NixOS configuration
One shared daily environment on Polaris and Zenith, with shared services on Orion. NixOS and Home Manager are composed through flake-parts and import-tree.
Start here
- Design: vocabulary, ownership and coding conventions.
- Agent instructions: essential collaboration boundaries.
- Current work: implementation state, pending decisions and remaining acceptance checks.
Configuration map
| Owner | Location | Responsibility |
|---|---|---|
| Hosts | modules/hosts/<host>/ |
Identity, hardware, machine-specific selection |
| Profiles | modules/profiles/ |
Combinations of capabilities |
| Capabilities | modules/capabilities/ |
Behavior and NixOS/Home Manager integration |
| Facts | modules/facts.nix |
Shared identity/topology; host facts live with hosts |
| Composition | flake.nix, modules/flake-parts.nix |
Inputs, discovery, host construction |
| Secrets | modules/secrets/ |
SOPS declarations and encrypted documents |
Discovery makes named modules available; imports select them. Flat owners use
name.nix or name/default.nix. Private Nix helpers live under _support/, excluded
from discovery. Scripts, assets and operational notes stay beside their owner.
Select shared behavior through profiles; keep machine differences in hosts.
The primary editor is selected in host-base.nix, the terminal in
workstation-base.nix. capabilities/theme/default.nix selects Kanagawa;
application appearance lives in theme/_support/, interaction with capabilities.
Both workstations import the provisional work profile. See
workbench setup for native devenv,
company credentials and always-available read-only mounts. Only company-root and
workbench environments are migrated; product/personal projects remain user-owned.
Maintenance
just validate # format, evaluate, build all hosts and workbench tools
just validate polaris # same workflow, build only the named host(s)
nix flake update # update inputs; selective input updates are also supported
Validation copies current tracked and nonignored new files into a temporary snapshot, respecting deletions and leaving the Git index untouched. It formats included Nix files in the working tree, refreshes the snapshot, prepares devenv's upstream evaluation dependencies, evaluates configurations and builds. Avoid concurrent edits: results describe that snapshot. Ordinary Git-backed flake commands outside the wrapper still require new source files to be added to Git.
Read the short result first. Full logs live in the printed /tmp/nixos-validate-*
directory. Failure stops the command; snapshots are removed on exit. It neither
updates inputs nor creates result links or activates systems. The implementation is
scripts/validate.py; just and Python are installed on both workstations.
Use targeted hosts during iteration and full validation for a completed batch.
Documentation-only changes need review and git diff --check, not system builds.
Build, activation and interactive behavior are separate evidence.
User-owned activation:
nh os switch
nixos-rebuild switch --target-host orion --sudo --flake ~/.config/nixos
Edit system ciphertext with sops edit modules/secrets/secrets.yaml; company
provisioning is documented with workbench. Never put plaintext secrets in Nix.
First-use acceptance
- Notes: Super+N and Walker's Notes open the same picker. Enter opens a note; Ctrl+E creates one using the search text. Daily-note commands remain available.
- Orientation: Super+Shift+N names the focused workspace; submit an empty name to clear it. Named empty workspaces persist until cleared. Noctalia shows labels; terminal titles include the working directory and command.
- Icons/vault: check Oil from Walker and Nautilus device/symbolic icons. Walker's
?vault provider should request unlocking on use, never during desktop startup. - Calendar: in Noctalia Settings → Services → Calendar, set the Radicale password through the existing Personal account (GNOME Keyring). Add an ICS account named Work using Outlook's published URL. Keep this URL in writable Noctalia settings, outside this repository. Check both agendas; edit work events in Outlook.
- Tailnet: run
sudo tailscale upon each machine and enroll the phone with the Tailscale app. Keep Tailscale SSH disabled; use ordinary SSH keys. With MagicDNS enabled, verifyssh kiri@orion.<tailnet-name>.ts.netfrom a workstation. Existingssh orionstill uses the public address until the private route is accepted. Close public Orion SSH only in the subsequent verified transition.
No systems have been activated as part of this implementation. Old SharePoint
mirror content, experimental AI data and unrelated workspace changes are preserved.
Historical material under docs/.archive/ is evidence, not current authority.