alexion
e7d7eb14e1
Add a third auto-loaded kind beside the host and the module: the guest, a reusable definition under guests/ that a host enables like a module and that realizes its interior as a systemd-nspawn nested container. Split the shared base config so a guest can stand on it. base.nix now holds the substrate both bases share — the primary user, home-manager, and the unstable/stable overlays. system.nix keeps the host-only machinery, and a new guest.nix is the slim guest-base: it imports the full modules tree, pins the interior release, and auto-enables the toolkit bundle and SSH so any guest is workable on sight. Give modules.ssh a guest flavor. A host restores its host keys from secrets as before, while a guest sets hostKeys.restore = false, names no sops files, and self-generates a host key, so it holds no age key of its own. The lib grows a guest helper that declares the guests.<path> namespace with an enable and a backend field. Only the container backend is built; microvm is a reserved value that trips a clear build-time assertion rather than silently building nothing. A sample guest exercises the whole path, and neogaia enables it, so the guest interior builds through the existing nix flake check seam.
61 lines
1.8 KiB
Nix
61 lines
1.8 KiB
Nix
{
|
|
config,
|
|
inputs,
|
|
pkgs,
|
|
...
|
|
}:
|
|
# neogaia — Dell XPS 13 9380 laptop.
|
|
# Disk layout is in ./disk.nix.
|
|
# `fileSystems` are derived from it, none declared here.
|
|
{
|
|
imports = [
|
|
inputs.nixos-hardware.nixosModules.dell-xps-13-9380
|
|
./hardware-configuration.nix
|
|
./disk.nix
|
|
];
|
|
|
|
system.stateVersion = "26.05";
|
|
|
|
# systemd-boot on the EFI system partition.
|
|
boot.loader.systemd-boot.enable = true;
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
|
|
boot.kernelPackages = pkgs.linuxPackages_cachyos;
|
|
|
|
# Redistributable firmware for the QCA6174 wifi (ath10k blobs).
|
|
# Intel microcode updates follow from this, so none is declared here.
|
|
hardware.enableRedistributableFirmware = true;
|
|
|
|
# RAM-backed swap, no on-disk swap partition.
|
|
zramSwap.enable = true;
|
|
|
|
# So wifi can be joined from the console.
|
|
networking.networkmanager.enable = true;
|
|
|
|
# So setup can be driven over the network.
|
|
# The matching host public keys sit beside this file in plaintext, since
|
|
# publishing them is their purpose.
|
|
modules.ssh.enable = true;
|
|
modules.ssh.hostKeys.sopsFile = ../../secrets/neogaia.yaml;
|
|
modules.ssh.userKey.sopsFile = ../../secrets/neogaia.yaml;
|
|
|
|
# A machine the operator works from, so it admits the workstation keys alone.
|
|
modules.ssh.authorizedKeys = config.modules.ssh.workstationKeys;
|
|
|
|
modules.toolkit.enable = true;
|
|
|
|
# The walking-skeleton guest, enabled like any module: proves the guest path
|
|
# end to end through this host's `nix flake check`.
|
|
guests.sample.enable = true;
|
|
|
|
modules.agents.claude-code.enable = true;
|
|
modules.agents.tools.gitea-axi.enable = true;
|
|
modules.agents.pi.enable = true;
|
|
|
|
modules.desktop.enable = true;
|
|
modules.desktop.obsidian.enable = true;
|
|
|
|
time.timeZone = "America/New_York";
|
|
i18n.defaultLocale = "en_GB.UTF-8";
|
|
}
|