98 lines
5.1 KiB
Markdown
98 lines
5.1 KiB
Markdown
# NixOS configuration
|
|
|
|
One shared daily environment on Polaris and Zenith, with shared services on Orion.
|
|
NixOS and Home Manager are composed through flake-parts and import-tree.
|
|
|
|
## Start here
|
|
|
|
- [Design](docs/design.md): vocabulary, ownership and coding conventions.
|
|
- [Agent instructions](AGENTS.md): essential collaboration boundaries.
|
|
- [Current work](docs/current-work.md): implementation state, pending decisions and
|
|
remaining acceptance checks.
|
|
|
|
## Configuration map
|
|
|
|
| Owner | Location | Responsibility |
|
|
| --- | --- | --- |
|
|
| Hosts | `modules/hosts/<host>/` | Identity, hardware, machine-specific selection |
|
|
| Profiles | `modules/profiles/` | Combinations of capabilities |
|
|
| Capabilities | `modules/capabilities/` | Behavior and NixOS/Home Manager integration |
|
|
| Facts | `modules/facts.nix` | Shared identity/topology; host facts live with hosts |
|
|
| Composition | `flake.nix`, `modules/flake-parts.nix` | Inputs, discovery, host construction |
|
|
| Secrets | `modules/secrets/` | SOPS declarations and encrypted documents |
|
|
|
|
Discovery makes named modules available; imports select them. Flat owners use
|
|
`name.nix` or `name/default.nix`. Private Nix helpers live under `_support/`, excluded
|
|
from discovery. Scripts, assets and operational notes stay beside their owner.
|
|
Select shared behavior through profiles; keep machine differences in hosts.
|
|
|
|
The primary editor is selected in `host-base.nix`, the terminal in
|
|
`workstation-base.nix`. `capabilities/theme/default.nix` selects Kanagawa;
|
|
application appearance lives in `theme/_support/`, interaction with capabilities.
|
|
|
|
Both workstations import the provisional `work` profile. See
|
|
[workbench setup](modules/capabilities/workbench/README.md) for native devenv,
|
|
company credentials and always-available read-only mounts. Only company-root and
|
|
workbench environments are migrated; product/personal projects remain user-owned.
|
|
|
|
Orion's wardrobe service has its own
|
|
[setup and operations guide](modules/capabilities/wardrowbe/README.md).
|
|
Provision its SOPS secrets and two DNS records before building or activating Orion.
|
|
|
|
## Maintenance
|
|
|
|
```console
|
|
just validate # format, evaluate, build all hosts and workbench tools
|
|
just validate polaris # same workflow, build only the named host(s)
|
|
nix flake update # update inputs; selective input updates are also supported
|
|
```
|
|
|
|
Validation copies current tracked and nonignored new files into a temporary snapshot,
|
|
respecting deletions and leaving the Git index untouched. It formats included Nix
|
|
files in the working tree, refreshes the snapshot, prepares devenv's upstream
|
|
evaluation dependencies, evaluates configurations and builds. Avoid concurrent edits:
|
|
results describe that snapshot. Ordinary Git-backed flake commands outside the
|
|
wrapper still require new source files to be added to Git.
|
|
|
|
Read the short result first. Full logs live in the printed `/tmp/nixos-validate-*`
|
|
directory. Failure stops the command; snapshots are removed on exit. It neither
|
|
updates inputs nor creates result links or activates systems. The implementation is
|
|
`scripts/validate.py`; `just` and Python are installed on both workstations.
|
|
|
|
Run targeted host builds or full validation only when explicitly requested. Routine
|
|
changes need a focused review or small manual check. Build, activation and
|
|
interactive behavior are separate evidence.
|
|
|
|
User-owned activation:
|
|
|
|
```console
|
|
nh os switch
|
|
nixos-rebuild switch --target-host orion --sudo --flake ~/.config/nixos
|
|
```
|
|
|
|
Edit system ciphertext with `sops edit modules/secrets/secrets.yaml`; company
|
|
provisioning is documented with workbench. Never put plaintext secrets in Nix.
|
|
|
|
## First-use acceptance
|
|
|
|
- **Notes:** Super+N and Walker's Notes open the same picker. Enter opens a note;
|
|
Ctrl+E creates one using the search text. Daily-note commands remain available.
|
|
- **Orientation:** Super+Shift+N names the focused workspace; submit an empty name
|
|
to clear it. Named empty workspaces persist until cleared. Noctalia shows labels;
|
|
terminal titles include the working directory and command.
|
|
- **Icons/vault:** check Oil from Walker and Nautilus device/symbolic icons. Check
|
|
Walker's `?` vault provider; upstream Elephant may query `rbw` during startup.
|
|
- **Calendar:** in Noctalia Settings → Services → Calendar, set the Radicale
|
|
password through the existing Personal account (GNOME Keyring). Add an ICS account
|
|
named Work using Outlook's published URL. Keep this URL in writable Noctalia
|
|
settings, outside this repository. Check both agendas; edit work events in Outlook.
|
|
- **Tailnet:** run `sudo tailscale up` on each machine and enroll the phone with
|
|
the Tailscale app. Keep Tailscale SSH disabled; use ordinary SSH keys. With
|
|
MagicDNS enabled, verify `ssh kiri@orion.<tailnet-name>.ts.net` from a workstation.
|
|
Existing `ssh orion` still uses the public address until the private route is
|
|
accepted. Close public Orion SSH only in the subsequent verified transition.
|
|
|
|
No systems have been activated as part of this implementation. Old SharePoint
|
|
mirror content, experimental AI data and unrelated workspace changes are preserved.
|
|
Historical material under `docs/.archive/` is evidence, not current authority.
|