Emma ThorpeandClaude Opus 5
a94a749f29
CI / flake (push) Skipped
CI / flake (pull_request) Successful in 4m16s
A headless aarch64 companion for a Psion 5MX: PPP over RS232 with NAT out to wifi and a telnet login, plus a cleartext POP3/SMTP proxy for the Psion's mail client. - hosts/PiZero2W/: host config, serial-ppp.nix, email-proxy.nix, an SD-image variant, and a hardware-configuration.nix placeholder. - Host table entry on nixos-hardware's raspberry-pi-3 profile; the Zero 2 W is the Pi 3's BCM2837 SoC. nixpkgs' linuxPackages_rpi02w is deprecated and warns that the linux-rpi series is being removed in favour of nixos-hardware. - The host owns its firmware partition (hardware.raspberry-pi.firmware), which is what puts the disable-bt and uart0/ctsrts overlays in config.txt so /dev/ttyAMA0 is the RS232 header rather than Bluetooth. uboot.enable keeps the U-Boot -> extlinux boot path the rewritten config.txt would otherwise lose. - packages.aarch64-linux.zero2w-sd-image: the host's own configuration as an installable card. The board has no Ethernet and no free serial port, so a generic image would leave no way in. - The mail proxy comes from the legacy-email-proxy flake, which provides the package and the NixOS module; nothing about it is vendored here. - docs/hosts/pizero2w.md, plus README host table and shared-layer notes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
535 lines
20 KiB
Nix
535 lines
20 KiB
Nix
{
|
|
description = "NixOS configuration";
|
|
|
|
inputs = {
|
|
# Pinned stable channel; the single source of truth for every host.
|
|
nixpkgs.url = "github:nixos/nixpkgs/nixos-26.05";
|
|
# Bleeding-edge channel, used only to pull individual packages via overlay.
|
|
nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
|
|
# Home-manager release matched to the stable nixpkgs; `follows` keeps a single nixpkgs eval.
|
|
home-manager.url = "github:nix-community/home-manager/release-26.05";
|
|
home-manager.inputs.nixpkgs.follows = "nixpkgs";
|
|
# WSL module for the EDaaS host; flake input avoids the impure <nixos-wsl> NIX_PATH lookup.
|
|
nixos-wsl.url = "github:nix-community/NixOS-WSL";
|
|
nixos-wsl.inputs.nixpkgs.follows = "nixpkgs";
|
|
# Apple Silicon (Asahi) support for the MacBook host.
|
|
nixos-apple-silicon.url = "github:nix-community/nixos-apple-silicon";
|
|
nixos-apple-silicon.inputs.nixpkgs.follows = "nixpkgs";
|
|
# nix-darwin: manage macOS hosts from this same flake.
|
|
nix-darwin.url = "github:nix-darwin/nix-darwin/nix-darwin-26.05";
|
|
nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
|
|
# nix-homebrew: declaratively own and install the Homebrew prefix on macOS.
|
|
nix-homebrew.url = "github:zhaofengli/nix-homebrew";
|
|
# Provides mkFlake: the systems/perSystem scaffolding used below.
|
|
flake-parts.url = "github:hercules-ci/flake-parts";
|
|
flake-parts.inputs.nixpkgs-lib.follows = "nixpkgs";
|
|
# Declarative Firefox add-ons (e.g. the Catppuccin theme); see modules/users.nix.
|
|
firefox-addons = {
|
|
url = "gitlab:rycee/nur-expressions?dir=pkgs/firefox-addons";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
# Prebuilt nix-index database so "command not found -> which package
|
|
# provides it" works immediately (no manual `nix-index` run). See shell.nix.
|
|
nix-index-database = {
|
|
url = "github:nix-community/nix-index-database";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
# treefmt-nix: one multi-language formatter driving `nix fmt` and the
|
|
# formatting flake check (nixfmt + shfmt + prettier).
|
|
treefmt-nix = {
|
|
url = "github:numtide/treefmt-nix";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
# git-hooks.nix: declarative pre-commit hooks (nixfmt/deadnix/statix),
|
|
# installed into the repo via the devShell.
|
|
git-hooks = {
|
|
url = "github:cachix/git-hooks.nix";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
# Declarative Neovim (the editor; see home/editor.nix). Release
|
|
# branch matched to the pinned nixpkgs (26.05); follows our nixpkgs to keep a
|
|
# single nixpkgs in the closure. editor.nix sets programs.nixvim.nixpkgs.source
|
|
# to this same input so the home module doesn't warn about the pin.
|
|
nixvim = {
|
|
url = "github:nix-community/nixvim/nixos-26.05";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
# Curated per-hardware profiles (microcode, SSD, platform quirks) for the
|
|
# physical x86 hosts.
|
|
nixos-hardware = {
|
|
url = "github:NixOS/nixos-hardware";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
# kube-tmux: kube context/namespace for the tmux status line on the work
|
|
# host. Not in nixpkgs and not a flake -- pinned here as a plain source so
|
|
# the script is always in the store (no manual checkout). See work.nix.
|
|
kube-tmux = {
|
|
url = "github:jonmosco/kube-tmux";
|
|
flake = false;
|
|
};
|
|
# legacy-email-proxy: cleartext POP3/SMTP front end for the Psion's mail
|
|
# client, proxied to authenticated IMAPS/SMTPS. Ships its own package and
|
|
# NixOS module; the Pi Zero 2 W host just enables the service.
|
|
legacy-email-proxy = {
|
|
url = "git+https://code.emmathe.dev/lyrathorpe/legacy-email-proxy";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
};
|
|
|
|
outputs =
|
|
inputs@{
|
|
flake-parts,
|
|
nixpkgs,
|
|
nixpkgs-unstable,
|
|
home-manager,
|
|
nixos-wsl,
|
|
nixos-apple-silicon,
|
|
nix-darwin,
|
|
nix-homebrew,
|
|
...
|
|
}:
|
|
flake-parts.lib.mkFlake { inherit inputs; } (
|
|
{ lib, ... }:
|
|
let
|
|
# These track nixpkgs-unstable regardless of the pinned nixpkgs.
|
|
# gcx: 26.05 ships 0.2.14, which predates the stacks/contexts config
|
|
# model and the agento11y commands the tooling expects.
|
|
overlays = [
|
|
(_final: prev: {
|
|
inherit
|
|
(import nixpkgs-unstable {
|
|
inherit (prev.stdenv.hostPlatform) system;
|
|
config.allowUnfree = true;
|
|
})
|
|
claude-code
|
|
gcx
|
|
;
|
|
})
|
|
# commitizen 4.13.9's regression test for the invalid-command error
|
|
# message asserts argparse's older, unquoted "invalid choice" wording;
|
|
# the argparse in Python 3.13 quotes each choice, so the fixture no
|
|
# longer matches and the checkPhase fails. The package itself is fine
|
|
# -- deselect just that test. Drop once nixpkgs updates the fixture.
|
|
(_final: prev: {
|
|
commitizen = prev.commitizen.overridePythonAttrs (old: {
|
|
disabledTests = (old.disabledTests or [ ]) ++ [ "test_invalid_command" ];
|
|
});
|
|
})
|
|
];
|
|
|
|
# Unfree packages permitted to be built (replaces blanket allowUnfree).
|
|
# The NVIDIA entries are for the Mac Pro's Quadro P400 (hosts/MacPro31/
|
|
# nvidia.nix); unfree packages are not in the binary cache, so the
|
|
# kernel module is compiled on the host.
|
|
unfreePackages = [
|
|
"claude-code"
|
|
"nvidia-x11"
|
|
"nvidia-kernel-modules"
|
|
"nvidia-settings"
|
|
];
|
|
|
|
# Per-user identity, keyed by username. See README "Users".
|
|
userRegistry = import ./users/registry.nix;
|
|
|
|
# nixpkgs + nix-daemon settings shared by NixOS and Darwin hosts.
|
|
commonModule = {
|
|
nixpkgs.overlays = overlays;
|
|
nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) unfreePackages;
|
|
nix.settings.experimental-features = [
|
|
"nix-command"
|
|
"flakes"
|
|
];
|
|
# Make `nix shell nixpkgs#...` and <nixpkgs> use the pinned nixpkgs.
|
|
nix.registry.nixpkgs.flake = nixpkgs;
|
|
nix.nixPath = [ "nixpkgs=${nixpkgs}" ];
|
|
};
|
|
|
|
# Shared scaffolding for every NixOS host: common user, settings, home-manager.
|
|
baseModules = [
|
|
./modules/users.nix
|
|
./modules/common-nixos.nix
|
|
./modules/features.nix
|
|
commonModule
|
|
home-manager.nixosModules.home-manager
|
|
{
|
|
home-manager.useGlobalPkgs = true;
|
|
home-manager.useUserPackages = true;
|
|
# Back up pre-existing dotfiles (e.g. .zshrc) instead of aborting
|
|
# activation when home-manager would overwrite them.
|
|
home-manager.backupFileExtension = "backup";
|
|
}
|
|
];
|
|
|
|
# Build one NixOS host. `users` is an attrset keyed by username (home
|
|
# modules + optional per-user system bits). See README "Users".
|
|
mkHost =
|
|
{
|
|
system,
|
|
modules,
|
|
users,
|
|
# Host form factor. Laptops inherit the default; a desktop host sets
|
|
# `portable = false` to drop mobile components (battery block,
|
|
# brightness keys) from the home-manager Sway config.
|
|
portable ? true,
|
|
}:
|
|
nixpkgs.lib.nixosSystem {
|
|
inherit system;
|
|
specialArgs = {
|
|
inherit
|
|
inputs
|
|
userRegistry
|
|
portable
|
|
;
|
|
};
|
|
modules =
|
|
baseModules
|
|
++ modules
|
|
++ [
|
|
{ _module.args.hostUsers = users; }
|
|
{
|
|
home-manager.extraSpecialArgs = { inherit inputs portable; };
|
|
home-manager.users = lib.mapAttrs (name: spec: {
|
|
imports = spec.homeModules;
|
|
_module.args.identity = userRegistry.${name} // {
|
|
username = name;
|
|
};
|
|
}) users;
|
|
}
|
|
];
|
|
};
|
|
|
|
# Shared scaffolding for every Darwin (macOS) host.
|
|
darwinBaseModules = [
|
|
commonModule
|
|
nix-homebrew.darwinModules.nix-homebrew
|
|
home-manager.darwinModules.home-manager
|
|
{
|
|
home-manager.useGlobalPkgs = true;
|
|
home-manager.useUserPackages = true;
|
|
# Back up pre-existing dotfiles (e.g. .zshrc) instead of aborting
|
|
# activation when home-manager would overwrite them.
|
|
home-manager.backupFileExtension = "backup";
|
|
}
|
|
];
|
|
|
|
# Darwin counterpart of mkHost: single-user (macOS owns the account),
|
|
# identity still from the registry. See README "Users".
|
|
mkDarwinHost =
|
|
{
|
|
system,
|
|
username,
|
|
modules,
|
|
homeModules,
|
|
}:
|
|
nix-darwin.lib.darwinSystem {
|
|
specialArgs = { inherit inputs username; };
|
|
modules =
|
|
darwinBaseModules
|
|
++ modules
|
|
++ [
|
|
{
|
|
nixpkgs.hostPlatform = system;
|
|
# macOS owns the account; point home-manager at its home dir.
|
|
users.users.${username}.home = "/Users/${username}";
|
|
home-manager.extraSpecialArgs = { inherit inputs; };
|
|
home-manager.users.${username} = {
|
|
imports = homeModules;
|
|
_module.args.identity = userRegistry.${username} // {
|
|
inherit username;
|
|
};
|
|
};
|
|
}
|
|
];
|
|
};
|
|
|
|
# Host table — one entry per machine, realised into a nixosConfiguration
|
|
# of the same name below. See README "Hosts" / "Users".
|
|
hosts = {
|
|
lyrathorpe-mbp = {
|
|
system = "aarch64-linux";
|
|
modules = [
|
|
./hosts/MBP-Asahi/configuration.nix
|
|
./modules/laptop.nix
|
|
nixos-apple-silicon.nixosModules.default
|
|
./modules/sway.nix
|
|
];
|
|
users.lyrathorpe.homeModules = [
|
|
./home
|
|
./users/lyrathorpe/home.nix
|
|
./home/desktop.nix
|
|
];
|
|
};
|
|
|
|
lyrathorpe-t400 = {
|
|
system = "x86_64-linux";
|
|
modules = [
|
|
./hosts/T400/configuration.nix
|
|
./modules/laptop.nix
|
|
./modules/ssh.nix
|
|
# No t400-specific profile exists; compose the generic ThinkPad +
|
|
# laptop/SSD/Intel building blocks (tp_smapi/acpi_call for battery
|
|
# thresholds, SSD + microcode defaults).
|
|
inputs.nixos-hardware.nixosModules.lenovo-thinkpad
|
|
inputs.nixos-hardware.nixosModules.common-pc-laptop
|
|
inputs.nixos-hardware.nixosModules.common-pc-laptop-ssd
|
|
inputs.nixos-hardware.nixosModules.common-cpu-intel
|
|
./modules/sway.nix
|
|
];
|
|
users.lyrathorpe.homeModules = [
|
|
./home
|
|
./users/lyrathorpe/home.nix
|
|
./home/desktop.nix
|
|
];
|
|
};
|
|
|
|
lyrathorpe-macpro31 = {
|
|
system = "x86_64-linux";
|
|
portable = false;
|
|
modules = [
|
|
./hosts/MacPro31/configuration.nix
|
|
./modules/desktop.nix
|
|
./modules/ssh.nix
|
|
inputs.nixos-hardware.nixosModules.common-pc-ssd
|
|
inputs.nixos-hardware.nixosModules.common-cpu-intel
|
|
./modules/sway.nix
|
|
];
|
|
users.lyrathorpe.homeModules = [
|
|
./home
|
|
./users/lyrathorpe/home.nix
|
|
./home/desktop.nix
|
|
];
|
|
};
|
|
|
|
emmathorpe-edaas = {
|
|
system = "x86_64-linux";
|
|
modules = [
|
|
./hosts/EDaaS/configuration.nix
|
|
nixos-wsl.nixosModules.default
|
|
./modules/sway.nix
|
|
];
|
|
users.emmathorpe = {
|
|
homeModules = [
|
|
./home
|
|
./users/emmathorpe/work.nix
|
|
];
|
|
# Keep the systemd --user instance alive without a login session so
|
|
# the renovate-review home timer fires on schedule.
|
|
linger = true;
|
|
};
|
|
};
|
|
|
|
lyrathorpe-rpi5 = {
|
|
system = "aarch64-linux";
|
|
portable = false;
|
|
# Headless server: Docker host + nginx reverse proxy. No sway.nix
|
|
# (no desktop); the raspberry-pi-5 profile supplies kernel/firmware,
|
|
# ssh.nix adds key-only sshd.
|
|
modules = [
|
|
./hosts/RPi5/configuration.nix
|
|
inputs.nixos-hardware.nixosModules.raspberry-pi-5
|
|
./modules/ssh.nix
|
|
];
|
|
users.lyrathorpe.homeModules = [
|
|
./home
|
|
./users/lyrathorpe/home.nix
|
|
];
|
|
};
|
|
|
|
lyrathorpe-zero2w = {
|
|
system = "aarch64-linux";
|
|
portable = false;
|
|
# Headless "Psion sidecar": PPP over RS232 plus a legacy mail proxy
|
|
# (hosts/PiZero2W/). No sway.nix; the raspberry-pi-3 profile carries
|
|
# the kernel/firmware/device tree (the Zero 2 W is the Pi 3's
|
|
# BCM2837 SoC) and ssh.nix adds key-only sshd. This board has 512 MB
|
|
# of RAM and never builds its own system -- see
|
|
# docs/hosts/pizero2w.md.
|
|
modules = [
|
|
./hosts/PiZero2W/configuration.nix
|
|
inputs.nixos-hardware.nixosModules.raspberry-pi-3
|
|
./modules/ssh.nix
|
|
];
|
|
users.lyrathorpe.homeModules = [
|
|
./home
|
|
./users/lyrathorpe/home.nix
|
|
];
|
|
};
|
|
};
|
|
|
|
# Darwin host table — macOS machines built via mkDarwinHost. The shared
|
|
# ./home bundle (shell, git, editor) is reused directly; the Linux-only
|
|
# desktop/sway modules are intentionally left out.
|
|
darwinHosts = {
|
|
lyrathorpe-mac = {
|
|
system = "aarch64-darwin";
|
|
username = "lyrathorpe";
|
|
modules = [
|
|
./hosts/Darwin/configuration.nix
|
|
];
|
|
homeModules = [
|
|
./home
|
|
./users/lyrathorpe/home.nix
|
|
];
|
|
};
|
|
};
|
|
in
|
|
{
|
|
# flake-parts modules: treefmt-nix wires `nix fmt` + a formatting check;
|
|
# git-hooks.nix wires the pre-commit check + devShell installation script.
|
|
imports = [
|
|
inputs.treefmt-nix.flakeModule
|
|
inputs.git-hooks.flakeModule
|
|
];
|
|
|
|
systems = [
|
|
"x86_64-linux"
|
|
"aarch64-linux"
|
|
"aarch64-darwin"
|
|
"x86_64-darwin"
|
|
];
|
|
|
|
# perSystem is evaluated once per entry in `systems`; `pkgs` is the
|
|
# nixpkgs instance for that system. Outputs here become per-system
|
|
# attrsets automatically (e.g. devShells.<system>.default).
|
|
perSystem =
|
|
{
|
|
config,
|
|
pkgs,
|
|
system,
|
|
...
|
|
}:
|
|
{
|
|
# One-shot SD card for bringing the Pi Zero 2 W up: that host's own
|
|
# configuration plus the sd-image module, so the first boot is
|
|
# already the real system. aarch64-linux only -- building it needs
|
|
# an aarch64 Linux builder. See docs/hosts/pizero2w.md.
|
|
packages = lib.optionalAttrs (system == "aarch64-linux") {
|
|
zero2w-sd-image =
|
|
((mkHost hosts.lyrathorpe-zero2w).extendModules {
|
|
modules = [ ./hosts/PiZero2W/sd-image.nix ];
|
|
}).config.system.build.sdImage;
|
|
};
|
|
|
|
# treefmt drives `nix fmt` and the formatting check below. nixfmt
|
|
# stays the .nix formatter (the tree is already nixfmt-formatted);
|
|
# shfmt covers shell and prettier covers markdown/yaml/json.
|
|
treefmt = {
|
|
projectRootFile = "flake.nix";
|
|
programs.nixfmt.enable = true;
|
|
programs.shfmt.enable = true;
|
|
programs.prettier.enable = true;
|
|
# Generated hardware-configuration.nix files are not hand-edited.
|
|
settings.global.excludes = [
|
|
"*/hardware-configuration.nix" # generated by nixos-generate-config
|
|
"flake.lock" # generated by `nix flake lock`
|
|
];
|
|
};
|
|
|
|
# Pre-commit hooks: format + lint gate run on commit. The same hooks
|
|
# are exposed as a flake check (pre-commit.check.enable defaults true).
|
|
pre-commit.settings = {
|
|
# Generated by nixos-generate-config; don't lint/reformat (treefmt
|
|
# excludes them too).
|
|
excludes = [ "hardware-configuration\\.nix$" ];
|
|
hooks = {
|
|
nixfmt-rfc-style.enable = true;
|
|
deadnix = {
|
|
enable = true;
|
|
# Unused module args ({config,lib,pkgs,...}) are normal; only
|
|
# flag genuinely dead bindings.
|
|
settings.noLambdaPatternNames = true;
|
|
};
|
|
statix.enable = true; # reads statix.toml (repeated_keys/empty_pattern disabled)
|
|
};
|
|
};
|
|
|
|
# treefmt-nix exposes its own `checks.treefmt`; alias it to
|
|
# `formatting` so the existing CI gate (.#checks.*.formatting) keeps
|
|
# working without churn.
|
|
checks.formatting = config.treefmt.build.check inputs.self;
|
|
|
|
# deadnix / statix lints as standalone flake checks so `nix flake
|
|
# check` flags dead code and antipatterns independently of pre-commit.
|
|
checks.deadnix = pkgs.runCommandLocal "check-deadnix" { nativeBuildInputs = [ pkgs.deadnix ]; } ''
|
|
deadnix --fail --no-lambda-pattern-names ${./.} && touch $out
|
|
'';
|
|
checks.statix = pkgs.runCommandLocal "check-statix" { nativeBuildInputs = [ pkgs.statix ]; } ''
|
|
statix check -c ${./.} ${./.} && touch $out
|
|
'';
|
|
|
|
# `nix develop` shell with the tooling needed to hack on this flake.
|
|
# shellHook installs the git pre-commit hooks into the working tree.
|
|
devShells.default = pkgs.mkShellNoCC {
|
|
packages = with pkgs; [
|
|
nixfmt
|
|
nil
|
|
git
|
|
deadnix
|
|
statix
|
|
treefmt
|
|
];
|
|
shellHook = config.pre-commit.installationScript;
|
|
};
|
|
};
|
|
|
|
# Realise the host tables: each entry becomes a {nixos,darwin}Configuration.
|
|
flake.nixosConfigurations = lib.mapAttrs (_name: mkHost) hosts;
|
|
flake.darwinConfigurations = lib.mapAttrs (_name: mkDarwinHost) darwinHosts;
|
|
|
|
# Reusable home modules, exported for use off these hosts. See README
|
|
# "Portable home" for the consumer module-arg expectations.
|
|
flake.homeModules = {
|
|
default = ./home;
|
|
shell = ./home/shell.nix;
|
|
git = ./home/git.nix;
|
|
editor = ./home/editor.nix;
|
|
claude = ./home/claude.nix;
|
|
secret-service = ./home/secret-service.nix;
|
|
desktop = ./home/desktop.nix;
|
|
sway = ./home/sway.nix;
|
|
};
|
|
|
|
# Standalone home-manager configs (portable bundle) for machines not
|
|
# managed by this flake. See README "Portable home".
|
|
flake.homeConfigurations =
|
|
let
|
|
mkHome =
|
|
{
|
|
system,
|
|
name,
|
|
}:
|
|
home-manager.lib.homeManagerConfiguration {
|
|
pkgs = import nixpkgs {
|
|
inherit system overlays;
|
|
config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) unfreePackages;
|
|
};
|
|
extraSpecialArgs = {
|
|
inherit inputs;
|
|
portable = true;
|
|
identity = userRegistry.${name} // {
|
|
username = name;
|
|
};
|
|
};
|
|
modules = [
|
|
./home
|
|
{
|
|
home.username = name;
|
|
home.homeDirectory = "/home/${name}";
|
|
}
|
|
];
|
|
};
|
|
in
|
|
{
|
|
"lyrathorpe@x86_64-linux" = mkHome {
|
|
system = "x86_64-linux";
|
|
name = "lyrathorpe";
|
|
};
|
|
"lyrathorpe@aarch64-linux" = mkHome {
|
|
system = "aarch64-linux";
|
|
name = "lyrathorpe";
|
|
};
|
|
};
|
|
}
|
|
);
|
|
}
|