nixfiles/README.md

nixfiles

NixOS / nix-darwin / home-manager configuration for all hosts, built from a single flake.

Hosts

Defined in the host table in flake.nix:

Configuration	System	Machine
lyrathorpe-mbp	aarch64-linux	MacBook Pro (Apple Silicon, Asahi)
lyrathorpe-t400	x86_64-linux	ThinkPad T400 — install notes
lyrathorpe-macpro31	x86_64-linux	Mac Pro 3,1, desktop — install notes
emmathorpe-edaas	x86_64-linux	Work WSL box (NixOS-WSL)
lyrathorpe-rpi5	aarch64-linux	Raspberry Pi 5 headless server: Docker host + nginx reverse proxy — install notes
lyrathorpe-mac	aarch64-darwin	macOS (nix-darwin)

Shared layers: home (home-manager: shell, git, editor), modules/common-nixos.nix (all NixOS hosts: fonts, nix-ld, caches), modules/workstation.nix (physical graphical hosts: audio, thermald, earlyoom, fwupd), modules/laptop.nix (laptops: Wi-Fi, Bluetooth, power, lid), and modules/ssh.nix (key-only sshd). The x86 hosts also pull nixos-hardware profiles.

Users

Identity is data, kept separate from the reusable modules:

• users/registry.nix — one entry per user (display name, email, supplementary groups, authorized + signing keys). This is the single source of identity; no user data is hardcoded in the modules.
• Each host's table entry declares a users set keyed by username; every entry lists that user's home-module composition (the shared ./home bundle plus any per-user modules, e.g. users/emmathorpe/work.nix) and optional per-host-user system bits such as linger.
• mkHost builds each account from the registry and injects the matching identity into that user's home config as the identity module arg. A host can therefore declare any number of users.

Portable home (off-NixOS / external consumers)

The home config is also exposed for use beyond these hosts:

• homeConfigurations."<user>@<system>" — a standalone home-manager profile (the portable subset: shell + git + editor + claude) that can be activated on a machine this flake does not manage: home-manager switch --flake .#"lyrathorpe@x86_64-linux". The desktop/sway modules are intentionally excluded (they rely on a NixOS-provided Sway/Firefox binary).
• homeModules — the reusable modules exported so another flake can import them (inputs.<this>.homeModules.default). Consumers must supply the module args these expect: inputs always, identity for git/desktop, portable for sway.

Directory authentication (SSSD → Authentik LDAP)

Every NixOS host authenticates users against the Authentik LDAP outpost via SSSD, implemented in modules/sssd.nix and enabled by default through the services.authentikLdap.enable option (added to baseModules). The EDaaS WSL box opts out (services.authentikLdap.enable = false) as a work-managed environment; the macOS host is unaffected (SSSD is Linux-only).

• Connects over LDAPS to ldap.lyrapup.pet:636, search base dc=ldap,dc=goauthentik,dc=io, binding as cn=sssd-bind,ou=users,dc=ldap,dc=goauthentik,dc=io.
• The schema mappings match Authentik's non-standard object classes (goauthentik.io/ldap/user, goauthentik.io/ldap/group) over the POSIX attributes (uid, uidNumber, gidNumber, homeDirectory).
• Home directories are created on first login (pam_mkhomedir).

Secrets (agenix)

The LDAP bind credential is an agenix secret, decrypted at activation with each host's SSH host key. The decrypted plaintext is a full sssd.conf drop-in delivered to /etc/sssd/conf.d/01-ldap-authtok.conf, so the password never enters the Nix store. Owner setup (host recipient keys, encrypting the bind password, DNS for ldap.lyrapup.pet, rebuild) is documented in secrets/README.md.

Applying

# NixOS
sudo nixos-rebuild switch --flake .#<configuration>
# Darwin
darwin-rebuild switch --flake .#lyrathorpe-mac

Shell environment & keybindings

• Interactive shell features (zsh, tmux, git, ssh, CLI tools, auto-tmux): home/README.md.
• All Sway / tmux / foot / zsh keyboard shortcuts: home/KEYBINDINGS.md.

Login / greeter

Graphical (Sway) hosts log in through a Wayland greeter — greetd running ReGreet inside the cage kiosk compositor — implemented in modules/sway.nix, gated on features.swayDesktop.enable (the option is declared in modules/features.nix, so headless hosts can leave it off without importing modules/sway.nix). The greeter is forced to Dvorak to match the console and Sway session. Headless hosts (the WSL work box and the Raspberry Pi server) keep plain TTY login. The target account needs a password (passwd <user>) before it can log in.

MacBook (Asahi) firmware

The MBP host references modules/firmware/ for Apple peripheral firmware (Wi-Fi/Bluetooth). These blobs are committed (tracked) even though .gitignore lists the directory: the flake is git+file, so it only sees tracked files — untracking them breaks lyrathorpe-mbp evaluation (and the CI host-eval) because the config can't find the firmware. They are not redistributable; the repo is private.

To refresh them, copy the firmware extracted during the Asahi install (from /etc/nixos/firmware, or re-extract per the Asahi NixOS docs) into modules/firmware/ and commit with git add -f.

Development

A dev shell and a formatting/lint gate are wired through the flake:

• nix develop — shell with deadnix, statix, treefmt, and the git pre-commit hooks (installed automatically on first entry).
• nix fmt — formats the tree via treefmt (nixfmt + shfmt + prettier; generated files and flake.lock are excluded).
• nix flake check — runs formatting, deadnix, statix, the pre-commit hooks, and evaluates every host. .editorconfig carries the base style; statix.toml disables the two house-style lints (repeated_keys, empty_pattern).

CI

.gitea/workflows/ci.yaml runs nix flake check (formatting, deadnix, statix, the pre-commit hooks) and evaluates every NixOS and Darwin host configuration on push/PR.