refactor(nix): expose app outputs directly

docs/TODO.md

@@ -99,6 +99,7 @@
 # tech debt
 
 - better remote deployment
+- expose remote deployment as a flake app, replacing the Fish-only `deploy-to` workflow
 - centralize shared system group names, starting with the `storage` group
 
 ## nix refactor

flake.lock

@@ -465,7 +465,8 @@
         "nixpkgs-unstable": "nixpkgs-unstable",
         "nixvim": "nixvim",
         "sops-nix": "sops-nix",
-        "stylix": "stylix"
+        "stylix": "stylix",
+        "treefmt-nix": "treefmt-nix"
       }
     },
     "sops-nix": {
@@ -617,6 +618,26 @@
         "repo": "base16-zed",
         "type": "github"
       }
+    },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1786901030,
+        "narHash": "sha256-WSFCsDSE5ffgD2MqzkM2CYjeFiKhRF/dJUN8uedb6YE=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "27b3b12a8e6375f28ebe122f07d230ca5459bbfa",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -62,6 +62,12 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    # Repository formatter and Nix lint wiring.
+    treefmt-nix = {
+      url = "github:numtide/treefmt-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     # CachyOS kernel and binary cache.
     # This must not follow this flake's nixpkgs because Chaotic builds against its own pinned package set.
     # Its cache serves the kernel only when the overlay stays on the cache-friendly path.
@@ -70,11 +76,9 @@
 
   outputs =
     { self, nixpkgs, ... }@inputs:
-    {
-      nixosConfigurations = (import ./src/dotfiles {
-        inherit inputs self;
-        lib = nixpkgs.lib;
-        root = ./configs/nixos;
-      }).nixosConfigurations;
+    import ./src/dotfiles {
+      inherit inputs self;
+      lib = nixpkgs.lib;
+      root = ./configs/nixos;
     };
 }

src/dotfiles/apps.nix

@@ -0,0 +1,40 @@
+{
+  inputs,
+  lib,
+}:
+let
+  system = "x86_64-linux";
+  pkgs = inputs.nixpkgs.legacyPackages.${system};
+
+  treefmtEval = inputs.treefmt-nix.lib.evalModule pkgs {
+    projectRootFile = "flake.nix";
+
+    programs.nixfmt.enable = true;
+
+    settings.formatter.nixfmt.excludes = [
+      "configs/nixos/hosts/*/hardware-configuration.nix"
+    ];
+  };
+
+  styleCheck = pkgs.writeShellApplication {
+    name = "style-check";
+    runtimeInputs = [
+      treefmtEval.config.build.wrapper
+      pkgs.statix
+      pkgs.deadnix
+    ];
+    text = ''
+      treefmt --fail-on-change
+      statix check .
+      deadnix --fail --no-lambda-pattern-names --no-underscore .
+    '';
+  };
+in
+{
+  formatter.${system} = treefmtEval.config.build.wrapper;
+
+  apps.${system}.style-check = {
+    type = "app";
+    program = lib.getExe styleCheck;
+  };
+}

src/dotfiles/default.nix

@@ -40,6 +40,17 @@ let
   };
 in
 {
+  inherit
+    (import ./apps.nix {
+      inherit
+        inputs
+        lib
+        ;
+    })
+    apps
+    formatter
+    ;
+
   nixosConfigurations = import ./hosts.nix {
     inherit
       inputs

statix.toml

@@ -0,0 +1,3 @@
+disabled = [
+  "repeated_keys",
+]