configs/nixos/AGENTS.md

@@ -46,3 +46,5 @@
   Use a host-visible owner plus a shared group mode when the guest service can read the decrypted secret file through its group.
 - Pikachu deploys from the monorepo checkout copied to `~/dev`.
   Do not use the old `~/wrk/dotfiles` path for remote rebuild commands.
+- Do not hand-author `hardware-configuration.nix` for a host that has not been generated on that machine.
+  Generate it on the target system or live ISO, then stage it before evaluating the flake.

configs/nixos/hosts/zeus/default.nix

@@ -0,0 +1,44 @@
+{ lib, pkgs, ... }:
+# zeus — Ryzen desktop with AMD graphics.
+# Disk layout is in ./disk.nix.
+# `fileSystems` are derived from it, none declared here.
+{
+  imports = [ ./disk.nix ] ++ lib.optional (builtins.pathExists ./hardware-configuration.nix) ./hardware-configuration.nix;
+
+  system.stateVersion = "26.05";
+  nixpkgs.hostPlatform = "x86_64-linux";
+
+  # systemd-boot on the EFI system partition.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  boot.kernelPackages = pkgs.linuxPackages_cachyos;
+
+  hardware.enableRedistributableFirmware = true;
+  hardware.graphics = {
+    enable = true;
+    enable32Bit = true;
+  };
+
+  # RAM-backed swap, no on-disk swap partition.
+  zramSwap.enable = true;
+
+  networking.networkmanager.enable = true;
+
+  hardware.bluetooth = {
+    enable = true;
+    powerOnBoot = true;
+  };
+
+  modules.monorepo.enable = true;
+  modules.shell.herdr.enable = true;
+  modules.shell.gitea-axi.enable = true;
+  modules.shell.pi.enable = true;
+
+  modules.desktop.enable = true;
+  modules.desktop.apps.obsidian.enable = true;
+  modules.desktop.apps.steam.enable = true;
+
+  time.timeZone = "America/New_York";
+  i18n.defaultLocale = "en_GB.UTF-8";
+}

configs/nixos/hosts/zeus/disk.nix

@@ -0,0 +1,61 @@
+{ ... }:
+# zeus's disk layout for disko: one NVMe disk, GPT, with an EFI system
+# partition and a LUKS container holding btrfs subvolumes.
+# No swap partition, since swap is zram.
+# disko derives `fileSystems` and `boot.initrd.luks.devices` from this.
+{
+  disko.devices.disk.main = {
+    type = "disk";
+    device = "/dev/nvme0n1";
+    content = {
+      type = "gpt";
+      partitions = {
+        ESP = {
+          size = "2G";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+            mountOptions = [ "umask=0077" ];
+          };
+        };
+        luks = {
+          size = "100%";
+          content = {
+            type = "luks";
+            name = "cryptroot";
+            settings.allowDiscards = true;
+            content = {
+              type = "btrfs";
+              extraArgs = [ "-f" ];
+              subvolumes = {
+                "@root" = {
+                  mountpoint = "/";
+                  mountOptions = [
+                    "compress=zstd"
+                    "noatime"
+                  ];
+                };
+                "@home" = {
+                  mountpoint = "/home";
+                  mountOptions = [
+                    "compress=zstd"
+                    "noatime"
+                  ];
+                };
+                "@nix" = {
+                  mountpoint = "/nix";
+                  mountOptions = [
+                    "compress=zstd"
+                    "noatime"
+                  ];
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}