From 683017fbd2cab6dc67865cb93db95025c1e57af4 Mon Sep 17 00:00:00 2001 From: alexion Date: Tue, 20 Oct 2026 04:07:15 -0400 Subject: [PATCH] docs(nix): clarify style rules --- src/skills/style/nix/rules/dotfiles.md | 16 +++++++++++----- src/skills/style/nix/rules/general.md | 3 +-- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/src/skills/style/nix/rules/dotfiles.md b/src/skills/style/nix/rules/dotfiles.md index 498c34c..897c3b5 100644 --- a/src/skills/style/nix/rules/dotfiles.md +++ b/src/skills/style/nix/rules/dotfiles.md @@ -16,23 +16,29 @@ Run this command to list window classes from the running compositor: hyprctl clients -j | jq -r '.[].class' | sort -u ``` -## Separate guest wiring from host deployment +## Separate guest wrappers from service modules ### Rule -Keep guest modules host-agnostic. +Make each guest module a wrapper around its service module. +Enable the service module through `guests..interior`. +Keep service configuration in `modules.services.`. +Use the guest module to pass paths and secret files to the service module. +Use the guest module to configure bind mounts, resource limits, and registry entries. +Keep guest modules independent of hosts. Put host paths, served volumes, guest addresses, and routes in host configuration. ### Rationale -Guest modules support multiple hosts. -Host configuration owns deployment-specific infrastructure choices. +Service modules support a service without guest infrastructure. +Guest modules adapt a service module to a guest. +Host configuration provides deployment-specific values. ## Decrypt guest secrets on the host ### Rule -Set the owner of a guest secret decrypted by the host to a host user. +Set the secret's owner to a host user before SOPS decrypts it. Give the guest service group read access through a read-only bind mount. ### Rationale diff --git a/src/skills/style/nix/rules/general.md b/src/skills/style/nix/rules/general.md index 364cdb5..73af43e 100644 --- a/src/skills/style/nix/rules/general.md +++ b/src/skills/style/nix/rules/general.md @@ -26,8 +26,7 @@ The utility centralizes Nix file-name normalization. ### Rule -Call library functions as `lib.`. -Do not import individual functions with `inherit (lib)`. +Keep library functions qualified as `lib.`. ### Rationale