initial scaffold: multi-host flake (poppy, muscari, rosemary)

- flake.nix with mkNixos + mkDarwin dispatchers
- hosts/common/{default.nix} (NixOS shared)
- hosts/common-darwin/{default.nix} (darwin shared)
- hosts/poppy/ (M1 MacBook Air, nix-darwin)
- hosts/muscari/ (k3s server, placeholder)
- hosts/rosemary/ (backup VM, placeholder)
- home/default.nix (home-manager for mikl)
- README.md, garden.md (host naming scheme: plants)
- secrets/.gitkeep

old muscari-only config moved to nix-config-legacy/

.gitignore

@@ -0,0 +1,8 @@
+.DS_Store
+*.swp
+*.bak
+result
+result-*
+.direnv/
+*.local.nix
+nh-output/

README.md

@@ -0,0 +1,15 @@
+# nix-config
+
+Nix configurations for iscg infra hosts.
+
+Hosts and naming scheme: see [garden.md](./garden.md).
+
+## rebuild
+
+```bash
+# poppy (macOS)
+darwin-rebuild switch --flake .#poppy
+
+# muscari, rosemary (NixOS)
+sudo nixos-rebuild switch --flake .#<host>
+```

flake.nix

@@ -0,0 +1,77 @@
+{
+  description = "nix-config — multi-host Nix configurations";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+
+    nix-darwin = {
+      url = "github:LnL7/nix-darwin";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    home-manager = {
+      url = "github:nix-community/home-manager";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    disko = {
+      url = "github:nix-community/disko";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs =
+    { self, nixpkgs, nix-darwin, home-manager, sops-nix, disko, ... }:
+    let
+      mkNixos = hostname:
+        nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
+          modules = [
+            ./hosts/common
+            ./hosts/${hostname}
+            sops-nix.nixosModules.sops
+            disko.nixosModules.disko
+            home-manager.nixosModules.home-manager
+            {
+              home-manager = {
+                useGlobalPkgs = true;
+                useUserPackages = true;
+                users.mikl = import ./home;
+              };
+            }
+          ];
+        };
+
+      mkDarwin = hostname:
+        nix-darwin.lib.darwinSystem {
+          system = "aarch64-darwin";
+          modules = [
+            ./hosts/common-darwin
+            ./hosts/${hostname}
+            home-manager.darwinModules.home-manager
+            {
+              home-manager = {
+                useGlobalPkgs = true;
+                useUserPackages = true;
+                users.mikl = import ./home;
+              };
+            }
+          ];
+        };
+    in
+    {
+      nixosConfigurations = {
+        muscari = mkNixos "muscari";
+        rosemary = mkNixos "rosemary";
+      };
+
+      darwinConfigurations = {
+        poppy = mkDarwin "poppy";
+      };
+    };
+}

garden.md

@@ -0,0 +1,32 @@
+# garden
+
+Hosts in this repo are named after plants and flowers.
+
+## hosts
+
+### poppy *(active)*
+- **role:** MacBook Air M1, personal/work machine
+- **system:** nix-darwin, aarch64-darwin
+- **location:** daily driver
+
+### muscari *(planned migration)*
+- **role:** linux server, k3s cluster
+- **system:** NixOS, x86_64-linux
+- **location:** iscg infra
+
+### rosemary *(planned)*
+- **role:** backup VM
+- **system:** NixOS, x86_64-linux
+
+## structure
+
+- `flake.nix` — entry point, dispatches `mkNixos` and `mkDarwin` per host
+- `hosts/<name>/default.nix` — per-host config
+- `hosts/common/default.nix` — shared NixOS config
+- `hosts/common-darwin/default.nix` — shared darwin config
+- `home/default.nix` — shared home-manager config for user `mikl`
+- `secrets/` — sops-encrypted secrets per host
+
+## migrations
+
+- `nix-config-legacy/` — previous muscari-only config (preserved for reference)

home/default.nix

@@ -0,0 +1,13 @@
+{ pkgs, ... }:
+{
+  home.stateVersion = "25.11";
+
+  programs.zsh.enable = true;
+
+  programs.git.enable = true;
+
+  home.packages = [
+    pkgs.ripgrep
+    pkgs.fd
+  ];
+}

hosts/common-darwin/default.nix

@@ -0,0 +1,20 @@
+{ pkgs, ... }:
+{
+  # flake + nix-command
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
+
+  # nix daemon (multi-user install)
+  services.nix-daemon.enable = true;
+
+  users.users.mikl = {
+    home = "/Users/mikl";
+    shell = pkgs.zsh;
+  };
+
+  environment.systemPackages = [
+    pkgs.vim
+  ];
+}

hosts/common/default.nix

@@ -0,0 +1,18 @@
+{ pkgs, ... }:
+{
+  # flake + nix-command
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
+
+  users.users.mikl = {
+    isNormalUser = true;
+    shell = pkgs.zsh;
+    home = "/home/mikl";
+  };
+
+  environment.systemPackages = [
+    pkgs.vim
+  ];
+}

hosts/muscari/default.nix

@@ -0,0 +1,6 @@
+{ ... }:
+{
+  networking.hostName = "muscari";
+
+  # TODO: migrate from nix-config-legacy/hosts/muscari
+}

hosts/poppy/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  networking.hostName = "poppy";
+
+  # Allow unfree packages (some macOS-ported tools need it)
+  nixpkgs.config.allowUnfree = true;
+
+  system.primaryUser = "mikl";
+}

hosts/rosemary/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  networking.hostName = "rosemary";
+}