alexion
5e254857b9
Supersede ADR 0001's SSH-derived key mechanism with an admin identity held outside the repo plus a per-host identity on each encrypted root. Decoupling the two is what lets the SSH host keys become secrets themselves rather than the root of trust they were. Add the spec, the three implementing tasks, and the glossary terms the breakdown speaks in.
2.5 KiB
NixOS Dotfiles
A single flake that builds every machine the user owns — laptop, desktop, and three servers — from one shared, modular configuration.
Language
Host:
One physical machine the flake builds a NixOS configuration for. Each Host has a directory under hosts/ holding its machine-specific hardware-configuration.nix and its choice of enabled Modules.
Avoid: machine, node, system, box
Module:
A single .nix feature file under modules/ that declares an enable option and the configuration it turns on. Every Module is always imported but stays inert until a Host enables it.
Avoid: component, package, plugin
Skeleton: The flake's plumbing — the Auto-loader, the helper lib, the flake inputs/overlays, and the shared base config — as distinct from the Modules that sit on top of it. Avoid: framework, core, base, scaffolding
Auto-loader:
The lib code that recursively discovers and imports every Module under modules/ (and every Host under hosts/) so new files wire themselves in without manual imports edits.
Avoid: loader, importer, scanner
Enable convention:
The rule that every Module is imported unconditionally and guards its own body with mkIf config.modules.<path>.enable, so a Host reads as a checklist of enable = true flags.
Avoid: feature flag, toggle, opt-in
admin identity: The age identity held only in the operator's password manager, never committed, that is a recipient of every secrets file. It is the recovery path for any wiped machine and the credential that authorizes registering a new host. Avoid: master key, admin key, root key
host identity: The dedicated age key on one machine's encrypted root, generated there and never transmitted, that decrypts that machine's own secrets and the shared file. Deliberately distinct from the machine's SSH host key. Avoid: machine key, node key, host key
secrets file: One sops-encrypted file in the repo, encrypted to the admin identity plus whichever hosts may read it. Either shared across every host or specific to one. Avoid: vault, secret store, keyring
unstable overlay:
The overlay exposing nixpkgs-unstable packages as unstable.<name>, used to pull an individual package fresher than the nixos-unstable base.
Avoid: bleeding-edge, latest
stable overlay:
The overlay exposing the latest stable release (nixos-26.05) as stable.<name>, used to pin an individual package to the rock-solid release from the nixos-unstable base.
Avoid: LTS, release channel