lyrathorpeandEmma Thorpe
128deca2e3
CI / flake (push) Successful in 3m26s
## Summary Separates user identity (data) from the reusable Nix modules and lets a host declare any number of users, replacing the previous one-user-per-host structure. Also restructures the tree and exposes the home config for use off these hosts. ## Changes - **User registry** (`users/registry.nix`): per-user identity (name, email, groups, authorized + signing keys) as the single source of truth; no user data hardcoded in modules. - **Multi-user `mkHost`**: a host declares a `users` set keyed by username; per-user identity is injected into each home config via the `identity` module arg. - **Restructured layout**: `users/`, `home/`, `modules/`, `hosts/`, `lib/` replace the former `lyrathorpe/` and `system/` trees. - **Portable outputs**: standalone `homeConfigurations."<user>@<system>"` (the portable subset — shell, git, editor, claude) plus an exported `homeModules` for use on machines not managed by this flake, or as an input to other flakes. - Docs (`README.md`, `home/README.md`) and `.gitignore` updated for the new paths. ## Fixes - Closes #46 — shared user module authorized one user's SSH key for every account. - Closes #47 — git committer identity hardcoded as defaults instead of per-user. - Closes #48 — EDaaS systemd linger hardcoded to a literal username. ## Verification - `nix flake check` passes: treefmt, deadnix, statix, pre-commit, and evaluation of all NixOS hosts + Darwin + homeConfigurations. - Derivation-path comparison vs `main`: `lyrathorpe-mbp` and `emmathorpe-edaas` are byte-identical; `lyrathorpe-t400`, `lyrathorpe-macpro31` and `lyrathorpe-rpi5` differ only by de-duplicating a repeated `authorized_keys` entry (confirmed with nix-diff — no other change). - Standalone `homeConfigurations."lyrathorpe@x86_64-linux".activationPackage` builds. ## Notes - `emmathorpe` has no personal authorized key yet (it previously inherited Lyra's key via the bug in #46); the registry entry is intentionally empty — add a real key if SSH login as `emmathorpe` is wanted (moot on the WSL host). - A two-repo (public dotfiles / private systems) split is deferred by design; this internal restructure is the prerequisite for it. --------- Co-authored-by: Emma Thorpe <emma.thorpe@citrix.com> Reviewed-on: #49
68 lines
2.0 KiB
Nix
68 lines
2.0 KiB
Nix
# Work (EDaaS/WSL) home profile: corporate toolchain + tmux tweaks. Git identity
|
|
# comes from the registry (users/registry.nix), not here.
|
|
{ pkgs, lib, ... }:
|
|
|
|
{
|
|
# Host-scoped extras for this machine only (the EDaaS/WSL host).
|
|
imports = [
|
|
./renovate-review.nix # daily headless Renovate PR review (systemd user timer)
|
|
];
|
|
|
|
# The work box keeps its own (corporate) ~/.ssh/config; don't let the personal
|
|
# programs.ssh (shell.nix) take it over. The ssh-agent below still runs.
|
|
programs.ssh.enable = lib.mkForce false;
|
|
|
|
home.packages = [
|
|
pkgs.kubectl
|
|
pkgs.argo-rollouts
|
|
pkgs.tenv
|
|
pkgs.kubernetes-helm
|
|
pkgs.azure-cli
|
|
pkgs.kubelogin
|
|
pkgs.curl
|
|
pkgs.notation
|
|
pkgs.powershell
|
|
pkgs.nuget
|
|
pkgs.gedit
|
|
pkgs.lens
|
|
pkgs.python3
|
|
pkgs.gnumake
|
|
pkgs.gcc
|
|
pkgs.libiconv
|
|
pkgs.autoconf
|
|
pkgs.automake
|
|
pkgs.pkg-config
|
|
pkgs.wget
|
|
pkgs.google-cloud-sdk
|
|
# Day-to-day Kubernetes / Helm / Terraform accelerators for this box.
|
|
pkgs.k9s # cluster TUI
|
|
pkgs.kubectx # kubectx + kubens (context/namespace switch)
|
|
pkgs.stern # multi-pod log tail
|
|
pkgs.dyff # semantic YAML/manifest diffs (Helm release drift)
|
|
pkgs.tflint # Terraform linter (catches what terraformls won't)
|
|
pkgs.terraform-docs # generate Terraform module docs
|
|
pkgs.yq-go # jq for YAML
|
|
];
|
|
services.ssh-agent.enable = true;
|
|
home.shellAliases = {
|
|
docker = "/run/current-system/sw/bin/docker";
|
|
};
|
|
programs.tmux = {
|
|
extraConfig = ''
|
|
set -g status-right "#(/run/current-system/sw/bin/bash $HOME/code/kube-tmux/kube.tmux 250 red black)"
|
|
'';
|
|
};
|
|
programs.go = {
|
|
enable = true;
|
|
};
|
|
|
|
# LSP servers only relevant to work: C# (omnisharp) and Helm charts (helm_ls).
|
|
# The shared editor (home/editor.nix) carries the universal ones;
|
|
# these are gated to this host so the heavy omnisharp closure stays off the
|
|
# personal machines. Tree-sitter grammars (highlighting) remain global there.
|
|
programs.nixvim.plugins.lsp.servers = {
|
|
omnisharp.enable = true;
|
|
helm_ls.enable = true;
|
|
};
|
|
}
|