chore: post-refactor cleanups (#50-#53) #54

2026-06-29T13:29:53+01:00

lyrathorpe commented

2026-06-29 13:29:53 +01:00

Summary

Follow-up cleanups from the post-refactor audit (issues #50–#53). All behaviour-preserving except the work-host changes (kube-tmux + Lens removal).

Changes

#51 refactor(ssh) — move services.openssh.enable + firewall.allowedTCPPorts = [ 22 ] into modules/ssh.nix; drop the duplicated lines from T400, MacPro31, RPi5.
#50 fix/feat(work) — load kube-tmux from a pinned flake = false input (it is not in nixpkgs) and reference ${inputs.kube-tmux}/kube.tmux directly, so the status line no longer depends on a manual $HOME/code/kube-tmux checkout. (Supersedes the interim file-existence guard.)
#52 chore — gitignore the untracked tf-inspect/ scratch project.
#53 chore — remove the unused Lens package entirely (pkgs.lens + its unfree entry; unfreePackages is now just claude-code), fix the nil→nil_ls LSP doc, remove the redundant .editorconfig block, name the RPi5 Docker subnet in a let binding.

Deferred (from #53, noted in the commit)

.gitignore firmware entry — documented behaviour, low value, left as-is.
Per-eval nixpkgs-unstable overlay import — inherently per-system; no clean single-import hoist.

Verification

nix flake check passes (treefmt, deadnix, statix, pre-commit, all hosts + Darwin + homeConfigurations).
Derivation-path diff vs main: lyrathorpe-mbp, lyrathorpe-t400, lyrathorpe-macpro31, lyrathorpe-rpi5 are byte-identical (confirms #51 and the subnet let binding change nothing). Only emmathorpe-edaas differs — the kube-tmux input (#50) and the Lens removal (#53).

Closes #50, #51, #52, #53.

## Summary Follow-up cleanups from the post-refactor audit (issues #50–#53). All behaviour-preserving except the work-host changes (kube-tmux + Lens removal). ## Changes - **#51** `refactor(ssh)` — move `services.openssh.enable` + `firewall.allowedTCPPorts = [ 22 ]` into `modules/ssh.nix`; drop the duplicated lines from T400, MacPro31, RPi5. - **#50** `fix/feat(work)` — load kube-tmux from a pinned `flake = false` input (it is not in nixpkgs) and reference `${inputs.kube-tmux}/kube.tmux` directly, so the status line no longer depends on a manual `$HOME/code/kube-tmux` checkout. (Supersedes the interim file-existence guard.) - **#52** `chore` — gitignore the untracked `tf-inspect/` scratch project. - **#53** `chore` — remove the unused Lens package entirely (`pkgs.lens` + its unfree entry; `unfreePackages` is now just `claude-code`), fix the `nil`→`nil_ls` LSP doc, remove the redundant `.editorconfig` block, name the RPi5 Docker subnet in a `let` binding. ## Deferred (from #53, noted in the commit) - `.gitignore` firmware entry — documented behaviour, low value, left as-is. - Per-eval `nixpkgs-unstable` overlay import — inherently per-system; no clean single-import hoist. ## Verification - `nix flake check` passes (treefmt, deadnix, statix, pre-commit, all hosts + Darwin + homeConfigurations). - Derivation-path diff vs `main`: `lyrathorpe-mbp`, `lyrathorpe-t400`, `lyrathorpe-macpro31`, `lyrathorpe-rpi5` are byte-identical (confirms #51 and the subnet `let` binding change nothing). Only `emmathorpe-edaas` differs — the kube-tmux input (#50) and the Lens removal (#53). Closes #50, #51, #52, #53.

lyrathorpe added 3 commits 2026-06-29 13:29:53 +01:00

refactor(ssh): consolidate sshd enable and port 22 into modules/ssh.nix e42f368d72

The daemon enable and the firewall port were duplicated in each sshd host
(T400, Mac Pro, RPi5). Move both into modules/ssh.nix so importing it both
hardens and enables sshd; drop the per-host copies. No build change: the
three hosts evaluate to identical derivations.

Closes #51

fix(work): guard the kube-tmux status line on the script's presence b605515f05

The tmux status-right shelled out to $HOME/code/kube-tmux/kube.tmux by
absolute path; on a checkout without that external repo every status refresh
errored. Wrap it in a file-existence test so it degrades quietly.

Closes #50

chore: gitignore the local tf-inspect scratch project e275be3660

tf-inspect/ is a separate project living untracked in the repo root; ignore
it so it stops showing in git status and cannot be lost to git clean.

Closes #52

lyrathorpe added 1 commit 2026-06-29 13:34:29 +01:00

chore: minor cleanups (remove unused lens, LSP doc, editorconfig, docker subnet)

CI / flake (pull_request) Successful in 3m30s

Details

41ef023c70

- Remove the unused Lens package entirely: drop pkgs.lens from the work host
  and its unfree entry from flake.nix. Nothing else needed it, so
  unfreePackages is now just claude-code. (pkgs.lens has pname
  "lens-desktop", which was the string the unfree predicate matched.)
- home/README.md: the Nix LSP is nil_ls, not nil.
- .editorconfig: remove the rule block that duplicated the [*] defaults.
- hosts/RPi5/docker.nix: name the trusted Docker subnet in a let binding
  rather than repeating the literal CIDR.

Deferred from the audit bundle: the .gitignore firmware entry (documented,
low value) and the per-eval nixpkgs-unstable overlay import (inherently
per-system, no clean hoist).

Closes #53

lyrathorpe force-pushed chore/post-refactor-cleanups from ff5fe16728 to 41ef023c70

2026-06-29 13:34:29 +01:00

Compare

lyrathorpe added 1 commit 2026-06-29 14:05:38 +01:00

feat(work): load kube-tmux from a pinned flake input

CI / flake (pull_request) Successful in 3m35s

Details

04171febf1

kube-tmux is not in nixpkgs, so add the upstream repo as a flake = false
input and reference ${inputs.kube-tmux}/kube.tmux directly. The script is now
always in the store, so the previous $HOME/code/kube-tmux existence guard is
removed and the tmux status line no longer depends on a manual checkout.

Refs #50

lyrathorpe merged commit c06a57f249 into main

2026-06-29 14:09:38 +01:00

lyrathorpe deleted branch chore/post-refactor-cleanups

2026-06-29 14:09:39 +01:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: lyrathorpe/nixfiles#54