harivansh-afk/nix
1
1
Fork 0
mirror of https://github.com/harivansh-afk/nix.git synced 2026-04-15 12:03:52 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

update readme

Browse source
This commit is contained in:
Harivansh Rathi 2026-03-31 00:31:47 -04:00
parent 39ad1ff7a4
commit 65715b8ea4
1 changed files with 8 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

16
README.md
View file

@ -1,17 +1,17 @@
# Nix Leveraging
[flake.nix](./flake.nix) is the root lever: one flake, one lockfile, one graph for both macOS and Linux. [modules/hosts/darwin.nix](./modules/hosts/darwin.nix) composes `nix-darwin`, `home-manager`, and `nix-homebrew`; [modules/hosts/netty.nix](./modules/hosts/netty.nix) composes `nixosSystem`, `disko`, and `home-manager`. The point is not “using Nix”; it is collapsing laptop state and VPS state into one reproducible interface.
Everything starts at [flake.nix](./flake.nix) — one one dependency graph that owns both a macOS laptop and a Netcup VPS. Instead of managing two machines with different tools, both collapse into the same reproducible interface.
[modules/nixpkgs.nix](./modules/nixpkgs.nix) and [lib/hosts.nix](./lib/hosts.nix) are the next leverage layer. They define the global `username`, per-host metadata, feature flags, and the `specialArgs` boundary. That removes random `isDarwin` checks from leaf modules and turns host differences into data.
At the machine level, [modules/hosts/darwin.nix](./modules/hosts/darwin.nix) composes `nix-darwin`, `home-manager`, and `nix-homebrew` for macOS, while [modules/hosts/netty.nix](./modules/hosts/netty.nix) composes `nixosSystem`, `disko`, and `home-manager` for the server. The differences between hosts are encoded as data in [lib/hosts.nix](./lib/hosts.nix) and [modules/nixpkgs.nix](./modules/nixpkgs.nix) — global username, per-host metadata, feature flags — so leaf modules never need ad hoc platform checks.
[lib/package-sets.nix](./lib/package-sets.nix), [modules/base.nix](./modules/base.nix), [modules/packages.nix](./modules/packages.nix), and [modules/homebrew.nix](./modules/homebrew.nix) are the package policy. `core`, `extras`, and `fonts` give one place to reason about the machine surface; custom inputs like `googleworkspace-cli`, `claude-code-nix`, `OpenSpec`, `neovim-nightly`, `nix-homebrew`, and `disko` are pinned in [flake.nix](./flake.nix) instead of installed ad hoc.
One layer down, packages are policy. [lib/package-sets.nix](./lib/package-sets.nix), [modules/base.nix](./modules/base.nix), [modules/packages.nix](./modules/packages.nix), and [modules/homebrew.nix](./modules/homebrew.nix) split the machine surface into `core`, `extras`, and `fonts`. Custom inputs like `claude-code-nix`, `neovim-nightly`, `disko`, and `nix-homebrew` are pinned in the flake, not installed by hand.
[home/default.nix](./home/default.nix) and [home/common.nix](./home/common.nix) turn Home Manager into the userland control plane. [home/xdg.nix](./home/xdg.nix) pushes Rust, Go, Node, Python, AWS, Claude, npm, wget, psql, and sqlite into XDG paths; [home/security.nix](./home/security.nix) fixes SSH and GPG permissions on activation; [home/migration.nix](./home/migration.nix) cleans legacy `~/dots` links during the cutover instead of relying on manual cleanup.
Below system packages sits the user environment. [home/default.nix](./home/default.nix) and [home/common.nix](./home/common.nix) make Home Manager the userland control plane. [home/xdg.nix](./home/xdg.nix) routes Rust, Go, Node, Python, AWS, and a dozen other tools into XDG-compliant paths. [home/security.nix](./home/security.nix) locks down SSH and GPG permissions on every activation. [home/migration.nix](./home/migration.nix) handles the cutover from legacy `~/dots` symlinks so nothing is left to clean up manually.
[lib/theme.nix](./lib/theme.nix), [home/ghostty.nix](./home/ghostty.nix), [home/tmux.nix](./home/tmux.nix), [home/zsh.nix](./home/zsh.nix), and [home/scripts.nix](./home/scripts.nix) are the ergonomic leverage. One palette renders Ghostty, tmux, fzf, zsh highlights, bat, and delta. The generated `theme` script hot-swaps light/dark across those surfaces. tmux gets session restore, directory-based window names, and a generated session list; zsh gets vi mode, cursor-shape switching, XDG history, prompt theming, and deterministic PATH assembly.
The shell and terminal layer is driven by a single palette in [lib/theme.nix](./lib/theme.nix). That one definition renders colors for Ghostty, tmux, fzf, zsh syntax highlighting, bat, and delta. A generated `theme` script hot-swaps light and dark across all of them. [home/tmux.nix](./home/tmux.nix) adds session restore and directory-based window names. [home/zsh.nix](./home/zsh.nix) sets up vi mode, cursor-shape switching, XDG history, and deterministic PATH assembly. [home/scripts.nix](./home/scripts.nix) rounds out the ergonomics.
[home/nvim.nix](./home/nvim.nix), [home/codex.nix](./home/codex.nix), [home/claude.nix](./home/claude.nix), and [home/skills.nix](./home/skills.nix) are the agent/editor layer. Neovim is pinned with the nightly overlay and seeded lockfile state; Codex and Claude configs are repo-owned; global skills are installed declaratively via `npx skills add -g` and hash-stamped so the activation only resyncs when the manifest changes.
At the editor and agent layer, [home/nvim.nix](./home/nvim.nix) pins Neovim to the nightly overlay with seeded lockfile state. [home/claude.nix](./home/claude.nix) and [home/codex.nix](./home/codex.nix) keep AI tool configs repo-owned rather than scattered across `$HOME`. [home/skills.nix](./home/skills.nix) installs global skills declaratively and only resyncs when the manifest hash changes.
[scripts/default.nix](./scripts/default.nix), [justfile](./justfile), [scripts/render-bw-shell-secrets.sh](./scripts/render-bw-shell-secrets.sh), and [scripts/restore-bw-files.sh](./scripts/restore-bw-files.sh) are the operational leverage. `writeShellApplication` turns local scripts into managed tools (`ga`, `ghpr`, `gpr`, `ni`, `theme`, `wt`, `wtc`); Bitwarden stays the secret source of truth; `just switch`, `just switch-netty`, and `nixos-anywhere` keep deployment small.
For day-to-day operations, [scripts/default.nix](./scripts/default.nix) wraps local scripts into managed tools (`ga`, `ghpr`, `gpr`, `ni`, `theme`, `wt`, `wtc`) via `writeShellApplication`. Secrets stay in Bitwarden and are rendered at activation time by [scripts/render-bw-shell-secrets.sh](./scripts/render-bw-shell-secrets.sh) and [scripts/restore-bw-files.sh](./scripts/restore-bw-files.sh). Deployment is `just switch` for the laptop and `just switch-netty` for the server.
Finally, [hosts/netty/configuration.nix](./hosts/netty/configuration.nix) turns the VPS into a declarative service bundle: static networking, nginx + ACME, Forgejo with GitHub mirror sync, sandbox-agent plus its CORS proxy, bounded GC/journald retention, and a machine that can be rebuilt instead of repaired.
At the bottom of the stack, the VPS itself is a declarative service bundle in [hosts/netty/configuration.nix](./hosts/netty/configuration.nix): static networking, nginx with ACME, Forgejo mirroring to GitHub, a sandbox agent behind a CORS proxy, bounded GC and journald retention — a machine built to be rebuilt, not repaired.