NixOS configuration

One shared daily environment on Polaris and Zenith, with shared services on Orion. NixOS and Home Manager are composed through flake-parts and import-tree.

Start here

• Design: vocabulary, ownership and coding conventions.
• Agent instructions: essential collaboration boundaries.
• Current work: implementation state, pending decisions and remaining acceptance checks.

Configuration map

Owner	Location	Responsibility
Hosts	modules/hosts/<host>/	Identity, hardware, machine-specific selection
Profiles	modules/profiles/	Combinations of capabilities
Capabilities	modules/capabilities/	Behavior and NixOS/Home Manager integration
Facts	modules/facts.nix	Shared identity/topology; host facts live with hosts
Composition	flake.nix, modules/flake-parts.nix	Inputs, discovery, host construction
Secrets	modules/secrets/	SOPS declarations and encrypted documents

Discovery makes named modules available; imports select them. Flat owners use name.nix or name/default.nix. Private Nix helpers live under _support/, excluded from discovery. Scripts, assets and operational notes stay beside their owner. Select shared behavior through profiles; keep machine differences in hosts.

The primary editor is selected in host-base.nix, the terminal in workstation-base.nix. capabilities/theme/default.nix selects Kanagawa; application appearance lives in theme/_support/, interaction with capabilities.

Both workstations import the provisional work profile. See workbench setup for native devenv, company credentials and always-available read-only mounts. Only company-root and workbench environments are migrated; product/personal projects remain user-owned.

Orion's wardrobe service has its own setup and operations guide. Provision its SOPS secrets and two DNS records before building or activating Orion.

Maintenance

just validate          # format, evaluate, build all hosts and workbench tools
just validate polaris  # same workflow, build only the named host(s)
nix flake update       # update inputs; selective input updates are also supported

Validation copies current tracked and nonignored new files into a temporary snapshot, respecting deletions and leaving the Git index untouched. It formats included Nix files in the working tree, refreshes the snapshot, prepares devenv's upstream evaluation dependencies, evaluates configurations and builds. Avoid concurrent edits: results describe that snapshot. Ordinary Git-backed flake commands outside the wrapper still require new source files to be added to Git.

Read the short result first. Full logs live in the printed /tmp/nixos-validate-* directory. Failure stops the command; snapshots are removed on exit. It neither updates inputs nor creates result links or activates systems. The implementation is scripts/validate.py; just and Python are installed on both workstations.

Run targeted host builds or full validation only when explicitly requested. Routine changes need a focused review or small manual check. Build, activation and interactive behavior are separate evidence.

User-owned activation:

nh os switch
nixos-rebuild switch --target-host orion --sudo --flake ~/.config/nixos

Edit system ciphertext with sops edit modules/secrets/secrets.yaml; company provisioning is documented with workbench. Never put plaintext secrets in Nix.

First-use acceptance

• Notes: Super+N and Walker's Notes open the same picker. Enter opens a note; Ctrl+E creates one using the search text. Daily-note commands remain available.
• Orientation: Super+Shift+N names the focused workspace; submit an empty name to clear it. Named empty workspaces persist until cleared. Noctalia shows labels; terminal titles include the working directory and command.
• Icons/vault: check Oil from Walker and Nautilus device/symbolic icons. Check Walker's ? vault provider; upstream Elephant may query rbw during startup.
• Calendar: in Noctalia Settings → Services → Calendar, set the Radicale password through the existing Personal account (GNOME Keyring). Add an ICS account named Work using Outlook's published URL. Keep this URL in writable Noctalia settings, outside this repository. Check both agendas; edit work events in Outlook.
• Tailnet: run sudo tailscale up on each machine and enroll the phone with the Tailscale app. Keep Tailscale SSH disabled; use ordinary SSH keys. With MagicDNS enabled, verify ssh kiri@orion.<tailnet-name>.ts.net from a workstation. Existing ssh orion still uses the public address until the private route is accepted. Close public Orion SSH only in the subsequent verified transition.

No systems have been activated as part of this implementation. Old SharePoint mirror content, experimental AI data and unrelated workspace changes are preserved. Historical material under docs/.archive/ is evidence, not current authority.