refactor(nixos): organize host modules

configs/nixos/AGENTS.md

@@ -63,3 +63,4 @@
   Generate it on the target system or live ISO, then stage it before evaluating the flake.
 - Configure the Chaotic Nyx cache only on hosts that select `linuxPackages_cachyos` (currently Neogaia
   and Zeus), not in the generic host module.
+- Module-relative paths resolve from the module file. Update them when moving a module into a subdirectory.

configs/nixos/hosts/neogaia/default.nix

@@ -12,7 +12,7 @@
     ./disk.nix
   ];
 
-  modules.kernel.cachyos.enable = true;
+  modules.host.cachyos.enable = true;
 
   # So wifi can be joined from the console.
   networking.networkmanager.enable = true;

configs/nixos/hosts/pikachu/default.nix

@@ -58,9 +58,8 @@
 
   boot.zfs.forceImportRoot = false;
 
-  modules.zfs = {
+  modules.host.zfs = {
     enable = true;
-    hostId = "2346edbd";
     pools.pikachu = { };
   };
 

configs/nixos/hosts/zeus/default.nix

@@ -14,7 +14,7 @@
 
   nixpkgs.hostPlatform = "x86_64-linux";
 
-  modules.kernel.cachyos.enable = true;
+  modules.host.cachyos.enable = true;
 
   hardware.graphics = {
     enable = true;

configs/nixos/modules/host/cachyos.nix

@@ -5,9 +5,9 @@
   ...
 }:
 {
-  options.modules.kernel.cachyos.enable = lib.mkEnableOption "CachyOS kernel";
+  options.modules.host.cachyos.enable = lib.mkEnableOption "CachyOS kernel";
 
-  config = lib.mkIf config.modules.kernel.cachyos.enable {
+  config = lib.mkIf config.modules.host.cachyos.enable {
     boot.kernelPackages = pkgs.linuxPackages_cachyos;
 
     nix.settings.extra-substituters = [ "https://nyx-cache.chaotic.cx/" ];

configs/nixos/modules/host/default.nix

@@ -5,7 +5,7 @@
   ...
 }:
 let
-  hostSecrets = ../secrets + "/${config.networking.hostName}.yaml";
+  hostSecrets = ../../secrets + "/${config.networking.hostName}.yaml";
 in
 {
   options.modules.host.enable = lib.mkEnableOption "physical host configuration";
@@ -33,7 +33,7 @@ in
     services.xserver.xkb.options = "caps:escape_shifted_capslock";
     console.useXkbConfig = true;
 
-    sops.defaultSopsFile = ../secrets/shared.yaml;
+    sops.defaultSopsFile = ../../secrets/shared.yaml;
     sops.age.keyFile = "/var/lib/sops-nix/key.txt";
     sops.age.sshKeyPaths = [ ];
     sops.gnupg.sshKeyPaths = [ ];

configs/nixos/modules/host/zfs.nix

@@ -5,24 +5,12 @@
 }:
 # The host-level ZFS pool import: durable service state a host mounts, never rebuilds.
 let
-  cfg = config.modules.zfs; # NOLINT(let_order)
+  cfg = config.modules.host.zfs; # NOLINT(let_order)
 in
 {
-  options.modules.zfs = {
+  options.modules.host.zfs = {
     enable = lib.mkEnableOption "importing durable ZFS pools that hold service state";
 
-    hostId = lib.mkOption {
-      type = lib.types.strMatching "[0-9a-f]{8}";
-      example = "deadbeef";
-      description = ''
-        This host's 8-hex-digit ZFS host id, written to `networking.hostId`. ZFS
-        stamps an imported pool with the importing host's id, so a pool still
-        held by another machine is refused rather than silently dual-mounted. It
-        must be fixed for the machine and distinct across machines that can reach
-        the same pool.
-      '';
-    };
-
     pools = lib.mkOption {
       type = lib.types.attrsOf (lib.types.attrsOf lib.types.path);
       default = { };
@@ -49,8 +37,10 @@ in
     # The ZFS stack in the kernel and boot, needed even where the root filesystem is another kind.
     boot.supportedFilesystems = [ "zfs" ];
 
-    # ZFS refuses to import a pool without a host id to stamp its ownership onto.
+    # Derive a stable 32-bit host ID from the configured hostname.
-    networking.hostId = cfg.hostId;
+    networking.hostId = builtins.substring 0 8 (
+      builtins.hashString "sha256" config.networking.hostName
+    );
 
     # The declared pools are imported at boot, distinct from any pool backing the root filesystem.
     boot.zfs.extraPools = lib.attrNames cfg.pools;