Establish repository foundation and shared work environment

modules/capabilities/dev-tools.nix

@@ -1,35 +1,6 @@
 {
   flake.modules.homeManager.dev-tools =
     { config, pkgs, ... }:
-    let
-      gardenctl = pkgs.stdenvNoCC.mkDerivation {
-        pname = "gardenctl";
-        version = "2.14.0";
-        src = pkgs.fetchurl {
-          url = "https://github.com/gardener/gardenctl-v2/releases/download/v2.14.0/gardenctl_v2_linux_amd64";
-          hash = "sha256-JCZ0eJLgYbd2ZMCCWFlhX4vOhHKZL40oR2a3EZ3i4Q8=";
-        };
-        dontUnpack = true;
-        installPhase = ''
-          install -Dm755 "$src" "$out/bin/gardenctl"
-          install -d "$out/share/zsh/site-functions"
-          "$out/bin/gardenctl" completion zsh > "$out/share/zsh/site-functions/_gardenctl"
-        '';
-      };
-      gardenlogin = pkgs.stdenvNoCC.mkDerivation {
-        pname = "gardenlogin";
-        version = "0.10.0";
-        src = pkgs.fetchurl {
-          url = "https://github.com/gardener/gardenlogin/releases/download/v0.10.0/gardenlogin_linux_amd64";
-          hash = "sha256-X4nHiZ29Mbnhxv/wlyD6PxX1KxzaX2R27N7Muu/gnH8=";
-        };
-        dontUnpack = true;
-        installPhase = ''
-          install -Dm755 "$src" "$out/bin/gardenlogin"
-          ln -s gardenlogin "$out/bin/kubectl-gardenlogin"
-        '';
-      };
-    in
     {
       home.sessionVariables.CARGO_HOME = "${config.xdg.dataHome}/cargo";
       home.packages = with pkgs; [
@@ -40,8 +11,6 @@
         scc
         visidata
         just
-        gardenctl
-        gardenlogin
       ];
 
       programs.lazygit.enable = true;

modules/capabilities/git.nix

@@ -1,63 +1,40 @@
 { config, lib, ... }:
 let
   account = config.facts.account;
+  mkScope =
+    config: scope:
+    let
+      email = account.emails.${scope}.address;
+      key = config.facts.machine.sshKeys.${scope} or null;
+      hasSigningKey = key != null;
+      privateKeyPath =
+        if hasSigningKey && key.privateKeyPath != null then key.privateKeyPath else "~/.ssh/id_${scope}";
+    in
+    {
+      allowedSigners = lib.optional hasSigningKey "${email} ${key.publicKey}";
+      git = {
+        user = {
+          name = account.realName;
+          inherit email;
+        }
+        // lib.optionalAttrs hasSigningKey {
+          signingKey = "${privateKeyPath}.pub";
+        };
+      }
+      // lib.optionalAttrs hasSigningKey {
+        core.sshCommand = "ssh -i ${privateKeyPath} -o IdentitiesOnly=yes";
+        gpg.ssh.allowedSignersFile = "${config.xdg.configHome}/git/allowed_signers";
+      };
+    };
 in
 {
   flake.modules.homeManager.git =
-    {
-      config,
-      pkgs,
-      ...
-    }:
+    { config, ... }:
     let
-      machine = config.facts.machine;
-      allowedSignersFile = "${config.xdg.configHome}/git/allowed_signers";
-      githubTokenFile = "${config.xdg.configHome}/yookr/github-read-only.token";
-
-      gh = pkgs.symlinkJoin {
-        name = "gh-with-read-only-token-${pkgs.gh.version}";
-        paths = [ pkgs.gh ];
-        nativeBuildInputs = [ pkgs.makeWrapper ];
-        meta.mainProgram = "gh";
-        postBuild = ''
-          wrapProgram "$out/bin/gh" \
-            --run 'if [[ -z "''${GH_TOKEN:-}" && -r "${githubTokenFile}" ]]; then export GH_TOKEN="$(< "${githubTokenFile}")"; fi'
-        '';
-      };
-
-      mkScope =
-        scope:
-        let
-          email = account.emails.${scope}.address;
-          key = machine.sshKeys.${scope} or null;
-          hasSigningKey = key != null;
-          privateKeyPath =
-            if hasSigningKey && key.privateKeyPath != null then key.privateKeyPath else "~/.ssh/id_${scope}";
-        in
-        {
-          allowedSigners = lib.optional hasSigningKey "${email} ${key.publicKey}";
-          git = {
-            user = {
-              name = account.realName;
-              inherit email;
-            }
-            // lib.optionalAttrs hasSigningKey {
-              signingKey = "${privateKeyPath}.pub";
-            };
-          }
-          // lib.optionalAttrs hasSigningKey {
-            core.sshCommand = "ssh -i ${privateKeyPath} -o IdentitiesOnly=yes";
-            gpg.ssh.allowedSignersFile = allowedSignersFile;
-          };
-        };
-
-      personal = mkScope "personal";
-      work = mkScope "work";
+      personal = mkScope config "personal";
     in
     {
-      xdg.configFile."git/allowed_signers".text = lib.concatStringsSep "\n" (
-        personal.allowedSigners ++ work.allowedSigners ++ [ "" ]
-      );
+      xdg.configFile."git/allowed_signers".text = lib.concatStringsSep "\n" personal.allowedSigners;
 
       programs.git = {
         enable = true;
@@ -73,34 +50,52 @@ in
             email = account.emails.personal.address;
           };
         };
-        includes = [
-          {
-            condition = "gitdir:${account.nixosConfigurationPath}/";
-            contents = personal.git;
-          }
-          {
-            condition = "gitdir:${config.home.homeDirectory}/yookr/";
-            contents = work.git;
-          }
-          {
-            condition = "gitdir:${config.xdg.userDirs.projects}/own/";
-            contents = personal.git;
-          }
-          {
-            condition = "gitdir:${config.xdg.userDirs.projects}/ext/";
-            contents = personal.git;
-          }
-          {
-            condition = "gitdir:${config.xdg.userDirs.projects}/forks/";
-            contents = personal.git;
-          }
-        ];
+        includes =
+          map
+            (path: {
+              condition = "gitdir:${path}/";
+              contents = personal.git;
+            })
+            [
+              account.nixosConfigurationPath
+              "${config.xdg.userDirs.projects}/own"
+              "${config.xdg.userDirs.projects}/ext"
+              "${config.xdg.userDirs.projects}/forks"
+            ];
       };
 
       programs.gh = {
         enable = true;
-        package = gh;
         settings.git_protocol = "ssh";
       };
     };
+
+  flake.modules.homeManager.work-git =
+    { config, pkgs, ... }:
+    let
+      work = mkScope config "work";
+      githubTokenFile = "${config.xdg.configHome}/yookr/github-read-only.token";
+      gh = pkgs.symlinkJoin {
+        name = "gh-with-read-only-token-${pkgs.gh.version}";
+        paths = [ pkgs.gh ];
+        nativeBuildInputs = [ pkgs.makeWrapper ];
+        meta.mainProgram = "gh";
+        postBuild = ''
+          wrapProgram "$out/bin/gh" \
+            --run 'if [[ -z "''${GH_TOKEN:-}" && -r "${githubTokenFile}" ]]; then export GH_TOKEN="$(< "${githubTokenFile}")"; fi'
+        '';
+      };
+    in
+    {
+      xdg.configFile."git/allowed_signers".text = lib.mkAfter (
+        lib.concatStringsSep "\n" work.allowedSigners
+      );
+      programs.git.includes = [
+        {
+          condition = "gitdir:${config.home.homeDirectory}/yookr/";
+          contents = work.git;
+        }
+      ];
+      programs.gh.package = gh;
+    };
 }

modules/capabilities/yookr-dev.nix

@@ -1,4 +1,16 @@
 {
+  flake.modules.homeManager.yookr-tools =
+    { pkgs, ... }:
+    let
+      tools = import ./yookr-dev/_packages.nix { inherit pkgs; };
+    in
+    {
+      home.packages = [
+        tools.gardenctl
+        tools.gardenlogin
+      ];
+    };
+
   flake.modules.nixos.yookr-dev = {
     security.pki.certificateFiles = [
       ./yookr-dev/zenith-rootCA.pem

modules/capabilities/yookr-dev/_packages.nix

@@ -0,0 +1,30 @@
+{ pkgs }:
+{
+  gardenctl = pkgs.stdenvNoCC.mkDerivation {
+    pname = "gardenctl";
+    version = "2.14.0";
+    src = pkgs.fetchurl {
+      url = "https://github.com/gardener/gardenctl-v2/releases/download/v2.14.0/gardenctl_v2_linux_amd64";
+      hash = "sha256-JCZ0eJLgYbd2ZMCCWFlhX4vOhHKZL40oR2a3EZ3i4Q8=";
+    };
+    dontUnpack = true;
+    installPhase = ''
+      install -Dm755 "$src" "$out/bin/gardenctl"
+      install -d "$out/share/zsh/site-functions"
+      "$out/bin/gardenctl" completion zsh > "$out/share/zsh/site-functions/_gardenctl"
+    '';
+  };
+  gardenlogin = pkgs.stdenvNoCC.mkDerivation {
+    pname = "gardenlogin";
+    version = "0.10.0";
+    src = pkgs.fetchurl {
+      url = "https://github.com/gardener/gardenlogin/releases/download/v0.10.0/gardenlogin_linux_amd64";
+      hash = "sha256-X4nHiZ29Mbnhxv/wlyD6PxX1KxzaX2R27N7Muu/gnH8=";
+    };
+    dontUnpack = true;
+    installPhase = ''
+      install -Dm755 "$src" "$out/bin/gardenlogin"
+      ln -s gardenlogin "$out/bin/kubectl-gardenlogin"
+    '';
+  };
+}

modules/capabilities/yookr-dev/environment.nix

@@ -0,0 +1,34 @@
+{
+  perSystem =
+    { pkgs, ... }:
+    let
+      tools = import ./_packages.nix { inherit pkgs; };
+    in
+    {
+      # Tooling only: no credential loading, mounts, or Python dependency installs.
+      devShells.workbench = pkgs.mkShell {
+        LD_LIBRARY_PATH = pkgs.lib.makeLibraryPath [
+          pkgs.stdenv.cc.cc.lib
+          pkgs.zlib
+        ];
+        UV_PYTHON = "${pkgs.python314}/bin/python";
+        UV_PYTHON_DOWNLOADS = "never";
+        packages = [
+          tools.gardenctl
+          tools.gardenlogin
+        ]
+        ++ (with pkgs; [
+          k9s
+          kubectl
+          kubelogin-oidc
+          jq
+          just
+          python314
+          rclone
+          sops
+          util-linux
+          uv
+        ]);
+      };
+    };
+}

modules/profiles/work.nix

@@ -0,0 +1,22 @@
+{ config, ... }:
+let
+  nixosModules = config.flake.modules.nixos;
+  homeModules = config.flake.modules.homeManager;
+in
+{
+  # Provisional boundary: both workstations select the same company integration.
+  flake.modules.nixos.work = {
+    imports = [
+      nixosModules.openvpn
+      nixosModules.yookr-dev
+    ];
+    home-manager.sharedModules = [ homeModules.work ];
+  };
+
+  flake.modules.homeManager.work = {
+    imports = [
+      homeModules.yookr-tools
+      homeModules.work-git
+    ];
+  };
+}

modules/profiles/workstation-base.nix

@@ -27,9 +27,8 @@ in
       nixosModules.theme
       nixosModules.ai
       nixosModules.yunzi-b75-pro
-      nixosModules.openvpn
       nixosModules.walker
-      nixosModules.yookr-dev
+      nixosModules.work
     ];
 
     programs.nix-ld.enable = true;