updates
This commit is contained in:
kiri committed
1 parent
f164d8b76e
commit
5748b3409b
60 files changed
+1346
-590
No files matched your search
@@ -5,9 +5,10 @@ NixOS and Home Manager are composed through flake-parts and import-tree.
|
||||
|
||||
## Start here
|
||||
|
||||
- [Design](docs/design.md): vocabulary, ownership, and rationale.
|
||||
- [Agent instructions](AGENTS.md): repository collaboration boundaries.
|
||||
- [Current work](docs/current-work.md): accepted scope, open decisions, and next step.
|
||||
- [Design](docs/design.md): vocabulary, ownership and coding conventions.
|
||||
- [Agent instructions](AGENTS.md): essential collaboration boundaries.
|
||||
- [Current work](docs/current-work.md): implementation state, pending decisions and
|
||||
remaining acceptance checks.
|
||||
|
||||
## Configuration map
|
||||
|
||||
@@ -15,76 +16,78 @@ NixOS and Home Manager are composed through flake-parts and import-tree.
|
||||
| --- | --- | --- |
|
||||
| Hosts | `modules/hosts/<host>/` | Identity, hardware, machine-specific selection |
|
||||
| Profiles | `modules/profiles/` | Combinations of capabilities |
|
||||
| Capabilities | `modules/capabilities/` | Behavior and integration across NixOS and Home Manager |
|
||||
| Facts | `modules/facts.nix` | Shared identity and topology; host facts are declared with hosts |
|
||||
| Capabilities | `modules/capabilities/` | Behavior and NixOS/Home Manager integration |
|
||||
| Facts | `modules/facts.nix` | Shared identity/topology; host facts live with hosts |
|
||||
| Composition | `flake.nix`, `modules/flake-parts.nix` | Inputs, discovery, host construction |
|
||||
| Secrets | `modules/secrets/` | Existing SOPS declarations and encrypted data |
|
||||
| Secrets | `modules/secrets/` | SOPS declarations and encrypted documents |
|
||||
|
||||
Discovery makes named modules available; imports select them. Underscore-prefixed
|
||||
helpers and directories are excluded from automatic discovery and imported explicitly.
|
||||
Add shared behavior to its capability and select it through the relevant profile.
|
||||
Keep machine differences in hosts. A capability can own system and user modules.
|
||||
Discovery makes named modules available; imports select them. Flat owners use
|
||||
`name.nix` or `name/default.nix`. Private Nix helpers live under `_support/`, excluded
|
||||
from discovery. Scripts, assets and operational notes stay beside their owner.
|
||||
Select shared behavior through profiles; keep machine differences in hosts.
|
||||
|
||||
The primary editor is selected in `host-base.nix`, the primary terminal in
|
||||
`workstation-base.nix`. `modules/capabilities/theme.nix` selects the complete theme;
|
||||
Kanagawa lives in `modules/capabilities/_themes/kanagawa.nix`. Appearance belongs
|
||||
there; interaction and layout belong with the capability.
|
||||
The primary editor is selected in `host-base.nix`, the terminal in
|
||||
`workstation-base.nix`. `capabilities/theme/default.nix` selects Kanagawa;
|
||||
application appearance lives in `theme/_support/`, interaction with capabilities.
|
||||
|
||||
## Work environment (provisional)
|
||||
|
||||
Both workstations import `modules/profiles/work.nix`: company network/development
|
||||
integration, Garden tools, and work Git settings. This is a trial boundary, not
|
||||
an independent workstation variant. SharePoint remains Zenith-only for now.
|
||||
|
||||
The tools-only environment is owned by
|
||||
`modules/capabilities/yookr-dev/environment.nix`. It shares Garden definitions in
|
||||
`_packages.nix` with installed tools and uses the system's nixpkgs pin:
|
||||
|
||||
```console
|
||||
nix develop --quiet ~/.config/nixos#workbench --command bash --norc
|
||||
```
|
||||
|
||||
This does not clear inherited credentials; start from a clean environment for
|
||||
agent work. It does not load secrets, mount storage, or install Python dependencies.
|
||||
Workspace `.envrc` files select it; the workbench's human credential and mount
|
||||
steps remain workspace-owned. Requests, queries, analysis, and `uv.lock` stay there.
|
||||
After loader changes, the user must review and re-allow the changed `.envrc` files
|
||||
with direnv. No loader is sourced as part of validation.
|
||||
Both workstations import the provisional `work` profile. See
|
||||
[workbench setup](modules/capabilities/workbench/README.md) for native devenv,
|
||||
company credentials and always-available read-only mounts. Only company-root and
|
||||
workbench environments are migrated; product/personal projects remain user-owned.
|
||||
|
||||
## Maintenance
|
||||
|
||||
Run from this repository:
|
||||
|
||||
```console
|
||||
just validate # format, evaluate, build every host and the workbench
|
||||
just validate # format, evaluate, build all hosts and workbench tools
|
||||
just validate polaris # same workflow, build only the named host(s)
|
||||
nix flake update # update inputs; selective input updates are also supported
|
||||
```
|
||||
|
||||
The command includes current tracked files and non-ignored new files, respects
|
||||
working-tree deletions, and never changes the Git index. It resolves the pinned
|
||||
formatter from a temporary source snapshot, formats included Nix files in the
|
||||
working tree, then refreshes the snapshot for evaluation and builds. Ignored
|
||||
untracked files and `.git` are excluded. Avoid concurrent edits during validation:
|
||||
results describe the snapshot, not subsequent changes.
|
||||
Validation copies current tracked and nonignored new files into a temporary snapshot,
|
||||
respecting deletions and leaving the Git index untouched. It formats included Nix
|
||||
files in the working tree, refreshes the snapshot, prepares devenv's upstream
|
||||
evaluation dependencies, evaluates configurations and builds. Avoid concurrent edits:
|
||||
results describe that snapshot. Ordinary Git-backed flake commands outside the
|
||||
wrapper still require new source files to be added to Git.
|
||||
|
||||
Output is limited to stage results and a short excerpt on failure. Full logs remain
|
||||
in the printed `/tmp/nixos-validate-*` directory; source snapshots are removed on
|
||||
exit. Failed stages stop the command. Inputs are not updated, no result links are
|
||||
created, and nothing is activated. Host names are discovered from the flake.
|
||||
Read the short result first. Full logs live in the printed `/tmp/nixos-validate-*`
|
||||
directory. Failure stops the command; snapshots are removed on exit. It neither
|
||||
updates inputs nor creates result links or activates systems. The implementation is
|
||||
`scripts/validate.py`; `just` and Python are installed on both workstations.
|
||||
|
||||
`just` and Python are already declared for both workstations. The implementation
|
||||
is `scripts/validate.py`; the justfile is only its entry point. The formatter output
|
||||
currently targets this repository's sole system, `x86_64-linux`.
|
||||
Use targeted hosts during iteration and full validation for a completed batch.
|
||||
Documentation-only changes need review and `git diff --check`, not system builds.
|
||||
Build, activation and interactive behavior are separate evidence.
|
||||
|
||||
Use full validation after a configuration batch and targeted hosts during iteration.
|
||||
Documentation-only edits need review, local link checks, and `git diff --check`,
|
||||
not system builds. Evaluation, build, activation, and confirmed behavior are
|
||||
separate evidence. Outside this wrapper, ordinary Git-backed flake commands still
|
||||
require intended new files to be added to Git.
|
||||
User-owned activation:
|
||||
|
||||
The user activates with `nh os switch`. Edit encrypted data with
|
||||
`sops edit modules/secrets/secrets.yaml`; keep plaintext out of Nix expressions
|
||||
and the store. No new credential-delivery design is selected yet.
|
||||
```console
|
||||
nh os switch
|
||||
nixos-rebuild switch --target-host orion --sudo --flake ~/.config/nixos
|
||||
```
|
||||
|
||||
Historical material under `docs/.archive/` is evidence, not current instructions
|
||||
or a backlog. Consult it only for relevant unresolved questions.
|
||||
Edit system ciphertext with `sops edit modules/secrets/secrets.yaml`; company
|
||||
provisioning is documented with workbench. Never put plaintext secrets in Nix.
|
||||
|
||||
## First-use acceptance
|
||||
|
||||
- **Notes:** Super+N and Walker's Notes open the same picker. Enter opens a note;
|
||||
Ctrl+E creates one using the search text. Daily-note commands remain available.
|
||||
- **Orientation:** Super+Shift+N names the focused workspace; submit an empty name
|
||||
to clear it. Named empty workspaces persist until cleared. Noctalia shows labels;
|
||||
terminal titles include the working directory and command.
|
||||
- **Icons/vault:** check Oil from Walker and Nautilus device/symbolic icons. Walker's
|
||||
`?` vault provider should request unlocking on use, never during desktop startup.
|
||||
- **Calendar:** in Noctalia Settings → Services → Calendar, set the Radicale
|
||||
password through the existing Personal account (GNOME Keyring). Add an ICS account
|
||||
named Work using Outlook's published URL. Keep this URL in writable Noctalia
|
||||
settings, outside this repository. Check both agendas; edit work events in Outlook.
|
||||
- **Tailnet:** run `sudo tailscale up` on each machine and enroll the phone with
|
||||
the Tailscale app. Keep Tailscale SSH disabled; use ordinary SSH keys. With
|
||||
MagicDNS enabled, verify `ssh kiri@orion.<tailnet-name>.ts.net` from a workstation.
|
||||
Existing `ssh orion` still uses the public address until the private route is
|
||||
accepted. Close public Orion SSH only in the subsequent verified transition.
|
||||
|
||||
No systems have been activated as part of this implementation. Old SharePoint
|
||||
mirror content, experimental AI data and unrelated workspace changes are preserved.
|
||||
Historical material under `docs/.archive/` is evidence, not current authority.
|
||||
Reference in new issue
Block a user