# Work WSL box — `emmathorpe-edaas`

Flake host: `emmathorpe-edaas` (`x86_64-linux`). NixOS running under
**NixOS-WSL** on the corporate Windows machine. Headless: no Sway desktop
(`features.swayDesktop.enable = false`), plain WSL shell login. Files:
`configuration.nix`.

## What this host is

The day-to-day work environment. It layers the corporate Kubernetes / Helm /
Terraform / cloud toolchain and a couple of work-only editor language servers on
top of the shared home profile. The system config here is thin — it is mostly
WSL plumbing; the user-facing tooling lives in
[`../../users/emmathorpe/work.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/users/emmathorpe/work.nix).

## WSL specifics

- `wsl.enable`, default user `emmathorpe`, Windows PATH interop and start-menu
  launchers on. `/etc/hosts` generation is off (`generateHosts = false`).
- **Docker Desktop integration**, not the native daemon as the primary path:
  `wsl.extraBin` shims the coreutils/`groupadd`/`usermod` binaries Docker
  Desktop's `wsl-distro-proxy` expects, and `docker-desktop-proxy.script` is
  patched to the real proxy path. The native `virtualisation.docker` is also
  enabled (with `enableOnBoot` + `autoPrune`).
- `programs.ssh.systemd-ssh-proxy.enable = false` — the NixOS-WSL store is a
  read-only VHD owned by `nobody`, and OpenSSH rejects the generated
  `ssh-proxy` Include as "Bad owner or permissions", which would break ssh/git
  for every command. The vsock proxy it provides is unused under WSL.
- `networking.hostName = "emmathorpe-edaas"` matches the flake attribute so
  `nh os switch` resolves without `-H`.

## Renovate review timer

The host-table entry sets `users.emmathorpe.linger = true` so the user's
`systemd --user` instance stays alive without an open login session. That keeps
the daily headless **Renovate PR review** timer firing — defined in
[`../../users/emmathorpe/renovate-review.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/users/emmathorpe/renovate-review.nix)
(imported only from `work.nix`, so it exists on this machine alone). See that
file's header for the auth (Vertex AI ADC), triage policy, and caveats.

## Secret Service (keychain)

`work.nix` sets `services.headlessSecretService.enable = true`, which runs
`gnome-keyring` as a `systemd --user` service owning `org.freedesktop.secrets`
on the session bus, with the login keyring unlocked at start.

This exists for **gcx**, the Grafana Cloud CLI. gcx stores its OAuth access and
refresh tokens in the keychain unconditionally (its config keeps only opaque
`keychain:gcx:v2:...` handles) and has no plaintext fallback, so without a
Secret Service `gcx login` authenticates and then fails to persist with "The
name is not activatable".

Home-manager's own `services.gnome-keyring` does not work here: it is
`WantedBy=graphical-session-pre.target`, which never activates on this headless
box, and it cannot unlock the keyring. See
[`../../home/secret-service.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/home/secret-service.nix) for the full
rationale and the security trade-off of an auto-unlocked keyring.

Only the `secrets` component is started. The `ssh` component is deliberately off
— it would claim `SSH_AUTH_SOCK` and displace `services.ssh-agent`, breaking SSH
auth and signed commits.

Checking it:

```sh
systemctl --user status headless-secret-service
busctl --user list | grep secrets     # expect org.freedesktop.secrets
secret-tool search --all service gcx  # inspect what gcx stored
gcx config check                      # end-to-end
```

If the keyring password is ever lost or changed, the login keyring cannot be
unlocked: delete `~/.local/share/keyrings` and re-run `gcx login`.

## stateVersion

`system.stateVersion = "24.11"` — the release this box was first installed on.
Leave it; it freezes stateful defaults and is not meant to track the current
nixpkgs.

## Apply

```sh
sudo nixos-rebuild switch --flake .#emmathorpe-edaas
# or, since the hostname matches the attribute:
nh os switch
```