users/emmathorpe/work.nix`](./users/emmathorpe/work.nix) — the work
-  toolchain (kubectl/helm/az/etc.), work-only LSP servers, and the corporate ssh
-  handling; imports
-  [`users/emmathorpe/renovate-review.nix`](./users/emmathorpe/renovate-review.nix),
-  the daily headless Renovate-PR review timer (EDaaS only).
-
 ### Portable home (off-NixOS / external consumers)
 
 The home config is also exposed for use beyond these hosts:
@@ -122,36 +61,6 @@ sudo nixos-rebuild switch --flake .#<configuration>
 darwin-rebuild switch --flake .#lyrathorpe-mac
 ```
 
-On a host whose `networking.hostName` matches its flake attribute (the WSL box
-and the Pi are set up this way), `nh os switch` resolves the configuration from
-the hostname with no `--flake`/`-H` flag.
-
-## Adding a new host
-
-1. **Create `hosts/<Name>/`.** Add `configuration.nix` with the host-specific
-   bits only: `networking.hostName`, bootloader (firmware-specific — it is
-   deliberately not set in the shared modules), and any per-machine hardware
-   quirks. Keep anything reusable in `modules/` instead.
-2. **Hardware config.** Generate `hardware-configuration.nix` on the real
-   machine with `nixos-generate-config` and commit it. If the machine does not
-   exist yet, commit a clearly-labelled placeholder so the host still evaluates
-   in CI (see the existing T400 / RPi5 placeholders), and replace it at install.
-   These files are excluded from the formatter and linters.
-3. **Add a host-table entry in `flake.nix`.** Under `hosts` (NixOS) or
-   `darwinHosts` (macOS), set `system`, the `modules` list (host config + form
-   factor + any `nixos-hardware` profiles), and the `users` map (each user's
-   `homeModules`). Choose the form factor per the decision note above; a headless
-   host imports neither `laptop.nix` nor `desktop.nix`.
-4. **Users.** If the host introduces a new person, add them to
-   `users/registry.nix` first; otherwise reference an existing username.
-5. **Verify.** `nix flake check` formats, lints, and evaluates every host —
-   including the new one — so a broken entry fails locally before CI. Then
-   `sudo nixos-rebuild switch --flake .#<configuration>` on the machine.
-
-No change to CI is needed: the host-eval step discovers hosts from the flake
-(`attrNames` of the configuration sets), so a new entry is picked up
-automatically.
-
 ## Shell environment & keybindings
 
 - Interactive shell features (zsh, tmux, git, ssh, CLI tools, auto-tmux):
@@ -202,7 +111,4 @@ A dev shell and a formatting/lint gate are wired through the flake:
 
 [`.gitea/workflows/ci.yaml`](./.gitea/workflows/ci.yaml) runs `nix flake check`
 (formatting, `deadnix`, `statix`, the pre-commit hooks) and evaluates every
-NixOS and Darwin host configuration on push/PR. It always runs (no `paths:`
+NixOS and Darwin host configuration on push/PR.
-filter) so the required check never hangs pending; the heavy Nix steps are
-skipped when a PR touches no `.nix`/lockfile/workflow file, and the job still
-reports green.

flake.lock

@@ -191,22 +191,6 @@
         "type": "github"
       }
     },
-    "kube-tmux": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1779714285,
-        "narHash": "sha256-l1wjg2ReWKCI7h/K11vvX2ykYTs/mVD+tfz/mQsjn/E=",
-        "owner": "jonmosco",
-        "repo": "kube-tmux",
-        "rev": "8b7e1d127c16b6dc87ff5743f4d775b245198b69",
-        "type": "github"
-      },
-      "original": {
-        "owner": "jonmosco",
-        "repo": "kube-tmux",
-        "type": "github"
-      }
-    },
     "nix-darwin": {
       "inputs": {
         "nixpkgs": [
@@ -389,7 +373,6 @@
         "flake-parts": "flake-parts",
         "git-hooks": "git-hooks",
         "home-manager": "home-manager",
-        "kube-tmux": "kube-tmux",
         "nix-darwin": "nix-darwin",
         "nix-homebrew": "nix-homebrew",
         "nix-index-database": "nix-index-database",

flake.nix

@@ -60,13 +60,6 @@
       url = "github:NixOS/nixos-hardware";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    # kube-tmux: kube context/namespace for the tmux status line on the work
-    # host. Not in nixpkgs and not a flake -- pinned here as a plain source so
-    # the script is always in the store (no manual checkout). See work.nix.
-    kube-tmux = {
-      url = "github:jonmosco/kube-tmux";
-      flake = false;
-    };
   };
 
   outputs =
@@ -100,6 +93,7 @@
         # Unfree packages permitted to be built (replaces blanket allowUnfree).
         unfreePackages = [
           "claude-code"
+          "lens-desktop" # the name of pkgs.lens (used on the work host)
         ];
 
         # Per-user identity, keyed by username. See README "Users".

hosts/Darwin/README.md

@@ -1,51 +0,0 @@
-# macOS (nix-darwin) — `lyrathorpe-mac`
-
-Flake host: `lyrathorpe-mac` (`aarch64-darwin`). Apple Silicon Mac managed by
-**nix-darwin** from this same flake. Built via `mkDarwinHost` (single-user —
-macOS owns the account; identity still comes from the registry). Files:
-`configuration.nix`.
-
-## What this host is
-
-A macOS workstation. The interactive user environment (shell, git, editor,
-Claude) is the **shared `../../home` bundle** — the same modules the Linux hosts
-use — so the terminal experience matches. The Linux-only `desktop.nix`/`sway.nix`
-are intentionally left out. This host config covers the macOS-specific layer:
-system packages, Homebrew, and macOS UI defaults.
-
-## Package sourcing
-
-- **nixpkgs** (`environment.systemPackages`) for CLI tooling and libraries.
-- **Homebrew**, owned declaratively by `nix-homebrew` (Rosetta enabled for
-  x86_64 formulae). The `brews`/`casks` lists are **authoritative**:
-  `onActivation.cleanup = "zap"` uninstalls anything not declared. GUI apps are
-  casks (nixpkgs darwin GUI support is unreliable); a few version-pinned
-  toolchains and the PWA host stay on brew for continuity.
-- **Mac App Store** apps are **not** declarative: nix-darwin 26.05 runs
-  activation as root, and `mas` cannot reach the App Store session from root.
-  Install them by hand with `mas install <id>` from a GUI Terminal (the `mas`
-  CLI is in `environment.systemPackages`).
-
-## macOS integration
-
-- `security.pam.services.sudo_local` — **Touch ID for sudo** (and
-  `darwin-rebuild`'s sudo prompt), kept in `sudo_local` so it survives OS
-  updates. `reattach` pulls in `pam_reattach` so Touch ID works inside tmux
-  (which the terminals auto-start).
-- `system.defaults` — declarative dock / finder / global / trackpad preferences,
-  applied on activation and reversible. This is the main reason to run nix-darwin
-  beyond package management.
-- The JetBrainsMono Nerd Font is installed to `/Library/Fonts`; set it in
-  iTerm2 (Settings → Profiles → Text → Font) so the tmux statusline glyphs
-  render.
-
-## stateVersion
-
-`system.stateVersion = 5` (the nix-darwin state version, an integer — not a
-NixOS release string). Read `darwin-rebuild changelog` before changing it.
-
-## Apply
-
-```sh
-darwin-rebuild switch --flake .#lyrathorpe-mac
-```

hosts/EDaaS/README.md

@@ -1,53 +0,0 @@
-# Work WSL box — `emmathorpe-edaas`
-
-Flake host: `emmathorpe-edaas` (`x86_64-linux`). NixOS running under
-**NixOS-WSL** on the corporate Windows machine. Headless: no Sway desktop
-(`features.swayDesktop.enable = false`), plain WSL shell login. Files:
-`configuration.nix`.
-
-## What this host is
-
-The day-to-day work environment. It layers the corporate Kubernetes / Helm /
-Terraform / cloud toolchain and a couple of work-only editor language servers on
-top of the shared home profile. The system config here is thin — it is mostly
-WSL plumbing; the user-facing tooling lives in
-[`../../users/emmathorpe/work.nix`](../../users/emmathorpe/work.nix).
-
-## WSL specifics
-
-- `wsl.enable`, default user `emmathorpe`, Windows PATH interop and start-menu
-  launchers on. `/etc/hosts` generation is off (`generateHosts = false`).
-- **Docker Desktop integration**, not the native daemon as the primary path:
-  `wsl.extraBin` shims the coreutils/`groupadd`/`usermod` binaries Docker
-  Desktop's `wsl-distro-proxy` expects, and `docker-desktop-proxy.script` is
-  patched to the real proxy path. The native `virtualisation.docker` is also
-  enabled (with `enableOnBoot` + `autoPrune`).
-- `programs.ssh.systemd-ssh-proxy.enable = false` — the NixOS-WSL store is a
-  read-only VHD owned by `nobody`, and OpenSSH rejects the generated
-  `ssh-proxy` Include as "Bad owner or permissions", which would break ssh/git
-  for every command. The vsock proxy it provides is unused under WSL.
-- `networking.hostName = "emmathorpe-edaas"` matches the flake attribute so
-  `nh os switch` resolves without `-H`.
-
-## Renovate review timer
-
-The host-table entry sets `users.emmathorpe.linger = true` so the user's
-`systemd --user` instance stays alive without an open login session. That keeps
-the daily headless **Renovate PR review** timer firing — defined in
-[`../../users/emmathorpe/renovate-review.nix`](../../users/emmathorpe/renovate-review.nix)
-(imported only from `work.nix`, so it exists on this machine alone). See that
-file's header for the auth (Vertex AI ADC), triage policy, and caveats.
-
-## stateVersion
-
-`system.stateVersion = "24.11"` — the release this box was first installed on.
-Leave it; it freezes stateful defaults and is not meant to track the current
-nixpkgs.
-
-## Apply
-
-```sh
-sudo nixos-rebuild switch --flake .#emmathorpe-edaas
-# or, since the hostname matches the attribute:
-nh os switch
-```

hosts/MacPro31/README.md

@@ -48,7 +48,7 @@ gigabit ports.
 ## Login
 
 Graphical login via a Wayland greeter — `greetd` running ReGreet inside the
-`cage` kiosk compositor — configured centrally in `../../modules/sway.nix` for
+`cage` kiosk compositor — configured centrally in `lyrathorpe/swaywm.nix` for
 every Sway host (gated on `features.swayDesktop.enable`). The greeter is forced
 to the Dvorak layout to match the console and Sway session. Set the user
 password (`passwd lyrathorpe`) after install, or the greeter cannot

hosts/RPi5/README.md

@@ -15,7 +15,7 @@ Headless `aarch64-linux` server with two roles:
    ```sh
    nixos-generate-config --root /mnt
    # copy /mnt/etc/nixos/hardware-configuration.nix over
-   # hosts/RPi5/hardware-configuration.nix in this repo, then commit
+   # system/machine/RPi5/hardware-configuration.nix in this repo, then commit
    ```
    `hardware-configuration.nix` in this directory is a **placeholder** committed
    only so the host evaluates in CI. The machine will not boot correctly until it
@@ -28,8 +28,7 @@ Headless `aarch64-linux` server with two roles:
    nh os switch
    ```
 4. Give the login user a password (`passwd lyrathorpe`) and confirm the key in
-   the user registry (`../../users/registry.nix`, applied by
+   `system/modules/ssh.nix` is the one you will connect with.
-   `../../modules/ssh.nix`) is the one you will connect with.
 
 ## Docker socket (security)
 

hosts/T400/README.md

@@ -35,7 +35,7 @@ change and `radeon` stays idle.
 ## Login
 
 Graphical login via a Wayland greeter — `greetd` running ReGreet inside the
-`cage` kiosk compositor — configured centrally in `../../modules/sway.nix` for
+`cage` kiosk compositor — configured centrally in `lyrathorpe/swaywm.nix` for
 every Sway host (gated on `features.swayDesktop.enable`). The greeter is forced
 to the Dvorak layout to match the console and Sway session. Set the user
 password (`passwd lyrathorpe`) after install, or the greeter cannot

users/emmathorpe/work.nix

@@ -1,11 +1,6 @@
 # Work (EDaaS/WSL) home profile: corporate toolchain + tmux tweaks. Git identity
 # comes from the registry (users/registry.nix), not here.
-{
+{ pkgs, lib, ... }:
-  pkgs,
-  lib,
-  inputs,
-  ...
-}:
 
 {
   # Host-scoped extras for this machine only (the EDaaS/WSL host).
@@ -29,6 +24,7 @@
     pkgs.powershell
     pkgs.nuget
     pkgs.gedit
+    pkgs.lens
     pkgs.python3
     pkgs.gnumake
     pkgs.gcc
@@ -52,10 +48,10 @@
     docker = "/run/current-system/sw/bin/docker";
   };
   programs.tmux = {
-    # kube context/namespace in the status line. kube-tmux is pinned as a flake
+    # kube-tmux is an external checkout; guard on its presence so the status
-    # input (it is not in nixpkgs), so the script is always present in the store.
+    # line degrades gracefully (no per-refresh error) when it isn't cloned.
     extraConfig = ''
-      set -g status-right "#(${pkgs.bash}/bin/bash ${inputs.kube-tmux}/kube.tmux 250 red black)"
+      set -g status-right "#(if [ -f $HOME/code/kube-tmux/kube.tmux ]; then /run/current-system/sw/bin/bash $HOME/code/kube-tmux/kube.tmux 250 red black; fi)"
     '';
   };
   programs.go = {