configs/nixos/AGENTS.md

@@ -44,3 +44,5 @@
 - `sops.secrets.<name>.owner` must name a user known on the decrypting host.
   Do not set the owner to a guest-only service user unless the host also declares that user.
   Use a host-visible owner plus a shared group mode when the guest service can read the decrypted secret file through its group.
+- Pikachu deploys from the monorepo checkout copied to `~/dev`.
+  Do not use the old `~/wrk/dotfiles` path for remote rebuild commands.

configs/nixos/guests/copyparty.nix

@@ -111,7 +111,14 @@ in
             readOnly = true;
           };
         }
-        // lib.mapAttrs' (_urlPath: volume: lib.nameValuePair volume.path { directory = volume.hostPath; }) cfg.volumes;
+        // lib.mapAttrs' (_urlPath: volume:
+          lib.nameValuePair volume.path {
+            directory = volume.hostPath;
+            owner = "root";
+            group = "storage";
+            mode = "2770";
+          }
+        ) cfg.volumes;
       limits = {
         memory = lib.mkDefault "2G";
         cpu = lib.mkDefault "200%";

configs/nixos/modules/services/copyparty.nix

@@ -34,7 +34,13 @@ let
 
   renderAccess = permission: accounts: "    ${permission}: ${lib.concatStringsSep ", " accounts}";
 
-  renderFlags = flags: lib.concatMapStringsSep "\n" (flag: "    ${flag}") flags;
+  hasFlag = name: flags: lib.any (flag: lib.hasPrefix "${name}:" flag || lib.hasPrefix "${name}=" flag) flags;
+
+  defaultPermissionFlags = flags:
+    lib.optionals (!(hasFlag "chmod_d" flags)) [ "chmod_d: 2770" ]
+    ++ lib.optionals (!(hasFlag "chmod_f" flags)) [ "chmod_f: 660" ];
+
+  renderFlags = flags: lib.concatMapStringsSep "\n" (flag: "    ${flag}") (flags ++ defaultPermissionFlags flags);
 
   renderVolume = urlPath: volume: ''
     [${urlPath}]

configs/nixos/modules/shell/fish/default.nix

@@ -8,8 +8,8 @@
 let
   cfg = config.modules.shell.fish;
   user = config.user.name;
-  shortcuts = config.registry.shell-shortcut.${config.networking.hostName};
-  envVars = config.registry.env-var.${config.networking.hostName};
+  shortcuts = lib.attrByPath [ config.networking.hostName ] { } config.registry.shell-shortcut;
+  envVars = lib.attrByPath [ config.networking.hostName ] { } config.registry.env-var;
   commandsOf = shortcuts: lib.mapAttrs (_name: shortcut: shortcut.command) shortcuts;
   exportEnvVar = name: value: ''
     set -gx ${name} ${lib.escapeShellArg value}

configs/nixos/modules/shell/fish/functions/deploy-to.fish

@@ -48,6 +48,6 @@ end
 
 set escaped_branch (string escape -- $branch)
 set escaped_host (string escape -- $host)
-set remote_command "cd ~/wrk/dotfiles && git fetch origin && git switch -- $escaped_branch && git reset --hard origin/$escaped_branch && sudo nixos-rebuild switch --flake .#$escaped_host --print-build-logs"
+set remote_command "cd ~/dev && git fetch origin && git switch -- $escaped_branch && git reset --hard origin/$escaped_branch && sudo nixos-rebuild switch --flake .#$escaped_host --print-build-logs"
 
 ssh -t $host $remote_command