Emma Thorpe
dcc13f94e0
CI / flake (push) Skipped
CI / flake (pull_request) Successful in 4m21s
The docs-site build syncs this repo's README.md and docs/ into the site tree; nothing else is copied. All prose apart from the README therefore lived outside the sync and never appeared on https://docs.lyrapup.pet/nixfiles/, and the one page that did publish carried 18 link targets that resolved to nothing. Moves: home/README.md -> docs/shell.md home/KEYBINDINGS.md -> docs/keybindings.md hosts/<Name>/README.md -> docs/hosts/<name>.md docs/.pages and docs/hosts/.pages give the awesome-pages plugin an explicit order; new pages are picked up by the trailing '...' without an edit. Links are rewritten so a single URL is correct in both Gitea and the published site: absolute Gitea source URLs for .nix files and directories, relative links between pages under docs/, and absolute docs.lyrapup.pet URLs from the root README, which the build republishes at a different depth from the rest of the tree. In-code comments that pointed at a moved README are updated to the new path. The README gains a Documentation section covering the sync contract and the linking rules, and CLAUDE.md carries the short version so future edits do not reintroduce unsynced pages or dead links. Verified by reproducing the docs-site assembly locally against its pinned toolchain (mkdocs 1.6.1, mkdocs-material 9.7.7, awesome-pages 2.10.1): pages render at the URLs used above and in the declared order.
88 lines
4.0 KiB
Markdown
88 lines
4.0 KiB
Markdown
# Work WSL box — `emmathorpe-edaas`
|
|
|
|
Flake host: `emmathorpe-edaas` (`x86_64-linux`). NixOS running under
|
|
**NixOS-WSL** on the corporate Windows machine. Headless: no Sway desktop
|
|
(`features.swayDesktop.enable = false`), plain WSL shell login. Files:
|
|
`configuration.nix`.
|
|
|
|
## What this host is
|
|
|
|
The day-to-day work environment. It layers the corporate Kubernetes / Helm /
|
|
Terraform / cloud toolchain and a couple of work-only editor language servers on
|
|
top of the shared home profile. The system config here is thin — it is mostly
|
|
WSL plumbing; the user-facing tooling lives in
|
|
[`../../users/emmathorpe/work.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/users/emmathorpe/work.nix).
|
|
|
|
## WSL specifics
|
|
|
|
- `wsl.enable`, default user `emmathorpe`, Windows PATH interop and start-menu
|
|
launchers on. `/etc/hosts` generation is off (`generateHosts = false`).
|
|
- **Docker Desktop integration**, not the native daemon as the primary path:
|
|
`wsl.extraBin` shims the coreutils/`groupadd`/`usermod` binaries Docker
|
|
Desktop's `wsl-distro-proxy` expects, and `docker-desktop-proxy.script` is
|
|
patched to the real proxy path. The native `virtualisation.docker` is also
|
|
enabled (with `enableOnBoot` + `autoPrune`).
|
|
- `programs.ssh.systemd-ssh-proxy.enable = false` — the NixOS-WSL store is a
|
|
read-only VHD owned by `nobody`, and OpenSSH rejects the generated
|
|
`ssh-proxy` Include as "Bad owner or permissions", which would break ssh/git
|
|
for every command. The vsock proxy it provides is unused under WSL.
|
|
- `networking.hostName = "emmathorpe-edaas"` matches the flake attribute so
|
|
`nh os switch` resolves without `-H`.
|
|
|
|
## Renovate review timer
|
|
|
|
The host-table entry sets `users.emmathorpe.linger = true` so the user's
|
|
`systemd --user` instance stays alive without an open login session. That keeps
|
|
the daily headless **Renovate PR review** timer firing — defined in
|
|
[`../../users/emmathorpe/renovate-review.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/users/emmathorpe/renovate-review.nix)
|
|
(imported only from `work.nix`, so it exists on this machine alone). See that
|
|
file's header for the auth (Vertex AI ADC), triage policy, and caveats.
|
|
|
|
## Secret Service (keychain)
|
|
|
|
`work.nix` sets `services.headlessSecretService.enable = true`, which runs
|
|
`gnome-keyring` as a `systemd --user` service owning `org.freedesktop.secrets`
|
|
on the session bus, with the login keyring unlocked at start.
|
|
|
|
This exists for **gcx**, the Grafana Cloud CLI. gcx stores its OAuth access and
|
|
refresh tokens in the keychain unconditionally (its config keeps only opaque
|
|
`keychain:gcx:v2:...` handles) and has no plaintext fallback, so without a
|
|
Secret Service `gcx login` authenticates and then fails to persist with "The
|
|
name is not activatable".
|
|
|
|
Home-manager's own `services.gnome-keyring` does not work here: it is
|
|
`WantedBy=graphical-session-pre.target`, which never activates on this headless
|
|
box, and it cannot unlock the keyring. See
|
|
[`../../home/secret-service.nix`](https://code.emmathe.dev/lyrathorpe/nixfiles/src/branch/main/home/secret-service.nix) for the full
|
|
rationale and the security trade-off of an auto-unlocked keyring.
|
|
|
|
Only the `secrets` component is started. The `ssh` component is deliberately off
|
|
— it would claim `SSH_AUTH_SOCK` and displace `services.ssh-agent`, breaking SSH
|
|
auth and signed commits.
|
|
|
|
Checking it:
|
|
|
|
```sh
|
|
systemctl --user status headless-secret-service
|
|
busctl --user list | grep secrets # expect org.freedesktop.secrets
|
|
secret-tool search --all service gcx # inspect what gcx stored
|
|
gcx config check # end-to-end
|
|
```
|
|
|
|
If the keyring password is ever lost or changed, the login keyring cannot be
|
|
unlocked: delete `~/.local/share/keyrings` and re-run `gcx login`.
|
|
|
|
## stateVersion
|
|
|
|
`system.stateVersion = "24.11"` — the release this box was first installed on.
|
|
Leave it; it freezes stateful defaults and is not meant to track the current
|
|
nixpkgs.
|
|
|
|
## Apply
|
|
|
|
```sh
|
|
sudo nixos-rebuild switch --flake .#emmathorpe-edaas
|
|
# or, since the hostname matches the attribute:
|
|
nh os switch
|
|
```
|