# nixfiles

NixOS / nix-darwin / home-manager configuration for all hosts, built from a
single flake.

## Hosts

Defined in the host table in [`flake.nix`](./flake.nix):

| Configuration         | System           | Machine                                                                                                     |
| --------------------- | ---------------- | ----------------------------------------------------------------------------------------------------------- |
| `lyrathorpe-mbp`      | `aarch64-linux`  | MacBook Pro (Apple Silicon, Asahi)                                                                          |
| `lyrathorpe-t400`     | `x86_64-linux`   | ThinkPad T400 — [install notes](./hosts/T400/README.md)                                                     |
| `lyrathorpe-macpro31` | `x86_64-linux`   | Mac Pro 3,1, desktop — [install notes](./hosts/MacPro31/README.md)                                          |
| `emmathorpe-edaas`    | `x86_64-linux`   | Work WSL box (NixOS-WSL)                                                                                    |
| `lyrathorpe-rpi5`     | `aarch64-linux`  | Raspberry Pi 5 headless server: Docker host + nginx reverse proxy — [install notes](./hosts/RPi5/README.md) |
| `lyrathorpe-mac`      | `aarch64-darwin` | macOS (nix-darwin)                                                                                          |

Shared layers: `home` (home-manager: shell, git, editor),
`modules/common-nixos.nix` (all NixOS hosts: fonts, nix-ld, caches),
`modules/workstation.nix` (physical graphical hosts: audio, thermald,
earlyoom, fwupd), `modules/laptop.nix` (laptops: Wi-Fi, Bluetooth, power,
lid), and `modules/ssh.nix` (key-only sshd). The x86 hosts also pull
`nixos-hardware` profiles.

## Users

Identity is data, kept separate from the reusable modules:

- [`users/registry.nix`](./users/registry.nix) — one entry per user (display
  name, email, supplementary groups, authorized + signing keys). This is the
  single source of identity; no user data is hardcoded in the modules.
- Each host's table entry declares a `users` set keyed by username; every entry
  lists that user's home-module composition (the shared `./home` bundle plus any
  per-user modules, e.g. [`users/emmathorpe/work.nix`](./users/emmathorpe/work.nix))
  and optional per-host-user system bits such as `linger`.
- `mkHost` builds each account from the registry and injects the matching
  identity into that user's home config as the `identity` module arg. A host can
  therefore declare any number of users.

### Portable home (off-NixOS / external consumers)

The home config is also exposed for use beyond these hosts:

- `homeConfigurations."<user>@<system>"` — a standalone home-manager profile
  (the portable subset: shell + git + editor + claude) that can be activated on a
  machine this flake does **not** manage:
  `home-manager switch --flake .#"lyrathorpe@x86_64-linux"`. The desktop/sway
  modules are intentionally excluded (they rely on a NixOS-provided Sway/Firefox
  binary).
- `homeModules` — the reusable modules exported so another flake can import them
  (`inputs.<this>.homeModules.default`). Consumers must supply the module args
  these expect: `inputs` always, `identity` for git/desktop, `portable` for sway.

## Directory authentication (SSSD → Authentik LDAP)

Every NixOS host authenticates users against the Authentik LDAP outpost via
SSSD, implemented in [`modules/sssd.nix`](./modules/sssd.nix) and enabled by
default through the `services.authentikLdap.enable` option (added to
`baseModules`). The **EDaaS** WSL box opts out
(`services.authentikLdap.enable = false`) as a work-managed environment; the
macOS host is unaffected (SSSD is Linux-only).

- Connects over LDAPS to `ldap.lyrapup.pet:636`, search base
  `dc=ldap,dc=goauthentik,dc=io`, binding as
  `cn=sssd-bind,ou=users,dc=ldap,dc=goauthentik,dc=io`.
- The schema mappings match Authentik's non-standard object classes
  (`goauthentik.io/ldap/user`, `goauthentik.io/ldap/group`) over the POSIX
  attributes (`uid`, `uidNumber`, `gidNumber`, `homeDirectory`).
- Home directories are created on first login (`pam_mkhomedir`).

### Secrets (agenix)

The LDAP bind credential is an [agenix](https://github.com/ryantm/agenix)
secret, decrypted at activation with each host's SSH host key. The decrypted
plaintext is a full `sssd.conf` drop-in delivered to
`/etc/sssd/conf.d/01-ldap-authtok.conf`, so the password never enters the Nix
store. Owner setup (host recipient keys, encrypting the bind password, DNS for
`ldap.lyrapup.pet`, rebuild) is documented in
[`secrets/README.md`](./secrets/README.md).

## Applying

```sh
# NixOS
sudo nixos-rebuild switch --flake .#<configuration>
# Darwin
darwin-rebuild switch --flake .#lyrathorpe-mac
```

## Shell environment & keybindings

- Interactive shell features (zsh, tmux, git, ssh, CLI tools, auto-tmux):
  [`home/README.md`](./home/README.md).
- All Sway / tmux / foot / zsh keyboard shortcuts:
  [`home/KEYBINDINGS.md`](./home/KEYBINDINGS.md).

## Login / greeter

Graphical (Sway) hosts log in through a Wayland greeter — `greetd` running
ReGreet inside the `cage` kiosk compositor — implemented in
[`modules/sway.nix`](./modules/sway.nix), gated on
`features.swayDesktop.enable` (the option is declared in
[`modules/features.nix`](./modules/features.nix), so headless hosts
can leave it off without importing `modules/sway.nix`). The greeter is forced to Dvorak
to match the console and Sway session. Headless hosts (the WSL work box and the
Raspberry Pi server) keep plain TTY login. The target account needs a password
(`passwd <user>`) before it can log in.

## MacBook (Asahi) firmware

The MBP host references `modules/firmware/` for Apple peripheral
firmware (Wi-Fi/Bluetooth). These blobs are **committed** (tracked) even though
`.gitignore` lists the directory: the flake is `git+file`, so it only sees
tracked files — untracking them breaks `lyrathorpe-mbp` evaluation (and the CI
host-eval) because the config can't find the firmware. They are not
redistributable; the repo is private.

To refresh them, copy the firmware extracted during the Asahi install (from
`/etc/nixos/firmware`, or re-extract per the
[Asahi NixOS docs](https://github.com/tpwrules/nixos-apple-silicon)) into
`modules/firmware/` and commit with `git add -f`.

## Development

A dev shell and a formatting/lint gate are wired through the flake:

- `nix develop` — shell with `deadnix`, `statix`, `treefmt`, and the git
  `pre-commit` hooks (installed automatically on first entry).
- `nix fmt` — formats the tree via `treefmt` (nixfmt + shfmt + prettier;
  generated files and `flake.lock` are excluded).
- `nix flake check` — runs formatting, `deadnix`, `statix`, the pre-commit
  hooks, and evaluates every host. `.editorconfig` carries the base style;
  `statix.toml` disables the two house-style lints (`repeated_keys`,
  `empty_pattern`).

## CI

[`.gitea/workflows/ci.yaml`](./.gitea/workflows/ci.yaml) runs `nix flake check`
(formatting, `deadnix`, `statix`, the pre-commit hooks) and evaluates every
NixOS and Darwin host configuration on push/PR.