lyrathorpeandEmma Thorpe
c06a57f249
CI / flake (push) Successful in 3m30s
## Summary
Follow-up cleanups from the post-refactor audit (issues #50–#53). All behaviour-preserving except the work-host changes (kube-tmux + Lens removal).
## Changes
- **#51** `refactor(ssh)` — move `services.openssh.enable` + `firewall.allowedTCPPorts = [ 22 ]` into `modules/ssh.nix`; drop the duplicated lines from T400, MacPro31, RPi5.
- **#50** `fix/feat(work)` — load kube-tmux from a pinned `flake = false` input (it is not in nixpkgs) and reference `${inputs.kube-tmux}/kube.tmux` directly, so the status line no longer depends on a manual `$HOME/code/kube-tmux` checkout. (Supersedes the interim file-existence guard.)
- **#52** `chore` — gitignore the untracked `tf-inspect/` scratch project.
- **#53** `chore` — remove the unused Lens package entirely (`pkgs.lens` + its unfree entry; `unfreePackages` is now just `claude-code`), fix the `nil`→`nil_ls` LSP doc, remove the redundant `.editorconfig` block, name the RPi5 Docker subnet in a `let` binding.
## Deferred (from #53, noted in the commit)
- `.gitignore` firmware entry — documented behaviour, low value, left as-is.
- Per-eval `nixpkgs-unstable` overlay import — inherently per-system; no clean single-import hoist.
## Verification
- `nix flake check` passes (treefmt, deadnix, statix, pre-commit, all hosts + Darwin + homeConfigurations).
- Derivation-path diff vs `main`: `lyrathorpe-mbp`, `lyrathorpe-t400`, `lyrathorpe-macpro31`, `lyrathorpe-rpi5` are byte-identical (confirms #51 and the subnet `let` binding change nothing). Only `emmathorpe-edaas` differs — the kube-tmux input (#50) and the Lens removal (#53).
Closes #50, #51, #52, #53.
---------
Co-authored-by: Emma Thorpe <emma.thorpe@citrix.com>
Reviewed-on: #54
38 lines
1.5 KiB
Nix
38 lines
1.5 KiB
Nix
# Raspberry Pi 5 (aarch64) headless server. Two roles, split into submodules:
|
|
# ./docker.nix (Docker host with a network socket) and ./reverse-proxy.nix
|
|
# (native nginx). The raspberry-pi-5 nixos-hardware profile (kernel, firmware,
|
|
# device tree) and key-only sshd (../../modules/ssh.nix) are layered on in the
|
|
# flake host table. Install notes: see ./README.md.
|
|
{ ... }:
|
|
{
|
|
imports = [
|
|
./hardware-configuration.nix
|
|
./docker.nix
|
|
./reverse-proxy.nix
|
|
];
|
|
|
|
# Match the flake's nixosConfigurations attribute name so `nh os switch`
|
|
# (which selects by the local hostname) resolves without an explicit -H flag.
|
|
networking.hostName = "lyrathorpe-rpi5";
|
|
|
|
# Headless server: the Sway desktop is intentionally not set up. modules/sway.nix is
|
|
# not imported and features.swayDesktop.enable defaults to false (declared in
|
|
# system/modules/features.nix), so this host keeps plain TTY/SSH login.
|
|
|
|
# Raspberry Pi boots via U-Boot + extlinux, not GRUB/systemd-boot. The
|
|
# raspberry-pi-5 nixos-hardware profile supplies the kernel, firmware and
|
|
# device tree.
|
|
boot.loader.grub.enable = false;
|
|
boot.loader.generic-extlinux-compatible.enable = true;
|
|
|
|
# Remote administration: the daemon, port 22 and key-only policy all come from
|
|
# ../../modules/ssh.nix.
|
|
|
|
# Default-deny inbound; the Docker and nginx submodules open their own ports
|
|
# (Docker via a source-restricted nftables rule, nginx via 80/443).
|
|
networking.firewall.enable = true;
|
|
|
|
# See `man configuration.nix` / the stateVersion docs before changing.
|
|
system.stateVersion = "26.05";
|
|
}
|